@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/sdk/runtimeContext-BpObgzbj.js

@@ -1,6 +0,0 @@
-import{r as e}from"./chunk-dVx5-UGu.js";import{B as t,C as n,D as r,M as i,N as a,O as o,S as s,T as c,V as l,b as u,c as d,d as f,h as p,j as m,k as h,l as g,m as _,n as v,p as y,r as b,t as x,u as S,v as C,w,x as T}from"./domainIds-GDzjOs6i.js";import{_ as E,c as ee,d as D,h as O,n as k,p as A,u as j,x as te,y as M}from"./validation-dC1-_uyG.js";import{r as ne}from"./transactionReviewAdmission-0ZgWs6q3.js";import{a as re,n as ie,r as ae,t as oe}from"./base-Xtd32asf.js";import{t as se}from"./walletIframeIdentity-C0b0XMQF.js";import{b as ce}from"./messages-Cv2j4SKI.js";import{i as le,n as ue,o as N,t as P}from"./errors-DfbnsXjO.js";import{i as F,n as de,r as I}from"./base64-ojm5DKcF.js";import{n as fe,r as pe,t as me}from"./secureRandomId-CTdlJ5Mx.js";import{$ as he,$t as ge,A as _e,At as ve,B as ye,Bt as be,C as xe,Ct as Se,D as Ce,Dt as we,E as Te,Et as Ee,F as De,Ft as Oe,G as ke,Gt as Ae,H as je,Ht as Me,I as Ne,It as Pe,J as Fe,Jt as Ie,K as Le,Kt as Re,L as ze,Lt as Be,M as Ve,Mt as He,N as Ue,Nt as We,O as Ge,Ot as Ke,P as qe,Pt as Je,Q as Ye,Qt as Xe,R as Ze,Rt as Qe,S as $e,St as et,T as tt,Tt as nt,U as rt,Ut as it,V as at,Vt as ot,W as st,Wt as ct,X as lt,Xt as ut,Y as dt,Yt as ft,Z as pt,Zt as mt,_ as ht,_t as gt,a as _t,at as vt,b as yt,bt,c as xt,ct as St,d as Ct,dt as wt,en as Tt,et as Et,f as Dt,ft as Ot,g as kt,gt as At,h as jt,ht as Mt,it as Nt,j as Pt,jt as Ft,k as It,kt as Lt,l as Rt,lt as zt,m as Bt,mt as Vt,nt as Ht,ot as Ut,p as Wt,pt as Gt,q as Kt,qt,rt as Jt,st as Yt,t as Xt,tt as Zt,u as Qt,ut as $t,v as en,vt as tn,w as nn,wt as rn,x as an,xt as on,y as sn,yt as cn,z as ln,zt as un}from"./registration-CSAG_h4Y.js";import{C as dn,D as fn,E as pn,I as mn,O as hn,S as gn,T as _n,_ as vn,a as yn,b as bn,c as xn,d as Sn,f as Cn,g as wn,h as Tn,i as En,j as Dn,k as On,l as kn,o as An,p as jn,r as Mn,t as Nn,u as Pn,v as Fn,w as In,x as Ln,y as Rn}from"./sessionPolicy-CNVK7nJ6.js";import{$ as zn,B as Bn,Dt as Vn,E as Hn,Et as Un,G as Wn,H as Gn,K as Kn,M as qn,Q as Jn,S as Yn,Tt as Xn,U as Zn,V as Qn,Z as $n,_ as er,_t as tr,bt as nr,i as rr,it as L,jt as ir,kt as ar,nt as or,p as sr,q as cr,r as lr,rt as ur,t as dr,v as fr,w as pr,xt as mr,y as hr,yt as gr}from"./ecdsaPresignLifecycle-CQnCxSlq.js";import{a as _r,d as vr,g as yr,h as br,i as xr,l as Sr,m as Cr,n as wr,o as Tr,r as Er,t as Dr}from"./capabilityKinds-XaXXiD2B.js";import{d as Or,f as kr,h as Ar,m as jr,n as Mr,t as Nr,u as Pr}from"./chains-yAls2d9X.js";import{a as Fr,o as Ir,r as Lr}from"./canonicalPrimitives-MPGET2cl.js";import{a as Rr,c as R,i as zr,n as Br,o as z,s as Vr,t as Hr,u as Ur}from"./ecdsaChainTarget-CRcRR78w.js";import{a as B,d as Wr,f as Gr,i as Kr,l as qr,n as V,p as Jr,r as Yr,s as Xr,u as Zr}from"./signerDomain-BhUTzDmF.js";import{r as Qr}from"./registrationIntent-DV1GYZ3K.js";import{a as $r,c as ei,d as ti,h as ni,i as ri,l as ii,m as ai,o as oi,s as si}from"./passkey-custody-LP4UTFbn.js";import{a as ci,t as li}from"./normalization-BGPR6osg.js";import{A as ui,C as di,D as fi,E as pi,F as mi,I as hi,M as gi,O as _i,S as vi,T as yi,_ as bi,a as xi,b as Si,c as Ci,g as wi,i as Ti,k as Ei,l as Di,n as Oi,o as ki,r as Ai,s as ji,t as Mi,v as Ni,w as Pi,x as Fi,y as Ii}from"./accountLifecycle-EyfYPnuT.js";import{a as Li,c as Ri,d as zi,i as Bi,r as Vi,t as Hi}from"./accountIds-C3Ihsd2c.js";import{$ as Ui,At as Wi,Ct as Gi,D as Ki,Dt as qi,E as Ji,Et as Yi,F as Xi,Ft as Zi,G as Qi,H as $i,Ht as ea,I as ta,J as na,K as ra,Kt as ia,N as aa,Nt as oa,Ot as sa,P as ca,Pt as la,Q as ua,R as da,Rt as fa,St as pa,T as ma,Tt as ha,U as ga,V as _a,Vt as va,W as ya,Wt as ba,X as xa,Y as Sa,Z as Ca,_ as wa,_n as Ta,_t as Ea,a as Da,an as Oa,at as ka,bn as Aa,bt as ja,c as Ma,cn as Na,ct as Pa,d as Fa,dt as Ia,et as La,f as Ra,ft as za,gn as Ba,gt as Va,hn as Ha,ht as Ua,i as Wa,in as Ga,it as Ka,jt as qa,k as Ja,kt as Ya,lt as Xa,m as Za,mt as Qa,n as $a,nn as eo,nt as to,ot as no,p as ro,pn as io,pt as ao,q as oo,qt as so,r as co,rn as lo,s as uo,st as fo,t as po,tn as mo,tt as ho,u as go,un as _o,ut as vo,v as yo,vn as bo,vt as xo,w as So,wt as Co,x as wo,xn as To,xt as Eo,y as Do,yn as Oo,yt as ko}from"./evmFamilyEcdsaIdentity-Br3iFdQx.js";import{C as Ao,E as jo,S as Mo,T as No,d as Po,f as Fo,n as Io,o as Lo,r as Ro,t as zo,w as Bo}from"./walletAuthority-CoWSeqvQ.js";import{a as Vo,i as Ho,o as Uo,r as Wo}from"./registrationIds-BIel5S0i.js";import{a as Go,d as Ko,f as qo,i as Jo,l as Yo,n as Xo,r as Zo,s as Qo,u as $o}from"./keyMaterialBrands-uVZHfAh3.js";import{a as es,d as ts,f as ns,g as rs,h as is,i as as,l as os,m as ss,n as H,o as U,p as cs,r as ls,s as W,t as us,u as ds}from"./sdkSentEvents-_RGAEeld.js";import{M as fs,a as ps,b as G,d as ms,f as hs,g as gs,h as _s,i as vs,j as ys,k as bs,l as xs,m as Ss,n as Cs,o as ws,p as Ts,s as Es,t as Ds,u as K,y as Os}from"./walletCustodyEcdsaContinuity-B7xi7nwh.js";import{t as ks}from"./signerSlot-BQ1g5JNV.js";import"./keccak-zexutGfG.js";import{a as As,l as js,n as Ms,o as Ns,r as Ps,t as Fs}from"./signingSessionSeal-Mr2Xp44o.js";import{c as Is,d as Ls,f as Rs,i as zs,o as Bs,r as Vs,s as Hs,t as Us}from"./wallet-recovery-CcDZ1hMH.js";import{c as Ws,d as Gs,i as Ks,t as qs}from"./registrationSignerPlan-FzD3TwxB.js";import{c as Js,n as Ys,r as Xs,s as Zs}from"./types-M7vxrYtJ.js";import{t as Qs}from"./challengeDelivery-cAsaUC6U.js";import{C as $s,D as ec,E as tc,S as nc,T as rc,k as ic,w as ac,x as oc,y as sc}from"./ecdsaCapabilityManifest-CHFu-QrV.js";import{c as cc,i as lc,l as uc,n as dc,o as fc,s as pc,t as mc,u as hc}from"./helpers-D4QckQhq.js";import{i as gc}from"./profileAccountProjection-DHCaMtOu.js";import{A as _c,C as vc,E as yc,O as bc,_ as xc,a as Sc,b as Cc,g as wc,i as Tc,j as Ec,l as Dc,m as Oc,n as kc,o as Ac,r as jc,t as Mc,u as Nc,v as Pc}from"./nearEd25519YaoMaterialActivation-DQIw8ho3.js";import{n as Fc,r as Ic,t as Lc}from"./relayerHttp-DaPeS929.js";import{a as Rc,c as zc,f as Bc,h as Vc,i as Hc,l as Uc,m as Wc,n as Gc,p as Kc,t as qc,u as Jc}from"./exactSigningLaneIdentity-olheZx_n.js";import{_ as Yc,a as Xc,b as Zc,d as Qc,f as $c,g as el,h as tl,i as nl,m as rl,n as il,p as al,r as ol,t as sl,u as cl,v as ll,x as ul}from"./nearEd25519YaoSigningPreparation-Bp_CvWRz.js";import{a as dl,i as fl,n as pl,o as ml,r as hl,t as gl}from"./routePlan-B_KJaPtm.js";import{n as _l,t as vl}from"./prfCache-Mbo7_USg.js";import{l as yl,u as bl}from"./trace-M34pNGuF.js";import{t as xl}from"./webauthnPromptCoordinator-DO-qfECu.js";import{a as Sl,t as Cl}from"./actions-DZLxCcrU.js";import{_ as wl,a as Tl,c as El,d as Dl,f as Ol,g as kl,h as Al,i as jl,l as Ml,m as Nl,o as Pl,p as Fl,r as Il,s as Ll,t as Rl,u as zl}from"./signNear-mWbTE2Dl.js";import{C as Bl,D as Vl,E as Hl,M as Ul,N as q,O as Wl,P as Gl,S as Kl,T as ql,_ as Jl,b as Yl,c as Xl,g as Zl,h as Ql,l as $l,m as eu,n as tu,o as nu,p as ru,r as iu,s as au,t as ou,u as su,v as cu,w as lu,x as uu,y as du}from"./adapters-DtAyuoiA.js";import{i as fu,n as pu,r as mu}from"./intentDigest-CB6zy3lN.js";import{r as hu,t as gu}from"./pendingWalletRecoveryCodeBackup-BNk4ebsY.js";import{t as _u}from"./NearClient-vJ65Wjrq.js";import{t as vu}from"./EvmClient-DoxytQaJ.js";import{C as yu,S as bu,b as xu,d as Su,f as Cu,p as wu,r as Tu,x as Eu,y as Du}from"./exactSessionState-CjD8gekO.js";import{n as Ou,o as ku}from"./configHelpers-CseiVoZD.js";import{n as Au,t as ju}from"./csp-stylesheet-B1fAhrGB.js";import{r as Mu}from"./defaultConfigs-CWpApkMq.js";import{t as Nu}from"./NonceCoordinator-BBeadCSq.js";import{i as Pu}from"./walletRecoveryCommit-ljxVeo-d.js";import{i as Fu,n as Iu,r as Lu,t as Ru}from"./signerLoader-By0IY24G.js";import{t as zu}from"./executeWorkerOperation-CrFf3FkL.js";import{A as Bu,B as Vu,C as Hu,D as Uu,E as Wu,F as Gu,H as Ku,I as qu,L as Ju,M as Yu,N as Xu,O as Zu,P as Qu,R as $u,S as ed,T as td,U as nd,V as rd,W as id,_ as ad,a as od,b as sd,c as cd,d as ld,f as ud,g as dd,h as fd,i as pd,j as md,k as hd,l as gd,m as _d,o as vd,p as yd,r as bd,s as xd,u as Sd,v as Cd,w as wd,x as Td,y as Ed,z as Dd}from"./secp256k1-B_6W9QDJ.js";import{A as Od,B as kd,C as Ad,D as jd,E as Md,F as Nd,I as Pd,L as Fd,M as Id,N as Ld,O as Rd,P as zd,R as Bd,S as Vd,T as Hd,V as Ud,_ as Wd,a as Gd,b as Kd,c as qd,d as Jd,f as Yd,g as Xd,h as Zd,i as Qd,j as $d,k as ef,l as tf,m as nf,n as rf,o as af,p as of,r as sf,t as cf,u as lf,v as uf,w as df,x as ff,y as pf,z as mf}from"./signEvmFamily-CcLVBm0f.js";import{n as hf}from"./promptText-s8TQ6ckX.js";import{C as gf,d as _f,f as vf,m as yf,p as bf,v as xf}from"./operationFingerprint-5-wH2Ht8.js";import{f as Sf,g as Cf,h as wf,m as Tf}from"./routerAbNormalSigning-D_fHjq5l.js";import{S as Ef,_ as Df,b as Of,d as kf,f as Af,g as jf,h as Mf,l as Nf,m as Pf,p as Ff,u as If,v as Lf,x as Rf,y as zf}from"./transactionState-9d7f3xVj.js";import{t as Bf}from"./bytes-t5S5mkat.js";import{c as Vf,i as Hf,o as Uf,s as Wf,t as Gf}from"./signingFlow-LUWrZi2d.js";import{n as Kf,t as qf}from"./export-viewer-host-jo7h_0wl.js";import{i as Jf,n as Yf,r as Xf,t as Zf}from"./transaction-activity-BbDod7ji.js";import"./jsxRuntime.module-CoHsKD_3.js";import{t as Qf}from"./registration-Btozh7uh.js";import{i as $f,n as ep,r as tp,t as np}from"./walletRecoveryRotate-HztDcDaY.js";function rp(){let e=typeof window<`u`&&window.location?.origin?window.location.origin:``;try{let t=window?.__SEAMS_WALLET_SDK_BASE__;if(t){let n=new URL(t,e||`https://invalid.local`).origin;if(n===e)return n}}catch{}return e}function ip(e,t){let n=t.worker,r=t.baseOrigin||rp()||(typeof window<`u`?window.location.origin:``)||`https://invalid.local`;try{let t=typeof window<`u`?window:{},i;switch(n){case`signer`:i=t.__SEAMS_SIGNER_WORKER_URL__;break;case`ecdsaDerivationClient`:i=t.__SEAMS_ECDSA_DERIVATION_CLIENT_WORKER_URL__;break;case`ecdsaPresignClient`:i=t.__SEAMS_ECDSA_PRESIGN_CLIENT_WORKER_URL__;break;case`ecdsaOnlineClient`:i=t.__SEAMS_ECDSA_ONLINE_CLIENT_WORKER_URL__;break;case`touchConfirm`:i=t.__SEAMS_TOUCH_CONFIRM_WORKER_URL__;break;case`passkeyMpcExport`:i=t.__SEAMS_PASSKEY_MPC_EXPORT_WORKER_URL__;break;case`passkeyMpcSession`:i=t.__SEAMS_PASSKEY_MPC_SESSION_WORKER_URL__;break;case`deviceLinking`:i=t.__SEAMS_DEVICE_LINKING_WORKER_URL__;break;default:}let a=typeof i==`string`&&i?i:e||op(n);return ap(/^https?:\/\//i.test(a)?new URL(a):new URL(a,r),i).toString()}catch{try{return new URL(e||op(n),r).toString()}catch{}return e||op(n)}}function ap(e,t){if(typeof t==`string`&&t.length>0)return e;let n=oe(),r=ie();if(!n||!r||e.searchParams.has(`v`))return e;try{let t=new URL(r);if(e.origin!==t.origin||!e.pathname.startsWith(t.pathname))return e;e.searchParams.set(`v`,n)}catch{}return e}function op(e){switch(e){case`signer`:return`/sdk/workers/near-signer.worker.js`;case`ecdsaDerivationClient`:return`/sdk/workers/ecdsa-derivation-client.worker.js`;case`ecdsaPresignClient`:return`/sdk/workers/ecdsa-presign-client.worker.js`;case`ecdsaOnlineClient`:return`/sdk/workers/ecdsa-online-client.worker.js`;case`touchConfirm`:return`/sdk/workers/passkey-confirm.worker.js`;case`passkeyMpcExport`:return`/sdk/workers/passkey-mpc-export.worker.js`;case`passkeyMpcSession`:return`/sdk/workers/passkey-mpc-session.worker.js`;case`deviceLinking`:return`/sdk/workers/device-linking-key.worker.js`;default:throw Error(`Unsupported dedicated worker kind`)}}function sp(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=e,n=typeof t.id==`string`&&t.id.trim()?t.id.trim():void 0;return t.success===!0&&`data`in t&&t.error===void 0?{id:n,success:!0,data:t.data}:t.success===!1&&typeof t.error==`string`&&t.data===void 0?{id:n,success:!1,error:t.error}:null}var J=class extends Error{constructor(e,t,n){super(e),this.code=t,this.phase=n,this.name=`DeviceLinkingError`}};let Y=function(e){return e.INVALID_QR_DATA=`INVALID_QR_DATA`,e.ACCOUNT_NOT_OWNED=`ACCOUNT_NOT_OWNED`,e.AUTHORIZATION_TIMEOUT=`AUTHORIZATION_TIMEOUT`,e.INSUFFICIENT_BALANCE=`INSUFFICIENT_BALANCE`,e.REGISTRATION_FAILED=`REGISTRATION_FAILED`,e.WALLET_UNLOCK_REQUIRED=`WALLET_UNLOCK_REQUIRED`,e.DELIVERY_RECOVERY_REQUIRED=`DELIVERY_RECOVERY_REQUIRED`,e.SESSION_EXPIRED=`SESSION_EXPIRED`,e.UNSUPPORTED=`UNSUPPORTED`,e}({});function cp(e){let t=w(e);if(!t.ok)throw Error(`Device-link target email address is invalid: ${t.error.message}`);return t.value}function lp(e){try{return cp(e),!0}catch{return!1}}var up=class{constructor(e,t){this.eventTarget=e,this.clientOwner=t,this.state={kind:`active`},this.handlePageHideBound=this.handlePageHide.bind(this),this.eventTarget?.addEventListener(`pagehide`,this.handlePageHideBound)}handlePageHide(){this.dispose()}dispose(){this.state.kind!==`disposed`&&(this.state={kind:`disposed`},this.eventTarget?.removeEventListener(`pagehide`,this.handlePageHideBound),this.clientOwner.dispose())}};function dp(e){let t;try{t=JSON.parse(e.activationResultJson)}catch{throw Error(`the Router activation result is not JSON`)}let n=Na(t);if(!n.ok)throw Error(`Router activation result is invalid: ${n.message}`);let r=n.value,i=r.public_receipt;if(r.binding.lifecycle.lifecycle_id!==e.admissionRequest.scope.lifecycle_id)throw Error(`the Router activation result belongs to another lifecycle`);let a=i.material_activation,o=p({kind:a.kind,activationId:a.activation_id,capability:a.capability,materialOwner:a.material_owner,keyBinding:a.key_binding,lifecycleBinding:a.lifecycle_binding,signingWorker:a.signing_worker});if(!o.ok)throw Error(`Invalid activation material reference: ${o.error.message}`);let s=e.admissionRequest.participant_ids;if(s.length!==2)throw Error(`an Ed25519 Yao registration has exactly two participants`);return{kind:Ie,scope:e.admissionRequest.scope,applicationBinding:e.admissionRequest.application_binding,participantIds:[s[0],s[1]],registeredPublicKey:Uint8Array.from(i.registered_public_key),signingWorkerVerifyingShare:Uint8Array.from(i.signing_worker_verifying_share),stateEpoch:BigInt(i.state_epoch),transcript:Uint8Array.from(i.transcript),activeCapabilityBinding:r.binding.session_id,materialActivation:o.value}}function fp(e){let t;try{t=JSON.parse(e.activationResultJson)}catch{throw Error(`the Router recovery result is not JSON`)}let n=Ga(t);if(!n.ok)throw Error(`Router recovery result is invalid: ${n.message}`);if(n.value.binding.lifecycle.lifecycle_id!==e.admissionRequest.scope.lifecycle_id)throw Error(`the Router recovery result belongs to another lifecycle`);if(e.activationReceipt.binding.lifecycle.lifecycle_id!==e.admissionRequest.scope.lifecycle_id)throw Error(`the Router recovery activation belongs to another lifecycle`);let r=e.activationReceipt.public_receipt,i=p({kind:r.material_activation.kind,activationId:r.material_activation.activation_id,capability:r.material_activation.capability,materialOwner:r.material_activation.material_owner,keyBinding:r.material_activation.key_binding,lifecycleBinding:r.material_activation.lifecycle_binding,signingWorker:r.material_activation.signing_worker});if(!i.ok)throw Error(`Invalid recovery material reference: ${i.error.message}`);return{kind:Ie,scope:e.admissionRequest.scope,applicationBinding:e.admissionRequest.application_binding,participantIds:[e.admissionRequest.participant_ids[0],e.admissionRequest.participant_ids[1]],registeredPublicKey:Uint8Array.from(r.registered_public_key),signingWorkerVerifyingShare:Uint8Array.from(r.signing_worker_verifying_share),stateEpoch:BigInt(r.state_epoch),transcript:Uint8Array.from(r.transcript),activeCapabilityBinding:[...e.activationReceipt.active_capability_binding],materialActivation:i.value}}async function pp(e){let t=Xn(e.currentScope.material_activation),n=_(pe(`wallet-recovery-ed25519-material-activation`,32,`wallet recovery Ed25519 activation identities`)),r=y(`${e.lifecycleId}:material-activation`);if(!n.ok||!r.ok)throw Error(`wallet recovery Ed25519 material activation identity is invalid`);let i=x({activationId:n.value,capability:t.capability,materialOwner:t.materialOwner,keyBinding:t.keyBinding,lifecycleBinding:r.value,signingWorker:t.signingWorker}),a=new Uint8Array(32);globalThis.crypto.getRandomValues(a);try{return hp(Oa({scope:{lifecycle_id:e.lifecycleId,root_share_epoch:e.currentScope.root_share_epoch,account_id:e.currentScope.account_id,threshold_session_id:e.thresholdSessionId,signer_set_id:e.currentScope.signer_set_id,signing_worker_id:e.currentScope.signing_worker_id,material_activation:Un(i)},active_material_activation:e.currentScope.material_activation,application_binding:e.applicationBinding,participant_ids:e.participantIds,active_capability_binding:e.activeCapabilityBinding,replacement_capability_binding:[...a],registered_public_key:e.registeredPublicKey}),`wallet recovery Ed25519 admission request is invalid`)}finally{a.fill(0)}}function mp(e,t){if(e.length!==t.length)return!1;let n=0;for(let r=0;r<e.length;r+=1)n|=(e[r]??0)^(t[r]??0);return n===0}function hp(e,t){if(!e.ok)throw Error(`${t}: ${e.message}`);return e.value}async function gp(e){let t=await Ls({reservationId:Rs(e.reservationId),keySetId:e.entry.keySetId});return await pp({lifecycleId:t,thresholdSessionId:`${t}:threshold-session`,currentScope:e.entry.recoveryBasis.scope,applicationBinding:e.entry.recoveryBasis.applicationBinding,participantIds:e.entry.recoveryBasis.participantIds,activeCapabilityBinding:e.entry.recoveryBasis.activeCapabilityBinding,registeredPublicKey:e.entry.recoveryBasis.registeredPublicKey})}async function _p(e){return await pp({lifecycleId:pe(`wallet-session-ed25519-recovery`,32,`wallet-session Ed25519 recovery lifecycles`),thresholdSessionId:e.basis.lifecycle.thresholdSessionId,currentScope:{root_share_epoch:e.basis.lifecycle.rootShareEpoch,account_id:e.basis.lifecycle.accountId,signer_set_id:e.basis.lifecycle.signerSetId,signing_worker_id:e.basis.lifecycle.signingWorkerId,material_activation:Un(e.basis.materialActivation)},applicationBinding:e.basis.applicationBinding,participantIds:e.basis.participantIds,activeCapabilityBinding:e.basis.activeCapabilityBinding,registeredPublicKey:e.basis.registeredPublicKey})}async function vp(e){let t=await e.transport.send({kind:`recovery_admit`,path:ea,body:e.request});if(!t.ok)throw Error(`Router Ed25519 recovery admission failed: ${t.message}`);let n=hp(mo(t.value),`Router Ed25519 recovery admission is invalid`);if(n.binding.lifecycle.lifecycle_id!==e.request.scope.lifecycle_id||!Vn(n.binding.material_activation,e.request.scope.material_activation))throw Error(`Router Ed25519 recovery admission changed the requested lifecycle`);return{request:e.request,receipt:n}}async function yp(e){let t=hp(eo(JSON.parse(e.executeRequestJson)),`wallet recovery Ed25519 execute request is invalid`),n=await e.transport.send({kind:`recovery_execute`,path:ba,body:t});if(!n.ok)throw Error(`Router Ed25519 recovery execute failed: ${n.message}`);let r=hp(Ga(n.value),`Router Ed25519 recovery result is invalid`);return JSON.stringify(r)}async function bp(e){let t=hp(Ga(JSON.parse(e.protocolResultJson)),`Router Ed25519 recovery result is invalid`),n=await e.transport.send({kind:`recovery_activate`,path:va,body:{binding:t.binding,public_receipt:t.public_receipt}});if(!n.ok)throw Error(`Router Ed25519 recovery activation failed: ${n.message}`);let r=hp(lo(n.value),`Router Ed25519 recovery activation is invalid`);if(!mp(r.active_capability_binding,e.request.replacement_capability_binding)||!mp(r.retired_capability_binding,e.request.active_capability_binding)||!mp(r.public_receipt.transcript,t.public_receipt.transcript)||!mp(r.public_receipt.registered_public_key,t.public_receipt.registered_public_key)||!mp(r.public_receipt.signing_worker_verifying_share,t.public_receipt.signing_worker_verifying_share)||r.public_receipt.state_epoch!==t.public_receipt.state_epoch||!Vn(r.public_receipt.material_activation,e.request.scope.material_activation))throw Error(`Router Ed25519 recovery activation changed the requested identity`);return r}function xp(e){let t=I(e);if(t.length!==20)throw Error(`wallet recovery ECDSA identity has an invalid address`);return`0x${Array.from(t,e=>e.toString(16).padStart(2,`0`)).join(``)}`}function Sp(e){let t=e.activationReceipt.ecdsa_activation;if(t.context.application_binding_digest_b64u!==e.publicCapability.context.application_binding_digest_b64u||!Gn(t.public_identity,e.publicCapability.public_identity)||!Wn(t.signing_worker,e.publicCapability.signer_set.selected_server)||!Vn(t.material_activation,e.publicCapability.material_activation)||t.activation_epoch!==e.publicCapability.activation_epoch||e.activationReceipt.server_generation!==e.serverGeneration)throw Error(`wallet recovery ECDSA activation changed its registered capability`)}function Cp(e){let t=e.publicCapability.public_identity;if(e.challenge.walletId!==e.walletId||e.challenge.reservationId!==e.reservationId||e.challenge.replacementId!==e.replacementId||e.challenge.keySetId!==e.entry.keySetId||e.challenge.keyHandle!==e.entry.keyHandle||e.challenge.recordedKeyManifestDigestB64u!==e.entry.recordedKeyManifestDigestB64u||e.challenge.expectedServerGeneration!==String(e.entry.recoveryBasis.serverGeneration)||e.challenge.derivationClientSharePublicKey33B64u!==t.derivation_client_share_public_key33_b64u)throw Error(`wallet recovery ECDSA possession challenge changed its registered identity`)}function wp(e){let t=e.publicCapability.public_identity;if(e.publicFacts.contextBinding32B64u!==t.context_binding_b64u||e.publicFacts.derivationClientSharePublicKey33B64u!==t.derivation_client_share_public_key33_b64u||e.publicFacts.clientVerifyingShare33B64u!==t.derivation_client_share_public_key33_b64u||e.publicFacts.relayerPublicKey33B64u!==t.server_public_key33_b64u||e.publicFacts.groupPublicKey33B64u!==t.threshold_public_key33_b64u||e.publicFacts.clientShareRetryCounter!==t.client_share_retry_counter||e.publicFacts.relayerShareRetryCounter!==t.server_share_retry_counter||e.publicFacts.ethereumAddress!==xp(t.ethereum_address20_b64u))throw Error(`wallet recovery ECDSA custody public facts changed the capability`)}function Tp(e){let t=e.trim();if(!t)throw Error(`wallet recovery ECDSA returned no ready state blob`);return{kind:`ecdsa_role_local_state_blob_v1`,curve:`secp256k1`,encoding:`base64url`,producer:`signer_core`,stateBlobB64u:t}}async function Ep(e){let t=fr(e.entry.recoveryBasis.publicCapability),n=Hn(e.entry.recoveryBasis.activationReceipt);Sp({activationReceipt:n,publicCapability:t,serverGeneration:String(e.entry.recoveryBasis.serverGeneration)});let r=Us(e.entry.recoveryBasis.possessionChallenge);Cp({challenge:r,entry:e.entry,walletId:e.walletId,reservationId:e.reservationId,replacementId:e.replacementId,publicCapability:t});let i=F(await jr(kr(t)));if(r.publicCapabilityDigestB64u!==i)throw Error(`wallet recovery ECDSA possession challenge changed the capability digest`);wp({publicFacts:e.publicFacts,publicCapability:t});let a=await Wu({workerCtx:e.workerCtx,challenge:r,stateBlob:Tp(e.readyStateBlobB64u)}),o=await Vs(r);if(a.challengeDigestB64u!==o||a.derivationClientSharePublicKey33B64u!==r.derivationClientSharePublicKey33B64u)throw Error(`wallet recovery ECDSA possession proof changed its challenge binding`);return{activationReceipt:n,publicCapability:t,possessionProof:a.proof}}function Dp(e){return e.entryIndex===0?{kind:`reseal_replacement_factor`,factorJson:JSON.stringify({envelopeId:e.replacementFactor.replacementId,walletAuthMethodId:e.replacementFactor.walletAuthMethodId,factor:e.replacementFactor.factor}),factorSecret:e.replacementFactor.factorSecret.slice(0)}:{kind:`preserve_existing`}}function Op(e){return Uint8Array.from(e).buffer}function kp(e){e.kind===`reseal_replacement_factor`&&new Uint8Array(e.factorSecret).fill(0)}function Ap(e){let t=I(e);if(t.length!==20)throw Error(`wallet recovery ECDSA identity has an invalid address`);return`0x${Array.from(t,e=>e.toString(16).padStart(2,`0`)).join(``)}`}function jp(e){let t=e.entry.recoveryBasis.publicCapability.public_identity;if(e.bootstrap.contextBinding32B64u!==t.context_binding_b64u||e.bootstrap.clientSharePublicKey33B64u!==t.derivation_client_share_public_key33_b64u||e.bootstrap.clientShareRetryCounter!==t.client_share_retry_counter)throw Error(`wallet recovery changed ECDSA identity for ${e.entry.keySetId}`)}function Mp(e){if(!e.candidate)return e.current;if(e.current)throw Error(`wallet recovery produced more than one replacement envelope`);return e.candidate}async function Np(e){let t=[],n=[],r=null;for(let[i,a]of e.prepared.keyManifest.entries.entries()){let o=null,s=null;try{let c=Op(e.recoveryCodeBytes);o=c;let l=Dp({entryIndex:i,replacementFactor:e.replacementFactor});switch(s=l,a.kind){case`near_ed25519`:{let n=new ut({routerOrigin:new URL(e.relayUrl).origin,authorization:{kind:`recovery_challenge`,challengeId:e.recoveryChallengeId},fetch:globalThis.fetch}),i=await gp({reservationId:e.prepared.reservationId,entry:a}),o=await vp({request:i,transport:n}),s=await St({runStep:e.runStep,walletId:e.walletId,custodyJson:e.custodyJson,recoveryCode:c,recordedKeyManifestDigestB64u:a.recordedKeyManifestDigestB64u,factorReplacement:l,nearEd25519SigningKeyId:a.recoveryBasis.applicationBinding.near_ed25519_signing_key_id,yaoAdmission:o.receipt,yaoApplication:o.request.application_binding,participantIds:o.request.participant_ids,registeredPublicKeyB64u:F(Uint8Array.from(a.recoveryBasis.registeredPublicKey)),runRouterRound:e=>yp({executeRequestJson:e,transport:n}),activateRouterRecovery:e=>bp({request:i,protocolResultJson:e,transport:n})});if(!s.localMaterial)throw Error(`wallet recovery produced no NEAR local material`);r=Mp({current:r,candidate:s.recoveryReplacementEnvelope}),t.push({entry:a,metadata:fp({admissionRequest:i,activationResultJson:s.activationResultJson,activationReceipt:s.activationReceipt}),localMaterial:s.localMaterial});break}case`evm_family_ecdsa`:{let t=await Yt({runStep:e.runStep,walletId:e.walletId,custodyJson:e.custodyJson,recoveryCode:c,recordedKeyManifestDigestB64u:a.recordedKeyManifestDigestB64u,factorReplacement:l,evmFamilySigningKeySlotId:a.evmFamilySigningKeySlotId,applicationBindingDigestB64u:a.recoveryBasis.publicCapability.context.application_binding_digest_b64u,registeredClientRootPublicKey33B64u:a.recoveryBasis.clientRootPublicKey33B64u,resolveRelayerPublicIdentity:async e=>(jp({entry:a,bootstrap:e}),JSON.stringify({relayerKeyId:a.recoveryBasis.publicCapability.signer_set.selected_server.server_id,relayerPublicKey33B64u:a.recoveryBasis.publicCapability.public_identity.server_public_key33_b64u,groupPublicKey33B64u:a.recoveryBasis.publicCapability.public_identity.threshold_public_key33_b64u,ethereumAddress:Ap(a.recoveryBasis.publicCapability.public_identity.ethereum_address20_b64u),relayerShareRetryCounter:a.recoveryBasis.publicCapability.public_identity.server_share_retry_counter}))}),i=await Ep({entry:a,walletId:e.walletId,reservationId:e.prepared.reservationId,replacementId:e.replacementFactor.replacementId,readyStateBlobB64u:t.readyStateBlobB64u,publicFacts:t.publicFacts,workerCtx:e.workerCtx});r=Mp({current:r,candidate:t.recoveryReplacementEnvelope}),n.push({entry:a,activation:i,readyStateBlobB64u:t.readyStateBlobB64u,publicFacts:t.publicFacts});break}}}finally{s&&kp(s),o&&new Uint8Array(o).fill(0)}}if(!r)throw Error(`wallet recovery produced no replacement custody envelope`);return{replacementEnvelope:qe({expectedWalletId:e.walletId,replacement:r,activatedAtMs:(e.nowMs??Date.now)()}),nearKeySets:t,ecdsaKeySets:n}}function Pp(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<1)throw Error(`${t} must be a positive integer`);return e}function Fp(e){if(!Array.isArray(e)||e.length!==2||!Number.isSafeInteger(e[0])||!Number.isSafeInteger(e[1])||e[0]<1||e[1]<1||e[0]===e[1])throw Error(`warm recovery participantIds must contain two distinct positive integers`);return[Number(e[0]),Number(e[1])]}const Ip=[`capability`,`kind`,`nearAccountId`,`nearEd25519SigningKeyId`,`participantIds`,`quotaId`,`routerAbNormalSigning`,`runtimePolicyScope`,`signerSlot`,`signingWorkerId`,`thresholdExpiresAtMs`,`thresholdSessionId`,`walletId`,`walletSessionId`];function Lp(e,t){let n=[...t].sort(),r=Object.keys(e).sort();if(r.length!==n.length)throw Error(`warm recovery bootstrap response fields are invalid`);for(let e=0;e<r.length;e+=1)if(r[e]!==n[e])throw Error(`warm recovery bootstrap response fields are invalid`)}function Rp(e,t){if(e.authMethod!==`passkey`)return!1;let n=e.ed25519Restore;return n.credentialIdB64u?e.walletId===t.walletId&&n.nearAccountId===t.nearAccountId&&n.nearEd25519SigningKeyId===t.nearEd25519SigningKeyId&&n.signerSlot===t.signerSlot&&e.thresholdSessionIds.ed25519===t.thresholdSessionId:!1}async function zp(e,t){let n=await t.readExactEd25519SealedSession(Df({authMethod:`passkey`,materialActivation:e.materialActivation}));return n&&(n.curve!==`ed25519`||!Rp(n,e)||!b(n.ed25519Restore.materialActivation,e.materialActivation))||!n||n.expiresAtMs<=t.nowMs()||n.remainingUses<1?{kind:`unavailable`}:{kind:`ready`,record:n}}async function Bp(e){let t;try{t=await e.runtime.resolveSelectedWalletAuthority(String(e.walletId))}catch{return null}if(t.kind!==`resolved`)return null;let{selection:n,authMethod:r,authority:i}=t;if(n.lockState!==`unlocked`||n.walletId!==e.walletId||e.expectedAuthorityRef.walletId!==e.walletId||n.walletAuthMethodId!==e.expectedAuthorityRef.walletAuthMethodId||r.kind!==`passkey`||r.status!==`active`||r.walletId!==e.walletId||r.walletAuthMethodId!==e.expectedAuthorityRef.walletAuthMethodId||r.walletAuthorityId!==i.authorityId||String(r.rpId)!==e.rpId||String(r.credentialIdB64u)!==e.credentialIdB64u||i.state!==`active`||i.walletId!==e.walletId)return null;try{return{authorizationRead:await e.runtime.readExactWalletSessionAuthorization({walletId:e.walletId,authorityId:i.authorityId,authMethodId:r.walletAuthMethodId}),authorityId:i.authorityId,authorityDigestB64u:i.authorityDigestB64u,authorityRevocationEpoch:i.revocationEpoch}}catch{return null}}async function Vp(e){if(e.authorizationRead.kind!==`found`)return null;let t=e.authorizationRead,n=t.record,r=n.capabilitySubjects.filter(t=>t.kind===`sign`&&t.keyFamily===`ed25519`&&b(t.materialActivation,e.record.ed25519Restore.materialActivation));return n.walletId!==e.expectedAuthorityRef.walletId||n.walletId!==e.record.walletId||n.authorityId!==e.expectedAuthorityId||n.authMethodId!==e.expectedAuthorityRef.walletAuthMethodId||String(n.authorityDigestB64u)!==String(e.expectedAuthorityDigestB64u)||n.authorityRevocationEpoch!==e.expectedAuthorityRevocationEpoch||n.expiresAtMs<=e.nowMs||t.operationCredential.walletSessionId.trim().length===0||t.operationCredential.token.trim().length===0||r.length!==1?null:t}function Hp(e,t){let n=e.ed25519Restore,r=_o({kind:`router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1`,walletId:e.walletId,nearAccountId:n.nearAccountId,nearEd25519SigningKeyId:n.nearEd25519SigningKeyId,signerSlot:n.signerSlot,thresholdSessionId:t,signingWorkerId:n.routerAbNormalSigning.signingWorkerId,participantIds:n.participantIds});if(!r.ok)throw Error(r.message);return r.value}async function Up(e){let t=e.authorization.operationCredential.token;if(e.authorization.record.walletId!==e.request.walletId||!e.authorization.operationCredential.walletSessionId||!t.trim())throw Error(`[SigningEngine][near] active Wallet Session authorization does not match sealed material`);let n=await e.fetch(`${new URL(e.relayerUrl).origin}${so}`,{method:`POST`,headers:{Authorization:`Bearer ${t}`,"Content-Type":`application/json`},body:JSON.stringify(e.request)}),r=await Wp(n),i=D(r)?r:null;if(!n.ok){let e=i?String(i.code||``).trim():``;if(n.status===401&&e===`wallet_session_expired`)return{kind:`unavailable`,reason:`wallet_session_expired`};let t=i?String(i.message||``).trim():``;throw Error(`[SigningEngine][near] Ed25519 warm recovery bootstrap failed (HTTP ${n.status}${e?`, ${e}`:``}): ${t||`invalid response`}`)}if(!i)throw Error(`Ed25519 warm recovery bootstrap returned invalid JSON`);return{kind:`ready`,descriptor:await Gp({record:e.record,authorization:e.authorization,expectedAuthorityRef:e.expectedAuthorityRef,expectedThresholdSessionId:e.expectedThresholdSessionId,response:i})}}async function Wp(e){try{return await e.json()}catch{return null}}async function Gp(e){let t=e.record,n=e.response;if(Lp(n,Ip),n.kind!==`router_ab_ed25519_yao_v2_session_bootstrap_v1`)throw Error(`warm recovery bootstrap response kind is invalid`);let r=t.ed25519Restore,i=M(n.walletId,`response.walletId`),a=M(n.nearAccountId,`response.nearAccountId`),o=M(n.nearEd25519SigningKeyId,`response.nearEd25519SigningKeyId`),s=Pp(n.signerSlot,`response.signerSlot`),c=M(n.thresholdSessionId,`response.thresholdSessionId`),l=M(n.signingWorkerId,`response.signingWorkerId`),u=Pp(n.thresholdExpiresAtMs,`response.thresholdExpiresAtMs`),d=Fp(n.participantIds),f=Tn(E(n.runtimePolicyScope,`response.runtimePolicyScope`)),p=Tn(E(r.runtimePolicyScope,`ed25519Restore.runtimePolicyScope`)),m=js(n.routerAbNormalSigning),h=br(n.walletSessionId),g=vr(n.quotaId),_=mt(n.capability),v=e.authorization.operationCredential.token;if(!h.ok||!g.ok||e.expectedAuthorityRef.walletId!==t.walletId||String(h.value)!==String(e.authorization.operationCredential.walletSessionId)||String(g.value)!==String(e.authorization.record.quotaId)||!m||i!==t.walletId||a!==r.nearAccountId||o!==r.nearEd25519SigningKeyId||s!==r.signerSlot||c!==String(e.expectedThresholdSessionId)||!v||l!==r.relayerKeyId||l!==r.routerAbNormalSigning.signingWorkerId||m.signingWorkerId!==l||t.expiresAtMs>u||d[0]!==r.participantIds[0]||d[1]!==r.participantIds[1]||!wn(f,p))throw Error(`warm recovery bootstrap does not match the exact sealed Ed25519 lane`);if(!vn(f))throw Error(`warm recovery bootstrap signing-root scope is invalid`);if(!v)throw Error(`[SigningEngine][near] active Wallet Session authorization is unavailable`);let y={authority:e.expectedAuthorityRef,walletId:Uo(i),nearAccountId:Hi(a),nearEd25519SigningKeyId:o,signerSlot:s,operationalPublicKey:`ed25519:${zi(Uint8Array.from(_.registeredPublicKey))}`,relayerKeyId:l,credentialIdB64u:M(r.credentialIdB64u,`ed25519Restore.credentialIdB64u`),session:{sessionKind:`opaque`,walletSessionToken:v,thresholdSessionId:c,walletSessionId:h.value,authorizationId:e.authorization.record.authorizationId,quotaId:g.value,expiresAtMs:u,remainingUses:t.remainingUses,runtimePolicyScope:f,participantIds:d,routerAbNormalSigning:m},capability:_};return dt(y,r.materialActivation),y}async function Kp(e,t){let n=await zp(e.subject,t);if(n.kind===`unavailable`)return{kind:`capability_recovery_required`};let r=o(n.record.walletId);if(!r.ok)throw Error(`[SigningEngine][near] sealed Ed25519 wallet identity is invalid`);let i=M(n.record.ed25519Restore.credentialIdB64u,`ed25519Restore.credentialIdB64u`),a;try{a=await t.resolveExactPasskeyWalletAuthAuthorityRef({walletId:r.value,rpId:n.record.ed25519Restore.rpId,credentialIdB64u:i})}catch{return{kind:`capability_recovery_required`}}if(!a)return{kind:`capability_recovery_required`};let s=await Bp({walletId:r.value,rpId:n.record.ed25519Restore.rpId,credentialIdB64u:i,expectedAuthorityRef:a,runtime:t});if(!s)return{kind:`capability_recovery_required`};let c=await Vp({record:n.record,authorizationRead:s.authorizationRead,expectedAuthorityRef:a,expectedAuthorityId:s.authorityId,expectedAuthorityDigestB64u:s.authorityDigestB64u,expectedAuthorityRevocationEpoch:s.authorityRevocationEpoch,nowMs:t.nowMs()});if(!c)return{kind:`capability_recovery_required`};let l=await Up({request:Hp(n.record,e.subject.thresholdSessionId),authorization:c,record:n.record,expectedAuthorityRef:a,expectedThresholdSessionId:e.subject.thresholdSessionId,relayerUrl:e.relayerUrl,fetch:e.fetch});if(l.kind===`unavailable`)return{kind:`capability_recovery_required`};let u=l.descriptor,d=await t.readPasskeyCustodySessionEnvelope({walletId:String(u.walletId),credentialIdB64u:u.credentialIdB64u});return!d||d.binding.kind!==`wallet_custody_seed_v1`?{kind:`capability_recovery_required`}:{kind:`ready`,context:{kind:`passkey_ed25519_yao_export_context_v1`,selectedLaneMaterialActivation:u.capability.materialActivation,material:{authority:u.authority,walletId:u.walletId,nearAccountId:u.nearAccountId,nearEd25519SigningKeyId:u.nearEd25519SigningKeyId,signerSlot:u.signerSlot,operationalPublicKey:u.operationalPublicKey,relayerKeyId:u.relayerKeyId,credentialIdB64u:u.credentialIdB64u,capability:u.capability},authorization:c,relayerUrl:e.relayerUrl,rpId:n.record.ed25519Restore.rpId,walletCustodyEnvelope:d}}}function qp(e){return Te(e)}function Jp(e){return`selector`in e?e.selector.capability:e.capability}function Yp(e){switch(e.kind){case`retired`:return Tc({capability:e.manifest.signer.capability,reason:`replaced`});case`missing`:return e.subject===`capability`?Tc({capability:null,reason:`missing_capability`}):Tc({capability:Jp(e),reason:`missing_material`});case`exact_binding_mismatch`:return Tc({capability:Jp(e),reason:`binding_mismatch`});case`exact_record_conflict`:return Tc({capability:Jp(e),reason:`exact_record_conflict`});case`corrupt`:return Tc({capability:Jp(e),reason:`corrupt`});case`persistence_unavailable`:return Tc({capability:Jp(e),reason:`persistence_unavailable`})}}function Xp(e){let t=e.lookup.manifest.activation.materialActivation;if(!b(t,e.lookup.material.binding.materialActivation)||e.lookup.manifest.signer.materialOwner!==t.materialOwner)return Tc({capability:e.lookup.manifest.signer.capability,reason:`binding_mismatch`});switch(e.runtime.kind){case`live`:return b(t,e.runtime.materialActivation)?Ac({authority:e.lookup.manifest.signer.authority,runtime:e.runtime.runtime,materialActivation:t}):Tc({capability:e.lookup.manifest.signer.capability,reason:`binding_mismatch`});case`absent`:return Sc({authority:e.lookup.manifest.signer.authority,materialActivation:t,sealedMaterial:Te(e.lookup.material.binding.durableMaterialRef)})}}function Zp(e){return e.lookup.kind===`active`?Xp({lookup:e.lookup,runtime:e.runtime}):Yp(e.lookup)}const Qp=[`kind`,`keyFamily`,`walletId`,`walletKeyId`,`walletKeyVersion`,`lifecycle`],$p=[...Qp,`nearEd25519SigningKeyId`,`keyCreationSignerSlot`,`registeredPublicKeyB64u`],em=[...Qp,`evmFamilySigningKeySlotId`,`thresholdPublicKey33B64u`,`evmAddress`],tm=Array.from(new Set([...$p,...em])),nm=[`state`,`activatedAtMs`,`retiredAtMs`,`compromisedAtMs`],rm=[...[`kind`,`walletId`,`walletKeyId`,`laneId`,`laneKind`,`laneShareEpoch`,`participantBindingDigestB64u`],`lifecycle`],im=[...rm,`walletAuthMethodId`,`ownerParticipantContinuity`],am=[...rm,`ownerParticipantContinuity`],om=[...rm,`holderParticipant`,`serverParticipant`],sm=[...om,`authorizationId`,`agentIdentityKeyId`,`custodyBindingId`,`authorizationBindingDigestB64u`],cm=[...om,`linkedDeviceId`],lm=Array.from(new Set([...im,...am,...sm,...cm])),um=[`state`,`revocationEpoch`,`startedAtMs`,`deliveryDigestB64u`,`activatedAtMs`,`activationReceiptDigestB64u`,`revokedAtMs`,`revokeReason`];function dm(e){switch(e){case`owner_passkey`:case`owner_email_otp`:return im;case`recovery`:case`break_glass`:return am;case`linked_device`:return cm;case`delegated_execution`:return sm}}function fm(e,t){if(e==null)throw Error(`${t} is required`);if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} is required`);if(v(n))throw Error(`${t} must not contain whitespace or control characters`);return n}function pm(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} is required`);if(v(n))throw Error(`${t} must not contain whitespace or control characters`);return n}function mm(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function hm(e,t=`walletKeyVersion`){return fm(e,t)}function gm(e,t){return fm(e,t)}function _m(e,t){return fm(e,t)}function vm(e,t){return fm(e,t)}function ym(e,t){switch(e){case`owner_passkey`:case`owner_email_otp`:case`linked_device`:case`delegated_execution`:case`recovery`:case`break_glass`:return e;default:throw Error(`${t} must be a known signing lane kind`)}}function bm(e,t){let n=E(e,t);switch(mn(n,nm,t,nm),n.state){case`active`:if(n.retiredAtMs!==void 0||n.compromisedAtMs!==void 0)throw Error(`${t} cannot be active and carry a retired or compromised timestamp`);return Dm({activatedAtMs:fn(n.activatedAtMs,`${t}.activatedAtMs`)});case`retired`:if(n.activatedAtMs!==void 0||n.compromisedAtMs!==void 0)throw Error(`${t} cannot be retired and carry an active or compromised timestamp`);return Om({retiredAtMs:fn(n.retiredAtMs,`${t}.retiredAtMs`)});case`compromised`:if(n.activatedAtMs!==void 0||n.retiredAtMs!==void 0)throw Error(`${t} cannot be compromised and carry an active or retired timestamp`);return km({compromisedAtMs:fn(n.compromisedAtMs,`${t}.compromisedAtMs`)});default:throw Error(`${t}.state must be active, retired, or compromised`)}}function xm(e,t){let n=E(e,t);mn(n,um,t);let r=mm(n.revocationEpoch,`${t}.revocationEpoch`);switch(n.state){case`provisioning`:if(n.deliveryDigestB64u!==void 0||n.activatedAtMs!==void 0||n.activationReceiptDigestB64u!==void 0||n.revokedAtMs!==void 0||n.revokeReason!==void 0)throw Error(`${t} provisioning state carries fields from another lifecycle state`);return Nm({revocationEpoch:r,startedAtMs:fn(n.startedAtMs,`${t}.startedAtMs`)});case`pending_receipt`:if(n.activatedAtMs!==void 0||n.activationReceiptDigestB64u!==void 0||n.revokedAtMs!==void 0||n.revokeReason!==void 0)throw Error(`${t} pending_receipt state carries fields from another lifecycle state`);return Pm({revocationEpoch:r,startedAtMs:fn(n.startedAtMs,`${t}.startedAtMs`),deliveryDigestB64u:bn(n.deliveryDigestB64u,`${t}.deliveryDigestB64u`)});case`active`:if(n.startedAtMs!==void 0||n.deliveryDigestB64u!==void 0||n.revokedAtMs!==void 0||n.revokeReason!==void 0)throw Error(`${t} active state carries fields from another lifecycle state`);return Fm({revocationEpoch:r,activatedAtMs:fn(n.activatedAtMs,`${t}.activatedAtMs`),activationReceiptDigestB64u:bn(n.activationReceiptDigestB64u,`${t}.activationReceiptDigestB64u`)});case`revoked`:{if(n.startedAtMs!==void 0||n.deliveryDigestB64u!==void 0||n.activatedAtMs!==void 0||n.activationReceiptDigestB64u!==void 0)throw Error(`${t} revoked state carries fields from another lifecycle state`);let e=n.revokeReason;if(e!==`user_revoked`&&e!==`device_compromise`&&e!==`agent_compromise`&&e!==`rotation`)throw Error(`${t}.revokeReason is invalid`);return Im({revocationEpoch:r,revokedAtMs:fn(n.revokedAtMs,`${t}.revokedAtMs`),revokeReason:e})}default:throw Error(`${t}.state must be provisioning, pending_receipt, active, or revoked`)}}function Sm(e,t){if(e.kind!==`signing_lane_reference_v1`)throw Error(`${t}.kind must be signing_lane_reference_v1`);return Mm({walletId:hn(o(e.walletId),`${t}.walletId`),walletKeyId:hn(h(e.walletKeyId),`${t}.walletKeyId`),laneId:hn(u(e.laneId),`${t}.laneId`),laneShareEpoch:hn(d(e.laneShareEpoch),`${t}.laneShareEpoch`),laneKind:ym(e.laneKind,`${t}.laneKind`),participantBindingDigestB64u:hn(Ji(e.participantBindingDigestB64u),`${t}.participantBindingDigestB64u`)})}function Cm(e,t){let n=Sm(e,t);return{walletId:n.walletId,walletKeyId:n.walletKeyId,laneId:n.laneId,laneShareEpoch:n.laneShareEpoch,participantBindingDigestB64u:n.participantBindingDigestB64u,lifecycle:xm(e.lifecycle,`${t}.lifecycle`)}}function wm(e,t){let n=Cm(e,t),r=c(e.walletAuthMethodId);return{...n,walletAuthMethodId:hn(r,`${t}.walletAuthMethodId`),ownerParticipantContinuity:So(e.ownerParticipantContinuity,`${t}.ownerParticipantContinuity`)}}function Tm(e,t){return{...Cm(e,t),ownerParticipantContinuity:So(e.ownerParticipantContinuity,`${t}.ownerParticipantContinuity`)}}function Em(e,t){return{...Cm(e,t),holderParticipant:ma(e.holderParticipant,`${t}.holderParticipant`),serverParticipant:Ki(e.serverParticipant,`${t}.serverParticipant`)}}function Dm(e){return{state:`active`,activatedAtMs:e.activatedAtMs}}function Om(e){return{state:`retired`,retiredAtMs:e.retiredAtMs}}function km(e){return{state:`compromised`,compromisedAtMs:e.compromisedAtMs}}function Am(e){return{kind:`wallet_key_record_v1`,keyFamily:`ed25519`,walletId:e.walletId,walletKeyId:e.walletKeyId,walletKeyVersion:e.walletKeyVersion,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,keyCreationSignerSlot:e.keyCreationSignerSlot,registeredPublicKeyB64u:e.registeredPublicKeyB64u,lifecycle:e.lifecycle}}function jm(e){return{kind:`wallet_key_record_v1`,keyFamily:`ecdsa_secp256k1`,walletId:e.walletId,walletKeyId:e.walletKeyId,walletKeyVersion:e.walletKeyVersion,evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,thresholdPublicKey33B64u:e.thresholdPublicKey33B64u,evmAddress:e.evmAddress,lifecycle:e.lifecycle}}function Mm(e){return{kind:`signing_lane_reference_v1`,walletId:e.walletId,walletKeyId:e.walletKeyId,laneId:e.laneId,laneKind:e.laneKind,laneShareEpoch:e.laneShareEpoch,participantBindingDigestB64u:e.participantBindingDigestB64u}}function Nm(e){return{state:`provisioning`,revocationEpoch:e.revocationEpoch,startedAtMs:e.startedAtMs}}function Pm(e){return{state:`pending_receipt`,revocationEpoch:e.revocationEpoch,startedAtMs:e.startedAtMs,deliveryDigestB64u:e.deliveryDigestB64u}}function Fm(e){return{state:`active`,revocationEpoch:e.revocationEpoch,activatedAtMs:e.activatedAtMs,activationReceiptDigestB64u:e.activationReceiptDigestB64u}}function Im(e){return{state:`revoked`,revocationEpoch:e.revocationEpoch,revokedAtMs:e.revokedAtMs,revokeReason:e.revokeReason}}function Lm(e){return{kind:`signing_lane_reference_v1`,walletId:e.walletId,walletKeyId:e.walletKeyId,laneId:e.laneId,laneKind:`owner_passkey`,laneShareEpoch:e.laneShareEpoch,participantBindingDigestB64u:e.participantBindingDigestB64u,walletAuthMethodId:e.walletAuthMethodId,ownerParticipantContinuity:e.ownerParticipantContinuity,lifecycle:e.lifecycle}}function Rm(e){return{kind:`signing_lane_reference_v1`,walletId:e.walletId,walletKeyId:e.walletKeyId,laneId:e.laneId,laneKind:`owner_email_otp`,laneShareEpoch:e.laneShareEpoch,participantBindingDigestB64u:e.participantBindingDigestB64u,walletAuthMethodId:e.walletAuthMethodId,ownerParticipantContinuity:e.ownerParticipantContinuity,lifecycle:e.lifecycle}}function zm(e){return{kind:`signing_lane_reference_v1`,walletId:e.walletId,walletKeyId:e.walletKeyId,laneId:e.laneId,laneKind:`linked_device`,laneShareEpoch:e.laneShareEpoch,participantBindingDigestB64u:e.participantBindingDigestB64u,holderParticipant:e.holderParticipant,serverParticipant:e.serverParticipant,lifecycle:e.lifecycle,linkedDeviceId:e.linkedDeviceId}}function Bm(e){return{kind:`signing_lane_reference_v1`,walletId:e.walletId,walletKeyId:e.walletKeyId,laneId:e.laneId,laneKind:`delegated_execution`,laneShareEpoch:e.laneShareEpoch,participantBindingDigestB64u:e.participantBindingDigestB64u,holderParticipant:e.holderParticipant,serverParticipant:e.serverParticipant,lifecycle:e.lifecycle,authorizationId:e.authorizationId,agentIdentityKeyId:e.agentIdentityKeyId,custodyBindingId:e.custodyBindingId,authorizationBindingDigestB64u:e.authorizationBindingDigestB64u}}function Vm(e){return{kind:`signing_lane_reference_v1`,walletId:e.walletId,walletKeyId:e.walletKeyId,laneId:e.laneId,laneKind:`recovery`,laneShareEpoch:e.laneShareEpoch,participantBindingDigestB64u:e.participantBindingDigestB64u,ownerParticipantContinuity:e.ownerParticipantContinuity,lifecycle:e.lifecycle}}function Hm(e){return{kind:`signing_lane_reference_v1`,walletId:e.walletId,walletKeyId:e.walletKeyId,laneId:e.laneId,laneKind:`break_glass`,laneShareEpoch:e.laneShareEpoch,participantBindingDigestB64u:e.participantBindingDigestB64u,ownerParticipantContinuity:e.ownerParticipantContinuity,lifecycle:e.lifecycle}}function Um(e,t=`walletKeyRecord`){let n=E(e,t);if(n.kind!==`wallet_key_record_v1`)throw Error(`${t}.kind must be wallet_key_record_v1`);if(n.keyFamily===`ed25519`)return mn(n,$p,t,tm),Am({walletId:hn(o(n.walletId),`${t}.walletId`),walletKeyId:hn(h(n.walletKeyId),`${t}.walletKeyId`),walletKeyVersion:hm(n.walletKeyVersion,`${t}.walletKeyVersion`),nearEd25519SigningKeyId:Vo(n.nearEd25519SigningKeyId),keyCreationSignerSlot:_n(n.keyCreationSignerSlot,`${t}.keyCreationSignerSlot`),registeredPublicKeyB64u:Ln(n.registeredPublicKeyB64u,`${t}.registeredPublicKeyB64u`),lifecycle:bm(n.lifecycle,`${t}.lifecycle`)});if(n.keyFamily===`ecdsa_secp256k1`)return mn(n,em,t,tm),jm({walletId:hn(o(n.walletId),`${t}.walletId`),walletKeyId:hn(h(n.walletKeyId),`${t}.walletKeyId`),walletKeyVersion:hm(n.walletKeyVersion,`${t}.walletKeyVersion`),evmFamilySigningKeySlotId:Rn(n.evmFamilySigningKeySlotId,`${t}.evmFamilySigningKeySlotId`),thresholdPublicKey33B64u:pn(n.thresholdPublicKey33B64u,`${t}.thresholdPublicKey33B64u`),evmAddress:pm(n.evmAddress,`${t}.evmAddress`),lifecycle:bm(n.lifecycle,`${t}.lifecycle`)});throw Error(`${t}.keyFamily must be ed25519 or ecdsa_secp256k1`)}function Wm(e,t=`signingLaneRecord`){let n=E(e,t);if(n.kind!==`signing_lane_reference_v1`)throw Error(`${t}.kind must be signing_lane_reference_v1`);let r=ym(n.laneKind,`${t}.laneKind`);switch(mn(n,dm(r),t,lm),r){case`owner_passkey`:return Lm(wm(n,t));case`owner_email_otp`:return Rm(wm(n,t));case`linked_device`:{let e=Em(n,t);return zm({walletId:e.walletId,walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,participantBindingDigestB64u:e.participantBindingDigestB64u,holderParticipant:e.holderParticipant,serverParticipant:e.serverParticipant,lifecycle:e.lifecycle,linkedDeviceId:hn(f(n.linkedDeviceId),`${t}.linkedDeviceId`)})}case`delegated_execution`:{let e=Em(n,t);return Bm({walletId:e.walletId,walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,participantBindingDigestB64u:e.participantBindingDigestB64u,holderParticipant:e.holderParticipant,serverParticipant:e.serverParticipant,lifecycle:e.lifecycle,authorizationId:vm(n.authorizationId,`${t}.authorizationId`),agentIdentityKeyId:gm(n.agentIdentityKeyId,`${t}.agentIdentityKeyId`),custodyBindingId:_m(n.custodyBindingId,`${t}.custodyBindingId`),authorizationBindingDigestB64u:bn(n.authorizationBindingDigestB64u,`${t}.authorizationBindingDigestB64u`)})}case`recovery`:return Vm(Tm(n,t));case`break_glass`:return Hm(Tm(n,t))}}async function Gm(e){let t=await fetch(`${Ic(e.relayerUrl)}/wallet/execution-lane/owner`,Fc({headers:Lc({token:e.walletSessionToken,missingMessage:`Owner execution-lane preflight requires a Wallet Session token`}),body:{curve:e.curve,expectedMaterialActivation:e.expectedMaterialActivation}})),n=await t.json().catch(()=>null);if(!t.ok){let e=Jm(n);throw Error(e||`Owner execution-lane preflight returned HTTP ${t.status}`)}return Km(n,e.curve)}function Km(e,t){let n=qm(e,[`ok`,`projection`],`owner execution-lane response`);if(n.get(`ok`)!==!0)throw Error(`owner execution-lane response is unsuccessful`);let r=qm(n.get(`projection`),[`kind`,`walletKey`,`lane`,`materialActivation`,`verifiedActivationReceiptDigestB64u`],`owner execution-lane projection`);if(r.get(`kind`)!==`active_owner_wallet_execution_lane_projection_v1`)throw Error(`owner execution-lane projection kind is invalid`);let i=Um(r.get(`walletKey`)),a=Wm(r.get(`lane`)),o=p(r.get(`materialActivation`));if(!o.ok)throw Error(o.error.message);if(i.keyFamily!==t||a.walletId!==i.walletId||a.walletKeyId!==i.walletKeyId||a.laneKind!==`owner_passkey`&&a.laneKind!==`owner_email_otp`)throw Error(`owner execution-lane projection identity is inconsistent`);return{kind:`active_owner_wallet_execution_lane_projection_v1`,walletKey:i,lane:a,materialActivation:o.value,verifiedActivationReceiptDigestB64u:Lr(r.get(`verifiedActivationReceiptDigestB64u`))}}function qm(e,t,n){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)throw Error(`${n} must be a JSON object`);let r=new Map(Object.entries(e)),i=new Set(t);if(r.size!==i.size||[...r.keys()].some(e=>!i.has(e)))throw Error(`${n} fields are invalid`);return r}function Jm(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return null;let t=new Map(Object.entries(e));if(t.size===0||t.size>2||[...t.keys()].some(e=>e!==`code`&&e!==`message`))return null;let n=t.get(`message`);return typeof n==`string`&&n.trim()?n.trim():null}function Ym(e){let t=d(e);if(!t.ok)throw Error(t.error.message);return t.value}function Xm(e){return{walletKey:Um(e.walletKey),lane:Wm(e.lane)}}function Zm(e,t){return{kind:`wallet_execution_lane_refused_v1`,reason:e,walletId:t.walletKey.walletId,walletKeyId:t.walletKey.walletKeyId,laneId:t.lane.laneId}}function Qm(){return{kind:`wallet_execution_lane_refused_v1`,reason:`invalid_boundary_record`}}function $m(e){if(e.lane.lifecycle.state!==`active`)throw Error(`active lane reference requires an active lane`);return{kind:`signing_lane_reference_v1`,walletId:e.lane.walletId,walletKeyId:e.lane.walletKeyId,laneId:e.lane.laneId,laneKind:e.lane.laneKind,laneShareEpoch:e.lane.laneShareEpoch,participantBindingDigestB64u:e.lane.participantBindingDigestB64u,lifecycle:e.lane.lifecycle,materialActivation:e.materialActivation}}function eh(e){switch(e.laneKind){case`owner_passkey`:case`owner_email_otp`:case`recovery`:case`break_glass`:return e.ownerParticipantContinuity;case`linked_device`:case`delegated_execution`:return null}}function th(e,t){return t.length===e.participantIds.length&&t.every((t,n)=>t===e.participantIds[n])}function nh(e,t){let{walletKey:n,lane:r}=e;if(n.lifecycle.state!==`active`)return Zm(`wallet_key_inactive`,e);if(r.lifecycle.state!==`active`)return Zm(`lane_inactive`,e);if(String(n.walletId)!==String(r.walletId)||String(n.walletKeyId)!==String(r.walletKeyId))return Zm(`wallet_key_mismatch`,e);if(n.keyFamily!==t.keyFamily)return Zm(`key_family_mismatch`,e);if(r.laneKind===`linked_device`||r.laneKind===`delegated_execution`)return Zm(`unsupported_lane_kind`,e);let i=eh(r);if(i===null)return Qm();let a;try{a=Ym(t.laneShareEpoch)}catch{return Qm()}return String(a)===String(r.laneShareEpoch)?!String(r.participantBindingDigestB64u)||!String(i.signerId)||!String(i.signingWorkerId)||i.participantIds.length!==2?Zm(`participant_binding_mismatch`,e):null:Zm(`share_epoch_mismatch`,e)}function rh(e){return e.kind===`use_live_runtime`||e.kind===`rehydrate_material_activation`}function ih(e,t){let n=nh(e,t);if(n)return n;let r=e.walletKey,i=e.lane,a=eh(i);if(r.keyFamily!==`ed25519`||i.lifecycle.state!==`active`)return Zm(`key_family_mismatch`,e);if(a===null)return Qm();let o=jc(t.hydration);if(!rh(o))return Zm(`hydration_blocked`,e);if(!b(o.materialActivation,t.metadata.materialActivation))return Zm(`material_activation_mismatch`,e);let s=t.metadata.applicationBinding,c=t.hydration.publicLocator;if(c.kind!==`available`||String(c.walletId)!==String(r.walletId)||c.signerSlot!==s.key_creation_signer_slot||!b(c.materialActivation,t.metadata.materialActivation)||String(o.authority.walletId)!==String(r.walletId)||String(s.wallet_id)!==String(r.walletId)||String(t.metadata.scope.account_id)!==String(s.wallet_id)||String(t.metadata.scope.signing_worker_id)!==String(o.materialActivation.signingWorker)||String(s.near_ed25519_signing_key_id)!==String(r.nearEd25519SigningKeyId)||s.key_creation_signer_slot!==r.keyCreationSignerSlot||F(t.metadata.registeredPublicKey)!==String(r.registeredPublicKeyB64u))return Zm(`public_identity_mismatch`,e);if(String(a.signingWorkerId)!==String(o.materialActivation.signingWorker)||!th(a,t.metadata.participantIds)||t.metadata.participantIds.length!==2||t.metadata.participantIds[0]===t.metadata.participantIds[1]||t.metadata.participantIds.some(e=>!Number.isSafeInteger(e)||e<1))return Zm(`participant_binding_mismatch`,e);let l=o.materialActivation;return{kind:`active_wallet_execution_lane_v1`,keyFamily:`ed25519`,walletKey:r,lane:$m({lane:i,materialActivation:l}),ownerParticipantContinuity:a,materialActivation:l,laneShareEpoch:i.laneShareEpoch,activationReceiptDigestB64u:i.lifecycle.activationReceiptDigestB64u,publicIdentity:{keyFamily:`ed25519`,registeredPublicKeyB64u:r.registeredPublicKeyB64u,nearEd25519SigningKeyId:r.nearEd25519SigningKeyId,keyCreationSignerSlot:r.keyCreationSignerSlot}}}function ah(e,t){let n=nh(e,t);if(n)return n;let r=e.walletKey,i=e.lane,a=eh(i);if(r.keyFamily!==`ecdsa_secp256k1`||i.lifecycle.state!==`active`)return Zm(`key_family_mismatch`,e);if(a===null)return Qm();let o=Zp({lookup:t.lookup,runtime:t.runtime});if(!rh(o)||t.lookup.kind!==`active`)return Zm(`hydration_blocked`,e);let s=t.lookup.manifest,c=s.durableMaterial,l=c.roleLocalPublicFacts,u=s.signer.registeredPublicFacts,d=s.activation.serverActivation.serverActivationReceipt,f=d.protocolReceipt.ecdsa_activation.public_identity,p=Fn({walletId:l.walletId,signingRootId:l.signingRootId,signingRootVersion:l.signingRootVersion});if(!b(o.materialActivation,s.activation.materialActivation)||!b(o.materialActivation,c.materialActivation)||String(o.authority.walletId)!==String(r.walletId)||String(s.signer.walletId)!==String(r.walletId)||String(l.walletId)!==String(r.walletId)||String(r.evmFamilySigningKeySlotId)!==String(p)||String(r.thresholdPublicKey33B64u)!==String(l.groupPublicKey33B64u)||String(r.thresholdPublicKey33B64u)!==String(u.publicKeyB64u)||r.evmAddress.toLowerCase()!==String(l.ethereumAddress).toLowerCase()||r.evmAddress.toLowerCase()!==String(u.thresholdOwnerAddress).toLowerCase()||String(f.context_binding_b64u)!==String(c.bindingDigest)||String(f.derivation_client_share_public_key33_b64u)!==String(l.derivationClientSharePublicKey33B64u)||String(f.threshold_public_key33_b64u)!==String(r.thresholdPublicKey33B64u)||String(d.activationDigest)!==String(i.lifecycle.activationReceiptDigestB64u))return Zm(`activation_receipt_mismatch`,e);if(String(a.signingWorkerId)!==String(o.materialActivation.signingWorker)||!th(a,l.participantIds))return Zm(`participant_binding_mismatch`,e);let m=o.materialActivation;return{kind:`active_wallet_execution_lane_v1`,keyFamily:`ecdsa_secp256k1`,walletKey:r,lane:$m({lane:i,materialActivation:m}),ownerParticipantContinuity:a,materialActivation:m,laneShareEpoch:i.laneShareEpoch,activationReceiptDigestB64u:i.lifecycle.activationReceiptDigestB64u,publicIdentity:{keyFamily:`ecdsa_secp256k1`,thresholdPublicKey33B64u:r.thresholdPublicKey33B64u,evmAddress:r.evmAddress,evmFamilySigningKeySlotId:r.evmFamilySigningKeySlotId}}}function oh(e){let t;try{t=Xm(e)}catch{return Qm()}try{switch(e.material.keyFamily){case`ed25519`:return ih(t,e.material);case`ecdsa_secp256k1`:return ah(t,e.material);default:return e.material,Qm()}}catch{return Qm()}}function sh(e,t){t.wrapKeySalt&&(e.wrapKeySalt=t.wrapKeySalt),t.payload&&(e.payload=t.payload),typeof t.timestamp==`number`&&(e.timestamp=t.timestamp),typeof t.schemaVersion==`number`&&(e.schemaVersion=t.schemaVersion)}function ch(e,t){typeof t.timestamp==`number`&&(e.timestamp=t.timestamp),typeof t.schemaVersion==`number`&&(e.schemaVersion=t.schemaVersion)}function lh(e){let n=Bi(t(e||``));return n.startsWith(`ed25519:`)?n:``}function uh(e){let n=lh(e.publicKey);if(n)return n;let r=Bi(t(e.relayerKeyId||``));return r.startsWith(`ed25519:`)?r:``}function dh(e,t){if(e.role!==`relayer`)return e;let n={id:e.id,role:`relayer`,relayerKeyId:t};return e.relayerUrl&&(n.relayerUrl=e.relayerUrl),e.shareDerivation&&(n.shareDerivation=e.shareDerivation),n}function fh(e){let t=Cn(e.participants),n=t?.some(e=>e.role===`relayer`)===!0;return!t||!n?Pn({relayerKeyId:e.relayerKeyId,clientShareDerivation:`prf_first_v1`}):t.map(t=>dh(t,e.relayerKeyId))}function ph(e,n,r){if(!r)return null;let i=r.payload||{},a=lh(r.publicKey),o=uh({publicKey:a,relayerKeyId:i.relayerKeyId}),s=t(i.keyVersion||``);return!a||!o||!s?null:{nearAccountId:e,signerSlot:n,kind:`threshold_ed25519_v1`,publicKey:a,relayerKeyId:o,keyVersion:s,participants:fh({participants:i.participants,relayerKeyId:o}),timestamp:r.timestamp}}async function mh(e,t,n){return ph(t,n,await Es({deps:e,accountRefs:gc(t),signerSlot:n,keyKind:`threshold_share_v1`}))}async function hh(e,n){let r=t(n.nearAccountId||``).toLowerCase();if(!r)throw Error(`IndexedDBManager: Missing nearAccountId for key write`);if(!Number.isSafeInteger(n.signerSlot)||n.signerSlot<1)throw Error(`IndexedDBManager: Invalid signerSlot for key write`);let i=t(n.keyKind||``);if(!i)throw Error(`IndexedDBManager: Missing keyKind for key write`);let a=String(n.algorithm||`ed25519`).trim().toLowerCase(),o=t(n.publicKey||``);if(!o)throw Error(`IndexedDBManager: Missing publicKey for key write`);let s=t(n.signerId||``);if(!s)throw Error(`IndexedDBManager: Missing signerId for key write`);let c=t(n.chainIdKey||``).toLowerCase(),l=t(n.profileId||``),u=gc(r);if(l||c){if(!l||!c)throw Error(`IndexedDBManager: profileId and chainIdKey are required together for explicit NEAR key material writes`);let t={accountRefs:u,signerSlot:n.signerSlot,keyKind:i,algorithm:a,publicKey:o,signerId:s,explicitProfileId:l,explicitChainIdKey:c,explicitAccountAddress:r};sh(t,n),await xs(e,t);return}let d={accountRefs:u,signerSlot:n.signerSlot,keyKind:i,algorithm:a,publicKey:o,signerId:s};sh(d,n),await xs(e,d)}async function gh(e,n){let r=lh(n.publicKey);if(!r)throw Error(`IndexedDBManager: Missing Ed25519 publicKey for threshold key write`);let i=uh({publicKey:r,relayerKeyId:n.relayerKeyId}),a=t(n.keyVersion||``);if(!i||!a)throw Error(`IndexedDBManager: Missing threshold Ed25519 relayer metadata for key write`);let o={relayerKeyId:i,keyVersion:a,participants:fh({participants:n.participants,relayerKeyId:i})},s=t(n.profileId||``),c=t(n.chainIdKey||``).toLowerCase();if(s||c){if(!s||!c)throw Error(`IndexedDBManager: profileId and chainIdKey are required together for explicit NEAR threshold key writes`);let t={nearAccountId:n.nearAccountId,signerSlot:n.signerSlot,keyKind:`threshold_share_v1`,publicKey:r,signerId:n.signerId,payload:o,profileId:s,chainIdKey:c};ch(t,n),await hh(e,t);return}let l={nearAccountId:n.nearAccountId,signerSlot:n.signerSlot,keyKind:`threshold_share_v1`,publicKey:r,signerId:n.signerId,payload:o};ch(l,n),await hh(e,l)}async function _h(e){let{authority:t,authMethod:n}=e.projection;if(String(t.walletId)!==e.walletId||String(n.walletId)!==e.walletId||String(n.walletAuthMethodId)!==e.walletAuthMethodId||String(n.walletAuthorityId)!==String(t.authorityId))throw Error(`Verified Email OTP authority changed during wallet unlock`);switch(t.provenance.kind){case`wallet_registration`:await K.persistFoundingWalletAuthority({authority:t,authMethod:n});return;case`wallet_recovery`:{if(!Lo(t))throw Error(`Recovered Email OTP authority provenance is invalid`);let r=await K.resolveWalletAuthorityForMethod(e.walletId,e.walletAuthMethodId),i=r.kind===`resolved`?[...String(r.authority.authorityId)===String(t.authorityId)?[]:[`authorityId`],...String(r.authority.authorityDigestB64u)===String(t.authorityDigestB64u)?[]:[`authorityDigest`],...r.authMethod.kind===`email_otp`?[]:[`method.kind`],...r.authMethod.status===`active`?[]:[`method.status`],...String(r.authMethod.walletAuthMethodId)===String(n.walletAuthMethodId)?[]:[`method.id`],...String(r.authMethod.walletAuthorityId)===String(n.walletAuthorityId)?[]:[`method.authorityId`],...r.authMethod.kind===`email_otp`&&r.authMethod.emailHashHex!==n.emailHashHex?[`method.emailHash`]:[]]:[`resolution:${r.kind}`];if(i.length>0)throw Error(`Verified recovered Email OTP authority is not installed on this device: ${i.join(`, `)}`);return}case`device_link`:{let n=await K.resolveWalletAuthorityForMethod(e.walletId,e.walletAuthMethodId);if(n.kind!==`resolved`||String(n.authority.authorityId)!==String(t.authorityId)||String(n.authority.authorityDigestB64u)!==String(t.authorityDigestB64u))throw Error(`Verified linked Email OTP authority is not installed on this device`);return}}t.provenance}async function vh(e){let{authority:t,authMethod:n}=e.projection;if(String(t.walletId)!==e.walletId||String(n.walletId)!==e.walletId||String(n.walletAuthMethodId)!==e.walletAuthMethodId||String(n.walletAuthorityId)!==String(t.authorityId)||n.emailHashHex!==e.emailHashHex)throw Error(`Verified Email OTP authority does not match the wallet unlock factor`);let r=Kn({walletId:e.walletId,provider:e.providerSubject.startsWith(`google:`)?`google`:`email`,providerUserId:e.providerSubject,emailHashHex:e.emailHashHex});return await L({authority:{walletId:r.walletId,factor:r.factor,verifier:r.verifier,bindingId:n.walletAuthMethodId}})}function yh(){}async function bh(e,t){switch(t.kind){case`near_ed25519_wallet`:await e.signingEngine.activateAuthenticatedWalletState({walletId:t.signer.account.wallet.walletId,nearAccountId:Hi(t.signer.account.nearAccountId),signerSlot:t.signer.signerSlot,...e.nearClient?{nearClient:e.nearClient}:{}}),await e.signingEngine.markSelectedEmailOtpWalletAuthorityUnlocked({walletId:t.signer.account.wallet.walletId,walletAuthMethodId:t.walletAuthMethodId}),e.signingEngine.setWalletAuthenticated({kind:`authenticated`,walletId:t.signer.account.wallet.walletId,authMethod:`email_otp`});return;case`evm_family_ecdsa_wallet`:{let n=e.signingEngine.getUserPreferences();n.setCurrentWallet(t.walletId),await n.reloadUserSettings().catch(yh),await e.signingEngine.markSelectedEmailOtpWalletAuthorityUnlocked({walletId:t.walletId,walletAuthMethodId:t.walletAuthMethodId}),e.signingEngine.setWalletAuthenticated({kind:`authenticated`,walletId:t.walletId,authMethod:`email_otp`});return}}}function xh(e){return e.chainTarget.kind}function Sh(e){return e}function Ch(e){return!e||e.curve!==`ecdsa`||!e.chainTarget||!Mf(e)||!String(e.publicFacts.keyHandle||``).trim()?!1:e.source===`active_wallet_authority`?e.runtime.requiredCapability===`export_keys`&&e.state===`deferred`&&e.authorizationState===`authorization_required`:e.authorization?!0:e.state===`deferred`}function wh(e){if(e.length!==2)throw Error(`[SigningEngine][ecdsa-export] ECDSA participant set must contain two parties`);let t=e[0],n=e[1];if(!Number.isSafeInteger(t)||!Number.isSafeInteger(n)||t<=0||n<=0||t===n)throw Error(`[SigningEngine][ecdsa-export] ECDSA participant set is invalid`);return[t,n]}function Th(e){let{exportLane:t,label:n}=e,r=t.capability,i=r.manifest.signer;if(i.walletId!==t.key.walletId||!i.scope.targetMemberships.some(e=>Vr(e,t.chainTarget)))throw Error(`[SigningEngine][ecdsa-export] ${n} capability target mismatch`);if(!e.authMatches())throw Error(`[SigningEngine][ecdsa-export] ${n} capability auth mismatch`);if(!b(r.manifest.activation.materialActivation,t.laneIdentity.signer.materialActivation))throw Error(`[SigningEngine][ecdsa-export] ${n} material activation mismatch`);po({expected:t.publicFacts,actual:i.registeredPublicFacts,context:`canonical ${n} export lane`});let a=r.material.publicFacts;if(a.walletId!==i.walletId||String(a.keyHandle)!==String(t.publicFacts.keyHandle)||String(a.groupPublicKey33B64u)!==String(t.publicFacts.publicKeyB64u)||String(a.ethereumAddress)!==String(t.publicFacts.thresholdOwnerAddress)||a.participantIds.length!==t.publicFacts.participantIds.length||a.participantIds.some((e,n)=>e!==t.publicFacts.participantIds[n]))throw Error(`[SigningEngine][ecdsa-export] canonical ${n} export material mismatch`);let o=r.manifest.durableMaterial,s=o.runtimePolicyScope,c=String(e.deps.relayerUrl).trim().replace(/\/+$/g,``);if(!s)throw Error(`[SigningEngine][ecdsa-export] ${n} runtime policy scope is missing`);if(!c)throw Error(`[SigningEngine][ecdsa-export] ${n} export relayer URL is missing`);return{durable:o,runtimePolicyScope:s,relayerUrl:c}}function Eh(e){let{exportLane:t}=e,n=t.capability,r=n.authority;if(!$n(r))throw Error(`[SigningEngine][ecdsa-export] Email OTP capability authority mismatch`);let{durable:i,runtimePolicyScope:a,relayerUrl:o}=Th({deps:e.deps,exportLane:t,label:`Email OTP`,authMatches:()=>t.laneIdentity.auth.kind===`email_otp`&&t.laneIdentity.auth.providerSubjectId===r.factor.providerUserId});return{source:`canonical_capability`,kind:`fresh_email_otp_route_auth_ready`,chainTarget:t.chainTarget,publicFacts:t.publicFacts,runtimePolicyScope:a,persistedMaterial:n.material,normalSigning:i.routerAbEcdsaDerivationNormalSigning,relayerKeyId:String(i.roleLocalBinding.relayerKeyId),participantIds:wh(i.roleLocalBinding.participantIds),relayerUrl:o,authorization:{kind:`fresh_operation_authorization_required`,authority:r}}}function Dh(e){let{exportLane:t}=e,n=t.capability,r=n.authority;if(!Jn(r))throw Error(`[SigningEngine][ecdsa-export] passkey capability authority mismatch`);let{durable:i,runtimePolicyScope:a,relayerUrl:o}=Th({deps:e.deps,exportLane:t,label:`passkey`,authMatches:()=>t.laneIdentity.auth.kind===`passkey`&&t.laneIdentity.auth.credentialIdB64u===r.factor.credentialIdB64u});return{source:`canonical_capability`,kind:`fresh_passkey_needs_authorization`,chainTarget:t.chainTarget,publicFacts:t.publicFacts,runtimePolicyScope:a,publicCapability:i.roleLocalPublicFacts.publicCapability,existingRoleLocalMaterial:n.material,normalSigning:i.routerAbEcdsaDerivationNormalSigning,relayerKeyId:String(i.roleLocalBinding.relayerKeyId),participantIds:wh(i.roleLocalBinding.participantIds),relayerUrl:o}}function Oh(e){let{exportLane:t,resolution:n}=e;if(t.laneIdentity.auth.kind!==`email_otp`)throw Error(`[SigningEngine][ecdsa-export] Email OTP runtime auth mismatch`);if(n.runtime.authBinding.kind!==`email_otp`)throw Error(`[SigningEngine][ecdsa-export] Email OTP runtime authority mismatch`);if(t.laneIdentity.auth.providerSubjectId!==n.runtime.authBinding.providerSubjectId)throw Error(`[SigningEngine][ecdsa-export] Email OTP runtime auth mismatch`);if(!b(n.runtime.materialActivation,t.laneIdentity.signer.materialActivation))throw Error(`[SigningEngine][ecdsa-export] Email OTP material activation mismatch`);let r=n.runtime.runtimePolicyScope;if(!r)throw Error(`[SigningEngine][ecdsa-export] Email OTP runtime policy scope is missing`);let i=Md({authority:n.manifest.signer.authority,materialActivation:n.manifest.activation.materialActivation,publicFacts:n.manifest.durableMaterial.roleLocalPublicFacts});return{source:`canonical_capability`,kind:`fresh_email_otp_route_auth_ready`,chainTarget:t.chainTarget,publicFacts:t.publicFacts,runtimePolicyScope:r,persistedMaterial:i,normalSigning:n.runtime.normalSigning,relayerKeyId:n.runtime.relayerKeyId,participantIds:n.runtime.participantIds,relayerUrl:n.runtime.relayerUrl,authorization:{kind:`fresh_operation_authorization_required`,authority:n.runtime.authBinding.emailOtpAuthority}}}function kh(e){let{exportLane:t}=e,n=t.runtime;if(n.requiredCapability!==`export_keys`)throw Error(`[SigningEngine][ecdsa-export] active Wallet Authority lane lacks export_keys capability`);if(n.walletId!==t.key.walletId)throw Error(`[SigningEngine][ecdsa-export] active Wallet Authority wallet mismatch`);if(!b(n.materialActivation,t.laneIdentity.signer.materialActivation))throw Error(`[SigningEngine][ecdsa-export] active Wallet Authority material activation mismatch`);po({expected:t.publicFacts,actual:n.publicFacts,context:`active Wallet Authority ECDSA export lane`});let r=n.normalSigning,i=r.scope;if(i.wallet_id!==String(n.walletId)||i.ecdsa_threshold_key_id!==n.ecdsaThresholdKeyId||i.public_identity.threshold_public_key33_b64u!==n.publicFacts.publicKeyB64u||!b(Xn(i.material_activation),n.materialActivation))throw Error(`[SigningEngine][ecdsa-export] active Wallet Authority normal-signing identity mismatch`);let a=String(e.deps.relayerUrl).trim().replace(/\/+$/g,``);if(!a)throw Error(`[SigningEngine][ecdsa-export] active Wallet Authority export relayer URL is missing`);let o=wh(n.publicFacts.participantIds);if(n.auth.kind===`passkey`){if(!Jn(n.factorAuthority))throw Error(`[SigningEngine][ecdsa-export] active passkey factor authority mismatch`);if(n.factorAuthority.factor.credentialIdB64u!==n.auth.credentialIdB64u||n.factorAuthority.bindingId!==n.walletAuthMethodId)throw Error(`[SigningEngine][ecdsa-export] active passkey factor identity mismatch`);return{source:`active_wallet_authority`,kind:`active_wallet_authority_passkey_needs_authorization`,chainTarget:t.chainTarget,publicFacts:n.publicFacts,normalSigning:r,relayerKeyId:n.relayerKeyId,participantIds:o,relayerUrl:a,runtime:n,factorAuthority:n.factorAuthority,authMethod:`passkey`}}if(!$n(n.factorAuthority))throw Error(`[SigningEngine][ecdsa-export] active Email OTP factor authority mismatch`);if(n.factorAuthority.factor.providerUserId!==n.auth.providerSubjectId||n.factorAuthority.bindingId!==n.walletAuthMethodId)throw Error(`[SigningEngine][ecdsa-export] active Email OTP factor identity mismatch`);return{source:`active_wallet_authority`,kind:`active_wallet_authority_email_otp_needs_authorization`,chainTarget:t.chainTarget,publicFacts:n.publicFacts,normalSigning:r,relayerKeyId:n.relayerKeyId,participantIds:o,relayerUrl:a,runtime:n,factorAuthority:n.factorAuthority,authMethod:`email_otp`}}async function Ah(e,t){if(t.source!==`canonical_capability`)throw Error(`[SigningEngine][ecdsa-export] active Wallet Authority Email OTP material uses its holder runtime`);if(t.authMethod!==`email_otp`)throw Error(`[SigningEngine][ecdsa-export] fresh Email OTP export requires Email OTP lane`);let n=await e.resolveActiveEcdsaCapabilityRuntime({walletId:t.key.walletId,chainTarget:t.chainTarget});if(n.kind===`blocked`&&n.reason===`missing_material`)return Eh({deps:e,exportLane:t});if(n.kind!==`resolved`)throw Error(`[SigningEngine][ecdsa-export] Email OTP capability runtime unavailable: ${n.reason}`);return Oh({exportLane:t,resolution:n})}async function jh(e,t){if(t.source===`active_wallet_authority`)return kh({deps:e,exportLane:t});if(t.authMethod===`email_otp`)return await Ah(e,t);let n=await e.resolveActiveEcdsaCapabilityRuntime({walletId:t.key.walletId,chainTarget:t.chainTarget});if(n.kind===`blocked`&&n.reason===`missing_material`)return Dh({deps:e,exportLane:t});if(n.kind!==`resolved`)throw Error(`[SigningEngine][ecdsa-export] passkey capability runtime unavailable: ${n.reason}`);if(!b(n.runtime.materialActivation,t.laneIdentity.signer.materialActivation))throw Error(`[SigningEngine][ecdsa-export] passkey material activation mismatch`);if(n.runtime.authBinding.kind!==`passkey`)throw Error(`[SigningEngine][ecdsa-export] passkey authority binding mismatch`);let r=n.manifest.signer.registeredPublicFacts;po({expected:t.publicFacts,actual:r,context:`canonical passkey export lane`});let i=n.runtime.runtimePolicyScope;if(!i)throw Error(`[SigningEngine][ecdsa-export] durable passkey export requires runtimePolicyScope`);return{source:`canonical_capability`,kind:`fresh_passkey_needs_authorization`,chainTarget:t.chainTarget,publicFacts:r,runtimePolicyScope:i,publicCapability:n.manifest.durableMaterial.roleLocalPublicFacts.publicCapability,existingRoleLocalMaterial:Md({authority:n.manifest.signer.authority,materialActivation:n.manifest.durableMaterial.materialActivation,publicFacts:n.manifest.durableMaterial.roleLocalPublicFacts}),normalSigning:n.runtime.normalSigning,relayerKeyId:n.runtime.relayerKeyId,participantIds:n.runtime.participantIds,relayerUrl:n.runtime.relayerUrl}}const Mh=`ecdsa-derivation:role-local:product-export-confirmation:v5`,Nh=`ecdsa-derivation:role-local:product-export-authorization:v5`;function Ph(e){return{kind:`operation_step_up`}}function Fh(e){return{authorizationKind:e.kind,authorizationId:e.evidenceSetDigest}}function Ih(){let e=globalThis.crypto;if(!e||typeof e.getRandomValues!=`function`)throw Error(`crypto.getRandomValues is required for threshold ECDSA export`);return F(e.getRandomValues(new Uint8Array(32)))}async function Lh(e){let t=String(e.relayerUrl||``).trim().replace(/\/+$/g,``);if(!t)throw Error(`[SigningEngine][ecdsa-export] relayer URL is required`);if(e.authorization.kind===`wallet_session_bearer`&&!e.authorization.token.trim())throw Error(`[SigningEngine][ecdsa-export] Wallet Session operation credential is required`);let n={"Content-Type":`application/json`};e.authorization.kind===`wallet_session_bearer`&&(n.Authorization=`Bearer ${e.authorization.token}`);try{let r=await fetch(`${t}${rr}`,{method:`POST`,credentials:e.authorization.kind===`legacy_cookie`?`include`:`omit`,headers:n,body:JSON.stringify({request:e.request,requestDigestB64u:e.requestDigestB64u})}),i=await r.json().catch(()=>null);if(!r.ok){let e=i&&typeof i==`object`&&!Array.isArray(i)?i:null;return{ok:!1,code:String(e?.code||`http_error`),message:String(e?.message||`HTTP ${r.status}`)}}return{ok:!0,value:hr(i)}}catch(e){return{ok:!1,error:e instanceof Error?e.message:String(e)}}}async function Rh(e){return await Lh({...e,authorization:{kind:`legacy_cookie`}})}async function zh(e){return await Lh({relayerUrl:e.relayerUrl,request:e.request,requestDigestB64u:e.requestDigestB64u,authorization:{kind:`wallet_session_bearer`,token:e.operationCredential.token}})}function Bh(e){let t=Math.min(e.issuedAtUnixMs+6e4,e.authorizationExpiresAtMsCeiling??1/0);if(Number.isFinite(t)&&t>e.issuedAtUnixMs)return t;throw new Sf({failure:Tf(Cf.expired),message:`Wallet Session expired before ECDSA export authorization`})}function Vh(e){if(String(e.material.persistedMaterial.publicFacts.walletId)!==String(e.walletSessionUserId))throw Error(`[SigningEngine][ecdsa-export] explicit export wallet mismatch`)}async function Hh(e){return F(await jr(kr(e)))}function Uh(e){switch(e.kind){case`rehydrated`:return e;case`device_link_required`:throw Error(`[SigningEngine][ecdsa-export] device_link_required: local threshold ECDSA material is unavailable`);case`corrupt`:throw Error(`[SigningEngine][ecdsa-export] local threshold ECDSA material is corrupt (${e.reason}): ${e.message}`);default:{let t=e;throw Error(`Unsupported ECDSA export material resolution: ${String(t)}`)}}}async function Wh(e){return Uh(await Rd({purpose:`explicit_key_export`,source:jd(e.persistedMaterial),workerCtx:e.workerCtx}))}function Gh(e){let t=Fh(e.material.operationAuthorization),n=e.material.persistedMaterial.publicFacts;return{version:Nh,operation:`explicit_key_export`,keyHandle:n.keyHandle,walletId:String(n.walletId),ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,relayerKeyId:n.publicCapability.signer_set.selected_server.server_id,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,contextBinding32B64u:e.contextBinding32B64u,publicIdentity:e.publicIdentity,exportRequestNonce32B64u:e.exportRequestNonce32B64u,confirmationDigest32B64u:e.confirmationDigest32B64u,issuedAtUnixMs:e.issuedAtUnixMs,expiresAtUnixMs:e.expiresAtUnixMs,authorizationKind:t.authorizationKind,authorizationId:t.authorizationId,materialActivation:Un(e.material.persistedMaterial.materialActivation),participantIds:n.participantIds}}async function Kh(e,t){let n=t.persistedMaterial.publicFacts,r=Un(t.persistedMaterial.materialActivation);switch(t.factorAuthorization.kind){case`passkey`:{let e=String(t.factorAuthorization.credential.rawId||t.factorAuthorization.credential.id||``).trim();if(!e)throw Error(`[SigningEngine][ecdsa-export] passkey authorization credential is missing`);if(e!==t.factorAuthorization.passkeyCredentialIdB64u)throw Error(`[SigningEngine][ecdsa-export] passkey export authorization credential mismatch`);break}case`email_otp_verified`:break;default:{let e=t.factorAuthorization;throw Error(`Unsupported ECDSA export authorization: ${String(e)}`)}}let i=Date.now(),a=Bh({issuedAtUnixMs:i,authorizationExpiresAtMsCeiling:t.operationAuthorization.expiresAtMs}),o={derivationClientSharePublicKey33B64u:n.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:n.relayerPublicKey33B64u,groupPublicKey33B64u:n.groupPublicKey33B64u,ethereumAddress:n.ethereumAddress},s=Ih(),c=Fh(t.operationAuthorization),l=await Hh({version:Mh,walletId:String(n.walletId),ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,relayerKeyId:n.publicCapability.signer_set.selected_server.server_id,contextBinding32B64u:n.contextBinding32B64u,publicIdentity:o,authorizationKind:c.authorizationKind,authorizationId:c.authorizationId,materialActivation:r,exportRequestNonce32B64u:s,issuedAtUnixMs:i,expiresAtUnixMs:a}),u=await Hh(Gh({ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,contextBinding32B64u:n.contextBinding32B64u,publicIdentity:o,exportRequestNonce32B64u:s,confirmationDigest32B64u:l,issuedAtUnixMs:i,expiresAtUnixMs:a,material:t})),d=n.publicCapability,f=`ecdsa-export:${s}`,p=await yd({workerCtx:e.getSignerWorkerContext(),command:{kind:`create_router_ab_ecdsa_explicit_export_ceremony_v1`,ceremonyId:f,request:{context:d.context,lifecycle:{lifecycle_id:f,work_kind:`key_export`,primitive_request_kind:`export`,root_share_epoch:d.activation_epoch,account_id:String(n.walletId),session_id:Xs.thresholdEcdsaSession(f),signer_set_id:d.signer_set.signer_set_id,selected_server_id:d.signer_set.selected_server.server_id},public_identity:d.public_identity,signer_set:d.signer_set,router_id:d.router_id,client_id:d.client_id,authorization:Ph(t.operationAuthorization),authorization_id:t.operationAuthorization.evidenceSetDigest,operation:t.operationAuthorization.operation,material_activation:r,export_authorization_digest_b64u:u,export_nonce:s,expires_at_ms:a,deriver_recipient_keys:d.deriver_recipient_keys}}});if(p.kind!==`router_ab_ecdsa_explicit_export_ceremony_created_v1`)throw Error(`[SigningEngine][ecdsa-export] strict export ceremony kind mismatch`);try{let i=await Rh({relayerUrl:t.relayerUrl,request:p.request,requestDigestB64u:p.requestDigestB64u});if(!i.ok)throw Error(i.error||i.message||i.code||`Strict ECDSA explicit export request failed`);let a=await Ed({workerCtx:e.getSignerWorkerContext(),command:{kind:`finalize_router_ab_ecdsa_explicit_export_v1`,ceremonyId:f,clientProofFinalization:{kind:`finalize_encrypted_client_proof_bundles_v2`,bundles:i.value.response.bundles},signingWorkerExport:i.value.signing_worker_export,authorizationKind:c.authorizationKind,authorizationId:c.authorizationId,materialActivation:r,roleLocalMaterial:t.liveMaterial.liveHandle,roleLocalMaterialRef:t.liveMaterial.materialRef,publicFacts:n}});return{publicKeyHex:a.publicKeyHex,privateKeyHex:a.privateKeyHex,ethereumAddress:a.ethereumAddress}}catch(t){throw await Sd({workerCtx:e.getSignerWorkerContext(),command:{kind:`close_router_ab_ecdsa_post_registration_ceremony_v1`,ceremonyId:f}}).catch(()=>void 0),t}}async function qh(e,t){let n=t.exportProvision.material;Vh({material:n,walletSessionUserId:t.walletSessionUserId});let r=String(n.relayerUrl||``).trim();if(!r)throw Error(`[SigningEngine][ecdsa-export] relayer URL is required`);let i=n.persistedMaterial;return await Kh(e,{persistedMaterial:i,liveMaterial:await Wh({persistedMaterial:i,workerCtx:e.getSignerWorkerContext()}),relayerUrl:r,operationAuthorization:t.exportProvision.authorization,factorAuthorization:t.factorAuthorization})}function Jh(e){let t=e.runtime.normalSigning.scope,n=e.operationAuthorization.operation,r=Xn(n.material_activation);if(n.operation_kind!==`evm.export_key`||n.wallet_id!==String(e.runtime.walletId)||n.key_handle!==e.runtime.publicFacts.keyHandle||n.relayer_key_id!==e.runtime.relayerKeyId||n.participant_ids[0]!==e.runtime.publicFacts.participantIds[0]||n.participant_ids[1]!==e.runtime.publicFacts.participantIds[1]||n.signing_worker_id!==t.signing_worker.server_id||n.normal_signing_scope.wallet_id!==t.wallet_id||n.normal_signing_scope.context.application_binding_digest_b64u!==t.context.application_binding_digest_b64u||n.normal_signing_scope.public_identity.context_binding_b64u!==t.public_identity.context_binding_b64u||n.normal_signing_scope.public_identity.threshold_public_key33_b64u!==t.public_identity.threshold_public_key33_b64u||n.normal_signing_scope.signing_worker.server_id!==t.signing_worker.server_id||!b(r,e.runtime.materialActivation)||!b(Xn(n.normal_signing_scope.material_activation),e.runtime.materialActivation))throw Error(`[SigningEngine][ecdsa-export] active Wallet Authority operation identity changed`)}async function Yh(e,t){Jh(t);let n=t.runtime,r=n.normalSigning.scope;if(t.operationAuthorization.exportTopology.signer_set.selected_server.server_id!==r.signing_worker.server_id)throw Error(`[SigningEngine][ecdsa-export] active export topology changed`);let i=r.material_activation,a=Date.now(),o=Bh({issuedAtUnixMs:a,authorizationExpiresAtMsCeiling:t.operationAuthorization.expiresAtMs}),s={derivationClientSharePublicKey33B64u:r.public_identity.derivation_client_share_public_key33_b64u,relayerPublicKey33B64u:r.public_identity.server_public_key33_b64u,groupPublicKey33B64u:r.public_identity.threshold_public_key33_b64u,ethereumAddress:n.publicFacts.thresholdOwnerAddress},c=Ih(),l=Fh(t.operationAuthorization),u=await Hh({version:Mh,walletId:String(n.walletId),ecdsaThresholdKeyId:r.ecdsa_threshold_key_id,relayerKeyId:n.relayerKeyId,contextBinding32B64u:r.public_identity.context_binding_b64u,publicIdentity:s,authorizationKind:l.authorizationKind,authorizationId:l.authorizationId,materialActivation:i,exportRequestNonce32B64u:c,issuedAtUnixMs:a,expiresAtUnixMs:o}),d=await Hh({version:Nh,operation:`explicit_key_export`,keyHandle:n.publicFacts.keyHandle,walletId:String(n.walletId),ecdsaThresholdKeyId:r.ecdsa_threshold_key_id,relayerKeyId:n.relayerKeyId,signingRootId:r.signing_root_id,signingRootVersion:r.signing_root_version,contextBinding32B64u:r.public_identity.context_binding_b64u,publicIdentity:s,exportRequestNonce32B64u:c,confirmationDigest32B64u:u,issuedAtUnixMs:a,expiresAtUnixMs:o,authorizationKind:l.authorizationKind,authorizationId:l.authorizationId,materialActivation:i,participantIds:n.publicFacts.participantIds}),f=`ecdsa-export:${c}`,p={context:r.context,lifecycle:{lifecycle_id:f,work_kind:`key_export`,primitive_request_kind:`export`,root_share_epoch:r.activation_epoch,account_id:r.wallet_id,session_id:Xs.thresholdEcdsaSession(f),signer_set_id:t.operationAuthorization.exportTopology.signer_set.signer_set_id,selected_server_id:t.operationAuthorization.exportTopology.signer_set.selected_server.server_id},public_identity:r.public_identity,signer_set:t.operationAuthorization.exportTopology.signer_set,router_id:t.operationAuthorization.exportTopology.router_id,client_id:String(n.walletId),authorization:Ph(t.operationAuthorization),operation:t.operationAuthorization.operation,authorization_id:Lr(t.operationAuthorization.evidenceSetDigest),material_activation:i,export_authorization_digest_b64u:d,export_nonce:c,expires_at_ms:o,deriver_recipient_keys:t.operationAuthorization.exportTopology.deriver_recipient_keys},m=await ud({holderHandleId:n.holderRuntime.holderHandleId,request:p,workerCtx:e.getSignerWorkerContext()});if(m.kind!==`ecdsa_holder_ordinary_export_request_created_v1`)throw Error(`[SigningEngine][ecdsa-export] active holder export request kind mismatch`);let h=await zh({relayerUrl:t.relayerUrl,request:m.request,requestDigestB64u:m.requestDigestB64u,operationCredential:n.operationCredential});if(!h.ok)throw Error(h.error||h.message||h.code||`Active Wallet Authority ECDSA export request failed`);let g={wallet_id:r.wallet_id,key_handle:n.publicFacts.keyHandle,ecdsa_threshold_key_id:r.ecdsa_threshold_key_id,signing_root_id:r.signing_root_id,signing_root_version:r.signing_root_version,activation_epoch:r.activation_epoch,signing_worker_id:r.signing_worker.server_id,context_binding_b64u:r.public_identity.context_binding_b64u,threshold_public_key33_b64u:r.public_identity.threshold_public_key33_b64u,export_request_digest_b64u:m.requestDigestB64u,export_authorization_digest_b64u:d,export_nonce:c,authorization_kind:`verified_step_up`,authorization_id:t.operationAuthorization.evidenceSetDigest,material_activation:i,lifecycle_id:f,recipient_identity:m.request.client_id,recipient_public_key:m.request.client_ephemeral_public_key,expires_at_ms:m.request.expires_at_ms},_=await Cd({holderHandleId:n.holderRuntime.holderHandleId,requestDigestB64u:m.requestDigestB64u,expectedBinding:g,forwardedResponse:h.value,workerCtx:e.getSignerWorkerContext()});return{publicKeyHex:_.publicKeyHex,privateKeyHex:_.privateKeyHex,ethereumAddress:_.ethereumAddress}}function Xh(e,t,n){let r=String(e||``).trim();if(!r)throw Error(`[signer-core-command] ${t} is required`);if(I(r).length!==n)throw Error(`[signer-core-command] ${t} must decode to ${n} bytes`);return r}function Zh(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`[signer-core-command] ${t} must be an object`);return e}function Qh(e,t,n){let r=Object.keys(e).sort(),i=[...t].sort();if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`[signer-core-command] ${n} fields are invalid`)}function $h(e,t){if(typeof e!=`string`)throw Error(`[signer-core-command] ${t} must be a string`);let n=e.trim();if(!n)throw Error(`[signer-core-command] ${t} is required`);return n}function eg(e){return Xh(e,`derivationClientSharePublicKey33B64u`,33)}function tg(e){return Xh(e,`relayerPublicKey33B64u`,33)}function ng(e,t){return Xh(e,t,33)}function rg(e){let t=String(e||``).trim();if(!/^0x[0-9a-fA-F]{40}$/.test(t))throw Error(`[signer-core-command] ethereumAddress must be 0x-prefixed 20-byte hex`);return t}function ig(e){let t=Zh(e,`ECDSA pending state blob`);if(Qh(t,[`kind`,`curve`,`encoding`,`producer`,`stateBlobB64u`],`ECDSA pending state blob`),Reflect.get(t,`kind`)!==`ecdsa_role_local_pending_state_blob_v1`||Reflect.get(t,`curve`)!==`secp256k1`||Reflect.get(t,`encoding`)!==`base64url`||Reflect.get(t,`producer`)!==`signer_core`)throw Error(`[signer-core-command] invalid ECDSA pending state blob envelope`);return{kind:`ecdsa_role_local_pending_state_blob_v1`,curve:`secp256k1`,encoding:`base64url`,producer:`signer_core`,stateBlobB64u:$h(Reflect.get(t,`stateBlobB64u`),`pendingStateBlob.stateBlobB64u`)}}function ag(e){if(e.kind!==`ecdsa_role_local_state_blob_v1`||e.curve!==`secp256k1`||e.encoding!==`base64url`||e.producer!==`signer_core`)throw Error(`[signer-core-command] invalid ECDSA ready state blob envelope`);return e}function og(e){return{kind:e.kind,algorithm:e.algorithm,context:{applicationBindingDigestB64u:e.context.applicationBindingDigestB64u},participants:{clientParticipantId:e.participants.clientParticipantId,relayerParticipantId:e.participants.relayerParticipantId,participantIds:[...e.participants.participantIds]},secretSource:{kind:`threshold_prf_x_client_base`,xClientBaseB64u:Xh(e.secretSource.xClientBaseB64u,`secretSource.xClientBaseB64u`,32)}}}function sg(e){if(e.clientBootstrap.participantId!==1)throw Error(`[signer-core-command] ECDSA client bootstrap participantId must be 1`);let t=eg(e.clientBootstrap.derivationClientSharePublicKey33B64u);return{pendingStateBlob:ig(e.pendingStateBlob),clientBootstrap:{contextBinding32B64u:Xh(e.clientBootstrap.contextBinding32B64u,`contextBinding32B64u`,32),derivationClientSharePublicKey33B64u:t,clientShareRetryCounter:e.clientBootstrap.clientShareRetryCounter,participantId:1},publicFacts:{derivationClientSharePublicKey33B64u:eg(e.publicFacts.derivationClientSharePublicKey33B64u),clientVerifyingShareB64u:ng(e.publicFacts.clientVerifyingShareB64u,`clientVerifyingShareB64u`)}}}function cg(e){return{kind:e.kind,pendingStateBlob:e.pendingStateBlob,relayerPublicIdentity:{relayerKeyId:e.relayerPublicIdentity.relayerKeyId,relayerPublicKey33B64u:e.relayerPublicIdentity.relayerPublicKey33B64u,groupPublicKey33B64u:e.relayerPublicIdentity.groupPublicKey33B64u,ethereumAddress:e.relayerPublicIdentity.ethereumAddress,relayerShareRetryCounter:e.relayerPublicIdentity.relayerShareRetryCounter}}}function lg(e){return{stateBlob:ag(e.stateBlob),publicFacts:{contextBinding32B64u:Xh(e.publicFacts.contextBinding32B64u,`contextBinding32B64u`,32),derivationClientSharePublicKey33B64u:eg(e.publicFacts.derivationClientSharePublicKey33B64u),clientVerifyingShareB64u:ng(e.publicFacts.clientVerifyingShareB64u,`clientVerifyingShareB64u`),relayerPublicKey33B64u:tg(e.publicFacts.relayerPublicKey33B64u),groupPublicKey33B64u:ng(e.publicFacts.groupPublicKey33B64u,`groupPublicKey33B64u`),ethereumAddress:rg(e.publicFacts.ethereumAddress)}}}function ug(e){return{ok:!1,code:`unavailable`,message:e}}function dg(e,t){return{ok:!1,failure:`invocation`,code:e,message:t}}function fg(e,t){return{ok:!1,failure:`command`,code:e,message:t}}function pg(e){let t=I(e),n=new ArrayBuffer(t.byteLength);return new Uint8Array(n).set(t),n}function mg(e){return{challenge:pg(e.challengeB64u),rp:{id:e.rpId,name:e.rpId},user:{id:pg(e.user.idB64u),name:e.user.name,displayName:e.user.displayName},pubKeyCredParams:e.pubKeyCredParams.map(e=>({type:e.type,alg:e.alg})),authenticatorSelection:e.authenticatorSelection,timeout:e.timeoutMs,attestation:e.attestation,excludeCredentials:e.excludeCredentials.map(e=>({type:e.type,id:pg(e.id)})),extensions:{prf:{eval:{first:I(e.extensions.prf.eval.firstB64u),second:I(e.extensions.prf.eval.secondB64u)}}}}}function hg(e){return/wasm (initialization|initialize|instantiation)|webassembly|module_or_path|failed to (load|compile|instantiate) wasm|derivation client wasm initialization failed/i.test(e)}function gg(e){let t=id(e),n=nd(e),r=P(e);if(n===`ECDSA_DERIVATION_WASM_INIT_FAILURE`||hg(r))return dg(`native_binding_failure`,r);switch(t){case`TIMEOUT`:return dg(`timeout`,r);case`WORKER_POSTMESSAGE_ERROR`:case`WORKER_PROTOCOL_ERROR`:case`WORKER_RUNTIME_ERROR`:return dg(`worker_transport_failure`,r);default:break}return/timed out/i.test(r)?dg(`timeout`,r):/postMessage|worker runtime|worker response|worker protocol|Malformed worker|Unknown worker/i.test(r)?dg(`worker_transport_failure`,r):null}function _g(e){let t=P(e);return/relayer|public identity|group public key|ethereum address|threshold public key/i.test(t)?fg(`public_identity_mismatch`,t):fg(`invalid_pending_state`,t)}function vg(e){return{kind:`durable_record_store`,async loadEcdsaRoleLocalReadyRecord(t){let n=rc(t);try{let r=await e.getAppState(n);if(r!=null){let e=ec(r);return ac({record:e,input:t})?{ok:!0,value:{kind:`found`,record:e}}:{ok:!0,value:{kind:`malformed`,cleanup:{...t,reason:`Stored ECDSA role-local record identity does not match lookup input`},message:`Stored ECDSA role-local record identity does not match lookup input`}}}return{ok:!0,value:{kind:`not_found`}}}catch(e){let n=P(e);return{ok:!0,value:{kind:`malformed`,cleanup:{...t,reason:n},message:n}}}},async persistEcdsaRoleLocalReadyRecord(t){try{let n=ec(t.record);return ac({record:n,input:t.storageKeyFacts})?(await e.setAppState(rc(t.storageKeyFacts),ic(n)),{ok:!0,value:{kind:`persisted`}}):{ok:!1,code:`invalid_record`,message:`ECDSA role-local ready record identity does not match storageKeyFacts`}}catch(e){return{ok:!1,code:`invalid_record`,message:P(e)}}},async cleanupMalformedEcdsaRoleLocalRecord(t){try{return await e.setAppState(rc(t),null),{ok:!0,value:{kind:`deleted`}}}catch(e){return{ok:!1,code:`unavailable`,message:P(e)}}}}}function yg(){return{kind:`secure_secret_store`,async seal(){return ug(`Browser secure secret store is not wired yet`)},async unseal(){return ug(`Browser secure secret store is not wired yet`)},async delete(){return ug(`Browser secure secret store is not wired yet`)}}}function bg(e){return e instanceof DOMException?e.name===`NotAllowedError`?{ok:!1,code:`not_allowed`,message:e.message||`Passkey operation was not allowed`}:{ok:!1,code:`platform_error`,message:e.message||e.name}:{ok:!1,code:`platform_error`,message:e instanceof Error?e.message:String(e)}}function xg(){return{prf:{eval:{first:Fs,second:Ms}}}}function Sg(){return{ok:!1,code:`prf_unavailable`,message:`Required passkey PRF.first output is unavailable`}}function Cg(e){return/Missing PRF/i.test(P(e))?Sg():null}function wg(e){return!!(e&&typeof e==`object`&&`rawId`in e&&`response`in e&&typeof e.getClientExtensionResults==`function`)}async function Tg(e,t,n){return e===`create`?n.create({publicKey:t}):n.get({publicKey:t})}function Eg(e){return{kind:`authenticator`,async run(t){if(!e)return{ok:!1,code:`unavailable`,message:`navigator.credentials is unavailable`};try{switch(t.kind){case`create_passkey`:{let n=t.registrationOptions,r=await Tg(`create`,mg(n),e);if(!wg(r))return{ok:!1,code:`invalid_credential`,message:`Passkey creation returned an invalid credential`};let i;try{i=cc({credential:r})}catch(e){if(t.requirePrfFirst){let t=Cg(e);if(t)return t}throw e}let a=uc(i);if(t.requirePrfFirst&&!a)return Sg();if(t.requirePrfFirst){let e=a||``;return{ok:!0,operation:`create_passkey`,requirePrfFirst:!0,credential:i,credentialIdB64u:i.rawId,rawIdB64u:i.rawId,rpId:wo(n.rpId),prf:{kind:`required`,prfFirstB64u:e}}}return{ok:!0,operation:`create_passkey`,requirePrfFirst:!1,credential:i,credentialIdB64u:i.rawId,rawIdB64u:i.rawId,rpId:wo(n.rpId),prf:a?{kind:`available_without_requirement`,prfFirstB64u:a}:{kind:`not_requested_or_unavailable`}}}case`get_passkey`:{let n=await Tg(`get`,{rpId:t.rpId,challenge:pg(t.challengeB64u),allowCredentials:[{type:`public-key`,id:pg(t.credentialIdB64u)}],userVerification:`preferred`,extensions:xg()},e);if(!wg(n))return{ok:!1,code:`invalid_credential`,message:`Passkey assertion returned an invalid credential`};let r;try{r=pc({credential:n})}catch(e){if(t.requirePrfFirst){let t=Cg(e);if(t)return t}throw e}let i=uc(r);if(t.requirePrfFirst&&!i)return Sg();if(t.requirePrfFirst){let e=i||``;return{ok:!0,operation:`get_passkey`,requirePrfFirst:!0,credential:r,credentialIdB64u:r.rawId,rawIdB64u:r.rawId,rpId:t.rpId,prf:{kind:`required`,prfFirstB64u:e}}}return{ok:!0,operation:`get_passkey`,requirePrfFirst:!1,credential:r,credentialIdB64u:r.rawId,rawIdB64u:r.rawId,rpId:t.rpId,prf:i?{kind:`available_without_requirement`,prfFirstB64u:i}:{kind:`not_requested_or_unavailable`}}}}}catch(e){return bg(e)}}}}function Dg(e){return{kind:`signer_crypto`,async createRouterAbEcdsaRegistrationCeremony(t){if(!e)throw Error(`ECDSA derivation client worker context is unavailable`);return _d({command:t,workerCtx:e})},async verifyRouterAbEcdsaRegistrationClientProofs(t){if(!e)throw Error(`ECDSA derivation client worker context is unavailable`);return $u({command:t,workerCtx:e})},async persistInitialCanonicalEcdsaActivation(t){if(!e)throw Error(`ECDSA derivation client worker context is unavailable`);return ed({command:t,workerCtx:e})},async finalizeRouterAbEcdsaRegistrationActivation(t){if(!e)throw Error(`ECDSA derivation client worker context is unavailable`);return sd({command:t,workerCtx:e})},async closeRouterAbEcdsaRegistrationCeremony(t){if(!e)throw Error(`ECDSA derivation client worker context is unavailable`);return ld({command:t,workerCtx:e})},async prepareEcdsaClientBootstrap(t){if(!e)return dg(`unavailable`,`ECDSA client bootstrap worker context is unavailable`);try{return{ok:!0,value:sg(await Hu({command:og(t),workerCtx:e}))}}catch(e){let t=P(e);return t.includes(`unsupported ECDSA bootstrap secret source`)?fg(`unsupported_secret_source`,t):gg(e)||fg(`crypto_failure`,t)}},async finalizeEcdsaClientBootstrap(t){if(t.pendingStateBlob.kind!==`ecdsa_role_local_pending_state_blob_v1`||t.pendingStateBlob.curve!==`secp256k1`||t.pendingStateBlob.encoding!==`base64url`||t.pendingStateBlob.producer!==`signer_core`)return fg(`invalid_pending_state`,`ECDSA client bootstrap pending blob envelope is invalid`);if(!e)return dg(`unavailable`,`ECDSA client bootstrap worker context is unavailable`);try{return{ok:!0,value:lg(await ad({command:cg(t),workerCtx:e}))}}catch(e){return gg(e)||_g(e)}},async storeEcdsaRoleLocalSigningMaterial(t){if(t.stateBlob.kind!==`ecdsa_role_local_state_blob_v1`||t.stateBlob.curve!==`secp256k1`||t.stateBlob.encoding!==`base64url`||t.stateBlob.producer!==`signer_core`)return fg(`invalid_ready_state`,`ECDSA role-local ready blob envelope is invalid`);if(!e)return dg(`unavailable`,`ECDSA role-local material worker context is unavailable`);try{let n=await Uu({materialHandle:t.handle.materialHandle,bindingDigest:t.handle.bindingDigest,stateBlob:t.stateBlob,workerCtx:e});return{ok:!0,value:{handle:{kind:`ecdsa_role_local_worker_handle_v1`,materialHandle:Jo(n.materialHandle),durableMaterialRef:Zo(n.materialHandle),bindingDigest:Xo(n.bindingDigest)}}}}catch(e){return gg(e)||fg(`crypto_failure`,P(e))}}}}function Og(e){return{kind:`http_transport`,async request(t){if(!e)return{ok:!1,code:`network_error`,message:`fetch is unavailable`};let n=new AbortController,r=t.timeoutMs&&t.timeoutMs>0?setTimeout(()=>n.abort(),t.timeoutMs):null;try{let r=await e(t.url,{method:t.method,headers:t.headers,body:t.body==null?void 0:JSON.stringify(t.body),signal:n.signal}),i=(r.headers.get(`content-type`)||``).includes(`application/json`)?await r.json().catch(()=>null):await r.text().catch(()=>``);return{ok:!0,value:{status:r.status,body:i}}}catch(e){return{ok:!1,code:n.signal.aborted?`timeout`:`network_error`,message:e instanceof Error?e.message:String(e)}}finally{r&&clearTimeout(r)}}}}function kg(e){return{kind:`clock`,nowMs:e||(()=>Date.now())}}function Ag(e){return{kind:`random_source`,randomBytes(t){if(!e?.getRandomValues)throw Error(`Browser crypto.getRandomValues is unavailable`);let n=new Uint8Array(t);return e.getRandomValues(n),n}}}function jg(e={}){return{kind:`browser`,storage:vg(e.indexedDB||K),secrets:yg(),authenticator:Eg(e.credentials||globalThis.navigator?.credentials),signerCrypto:Dg(e.workerCtx),http:Og(e.fetch||globalThis.fetch?.bind(globalThis)),clock:kg(e.nowMs),random:Ag(e.crypto||globalThis.crypto)}}function Mg(e){return e.kind===`credential_free_ecdsa_session_activation_authorization_v1`}function Ng(e,t){return e.error||e.message||e.code||t}function Pg(e){return pr({kind:`router_ab_ecdsa_post_registration_session_activation_v1`,public_capability:e.publicCapability,session_policy:{threshold_session_id:e.thresholdSessionId,wallet_session_mint_id:e.walletSessionMintId,ttl_ms:e.ttlMs,remaining_uses:e.remainingUses,runtime_policy_scope:e.runtimePolicyScope}})}function Fg(e,t){let n=t.public_identity;return e.applicationBindingDigestB64u===t.context.application_binding_digest_b64u&&e.contextBinding32B64u===n.context_binding_b64u&&e.derivationClientSharePublicKey33B64u===n.derivation_client_share_public_key33_b64u&&e.relayerPublicKey33B64u===n.server_public_key33_b64u&&e.groupPublicKey33B64u===n.threshold_public_key33_b64u&&e.ethereumAddress.toLowerCase()===Bf(I(n.ethereum_address20_b64u))&&sc(e.publicCapability,t)}function Ig(e,t){let n=e.normal_signing.scope;return n.wallet_id===String(t.walletId)&&n.ecdsa_threshold_key_id===String(t.ecdsaThresholdKeyId)&&n.signing_root_id===String(t.signingRootId)&&n.signing_root_version===String(t.signingRootVersion)}function Lg(e){let t=e.persistedRoleLocalMaterial.publicFacts;if(!sc(e.sessionActivation.public_capability,e.publicCapability)||e.sessionActivation.session.threshold_session_id!==e.thresholdSessionId||!Ig(e.sessionActivation,t))throw Error(`Strict ECDSA session activation returned a different registered key identity`)}function Rg(e){let t=e.sessionActivation.activation,n=e.sessionActivation.authorization,r=n.record,i=Xn(t.public_capability.material_activation),a=0;for(let e of r.capabilitySubjects)e.kind===`sign`&&e.keyFamily===`ecdsa_secp256k1`&&b(e.materialActivation,i)&&(a+=1);if(Lg({publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.persistedRoleLocalMaterial,thresholdSessionId:e.thresholdSessionId,sessionActivation:t}),String(r.walletId)!==e.walletId||String(r.walletId)!==String(t.public_capability.client_id)||r.authMethodId!==e.persistedRoleLocalMaterial.authority.walletAuthMethodId||r.authorizationId!==t.session.authorization_id||r.quotaId!==t.session.quota_id||r.expiresAtMs!==t.session.expires_at_ms||t.session.remaining_uses!==e.remainingUses||n.operationCredential.walletSessionId!==t.session.wallet_session_id||!b(i,e.persistedRoleLocalMaterial.materialActivation)||a!==1)throw Error(`Strict ECDSA credential-free activation authority does not match its session`)}function zg(e){let t=e.persistedRoleLocalMaterial.publicFacts;if(!e.walletId||!e.thresholdSessionId)throw Error(`Strict ECDSA session activation requires exact wallet and session identity`);if(!Number.isSafeInteger(e.ttlMs)||e.ttlMs<1)throw Error(`Strict ECDSA session activation requires a positive ttlMs`);if(!Number.isSafeInteger(e.remainingUses)||e.remainingUses<1)throw Error(`Strict ECDSA session activation requires positive remainingUses`);if(String(t.walletId)!==e.walletId||!Fg(t,e.publicCapability))throw Error(`Strict ECDSA session activation requires exact registered role-local material`)}function Bg(e){switch(e.kind){case`rehydrated`:return e;case`device_link_required`:throw Error(`device_link_required: registered ECDSA role-local material is unavailable on this device`);case`corrupt`:throw Error(`Registered ECDSA role-local material is corrupt (${e.reason}): ${e.message}`);default:{let t=e;throw Error(`Unsupported ECDSA role-local material resolution: ${String(t)}`)}}}async function Vg(e){let t=Bg(await Rd({purpose:`registration_activation`,source:jd(e.persistedRoleLocalMaterial),workerCtx:e.workerCtx}));return{kind:`existing_ecdsa_role_local_material_activated_v1`,roleLocalMaterial:t.liveHandle,roleLocalMaterialRef:t.materialRef,publicFacts:e.persistedRoleLocalMaterial.publicFacts,publicCapability:e.publicCapability}}async function Hg(e){zg(e);let t=await _c(e.relayerUrl,{auth:e.routeAuth,request:Pg(e)});if(!t.ok)throw Error(Ng(t,`Strict ECDSA session activation failed`));return await Ug({workerCtx:e.workerCtx,publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.persistedRoleLocalMaterial,walletId:e.walletId,thresholdSessionId:e.thresholdSessionId,ttlMs:e.ttlMs,remainingUses:e.remainingUses,runtimePolicyScope:e.runtimePolicyScope,sessionActivation:t.value})}async function Ug(e){return zg(e),Lg({publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.persistedRoleLocalMaterial,thresholdSessionId:e.thresholdSessionId,sessionActivation:e.sessionActivation}),{sessionActivation:e.sessionActivation,roleLocalActivation:await Vg(e)}}async function Wg(e){return zg(e),Rg(e),{sessionActivation:e.sessionActivation.activation,authorization:e.sessionActivation.authorization,roleLocalActivation:await Vg(e)}}async function Gg(e,t){let n=An(e.lanePolicy.runtimePolicyScope);if(!n)throw Error(`Strict ECDSA session activation requires runtimePolicyScope`);let r={workerCtx:e.workerCtx,publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.existingRoleLocalMaterial,walletId:String(e.key.walletId),thresholdSessionId:e.lanePolicy.thresholdSessionId,ttlMs:e.lanePolicy.ttlMs,remainingUses:e.lanePolicy.remainingUses,runtimePolicyScope:n},i=e.sessionActivation?Mg(e.sessionActivation)?await Wg({...r,sessionActivation:e.sessionActivation}):await Ug({...r,sessionActivation:e.sessionActivation}):await Hg({...r,walletSessionMintId:Kg(),relayerUrl:e.relayerUrl,routeAuth:e.bootstrapAuth}),a=i.sessionActivation.public_capability.public_identity,o=`authorization`in i?{thresholdSessionId:i.sessionActivation.session.threshold_session_id,authorizationSessionId:i.sessionActivation.session.authorization_session_id,authorizationId:i.sessionActivation.session.authorization_id,walletSessionId:i.sessionActivation.session.wallet_session_id,quotaId:i.sessionActivation.session.quota_id,expiresAtMs:i.sessionActivation.session.expires_at_ms,remainingUses:i.sessionActivation.session.remaining_uses,walletSession:i.authorization.record,operationCredential:i.authorization.operationCredential}:{thresholdSessionId:i.sessionActivation.session.threshold_session_id,authorizationSessionId:i.sessionActivation.session.authorization_session_id,authorizationId:i.sessionActivation.session.authorization_id,walletSessionId:i.sessionActivation.session.wallet_session_id,quotaId:i.sessionActivation.session.quota_id,expiresAtMs:i.sessionActivation.session.expires_at_ms,remainingUses:i.sessionActivation.session.remaining_uses,walletSession:i.sessionActivation.session.wallet_session,operationCredential:i.sessionActivation.session.operation_credential},s=await tr({walletId:String(e.key.walletId),signingRootId:e.key.signingRootId,signingRootVersion:e.key.signingRootVersion});return{ok:!0,bootstrapKind:`strict_post_registration`,keygenSessionId:String(e.requestId||``).trim()||pe(`tecdsa-keygen`,32,`threshold ECDSA session IDs`),rpId:t,keyHandle:String(e.keyHandle),clientVerifyingShareB64u:a.derivation_client_share_public_key33_b64u,thresholdEcdsaPublicKeyB64u:a.threshold_public_key33_b64u,ethereumAddress:Bf(I(a.ethereum_address20_b64u)),relayerKeyId:s,relayerVerifyingShareB64u:a.server_public_key33_b64u,participantIds:e.key.participantIds.map(Number),thresholdSessionId:o.thresholdSessionId,authorizationSessionId:o.authorizationSessionId,authorizationId:o.authorizationId,walletSessionId:o.walletSessionId,quotaId:o.quotaId,expiresAtMs:o.expiresAtMs,remainingUses:o.remainingUses,runtimePolicyScope:n,signingRootId:String(e.key.signingRootId),signingRootVersion:String(e.key.signingRootVersion),walletSession:o.walletSession,operationCredential:o.operationCredential,roleLocalActivation:i.roleLocalActivation,routerAbEcdsaDerivationNormalSigning:i.sessionActivation.normal_signing,secretSourceKind:`persisted_role_local`}}function Kg(){let e=yr(pe(`wallet-session-mint`,32,`Wallet Session mint IDs`));if(!e.ok)throw Error(`Failed to create Wallet Session mint identity`);return e.value}async function qg(e){let t=e.touchIdPrompt.getRpId();if(!t)return{ok:!1,code:`invalid_args`,message:`Missing rpId for WebAuthn`};try{return await Gg(e,t)}catch(e){return{ok:!1,code:`strict_post_registration_failed`,message:e instanceof Error?e.message:String(e)}}}const Jg=`stale_ecdsa_key_identity`;function Yg(e){if(!e)throw Error(`Strict ECDSA session bootstrap requires Wallet Session authority`);switch(e.kind){case`opaque_wallet_session_operation_credential_v1`:return e;case`publishable_key`:throw Error(`Strict ECDSA session bootstrap requires Wallet Session authority`)}throw Error(`Strict ECDSA session bootstrap authority is invalid`)}function Xg(e){let t=String(e.code||``).trim(),n=String(e.message||``).trim().toLowerCase();return t===`stale_session_state`&&n.includes(`threshold-ecdsa bootstrap`)&&n.includes(`client verifying share`)&&n.includes(`integrated key record`)}function Zg(e){let t=String(e.message||e.code||`threshold-ecdsa bootstrap failed`).trim(),n=Xg(e)?Jg:String(e.code||`threshold_ecdsa_bootstrap_failed`).trim()||`threshold_ecdsa_bootstrap_failed`,r=Error(t||`threshold-ecdsa bootstrap failed`);return r.code=n,r}function Qg(e){let t=Error(e);return t.code=Jg,t}function $g(e){switch(e.authKind){case`email_otp`:return`email_otp`;case`passkey`:return`passkey`}return`unknown`}function e_(e){switch(e.bootstrap.secretSourceKind){case`persisted_role_local`:return e.request.authKind===`email_otp`?oc({authSubjectId:e.request.emailOtpWorkerSessionHandle.authSubjectId}):nc({credentialIdB64u:e.request.passkeyCredentialIdB64u,rpId:e.bootstrap.rpId})}}function t_(e,t){let n=String(e||``).trim().toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(n))throw Error(`threshold-ecdsa exact activation returned invalid ${t}`);return n}function n_(e){let t=t_(e.bootstrapOwnerAddress,`server owner address`);if(t!==t_(e.key.thresholdOwnerAddress,`key owner address`))throw Qg(`threshold-ecdsa exact activation owner address mismatches server bootstrap result`);return t}async function r_(e,t){let n=R(String(t.key.walletId)),r=t.lanePolicy.chainTarget,i=String(t.lanePolicy.thresholdSessionId).trim();if(e.routerAbNormalSigning.mode!==`enabled`)throw Error(`Router A/B ECDSA derivation normal signing must be enabled for activation`);let a={walletId:n,chainTarget:r,targetKey:z(r),operationId:i||null,authMethod:$g(t),evmFamilyKeyFingerprint:Fa(t.key),keyHandle:t.keyHandle,chainTargetKey:z(r),ecdsaThresholdKeyId:String(t.key.ecdsaThresholdKeyId),thresholdSessionId:i||null,freshAuthRetrySideEffectState:`not_applicable`,hasRequestedEcdsaThresholdKeyId:!0,requestedSessionId:i||null,authKind:t.walletSessionRouteAuth?.kind||`none`,passkeyCredentialBound:t.authKind===`passkey`},o;try{o=await qg({touchIdPrompt:e.touchIdPrompt,relayerUrl:t.relayerUrl,requestId:t.requestId,workerCtx:e.workerCtx,...`preauthorizedSessionActivation`in t&&t.preauthorizedSessionActivation?{sessionActivation:t.preauthorizedSessionActivation}:{bootstrapAuth:Yg(t.walletSessionRouteAuth)},keyHandle:t.keyHandle,key:t.key,lanePolicy:t.lanePolicy,publicCapability:t.publicCapability,existingRoleLocalMaterial:t.existingRoleLocalMaterial})}catch(e){try{console.warn(`[threshold-ecdsa][bootstrap][exception]`,{...a,message:e instanceof Error?e.message:String(e)})}catch{}throw e}if(!o.ok){try{console.warn(`[threshold-ecdsa][bootstrap][failure]`,{...a,code:o.code||``,message:o.message||``})}catch{}throw Zg({code:o.code,message:o.message})}let s=String(t.key.ecdsaThresholdKeyId).trim();if(!s)throw Error(`threshold-ecdsa bootstrap returned empty ecdsaThresholdKeyId`);let c=Qo(s),l=$o(String(o.keyHandle||``).trim()),u=String(o.relayerKeyId||``).trim();if(!u)throw Error(`threshold-ecdsa bootstrap returned empty relayerKeyId`);let d=Ko(u),f=String(o.clientVerifyingShareB64u||``).trim();if(!f)throw Error(`threshold-ecdsa bootstrap returned empty clientVerifyingShareB64u`);let p=Yo(f),m=String(o.thresholdSessionId||``).trim();if(!m)throw Error(`threshold-ecdsa bootstrap returned empty thresholdSessionId`);let h=Number(o.expiresAtMs);if(!Number.isFinite(h))throw Error(`threshold-ecdsa bootstrap returned invalid expiresAtMs`);let g=Number(o.remainingUses);if(!Number.isFinite(g))throw Error(`threshold-ecdsa bootstrap returned invalid remainingUses`);let _=t.key.participantIds.map(e=>Number(e));if(!_)throw Error(`threshold-ecdsa bootstrap returned empty participantIds`);let v=n_({key:t.key,bootstrapOwnerAddress:o.ethereumAddress}),y=$s({walletId:n,chainTarget:r,keyHandle:l,ecdsaThresholdKeyId:c,signingRootId:o.signingRootId,signingRootVersion:o.signingRootVersion,applicationBindingDigestB64u:o.roleLocalActivation.publicCapability.context.application_binding_digest_b64u,clientParticipantId:1,relayerParticipantId:2,participantIds:_,contextBinding32B64u:o.roleLocalActivation.publicFacts.contextBinding32B64u,derivationClientSharePublicKey33B64u:o.roleLocalActivation.publicFacts.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:o.roleLocalActivation.publicFacts.relayerPublicKey33B64u,groupPublicKey33B64u:o.roleLocalActivation.publicFacts.groupPublicKey33B64u,ethereumAddress:o.roleLocalActivation.publicFacts.ethereumAddress,publicCapability:o.roleLocalActivation.publicCapability}),b=o.routerAbEcdsaDerivationNormalSigning,x=o.roleLocalActivation.roleLocalMaterial,S=e_({request:t,bootstrap:o}),C={ok:!0,thresholdSessionId:m,authorizationSessionId:o.authorizationSessionId,authorizationId:o.authorizationId,walletSessionId:o.walletSessionId,quotaId:o.quotaId,expiresAtMs:h,remainingUses:g,runtimePolicyScope:o.runtimePolicyScope,walletSession:o.walletSession,operationCredential:o.operationCredential,clientVerifyingShareB64u:p};return{thresholdEcdsaKeyRef:{type:`threshold-ecdsa-secp256k1`,userId:n,chainTarget:r,relayerUrl:t.relayerUrl,keyHandle:l,ecdsaThresholdKeyId:c,backendBinding:{materialKind:`role_local_worker_handle`,relayerKeyId:d,clientVerifyingShareB64u:p,roleLocalMaterialHandle:x,roleLocalMaterialRef:o.roleLocalActivation.roleLocalMaterialRef,publicFacts:y,authMethod:S},participantIds:_,thresholdEcdsaPublicKeyB64u:o.thresholdEcdsaPublicKeyB64u,ethereumAddress:v,relayerVerifyingShareB64u:o.relayerVerifyingShareB64u,routerAbEcdsaDerivationNormalSigning:b},session:C}}async function i_(e,t){return await r_(e,t)}function a_(e){let t;try{t=Lr(e.evidenceSetDigest)}catch(e){throw Error(e instanceof Error?e.message:`ECDSA explicit export evidence digest is invalid`)}let n=Math.floor(Number(e.expiresAtMs)),r=Yn(e.operation);if(r.operation_kind!==`evm.export_key`)throw Error(`ECDSA explicit export operation kind is invalid`);if(!Number.isSafeInteger(n)||n<=Date.now())throw Error(`ECDSA explicit export operation authorization expiry is invalid`);let i=o_(e.unseal);return{kind:`verified_step_up`,evidenceSetDigest:t,operation:r,expiresAtMs:n,quotaUse:`none`,unseal:i}}function o_(e){switch(e.kind){case`not_requested`:return{kind:`not_requested`};case`email_otp_grant`:{let t=String(e.grant||``).trim(),n=String(e.challenge_id||``).trim();if(!t||!n)throw Error(`ECDSA explicit export Email OTP unseal grant is invalid`);return{kind:`email_otp_grant`,grant:t,challenge_id:n}}default:{let t=e;throw Error(`Unsupported ECDSA explicit export unseal state: ${String(t)}`)}}}async function s_(e){let t=String(e.relayerUrl||``).trim();if(!t)throw Error(`ECDSA explicit export relayer URL is required`);return{kind:`explicit_key_export_ecdsa_activation_result`,purpose:`explicit_key_export`,material:{kind:`auth_neutral_ecdsa_export_material_v1`,relayerUrl:t,persistedMaterial:e.existingRoleLocalMaterial},authorization:a_(e.authorization)}}function c_(e,t){let n=String(e||t||``).trim();if(!n)throw Error(`Missing relayer url (configs.network.relayer.url)`);return n}function l_(e){return`key`in e&&!!e.key&&`keyHandle`in e&&!!String(e.keyHandle||``).trim()}function u_(e){return l_(e)?e.key.walletId:e.walletId}function d_(e){return l_(e)?e.lanePolicy.chainTarget:e.chainTarget}function f_(e){return e.kind===`email_otp_ecdsa_bootstrap`?{authMethod:V.emailOtp,signerSource:Kr.emailOtpRegistration}:{authMethod:V.passkey,signerSource:Kr.passkeyRegistration}}function p_(e){switch(e.kind){case`passkey_preauthorized_ecdsa_bootstrap`:case`wallet_session_reconnect_ecdsa_bootstrap`:return e.authorizationAuthority;case`passkey_fresh_ecdsa_bootstrap`:case`email_otp_ecdsa_bootstrap`:return e.existingRoleLocalMaterial.authority}}function m_(e){if(!(`sessionActivation`in e.request)||!e.request.sessionActivation)return;let t=e.request.sessionActivation,n=Mg(t)?t.activation:t,r=Mg(t)?t.authorization:{record:t.session.wallet_session,operationCredential:t.session.operation_credential};Ct({walletId:e.walletId,authority:e.authority,walletSession:r.record,operationCredential:r.operationCredential,expectedAuthorizationId:n.session.authorization_id,expectedWalletSessionId:n.session.wallet_session_id,expectedQuotaId:n.session.quota_id,expectedExpiresAtMs:n.session.expires_at_ms}),e.request.kind===`passkey_preauthorized_ecdsa_bootstrap`&&Qt({expected:e.request.authorizationIdentity,walletSession:r.record})}function h_(e,t){let n=(e,n,r)=>({kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:Do(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},...r,...n?{walletSessionRouteAuth:n}:{}}),r=e=>({kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:Do(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u,preauthorizedSessionActivation:e.sessionActivation});switch(e.kind){case`passkey_fresh_ecdsa_bootstrap`:return n(e,e.routeAuth,{authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u});case`passkey_preauthorized_ecdsa_bootstrap`:return r(e);case`wallet_session_reconnect_ecdsa_bootstrap`:return n(e,e.routeAuth,{authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u});case`email_otp_ecdsa_bootstrap`:{let r={authKind:`email_otp`,emailOtpWorkerSessionHandle:e.emailOtpWorkerSessionHandle};return e.sessionActivation?{kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:Do(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},...r,preauthorizedSessionActivation:e.sessionActivation}:n(e,e.routeAuth,r)}}throw Error(`[SigningEngine][ecdsa] unsupported ECDSA bootstrap request`)}function g_(e,t){return{purpose:`explicit_key_export`,relayerUrl:t,existingRoleLocalMaterial:e.existingRoleLocalMaterial,authorization:e.authorization}}function __(e,t){return{purpose:`explicit_key_export`,relayerUrl:t,existingRoleLocalMaterial:e.existingRoleLocalMaterial,authorization:e.authorization}}async function v_(e,t){if(t.kind===`reuse_warm_ecdsa_bootstrap`)throw Error(`[SigningEngine][ecdsa] reuse_warm bootstrap must resolve an existing exact material request before activation`);let n=p_(t),r=R(u_(t)),i=d_(t),a=c_(t.relayerUrl,e.defaultRelayerUrl),o=e.getSignerWorkerContext(),s={touchIdPrompt:e.touchIdPrompt,workerCtx:o,routerAbNormalSigning:e.routerAbNormalSigning};m_({request:t,walletId:r,authority:n});let c=await i_(s,h_(t,a)),l=f_(t);return await e.persistThresholdEcdsaBootstrapForWalletTarget({walletId:r,chainTarget:i,bootstrap:c,signerAuth:l}),await t.beforeAuthorizationPersistence?.(),await Rt(G,{walletId:r,authority:n,bootstrap:c}),c}async function y_(e,t){return await s_(g_(t,c_(t.relayerUrl,e.defaultRelayerUrl)))}async function b_(e,t){return await s_(__(t,c_(t.relayerUrl,e.defaultRelayerUrl)))}async function x_(e,t,n){let r=String(t),i=(e.get(r)||Promise.resolve()).catch(()=>void 0),a,o=new Promise(e=>{a=e}),s=i.then(()=>o);e.set(r,s),await i;try{return await n()}finally{a(),e.get(r)===s&&e.delete(r)}}function S_(e,t){return t.runtimeScopeBootstrap&&(e.runtimeScopeBootstrap=t.runtimeScopeBootstrap),t.operationIntent&&(e.operationIntent=t.operationIntent),typeof t.ttlMs==`number`&&(e.ttlMs=t.ttlMs),e}function C_(e){return S_({kind:`email_otp_ecdsa_activation`,purpose:`transaction_signing`,walletKey:e.walletKey,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,source:e.source,relayerUrl:e.relayerUrl,sessionIdentity:e.sessionIdentity,sessionKind:e.sessionKind,sessionBudgetUses:e.sessionBudgetUses,runtimePolicy:e.runtimePolicy,emailOtpWorkerSessionHandle:e.emailOtpWorkerSessionHandle,emailOtpAuthContext:e.emailOtpAuthContext,...`preauthorizedSessionActivation`in e?{preauthorizedSessionActivation:e.preauthorizedSessionActivation}:{walletSessionRouteAuth:e.walletSessionRouteAuth}},e)}function w_(e){if(el(e.context)!==e.expected)throw Error(`Email OTP ${e.label} activation requires ${e.expected} retention`)}function T_(e){return w_({context:e.emailOtpAuthContext,expected:`session`,label:`session bootstrap`}),C_(e)}function E_(e){return w_({context:e.emailOtpAuthContext,expected:`session`,label:`recovered session`}),C_(e)}function D_(e){return w_({context:e.emailOtpAuthContext,expected:`session`,label:`preauthorized session bootstrap`}),C_(e)}function O_(e){return w_({context:e.emailOtpAuthContext,expected:`single_use`,label:`per-operation reauth`}),C_(e)}function k_(e){return{kind:`email_otp_ecdsa_export_activation`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}function A_(e){return{kind:`passkey_ecdsa_export_activation`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}function j_(e){switch(e.kind){case`default_policy`:return;case`scoped_policy`:return e.scope}throw Error(`[SigningEngine][ecdsa] unsupported ECDSA activation policy`)}function M_(e,t){t.runtimeScopeBootstrap&&(e.runtimeScopeBootstrap=t.runtimeScopeBootstrap),t.operationIntent&&(e.operationIntent=t.operationIntent);let n=j_(t.runtimePolicy);return`walletId`in e&&(typeof t.ttlMs==`number`&&(e.ttlMs=t.ttlMs),n&&(e.runtimePolicyScope=n)),e}function N_(e){switch(e.kind){case`passkey_ecdsa_activation`:return{kind:`passkey_existing_session_activation`,request:e};case`email_otp_ecdsa_activation`:return{kind:`email_otp_existing_session_activation`,request:e}}throw Error(`[SigningEngine][ecdsa] unsupported activation request`)}function P_(e){let t=String(e.webauthnAuthentication.rawId||e.webauthnAuthentication.id||``).trim();if(!t)throw Error(`[SigningEngine][ecdsa] passkey activation requires credential identity`);return t}function F_(e){let t=N_(e);switch(t.kind){case`passkey_existing_session_activation`:return M_({kind:`passkey_fresh_ecdsa_bootstrap`,keyHandle:t.request.walletKey.keyHandle,key:Za(t.request.walletKey),lanePolicy:t.request.lanePolicy,publicCapability:t.request.publicCapability,existingRoleLocalMaterial:t.request.existingRoleLocalMaterial,source:t.request.source,relayerUrl:t.request.relayerUrl,requestId:t.request.requestId,passkeyCredentialIdB64u:P_(t.request),routeAuth:t.request.walletSessionRouteAuth},t.request);case`email_otp_existing_session_activation`:{let e={kind:`email_otp_ecdsa_bootstrap`,keyHandle:t.request.walletKey.keyHandle,key:Za(t.request.walletKey),lanePolicy:t.request.lanePolicy,publicCapability:t.request.publicCapability,existingRoleLocalMaterial:t.request.existingRoleLocalMaterial,source:`email_otp`,relayerUrl:t.request.relayerUrl,emailOtpWorkerSessionHandle:t.request.emailOtpWorkerSessionHandle,emailOtpAuthContext:t.request.emailOtpAuthContext};return t.request.preauthorizedSessionActivation?M_({...e,sessionActivation:t.request.preauthorizedSessionActivation},t.request):M_({...e,routeAuth:t.request.walletSessionRouteAuth},t.request)}}throw Error(`[SigningEngine][ecdsa] unsupported activation request`)}function I_(e){return{kind:`passkey_ecdsa_export_bootstrap`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}async function L_(e){let t=e.bootstrap.thresholdEcdsaKeyRef.backendBinding;if(!t)throw Error(`[WarmSessionStore] threshold ECDSA bootstrap is missing its backend binding`);let n=R_(t);if(!n)return;let r=await e.deps.persistEcdsaRoleLocalReadyRecord({record:n,storageKeyFacts:tc(n)});if(!r.ok)throw Error(`[WarmSessionStore] threshold ECDSA role-local ready record persistence failed (${r.code}): ${r.message}`)}function R_(e){switch(e.materialKind){case`role_local_ready_state_blob`:return e.ecdsaRoleLocalReadyRecord;case`role_local_worker_handle`:case`role_local_durable_public_anchor`:case`role_local_durable_sealed_ref`:case`metadata_only`:return null;default:{let t=e;throw Error(`[WarmSessionStore] unsupported threshold ECDSA backend binding: ${JSON.stringify(t)}`)}}}async function z_(e,t){let n=R(u_(t));return await x_(e.queueByWallet,n,async()=>{let n=await v_(e.activationDeps,t);return await L_({deps:e,bootstrap:n}),n})}async function B_(e,t){return await z_(e,F_(t))}async function V_(e,t){return await y_(e.activationDeps,I_(t))}async function H_(e,t){let n={kind:`email_otp_ecdsa_export_bootstrap`,purpose:`explicit_key_export`,existingRoleLocalMaterial:t.existingRoleLocalMaterial,relayerUrl:t.relayerUrl,authorization:t.authorization};return await b_(e.activationDeps,n)}function U_(e){return pe(e,32,`Email OTP export UI request IDs`)}function W_(e){switch(e.kind){case`near_account`:return String(Hi(e.nearAccountId));case`wallet_session`:{let t=String(e.walletId||``).trim();if(!t)throw Error(`Email OTP export requires wallet identity`);return t}default:return e}}function G_(e){switch(e.kind){case`near_account`:if(!String(e.walletId||``).trim())throw Error(`Email OTP NEAR export requires wallet identity`);return{kind:`near_wallet`,walletId:String(e.walletId).trim(),nearAccountId:String(Hi(e.nearAccountId))};case`wallet_session`:{let t=String(e.walletId||``).trim();if(!t)throw Error(`Email OTP export requires wallet identity`);return{kind:`evm_wallet`,walletId:t}}default:return e}}function K_(e){return{challengeId:e.challenge.challengeId,...e.challenge.emailHint?{emailHint:e.challenge.emailHint}:{},title:`Enter email code to export`,body:`This one-time code authorizes private key export only.`,helperText:`Enter the 6-digit code sent to your email`,onResend:e.onResend}}async function q_(e){let t=W_(e.identity),n=async()=>{let t=await e.challengeSource.requestChallenge(),n=String(t.challengeId||``).trim();if(!n)throw Error(`Email OTP export challenge response did not include challengeId`);let r=String(t.emailHint||``).trim();if(!r)throw Error(`Email OTP export challenge response did not include emailHint`);let i={challengeId:n,emailHint:r,delivery:t.delivery};return e.onChallenge?.(i),i},r=await n(),i=K_({challenge:r,onResend:async()=>(r=await n(),r)}),a=G_(e.identity),o=await e.confirmer.requestUserConfirmation({requestId:U_(`export-${e.curve}-email-otp-auth`),type:q.SIGN_INTENT_DIGEST,summary:{operation:`Export Private Key`,accountId:t,publicKey:e.publicKey,warning:`Enter the email code to export this key. Anyone with the private key can fully control the account.`},payload:{signingSubject:a,challengeB64u:r.challengeId,signingAuthPlan:{kind:hf.EmailOtpReauth,method:`email_otp`,emailOtpPrompt:i},emailOtpPrompt:i},intentDigest:`export-keys:${t}:${e.chain}:${e.curve}:email-otp`});if(!o.confirmed)throw Error(o.error||`User cancelled Email OTP export request`);let s=String(o.otpCode||``).replace(/\D/g,``).slice(0,6);if(s.length!==6)throw Error(`Email OTP export requires a 6-digit code`);return{challengeId:String(o.emailOtpChallengeId||r.challengeId).trim(),otpCode:s}}function J_(e){throw Error(`[SigningEngine][export] unsupported authorization identity: ${String(e)}`)}function Y_(e){throw Error(`[SigningEngine][export] unsupported step-up method: ${String(e)}`)}function X_(e){let t=String(e.walletSessionUserId||``).trim();if(!t)throw Error(`[SigningEngine][export] missing export step-up authorization identity`);let n=String(e.publicKey||``).trim();if(!n)throw Error(`[SigningEngine][export] missing export step-up authorization public key`);switch(e.curve){case`ecdsa`:return{walletSessionUserId:t,publicKey:n,curve:`ecdsa`,intent:`ecdsa_export`,chain:e.chain};case`ed25519`:{let r={walletSessionUserId:t,publicKey:n,curve:`ed25519`,intent:`ed25519_export`,chain:`near`,nearAccountId:String(e.nearAccountId||``).trim(),nearEd25519SigningKeyId:String(e.nearEd25519SigningKeyId||``).trim(),signerSlot:Number(e.signerSlot)};if(!r.nearAccountId||!r.nearEd25519SigningKeyId||!Number.isSafeInteger(r.signerSlot)||r.signerSlot<1)throw Error(`[SigningEngine][export] Ed25519 export authorization identity is invalid`);return r}default:return J_(e)}}function Z_(e){let t={kind:hf.EmailOtpReauth,method:`email_otp`,emailOtpPrompt:e.emailOtpPrompt},n=e.emailOtpPrompt.emailHint;switch(e.identity.curve){case`ecdsa`:return{kind:`email_otp`,signingAuthPlan:t,challengeId:e.challengeId,otpCode:e.otpCode,walletSessionUserId:e.identity.walletSessionUserId,publicKey:e.identity.publicKey,curve:`ecdsa`,intent:`ecdsa_export`,chain:e.identity.chain,...n?{emailHint:n}:{}};case`ed25519`:return{kind:`email_otp`,signingAuthPlan:t,challengeId:e.challengeId,otpCode:e.otpCode,walletSessionUserId:e.identity.walletSessionUserId,publicKey:e.identity.publicKey,curve:`ed25519`,intent:`ed25519_export`,chain:`near`,nearAccountId:e.identity.nearAccountId,nearEd25519SigningKeyId:e.identity.nearEd25519SigningKeyId,signerSlot:e.identity.signerSlot,...n?{emailHint:n}:{}};default:return J_(e.identity)}}function Q_(e){let t={kind:hf.PasskeyReauth,method:`passkey`};switch(e.identity.curve){case`ecdsa`:return{kind:`passkey`,signingAuthPlan:t,credential:e.credential,walletSessionUserId:e.identity.walletSessionUserId,publicKey:e.identity.publicKey,curve:`ecdsa`,intent:`ecdsa_export`,chain:e.identity.chain};case`ed25519`:return{kind:`passkey`,signingAuthPlan:t,credential:e.credential,walletSessionUserId:e.identity.walletSessionUserId,publicKey:e.identity.publicKey,curve:`ed25519`,intent:`ed25519_export`,chain:`near`,nearAccountId:e.identity.nearAccountId,nearEd25519SigningKeyId:e.identity.nearEd25519SigningKeyId,signerSlot:e.identity.signerSlot};default:return J_(e.identity)}}function $_(e){let t=X_(e);switch(e.method){case`email_otp`:{if(!e.decision.confirmed)throw Error(e.decision.error||`User cancelled Email OTP export request`);let n=String(e.decision.otpCode||``).replace(/\D/g,``).slice(0,6);if(n.length!==6)throw Error(`Email OTP export requires a 6-digit code`);let r=String(e.decision.emailOtpChallengeId||e.emailOtpPrompt.challengeId||``).trim();if(!r)throw Error(`Email OTP export challenge response did not include challengeId`);return Z_({identity:t,emailOtpPrompt:e.emailOtpPrompt,challengeId:r,otpCode:n})}case`passkey`:if(!e.decision.confirmed)throw Error(e.decision.error||`User cancelled export request`);if(!e.decision.credential)throw Error(`[SigningEngine][export] missing WebAuthn credential for export authorization`);return Q_({identity:t,credential:lc(e.decision.credential)});default:return Y_(e)}}function ev(e){switch(e.kind){case`ecdsa`:return{subject:`${String(e.walletSession.walletId)}:${z(e.chainTarget)}`,chain:e.chainTarget.kind,data:{curve:`ecdsa`,chain:e.chainTarget.kind,chainTarget:e.chainTarget}};case`ed25519`:return{subject:`${String(e.walletSession.walletId)}:near:${String(e.nearAccount.accountId)}`,chain:`near`,data:{curve:`ed25519`,chain:`near`,nearAccount:e.nearAccount}}}}function tv(e,t){if(e)try{e(ds(t))}catch{}}function nv(e){return pe(e,32,`key export UI request IDs`)}function rv(e,t){return`key-export:${e}:${t}:${nv(`flow`)}`}async function iv(e,t){let n=ev(e),r=rv(n.subject,n.chain),i=e.walletSession.walletId,a=n.data;tv(e.options.onEvent,{phase:H.STEP_01_STARTED,status:`running`,flowId:r,accountId:String(i),interaction:{kind:`none`,overlay:`none`},data:a});try{return await t({...e,flowId:r})}catch(t){let n=le(t);throw tv(e.options.onEvent,{phase:n?H.CANCELLED:H.FAILED,status:n?`cancelled`:`failed`,flowId:r,accountId:String(i),interaction:{kind:`none`,overlay:`hide`},error:{message:P(t)||(n?`Key export cancelled`:`Key export failed`)},data:a}),t}}async function av(e,t){return await e.requestExportChallenge({kind:`wallet_login_challenge`,walletSession:t.walletSession,chain:t.chain})}function ov(e,t){let n=e.kind===`email_otp_ed25519_export_auth`?e.walletId:e.walletSession.walletSessionUserId;tv(e.onEvent,{phase:H.STEP_02_AUTH_EMAIL_OTP_INPUT_REQUIRED,status:`waiting_for_user`,flowId:e.flowId,accountId:String(n),authMethod:`email_otp`,interaction:{kind:`otp_input`,overlay:`show`},data:{emailHint:t.emailHint,demoOtpCode:Qs(t.delivery)}})}async function sv(e,t){let n=t.walletSession.walletSessionUserId,r=await q_({identity:{kind:`wallet_session`,walletId:n},chain:t.chain,publicKey:t.publicKey,curve:t.curve,challengeSource:{requestChallenge:async()=>await av(e,t)},confirmer:{requestUserConfirmation:async t=>await e.touchConfirm.requestUserConfirmation(t)},onChallenge:ov.bind(void 0,t)}),i={challengeId:r.challengeId},a={confirmed:!0,otpCode:r.otpCode,emailOtpChallengeId:r.challengeId},o=$_({method:`email_otp`,walletSessionUserId:n,chain:t.chain,publicKey:t.publicKey,curve:`ecdsa`,intent:`ecdsa_export`,emailOtpPrompt:i,decision:a});if(o.kind!==`email_otp`)throw Error(`[SigningEngine][export] Email OTP export returned the wrong step-up method`);return o}async function cv(e,t){let n=await q_({identity:{kind:`near_account`,walletId:t.walletId,nearAccountId:t.nearAccountId},chain:`near`,publicKey:t.publicKey,curve:`ed25519`,challengeSource:{requestChallenge:async()=>await e.requestExportChallenge({kind:`wallet_export_challenge`,walletId:t.walletId,chain:`near`})},confirmer:{requestUserConfirmation:async t=>await e.touchConfirm.requestUserConfirmation(t)},onChallenge:ov.bind(void 0,t)}),r=$_({method:`email_otp`,walletSessionUserId:t.walletId,publicKey:t.publicKey,curve:`ed25519`,intent:`ed25519_export`,chain:`near`,nearAccountId:t.nearAccountId,nearEd25519SigningKeyId:t.nearEd25519SigningKeyId,signerSlot:t.signerSlot,emailOtpPrompt:{challengeId:n.challengeId},decision:{confirmed:!0,otpCode:n.otpCode,emailOtpChallengeId:n.challengeId}});if(r.kind!==`email_otp`||r.curve!==`ed25519`)throw Error(`[SigningEngine][export] Ed25519 Email OTP export authorization changed kind`);return r}async function lv(e,t){let n=t.state===`loading`,r=[{scheme:`ed25519`,label:`NEAR Ed25519 private key`,publicKey:t.publicKey,privateKey:n?``:t.privateKey}];await e.touchConfirm.requestUserConfirmation({requestId:nv(`export-ed25519-yao-view`),type:q.SHOW_SECURE_PRIVATE_KEY_UI,summary:{operation:`Export Private Key`,accountId:t.nearAccountId,publicKey:t.publicKey,warning:`Anyone with your private key can fully control your account. Never share it.`},payload:{subject:{kind:`near_wallet`,nearAccountId:t.nearAccountId},viewerSessionId:t.viewerSessionId,publicKey:t.publicKey,keys:r,variant:t.variant,theme:t.theme??e.theme??`dark`,loading:n,onLifecycle:e=>{tv(t.onEvent,{phase:e===`opened`?H.STEP_04_VIEWER_OPENED:H.STEP_05_VIEWER_CLOSED,status:e===`opened`?`waiting_for_user`:`succeeded`,flowId:t.flowId,accountId:t.nearAccountId,interaction:{kind:`key_export_viewer`,overlay:e===`opened`?`show`:`hide`},data:{chain:`near`,curve:`ed25519`,loading:n}}),e===`closed`&&tv(t.onEvent,{phase:H.STEP_06_COMPLETED,status:`succeeded`,flowId:t.flowId,accountId:t.nearAccountId,interaction:{kind:`none`,overlay:`hide`},data:{chain:`near`,curve:`ed25519`}})}},intentDigest:`export-keys:${t.walletId}:near:${t.nearAccountId}:ed25519`})}async function uv(e,t){let n=t.chainTarget.kind,r=String(t.walletSessionUserId||``).trim();if(!r)throw Error(`[SigningEngine][export] missing ECDSA export wallet session user id`);return await fv(e,{walletSessionUserId:t.walletSessionUserId,intent:`ecdsa_export`,curve:`ecdsa`,chain:n,publicKey:t.publicKey,flowId:t.flowId,onEvent:t.onEvent,request:{requestId:nv(`export-threshold-ecdsa-auth`),type:q.AUTHORIZE_KEY_EXPORT,summary:{operation:`Export Private Key`,accountId:r,publicKey:t.publicKey,warning:n===`tempo`?`Confirm to reveal your Tempo private key export.`:`Confirm to reveal your EVM private key export.`},payload:{subject:{kind:`evm_wallet`,walletId:r},credentialIdB64u:t.credentialIdB64u,publicKey:t.publicKey,...t.challengeB64u?{challengeB64u:t.challengeB64u}:{}},intentDigest:`export-keys:${r}:${z(t.chainTarget)}:secp256k1`}})}async function dv(e,t){let n=t.chainTarget.kind,r=n===`tempo`?`Tempo`:`EVM`,i=t.state===`loading`,a=i?[{scheme:`secp256k1`,label:r,publicKey:t.publicKeyHex,privateKey:``,address:t.ethereumAddress}]:[{scheme:`secp256k1`,label:r,publicKey:t.publicKeyHex,privateKey:t.privateKeyHex,address:t.ethereumAddress}];await e.touchConfirm.requestUserConfirmation({requestId:nv(`export-threshold-ecdsa-view`),type:q.SHOW_SECURE_PRIVATE_KEY_UI,summary:{operation:`Export Private Key`,accountId:t.walletId,publicKey:t.publicKeyHex,warning:`Anyone with your private key can fully control your account. Never share it.`},payload:{subject:{kind:`evm_wallet`,walletId:t.walletId},viewerSessionId:t.viewerSessionId,publicKey:t.publicKeyHex,keys:a,variant:t.variant,theme:t.theme??e.theme??`dark`,loading:i,onLifecycle:e=>{tv(t.onEvent,{phase:e===`opened`?H.STEP_04_VIEWER_OPENED:H.STEP_05_VIEWER_CLOSED,status:e===`opened`?`waiting_for_user`:`succeeded`,flowId:t.flowId,accountId:String(t.walletId),interaction:{kind:`key_export_viewer`,overlay:e===`opened`?`show`:`hide`},data:{chain:n,curve:`ecdsa`,loading:i}}),e===`closed`&&tv(t.onEvent,{phase:H.STEP_06_COMPLETED,status:`succeeded`,flowId:t.flowId,accountId:String(t.walletId),interaction:{kind:`none`,overlay:`hide`},data:{chain:n,curve:`ecdsa`}})}},intentDigest:`export-keys:${t.walletId}:${z(t.chainTarget)}:secp256k1`})}async function fv(e,t){let n=String(t.walletSessionUserId||``).trim();if(!n)throw Error(`[SigningEngine][export] missing export account identity`);tv(t.onEvent,{phase:H.STEP_02_AUTH_PASSKEY_PROMPT_STARTED,status:`waiting_for_user`,flowId:t.flowId,accountId:String(n),authMethod:`passkey`,interaction:{kind:`passkey_assert`,overlay:`show`},data:{intent:t.intent,curve:t.curve}}),Kf();let r=await e.touchConfirm.requestUserConfirmation(t.request),i=$_({method:`passkey`,walletSessionUserId:t.walletSessionUserId,publicKey:t.publicKey,curve:`ecdsa`,intent:`ecdsa_export`,chain:t.chain,decision:r});if(i.kind!==`passkey`)throw Error(`[SigningEngine][export] passkey export returned the wrong step-up method`);return tv(t.onEvent,{phase:H.STEP_02_AUTH_PASSKEY_PROMPT_SUCCEEDED,status:`succeeded`,flowId:t.flowId,accountId:String(n),authMethod:`passkey`,interaction:{kind:`passkey_assert`,overlay:`hide`},data:{intent:t.intent,curve:t.curve}}),i}function pv(e){tv(e.onEvent,{phase:H.STEP_03_MATERIAL_PREPARE_STARTED,status:`running`,flowId:e.flowId,accountId:String(e.walletId),interaction:{kind:`none`,overlay:`none`},data:{chain:e.chain,curve:`ecdsa`}})}function mv(e){tv(e.onEvent,{phase:H.STEP_03_MATERIAL_PREPARE_SUCCEEDED,status:`succeeded`,flowId:e.flowId,accountId:String(e.walletId),interaction:{kind:`none`,overlay:`none`},data:{chain:e.chain,curve:`ecdsa`,...e.source?{source:e.source}:{}}})}async function hv(e,t){await dv({touchConfirm:e.touchConfirm,theme:e.theme},{state:`ready`,walletId:t.walletId,chainTarget:t.exportLane.chainTarget,publicKeyHex:String(t.artifact.publicKeyHex||``).trim(),privateKeyHex:String(t.artifact.privateKeyHex||``).trim(),ethereumAddress:String(t.artifact.ethereumAddress||``).trim(),variant:t.options.variant,theme:t.options.theme,viewerSessionId:t.viewerSessionId,flowId:t.flowId,onEvent:t.onEvent})}async function gv(e,t){await dv({touchConfirm:e.touchConfirm,theme:e.theme},{state:`loading`,walletId:t.walletId,chainTarget:t.exportLane.chainTarget,publicKeyHex:String(t.publicKey||``).trim(),ethereumAddress:String(t.ethereumAddress||``).trim(),variant:t.options.variant,theme:t.options.theme,viewerSessionId:t.viewerSessionId,flowId:t.flowId,onEvent:t.onEvent})}async function _v(e,t){let n=xh(t.exportLane),r=nv(`export-threshold-ecdsa-viewer-session`);pv({flowId:t.flowId,walletId:t.walletId,chain:n,onEvent:t.onEvent});try{await gv(e,{walletId:t.walletId,exportLane:t.exportLane,publicKey:t.exportPublicKey,ethereumAddress:t.exportLane.publicFacts.thresholdOwnerAddress,options:t.options,viewerSessionId:r,flowId:t.flowId,onEvent:t.onEvent});let i=t.exportLane.laneIdentity.signer.materialActivation,a=await e.withThresholdEcdsaSigningQueue({queueKey:Ef({materialActivation:i}),walletId:t.exportLane.key.walletId,enabled:!0,task:async()=>{if(t.exportLane.source===`active_wallet_authority`){let n=t.activeRuntime;if(!n)throw Error(`[SigningEngine][ecdsa-export] active runtime is missing`);await Dv({ports:e.activeWalletAuthorityEcdsaRuntimeReadPorts,expectedRuntime:n})}else if(t.exportLane.authMethod===`email_otp`){if(!b((await Ah(e.sessionStore,t.exportLane)).persistedMaterial.materialActivation,i))throw Error(`[SigningEngine][ecdsa-export] prepared material activation was superseded`)}else{let n=await jh(e.sessionStore,t.exportLane);if(n.kind!==`fresh_passkey_needs_authorization`)throw Error(`[SigningEngine][ecdsa-export] prepared export authority changed`);if(!b(n.existingRoleLocalMaterial.materialActivation,i))throw Error(`[SigningEngine][ecdsa-export] prepared material activation was superseded`)}return await t.prepareArtifact()}});return mv({flowId:t.flowId,walletId:t.walletId,chain:n,onEvent:t.onEvent}),qf(r)&&await hv(e,{walletId:t.walletId,exportLane:t.exportLane,artifact:a,options:t.options,viewerSessionId:r,flowId:t.flowId,onEvent:t.onEvent}),{accountId:String(t.walletId),exportedSchemes:[`secp256k1`]}}catch(e){throw Kf(),e}}function vv(e){let t=e.laneIdentity.auth;if(t.kind!==`passkey`)throw Error(`[SigningEngine][ecdsa-export] fresh passkey export requires passkey lane`);return t}async function yv(e){return Ir(kr(e))}async function bv(e){let t=z(e.chainTarget);return await lf({walletId:e.walletId,operationKind:`evm.export_key`,operationId:e.requestId,operationDigests:{laneDigest:await yv({walletId:e.walletId,chainTarget:t,materialActivation:e.materialActivation,keyHandle:e.keyHandle}),intentDigest:await yv({operation:`explicit_key_export`,requestId:e.requestId,walletId:e.walletId,chainTarget:t}),displayDigest:await yv({operation:`Export Private Key`,publicKey:e.displayPublicKey,address:e.displayAddress})},materialActivation:e.materialActivation,normalSigningScope:e.operationRuntime.normalSigning.scope,keyHandle:e.keyHandle,relayerKeyId:e.operationRuntime.relayerKeyId,participantIds:[Number(e.operationRuntime.participantIds[0]),Number(e.operationRuntime.participantIds[1])],expiresAtMs:e.operationExpiresAtMs})}async function xv(e){return await bv({walletId:e.walletId,chainTarget:e.chainTarget,requestId:e.requestId,keyHandle:e.keyHandle,displayPublicKey:e.displayPublicKey,displayAddress:e.displayAddress,materialActivation:e.materialActivation,operationRuntime:e.operationRuntime,operationExpiresAtMs:e.operationExpiresAtMs})}async function Sv(e){let t=await jh(e.deps.sessionStore,e.exportLane);if(t.kind!==`fresh_passkey_needs_authorization`)throw Error(`[SigningEngine][ecdsa-export] passkey export authority changed`);if(!b(t.existingRoleLocalMaterial.materialActivation,e.expectedMaterialActivation))throw Error(`[SigningEngine][ecdsa-export] active material changed after authorization confirmation`)}async function Cv(e){if(!b((await Ah(e.deps.sessionStore,e.exportLane)).persistedMaterial.materialActivation,e.expectedMaterialActivation))throw Error(`[SigningEngine][ecdsa-export] active material changed after authorization confirmation`)}function wv(e){if(!Tv(e.expected,e.actual))throw Error(`[SigningEngine][ecdsa-export] active Wallet Authority runtime was replaced after authorization`)}function Tv(e,t){let n;switch(e.auth.kind){case`passkey`:n=t.auth.kind===`passkey`&&e.auth.rpId===t.auth.rpId&&e.auth.credentialIdB64u===t.auth.credentialIdB64u;break;case`email_otp`:n=t.auth.kind===`email_otp`&&e.auth.providerSubjectId===t.auth.providerSubjectId;break;default:return e.auth}return e.kind===t.kind&&e.walletId===t.walletId&&e.authorityId===t.authorityId&&e.walletAuthMethodId===t.walletAuthMethodId&&e.authorityDigestB64u===t.authorityDigestB64u&&e.factorAuthorityRef.kind===t.factorAuthorityRef.kind&&e.factorAuthorityRef.walletId===t.factorAuthorityRef.walletId&&e.factorAuthorityRef.authorityDigest===t.factorAuthorityRef.authorityDigest&&e.factorAuthorityRef.walletAuthMethodId===t.factorAuthorityRef.walletAuthMethodId&&e.authorityRevocationEpoch===t.authorityRevocationEpoch&&e.walletSessionId===t.walletSessionId&&e.requiredCapability===t.requiredCapability&&b(e.materialActivation,t.materialActivation)&&e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId&&e.relayerKeyId===t.relayerKeyId&&e.operationCredential.kind===t.operationCredential.kind&&e.operationCredential.token===t.operationCredential.token&&e.operationCredential.walletSessionId===t.operationCredential.walletSessionId&&ar(e.session,t.session)&&No(e.authMethod,t.authMethod)&&n&&ur(e.factorAuthority,t.factorAuthority)&&e.holderRuntime.kind===t.holderRuntime.kind&&e.holderRuntime.walletId===t.holderRuntime.walletId&&e.holderRuntime.authorityId===t.holderRuntime.authorityId&&e.holderRuntime.walletAuthMethodId===t.holderRuntime.walletAuthMethodId&&ur(e.holderRuntime.factorAuthority,t.holderRuntime.factorAuthority)&&b(e.holderRuntime.materialActivation,t.holderRuntime.materialActivation)&&e.holderRuntime.holderHandleId===t.holderRuntime.holderHandleId&&e.holderRuntime.ecdsaThresholdKeyId===t.holderRuntime.ecdsaThresholdKeyId&&Bn(e.normalSigning,t.normalSigning)}async function Ev(e){let t=await qd({ports:e.ports,input:{walletId:e.expectedRuntime.walletId,requiredCapability:`export_keys`,materialActivation:e.expectedRuntime.materialActivation}});if(t.kind!==`resolved`)throw Error(`[SigningEngine][ecdsa-export] active Wallet Authority runtime is ${t.reason}`);return wv({expected:e.expectedRuntime,actual:t.runtime}),t.runtime}async function Dv(e){await Ev(e)}function Ov(e){let t=e.credential,n=String(t.rawId||t.id||``).trim();if(!n||n!==e.authority.factor.credentialIdB64u)throw Error(`[SigningEngine][ecdsa-export] passkey credential does not match authority`);return{kind:`passkey`,authority:e.authority,webauthn_authentication:{id:t.id,rawId:t.rawId,type:t.type,authenticatorAttachment:t.authenticatorAttachment??null,response:{clientDataJSON:t.response.clientDataJSON,authenticatorData:t.response.authenticatorData,signature:t.response.signature,userHandle:t.response.userHandle??null},clientExtensionResults:t.clientExtensionResults??null}}}function kv(e){if(!$n(e.authority))throw Error(`[SigningEngine][ecdsa-export] Email OTP material authority mismatch`);return{kind:`email_otp`,authority:e.authority,challenge_id:e.challengeId,otp_code:e.otpCode}}async function Av(e){let t=await tf({relayerUrl:e.relayerUrl,...e.transport?{transport:e.transport}:{},request:{kind:`router_ab_ecdsa_operation_step_up_v1`,operation:e.prepared.operation,proof:e.proof}});if(t.operation_kind!==`evm.export_key`)throw Error(`[SigningEngine][ecdsa-export] operation step-up kind mismatch`);let n=t.authorization.evidence_set_digest,r=jv({proofKind:e.proof.kind,unseal:t.authorization.unseal});return{kind:`verified_step_up`,evidenceSetDigest:n,operation:e.prepared.operation,expiresAtMs:t.expires_at_ms,quotaUse:`none`,unseal:r,exportTopology:t.export_topology}}function jv(e){switch(e.proofKind){case`passkey`:if(e.unseal.kind!==`not_requested`)throw Error(`[SigningEngine][ecdsa-export] passkey step-up returned Email OTP unseal material`);return{kind:`not_requested`};case`email_otp`:if(e.unseal.kind!==`email_otp_grant`)throw Error(`[SigningEngine][ecdsa-export] Email OTP step-up did not return an unseal grant`);return{kind:`email_otp_grant`,grant:e.unseal.grant,challenge_id:e.unseal.challenge_id};default:{let t=e.proofKind;throw Error(`Unsupported ECDSA export step-up proof: ${String(t)}`)}}}async function Mv(e,t){vv(t.exportLane);let n=nv(`tecdsa-export`),r=await xv({walletId:t.walletId,chainTarget:t.exportLane.chainTarget,requestId:n,keyHandle:t.material.existingRoleLocalMaterial.publicFacts.keyHandle,displayPublicKey:t.material.existingRoleLocalMaterial.publicFacts.groupPublicKey33B64u,displayAddress:t.material.existingRoleLocalMaterial.publicFacts.ethereumAddress,materialActivation:t.material.existingRoleLocalMaterial.materialActivation,operationRuntime:t.material,operationExpiresAtMs:Date.now()+5*6e4}),i=await uv({touchConfirm:e.touchConfirm,theme:e.theme},{walletSessionUserId:t.walletId,credentialIdB64u:vv(t.exportLane).credentialIdB64u,publicKey:t.exportPublicKey,chainTarget:t.exportLane.chainTarget,challengeB64u:r.challengeB64u,flowId:t.flowId,onEvent:t.onEvent});await Sv({deps:e,exportLane:t.exportLane,expectedMaterialActivation:t.material.existingRoleLocalMaterial.materialActivation});let a=t.exportLane.capability.authority;if(!Jn(a))throw Error(`[SigningEngine][ecdsa-export] exact Passkey capability authority changed`);let o=await Av({relayerUrl:t.material.relayerUrl,prepared:r,transport:{kind:`legacy_cookie`},proof:Ov({authority:a,credential:i.credential})});return{exportActivation:A_({relayerUrl:t.material.relayerUrl,existingRoleLocalMaterial:t.material.existingRoleLocalMaterial,authorization:o}),credential:i.credential}}async function Nv(e){let t=Ur({walletId:e.walletId,walletSessionUserId:e.walletId});return await e.deps.emailOtp.exportEcdsaKeyWithDurableAuthorization({walletSession:t,chainTarget:e.material.chainTarget,challengeId:e.authorization.challengeId,otpCode:e.authorization.otpCode,publicFacts:e.material.publicFacts,runtimePolicyScope:e.material.runtimePolicyScope,authority:e.material.authorization.authority,persistedMaterial:e.persistedMaterial,explicitExportAuthorization:e.explicitExportAuthorization})}function Pv(e){return{normalSigning:e.runtime.normalSigning,relayerKeyId:e.relayerKeyId,participantIds:e.participantIds}}function Fv(e){return Math.min(Date.now()+5*6e4,e.session.expiresAtMs)}async function Iv(e){if(e.material.runtime.auth.kind!==`passkey`)throw Error(`[SigningEngine][ecdsa-export] active passkey runtime auth mismatch`);if(!Jn(e.material.factorAuthority))throw Error(`[SigningEngine][ecdsa-export] active passkey factor authority mismatch`);let t=await xv({walletId:e.walletId,chainTarget:e.exportLane.chainTarget,requestId:nv(`tecdsa-active-passkey-export`),keyHandle:e.material.runtime.publicFacts.keyHandle,displayPublicKey:e.material.runtime.publicFacts.publicKeyB64u,displayAddress:e.material.runtime.publicFacts.thresholdOwnerAddress,materialActivation:e.material.runtime.materialActivation,operationRuntime:Pv(e.material),operationExpiresAtMs:Fv(e.material.runtime)}),n=await uv({touchConfirm:e.deps.touchConfirm,theme:e.deps.theme},{walletSessionUserId:e.walletId,credentialIdB64u:e.material.factorAuthority.factor.credentialIdB64u,publicKey:e.exportPublicKey,chainTarget:e.exportLane.chainTarget,challengeB64u:t.challengeB64u,flowId:e.flowId,onEvent:e.onEvent}),r=await Ev({ports:e.deps.activeWalletAuthorityEcdsaRuntimeReadPorts,expectedRuntime:e.material.runtime});if(!Jn(r.factorAuthority))throw Error(`[SigningEngine][ecdsa-export] active passkey factor authority changed`);return{runtime:r,authorization:await Av({relayerUrl:e.material.relayerUrl,prepared:t,transport:{kind:`wallet_session_bearer`,token:r.operationCredential.token},proof:Ov({authority:r.factorAuthority,credential:n.credential})})}}async function Lv(e){if(e.material.runtime.auth.kind!==`email_otp`)throw Error(`[SigningEngine][ecdsa-export] active Email OTP runtime auth mismatch`);if(!$n(e.material.factorAuthority))throw Error(`[SigningEngine][ecdsa-export] active Email OTP factor authority mismatch`);let t=await xv({walletId:e.walletId,chainTarget:e.exportLane.chainTarget,requestId:nv(`tecdsa-active-email-otp-export`),keyHandle:e.material.runtime.publicFacts.keyHandle,displayPublicKey:e.material.runtime.publicFacts.publicKeyB64u,displayAddress:e.material.runtime.publicFacts.thresholdOwnerAddress,materialActivation:e.material.runtime.materialActivation,operationRuntime:Pv(e.material),operationExpiresAtMs:Fv(e.material.runtime)}),n=await sv({touchConfirm:e.deps.touchConfirm,requestExportChallenge:e.deps.emailOtp.requestExportChallenge},{kind:`wallet_session_export_auth`,walletSession:Ur({walletId:e.walletId,walletSessionUserId:e.walletId}),chain:xh(e.exportLane),publicKey:e.exportPublicKey,curve:`ecdsa`,flowId:e.flowId,onEvent:e.onEvent}),r=await Ev({ports:e.deps.activeWalletAuthorityEcdsaRuntimeReadPorts,expectedRuntime:e.material.runtime});if(!$n(r.factorAuthority))throw Error(`[SigningEngine][ecdsa-export] active Email OTP factor authority changed`);return{runtime:r,authorization:await Av({relayerUrl:e.material.relayerUrl,prepared:t,transport:{kind:`wallet_session_bearer`,token:r.operationCredential.token},proof:kv({authority:r.factorAuthority,challengeId:n.challengeId,otpCode:n.otpCode})})}}async function Rv(e){switch(e.material.kind){case`active_wallet_authority_passkey_needs_authorization`:return await Iv({deps:e.deps,walletId:e.walletId,exportLane:e.exportLane,material:e.material,exportPublicKey:e.exportPublicKey,flowId:e.flowId,onEvent:e.onEvent});case`active_wallet_authority_email_otp_needs_authorization`:return await Lv({deps:e.deps,walletId:e.walletId,exportLane:e.exportLane,material:e.material,exportPublicKey:e.exportPublicKey,flowId:e.flowId,onEvent:e.onEvent});default:return zv(e.material)}}function zv(e){throw Error(`[SigningEngine][ecdsa-export] unsupported active wallet authority material: ${String(e)}`)}async function Bv(e,t){let n=String(t.material.publicFacts.publicKeyB64u),r=await Rv({deps:e,walletId:t.walletId,exportLane:t.exportLane,material:t.material,exportPublicKey:n,flowId:t.flowId,onEvent:t.onEvent});return await _v(e,{walletId:t.walletId,exportLane:t.exportLane,activeRuntime:r.runtime,exportPublicKey:n,options:t.options,flowId:t.flowId,onEvent:t.onEvent,prepareArtifact:async()=>{let n=await Ev({ports:e.activeWalletAuthorityEcdsaRuntimeReadPorts,expectedRuntime:r.runtime});return await Yh({getSignerWorkerContext:e.getSignerWorkerContext},{runtime:n,operationAuthorization:r.authorization,relayerUrl:t.material.relayerUrl})}})}async function Vv(e,t){let n=xh(t.exportLane),r=await bv({walletId:t.walletId,chainTarget:t.exportLane.chainTarget,requestId:nv(`tecdsa-email-otp-export`),keyHandle:t.material.persistedMaterial.publicFacts.keyHandle,displayPublicKey:t.material.persistedMaterial.publicFacts.groupPublicKey33B64u,displayAddress:t.material.persistedMaterial.publicFacts.ethereumAddress,materialActivation:t.material.persistedMaterial.materialActivation,operationRuntime:t.material,operationExpiresAtMs:Date.now()+5*6e4}),i=await sv({touchConfirm:e.touchConfirm,requestExportChallenge:e.emailOtp.requestExportChallenge},{kind:`wallet_session_export_auth`,walletSession:Ur({walletId:t.walletId,walletSessionUserId:t.walletId}),chain:n,publicKey:String(t.material.publicFacts.publicKeyB64u),curve:`ecdsa`,flowId:t.flowId,onEvent:t.onEvent});await Cv({deps:e,exportLane:t.exportLane,expectedMaterialActivation:t.material.persistedMaterial.materialActivation});let a=await Av({relayerUrl:t.material.relayerUrl,prepared:r,transport:{kind:`legacy_cookie`},proof:kv({authority:t.material.authorization.authority,challengeId:i.challengeId,otpCode:i.otpCode})});return await _v(e,{walletId:t.walletId,exportLane:t.exportLane,exportPublicKey:String(t.material.publicFacts.publicKeyB64u),options:t.options,flowId:t.flowId,onEvent:t.onEvent,prepareArtifact:Nv.bind(void 0,{deps:e,walletId:t.walletId,material:t.material,authorization:i,persistedMaterial:t.material.persistedMaterial,explicitExportAuthorization:a})})}async function Hv(e,t){if(t.exportLane.authMethod!==`passkey`)throw Error(`[SigningEngine][ecdsa-export] fresh passkey export requires passkey lane`);let n=String(t.material.publicFacts.publicKeyB64u),r=await Mv(e,{walletId:t.walletId,exportLane:t.exportLane,material:t.material,exportPublicKey:n,flowId:t.flowId,onEvent:t.onEvent});return await _v(e,{walletId:t.walletId,exportLane:t.exportLane,exportPublicKey:n,options:t.options,flowId:t.flowId,onEvent:t.onEvent,prepareArtifact:async()=>{let n=await e.provisionPasskeyEcdsaExplicitExportSession(r.exportActivation);return await qh({getSignerWorkerContext:e.getSignerWorkerContext},{walletSessionUserId:t.walletId,exportProvision:n,factorAuthorization:{kind:`passkey`,passkeyCredentialIdB64u:String(r.credential.rawId||r.credential.id),credential:r.credential}})}})}function Uv(e){let t=e.source===`canonical_capability`?e.authorization:null;return{authMethod:If(e),curve:e.curve,chain:e.chainTarget.kind,chainTarget:e.chainTarget,state:e.state,source:e.source,...t?{remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs}:{},updatedAtMs:e.updatedAtMs,evmFamilyKeyFingerprint:Ra({walletId:e.key.walletId,publicFacts:e.publicFacts})}}function Wv(e,t){return String(e.key.walletId)===t.walletId?String(Ra({walletId:e.key.walletId,publicFacts:e.publicFacts})):``}function Gv(e){if(!e.candidates.length)throw yl(`evm-family`,{stage:`key_export.exact_lane_no_candidate`,context:e.context,candidateCount:e.candidates.length,candidates:e.candidates.map(Uv)}),Error(`[SigningEngine][${e.context}] exact lane selection failed: no_candidate`);for(let t of e.candidates)if(!Wv(t,e.ecdsaContext))return Kv(e);if(e.candidates.length!==1)return Kv(e);let[t]=e.candidates;return bl(`evm-family`,{stage:`key_export.exact_lane_selected`,context:e.context,reason:`single_exact_candidate`,selectedLane:Uv(t),candidateCount:e.candidates.length}),t}function Kv(e){throw yl(`evm-family`,{stage:`key_export.exact_lane_ambiguous_material`,context:e.context,candidateCount:e.candidates.length,candidates:e.candidates.map(Uv)}),Error(`[SigningEngine][${e.context}] exact lane selection failed: ambiguous_material`)}function qv(e){return Gc({signer:qc({walletId:e.lane.key.walletId,chainTarget:e.chainTarget||e.lane.chainTarget,keyHandle:e.lane.publicFacts.keyHandle,key:e.lane.key,materialActivation:e.lane.materialActivation}),auth:e.lane.auth})}function Jv(e){return e.source===`active_wallet_authority`||e.state===`ready`?{kind:`loaded_worker_material`}:If(e)===`email_otp`?{kind:`material_pending`,reason:`email_otp_route_auth`}:{kind:`sealed_worker_material`}}function Yv(e){if(e.lane.source===`active_wallet_authority`)return{chainTarget:e.chainTarget,authMethod:If(e.lane),material:{kind:`loaded_worker_material`},state:`deferred`};let t=If(e.lane),n=Jv(e.lane);switch(e.lane.state){case`expired`:case`exhausted`:throw Error(`[SigningEngine][ecdsa-export] expired export lane requires durable public reauth authority`);case`ready`:case`deferred`:return{chainTarget:e.chainTarget,authMethod:t,material:n,state:e.lane.state}}}async function Xv(e){let t=e.lane,n=qv({lane:t}),r=Yv({lane:t,chainTarget:e.chainTarget});return t.source===`active_wallet_authority`?{curve:`ecdsa`,laneIdentity:n,source:`active_wallet_authority`,authorizationState:`authorization_required`,key:t.key,publicFacts:t.publicFacts,runtime:t.runtime,chainTarget:e.chainTarget,authMethod:If(t),material:{kind:`loaded_worker_material`},state:`deferred`}:t.authorization?{curve:`ecdsa`,laneIdentity:n,source:`canonical_capability`,authorizationState:`authorized`,authorization:t.authorization,capability:t.capability,key:t.key,publicFacts:t.publicFacts,...r}:{curve:`ecdsa`,laneIdentity:n,source:`canonical_capability`,authorizationState:`authorization_required`,capability:t.capability,key:t.key,publicFacts:t.publicFacts,...r}}function Zv(e){return zc(e.laneIdentity)===zc(e.identity)}async function Qv(e){return qv({lane:e})}function $v(e){return Af(e.availableLanes,e.chainTarget).filter(e=>Ch(e))}async function ey(e,t){let n=$v({availableLanes:await e.readOwnerScopedAvailableSigningLanesForTargets({walletId:t.walletId,ecdsaChainTargets:[t.signingTarget]}),chainTarget:t.signingTarget}),r=[];for(let e of n)Zv({laneIdentity:await Qv(e),identity:t.laneIdentity})&&r.push(e);let i=Gv({context:`ecdsa-export`,candidates:r,ecdsaContext:{walletId:t.walletId}});return await Xv({lane:i,chainTarget:i.chainTarget})}async function ty(e,t){try{switch(t.kind){case`ecdsa`:return await ny(e,t);case`ed25519`:return await oy(e,t)}}catch(e){if(Ad(e))return{kind:`relink_required`,reason:e.reason};throw e}}async function ny(e,t){let n=String(R(t.walletSession.walletId));return{kind:`ecdsa`,laneIdentity:await Qv(Gv({context:`ecdsa-export-resolve`,candidates:$v({availableLanes:await e.readOwnerScopedAvailableSigningLanesForTargets({walletId:n,ecdsaChainTargets:[t.chainTarget]}),chainTarget:t.chainTarget}),ecdsaContext:{walletId:n}}))}}function ry(e){let t=e.lane.source===`durable_sealed_record`||e.lane.source===`public_capability_reference`;return String(e.lane.walletId)===e.walletId&&String(e.lane.nearAccountId)===e.nearAccountId&&t}function iy(e){return Hc({signer:Bc({walletId:e.walletId,nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:e.signerSlot}),auth:e.auth,thresholdSessionId:e.thresholdSessionId})}function ay(e){return[e.walletId,e.nearAccountId,e.nearEd25519SigningKeyId,e.signerSlot,Zs(e.auth)].map(e=>String(e)).join(`|`)}async function oy(e,t){let n=String(R(t.walletSession.walletId)),r=String(t.nearAccount.accountId),i=await e.readOwnerScopedAvailableSigningLanesForTargets({walletId:n,ecdsaChainTargets:[]}),a=i.lanes.ed25519.near;if(!Mf(a)||a.curve!==`ed25519`||!ry({lane:a,walletId:n,nearAccountId:r}))throw Error(`[SigningEngine][ed25519-export-resolve] exact Yao lane selection failed: no_candidate`);let o=i.candidates.ed25519.near.filter(e=>Mf(e)&&e.curve===`ed25519`&&ry({lane:e,walletId:n,nearAccountId:r})),s=ay(a);if(o.some(e=>ay(e)!==s))throw Error(`[SigningEngine][ed25519-export-resolve] exact Yao lane selection failed: ambiguous_material`);return{kind:`ed25519`,laneIdentity:iy(a),materialActivation:a.materialActivation}}async function sy(e,t){let n=await ey(e,{walletId:t.walletId,signingTarget:t.signingTarget,laneIdentity:t.laneIdentity});switch(n.material.kind){case`loaded_worker_material`:case`material_pending`:case`sealed_worker_material`:return n}throw n.material,Error(`[SigningEngine][ecdsa-export] unsupported material availability`)}function cy(e){return e.capability.materialActivation}function ly(e){return e.material.materialActivation}function uy(e){return e.auth.kind===`passkey`}function dy(e){if(!uy(e.laneIdentity))throw Error(`[SigningEngine][ed25519-export] export requires a passkey Yao lane`);if(e.laneIdentity.signer.account.wallet.walletId!==e.walletId||String(e.laneIdentity.signer.account.nearAccountId)!==String(e.nearAccountId))throw Error(`[SigningEngine][ed25519-export] exact lane subject mismatch`);return e.laneIdentity}function fy(e){return e.auth.kind===`email_otp`}function py(e){if(!fy(e.laneIdentity))throw Error(`[SigningEngine][ed25519-export] export requires an Email OTP Yao lane`);if(e.laneIdentity.signer.account.wallet.walletId!==e.walletId||String(e.laneIdentity.signer.account.nearAccountId)!==String(e.nearAccountId))throw Error(`[SigningEngine][ed25519-export] exact lane subject mismatch`);return e.laneIdentity}function my(e){let t=e.selected.signer,n=e.context.material;return String(t.account.wallet.walletId)===String(n.walletId)&&String(t.account.nearAccountId)===String(n.nearAccountId)&&String(t.nearEd25519SigningKeyId)===String(n.nearEd25519SigningKeyId)&&t.signerSlot===n.signerSlot&&String(e.selected.auth.rpId)===e.context.rpId&&e.selected.auth.credentialIdB64u===n.credentialIdB64u}function hy(e){if(!my({selected:e.selectedLaneIdentity,context:e.context}))throw Error(`[SigningEngine][ed25519-export] durable Yao context identity mismatch`);let t=e.context.material;if(!b(e.selectedMaterialActivation,e.context.selectedLaneMaterialActivation))throw Error(`[SigningEngine][ed25519-export] durable Yao context activation mismatch`);let n=e.context.authorization.operationCredential.token;if(!n)throw Error(`[SigningEngine][ed25519-export] active Wallet Session authorization is unavailable`);let r=t.capability.lifecycle;return{laneIdentity:e.selectedLaneIdentity,relayerUrl:e.context.relayerUrl,walletSessionToken:n,walletCustodyEnvelope:e.context.walletCustodyEnvelope,capability:{materialActivation:t.capability.materialActivation,scope:{lifecycle_id:r.lifecycleId,root_share_epoch:r.rootShareEpoch,account_id:r.accountId,threshold_session_id:r.thresholdSessionId,signer_set_id:r.signerSetId,signing_worker_id:r.signingWorkerId,material_activation:Un(t.capability.materialActivation)},applicationBinding:t.capability.applicationBinding,participantIds:t.capability.participantIds,registeredPublicKey:t.capability.registeredPublicKey,stateEpoch:t.capability.stateEpoch,activeCapabilityBinding:t.capability.activeCapabilityBinding,runtimePolicyScope:t.capability.runtimePolicyScope}}}async function gy(e,t){let n=dy(t),r=await e.resolvePasskeyExportContext({laneIdentity:n,materialActivation:t.materialActivation});switch(r.kind){case`ready`:return hy({context:r.context,selectedLaneIdentity:n,selectedMaterialActivation:t.materialActivation});case`capability_recovery_required`:throw Error(`[SigningEngine][ed25519-export] passkey material recovery did not publish durable context`)}throw Error(`[SigningEngine][ed25519-export] unsupported passkey export context state`)}async function _y(e,t){let n=py(t),r=await e.emailOtp.resolveExportContext({laneIdentity:n,materialActivation:t.materialActivation});if(!b(t.materialActivation,r.material.materialActivation)&&r.material.kind!==`sealed_export_root`)throw Error(`[SigningEngine][ed25519-export] Email OTP Yao context activation mismatch`);return{context:r,laneIdentity:n}}function vy(e){let t=e.resolved.laneIdentity.signer;return{artifactKind:`router-ab-ed25519-yao-seed-export-v1`,walletId:String(e.input.walletId),nearAccountId:String(e.input.nearAccountId),relayerUrl:e.resolved.relayerUrl,authorization:{kind:`opaque_wallet_session`,walletSessionToken:e.resolved.walletSessionToken},flowId:e.input.flowId,viewerSessionId:e.viewerSessionId,exactLane:{nearEd25519SigningKeyId:String(t.nearEd25519SigningKeyId),signerSlot:t.signerSlot,credentialIdB64u:e.resolved.laneIdentity.auth.credentialIdB64u,materialActivation:cy(e.resolved)},walletCustodyEnvelope:e.resolved.walletCustodyEnvelope,capability:e.resolved.capability,variant:e.input.options.variant,theme:e.input.options.theme??e.theme}}function yy(e,t){let n=String(e.walletId);tv(e.onEvent,{phase:t===`opened`?H.STEP_04_VIEWER_OPENED:H.STEP_05_VIEWER_CLOSED,status:t===`opened`?`waiting_for_user`:`succeeded`,flowId:e.flowId,accountId:n,interaction:{kind:`key_export_viewer`,overlay:t===`opened`?`show`:`hide`},data:{chain:`near`,curve:`ed25519`}}),t===`closed`&&tv(e.onEvent,{phase:H.STEP_06_COMPLETED,status:`succeeded`,flowId:e.flowId,accountId:n,interaction:{kind:`none`,overlay:`hide`},data:{chain:`near`,curve:`ed25519`}})}async function by(e,t){switch(t.laneIdentity.auth.kind){case`passkey`:break;case`email_otp`:return await xy(e,t);default:throw t.laneIdentity.auth,Error(`[SigningEngine][ed25519-export] unsupported lane authorization method`)}let n=gy(e,t),r=e.touchConfirm.initialize(),[i]=await Promise.all([n,r]),a=String(t.walletId),o=nv(`export-ed25519-yao-viewer-session`),s=yy.bind(void 0,{flowId:t.flowId,walletId:t.walletId,onEvent:t.onEvent});tv(t.onEvent,{phase:H.STEP_02_AUTH_PASSKEY_PROMPT_STARTED,status:`waiting_for_user`,flowId:t.flowId,accountId:a,authMethod:`passkey`,interaction:{kind:`passkey_assert`,overlay:`show`},data:{intent:`ed25519_export`,chain:`near`,curve:`ed25519`}}),tv(t.onEvent,{phase:H.STEP_03_MATERIAL_PREPARE_STARTED,status:`running`,flowId:t.flowId,accountId:a,interaction:{kind:`none`,overlay:`none`},data:{chain:`near`,curve:`ed25519`}});let c=await e.withThresholdEd25519CommitQueue({queueKey:Ef({materialActivation:cy(i)}),nearAccountId:t.nearAccountId,enabled:!0,task:()=>e.passkeyMpcExport.exportPrivateKeysWithUi(vy({resolved:i,viewerSessionId:o,input:t,theme:e.theme}),{onViewerLifecycle:s})});if(c.kind!==`completed`)throw Error(c.error);if(c.exportedSchemes.length!==1||c.exportedSchemes[0]!==`ed25519`)throw Error(`[SigningEngine][ed25519-export] secure export failed`);return tv(t.onEvent,{phase:H.STEP_02_AUTH_PASSKEY_PROMPT_SUCCEEDED,status:`succeeded`,flowId:t.flowId,accountId:a,authMethod:`passkey`,interaction:{kind:`passkey_assert`,overlay:`none`},data:{intent:`ed25519_export`,chain:`near`,curve:`ed25519`}}),tv(t.onEvent,{phase:H.STEP_03_MATERIAL_PREPARE_SUCCEEDED,status:`succeeded`,flowId:t.flowId,accountId:a,interaction:{kind:`none`,overlay:`none`},data:{chain:`near`,curve:`ed25519`}}),{accountId:String(t.nearAccountId),exportedSchemes:[`ed25519`]}}async function xy(e,t){let n=await _y(e,t),r=`ed25519:${zi(Uint8Array.from(n.context.material.capability.registeredPublicKey))}`,i=await cv({touchConfirm:e.touchConfirm,requestExportChallenge:e.emailOtp.requestExportChallenge},{kind:`email_otp_ed25519_export_auth`,walletId:t.walletId,nearAccountId:String(t.nearAccountId),nearEd25519SigningKeyId:String(n.laneIdentity.signer.nearEd25519SigningKeyId),signerSlot:n.laneIdentity.signer.signerSlot,publicKey:r,curve:`ed25519`,chain:`near`,flowId:t.flowId,onEvent:t.onEvent});tv(t.onEvent,{phase:H.STEP_03_MATERIAL_PREPARE_STARTED,status:`running`,flowId:t.flowId,accountId:String(t.nearAccountId),interaction:{kind:`none`,overlay:`none`},data:{chain:`near`,curve:`ed25519`}});let a=nv(`export-ed25519-yao-viewer-session`);try{await lv({touchConfirm:e.touchConfirm,theme:e.theme},{state:`loading`,walletId:String(t.walletId),nearAccountId:String(t.nearAccountId),publicKey:r,variant:t.options.variant,theme:t.options.theme,viewerSessionId:a,flowId:t.flowId,onEvent:t.onEvent});let o=await e.withThresholdEd25519CommitQueue({queueKey:Ef({materialActivation:ly(n.context)}),nearAccountId:t.nearAccountId,enabled:n.context.material.kind===`active_capability`,task:()=>e.emailOtp.exportSeedWithFreshAuthorization({challengeId:i.challengeId,otpCode:i.otpCode,exportContext:n.context})});return tv(t.onEvent,{phase:H.STEP_03_MATERIAL_PREPARE_SUCCEEDED,status:`succeeded`,flowId:t.flowId,accountId:String(t.nearAccountId),interaction:{kind:`none`,overlay:`none`},data:{chain:`near`,curve:`ed25519`}}),qf(a)&&await lv({touchConfirm:e.touchConfirm,theme:e.theme},{state:`ready`,walletId:String(t.walletId),nearAccountId:String(t.nearAccountId),publicKey:o.publicKey,privateKey:o.privateKey,variant:t.options.variant,theme:t.options.theme,viewerSessionId:a,flowId:t.flowId,onEvent:t.onEvent}),{accountId:String(t.nearAccountId),exportedSchemes:[`ed25519`]}}catch(e){throw Kf(),e}}function Sy(e){switch(e.kind){case`active`:case`expired`:return e;case`missing`:case`unavailable`:case`invalid`:return null;default:return e}}async function Cy(e){await e.deps.sessionLifecycle.invalidateExpiredAuthorization({state:e.state,source:e.source})}async function wy(e){let t=await e.deps.sessionLifecycle.readAuthorization(e.request);return t.kind===`expired`&&await Cy({deps:e.deps,state:t,source:es.operationPreflight}),t}function Ty(e){let t=Sy(e.preflightState);return t?Of({source:e.source,expiresAtMs:t.expiresAtMs,detectedAtMs:e.detectedAtMs}):null}async function Ey(e,t){let n=R(t.walletSession.walletId),r=await sy(e.laneSelection,{walletId:n,signingTarget:Sh(t.chainTarget),laneIdentity:t.laneIdentity}),i=await jh(e.ecdsa.sessionStore,r);if(r.source===`active_wallet_authority`){if(i.source!==`active_wallet_authority`)throw Error(`[SigningEngine][ecdsa-export] active lane material source changed`);return{kind:`active_wallet_authority`,exportLane:r,exportMaterial:i}}if(i.source!==`canonical_capability`)throw Error(`[SigningEngine][ecdsa-export] canonical lane material source changed`);return{kind:`canonical_capability`,exportLane:r,exportMaterial:i}}function Dy(e){if(!(!e||e.source!==`canonical_capability`||!e.authorization))return e.authorization.operationCredential.walletSessionId}function Oy(e){let t=e.exportLane?.publicFacts,n=e.exportLane?Ra({walletId:e.exportLane.key.walletId,publicFacts:e.exportLane.publicFacts}):void 0;try{console.warn(`[SigningEngine][ecdsa-export][failure]`,{operationId:e.flowId,authMethod:e.exportLane?.authMethod,...n?{evmFamilyKeyFingerprint:n}:{},...t?{keyHandle:String(t.keyHandle)}:{},chainTargetKey:z(e.input.chainTarget),...Dy(e.exportLane)?{walletSessionId:Dy(e.exportLane)}:{},materialActivationId:e.exportLane?.laneIdentity.signer.materialActivation.activationId,freshAuthRetrySideEffectState:`not_applicable`,error:e.error instanceof Error?e.error.message:String(e.error||`unknown error`)})}catch{}}async function ky(e,t,n){let r=R(t.walletSession.walletId);if(n.kind===`active_wallet_authority`)return await Bv(e.ecdsa,{walletId:r,exportLane:n.exportLane,material:n.exportMaterial,options:{variant:t.options.variant,theme:t.options.theme},flowId:t.flowId,onEvent:t.options.onEvent});if(n.exportMaterial.kind===`fresh_email_otp_route_auth_ready`)return await Vv(e.ecdsa,{walletId:r,exportLane:n.exportLane,material:n.exportMaterial,options:{variant:t.options.variant,theme:t.options.theme},flowId:t.flowId,onEvent:t.options.onEvent});if(n.exportMaterial.kind===`fresh_passkey_needs_authorization`)return await Hv(e.ecdsa,{walletId:r,exportLane:n.exportLane,material:n.exportMaterial,options:{variant:t.options.variant,theme:t.options.theme},flowId:t.flowId,onEvent:t.options.onEvent});throw n.exportMaterial,Error(`[SigningEngine][ecdsa-export] unsupported export material`)}async function Ay(e,t,n){let[r]=await Promise.all([Ey(e,t),e.ecdsa.touchConfirm.initialize()]);if(r.exportLane.authorizationState===`authorization_required`)try{return await ky(e,t,r)}catch(e){throw Oy({input:t,flowId:t.flowId,exportLane:r.exportLane,exportMaterial:r.exportMaterial,error:e}),e}let i={kind:`ecdsa`,laneIdentity:r.exportLane.laneIdentity,authorization:r.exportLane.authorization},a=await wy({deps:e,request:{kind:`ecdsa`,laneIdentity:r.exportLane.laneIdentity,authorization:r.exportLane.authorization,nowMs:Date.now()}});try{return await ky(e,t,r)}catch(o){Oy({input:t,flowId:t.flowId,exportLane:r.exportLane,exportMaterial:r.exportMaterial,error:o});let s=wf(o);if(n.kind===`fresh_auth_retry`||s?.kind!==`expired`)throw o;let c=Ty({source:i,preflightState:a,detectedAtMs:Date.now()});if(!c)throw o;return await Cy({deps:e,state:c,source:es.serverRejection}),await Ay(e,t,{kind:`fresh_auth_retry`})}}async function jy(e,t){return await by(e.ed25519Yao,{walletId:t.walletSession.walletId,nearAccountId:t.nearAccount.accountId,laneIdentity:t.laneIdentity,materialActivation:t.materialActivation,options:{variant:t.options.variant,theme:t.options.theme},flowId:t.flowId,onEvent:t.options.onEvent})}async function My(e,t){return await iv(t,async t=>{switch(t.kind){case`ecdsa`:return await Ay(e,t,{kind:`initial`});case`ed25519`:return await jy(e,t)}})}async function Ny(e,t){return await ty(e.laneSelection,t)}function Py(e){return{laneSelection:e.laneSelection,sessionLifecycle:e.sessionLifecycle,ecdsa:{...e.ecdsa,theme:e.getTheme()},ed25519Yao:{...e.ed25519Yao,theme:e.getTheme()}}}async function Fy(e,t){return await My(Py(e),t)}async function Iy(e,t){return await Ny(Py(e),t)}async function Ly(e,t){return await e.touchConfirm.requestRegistrationCredentialConfirmation({walletId:t.walletId,nearAccountId:t.nearAccountId,signerSlot:t.signerSlot,confirmerText:t.confirmerText,confirmationConfigOverride:t.confirmationConfigOverride,challengeB64u:t.challengeB64u,registrationOptions:t.registrationOptions})}async function Ry(e,t){return await e.touchIdPrompt.getAuthenticationCredentialsSerializedForChallengeB64u({subjectId:t.subjectId,challengeB64u:t.challengeB64u,allowCredentials:t.allowCredentials,includeSecondPrfOutput:t.includeSecondPrfOutput??!1})}function zy(e,t){return Fi(e.accountLifecycle,t).then(()=>void 0)}function By(e){return Ti(e.accountLifecycle)}function Vy(e,t,n){return ki(e.accountLifecycle,t,n)}function Hy(e){return xi(e.accountLifecycle)}function Uy(e,t){return Di(e.accountLifecycle,t)}function Wy(e,t,n){return Ni(e.accountLifecycle,t,n)}function Gy(e,t){return Ii(e.accountLifecycle,t)}function Ky(e,t){return ji(e.accountLifecycle,t)}function qy(e,t){return Mi(e.accountLifecycle,t)}function Jy(e,t){return Si(e.accountLifecycle,t)}function Yy(e,t){return wi(e.accountLifecycle,t)}function Xy(e,t){return Ci(e.accountLifecycle,t)}function Zy(e,t){return yi(e.accountLifecycle,t)}function Qy(e,t){return ui(e.accountLifecycle,t)}function $y(e,t){return Pi(e.accountLifecycle,t)}function eb(e,t){return _i(e.accountLifecycle,t)}function tb(e,t){return Ei(e.accountLifecycle,t)}function nb(e,t){return Ai(e.accountLifecycle,t)}function rb(e,t){return bi(e.accountLifecycle,t)}function ib(e,t){return di(e.accountLifecycle,t)}function ab(e,t){return vi(e.accountLifecycle,t)}function ob(e,t){return fi(e.accountLifecycle,t)}function sb(e,t){return Oi(e.accountLifecycle,t)}function cb(e,t){return pi(e.accountLifecycle,t)}function lb(e,t){return Ly(e.session,t)}function ub(e,t){return Ry(e.session,t)}function db(e){let{record:t,operationCredential:n,scope:r}=e;return t.walletId===r.walletId&&t.authorityId===r.authorityId&&t.authMethodId===r.authMethodId&&t.authorityDigestB64u===r.authorityDigestB64u&&t.authorityRevocationEpoch===r.authorityRevocationEpoch&&n.kind===`opaque_wallet_session_operation_credential_v1`&&n.token.trim().length>0}async function fb(e){let{walletId:t,ports:n}=e,r=await n.resolveSelectedWalletAuthority(String(t));if(r.kind!==`resolved`)return{kind:`missing`};let{selection:i,authMethod:a,authority:o}=r;if(i.walletId!==t||i.walletAuthMethodId!==a.walletAuthMethodId||i.lockState!==`unlocked`||a.walletId!==t||a.walletAuthorityId!==o.authorityId||a.status!==`active`||o.walletId!==t||o.state!==`active`)return{kind:`missing`};let s=await n.readExactWithOperationCredential({walletId:t,authorityId:o.authorityId,authMethodId:a.walletAuthMethodId});switch(s.kind){case`found`:break;case`missing`:return{kind:`missing`};case`upgrade_required`:return{kind:`upgrade_required`}}return!db({record:s.record,operationCredential:s.operationCredential,scope:{walletId:t,authorityId:o.authorityId,authMethodId:a.walletAuthMethodId,authorityDigestB64u:o.authorityDigestB64u,authorityRevocationEpoch:o.revocationEpoch}})||s.record.expiresAtMs<=Date.now()?{kind:`missing`}:{kind:`authenticated`,state:{kind:`authenticated`,walletId:t,authMethod:a.kind},walletAuthMethodId:a.walletAuthMethodId}}function pb(e,t){switch(e.kind){case`found`:return e;case`missing`:return null;case`upgrade_required`:throw new Os(t)}}function mb(e){e instanceof Uint8Array&&e.fill(0)}function hb(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`${t} returned invalid JSON`);return e}function X(e,t){return M(e,t)}function gb(e){return te(e)}function _b(e){let t=new ArrayBuffer(e.byteLength);return new Uint8Array(t).set(e),t}function vb(e){if(!e||typeof e.requestWorkerOperation!=`function`)throw Error(`Email OTP secret-bearing operations require the dedicated emailOtp worker`);return e}function yb(e,t){if(!(e instanceof Uint8Array))throw Error(`${t} must be a Uint8Array`);if(e.length!==32)throw Error(`${t} must contain 32 bytes`);return Uint8Array.from(e)}function bb(e){return e.routeFamily===`registration`?ml({routeFamily:`registration`,operation:Wr}):ml({routeFamily:`login`,operation:Jr})}function xb(e){let t=hb(e,`Email OTP enrollment result`);return{challengeId:X(t.challengeId,`challengeId`),otpChannel:Xr,enrollmentId:X(t.enrollmentId,`enrollmentId`),enrollmentSealKeyVersion:X(t.enrollmentSealKeyVersion,`enrollmentSealKeyVersion`),serverSealedFactorCiphertextB64u:X(t.serverSealedFactorCiphertextB64u,`serverSealedFactorCiphertextB64u`),clientUnlockPublicKeyB64u:X(t.clientUnlockPublicKeyB64u,`clientUnlockPublicKeyB64u`),unlockKeyVersion:X(t.unlockKeyVersion,`unlockKeyVersion`)}}function Sb(e){let t=hb(e,`Email OTP registration ECDSA handle`),n=X(t.kind,`emailOtpSessionHandle.handle.kind`);if(n!==`email_otp_worker_session_handle_v1`)throw Error(`Unsupported Email OTP worker handle kind: ${n}`);let r=X(t.action,`emailOtpSessionHandle.handle.action`);if(r!==`wallet_registration_ecdsa_prepare`)throw Error(`Unsupported Email OTP worker handle action: ${r}`);if(X(t.operation,`emailOtpSessionHandle.handle.operation`)!==`registration`)throw Error(`Email OTP registration ECDSA handle requires registration operation`);if(X(t.keyScope,`emailOtpSessionHandle.handle.keyScope`)!==`evm-family`)throw Error(`Email OTP registration ECDSA handle requires evm-family keyScope`);return{kind:`email_otp_worker_session_handle_v1`,sessionId:X(t.sessionId,`emailOtpSessionHandle.handle.sessionId`),walletId:X(t.walletId,`emailOtpSessionHandle.handle.walletId`),evmFamilySigningKeySlotId:X(t.evmFamilySigningKeySlotId,`emailOtpSessionHandle.handle.evmFamilySigningKeySlotId`),authSubjectId:X(t.authSubjectId,`emailOtpSessionHandle.handle.authSubjectId`),action:`wallet_registration_ecdsa_prepare`,operation:`registration`,keyScope:`evm-family`,chainTarget:Cb(t.chainTarget)}}function Cb(e){let t=e&&typeof e==`object`?e:null;if(!t)throw Error(`Email OTP registration ECDSA handle requires chainTarget`);return Rr(t)}function wb(e){let t=hb(e,`Email OTP registration ECDSA handle result`),n=X(t.kind,`emailOtpSessionHandle.kind`);switch(n){case`available`:if(!Array.isArray(t.handles)||t.handles.length===0)throw Error(`Email OTP registration ECDSA handle result requires handles`);{let e=[];for(let n of t.handles)e.push(Sb(n));let n=e[0];if(!n)throw Error(`Email OTP registration ECDSA handle result requires handles`);return{kind:`available`,handles:[n,...e.slice(1)]}}case`not_requested`:if(`handles`in t)throw Error(`Email OTP unrequested registration ECDSA handle result forbids handles`);return{kind:`not_requested`};default:throw Error(`Unsupported Email OTP registration ECDSA handle result kind: ${n}`)}}async function Tb(e){let t=vb(e.workerCtx),n=null;try{return n=e.clientSecret32?yb(e.clientSecret32,`clientSecret32`):null,xb(await t.requestWorkerOperation({kind:`emailOtp`,request:{type:`enrollEmailOtpWallet`,payload:{relayUrl:X(e.relayUrl,`relayUrl`),walletId:X(e.walletId,`walletId`),userId:X(e.userId,`userId`),...gb(e.challengeId)?{challengeId:gb(e.challengeId)}:{},otpCode:X(e.otpCode,`otpCode`),groupId:X(e.groupId,`groupId`),routePlan:bb({routeFamily:`registration`}),otpChannel:e.otpChannel||`email_otp`,...n?{clientSecret32:_b(n)}:{}}}}))}finally{mb(n)}}async function Eb(e){let t=vb(e.workerCtx),n=null;try{n=e.clientSecret32?yb(e.clientSecret32,`clientSecret32`):null;let r=await t.requestWorkerOperation({kind:`emailOtp`,request:{type:`prepareEmailOtpRegistrationEnrollmentMaterial`,payload:{relayUrl:X(e.relayUrl,`relayUrl`),walletId:X(e.walletId,`walletId`),userId:X(e.userId,`userId`),groupId:X(e.groupId,`groupId`),routePlan:bb({routeFamily:`registration`}),otpChannel:e.otpChannel||`email_otp`,ecdsaSessionHandle:e.ecdsaSessionHandle,...n?{clientSecret32:_b(n)}:{}}}});return{...r,emailOtpSessionHandle:wb(r.emailOtpSessionHandle),emailOtpEnrollment:r.emailOtpEnrollment}}finally{mb(n)}}function Db(e,t){return hl({freshRouteFamily:t,operation:e.operation})}function Ob(e){return{walletSession:e.walletSession,authoritySelector:e.authoritySelector,chainTarget:e.chainTarget,otpCode:e.otpCode,routePlan:Db(e,`login`),ecdsaBootstrapAuthorization:e.ecdsaBootstrapAuthorization,emailHashHex:e.emailHashHex,providerIdentity:e.providerIdentity,ed25519YaoRecovery:e.ed25519YaoRecovery??{kind:`not_requested`},...e.emailOtpAuthPolicy?{emailOtpAuthPolicy:e.emailOtpAuthPolicy}:{},...e.emailOtpAuthReason?{emailOtpAuthReason:e.emailOtpAuthReason}:{},...e.relayUrl?{relayUrl:e.relayUrl}:{},...e.challengeId?{challengeId:e.challengeId}:{},...e.operation?{operation:e.operation}:{},...e.groupId?{groupId:e.groupId}:{},...e.keyHandle?{keyHandle:e.keyHandle}:{},...e.participantIds?{participantIds:e.participantIds}:{},...e.publicationChainTargets?{publicationChainTargets:e.publicationChainTargets}:{},...typeof e.ttlMs==`number`?{ttlMs:e.ttlMs}:{},...typeof e.remainingUses==`number`?{remainingUses:e.remainingUses}:{},...e.runtimePolicyScope?{runtimePolicyScope:e.runtimePolicyScope}:{},...e.onProgress?{onProgress:e.onProgress}:{}}}async function kb(e,t){return await e.emailOtpSessions.loginWithEcdsaCapabilityInternal(Ob(t))}async function Ab(e,t){return await Wd({resolveSigningSessionAuth:t=>uf(t,e.signingSessionAuthorityPorts),withThresholdEcdsaSigningQueue:e.withThresholdEcdsaSigningQueue,emailOtpSessions:{requestTransactionSigningChallenge:t=>e.emailOtpSessions.requestTransactionSigningChallenge(t),loginWithEcdsaCapabilityInternal:({publicFacts:t,...n})=>e.emailOtpSessions.loginWithEcdsaCapabilityInternal({...n,keyHandle:String(t.keyHandle),participantIds:t.participantIds.map(e=>Number(e)),ecdsaBootstrapAuthorization:{kind:`route_plan_auth`},ed25519YaoRecovery:{kind:`not_requested`}})}},{walletSession:t.walletSession,chainTarget:t.chainTarget})}async function jb(e,t){return{...await Xd({resolveSigningSessionAuth:t=>uf(t,e.signingSessionAuthorityPorts),withThresholdEcdsaSigningQueue:e.withThresholdEcdsaSigningQueue,emailOtpSessions:{requestTransactionSigningChallenge:t=>e.emailOtpSessions.requestTransactionSigningChallenge(t),loginWithEcdsaCapabilityInternal:t=>e.emailOtpSessions.loginWithEcdsaCapabilityInternal({...t,ed25519YaoRecovery:{kind:`not_requested`}})}},{walletSession:t.walletSession,chainTarget:t.chainTarget,challengeId:t.challengeId,otpCode:t.otpCode,...typeof t.ttlMs==`number`?{ttlMs:t.ttlMs}:{},...typeof t.remainingUses==`number`?{remainingUses:t.remainingUses}:{}}),ed25519YaoRecovery:{kind:`not_requested`}}}async function Mb(e,t){let n=R(t.walletId),r=String(t.relayUrl||e.relayerUrl||``).trim();if(!r)throw Error(`Missing relayer url (configs.network.relayer.url)`);let i=String(t.groupId||e.groupId||``).trim();if(!i)throw Error(`Missing shamir prime for Email OTP runtime`);return await Tb({relayUrl:r,walletId:String(n),userId:String(n),challengeId:t.challengeId,otpCode:t.otpCode,groupId:i,workerCtx:e.getSignerWorkerContext(),otpChannel:t.otpChannel,...t.clientSecret32?{clientSecret32:t.clientSecret32}:{}})}async function Nb(e,t){let n=R(t.walletId),r=String(t.relayUrl||e.relayerUrl||``).trim();if(!r)throw Error(`Missing relayer url (configs.network.relayer.url)`);let i=String(t.groupId||e.groupId||``).trim();if(!i)throw Error(`Missing shamir prime for Email OTP runtime`);let a=String(t.userId).trim();if(!a)throw Error(`Email OTP registration enrollment material requires userId`);return await Eb({relayUrl:r,walletId:String(n),userId:a,groupId:i,workerCtx:e.getSignerWorkerContext(),otpChannel:t.otpChannel,ecdsaSessionHandle:{kind:`not_requested`},...t.clientSecret32?{clientSecret32:t.clientSecret32}:{}})}const Pb={BUILD:{ROOT:`dist`,WORKERS:`dist/workers`,ESM:`dist/esm`,TYPES:`dist/types`},SOURCE:{ROOT:`src`,CORE:`src/core`,STATIC:`src/static`,SIGNING_WORKERS:`src/core/signingEngine/workerManager/workers`,WASM_SIGNER:`../../wasm/near_signer`,ED25519_YAO_CLIENT:`../../crates/router-ab-ed25519-yao-client`,WASM_ECDSA_CLIENT:`../../wasm/router_ab_ecdsa_client`,WASM_EVM_CRYPTO:`../../wasm/evm_crypto`,WASM_TEMPO_SIGNER:`../../wasm/tempo_signer`,WASM_SHAMIR3PASS_RUNTIME:`../../wasm/shamir3pass_runtime`,WASM_EMAIL_OTP_RUNTIME:`../../wasm/email_otp_runtime`,WASM_WALLET_CUSTODY_CEREMONY:`../../wasm/wallet_custody_ceremony`,CRITICAL_DIRS:[`src/core`,`src/react`,`src/static`,`src/utils`,`../wallet-server/src`,`../shared-ts/src`,`../../crates/router-ab-ed25519-yao-client`,`../../wasm/near_signer`,`../../wasm/router_ab_ecdsa_client`,`../../wasm/evm_crypto`,`../../wasm/tempo_signer`,`../../wasm/shamir3pass_runtime`,`../../wasm/email_otp_runtime`,`../../wasm/wallet_custody_ceremony`]},RUNTIME:{SDK_BASE:`/sdk`,WORKERS_BASE:`/sdk/workers`,TOUCH_CONFIRM_WORKER:`/sdk/workers/passkey-confirm.worker.js`,PASSKEY_MPC_SESSION_WORKER:`/sdk/workers/passkey-mpc-session.worker.js`,PASSKEY_MPC_EXPORT_WORKER:`/sdk/workers/passkey-mpc-export.worker.js`,SIGNER_WORKER:`/sdk/workers/near-signer.worker.js`,ECDSA_DERIVATION_CLIENT_WORKER:`/sdk/workers/ecdsa-derivation-client.worker.js`,ECDSA_PRESIGN_CLIENT_WORKER:`/sdk/workers/ecdsa-presign-client.worker.js`,ECDSA_ONLINE_CLIENT_WORKER:`/sdk/workers/ecdsa-online-client.worker.js`,EMAIL_OTP_WORKER:`/sdk/workers/email-otp.worker.js`,WALLET_CUSTODY_CEREMONY_WORKER:`/sdk/workers/wallet-custody-ceremony.worker.js`,DEVICE_LINKING_KEY_WORKER:`/sdk/workers/device-linking-key.worker.js`},WORKERS:{TOUCH_CONFIRM:`passkey-confirm.worker.js`,PASSKEY_MPC_SESSION:`passkey-mpc-session.worker.js`,PASSKEY_MPC_EXPORT:`passkey-mpc-export.worker.js`,SIGNER:`near-signer.worker.js`,ECDSA_DERIVATION_CLIENT:`ecdsa-derivation-client.worker.js`,ECDSA_PRESIGN_CLIENT:`ecdsa-presign-client.worker.js`,ECDSA_ONLINE_CLIENT:`ecdsa-online-client.worker.js`,EMAIL_OTP:`email-otp.worker.js`,WALLET_CUSTODY_CEREMONY:`wallet-custody-ceremony.worker.js`,DEVICE_LINKING_KEY:`device-linking-key.worker.js`,SHAMIR3PASS:`shamir3pass.worker.js`,WASM_SIGNER_JS:`wasm_signer_worker.js`,WASM_SIGNER_WASM:`wasm_signer_worker_bg.wasm`,ED25519_YAO_CLIENT_JS:`router_ab_ed25519_yao_client.js`,ED25519_YAO_CLIENT_WASM:`router_ab_ed25519_yao_client_bg.wasm`,ECDSA_CLIENT_JS:`router_ab_ecdsa_client.js`,ECDSA_CLIENT_WASM:`router_ab_ecdsa_client_bg.wasm`,WASM_EVM_CRYPTO_WASM:`evm_crypto.wasm`,WASM_EVM_CRYPTO_BG_WASM:`evm_crypto_bg.wasm`,WASM_TEMPO_SIGNER_WASM:`tempo_signer.wasm`,WASM_TEMPO_SIGNER_BG_WASM:`tempo_signer_bg.wasm`,EMAIL_OTP_RUNTIME_JS:`email_otp_runtime.js`,EMAIL_OTP_RUNTIME_WASM:`email_otp_runtime_bg.wasm`,WALLET_CUSTODY_CEREMONY_WASM:`wallet_custody_ceremony_bg.wasm`},TEST_WORKERS:{TOUCH_CONFIRM:`/sdk/workers/passkey-confirm.worker.js`,PASSKEY_MPC_SESSION:`/sdk/workers/passkey-mpc-session.worker.js`,PASSKEY_MPC_EXPORT:`/sdk/workers/passkey-mpc-export.worker.js`,SIGNER:`/sdk/workers/near-signer.worker.js`,ECDSA_DERIVATION_CLIENT:`/sdk/workers/ecdsa-derivation-client.worker.js`,ECDSA_PRESIGN_CLIENT:`/sdk/workers/ecdsa-presign-client.worker.js`,ECDSA_ONLINE_CLIENT:`/sdk/workers/ecdsa-online-client.worker.js`,EMAIL_OTP:`/sdk/workers/email-otp.worker.js`,WALLET_CUSTODY_CEREMONY:`/sdk/workers/wallet-custody-ceremony.worker.js`,DEVICE_LINKING_KEY:`/sdk/workers/device-linking-key.worker.js`,SHAMIR3PASS:`/sdk/workers/shamir3pass.worker.js`,WASM_SIGNER_JS:`/sdk/workers/wasm_signer_worker.js`,WASM_SIGNER_WASM:`/sdk/workers/wasm_signer_worker_bg.wasm`,ED25519_YAO_CLIENT_JS:`/sdk/workers/router_ab_ed25519_yao_client.js`,ED25519_YAO_CLIENT_WASM:`/sdk/workers/router_ab_ed25519_yao_client_bg.wasm`,ECDSA_CLIENT_JS:`/sdk/workers/router_ab_ecdsa_client.js`,ECDSA_CLIENT_WASM:`/sdk/workers/router_ab_ecdsa_client_bg.wasm`,WASM_EVM_CRYPTO_WASM:`/sdk/workers/evm_crypto.wasm`,WASM_EVM_CRYPTO_BG_WASM:`/sdk/workers/evm_crypto_bg.wasm`,WASM_TEMPO_SIGNER_WASM:`/sdk/workers/tempo_signer.wasm`,WASM_TEMPO_SIGNER_BG_WASM:`/sdk/workers/tempo_signer_bg.wasm`,EMAIL_OTP_RUNTIME_JS:`/sdk/workers/email_otp_runtime.js`,EMAIL_OTP_RUNTIME_WASM:`/sdk/workers/email_otp_runtime_bg.wasm`,WALLET_CUSTODY_CEREMONY_WASM:`/sdk/workers/wallet_custody_ceremony_bg.wasm`}};function Fb(e){try{return Vl(e)===`emailOtp`}catch{return!1}}function Ib(e,t){let n=e.userPreferencesManager.getConfirmationConfig(),r=t?.confirmationConfig||{},i=Object.fromEntries(Object.entries(r).filter(([,e])=>e!=null)),a={...n,...i};if(t?.type===q.AUTHORIZE_KEY_EXPORT)return Gl({uiMode:`none`,behavior:a.behavior,autoProceedDelay:a.autoProceedDelay});t&&Fb(t)&&(a={...a,uiMode:a.uiMode===`none`?`modal`:a.uiMode,behavior:`requireClick`});let o=window.self!==window.top;if(Cu()){let e=a.uiMode===`none`?`drawer`:a.uiMode;a={...a,uiMode:e,behavior:`requireClick`}}return o&&t?.type&&(t.type===q.REGISTER_ACCOUNT||t.type===q.LINK_DEVICE)?Gl({uiMode:`modal`,behavior:`requireClick`,autoProceedDelay:a.autoProceedDelay}):Gl(a)}const Lb=new Map;function Rb(e){e?.cleanupTimer&&(clearTimeout(e.cleanupTimer),e.cleanupTimer=null)}function zb(e){let t=String(e.requestId||``).trim();if(!t)return;Rb(Lb.get(t));let n=Number.isFinite(e.ttlMs)&&Number(e.ttlMs)>0?Number(e.ttlMs):12e4,r={readiness:e.readiness,cleanupTimer:null};r.cleanupTimer=setTimeout(()=>{Lb.get(t)===r&&Lb.delete(t)},n),Lb.set(t,r)}function Bb(e){let t=String(e||``).trim();if(!t)return;let n=Lb.get(t);return Lb.delete(t),Rb(n),n?.readiness}function Vb(e){let t=String(e||``).trim();t&&(Rb(Lb.get(t)),Lb.delete(t))}const Hb={CONFIRMATION_COMPLETE:`confirmation.complete`,PASSKEY_PROMPT_STARTED:`auth.passkey.prompt.started`,PASSKEY_PROMPT_SUCCEEDED:`auth.passkey.prompt.succeeded`};function Ub(e,t,n){du(e,{requestId:t,step:2,phase:Hb.CONFIRMATION_COMPLETE,status:`failed`,message:n||eu.cancelled})}function Wb(e){return e.type===q.SIGN_TRANSACTION||e.type===q.SIGN_NEP413_MESSAGE?Vl(e)??`webauthn`:`webauthn`}function Gb(e){return!gf(e.signingOperationStateKind)||e.signingAuthMode===`emailOtp`}function Kb(e){if(!e)throw Error(`NEAR transaction signing lifecycle callback is required`);return e}function qb(){}function Jb(){return new Promise(qb)}function Yb(){return Jb()}function Xb(e){let t=wf(e);return t?.kind===`expired`?{kind:`wallet_session_expired`,failure:t}:Jb()}function Zb(e){return e.then(Yb,Xb)}function Qb(e){return`kind`in e&&e.kind===`wallet_session_expired`}function $b(e){return e.request.type===q.SIGN_NEP413_MESSAGE||e.request.type===q.SIGN_TRANSACTION&&e.transactionSummary.type===`delegateAction`?{kind:`signature_only`}:{kind:`transaction_access_key`}}function ex(e){return e.error===`NEAR_ACCOUNT_LOOKUP_FAILED`?e.details||`NEAR account access-key lookup failed.`:e.details?`${eu.nearRpcFailed}: ${e.details}`:eu.nearRpcFailed}function tx(e){if(e.readinessMode.kind!==`transaction_access_key`)return;if(e.request.type!==q.SIGN_TRANSACTION)throw Error(`NEAR transaction readiness requires a transaction confirmation request`);let t=Hl(e.request);if(t.signingKind!==`transaction`)throw Error(`NEAR transaction readiness cannot use a delegate confirmation payload`);let n=t.nearFundingRequest;if(n.signatureUses!==e.usesNeeded)throw Error(`NEAR funding request signature use count does not match confirmation request`);return n}function nx(e){return e?{nearTransactionReadiness:e}:{}}function rx(e){let t=String(e||``).replace(/\D/g,``).slice(0,6);if(!/^\d{6}$/.test(t))throw Error(`Enter the 6-digit Email OTP code to continue`);return t}function ix(e){if(e.signingAuthPlanKind===hf.EmailOtpReauth)throw console.warn(`[SigningEngine][ui-confirm] Email OTP auth plan reached passkey credential lookup`,{stage:e.stage,subjectId:e.subjectId,requestId:e.requestId,signingAuthPlanKind:e.signingAuthPlanKind}),Error(`[SigningEngine] passkey_lookup_for_email_otp`)}function ax(e){throw Error(`Unsupported WebAuthn challenge branch: ${JSON.stringify(e)}`)}function ox(e){e.ctx.operationStepUpPreparation.cancel({requestId:e.requestId,...e.preparation?{handle:e.preparation.handle}:{}})}function sx(e){let t=String(e||``).trim();return!t||t===`AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA`?``:t}function cx(e){let t=sx(e.defaultChallengeB64u);if(!e.webauthnChallenge){if(e.requireTypedChallenge)throw Error(`Missing typed WebAuthn challenge for passkey signing flow`);return t}switch(e.webauthnChallenge.kind){case`intent_digest`:return sx(e.webauthnChallenge.challengeB64u)||t;case`threshold_session_policy`:return String(e.webauthnChallenge.digest32B64u||``).trim();case`ecdsa_role_local_bootstrap`:return String(e.webauthnChallenge.digest32B64u||``).trim()}return ax(e.webauthnChallenge)}async function lx(e,t,n,r){let i=ne(e.surfaceMeasurementBinding),{confirmationConfig:a,transactionSummary:o,theme:s,surface:c}=r,l=tu(e),u=ou({adapters:l,worker:n,request:t,confirmationConfig:a,transactionSummary:o,theme:s,surface:c}),d=lu(t),f,p=String(Bl(t)||``).trim()||void 0;p===`pending-intent-digest`&&(p=void 0);try{let a=Wb(t),s=t.type===q.SIGN_TRANSACTION?Hl(t):null,c=s?.signingKind===`transaction`?s:null,m=c?Kb(r.onSigningOperationInteractionEvent):null,h=c?gf(c.signingOperationStateKind):!1,g=c?Gb({signingOperationStateKind:c.signingOperationStateKind,signingAuthMode:a}):!0,_=Wl(t),v=t.type===q.SIGN_TRANSACTION?Wf(t.requestId):void 0,y=t.type===q.SIGN_TRANSACTION?String(Bl(t)||``).trim()||void 0:t.type===q.SIGN_NEP413_MESSAGE&&String(await pu({nearAccountId:d,recipient:t.payload.recipient,message:t.payload.message})).trim()||void 0;y===`pending-intent-digest`&&(y=void 0);let b=y;p=y;let x=$b({request:t,transactionSummary:o}),S=tx({request:t,usesNeeded:_,readinessMode:x}),C=S?l.near.fetchNearContext(S):void 0,w=l.security.getRpId(),T=w?{rpId:w}:void 0,E,ee=new Promise(e=>{E=e}),D=!1,O=!1,k=Bb(t.requestId),A=!!k,j=k?Promise.resolve(k.promise):void 0,te=j?Zb(j):void 0,M=()=>{E?.(),E=void 0};a===`emailOtp`&&m?.({kind:xf.AuthenticationStarted});let ne=g?u.promptUser({securityContext:T,loading:!1,onMounted:()=>{M(),A&&u.updateUI({preparing:!0})}}):Promise.resolve({confirmed:!0});g?ne.finally(M):M();let re,ie=e=>{let t=String(e.intentDigest||``).trim(),n=String(e.challengeB64u||``).trim();t&&(y=t,p=t),n&&(b=n)},ae=e=>{ie(e),u.updateUI({...e.displayModel?{model:e.displayModel}:{},...e.title?{title:e.title}:{},...e.body?{body:e.body}:{},loading:!1})},oe=v?(async()=>(await ee,await v))():void 0;oe&&oe.then(e=>{D||ae(e)}).catch(e=>{D||u.updateUI({loading:!1,errorMessage:String(N(e)?.message||e||`Failed to prepare intent`)})}),j&&j.then(async()=>{A=!1,await ee,!D&&u.updateUI({preparing:!1})}).catch(async e=>{if(A=!1,await ee,D)return;if(O){u.updateUI({preparing:!1});return}let t=String(N(e)?.message||`NEAR signing session could not be finalized`);u.updateUI({preparing:!1,errorMessage:`NEAR signing session could not be finalized: ${t}`})}),C&&C.then(async e=>{if(re=e,await ee,e.kind===`failed`){if(O=!0,D)return;u.updateUI({loading:!1,errorMessage:ex(e)});return}if(O=!1,e.readiness.kind===`funding_required`){if(D)return;u.updateUI({loading:!1,body:nu(String(e.readiness.request.subject.nearAccountId)),errorMessage:``,confirmText:`Fund account`});return}u.setNonceLeases(e.reservedNonceLeases);let t=e.readiness.transactionContext,n=w?{rpId:w,blockHeight:t.txBlockHeight,blockHash:t.txBlockHash}:void 0;D||u.updateUI({securityContext:n,loading:!1})});let se=te?await Promise.race([ne,te]):await ne;if(D=!0,Qb(se))return ox({ctx:e,requestId:t.requestId,preparation:f}),u.confirmAndCloseModal({requestId:t.requestId,intentDigest:p,confirmed:!1,walletSessionFailure:se.failure});let{confirmed:ce,error:le,otpCode:ue,emailOtpChallengeId:P}=se;if(!ce)return Ub(n,t.requestId,le),ox({ctx:e,requestId:t.requestId,preparation:f}),u.confirmAndCloseModal({requestId:t.requestId,intentDigest:p,confirmed:!1,error:le});m&&!h&&(m({kind:xf.ReviewApproved}),u.dismissReviewSurface());let F=C?re||await C:void 0,de;if(C){if(!F||F.kind===`failed`){let n=F||{kind:`failed`,error:`NEAR_CONTEXT_UNAVAILABLE`,details:`NEAR transaction readiness did not resolve`};return console.error(`[SigningFlow] fetchNearContext failed`,n),ox({ctx:e,requestId:t.requestId,preparation:f}),u.confirmAndCloseModal({requestId:t.requestId,intentDigest:p,confirmed:!1,error:ex(n)})}de=F.readiness,F.readiness.kind===`context_ready`&&u.setNonceLeases(F.reservedNonceLeases)}if(oe&&ie(await oe),j)try{await j}catch(n){let r=String(N(n)?.message||`NEAR signing session could not be finalized`);return ox({ctx:e,requestId:t.requestId,preparation:f}),u.confirmAndCloseModal({requestId:t.requestId,intentDigest:p,confirmed:!1,error:`NEAR signing session could not be finalized: ${r}`})}if(a!==`warmSession`&&de?.kind===`funding_required`&&S){u.updateUI({body:au(String(de.request.subject.nearAccountId)),errorMessage:``,loading:!0});let n;try{n=await e.nearImplicitAccountFunding.fund({requestId:t.requestId,request:de.request})}catch(n){return ox({ctx:e,requestId:t.requestId,preparation:f}),u.confirmAndCloseModal({requestId:t.requestId,intentDigest:p,confirmed:!1,error:`NEAR account funding failed: ${String(N(n)?.message||n)}`})}de=n.readiness,u.setNonceLeases(n.reservedNonceLeases)}if(a!==`warmSession`&&de?.kind===`context_ready`){let n=tx({request:t,usesNeeded:_,readinessMode:x});if(!n)throw Error(`Operation step-up requires exact NEAR operation facts`);f=await e.operationStepUpPreparation.prepare({kind:`near_transaction`,requestId:t.requestId,transactionContext:de.transactionContext,operationId:n.operation.operationId,operationFingerprint:n.operation.operationFingerprint,displayDigest:String(p||``).trim()})}else a!==`warmSession`&&x.kind===`signature_only`&&(f=await e.operationStepUpPreparation.prepare({kind:`near_signature_only`,requestId:t.requestId,displayDigest:String(p||``).trim()}));if(a===`emailOtp`){m?.({kind:xf.AuthenticationCompleted}),u.confirmAndCloseModal({requestId:t.requestId,intentDigest:p,confirmed:!0,otpCode:rx(ue),...P?{emailOtpChallengeId:P}:{},...f?{operationStepUpPreparation:f}:{},...nx(de)});return}if(a===`warmSession`){u.confirmAndCloseModal({requestId:t.requestId,intentDigest:p,confirmed:!0,...nx(de)});return}ix({stage:`transaction_prompt`,subjectId:d,requestId:t.requestId,signingAuthPlanKind:t.payload.signingAuthPlan.kind});let I=f?.challengeB64u||cx({webauthnChallenge:t.payload.webauthnChallenge,defaultChallengeB64u:String(b||``).trim(),requireTypedChallenge:t.payload.signingAuthPlan.kind===hf.PasskeyReauth&&!!t.payload.webauthnChallenge});if(!I)throw Error(`Missing WebAuthn challenge digest for signing flow`);m?.({kind:xf.AuthenticationStarted});let fe=await ru({credentialStore:e.webauthnCredentialStore,touchIdPrompt:e.touchIdPrompt,onBeforePrompt:i?.beforeCredential,cancellation:i?{kind:`abort_signal`,signal:i.abortController.signal}:{kind:`none`},walletId:t.payload.walletId,challengeB64u:I});i?.afterCredential(),m?.({kind:xf.AuthenticationCompleted}),u.confirmAndCloseModal({requestId:t.requestId,intentDigest:p,confirmed:!0,credential:fe,...f?{operationStepUpPreparation:f}:{},...nx(de)})}catch(n){ox({ctx:e,requestId:t.requestId,preparation:f});let r=Zl(n),i=String(N(n)?.message||n||``);r&&window.parent?.postMessage({type:`WALLET_UI_CLOSED`},`*`);let a=/multiple passkeys \\(devicenumbers\\) for account/i.test(i);return u.confirmAndCloseModal({requestId:t.requestId,intentDigest:p,confirmed:!1,error:r?eu.cancelled:a?i:i||eu.collectCredentialsFailed})}}function ux(e){return Vl(e)??`webauthn`}async function dx(e,t,n,r){let i=ne(e.surfaceMeasurementBinding),{confirmationConfig:a,transactionSummary:o,theme:s,surface:c}=r,l=tu(e),u=ou({adapters:l,worker:n,request:t,confirmationConfig:a,transactionSummary:o,theme:s,surface:c}),d=ql(t),f=d.kind===`near_wallet`?d.nearAccountId:d.walletId,p=d.kind===`near_wallet`?d.nearAccountId:``,m=Wf(t.requestId);try{let r=ux(t),o=String(Bl(t)||``).trim()||void 0,s=String(t.payload.challengeB64u||``).trim(),c=a.kind===`interactive`,h=l.security.getRpId(),g=h?{rpId:h}:void 0;c&&du(n,{requestId:t.requestId,step:2,phase:`intent-confirmation-required`,status:`running`,message:`Awaiting confirmation click`});let _,v=new Promise(e=>{_=e}),y=()=>{_?.(),_=void 0},b=u.promptUser({securityContext:g,loading:!1,onMounted:()=>{y()}});b.finally(y);let x=!1,S=!1,C=e=>{o=String(e.intentDigest||``).trim()||o,s=String(e.challengeB64u||``).trim()||s,u.updateUI({...e.displayModel?{model:e.displayModel}:{},...e.title?{title:e.title}:{},...e.body?{body:e.body}:{},loading:!1}),S=!0},w=m?(async()=>(await v,await m))():void 0;w&&w.then(e=>{x||S||C(e)}).catch(e=>{x||u.updateUI({loading:!1,errorMessage:String(N(e)?.message||e||`Failed to prepare intent`)})});let{confirmed:T,error:E,otpCode:ee,emailOtpChallengeId:D}=await b;if(x=!0,!T)return c&&Ub(n,t.requestId,E),u.confirmAndCloseModal({requestId:t.requestId,intentDigest:o,confirmed:!1,error:E});if(w){let e=await w;S||C(e)}if(r===`emailOtp`)return c&&du(n,{requestId:t.requestId,step:2,phase:Hb.CONFIRMATION_COMPLETE,status:`succeeded`,message:`Email OTP submitted`}),u.confirmAndCloseModal({requestId:t.requestId,intentDigest:o,confirmed:!0,otpCode:rx(ee),...D?{emailOtpChallengeId:D}:{}});if(r===`warmSession`)return c&&du(n,{requestId:t.requestId,step:2,phase:Hb.CONFIRMATION_COMPLETE,status:`succeeded`,message:`Confirmation complete`}),u.confirmAndCloseModal({requestId:t.requestId,intentDigest:o,confirmed:!0});ix({stage:`intent_digest_prompt`,subjectId:f,requestId:t.requestId,signingAuthPlanKind:t.payload.signingAuthPlan.kind});let O=cx({webauthnChallenge:t.payload.webauthnChallenge,defaultChallengeB64u:String(s||``).trim(),requireTypedChallenge:t.payload.signingAuthPlan.kind===hf.PasskeyReauth});if(!O)throw Error(`Missing WebAuthn challenge digest for intent signing flow`);du(n,{requestId:t.requestId,step:3,phase:Hb.PASSKEY_PROMPT_STARTED,status:`running`,message:`Authenticating with passkey...`});let k=d.kind===`near_wallet`?await su({credentialStore:e.webauthnCredentialStore,touchIdPrompt:e.touchIdPrompt,onBeforePrompt:i?.beforeCredential,cancellation:i?{kind:`abort_signal`,signal:i.abortController.signal}:{kind:`none`},nearAccountId:p,challengeB64u:O}):await ru({credentialStore:e.webauthnCredentialStore,touchIdPrompt:e.touchIdPrompt,onBeforePrompt:i?.beforeCredential,cancellation:i?{kind:`abort_signal`,signal:i.abortController.signal}:{kind:`none`},walletId:d.walletId,challengeB64u:O});return i?.afterCredential(),du(n,{requestId:t.requestId,step:4,phase:Hb.PASSKEY_PROMPT_SUCCEEDED,status:`succeeded`,message:`Authentication complete`}),u.confirmAndCloseModal({requestId:t.requestId,intentDigest:o,confirmed:!0,credential:k})}catch(e){Uf(t.requestId),du(n,{requestId:t.requestId,step:4,phase:Hb.PASSKEY_PROMPT_SUCCEEDED,status:`failed`,message:String(N(e)?.message||e||eu.collectCredentialsFailed)});let r=Zl(e),i=String(N(e)?.message||e||``);return r&&window.parent?.postMessage({type:`WALLET_UI_CLOSED`},`*`),u.confirmAndCloseModal({requestId:t.requestId,intentDigest:String(Bl(t)||``).trim()||void 0,confirmed:!1,error:r?eu.cancelled:i||eu.collectCredentialsFailed})}}async function fx(e,t,n,r){let i=Ql(n,{channelToken:t.channelToken,onDecision:r?.onDecision}),a=t.data,o,s,c;try{Kl(a),uu(a),o=Ib(e,a),c=jn(e.getTheme?.())??`dark`;let t=Bl(a);s=cu({...a.summary,...t?{intentDigest:t}:{}})}catch(e){console.error(`[UserConfirm][Host] validateAndParseRequest failed`,e),Yl(i,{requestId:a.requestId,confirmed:!1,error:P(e)||`Invalid secure confirm request`});return}try{let t={confirmationConfig:o,transactionSummary:s,theme:c,surface:r?.signingSurface??{kind:`mount_new`}};switch(a.type){case q.AUTHORIZE_KEY_EXPORT:case q.SHOW_SECURE_PRIVATE_KEY_UI:{let{handleLocalOnlyFlow:n}=await import(`./localOnly-DBQRG6Qh.js`);await n(e,a,i,t);break}case q.REGISTER_ACCOUNT:case q.LINK_DEVICE:{let{handleRegistrationFlow:n}=await import(`./registration-Btozh7uh.js`).then(e=>e.n);await n(e,a,i,t);break}case q.SIGN_TRANSACTION:case q.SIGN_NEP413_MESSAGE:await lx(e,a,i,{...t,...r?.onSigningOperationInteractionEvent?{onSigningOperationInteractionEvent:r.onSigningOperationInteractionEvent}:{}});break;case q.SIGN_INTENT_DIGEST:await dx(e,a,i,t);break;default:px(a)}}catch(e){console.error(`[UserConfirm][Host] handler failed`,e),Yl(i,{requestId:a.requestId,intentDigest:Bl(a),confirmed:!1,error:P(e)||`Secure confirmation failed`})}}function px(e){throw Error(`Unsupported secure confirmation request`)}function mx(e){let t={signingKind:`transaction`,walletId:e.params.walletId,txSigningRequests:e.txSigningRequests,intentDigest:e.intentDigest,displayModel:e.displayModel,rpcCall:e.params.rpcCall,nearPublicKeyStr:e.params.nearPublicKeyStr,nearFundingRequest:e.params.nearFundingRequest,signingOperationStateKind:e.params.signingOperationStateKind};switch(e.params.signingAuthPlan.kind){case hf.WarmSession:return{...t,signingAuthPlan:e.params.signingAuthPlan};case hf.ActiveWalletAuthority:return{...t,signingAuthPlan:e.params.signingAuthPlan};case hf.PasskeyReauth:return{...t,signingAuthPlan:e.params.signingAuthPlan,...e.params.webauthnChallenge?{webauthnChallenge:e.params.webauthnChallenge}:{}};case hf.EmailOtpReauth:if(!e.params.emailOtpPrompt)throw Error(`Email OTP NEAR confirmation requires a prompt`);return{...t,signingAuthPlan:e.params.signingAuthPlan,emailOtpPrompt:e.params.emailOtpPrompt};default:return hx(e.params.signingAuthPlan)}}function hx(e){throw Error(`Unsupported transaction signing auth params: ${String(e)}`)}function gx(e){let t={signingKind:`delegate`,walletId:e.params.walletId,txSigningRequests:e.txSigningRequests,intentDigest:e.intentDigest,displayModel:e.displayModel,rpcCall:e.params.rpcCall,...e.params.nearPublicKeyStr?{nearPublicKeyStr:e.params.nearPublicKeyStr}:{}};switch(e.params.signingAuthPlan.kind){case hf.WarmSession:return{...t,signingAuthPlan:e.params.signingAuthPlan};case hf.ActiveWalletAuthority:return{...t,signingAuthPlan:e.params.signingAuthPlan};case hf.PasskeyReauth:return{...t,signingAuthPlan:e.params.signingAuthPlan,...e.params.webauthnChallenge?{webauthnChallenge:e.params.webauthnChallenge}:{}};case hf.EmailOtpReauth:{let n=e.params.signingAuthPlan.emailOtpPrompt;if(!n)throw Error(`Email OTP delegate confirmation requires a prompt`);return{...t,signingAuthPlan:e.params.signingAuthPlan,emailOtpPrompt:n}}default:return hx(e.params.signingAuthPlan)}}function _x(e){let t=String(e||``).trim();return!t||t===`pending-intent-digest`?``:t}function vx(e){return String(e||``).trim()||Hf}function yx(e){if(!e)throw Error(`[SigningConfirmation] passkey intent signing requires webauthnChallenge`);return e}function bx(e){return e.signingAuthPlan.kind===hf.PasskeyReauth?{signingSubject:e.signingSubject,challengeB64u:e.challengeB64u,...e.displayModel?{displayModel:e.displayModel}:{},webauthnChallenge:yx(e.webauthnChallenge),signingAuthPlan:e.signingAuthPlan}:{signingSubject:e.signingSubject,challengeB64u:e.challengeB64u,...e.displayModel?{displayModel:e.displayModel}:{},signingAuthPlan:e.signingAuthPlan,...e.webauthnChallenge?{webauthnChallenge:e.webauthnChallenge}:{},...e.emailOtpPrompt?{emailOtpPrompt:e.emailOtpPrompt}:{}}}function xx(e){try{return Al({txSigningRequests:e.txSigningRequests,intentDigest:e.intentDigest||``,signerAccount:e.signerAccountId,title:e.title,subtitle:e.body})}catch{return{chain:`near`,...e.intentDigest?{intentDigest:e.intentDigest}:{},signerAccount:e.signerAccountId,...e.title==null?{}:{title:e.title},...e.body==null?{}:{subtitle:e.body},operations:[]}}}async function Sx(e){let{sessionId:t}=e,n=Cx(e.ctx),r,i;switch(e.kind){case`transaction`:{let n=e.txSigningRequests,a=n.map(e=>({receiverId:e.receiverId,actions:e.actions.map(fu)})),o={receiverId:n[0]?.receiverId,totalAmount:wx(n),type:`transaction`,...e.title==null?{}:{title:e.title},...e.body==null?{}:{body:e.body}};r=await mu(a);let s={...o,intentDigest:r},c=xx({txSigningRequests:n,intentDigest:r,signerAccountId:e.rpcCall.nearAccountId,title:s.title,body:s.body});i={requestId:t,type:q.SIGN_TRANSACTION,summary:s,payload:mx({params:e,txSigningRequests:n,intentDigest:r,displayModel:c}),confirmationConfig:e.confirmationConfigOverride,intentDigest:r};break}case`delegate`:{let n=[{receiverId:e.delegate.receiverId,actions:e.delegate.actions}];r=await mu(n.map(e=>({receiverId:e.receiverId,actions:e.actions.map(fu)})));let a={intentDigest:r,receiverId:n[0]?.receiverId,totalAmount:wx(n),type:`delegateAction`,...e.title==null?{}:{title:e.title},...e.body==null?{}:{body:e.body},delegate:{senderId:e.delegate.senderId,receiverId:e.delegate.receiverId,nonce:String(e.delegate.nonce),maxBlockHeight:String(e.delegate.maxBlockHeight)}},o=xx({txSigningRequests:n,intentDigest:r,signerAccountId:e.nearAccountId,title:a.title,body:a.body});i={requestId:t,type:q.SIGN_TRANSACTION,summary:a,payload:gx({params:e,txSigningRequests:n,intentDigest:r,displayModel:o}),confirmationConfig:e.confirmationConfigOverride,intentDigest:r};break}case`nep413`:{r=`${e.nearAccountId}:${e.recipient}:${e.message}`;let n=kl({signerAccount:e.nearAccountId,recipient:e.recipient,message:e.message,intentDigest:r,title:e.title,subtitle:e.body}),a={intentDigest:r,method:`NEP-413`,receiverId:e.recipient,...e.title==null?{}:{title:e.title},...e.body==null?{}:{body:e.body}};i={requestId:t,type:q.SIGN_NEP413_MESSAGE,summary:a,payload:{walletId:e.walletId,nearAccountId:e.nearAccountId,...e.nearPublicKeyStr?{nearPublicKeyStr:e.nearPublicKeyStr}:{},message:e.message,recipient:e.recipient,displayModel:n,...e.webauthnChallenge?{webauthnChallenge:e.webauthnChallenge}:{},signingAuthPlan:e.signingAuthPlan,...e.emailOtpPrompt?{emailOtpPrompt:e.emailOtpPrompt}:{}},confirmationConfig:e.confirmationConfigOverride,intentDigest:r};break}case`intentDigest`:{let n=_x(e.intentDigest);r=n;let a=vx(e.challengeB64u),o=e.signingSubject,s=e.displayModel,c={...n?{intentDigest:n}:{},...e.title==null?{}:{title:e.title},...e.body==null?{}:{body:e.body}};i={requestId:t,type:q.SIGN_INTENT_DIGEST,summary:c,payload:bx({signingSubject:o,challengeB64u:a,displayModel:s,webauthnChallenge:e.webauthnChallenge,signingAuthPlan:e.signingAuthPlan,...e.emailOtpPrompt?{emailOtpPrompt:e.emailOtpPrompt}:{}}),confirmationConfig:e.confirmationConfigOverride,...n?{intentDigest:n}:{}};break}default:throw Error(`Unsupported signing confirmation kind`)}e.confirmationReadiness&&zb({requestId:t,readiness:e.confirmationReadiness});let a=await n(i,{onProgress:e.onProgress,...e.kind===`transaction`?{onSigningOperationInteractionEvent:e.onSigningOperationInteractionEvent}:{}}).finally(()=>{Vb(t)});if(!a?.confirmed)throw a?.walletSessionFailure?new Sf({failure:a.walletSessionFailure,message:`Wallet Session expired while signing confirmation was open`}):Error(a?.error||`User rejected signing request`);if(e.kind===`intentDigest`)return{sessionId:t,intentDigest:a.intentDigest||r,credential:a.credential,otpCode:a.otpCode,emailOtpChallengeId:a.emailOtpChallengeId};if(e.kind===`delegate`||e.kind===`nep413`)return{sessionId:t,intentDigest:a.intentDigest||r,credential:a.credential,operationStepUpPreparation:a.operationStepUpPreparation,otpCode:a.otpCode,emailOtpChallengeId:a.emailOtpChallengeId};if(!a.nearTransactionReadiness)throw Error(`Missing explicit NEAR transaction readiness from confirmation flow`);return{sessionId:t,readiness:a.nearTransactionReadiness,intentDigest:a.intentDigest||r,credential:a.credential,operationStepUpPreparation:a.operationStepUpPreparation,otpCode:a.otpCode,emailOtpChallengeId:a.emailOtpChallengeId}}function Cx(e){return e.touchConfirm.requestUserConfirmation.bind(e.touchConfirm)}function wx(e){try{let t=BigInt(0);for(let n of e)for(let e of n.actions)switch(e.action_type){case Cl.Transfer:t+=BigInt(e.deposit||`0`);break;case Cl.FunctionCall:t+=BigInt(e.deposit||`0`);break;case Cl.Stake:t+=BigInt(e.stake||`0`);break;default:break}return t>BigInt(0)?t.toString():void 0}catch{return}}async function Tx({ctx:e,surface:t,walletId:n,nearAccountId:r,signerSlot:i,confirmerText:a,confirmationConfig:o,challengeB64u:s,registrationOptions:c}){let l=Ex({walletId:n,nearAccountId:r,signerSlot:i,confirmerText:a,confirmationConfig:o,challengeB64u:s,registrationOptions:c});uu(l);let u=await Ox({ctx:e,surface:t,request:l,confirmationConfig:Ib(e,l),transactionSummary:Dx(l),theme:jn(e.getTheme?.())??`dark`});return Ax({requestId:l.requestId,decision:u})}function Ex({walletId:e,nearAccountId:t,signerSlot:n,confirmerText:r,confirmationConfig:i,challengeB64u:a,registrationOptions:o}){let s=pe(`register`,32,`registration credential confirmation IDs`),c=r?.title,l=r?.body,u=String(e||``).trim(),d=String(t||``).trim();if(!u)throw Error(`Registration credential confirmation requires walletId`);return o?{requestId:s,type:q.REGISTER_ACCOUNT,summary:{walletId:u,signerSlot:n,...c==null?{}:{title:c},...l==null?{}:{body:l}},payload:{walletId:u,walletAddAuthMethodRegistration:o},confirmationConfig:i,intentDigest:`register:${u}:${o.challengeId}`}:{requestId:s,type:q.REGISTER_ACCOUNT,summary:{walletId:u,...d?{nearAccountId:d}:{},signerSlot:n,...c==null?{}:{title:c},...l==null?{}:{body:l}},payload:{walletId:u,...d?{nearAccountId:d}:{},signerSlot:n,...a?{webauthnChallenge:{kind:`intent_digest`,challengeB64u:a}}:{}},confirmationConfig:i,intentDigest:`register:${u}:${n}`}}function Dx(e){let t=Jl(e.summary),n=Bl(e);return{...t,...n?{intentDigest:n}:{}}}async function Ox({ctx:e,surface:t,request:n,confirmationConfig:r,transactionSummary:i,theme:a}){let o,s,c=!1,l=new Promise((e,t)=>{o=e,s=t}),u=Qf(e,n,{postMessage:e=>{let t=kx(e,n.requestId);if(t.ok){o(t.value);return}s(Error(t.message))}},{confirmationConfig:r,transactionSummary:i,theme:a,surface:t}).then(()=>{c||s(Error(`Registration confirmation completed without a decision`))},e=>{s(Error(P(e)||`Registration confirmation failed`))}),d=await l;return c=!0,await u,d}function kx(e,t){if(!j(e))return{ok:!1,message:`Registration confirmation returned a malformed response`};let n=e;if(n.type!==Ul.USER_PASSKEY_CONFIRM_RESPONSE)return{ok:!1,message:`Registration confirmation returned an unexpected response type`};if((A(n.requestId)?n.requestId.trim():``)!==t)return{ok:!1,message:`Registration confirmation response requestId mismatch`};if(!j(n.data))return{ok:!1,message:`Registration confirmation returned missing decision data`};let r=n.data,i=A(r.requestId)?r.requestId.trim():``;return i===t?ee(r.confirmed)?{ok:!0,value:{requestId:i,confirmed:r.confirmed,...A(r.intentDigest)?{intentDigest:r.intentDigest}:{},...r.credential?{credential:r.credential}:{},...r.transactionContext?{transactionContext:r.transactionContext}:{},...r.registrationDiagnostics?{registrationDiagnostics:r.registrationDiagnostics}:{},...A(r.error)?{error:r.error}:{}}}:{ok:!1,message:`Registration confirmation returned invalid decision state`}:{ok:!1,message:`Registration confirmation decision requestId mismatch`}}function Ax({requestId:e,decision:t}){if(!t.confirmed)throw Error(t.error||`User rejected registration request`);if(!t.credential)throw Error(`Missing credential from registration confirmation`);return Pl({confirmed:t.confirmed,requestId:e,intentDigest:t.intentDigest||``,credential:t.credential,transactionContext:t.transactionContext,registrationDiagnostics:t.registrationDiagnostics,error:t.error})}function jx(e){return Math.max(0,Math.round(performance.now()-e))}function Mx(e){throw Error(`Unexpected UI confirmation state: ${String(e)}`)}function Nx(e){return typeof e==`object`&&!!e}function Px(e){if(!Nx(e)||e.type!==Ul.PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD)return null;let t=typeof e.requestId==`string`?e.requestId.trim():``,n=typeof e.channelToken==`string`?e.channelToken.trim():``;if(!t||!n||!Nx(e.data)||e.data.kind!==`pending_request`||`request`in e.data)return null;let r=typeof e.data.requestId==`string`?e.data.requestId.trim():``,i=typeof e.data.requestToken==`string`?e.data.requestToken.trim():``;return!r||r!==t||!i?null:{type:Ul.PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD,requestId:t,channelToken:n,data:{kind:`pending_request`,requestId:t,requestToken:i}}}function Fx(e){if(!Nx(e))return null;let t=typeof e.requestId==`string`?e.requestId.trim():``,n=typeof e.step==`number`?e.step:NaN,r=typeof e.phase==`string`?e.phase:``,i=e.status;return!t||!Number.isFinite(n)||!r||i!==`running`&&i!==`succeeded`&&i!==`failed`?null:{requestId:t,step:n,phase:r,status:i,...typeof e.message==`string`?{message:e.message}:{},...`data`in e?{data:e.data}:{}}}var Ix=class{constructor(e,t){this.worker=null,this.initializationPromise=null,this.messageId=0,this.pendingWorkerRequests=new Map,this.userConfirmProgressListeners=new Map,this.pendingConfirmRequests=new Map,this.boundHandleWorkerMessage=this.handleWorkerMessage.bind(this),this.boundHandleWorkerError=this.handleWorkerError.bind(this),this.registrationPreparationModalState={kind:`closed`,generation:0},this.transactionPreparationModalState={kind:`closed`,generation:0},this.config={workerUrl:Pb.RUNTIME.TOUCH_CONFIRM_WORKER,workerTimeout:6e4,debug:!1,...e},this.context={...t}}getContext(){return this.context}async requestUserConfirmation(e,t){let n=typeof e?.requestId==`string`?e.requestId.trim():``;if(!n)throw Error(`Invalid secure confirmation request: missing requestId`);if(this.pendingConfirmRequests.has(n))throw Error(`Duplicate secure confirmation request id: ${n}`);let r=this.generateMessageId();this.pendingConfirmRequests.set(n,{kind:`awaiting_decision`,context:{...this.context},request:e,requestToken:r,...t?.onSigningOperationInteractionEvent?{onSigningOperationInteractionEvent:t.onSigningOperationInteractionEvent}:{}});try{let e=performance.now();await this.ensureWorkerReady(!1);let i=jx(e);t?.onProgress&&this.userConfirmProgressListeners.set(n,t.onProgress);let a=performance.now(),o=await this.sendMessage({type:`SECURE_CONFIRM_REQUEST`,id:r,payload:{requestId:n}}),s=jx(a),c=performance.now();if(!o?.success)throw Error(String(o?.error||`Secure confirmation request failed`));let l=this.pendingConfirmRequests.get(n);if(!l||l.kind!==`decided`)throw Error(`Secure confirmation failed: missing host decision`);let u=l.decision,d=jx(c);return u.registrationDiagnostics?.kind===`registration_confirmation_diagnostics_v1`?{...u,registrationDiagnostics:{...u.registrationDiagnostics,workerReadyMs:i,workerRequestRoundTripMs:s,workerResponseValidationMs:d}}:u}finally{this.userConfirmProgressListeners.delete(n),this.pendingConfirmRequests.delete(n)}}async orchestrateSigningConfirmation(e){return Sx(e)}async openTransactionPreparationModal(e){if(!String(e.walletLabel||``).trim())throw Error(`Transaction preparation modal requires a wallet label`);this.closeTransactionPreparationModal();let t=this.context.userPreferencesManager.getConfirmationConfig(),n=Object.fromEntries(Object.entries(e.confirmationConfigOverride||{}).filter(([,e])=>e!=null)),r=Gl({...t,...n});if(r.kind===`silent`)return;let i=String(this.context.touchIdPrompt.getRpId()||``).trim(),a=this.transactionPreparationModalState.generation+1;this.transactionPreparationModalState={kind:`opening`,generation:a};let o=await iu({ctx:this.getContext(),summary:{title:`Review transaction`},...e.chain===`near`?{txSigningRequests:e.txSigningRequests}:{},model:e.model,securityContext:i?{rpId:i}:void 0,loading:!1,theme:this.context.getTheme?.()??`dark`,uiMode:r.uiMode}),s=this.transactionPreparationModalState;if(s.kind!==`opening`||s.generation!==a){o.close(!1);return}this.transactionPreparationModalState={kind:`open`,generation:a,handle:o},o.onCancel?.(this.handleTransactionPreparationCancel.bind(this,a,o))}handleTransactionPreparationCancel(e,t){let n=this.transactionPreparationModalState;n.kind!==`open`||n.generation!==e||n.handle!==t||(this.transactionPreparationModalState={kind:`cancelled`,generation:e},t.close(!1))}closeTransactionPreparationModal(){let e=this.transactionPreparationModalState;this.transactionPreparationModalState={kind:`closed`,generation:e.generation},e.kind===`open`&&e.handle.close(!1)}takeTransactionConfirmationSurface(){let e=this.transactionPreparationModalState;switch(e.kind){case`closed`:return{kind:`mount_new`};case`opening`:throw Error(`Transaction confirmation started before its preparation modal opened`);case`cancelled`:return this.transactionPreparationModalState={kind:`closed`,generation:e.generation},{kind:`preparation_cancelled`};case`open`:return this.transactionPreparationModalState={kind:`closed`,generation:e.generation},{kind:`reuse_mounted`,handle:e.handle};default:return Mx(e)}}async requestRegistrationCredentialConfirmation(e){let t=this.takeRegistrationConfirmationSurface();try{return await Tx({ctx:this.getContext(),surface:t,walletId:e.walletId,nearAccountId:e.nearAccountId,signerSlot:e.signerSlot,confirmerText:e.confirmerText,confirmationConfig:e.confirmationConfigOverride,challengeB64u:e.challengeB64u,registrationOptions:e.registrationOptions})}catch(e){throw t.kind===`reuse_mounted`&&t.handle.close(!1),e}}takeRegistrationConfirmationSurface(){let e=this.registrationPreparationModalState;switch(e.kind){case`closed`:return{kind:`mount_new`};case`opening`:throw Error(`Registration confirmation started before its preparation modal opened`);case`open`:return this.registrationPreparationModalState={kind:`closed`,generation:e.generation},{kind:`reuse_mounted`,handle:e.handle};default:return Mx(e)}}async openRegistrationPreparationModal(e){let t=String(e.walletLabel||``).trim();if(!t)throw Error(`Registration preparation modal requires a wallet label`);if(!Number.isInteger(e.signerSlot)||e.signerSlot<1)throw Error(`Registration preparation modal requires a positive signer slot`);let n=String(this.context.touchIdPrompt.getRpId()||``).trim();if(!n)throw Error(`Registration preparation modal requires an RP ID`);this.closeRegistrationPreparationModal();let r=this.registrationPreparationModalState.generation+1;this.registrationPreparationModalState={kind:`opening`,generation:r};let i=await iu({ctx:this.getContext(),summary:{title:`Create your passkey`,body:`Preparing secure registration…`},securityContext:{rpId:n,passkeyRegistration:{kind:`passkey_registration_confirm_display_v1`,intendedUserName:t,accountId:t,rpId:n,signerSlot:e.signerSlot}},loading:!0,theme:this.context.getTheme?.()??`dark`,uiMode:`modal`}),a=this.registrationPreparationModalState;if(a.kind!==`opening`||a.generation!==r){i.close(!1);return}this.registrationPreparationModalState={kind:`open`,generation:r,handle:i}}closeRegistrationPreparationModal(){let e=this.registrationPreparationModalState;this.registrationPreparationModalState={kind:`closed`,generation:e.generation},e.kind===`open`&&e.handle.close(!1)}setWorkerBaseOrigin(e){this.workerBaseOrigin=e}async ensureWorkerReady(e=!1){if(this.initializationPromise?await this.initializationPromise:this.worker||await this.initialize(),!this.worker)throw Error(`UserConfirm worker failed to initialize`);if(e)try{if(!(await this.sendMessage({type:`PING`,id:this.generateMessageId()},3e3)).success)throw Error(`UserConfirm worker failed health check`)}catch(e){throw console.error(`[UserConfirmWorker] health check failed:`,e),Error(`UserConfirm worker failed health check`)}}async initialize(){if(this.initializationPromise)return this.initializationPromise;if(!this.worker)return this.initializationPromise=this.createUserConfirmWorker().catch(e=>{throw console.error(`[UserConfirmWorker] initialization failed:`,e),console.error(`[UserConfirmWorker] error details:`,{message:e.message,stack:e.stack,name:e.name}),this.initializationPromise=null,e}),await this.initializationPromise}async createUserConfirmWorker(){try{if(this.worker){let e=this.worker;this.detachWorkerRouter(e),e.terminate(),this.worker=null,this.rejectPendingWorkerRequestsForWorker(e,Error(`UserConfirm worker was restarted`))}let e=ip(this.config.workerUrl||Pb.RUNTIME.TOUCH_CONFIRM_WORKER,{worker:`touchConfirm`,baseOrigin:this.workerBaseOrigin});this.config.debug&&console.debug(`[UserConfirmWorker] Worker URL:`,e);let t=new Worker(e,{type:`module`,name:`Web3AuthnSecureConfirmWorker`});this.attachWorkerRouter(t),this.worker=t,await this.testWebWorkerCommunication()}catch(e){let t=e instanceof Error?e.message:String(e);throw Error(`UserConfirm worker initialization failed: ${t}`)}}attachWorkerRouter(e){e.addEventListener(`message`,this.boundHandleWorkerMessage),e.addEventListener(`error`,this.boundHandleWorkerError)}detachWorkerRouter(e){e.removeEventListener(`message`,this.boundHandleWorkerMessage),e.removeEventListener(`error`,this.boundHandleWorkerError)}isFromActiveWorker(e){return e.currentTarget===this.worker&&e.target===this.worker}normalizePromptEnvelope(e){let t=Px(e);if(!t)return null;let n=this.pendingConfirmRequests.get(t.requestId);return!n||n.kind!==`awaiting_decision`||n.requestToken!==t.data.requestToken?null:{type:t.type,requestId:t.requestId,channelToken:t.channelToken,data:n.request}}capturePendingConfirmationDecision(e,t){let n=e.request.requestId.trim();if(!n||t.requestId.trim()!==n)return;let r=this.pendingConfirmRequests.get(n);r!==e||r.kind!==`awaiting_decision`||this.pendingConfirmRequests.set(n,{kind:`decided`,request:r.request,requestToken:r.requestToken,decision:t})}postPromptEnvelopeError(e,t,n,r){e.postMessage({type:Ul.USER_PASSKEY_CONFIRM_RESPONSE,requestId:t,channelToken:n,data:{requestId:t,confirmed:!1,error:r}})}dispatchUserConfirmProgress(e){let t=Fx(e.data),n=typeof e.requestId==`string`&&e.requestId.trim()?e.requestId.trim():typeof t?.requestId==`string`?t.requestId.trim():``;if(!n||!t)return;let r=this.userConfirmProgressListeners.get(n);if(r)try{r(t)}catch(e){console.error(`[UserConfirmWorker] progress listener failed:`,e)}}handleWorkerMessage(e){if(!this.isFromActiveWorker(e))return;let t=e.data;if(Nx(t)&&t.type===Ul.USER_PASSKEY_CONFIRM_PROGRESS){this.dispatchUserConfirmProgress(t);return}let n=this.normalizePromptEnvelope(t);if(n){let t=this.pendingConfirmRequests.get(n.requestId);if(!t||t.kind!==`awaiting_decision`)return;let r=t.context,i=e.currentTarget;fx(r,n,i,{signingSurface:n.data.type===q.SIGN_TRANSACTION||n.data.type===q.SIGN_NEP413_MESSAGE||n.data.type===q.SIGN_INTENT_DIGEST?this.takeTransactionConfirmationSurface():{kind:`mount_new`},onDecision:this.capturePendingConfirmationDecision.bind(this,t),...t.onSigningOperationInteractionEvent?{onSigningOperationInteractionEvent:t.onSigningOperationInteractionEvent}:{}}).catch(e=>{console.error(`[UserConfirmWorker] failed to handle confirmation prompt:`,e),this.postPromptEnvelopeError(i,n.requestId,n.channelToken,`Secure confirmation failed`)});return}if(Nx(t)&&t.type===Ul.PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD){console.error(`[UserConfirmWorker] rejected malformed prompt envelope`);return}let r=sp(t);if(!r)return;let i=r.id||``;if(!i)return;let a=e.currentTarget;this.resolvePendingWorkerRequest(a,i,r)}handleWorkerError(e){if(!this.isFromActiveWorker(e))return;let t=e,n=String(t?.message||`UserConfirm worker encountered an unknown error`),r=Error(`UserConfirm worker failed: ${n}`);console.error(`[UserConfirmWorker] error:`,t);let i=e.currentTarget;i===this.worker&&this.worker&&(this.detachWorkerRouter(this.worker),this.worker.terminate(),this.worker=null,this.initializationPromise=null),this.rejectPendingWorkerRequestsForWorker(i,r)}resolvePendingWorkerRequest(e,t,n){let r=this.pendingWorkerRequests.get(t);!r||r.worker!==e||(clearTimeout(r.timeoutId),r.settle?.(),this.pendingWorkerRequests.delete(t),r.resolve(n))}rejectPendingWorkerRequest(e,t){let n=this.pendingWorkerRequests.get(e);n&&(clearTimeout(n.timeoutId),n.settle?.(),this.pendingWorkerRequests.delete(e),n.reject(t))}rejectPendingWorkerRequestsForWorker(e,t){for(let n of this.pendingWorkerRequests.values())n.worker===e&&(this.pendingWorkerRequests.delete(n.id),clearTimeout(n.timeoutId),n.settle?.(),n.reject(t))}async sendMessage(e,t,n){return new Promise((r,i)=>{let a=this.worker;if(!a){i(Error(`UserConfirm worker not available`));return}let o=()=>Error(`UserConfirm worker request aborted for message type: ${e.type}`);if(n?.aborted){i(o());return}let s=typeof e.id==`string`&&e.id.trim().length?e.id.trim():this.generateMessageId();if(this.pendingWorkerRequests.has(s)){i(Error(`Duplicate UserConfirm worker request id: ${s}`));return}let c=t??this.config.workerTimeout??6e4,l=setTimeout(()=>{this.rejectPendingWorkerRequest(s,Error(`UserConfirm worker communication timeout (${c}ms) for message type: ${e.type}`))},c),u;if(n){let e=()=>{this.rejectPendingWorkerRequest(s,o())};n.addEventListener(`abort`,e,{once:!0}),u=()=>{n.removeEventListener(`abort`,e)}}this.pendingWorkerRequests.set(s,{id:s,messageType:e.type,worker:a,timeoutId:l,settle:u,resolve:r,reject:i});try{a.postMessage({...e,id:s})}catch(e){let t=e instanceof Error?e:Error(String(e));this.rejectPendingWorkerRequest(s,t)}})}generateMessageId(){return`sc_${Date.now()}_${++this.messageId}`}async testWebWorkerCommunication(){try{let e=await this.sendMessage({type:`PING`,id:this.generateMessageId()},15e3);if(!e.success)throw Error(`UserConfirm worker PING failed: ${e.error}`);return}catch(e){let t=e instanceof Error?e.message:String(e);throw console.warn(`[UserConfirmWorker] testWebWorkerCommunication failed:`,t),this.worker&&=(this.detachWorkerRouter(this.worker),this.worker.terminate(),null),e}}};function Lx(e,t){return new Ix(e,t)}function Rx(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`Invalid export confirmation: ${t} must be an object`);return e}function zx(e,t){if(typeof e!=`string`)throw Error(`Invalid export confirmation: ${t} must be a string`);return e}function Bx(e,t){let n=zx(e,t);if(!n.trim()||n!==n.trim())throw Error(`Invalid export confirmation: ${t} must be a nonempty identity`);return n}function Vx(e,t){return e===void 0?void 0:zx(e,t)}function Hx(e,t){if(e===void 0||typeof e==`boolean`)return e;throw Error(`Invalid export confirmation: ${t} must be a boolean`)}function Ux(e){let t=Rx(e,`subject`);switch(t.kind){case`near_wallet`:if(t.walletId!==void 0)throw Error(`Invalid NEAR export subject`);return{kind:`near_wallet`,nearAccountId:Bx(t.nearAccountId,`nearAccountId`)};case`evm_wallet`:if(t.nearAccountId!==void 0)throw Error(`Invalid EVM export subject`);return{kind:`evm_wallet`,walletId:Bx(t.walletId,`walletId`)};default:throw Error(`Invalid export confirmation: unsupported subject`)}}function Wx(e){let t=Rx(e,`summary`),n=t.operation;if(n!==`Export Private Key`&&n!==`Export Recovery Key`)throw Error(`Invalid export confirmation: unsupported operation`);return{operation:n,accountId:Bx(t.accountId,`summary.accountId`),publicKey:zx(t.publicKey,`summary.publicKey`),warning:zx(t.warning,`summary.warning`)}}function Gx(e){let t=Rx(e,`key`),n=t.scheme;if(n!==`ed25519`&&n!==`secp256k1`)throw Error(`Invalid export confirmation: unsupported key scheme`);return{scheme:n,label:zx(t.label,`key.label`),publicKey:zx(t.publicKey,`key.publicKey`),privateKey:zx(t.privateKey,`key.privateKey`),address:Vx(t.address,`key.address`)}}function Kx(e){if(e!==void 0){if(!Array.isArray(e))throw Error(`Invalid export confirmation: keys must be an array`);return e.map(Gx)}}function qx(e){return zx(e,`guidance step`)}function Jx(e){if(e===void 0)return;let t=Rx(e,`guidance`);if(t.steps!==void 0&&!Array.isArray(t.steps))throw Error(`Invalid export confirmation: guidance steps must be an array`);return{title:zx(t.title,`guidance.title`),body:Vx(t.body,`guidance.body`),steps:t.steps?.map(qx)}}function Yx(e){if(e===void 0)return;let{uiMode:t,behavior:n,autoProceedDelay:r}=Rx(e,`confirmationConfig`);if(t!==void 0&&t!==`none`&&t!==`modal`&&t!==`drawer`)throw Error(`Invalid export confirmation: unsupported UI mode`);if(n!==void 0&&n!==`skipClick`&&n!==`requireClick`)throw Error(`Invalid export confirmation: unsupported behavior`);if(r!==void 0&&(typeof r!=`number`||!Number.isFinite(r)))throw Error(`Invalid export confirmation: invalid autoProceedDelay`);return{uiMode:t,behavior:n,autoProceedDelay:r}}function Xx(e){let t=Rx(e,`request`),n=Rx(t.payload,`payload`);if(n.prfOutput!==void 0||n.prf_output!==void 0||n.wrapKeySeed!==void 0||n.wrapKeySalt!==void 0||n.prfKey!==void 0)throw Error(`Invalid export confirmation: forbidden signing secret`);let r=Bx(t.requestId,`requestId`),i=Wx(t.summary),a=Ux(n.subject),o=zx(n.publicKey,`publicKey`),s=Vx(t.intentDigest,`intentDigest`),c=Yx(t.confirmationConfig);if(n.onLifecycle!==void 0)throw Error(`Invalid export confirmation: callbacks belong to the host`);switch(t.type){case q.AUTHORIZE_KEY_EXPORT:return{type:q.AUTHORIZE_KEY_EXPORT,requestId:r,summary:i,intentDigest:s,confirmationConfig:c,payload:{subject:a,publicKey:o,credentialIdB64u:Bx(n.credentialIdB64u,`credentialIdB64u`),challengeB64u:Vx(n.challengeB64u,`challengeB64u`)}};case q.SHOW_SECURE_PRIVATE_KEY_UI:{let{variant:e,theme:t}=n;if(e!==void 0&&e!==`drawer`&&e!==`modal`)throw Error(`Invalid export confirmation: unsupported variant`);if(t!==void 0&&t!==`dark`&&t!==`light`)throw Error(`Invalid export confirmation: unsupported theme`);return{type:q.SHOW_SECURE_PRIVATE_KEY_UI,requestId:r,summary:i,intentDigest:s,confirmationConfig:c,payload:{subject:a,publicKey:o,viewerSessionId:Vx(n.viewerSessionId,`viewerSessionId`),privateKey:Vx(n.privateKey,`privateKey`),keys:Kx(n.keys),guidance:Jx(n.guidance),variant:e,theme:t,loading:Hx(n.loading,`loading`),errorMessage:Vx(n.errorMessage,`errorMessage`)}}}default:throw Error(`Invalid export confirmation: unsupported request type`)}}const Zx=6e4;function Qx(e){return typeof e==`object`&&!!e}function $x(e){if(!Qx(e))return null;let t=e.kind;if(typeof e.accountId!=`string`)return null;let n=Array.isArray(e.exportedSchemes)?e.exportedSchemes:null;if(!n)return null;let r=n.filter(e=>e===`ed25519`||e===`secp256k1`);return r.length===n.length?t===`completed`?`error`in e?null:{kind:t,accountId:e.accountId,exportedSchemes:r}:t!==`cancelled`&&t!==`failed`||r.length!==0||typeof e.error!=`string`?null:{kind:t,accountId:e.accountId,exportedSchemes:[],error:e.error}:null}var eS=class{constructor(e){this.context=e,this.worker=null,this.initializationPromise=null,this.messageId=0,this.pendingRequests=new Map,this.viewerLifecycleBySessionId=new Map,this.boundHandleWorkerMessage=this.handleWorkerMessage.bind(this),this.boundHandleWorkerError=this.handleWorkerError.bind(this)}setWorkerBaseOrigin(e){this.workerBaseOrigin=e}async exportPrivateKeysWithUi(e,t){await this.ensureWorkerReady();let n=`viewerSessionId`in e?String(e.viewerSessionId||``).trim():``;n&&t?.onViewerLifecycle&&this.viewerLifecycleBySessionId.set(n,t.onViewerLifecycle);try{let t=await this.sendMessage({type:`EXPORT_PRIVATE_KEYS_WITH_UI`,id:this.generateMessageId(),payload:e});if(!t.success)throw Error(String(t.error||`Export private keys request failed`));let n=$x(t.data);if(!n)throw Error(`Export private keys request failed: invalid worker response payload`);return n}finally{n&&this.viewerLifecycleBySessionId.delete(n)}}async ensureWorkerReady(){if(!this.worker&&(this.initializationPromise||=this.createWorker().catch(e=>{throw this.initializationPromise=null,e}),await this.initializationPromise,!this.worker))throw Error(`Passkey MPC export worker failed to initialize`)}async createWorker(){let e=ip(Pb.RUNTIME.PASSKEY_MPC_EXPORT_WORKER,{worker:`passkeyMpcExport`,baseOrigin:this.workerBaseOrigin}),t=new Worker(e,{type:`module`,name:`PasskeyMpcExportWorker`});t.addEventListener(`message`,this.boundHandleWorkerMessage),t.addEventListener(`error`,this.boundHandleWorkerError),this.worker=t}normalizePromptEnvelope(e){if(!Qx(e)||e.type!==Ul.PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD||!Qx(e.data)||e.data.kind!==`export_request`)return null;let t;try{t=Xx(e.data.request)}catch{return null}let n=typeof e.requestId==`string`?e.requestId.trim():``,r=typeof t.requestId==`string`?t.requestId.trim():``,i=typeof e.channelToken==`string`?e.channelToken.trim():``;return!n||n!==r||!i?null:{type:Ul.PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD,requestId:n,channelToken:i,data:this.restoreViewerLifecycle(t)}}restoreViewerLifecycle(e){if(e.type!==q.SHOW_SECURE_PRIVATE_KEY_UI)return e;let t=e.payload.viewerSessionId;if(!t)return e;let n=this.viewerLifecycleBySessionId.get(t);return n?{type:e.type,requestId:e.requestId,summary:e.summary,intentDigest:e.intentDigest,confirmationConfig:e.confirmationConfig,payload:{...e.payload,onLifecycle:n}}:e}postPromptEnvelopeError(e,t,n){e.postMessage({type:Ul.USER_PASSKEY_CONFIRM_RESPONSE,requestId:t,channelToken:n,data:{requestId:t,confirmed:!1,error:`Secure confirmation failed`}})}handleWorkerMessage(e){if(e.currentTarget!==this.worker||e.target!==this.worker)return;let t=this.normalizePromptEnvelope(e.data);if(t){let n=e.currentTarget;fx(this.context,t,n).catch(e=>{console.error(`[PasskeyMpcExportWorker] failed to handle export prompt:`,e),this.postPromptEnvelopeError(n,t.requestId,t.channelToken||``)});return}if(Qx(e.data)&&e.data.type===Ul.PROMPT_USER_CONFIRM_IN_JS_MAIN_THREAD){console.error(`[PasskeyMpcExportWorker] rejected malformed prompt envelope`);return}let n=sp(e.data);if(!n)return;let r=n.id||``;if(!r)return;let i=this.pendingRequests.get(r);i&&(clearTimeout(i.timeoutId),this.pendingRequests.delete(r),i.resolve(n))}handleWorkerError(e){if(e.currentTarget!==this.worker||e.target!==this.worker)return;let t=e,n=Error(`Passkey MPC export worker failed: ${String(t.message||`unknown worker error`)}`),r=this.worker;r&&(r.removeEventListener(`message`,this.boundHandleWorkerMessage),r.removeEventListener(`error`,this.boundHandleWorkerError),r.terminate()),this.worker=null,this.initializationPromise=null;for(let e of this.pendingRequests.values())clearTimeout(e.timeoutId),e.reject(n);this.pendingRequests.clear()}sendMessage(e){return new Promise((t,n)=>{let r=this.worker;if(!r){n(Error(`Passkey MPC export worker not available`));return}let i=typeof e.id==`string`&&e.id.trim()?e.id.trim():this.generateMessageId();if(this.pendingRequests.has(i)){n(Error(`Duplicate Passkey MPC export request id: ${i}`));return}let a=setTimeout(()=>{let e=this.pendingRequests.get(i);e&&(this.pendingRequests.delete(i),e.reject(Error(`Passkey MPC export request timed out (${Zx}ms)`)))},Zx);this.pendingRequests.set(i,{id:i,timeoutId:a,resolve:t,reject:n});try{r.postMessage({...e,id:i})}catch(e){clearTimeout(a),this.pendingRequests.delete(i),n(e instanceof Error?e:Error(String(e)))}})}generateMessageId(){return`mpc_export_${Date.now()}_${++this.messageId}`}};function tS(e){return new eS(e)}function nS(e){if(e.purpose.curve===`ecdsa`)return e.purpose.thresholdSessionId;if(e.thresholdSessionId===void 0)throw Error(`Ed25519 warm material operation requires its protocol session id`);return e.thresholdSessionId}function rS(e){return e.curve===`ecdsa`?{thresholdSessionId:e.thresholdSessionId,chainTarget:e.chainTarget}:null}function iS(e){let t=k(e);if(!t)return null;if(t.kind===`all`)return{kind:`all`};if(t.kind!==`session`)return null;let r=n(t.thresholdSessionId);return r.ok?{kind:`session`,thresholdSessionId:r.value}:null}function aS(e){let t=k(e);if(!t||t.kind!==`clear_volatile_warm_material`||t.durableRecord!=null||t.resolvedIdentity!=null||t.deleteReason!=null)return null;let n=iS(t.scope);return n?{kind:`clear_volatile_warm_material`,scope:n}:null}function oS(e){return{kind:`clear_volatile_warm_material`,scope:{kind:`session`,thresholdSessionId:e}}}function sS(){return{kind:`clear_volatile_warm_material`,scope:{kind:`all`}}}function Z(e){return String(e??``).trim()||null}function cS(e){return Array.isArray(e)?e.map(e=>Math.floor(Number(e))).filter(e=>Number.isFinite(e)&&e>0):[]}function lS(e){try{return er(e)}catch{return null}}function uS(e){try{return fr(e)}catch{return null}}function dS(e){switch(e){case`login`:case`registration`:case`manual-bootstrap`:case`email_otp`:return e;default:return null}}function fS(e){let t=dS(e);return t&&t!==`email_otp`?t:null}function pS(e){return e&&typeof e==`object`?e:null}function mS(e){return pS(e.thresholdSessionIds)||{}}function hS(e){let t=String(e||``).trim().toLowerCase();return/^0x[0-9a-f]{40}$/.test(t)?t:null}function gS(e){try{return cr(e)}catch{return null}}function _S(e){let t=Z(e.rawSigningRootId),n=Z(e.rawSigningRootVersion),r=null,i=null;if(e.runtimePolicyScope)try{let t=vn(e.runtimePolicyScope);r=Z(t.signingRootId),i=Z(t.signingRootVersion)}catch{}if(t&&r&&t!==r||n&&i&&n!==i)return null;let a=t||r,o=n||i;return a&&o?{signingRootId:a,signingRootVersion:o}:null}function vS(e){return!!(Z(e.signingRootId)||Z(e.signingRootVersion))}function yS(e){return!!(Z(e.subjectId)||Z(e.userId))}function bS(e){let t=mS(e);return{authMethod:e.authMethod,curve:e.curve,storeKey:e.storeKey,walletId:e.walletId||null,thresholdSessionIds:t,issuedAtMs:e.issuedAtMs,expiresAtMs:e.expiresAtMs,remainingUses:e.remainingUses,updatedAtMs:e.updatedAtMs,hasEcdsaRestore:!!e.ecdsaRestore}}function xS(e,t){return{kind:`rejected`,rejection:{kind:`rejected_sealed_recovery_record`,storeKey:Z(e.storeKey),walletId:Z(e.walletId),reason:t,safeSummary:bS(e)}}}function SS(e,t={}){let n=mS(e),r=pS(e.ecdsaRestore),i=Z(e.storeKey),a=Z(e.walletId),o=Z(e.sealedSecretB64u),s=Math.floor(Number(e.issuedAtMs)||0),c=Math.floor(Number(e.expiresAtMs)||0),l=Math.floor(Number(e.remainingUses)||0),u=Math.floor(Number(e.updatedAtMs)||0);if(e.authMethod!==`passkey`&&e.authMethod!==`email_otp`||e.curve!==`ecdsa`)return xS(e,`unsupported_record`);if(!i||!a||!o)return xS(e,`missing_identity`);if(c<=0||u<=0||s<=0)return xS(e,`missing_restore_metadata`);if(yS(e))return xS(e,`invalid_identity`);if(!t.allowExpired&&c<=Date.now())return xS(e,`expired`);if(!t.allowExhausted&&e.authMethod!==`passkey`&&l<=0)return xS(e,`exhausted`);let d=Z(n.ecdsa),f=r,p=An(f?.runtimePolicyScope),m=_S({runtimePolicyScope:p,rawSigningRootId:f?.signingRootId,rawSigningRootVersion:f?.signingRootVersion}),h=Z(e.relayerUrl),g=e.authMethod===`passkey`?Z(f?.rpId):null,_=e.authMethod===`passkey`?fS(f?.source):null,v=e.authMethod===`email_otp`&&dS(f?.source)===`email_otp`?`email_otp`:null,y=Z(f?.credentialIdB64u),b=Z(f?.providerSubjectId),x=Z(f?.emailHashHex),S=Z(f?.relayerKeyId),C=Z(f?.keyHandle),w=Z(f?.ecdsaThresholdKeyId),T=hS(f?.ethereumAddress),E=Z(f?.thresholdEcdsaPublicKeyB64u),ee=cS(f?.participantIds),D=lS(f?.routerAbEcdsaDerivationNormalSigning),O=uS(f?.publicCapability),k=null;try{k=Go(f?.roleLocalMaterialRef)}catch{k=null}let A=Z(f?.clientVerifyingShareB64u),j=e.authMethod===`passkey`?A:null;if(f?.sessionKind!=null||vS(e))return xS(e,`invalid_identity`);if(!d||!m)return xS(e,`missing_identity`);if(!f?.chainTarget)return xS(e,`wrong_chain_target`);let te;try{te=Rr(f.chainTarget)}catch{return xS(e,`wrong_chain_target`)}if(!h||e.authMethod===`passkey`&&!_||e.authMethod===`email_otp`&&!v||e.authMethod===`passkey`&&!g||e.authMethod===`passkey`&&!y||e.authMethod===`email_otp`&&(!b||!x)||!w||!S||!C||!T||!E||!p||!D||!O||!ee.length||!k||e.authMethod===`passkey`&&!j)return xS(e,`missing_restore_metadata`);let M=e.authMethod===`passkey`?gS({walletId:a,rpId:g,credentialIdB64u:y}):null,ne=or(f.authority),re=zn(f.emailOtpAuthority),ie=e.authMethod===`email_otp`&&ne&&re&&re.walletId===a&&re.factor.provider===f.provider&&re.factor.providerUserId===b&&re.verifier.emailHashHex===x?re:null;return e.authMethod===`passkey`&&!M||e.authMethod===`email_otp`&&!ie?xS(e,`invalid_identity`):{kind:`accepted`,record:e.authMethod===`passkey`?{storeKey:i,walletId:a,authMethod:`passkey`,curve:`ecdsa`,thresholdSessionId:d,sealedSecretB64u:o,issuedAtMs:s,expiresAtMs:c,remainingUses:l,updatedAtMs:u,...Z(e.keyVersion)?{keyVersion:Z(e.keyVersion)}:{},...Z(e.groupId)?{groupId:Z(e.groupId)}:{},chainTarget:te,source:_,authority:M,signingRootId:m.signingRootId,signingRootVersion:m.signingRootVersion,keyHandle:C,ecdsaThresholdKeyId:w,ethereumAddress:T,thresholdEcdsaPublicKeyB64u:E,participantIds:ee,relayerUrl:h,relayerKeyId:S,runtimePolicyScope:p,routerAbEcdsaDerivationNormalSigning:D,publicCapability:O,clientVerifyingShareB64u:j,roleLocalMaterialRef:k}:{storeKey:i,walletId:a,authMethod:`email_otp`,curve:`ecdsa`,thresholdSessionId:d,sealedSecretB64u:o,issuedAtMs:s,expiresAtMs:c,remainingUses:l,updatedAtMs:u,...Z(e.keyVersion)?{keyVersion:Z(e.keyVersion)}:{},...Z(e.groupId)?{groupId:Z(e.groupId)}:{},chainTarget:te,source:`email_otp`,authority:ne,emailOtpAuthority:ie,signingRootId:m.signingRootId,signingRootVersion:m.signingRootVersion,keyHandle:C,ecdsaThresholdKeyId:w,ethereumAddress:T,thresholdEcdsaPublicKeyB64u:E,participantIds:ee,relayerUrl:h,relayerKeyId:S,runtimePolicyScope:p,routerAbEcdsaDerivationNormalSigning:D,publicCapability:O,...A?{clientVerifyingShareB64u:A}:{},roleLocalMaterialRef:k}}}function CS(e,t){return String(e??``).trim()===String(t??``).trim()}function wS(e,t){return String(e??``).trim().toLowerCase()===String(t??``).trim().toLowerCase()}function TS(e,t){return e.length===t.length?e.every((e,n)=>Number(e)===Number(t[n])):!1}function ES(e,t){let n=[],r=t.signer;return CS(e.walletId,r.walletId)||n.push(`wallet_id`),Vr(e.chainTarget,r.chainTarget)||n.push(`chain_target`),CS(e.keyHandle,r.keyHandle)||n.push(`key_handle`),CS(e.ecdsaThresholdKeyId,r.key.ecdsaThresholdKeyId)||n.push(`ecdsa_threshold_key_id`),CS(e.signingRootId,r.key.signingRootId)||n.push(`signing_root_id`),CS(e.signingRootVersion,r.key.signingRootVersion)||n.push(`signing_root_version`),wS(e.ethereumAddress,r.key.thresholdOwnerAddress)||n.push(`threshold_owner_address`),TS(e.participantIds,r.key.participantIds)||n.push(`participant_ids`),e.authMethod!==t.auth.kind&&n.push(`auth_method`),e.authMethod===`passkey`?t.auth.kind===`passkey`?(CS(e.authority.verifier.rpId,t.auth.rpId)||n.push(`rp_id`),CS(e.authority.factor.credentialIdB64u,t.auth.credentialIdB64u)||n.push(`credential_id`),n):(n.push(`passkey_auth_branch`),n):t.auth.kind===`email_otp`?(CS(e.emailOtpAuthority.factor.providerUserId,t.auth.providerSubjectId)||n.push(`provider_subject_id`),n):(n.push(`email_otp_auth_branch`),n)}function DS(e){console.warn(`[SigningSessionRestore] ECDSA restore identity mismatch`,JSON.stringify({reasons:e.reasons,record:{authMethod:e.record.authMethod,walletId:e.record.walletId,source:e.record.source,chainTarget:z(e.record.chainTarget),keyHandle:e.record.keyHandle,ecdsaThresholdKeyId:e.record.ecdsaThresholdKeyId,signingRootId:e.record.signingRootId,signingRootVersion:e.record.signingRootVersion,ethereumAddress:e.record.ethereumAddress,participantIds:e.record.participantIds},lane:{authMethod:e.lane.auth.kind,walletId:e.lane.signer.walletId,chainTarget:z(e.lane.signer.chainTarget),keyHandle:e.lane.signer.keyHandle,ecdsaThresholdKeyId:e.lane.signer.key.ecdsaThresholdKeyId,signingRootId:e.lane.signer.key.signingRootId,signingRootVersion:e.lane.signer.key.signingRootVersion,thresholdOwnerAddress:e.lane.signer.key.thresholdOwnerAddress,participantIds:e.lane.signer.key.participantIds}},null,2))}function OS(e,t){if(t.authMethod!==e.authMethod||!Vr(t.chainTarget,e.chainTarget)||t.thresholdSessionId!==e.thresholdSessionId)return null;let n=e.materialRestoreIdentity.lane,r=ES(t,n);return r.length>0?(DS({record:t,lane:n,reasons:r}),null):!CS(t.ecdsaThresholdKeyId,e.materialRestoreIdentity.ecdsaThresholdKeyId)||!CS(t.walletId,n.signer.walletId)||!CS(t.keyHandle,n.signer.keyHandle)||!b(t.roleLocalMaterialRef.materialActivation,n.signer.materialActivation)?null:{record:t,purpose:{walletId:e.walletId,authMethod:e.authMethod,curve:`ecdsa`,chainTarget:e.chainTarget,materialActivation:t.roleLocalMaterialRef.materialActivation,thresholdSessionId:t.thresholdSessionId,reason:e.reason}}}function kS(e,t){let n=SS(t,{allowExpired:!1,allowExhausted:!1});if(n.kind===`rejected`)return{kind:`rejected`,rejection:n.rejection};let r=OS(e,n.record);return r?{kind:`matched`,workItem:r}:{kind:`not_applicable`}}function AS(e){return Vr(e.record.chainTarget,e.requestedChainTarget)?[{record:e.record,purpose:{walletId:e.walletId,authMethod:e.record.authMethod,curve:`ecdsa`,chainTarget:e.requestedChainTarget,materialActivation:e.record.roleLocalMaterialRef.materialActivation,thresholdSessionId:e.record.thresholdSessionId,reason:e.reason}}]:[]}function jS(e){let t=SS(e.record);if(t.kind===`rejected`)return[{kind:`rejected`,rejection:t.rejection}];let n=AS({walletId:e.walletId,record:t.record,reason:e.reason,requestedChainTarget:e.requestedChainTarget});return n.length?n.map(e=>({kind:`matched`,workItem:e})):[{kind:`not_applicable`}]}function MS(e){return e.kind===`matched`}function NS(e,t){let n=z(e.chainTarget),r=`materialRestoreIdentity`in e?e.materialRestoreIdentity.lane.signer.materialActivation:e.materialActivation;return[e.walletId,e.authMethod,e.curve,n,e.reason,Lf(r),e.thresholdSessionId,t.thresholdSessionId,t.updatedAtMs,`restored`].join(`|`)}function PS(e,t){let n=z(e.chainTarget);return[e.walletId,e.authMethod,e.curve,n,Lf(e.materialActivation),e.thresholdSessionId,t.updatedAtMs].join(`|`)}function FS(e){return{kind:`completed`,attempted:e.attempted,restored:e.restored,deferred:e.deferred}}function IS(e){return e.map(({record:e,purpose:t})=>({authMethod:t.authMethod,curve:t.curve,chain:z(t.chainTarget),thresholdSessionId:t.thresholdSessionId,recordThresholdSessionId:e.thresholdSessionId,updatedAtMs:e.updatedAtMs}))}function LS(){let e=new Set;return{hasSuccessfulRestore:(t,n)=>e.has(NS(t,n)),rememberSuccessfulRestore:(t,n)=>{e.add(NS(t,n))},clear:()=>{e.clear()}}}function RS(){let e=new Set,t=new Map;return{hasCompleted:t=>e.has(String(t||``).trim()),rememberCompleted:t=>{let n=String(t||``).trim();n&&e.add(n)},getInFlight:e=>{let n=String(e||``).trim();return n?t.get(n):void 0},setInFlight:(e,n)=>{let r=String(e||``).trim();r&&t.set(r,n)},clearInFlight:e=>{let n=String(e||``).trim();n&&t.delete(n)},clear:()=>{e.clear(),t.clear()}}}async function zS(e,t){let n=String(e.walletId||``).trim();if(!n)return FS({attempted:0,restored:0,deferred:0});let r={...e,walletId:n},i;try{i=await t.listExactSealedSessionsForWallet({walletId:n,authMethod:r.authMethod,curve:`ecdsa`,chainTarget:r.chainTarget})}catch(e){return t.onListError?.({walletId:n,target:z(r.chainTarget),reason:r.reason,error:e}),FS({attempted:0,restored:0,deferred:0})}let a=i.map(e=>kS(r,e));for(let e of a)e.kind===`rejected`&&t.onRejectedRecord?.({walletId:n,rejection:e.rejection});let o=a.filter(MS).map(e=>e.workItem);if(!o.length)return FS({attempted:0,restored:0,deferred:0});if(o.length>1)return{kind:`duplicate_records`,attempted:0,restored:0,deferred:0,duplicateCount:o.length,duplicateRecordSummaries:IS(o)};let s=0,c=0,l=0;return await Promise.all(o.map(async({record:e,purpose:i})=>{if(t.cache?.hasSuccessfulRestore(r,e))return;s+=1;let a=await t.restoreSealedRecordForWallet({walletId:n,record:e,purpose:i});a===`restored`&&(c+=1,t.cache?.rememberSuccessfulRestore(r,e)),a===`ready`&&t.cache?.rememberSuccessfulRestore(r,e),a===`deferred`&&(l+=1)})),FS({attempted:s,restored:c,deferred:l})}async function BS(e,t){let n=String(e.walletId||``).trim(),r=Math.max(0,Math.floor(e.maxRecords??10)),i={listed:0,discovered:0,truncated:0};if(!n||r<=0)return i;let a;try{a=(await Promise.all(e.ecdsaChainTargets.map(r=>t.listExactSealedSessionsForWallet({walletId:n,authMethod:e.authMethod,curve:`ecdsa`,chainTarget:r})))).flat()}catch(e){return t.onListError?.({walletId:n,error:e}),i}let o=new Set,s=a.flatMap(t=>e.ecdsaChainTargets.flatMap(e=>jS({walletId:n,record:t,reason:`session_status`,requestedChainTarget:e}))).filter(e=>e.kind===`rejected`?(t.onRejectedRecord?.({walletId:n,rejection:e.rejection}),!1):!0).filter(MS).map(e=>e.workItem).filter(e=>{let t=PS(e.purpose,e.record);return o.has(t)?!1:(o.add(t),!0)}),c=s.slice(0,r);return{listed:a.length,discovered:c.length,truncated:Math.max(0,s.length-c.length)}}function VS(e){if(e.ok)return!1;switch(e.code){case`expired`:case`exhausted`:return!1;case`not_found`:case`invalid_args`:case`invalid_response`:return!0;default:return!1}}async function HS(e){let t=await e.resolveCurrentEcdsaCapabilityRuntime({walletId:R(e.record.walletId),chainTarget:e.record.chainTarget});return t.kind===`resolved`&&b(t.runtime.materialActivation,e.record.roleLocalMaterialRef.materialActivation)?{kind:`current`}:{kind:`superseded`,status:{ok:!1,code:`superseded`,message:`Passkey ECDSA sealed recovery was superseded (${t.kind===`blocked`?t.reason:`material_activation_mismatch`})`}}}async function US(e){if(!Vr(e.record.chainTarget,e.purpose.chainTarget))return null;let t=String(e.purpose.thresholdSessionId||``).trim();if(!t||!e.groupId)return null;let n=await HS({record:e.record,resolveCurrentEcdsaCapabilityRuntime:e.resolveCurrentEcdsaCapabilityRuntime});if(n.kind===`superseded`)return n.status;let r=await e.rehydrateWarmSessionMaterial({thresholdSessionId:t,sealedSecretB64u:e.record.sealedSecretB64u,signingSessionSealKeyVersion:qo(e.record.keyVersion),expiresAtMs:e.record.expiresAtMs,remainingUses:e.record.remainingUses,transport:{...e.transport,groupId:e.groupId}});if(!r.ok){let t=await HS({record:e.record,resolveCurrentEcdsaCapabilityRuntime:e.resolveCurrentEcdsaCapabilityRuntime});return t.kind===`superseded`?t.status:(VS(r)&&await e.deletePersistedRecord().catch(()=>void 0),await e.recordSessionMaterialRestored(r),r)}let i=await e.readWarmSessionStatusFromWorker(t);if(!i)return{ok:!1,code:`worker_error`,message:`Warm-session status read failed after rehydrate`};let a=await HS({record:e.record,resolveCurrentEcdsaCapabilityRuntime:e.resolveCurrentEcdsaCapabilityRuntime});return a.kind===`superseded`?a.status:(i.ok?await e.updatePersistedPolicy({expiresAtMs:i.expiresAtMs,remainingUses:i.remainingUses,updatedAtMs:Date.now()}).catch(()=>void 0):VS(i)&&await e.deletePersistedRecord().catch(()=>void 0),await e.recordSessionMaterialRestored(i),i)}const WS=new Map;function GS(e){return Math.max(0,Math.round(performance.now()-e))}function KS(e){e.diagnostics?.recordDuration(e.bucket,GS(e.startedAt))}function qS(e){!e.diagnostics||!e.resultDiagnostics||(e.diagnostics.recordDuration(`sealed_record_apply_runtime_setup`,e.resultDiagnostics.runtimeSetupMs),e.diagnostics.recordDuration(`sealed_record_apply_client_seal`,e.resultDiagnostics.clientSealMs),e.diagnostics.recordDuration(`sealed_record_apply_server_route`,e.resultDiagnostics.serverSealRouteMs),e.diagnostics.recordDuration(`sealed_record_apply_client_unseal`,e.resultDiagnostics.clientUnsealMs),e.diagnostics.recordDuration(`sealed_record_apply_policy_update`,e.resultDiagnostics.policyUpdateMs))}function JS(e){if(e.transport.curve===`ecdsa`){let t=String(e.transport.walletId).trim(),n=String(e.transport.ecdsaRestore.authority.walletId).trim();if(!t||!n||t!==n)throw Error(`Passkey ECDSA seal transport wallet does not match restore metadata`);return{walletId:t,ecdsaRestore:e.transport.ecdsaRestore}}let t=vn(Tn(e.transport.ed25519Restore.runtimePolicyScope));return{walletId:e.transport.walletId,signingRootId:t.signingRootId,...t.signingRootVersion?{signingRootVersion:t.signingRootVersion}:{},ed25519Restore:e.transport.ed25519Restore}}function YS(e){return e.transport.curve===`ed25519`?{authMethod:`passkey`,curve:`ed25519`}:{authMethod:`passkey`,curve:`ecdsa`,chainTarget:e.transport.chainTarget}}function XS(e){if(e.transport.curve===`ecdsa`){let t=e.transport.ecdsaRestore?.roleLocalMaterialRef;if(!t)throw Error(`Passkey ECDSA persistence requires exact restore metadata`);return[`persist`,`passkey`,`ecdsa`,z(e.transport.chainTarget),t.materialActivation.activationId,t.materialActivation.capability,t.materialActivation.materialOwner,t.materialActivation.keyBinding,t.materialActivation.lifecycleBinding,t.materialActivation.signingWorker,t.durableMaterialRef,t.bindingDigest].join(`|`)}let t=Df({authMethod:`passkey`,materialActivation:e.transport.ed25519Restore.materialActivation});return[`persist`,t.kind,t.authMethod,Lf(t.materialActivation)].join(`|`)}function ZS(e){return e.transport.curve===`ed25519`}function QS(e){if(!ZS(e)){let t=String(e.metadata.walletId||``).trim();if(!t||!e.metadata.ecdsaRestore)throw Error(`[SigningSessionSealedStore] missing Passkey ECDSA seal metadata`);let n={...e.existing?.thresholdSessionIds,ecdsa:e.thresholdSessionId};return{thresholdSessionId:e.thresholdSessionId,sealedSecretB64u:e.sealedSecretB64u,curve:`ecdsa`,authMethod:`passkey`,thresholdSessionIds:n,walletId:t,relayerUrl:e.relayerUrl,keyVersion:e.keyVersion,groupId:e.groupId,ecdsaRestore:e.metadata.ecdsaRestore,...e.metadata.ed25519Restore?{ed25519Restore:e.metadata.ed25519Restore}:{},issuedAtMs:e.issuedAtMs,expiresAtMs:e.expiresAtMs,remainingUses:e.remainingUses,updatedAtMs:e.updatedAtMs}}let t=String(e.metadata.walletId||``).trim();if(!t||!e.metadata.ed25519Restore)throw Error(`[SigningSessionSealedStore] missing Passkey Ed25519 seal metadata`);let n={...e.existing?.thresholdSessionIds,ed25519:e.thresholdSessionId};return{thresholdSessionId:e.thresholdSessionId,sealedSecretB64u:e.sealedSecretB64u,curve:`ed25519`,authMethod:`passkey`,thresholdSessionIds:n,walletId:t,...e.metadata.signingRootId?{signingRootId:e.metadata.signingRootId}:{},...e.metadata.signingRootVersion?{signingRootVersion:e.metadata.signingRootVersion}:{},relayerUrl:e.relayerUrl,keyVersion:e.keyVersion,groupId:e.groupId,...e.metadata.ecdsaRestore?{ecdsaRestore:e.metadata.ecdsaRestore}:{},ed25519Restore:e.metadata.ed25519Restore,issuedAtMs:e.issuedAtMs,expiresAtMs:e.expiresAtMs,remainingUses:e.remainingUses,updatedAtMs:e.updatedAtMs}}function $S(e){return e.transport.curve===`ed25519`}async function eC(e){let t=Pe(e);if(!t)throw Error(`[SigningSessionSealedStore] invalid sealed session record write input`);await Oe(t)}function tC(e,t){return e.source===t.source&&Vr(e.chainTarget,t.chainTarget)&&e.keyHandle===t.keyHandle&&e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId&&e.ethereumAddress===t.ethereumAddress&&e.relayerKeyId===t.relayerKeyId&&e.clientVerifyingShareB64u===t.clientVerifyingShareB64u&&e.thresholdEcdsaPublicKeyB64u===t.thresholdEcdsaPublicKeyB64u&&b(e.roleLocalMaterialRef.materialActivation,t.roleLocalMaterialRef.materialActivation)&&e.roleLocalMaterialRef.durableMaterialRef===t.roleLocalMaterialRef.durableMaterialRef&&e.roleLocalMaterialRef.bindingDigest===t.roleLocalMaterialRef.bindingDigest&&e.participantIds.length===t.participantIds.length&&e.participantIds.every((e,n)=>e===t.participantIds[n])&&e.authority.kind===t.authority.kind&&e.authority.walletId===t.authority.walletId&&e.authority.authorityDigest===t.authority.authorityDigest&&e.authority.walletAuthMethodId===t.authority.walletAuthMethodId&&Qn(e.publicCapability,t.publicCapability)&&Bn(e.routerAbEcdsaDerivationNormalSigning,t.routerAbEcdsaDerivationNormalSigning)}function nC(e){if(e.existing.curve!==e.transport.curve)return!1;let t=String(e.transport.walletId).trim();if(!t||t!==e.existing.walletId)return!1;if(e.existing.curve===`ed25519`&&e.transport.curve===`ed25519`)return b(e.existing.ed25519Restore.materialActivation,e.transport.ed25519Restore.materialActivation);if(e.existing.curve!==`ecdsa`||e.transport.curve!==`ecdsa`||!Vr(e.existing.ecdsaRestore.chainTarget,e.transport.chainTarget))return!1;let n=e.metadata.ecdsaRestore;return n?tC(e.existing.ecdsaRestore,n):!0}function rC(e){return e.curve===`ecdsa`?{walletId:e.walletId,ecdsaRestore:e.ecdsaRestore,...e.ed25519Restore?{ed25519Restore:e.ed25519Restore}:{}}:{walletId:e.walletId,...e.signingRootId?{signingRootId:e.signingRootId}:{},...e.signingRootVersion?{signingRootVersion:e.signingRootVersion}:{},...e.ecdsaRestore?{ecdsaRestore:e.ecdsaRestore}:{},ed25519Restore:e.ed25519Restore}}function iC(e,t){return e.curve,{...e,authMethod:`passkey`,groupId:t}}async function aC(e){return e.transport.curve===`ed25519`?await ve(Df({authMethod:`passkey`,materialActivation:e.transport.ed25519Restore.materialActivation})):await Ft(e.thresholdSessionId,e.purpose)}var oC=class{constructor(e){this.deps=e}async persistSigningSessionSealForThresholdSession(e){if(this.deps.signingSessionPersistenceMode!==`sealed_refresh_v1`)return{ok:!1,code:`not_enabled`,message:`Passkey signing-session seal persistence requires signingSessionPersistenceMode="sealed_refresh_v1"`};let t=String(e.thresholdSessionId||``).trim();if(!t)return{ok:!1,code:`invalid_args`,message:`Missing threshold sessionId`};let n=String(e.transport.relayerUrl||``).trim();if(!n)return{ok:!1,code:`invalid_args`,message:`Passkey seal persistence requires relayerUrl`};let r=JS({transport:e.transport}),i=YS({transport:e.transport});if(!i)return{ok:!1,code:`invalid_args`,message:`Passkey seal persistence requires one exact record purpose`};let a=XS({transport:e.transport}),o=WS.get(a);if(o)return await o;let s;s=(e.transport.curve,this.persistExactRecord({thresholdSessionId:t,transport:e.transport,metadata:r,purpose:i,relayerUrl:n,diagnostics:e.diagnostics,completedSeal:e.completedSeal}));let c=s.finally(()=>{WS.delete(a)});return WS.set(a,c),await c}async recordPolicyResult(e,t,n){let r=await this.readRecordForPurpose(e,t);if(r){if(n.ok){await this.writePolicy(r,n.expiresAtMs,Math.max(0,n.remainingUses));return}if(n.code===`exhausted`){await this.writePolicy(r,r.expiresAtMs,0);return}n.code===`expired`&&await this.writePolicy(r,Math.min(r.expiresAtMs,Date.now()),Math.max(0,r.remainingUses))}}async updatePersistedPolicy(e){let t=await this.readRecordForPurpose(e.purpose,e.thresholdSessionId);!t||t.curve!==`ecdsa`||t.thresholdSessionIds.ecdsa!==e.thresholdSessionId||await this.writePolicy(t,e.expiresAtMs,e.remainingUses)}async persistExactRecord(e){let t=performance.now(),n;try{n=await aC(e)}catch(n){return KS({diagnostics:e.diagnostics,bucket:`sealed_record_existing_read`,startedAt:t}),{ok:!1,code:`local_persist_failed`,message:n instanceof Error?`Failed to read the existing sealed session: ${n.message}`:`Failed to read the existing sealed session`}}if(KS({diagnostics:e.diagnostics,bucket:`sealed_record_existing_read`,startedAt:t}),n){if(!nC({existing:n,transport:e.transport,metadata:e.metadata}))return{ok:!1,code:`binding_mismatch`,message:`Existing sealed session names different material`};let t=performance.now(),r;try{r=await this.deps.readWarmSessionStatus({thresholdSessionId:e.thresholdSessionId})}catch(e){return{ok:!1,code:`worker_error`,message:e instanceof Error?`Failed to read warm-session policy: ${e.message}`:`Failed to read warm-session policy`}}KS({diagnostics:e.diagnostics,bucket:`sealed_record_policy_read`,startedAt:t});let i=rC(n),a=r.ok?r.expiresAtMs:r.code===`expired`?Math.min(n.expiresAtMs,Date.now()):n.expiresAtMs,o=r.ok?r.remainingUses:r.code===`exhausted`?0:n.remainingUses;if(!r.ok&&r.code!==`expired`&&r.code!==`exhausted`)return r;let s=performance.now();return await eC(($S(e),QS({thresholdSessionId:e.thresholdSessionId,transport:e.transport,metadata:i,sealedSecretB64u:n.sealedSecretB64u,relayerUrl:n.relayerUrl,keyVersion:n.keyVersion,groupId:n.groupId,issuedAtMs:n.issuedAtMs,expiresAtMs:a,remainingUses:o,updatedAtMs:Date.now(),existing:n}))),KS({diagnostics:e.diagnostics,bucket:`sealed_record_register`,startedAt:s}),{ok:!0,sealedSecretB64u:n.sealedSecretB64u,keyVersion:n.keyVersion,remainingUses:o,expiresAtMs:a}}if(e.transport.curve===`ecdsa`&&!e.metadata.ecdsaRestore)return{ok:!1,code:`missing_restore_metadata`,message:`Passkey ECDSA seal persistence requires exact restore metadata`};if(e.transport.curve===`ecdsa`&&e.metadata.ecdsaRestore&&!Vr(e.transport.chainTarget,e.metadata.ecdsaRestore.chainTarget))return{ok:!1,code:`binding_mismatch`,message:`Passkey ECDSA seal transport and restore metadata name different material`};if(e.transport.curve===`ed25519`&&!e.metadata.ed25519Restore)return{ok:!1,code:`missing_restore_metadata`,message:`Passkey Ed25519 seal persistence requires exact restore metadata`};if(String(e.transport.groupId||`rfc2409-group2`).trim()!==`rfc2409-group2`)return{ok:!1,code:`invalid_args`,message:`Unsupported groupId for Passkey signing-session seal persistence`};let r=Ns,i=performance.now(),a=e.completedSeal??await this.deps.sealAndPersistWarmSessionMaterial({thresholdSessionId:e.thresholdSessionId,transport:iC(e.transport,r)});if(KS({diagnostics:e.diagnostics,bucket:`sealed_record_apply_server_seal`,startedAt:i}),qS({diagnostics:e.diagnostics,resultDiagnostics:a.ok?a.diagnostics:void 0}),!a.ok)return a;let o=String(a.keyVersion||``).trim();if(!o)return{ok:!1,code:`invalid_key_version`,message:`Signing-session seal response did not include a key version`};let s=Date.now(),c=performance.now();await eC(($S(e),QS({thresholdSessionId:e.thresholdSessionId,transport:e.transport,metadata:e.metadata,sealedSecretB64u:a.sealedSecretB64u,relayerUrl:e.relayerUrl,keyVersion:o,groupId:r,issuedAtMs:s,expiresAtMs:a.expiresAtMs,remainingUses:a.remainingUses,updatedAtMs:s}))),KS({diagnostics:e.diagnostics,bucket:`sealed_record_register`,startedAt:c});let l=performance.now(),u;try{u=await aC(e)}catch{u=null}return KS({diagnostics:e.diagnostics,bucket:`sealed_record_verify_read`,startedAt:l}),u?a:{ok:!1,code:`local_persist_failed`,message:`Failed to persist sealed signing-session record locally`}}async readRecordForPurpose(e,t){return e.curve===`ed25519`?await ve(Df({authMethod:`passkey`,materialActivation:e.materialActivation})):await Ft(t,{authMethod:`passkey`,curve:`ecdsa`,chainTarget:e.chainTarget})}async writePolicy(e,t,n){if(e.curve===`ed25519`){await We({locator:Df({authMethod:`passkey`,materialActivation:e.ed25519Restore.materialActivation}),expiresAtMs:Math.max(1,Math.floor(t)),remainingUses:Math.max(0,Math.floor(n)),updatedAtMs:Date.now()});return}await Je({thresholdSessionId:e.thresholdSessionIds.ecdsa,filter:{authMethod:`passkey`,curve:`ecdsa`,chainTarget:e.ecdsaRestore.chainTarget},expiresAtMs:Math.max(1,Math.floor(t)),remainingUses:Math.max(0,Math.floor(n)),updatedAtMs:Date.now()})}};const sC=new Map,cC=new Map;function lC(e){return[`rehydrate`,`passkey`,`ecdsa`,z(e.chainTarget),Lf(e.materialActivation),String(e.thresholdSessionId||``).trim()].join(`|`)}function uC(e,t){if(!e)return`deferred`;if(e.ok)return t;if(e.code===`exhausted`)return`ready`;if(e.code===`expired`)return`deferred`;throw Error(`[PasskeyMpcSession] sealed-session restore failed (${e.code}): ${e.message}`)}async function dC(e){return{chainTarget:e.chainTarget,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,source:e.source,authority:await L({authority:e.authority}),roleLocalMaterialRef:e.roleLocalMaterialRef,rpId:e.authority.verifier.rpId,credentialIdB64u:e.authority.factor.credentialIdB64u,keyHandle:e.keyHandle,ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,ethereumAddress:e.ethereumAddress,relayerKeyId:e.relayerKeyId,clientVerifyingShareB64u:e.clientVerifyingShareB64u,thresholdEcdsaPublicKeyB64u:e.thresholdEcdsaPublicKeyB64u,participantIds:[...e.participantIds],...e.runtimePolicyScope?{runtimePolicyScope:e.runtimePolicyScope}:{},routerAbEcdsaDerivationNormalSigning:e.routerAbEcdsaDerivationNormalSigning,publicCapability:e.publicCapability}}function fC(e){return e.session.capabilitySubjects.some(t=>t.kind===`sign`&&t.keyFamily===`ecdsa_secp256k1`&&b(t.materialActivation,e.materialActivation))}async function pC(e){let t=R(e.walletId),n;try{n=await K.resolveSelectedWalletAuthority(String(t))}catch{return null}if(n.kind!==`resolved`)return null;let{selection:r,authMethod:i,authority:a}=n;if(r.lockState!==`unlocked`||r.walletId!==t||r.walletAuthMethodId!==i.walletAuthMethodId||i.kind!==`passkey`||i.status!==`active`||i.walletId!==t||i.walletAuthorityId!==a.authorityId||i.walletAuthMethodId!==e.factorAuthority.bindingId||i.rpId!==e.factorAuthority.verifier.rpId||i.credentialIdB64u!==e.factorAuthority.factor.credentialIdB64u||a.state!==`active`||a.walletId!==t)return null;let o;try{o=await G.readExactWithOperationCredential({walletId:t,authorityId:a.authorityId,authMethodId:i.walletAuthMethodId})}catch{return null}return o.kind!==`found`||o.record.walletId!==t||o.record.authorityId!==a.authorityId||o.record.authMethodId!==i.walletAuthMethodId||o.record.authorityDigestB64u!==a.authorityDigestB64u||o.record.authorityRevocationEpoch!==a.revocationEpoch||o.record.expiresAtMs<=e.nowMs||!fC({session:o.record,materialActivation:e.materialActivation})?null:o.operationCredential}async function mC(e){let t=Be({durableRecord:{authMethod:`passkey`,curve:`ecdsa`,thresholdSessionId:e.thresholdSessionId,chainTarget:e.chainTarget},deleteReason:`invalid_persisted_record`,preserveResolvedIdentity:!1}),n=[`delete`,`passkey`,`ecdsa`,z(e.chainTarget),e.thresholdSessionId].join(`|`),r=cC.get(n);if(r)return await r;let i=we(t).finally(()=>{cC.delete(n)});cC.set(n,i),await i}async function hC(e){return await Lt({walletId:e.walletId,filter:{authMethod:`passkey`,curve:`ecdsa`,chainTarget:e.chainTarget}})}function gC(e){console.warn(`[PasskeyMpcSession] signing-session restore list failed`,{walletId:e.walletId,target:e.target,reason:e.reason,error:e.error instanceof Error?e.error.message:String(e.error||`unknown error`)})}function _C(e){console.warn(`[PasskeyMpcSession] signing-session restore rejected record`,e)}function vC(e){return typeof e==`object`&&!!e}function yC(e){let t=Math.floor(Number(e));return Number.isFinite(t)&&t>0?t:0}function bC(e){return Number.isSafeInteger(e)&&Number(e)>=0}function xC(e){return Number.isSafeInteger(e)&&Number(e)>0}function SC(e){return!vC(e)||typeof e.ok!=`boolean`?null:e.ok?!bC(e.remainingUses)||!xC(e.expiresAtMs)?null:{ok:!0,remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs}:{ok:!1,code:typeof e.code==`string`?e.code:`worker_error`,message:typeof e.message==`string`?e.message:`Warm-session status read failed`}}function CC(e){if(!vC(e)||!Array.isArray(e.results))return null;let t=[];for(let n of e.results){if(!vC(n)||typeof n.thresholdSessionId!=`string`||!n.thresholdSessionId.trim())return null;let e=SC(n.result);if(!e)return null;t.push({thresholdSessionId:n.thresholdSessionId,result:e})}return{results:t}}function wC(e){return!vC(e)||typeof e.ok!=`boolean`?null:e.ok?typeof e.prfFirstB64u!=`string`||!e.prfFirstB64u.trim()||!bC(e.remainingUses)||!xC(e.expiresAtMs)?null:{ok:!0,prfFirstB64u:e.prfFirstB64u,remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs}:{ok:!1,code:typeof e.code==`string`?e.code:`worker_error`,message:typeof e.message==`string`?e.message:`Warm-session claim failed`}}function TC(e){if(!vC(e)||typeof e.ok!=`boolean`)return null;if(!e.ok)return{ok:!1,code:typeof e.code==`string`?e.code:`worker_error`,message:typeof e.message==`string`?e.message:`Signing-session seal and persist failed`};if(typeof e.sealedSecretB64u!=`string`||!e.sealedSecretB64u.trim()||typeof e.keyVersion!=`string`||!e.keyVersion.trim()||!bC(e.remainingUses)||!xC(e.expiresAtMs))return null;let t=vC(e.diagnostics)?{runtimeSetupMs:yC(e.diagnostics.runtimeSetupMs),clientSealMs:yC(e.diagnostics.clientSealMs),serverSealRouteMs:yC(e.diagnostics.serverSealRouteMs),clientUnsealMs:yC(e.diagnostics.clientUnsealMs),policyUpdateMs:yC(e.diagnostics.policyUpdateMs)}:void 0;return{ok:!0,sealedSecretB64u:e.sealedSecretB64u,keyVersion:e.keyVersion.trim(),remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs,...t?{diagnostics:t}:{}}}function EC(e){if(e.authMethod===`email_otp`||e.curve===`linked_device`)throw Error(`Passkey MPC durable owner requires an owner signing-lane transport`);return e}function DC(e){return Math.max(0,Math.round(performance.now()-e))}function OC(e){e.diagnostics?.recordDuration(e.bucket,DC(e.startedAt))}var kC=class{constructor(e){this.deps=e,this.worker=null,this.initializationPromise=null,this.messageId=0,this.pendingRequests=new Map,this.boundHandleWorkerMessage=this.handleWorkerMessage.bind(this),this.boundHandleWorkerError=this.handleWorkerError.bind(this),this.putWarmSessionMaterial=async e=>{let{diagnostics:t,preparedServerSeal:n,...r}=e;if(n&&!e.transport)throw Error(`Prepared server seal requires exact persistence transport`);let i=performance.now();await this.ensureWorkerReady(),OC({diagnostics:t,bucket:`worker_ready`,startedAt:i});let a=performance.now(),o=await this.sendMessage({type:`WARM_SESSION_MATERIAL_PUT`,id:this.generateMessageId(),payload:r});if(!o.success)throw Error(String(o.error||`Failed to cache warm-session material`));let s=SC(o.data);if(!s)throw Error(`Warm-session cache returned an invalid response`);if(!s.ok)throw Error(`Warm-session cache failed (${s.code}): ${s.message}`);OC({diagnostics:t,bucket:`worker_put`,startedAt:a});let c;if(n&&e.transport){let t=await this.sendMessage({type:`COMPLETE_SESSION_CLIENT_SEAL`,id:this.generateMessageId(),payload:{preparationId:n.preparationId,thresholdSessionId:e.thresholdSessionId,transport:EC(e.transport),serverSeal:{ok:!0,ciphertext:n.ciphertext,keyVersion:n.keyVersion,expiresAtMs:n.expiresAtMs,remainingUses:n.remainingUses}}}),r=t.success?TC(t.data):null;if(!r){let e=t.success?`Prepared signing-session seal returned an invalid response`:t.error||`Prepared signing-session seal failed`;throw Error(e)}if(!r.ok)throw Error(`Prepared signing-session seal failed (${r.code}): ${r.message}`);c=r}let l=performance.now(),u=e.transport?await this.durableState.persistSigningSessionSealForThresholdSession({thresholdSessionId:e.thresholdSessionId,transport:EC(e.transport),...t?{diagnostics:t}:{},...c?{completedSeal:c}:{}}):null;if(OC({diagnostics:t,bucket:`sealed_record_persist`,startedAt:l}),u&&!u.ok)throw Error(`Warm-session cache could not persist sealed refresh material (${u.code}): ${u.message}`)},this.getWarmSessionStatus=async e=>await this.readWarmSessionStatus(e),this.discoverPersistedSessionsForWallet=async e=>this.deps.signingSessionPersistenceMode===`sealed_refresh_v1`?await BS({...e,authMethod:`passkey`},{listExactSealedSessionsForWallet:async e=>await Lt({walletId:e.walletId,filter:e.curve===`ecdsa`?{authMethod:`passkey`,curve:`ecdsa`,chainTarget:e.chainTarget}:{authMethod:`passkey`,curve:`ed25519`}}),onListError:({walletId:e,error:t})=>{console.warn(`[PasskeyMpcSession] persisted-session discovery list failed`,{walletId:e,error:t instanceof Error?t.message:String(t||`unknown error`)})},onRejectedRecord:({walletId:e,rejection:t})=>{console.warn(`[PasskeyMpcSession] persisted-session discovery rejected record`,{walletId:e,rejection:t})}}):{listed:0,discovered:0,truncated:0},this.restorePersistedSessionForSigning=async e=>this.deps.signingSessionPersistenceMode===`sealed_refresh_v1`?await zS({...e,authMethod:`passkey`},{listExactSealedSessionsForWallet:hC,restoreSealedRecordForWallet:this.restorePasskeySealedRecordForWallet,onListError:gC,onRejectedRecord:_C}):{kind:`completed`,attempted:0,restored:0,deferred:0},this.restorePasskeySealedRecordForWallet=async e=>{let{record:t,purpose:n}=e;if(n.authMethod!==`passkey`||t.authMethod!==`passkey`)return`deferred`;let r=String(n.thresholdSessionId||``).trim(),i=n.chainTarget;if(!r||t.curve!==`ecdsa`||!Vr(t.chainTarget,i)||!b(t.roleLocalMaterialRef.materialActivation,n.materialActivation))return`deferred`;let a=lC({thresholdSessionId:r,chainTarget:i,materialActivation:n.materialActivation}),o=sC.get(a);if(o)return uC(await o,`ready`);let s=pf({queueByKey:this.deps.thresholdEcdsaSigningQueueByKey,queueKey:Ef({materialActivation:t.roleLocalMaterialRef.materialActivation}),walletId:R(e.walletId),enabled:!0,task:async()=>await this.restorePasskeyEcdsaRecord({walletId:e.walletId,record:t,purpose:{...n,authMethod:`passkey`}})}).finally(()=>{sC.delete(a)});return sC.set(a,s),uC(await s,`restored`)},this.getWarmSessionStatuses=async e=>{let t=Array.from(new Set(e.thresholdSessionIds.map(e=>String(e||``).trim()).filter(Boolean)));if(!t.length)return{results:[]};let n=await this.sendMessage({type:`WARM_SESSION_STATUS_BATCH_READ`,id:this.generateMessageId(),payload:{thresholdSessionIds:t}});if(n.success){let e=CC(n.data);if(e)return e}return{results:t.map(e=>({thresholdSessionId:e,result:{ok:!1,code:`worker_error`,message:String(n.success?`Warm-session batch status read failed`:n.error)}}))}},this.claimWarmSessionMaterial=async e=>{let t=nS(e),n=await this.sendMessage({type:`WARM_SESSION_MATERIAL_CLAIM`,id:this.generateMessageId(),payload:{thresholdSessionId:t,...typeof e.uses==`number`?{uses:e.uses}:{},...typeof e.consume==`boolean`?{consume:e.consume}:{},curve:e.purpose.curve}});if(!n.success)return{ok:!1,code:`worker_error`,message:n.error};let r=wC(n.data);return r?(await this.recordWarmSessionPolicyResult(e.purpose,t,r),r):{ok:!1,code:`worker_error`,message:`Warm-session claim failed`}},this.consumeWarmSessionUses=async e=>{let t=nS(e),n=await this.sendMessage({type:`WARM_SESSION_MATERIAL_CONSUME`,id:this.generateMessageId(),payload:{thresholdSessionId:t,...typeof e.uses==`number`?{uses:e.uses}:{},curve:e.purpose.curve}});if(!n.success)return{ok:!1,code:`worker_error`,message:n.error};let r=SC(n.data);return r?(await this.recordWarmSessionPolicyResult(e.purpose,t,r),r):{ok:!1,code:`worker_error`,message:`Warm-session consume failed`}},this.clearVolatileWarmSessionMaterial=async e=>{let t=aS(e);if(t?.scope.kind!==`session`||!this.worker&&!this.initializationPromise)return;let n=await this.sendMessage({type:`WARM_SESSION_VOLATILE_MATERIAL_CLEAR`,id:this.generateMessageId(),payload:t});if(!n.success)throw Error(String(n.error||`Failed to clear volatile warm-session material`))},this.clearAllVolatileWarmSessionMaterial=async e=>{let t=aS(e);if(t?.scope.kind!==`all`||!this.worker&&!this.initializationPromise)return;let n=await this.sendMessage({type:`WARM_SESSION_VOLATILE_MATERIAL_CLEAR_ALL`,id:this.generateMessageId(),payload:t});if(!n.success)throw Error(String(n.error||`Failed to clear all volatile warm-session material entries`))},this.persistSigningSessionSealForThresholdSession=async e=>await this.durableState.persistSigningSessionSealForThresholdSession(e),this.recordWarmSessionPolicyResult=async(e,t,n)=>await this.durableState.recordPolicyResult(e,t,n),this.durableState=new oC({signingSessionPersistenceMode:e.signingSessionPersistenceMode,sealAndPersistWarmSessionMaterial:this.sealAndPersistWarmSessionMaterial.bind(this),readWarmSessionStatus:this.readWarmSessionStatus.bind(this)})}setWorkerBaseOrigin(e){this.workerBaseOrigin=e}async prewarmShamir3Pass(){try{await this.sendMessage({type:`PREWARM_SHAMIR3PASS`,id:this.generateMessageId(),payload:{}},15e3)}catch{}}async prepareSigningSessionHydration(e){let t=await this.sendMessage({type:`PREPARE_SESSION_CLIENT_SEAL`,id:this.generateMessageId(),payload:e});if(!t.success)throw Error(t.error||`Client seal preparation failed`)}async discardSigningSessionHydration(e){let t=await this.sendMessage({type:`DISCARD_SESSION_CLIENT_SEAL`,id:this.generateMessageId(),payload:e});if(!t.success)throw Error(t.error||`Client seal cleanup failed`)}async readPreparedSigningSessionHydration(e){let t=await this.sendMessage({type:`READ_SESSION_CLIENT_SEAL`,id:this.generateMessageId(),payload:e});if(!t.success||!vC(t.data)||t.data.ok!==!0||typeof t.data.ciphertext!=`string`||!t.data.ciphertext.trim())throw Error(t.success?`Prepared client seal is invalid`:t.error||`Client seal read failed`);return{ciphertext:t.data.ciphertext}}async restorePasskeyEcdsaRecord(e){let t=e.purpose.thresholdSessionId,n=e.purpose.chainTarget,r=await Ee({thresholdSessionId:t,authMethod:`passkey`,curve:`ecdsa`,chainTarget:n});if(!r)return null;try{let r=await pC({walletId:e.walletId,factorAuthority:e.record.authority,materialActivation:e.purpose.materialActivation,nowMs:Date.now()});if(!r)return null;let i=await dC(e.record),a=r.token,o=String(i.authority.walletId).trim();if(!o||o!==String(e.walletId).trim())return null;let s=String(e.record.groupId||``).trim();if(!s)return null;let c={curve:`ecdsa`,authMethod:`passkey`,walletId:o,chainTarget:n,relayerUrl:e.record.relayerUrl,signingSessionSealKeyVersion:qo(e.record.keyVersion),groupId:s,walletSessionToken:a,ecdsaRestore:i};return await US({record:e.record,purpose:e.purpose,transport:c,groupId:s,rehydrateWarmSessionMaterial:this.rehydrateWarmSessionMaterial.bind(this),deletePersistedRecord:async()=>await mC({thresholdSessionId:t,chainTarget:n}),recordSessionMaterialRestored:async e=>await this.recordWarmSessionPolicyResult({curve:`ecdsa`,thresholdSessionId:t,chainTarget:n},t,e),readWarmSessionStatusFromWorker:async e=>await this.readWarmSessionStatus({thresholdSessionId:e}),resolveCurrentEcdsaCapabilityRuntime:this.deps.resolveCurrentEcdsaCapabilityRuntime,updatePersistedPolicy:async e=>await this.durableState.updatePersistedPolicy({thresholdSessionId:t,purpose:{curve:`ecdsa`,thresholdSessionId:t,chainTarget:n},...e})})}finally{await He(r)}}async sealAndPersistWarmSessionMaterial(e){if(this.deps.signingSessionPersistenceMode!==`sealed_refresh_v1`)return{ok:!1,code:`not_enabled`,message:`Passkey MPC session sealing requires sealed refresh mode`};let t=await this.sendMessage({type:`WARM_SESSION_SEAL_AND_PERSIST`,id:this.generateMessageId(),payload:e});if(t.success){let e=TC(t.data);if(e)return e}return{ok:!1,code:`worker_error`,message:String(t.success?`Signing-session seal and persist failed`:t.error)}}async rehydrateWarmSessionMaterial(e){if(this.deps.signingSessionPersistenceMode!==`sealed_refresh_v1`)return{ok:!1,code:`not_enabled`,message:`Passkey MPC session rehydration requires sealed refresh mode`};let t=await this.sendMessage({type:`WARM_SESSION_REHYDRATE`,id:this.generateMessageId(),payload:e});if(t.success){let e=SC(t.data);if(e)return e}return{ok:!1,code:`worker_error`,message:String(t.success?`Warm-session rehydrate failed`:t.error)}}async readWarmSessionStatus(e){let t=await this.sendMessage({type:`WARM_SESSION_STATUS_READ`,id:this.generateMessageId(),payload:e});if(t.success){let e=SC(t.data);if(e)return e}return{ok:!1,code:`worker_error`,message:String(t.success?`Warm-session status read failed`:t.error)}}async ensureWorkerReady(){if(!this.worker&&(this.initializationPromise||=this.createWorker().catch(e=>{throw this.initializationPromise=null,e}),await this.initializationPromise,!this.worker))throw Error(`Passkey MPC session worker failed to initialize`)}async createWorker(){let e=ip(Pb.RUNTIME.PASSKEY_MPC_SESSION_WORKER,{worker:`passkeyMpcSession`,baseOrigin:this.workerBaseOrigin}),t=new Worker(e,{type:`module`,name:`PasskeyMpcSessionWorker`});t.addEventListener(`message`,this.boundHandleWorkerMessage),t.addEventListener(`error`,this.boundHandleWorkerError),this.worker=t}async sendMessage(e,t=6e4){await this.ensureWorkerReady();let n=this.worker;if(!n)throw Error(`Passkey MPC session worker not available`);let r=String(e.id||this.generateMessageId());if(this.pendingRequests.has(r))throw Error(`Duplicate Passkey MPC session worker request id: ${r}`);return await new Promise((i,a)=>{let o=setTimeout(()=>{this.rejectPendingRequest(r,Error(`Passkey MPC session worker communication timeout (${t}ms) for ${e.type}`))},t);this.pendingRequests.set(r,{id:r,timeoutId:o,resolve:i,reject:a});try{n.postMessage({...e,id:r})}catch(e){this.rejectPendingRequest(r,e instanceof Error?e:Error(String(e)))}})}handleWorkerMessage(e){if(e.currentTarget!==this.worker||e.target!==this.worker)return;let t=sp(e.data);if(!t)return;let n=t.id||``;if(!n)return;let r=this.pendingRequests.get(n);r&&(clearTimeout(r.timeoutId),this.pendingRequests.delete(n),r.resolve(t))}handleWorkerError(e){if(e.currentTarget!==this.worker||e.target!==this.worker)return;let t=this.worker;this.worker=null,this.initializationPromise=null,t?.removeEventListener(`message`,this.boundHandleWorkerMessage),t?.removeEventListener(`error`,this.boundHandleWorkerError),t?.terminate();let n=e,r=Error(`Passkey MPC session worker failed: ${String(n.message||`unknown error`)}`);for(let e of this.pendingRequests.values())clearTimeout(e.timeoutId),e.reject(r);this.pendingRequests.clear()}rejectPendingRequest(e,t){let n=this.pendingRequests.get(e);n&&(clearTimeout(n.timeoutId),this.pendingRequests.delete(e),n.reject(t))}generateMessageId(){return`passkey_mpc_session_${Date.now()}_${++this.messageId}`}};function AC(e){return new kC(e)}var jC=class extends Error{constructor(e){super(e),this.code=`wallet_origin_webauthn_unavailable`,this.name=`WalletOriginWebAuthnUnavailableError`}};async function MC(e,t,n){let r=NC(e,t);try{return e===`create`?await navigator.credentials.create({publicKey:r,...n.abortSignal?{signal:n.abortSignal}:{}}):await navigator.credentials.get({publicKey:r,...n.abortSignal?{signal:n.abortSignal}:{}})}catch(t){throw e===`create`&&(VC(t)||HC(t))?new jC(`Wallet-origin WebAuthn registration is unavailable: ${UC(t)}`):t}}function NC(e,t){return e===`create`?PC(t):FC(t)}function PC(e){return{...e,challenge:BC(e.challenge),user:{...e.user,id:BC(e.user.id)},excludeCredentials:e.excludeCredentials?.map(IC),extensions:LC(e.extensions)}}function FC(e){return{...e,challenge:BC(e.challenge),allowCredentials:e.allowCredentials?.map(IC),extensions:LC(e.extensions)}}function IC(e){return{...e,id:BC(e.id)}}function LC(e){if(!e)return e;let t={...e},n=t.prf;if(n&&typeof n==`object`){let e={...n};if(e.eval&&typeof e.eval==`object`&&(e.eval=RC(e.eval)),e.evalByCredential&&typeof e.evalByCredential==`object`){let t={};for(let[n,r]of Object.entries(e.evalByCredential))t[n]=r&&typeof r==`object`?RC(r):r;e.evalByCredential=t}t.prf=e}return t}function RC(e){return{...e,...zC(e.first)?{first:BC(e.first)}:{},...zC(e.second)?{second:BC(e.second)}:{}}}function zC(e){return e instanceof ArrayBuffer||ArrayBuffer.isView(e)}function BC(e){if(e instanceof ArrayBuffer)return e.slice(0);let t=e,n=new Uint8Array(t.buffer,t.byteOffset,t.byteLength).slice();if(e instanceof DataView)return new DataView(n.buffer);let r=Object.getPrototypeOf(e).constructor;return new r(n.buffer)}function VC(e){let t=UC(e);return/origin of the document is not the same as its ancestors/i.test(t)}function HC(e){let t=WC(e),n=UC(e),r=t===`NotAllowedError`,i=/document is not focused|not focused|focus/i.test(n);return!!(r&&i)}function UC(e){return String(e?.message||``)}function WC(e){let t=e?.name;return typeof t==`string`?t:``}function GC(e,t){return(e||t||``).toLowerCase()}function KC(e){let t=I(String(e||``));if(t.length!==32)throw Error(`Invalid WebAuthn challenge: expected 32 bytes, got ${t.length}`);return t}function qC(e){if(e.kind!==`wallet_registration`)throw Error(`Wallet registration challenge is unavailable`);return e.challengeB64u}function JC(e){let t=Uo(String(e.walletId||``).trim());if(String(e.intendedUserName||``).trim()!==String(t))throw Error(`WebAuthn registration user.name must match walletId`);return{walletId:t}}var YC=class{constructor(e){this.rpIdOverride=e}getRpId(){try{return GC(this.rpIdOverride,window?.location?.hostname)}catch{return this.rpIdOverride||``}}getAuthenticationCredentialsSerializedForChallengeB64u(e){let t=`webauthn-get-${me(12,`WebAuthn get request IDs`)}`;return xl.runImmediate({owner:{kind:`wallet_request`,requestId:t,operation:`authentication`},operation:this.executeAuthenticationCredential.bind(this,e)})}async executeAuthenticationCredential({subjectId:e,challengeB64u:t,allowCredentials:n=[],includeSecondPrfOutput:r=!1,cancellation:i={kind:`none`}}){this.abortController=new AbortController,this.removePageAbortHandlers=tw(this.abortController),this.removeExternalAbortListener=XC(this.abortController,i);let a=this.getRpId(),o={challenge:KC(t),rpId:a,userVerification:`preferred`,timeout:6e4,extensions:{prf:{eval:{first:mc(),second:dc()}}}};n.length>0&&(o.allowCredentials=n.map(e=>({id:I(e.id),type:`public-key`,transports:e.transports})));try{let e=pc({credential:await MC(`get`,o,{abortSignal:this.abortController.signal}),firstPrfOutput:!0,secondPrfOutput:r});return $C(e,t),e}finally{this.removePageAbortHandlers?.(),this.removePageAbortHandlers=void 0,this.removeExternalAbortListener?.(),this.removeExternalAbortListener=void 0,this.abortController=void 0}}generateRegistrationCredentialsInternal(e){switch(e.prompt.kind){case`reserved`:return xl.runReserved({reservation:e.prompt.reservation,owner:e.prompt.owner,operation:this.executeRegistrationCredential.bind(this,e)});case`immediate`:return xl.runImmediate({owner:{kind:`wallet_request`,requestId:e.prompt.requestId,operation:`registration`},operation:this.executeRegistrationCredential.bind(this,e)})}}async executeRegistrationCredential(e){this.abortController=new AbortController,this.removePageAbortHandlers=tw(this.abortController),this.removeExternalAbortListener=XC(this.abortController,e.prompt.cancellation);let t=this.getRpId(),n=JC({walletId:e.walletId,intendedUserName:e.intendedUserName}),r=e.kind===`wallet_recovery`?e.recoveryRegistration:null,i=e.kind===`wallet_add_auth_method`?e.registration:null,a=r??i,o=a?.rpId??t;if(a&&o!==t)throw Error(`Wallet recovery RP ID does not match the wallet origin`);let s=a?{challenge:KC(a.challengeB64u),rp:{name:`Seams Wallet`,id:o},user:{id:I(a.user.idB64u),name:a.user.name,displayName:a.user.displayName},pubKeyCredParams:a.pubKeyCredParams.map(e=>({...e})),authenticatorSelection:{...a.authenticatorSelection},timeout:a.timeoutMs,attestation:a.attestation,extensions:{prf:{eval:{first:I(a.extensions.prf.eval.firstB64u),second:I(a.extensions.prf.eval.secondB64u)}}},excludeCredentials:a.excludeCredentials.map(e=>({type:e.type,id:I(e.id)}))}:{challenge:KC(qC(e)),rp:{name:`WebAuthn Passkey`,id:o},user:{id:new TextEncoder().encode(ew(e.walletId,e.signerSlot)),name:n.walletId,displayName:n.walletId},pubKeyCredParams:[{alg:-7,type:`public-key`},{alg:-257,type:`public-key`}],authenticatorSelection:{residentKey:`required`,userVerification:`preferred`},timeout:6e4,attestation:`none`,extensions:{prf:{eval:{first:mc(),second:dc()}}}};try{return await MC(`create`,s,{abortSignal:this.abortController.signal})}finally{this.removePageAbortHandlers?.(),this.removePageAbortHandlers=void 0,this.removeExternalAbortListener?.(),this.removeExternalAbortListener=void 0,this.abortController=void 0}}};function XC(e,t){if(t.kind===`none`)return;let n=t.signal,r=e.abort.bind(e);if(n.aborted){r();return}return n.addEventListener(`abort`,r,{once:!0}),n.removeEventListener.bind(n,`abort`,r)}function ZC(e){return String(e||``).trim().replace(/=+$/g,``)}function QC(e){let t=String(e.response?.clientDataJSON||``).trim();if(!t)throw Error(`WebAuthn authentication response missing clientDataJSON`);let n=``;try{n=new TextDecoder().decode(I(t))}catch(e){throw Error(`WebAuthn authentication response has invalid clientDataJSON encoding: ${e instanceof Error?e.message:String(e)}`)}let r;try{r=JSON.parse(n)}catch(e){throw Error(`WebAuthn authentication response has invalid clientDataJSON JSON: ${e instanceof Error?e.message:String(e)}`)}let i=r&&typeof r==`object`?r.challenge:void 0;if(typeof i!=`string`||!i.trim())throw Error(`WebAuthn authentication response clientDataJSON missing challenge`);return i}function $C(e,t){let n=ZC(QC(e)),r=ZC(t);if(n!==r)throw Error(`Unexpected authentication response challenge "${n}", expected "${r}"`)}function ew(e,t){return t===void 0||t===1?e:`${e} (${t})`}function tw(e){let t=()=>{document.hidden&&e.abort()},n=()=>{e.abort()},r=()=>{e.abort()};return document.addEventListener(`visibilitychange`,t,{passive:!0}),window.addEventListener(`pagehide`,n,{passive:!0}),window.addEventListener(`beforeunload`,r,{passive:!0}),()=>{document.removeEventListener(`visibilitychange`,t),window.removeEventListener(`pagehide`,n),window.removeEventListener(`beforeunload`,r)}}var nw=class{constructor(e){this.resolveOperationStepUpCredential=e.resolveOperationStepUpCredential,this.nearKeyMaterialStore=e.nearKeyMaterialStore,this.touchIdPrompt=e.touchIdPrompt,this.touchConfirm=e.touchConfirm,this.passkeyMpcSession=e.passkeyMpcSession,this.nearClient=e.nearClient,this.userPreferencesManager=e.userPreferencesManager,this.nonceCoordinator=e.nonceCoordinator,this.relayerUrl=e.relayerUrl,this.chains=e.chains,this.nearExplorerUrl=e.nearExplorerUrl,this.tempoExplorerUrl=e.tempoExplorerUrl,this.evmExplorerUrl=e.evmExplorerUrl,this.getTheme=e.getTheme,this.workerTransport=e.workerTransport}setWorkerBaseOrigin(e){this.workerTransport.setWorkerBaseOrigin(e)}getContext(){return{resolveOperationStepUpCredential:this.resolveOperationStepUpCredential,requestWorkerOperation:this.requestWorkerOperation.bind(this),nearKeyMaterialStore:this.nearKeyMaterialStore,touchIdPrompt:this.touchIdPrompt,touchConfirm:this.touchConfirm,passkeyMpcSession:this.passkeyMpcSession,nearClient:this.nearClient,userPreferencesManager:this.userPreferencesManager,nonceCoordinator:this.nonceCoordinator,chains:this.chains,getTheme:this.getTheme,rpIdOverride:this.touchIdPrompt.getRpId(),nearExplorerUrl:this.nearExplorerUrl,tempoExplorerUrl:this.tempoExplorerUrl,evmExplorerUrl:this.evmExplorerUrl,relayerUrl:this.relayerUrl}}async prewarmWorkers(){await this.workerTransport.prewarmWorkers()}async clearEcdsaClientWorkerState(e){await this.workerTransport.clearEcdsaClientWorkerState(e)}async prewarmEcdsaRegistrationCrypto(){return await this.workerTransport.prewarmEcdsaRegistrationCrypto()}async prewarmEmailOtpYao(e){return await this.workerTransport.prewarmEmailOtpYao(e)}requestWorkerOperation(e){return this.workerTransport.requestOperation(e)}};const rw={TIMEOUTS:{DEFAULT:6e4,TRANSACTION:6e4,REGISTRATION:6e4},WORKER:{URL:Pb.RUNTIME.SIGNER_WORKER,TYPE:`module`,NAME:`Web3AuthnSignerWorker`},ECDSA_DERIVATION_CLIENT_WORKER:{URL:Pb.RUNTIME.ECDSA_DERIVATION_CLIENT_WORKER,TYPE:`module`,NAME:`Web3AuthnEcdsaDerivationClientWorker`},ECDSA_PRESIGN_CLIENT_WORKER:{URL:Pb.RUNTIME.ECDSA_PRESIGN_CLIENT_WORKER,TYPE:`module`,NAME:`Web3AuthnEcdsaPresignClientWorker`},ECDSA_ONLINE_CLIENT_WORKER:{URL:Pb.RUNTIME.ECDSA_ONLINE_CLIENT_WORKER,TYPE:`module`,NAME:`Web3AuthnEcdsaOnlineClientWorker`},RETRY:{MAX_ATTEMPTS:3,BACKOFF_MS:1e3}};function iw(e){switch(e){case`evmCrypto`:return`/sdk/workers/evm-crypto.worker.js`;case`tempoSigner`:return`/sdk/workers/tempo-signer.worker.js`}}function aw(e){let t=typeof window<`u`?window:{};switch(e){case`evmCrypto`:return typeof t.__SEAMS_EVM_CRYPTO_WORKER_URL__==`string`?t.__SEAMS_EVM_CRYPTO_WORKER_URL__:void 0;case`tempoSigner`:return typeof t.__SEAMS_TEMPO_SIGNER_WORKER_URL__==`string`?t.__SEAMS_TEMPO_SIGNER_WORKER_URL__:void 0}}function ow(e,t){let n=t?.baseOrigin||rp()||(typeof window<`u`?window.location.origin:``)||`https://invalid.local`,r=aw(e)||iw(e);return/^https?:\/\//i.test(r)?r:new URL(r,n).toString()}function sw(e){let t=e?.baseOrigin||rp()||(typeof window<`u`?window.location.origin:``)||`https://invalid.local`,n=(typeof window<`u`&&typeof window.__SEAMS_EMAIL_OTP_WORKER_URL__==`string`?String(window.__SEAMS_EMAIL_OTP_WORKER_URL__):``)||`/sdk/workers/email-otp.worker.js`;return/^https?:\/\//i.test(n)?n:new URL(n,t).toString()}function cw(e){let t=e?.baseOrigin||rp()||(typeof window<`u`?window.location.origin:``)||`https://invalid.local`,n=(typeof window<`u`&&typeof window.__SEAMS_WALLET_CUSTODY_CEREMONY_WORKER_URL__==`string`?String(window.__SEAMS_WALLET_CUSTODY_CEREMONY_WORKER_URL__):``)||`/sdk/workers/wallet-custody-ceremony.worker.js`;return/^https?:\/\//i.test(n)?n:new URL(n,t).toString()}const lw={AttachDerivationToPresign:`attach_ecdsa_derivation_to_presign_v1`,AttachLinkedHolderToPresign:`attach_linked_holder_to_ecdsa_presign_v1`,AttachPresignToOnline:`attach_ecdsa_presign_to_online_v1`};`A`.repeat(43);function uw(e){return Math.max(0,Math.round(performance.now()-e))}function dw(e){throw Error(`Unsupported Email OTP Yao prewarm result: ${String(e)}`)}function fw(e){throw Error(`Unsupported Email OTP Yao prewarm request: ${String(e)}`)}const pw=[`nearSigner`,`ecdsaDerivationClient`,`ecdsaPresignClient`,`ecdsaOnlineClient`,`evmCrypto`,`tempoSigner`,`emailOtp`,`walletCustodyCeremony`];function mw(e,t,n){console.warn(`[WorkerTransport] operation timed out; resetting worker`,{kind:e,type:String(t),timeoutMs:n})}function hw(e){return pe(e,32,`signer worker request IDs`)}function gw(e){return e?.type===Ku.WORKER_READY||e?.ready===!0}function _w(e){return e===`nearSigner`||e===`ecdsaDerivationClient`||e===`evmCrypto`||e===`tempoSigner`}function vw(){let e=()=>{},t=()=>{},n=new Promise((n,r)=>{e=n,t=r});return n.catch(()=>{}),{promise:n,resolve:e,reject:t,settled:!1}}function yw(e){e.settled||(e.settled=!0,e.resolve())}function bw(e,t){e.settled||(e.settled=!0,e.reject(t))}function xw(e){return!!e&&typeof e==`object`&&typeof e.id==`string`&&e.progress===!0}function Sw(e){return!!e&&typeof e==`object`&&typeof e.id==`string`&&e.ok===!0&&`result`in e}function Cw(e){return!!e&&typeof e==`object`&&typeof e.id==`string`&&e.ok===!1&&typeof e.error==`string`}function ww(e){return!!e&&typeof e==`object`&&typeof e.id==`string`&&e.ok===!0&&`result`in e}function Tw(e){return!!e&&typeof e==`object`&&typeof e.id==`string`&&e.ok===!1&&typeof e.error==`string`}function Ew(e){return!!e&&typeof e==`object`&&typeof e.id==`string`&&e.progress===!0&&`payload`in e}const Dw=new class{constructor(){this.workers=new Map,this.workerReadiness=new Map,this.pendingByKind=new Map,this.messageHandlers=new Map,this.errorHandlers=new Map,this.presignAuthorityKind=null,this.presignOnlineConnected=!1,this.ecdsaRegistrationCryptoPrewarmPromise=null,this.emailOtpYaoPrewarmPromise=null}setWorkerBaseOrigin(e){if(this.workerBaseOrigin!==e){this.workerBaseOrigin=e,this.emailOtpYaoPrewarmPromise=null;for(let e of Array.from(this.workers.keys()))this.resetWorker(e)}}async prewarmWorkers(){for(let e of pw)this.getOrCreateWorker(e);await Promise.all([this.requireWorkerReadiness(`nearSigner`),this.requireWorkerReadiness(`ecdsaDerivationClient`),this.requireWorkerReadiness(`evmCrypto`),this.requireWorkerReadiness(`tempoSigner`)])}async clearEcdsaClientWorkerState(e){switch(e.kind){case`all`:this.resetWorker(`ecdsaPresignClient`);return;case`wallet`:if(od(e.walletId),!this.workers.has(`ecdsaPresignClient`))return;await this.requestOperation({kind:`ecdsaPresignClient`,request:{type:Vu.ClearWallet,timeoutMs:2e4,payload:{walletId:e.walletId}}});return}}requireWorkerReadiness(e){let t=this.workerReadiness.get(e);if(!t)throw Error(`${e} worker readiness was not initialized`);return t.promise}async prewarmEcdsaRegistrationCrypto(){let e=this.ecdsaRegistrationCryptoPrewarmPromise;if(e)return await e;let t=this.requestEcdsaRegistrationCryptoPrewarm();this.ecdsaRegistrationCryptoPrewarmPromise=t;let n=await t;return n.kind===`failed`&&this.ecdsaRegistrationCryptoPrewarmPromise===t&&(this.ecdsaRegistrationCryptoPrewarmPromise=null),n}async requestEcdsaRegistrationCryptoPrewarm(){let e=performance.now();try{return await this.requestDerivationOperation({type:Dd.PrewarmEcdsaRegistrationCrypto,payload:{}}),{kind:`succeeded`,wasmInitMs:uw(e)}}catch{return{kind:`failed`,wasmInitMs:uw(e)}}}async prewarmEmailOtpYao(e={kind:`requested`}){switch(e.kind){case`not_requested`:return{kind:`not_requested`,elapsedMs:0,workerPrewarmMs:0,yaoWasmInitMs:0};case`requested`:break;default:return fw(e)}let t=this.emailOtpYaoPrewarmPromise;if(t)return await t;let n=this.requestEmailOtpYaoPrewarm();this.emailOtpYaoPrewarmPromise=n;let r=await n;return r.kind===`failed`&&this.emailOtpYaoPrewarmPromise===n&&(this.emailOtpYaoPrewarmPromise=null),r}async requestEmailOtpYaoPrewarm(){let e=performance.now();try{let t=await this.requestOperation({kind:`emailOtp`,request:{type:`prewarmEmailOtpRegistrationCrypto`,payload:{}}}),n=uw(e);switch(t.kind){case`succeeded`:return{kind:`succeeded`,elapsedMs:n,workerPrewarmMs:n,yaoWasmInitMs:t.elapsedMs};case`failed`:return{kind:`failed`,elapsedMs:n,workerPrewarmMs:n,yaoWasmInitMs:t.elapsedMs,failureStage:t.failureStage};default:return dw(t)}}catch{let t=uw(e);return{kind:`failed`,elapsedMs:t,workerPrewarmMs:t,yaoWasmInitMs:0,failureStage:`worker_ready`}}}async requestOperation(e){return e.kind===`nearSigner`?await this.requestNearOperation(e.request):e.kind===`ecdsaDerivationClient`?await this.requestDerivationOperation(e.request):e.kind===`ecdsaPresignClient`?(this.connectPresignAuthorityChannel(e.request),await this.requestRpcOperation(`ecdsaPresignClient`,e.request)):e.kind===`ecdsaOnlineClient`?(this.connectPresignOnlineChannel(),await this.requestRpcOperation(`ecdsaOnlineClient`,e.request)):e.kind===`evmCrypto`?await this.requestRpcOperation(`evmCrypto`,e.request):e.kind===`tempoSigner`?await this.requestRpcOperation(`tempoSigner`,e.request):e.kind===`walletCustodyCeremony`?await this.requestRpcOperation(`walletCustodyCeremony`,e.request):await this.requestRpcOperation(e.kind,e.request)}async requestNearOperation({type:e,payload:t,onEvent:n,timeoutMs:r=rw.TIMEOUTS.DEFAULT,transfer:i}){let a=this.getOrCreateWorker(`nearSigner`),o=hw(`nearSigner`);return await new Promise((s,c)=>{let l=setTimeout(()=>{this.rejectRequest(`nearSigner`,o,new rd({message:`Worker operation timed out after ${r}ms`,code:`TIMEOUT`,workerKind:`nearSigner`})),mw(`nearSigner`,e,r),this.resetWorker(`nearSigner`);try{let e=Math.round(r/1e3);window.postMessage({type:`MODAL_TIMEOUT`,payload:`Timed out after ${e}s, try again`},`*`)}catch{}},r);this.getPendingMap(`nearSigner`).set(o,{resolve:e=>s(e),reject:c,onEvent:n?e=>n(e):void 0,timeoutId:l});try{a.postMessage({id:o,type:e,payload:t},i||[])}catch(e){this.rejectRequest(`nearSigner`,o,new rd({message:`[nearSigner] failed to postMessage: ${P(e)}`,code:`WORKER_POSTMESSAGE_ERROR`,workerKind:`nearSigner`}))}})}async requestDerivationOperation({type:e,payload:t,timeoutMs:n=rw.TIMEOUTS.DEFAULT,transfer:r}){let i=this.getOrCreateWorker(`ecdsaDerivationClient`),a=hw(`ecdsaDerivationClient`);return await new Promise((o,s)=>{let c=setTimeout(()=>{this.rejectRequest(`ecdsaDerivationClient`,a,new rd({message:`Worker operation timed out after ${n}ms`,code:`TIMEOUT`,workerKind:`ecdsaDerivationClient`})),mw(`ecdsaDerivationClient`,e,n),this.resetWorker(`ecdsaDerivationClient`)},n);this.getPendingMap(`ecdsaDerivationClient`).set(a,{resolve:e=>o(e),reject:s,timeoutId:c});try{i.postMessage({id:a,type:e,payload:t},r||[])}catch(e){this.rejectRequest(`ecdsaDerivationClient`,a,new rd({message:`[ecdsaDerivationClient] failed to postMessage: ${P(e)}`,code:`WORKER_POSTMESSAGE_ERROR`,workerKind:`ecdsaDerivationClient`}))}})}async requestRpcOperation(e,t){let n=this.getOrCreateWorker(e),r=hw(e),i=Math.floor(Number(t.timeoutMs)),a=Number.isFinite(i)&&i>0?i:2e4;return await new Promise((i,o)=>{let s=setTimeout(()=>{this.rejectRequest(e,r,new rd({message:`Worker operation timed out after ${a}ms`,code:`TIMEOUT`,workerKind:e})),mw(e,t.type,a),this.resetWorker(e)},a);this.getPendingMap(e).set(r,{resolve:e=>i(e),reject:o,onEvent:t.onEvent,timeoutId:s});try{n.postMessage({id:r,type:t.type,payload:t.payload},t.transfer||[])}catch(t){this.rejectRequest(e,r,new rd({message:`[${e}] failed to postMessage: ${P(t)}`,code:`WORKER_POSTMESSAGE_ERROR`,workerKind:e}))}})}getOrCreateWorker(e){let t=this.workers.get(e);if(t)return t;let n=this.createWorker(e);_w(e)&&this.workerReadiness.set(e,vw());let r=t=>{this.handleWorkerMessage(e,t)},i=t=>{this.handleWorkerError(e,t)};return n.addEventListener(`message`,r),n.addEventListener(`error`,i),this.workers.set(e,n),this.messageHandlers.set(e,r),this.errorHandlers.set(e,i),n}connectPresignAuthorityChannel(e){if(e.type!==Vu.ListAvailable&&e.type!==Vu.SessionInit)return;let t=this.getOrCreateWorker(`ecdsaPresignClient`),n=this.parsePresignAuthorityKind(e.payload);switch(n){case`role_local_derivation_handle`:this.connectDerivationPresignChannel(t,n);return;case`linked_holder_signing_material`:this.connectDerivationPresignChannel(t,n);return;default:}}parsePresignAuthorityKind(e){if(!j(e)||!j(e.authority))throw Error(`ECDSA presign init authority is required`);switch(e.authority.kind){case`role_local_derivation_handle`:case`linked_holder_signing_material`:return e.authority.kind;default:throw Error(`ECDSA presign init authority kind is invalid`)}}createLinkedHolderPresignAuthorityPortV1(){let e=this.getOrCreateWorker(`ecdsaPresignClient`);pd();let t=new MessageChannel;return e.postMessage({kind:lw.AttachLinkedHolderToPresign,port:t.port1},[t.port1]),t.port2}connectDerivationPresignChannel(e,t){if(this.presignAuthorityKind===t)return;this.presignAuthorityKind!==null&&pd();let n=this.getOrCreateWorker(`ecdsaDerivationClient`),r=new MessageChannel,i=t===`role_local_derivation_handle`?lw.AttachDerivationToPresign:lw.AttachLinkedHolderToPresign;n.postMessage({kind:i,port:r.port1},[r.port1]),e.postMessage({kind:i,port:r.port2},[r.port2]),this.presignAuthorityKind=t}connectPresignOnlineChannel(){if(this.presignOnlineConnected)return;let e=this.getOrCreateWorker(`ecdsaPresignClient`),t=this.getOrCreateWorker(`ecdsaOnlineClient`),n=new MessageChannel;e.postMessage({kind:lw.AttachPresignToOnline,port:n.port1},[n.port1]),t.postMessage({kind:lw.AttachPresignToOnline,port:n.port2},[n.port2]),this.presignOnlineConnected=!0}createWorker(e){try{if(e===`nearSigner`){let e=ip(rw.WORKER.URL,{worker:`signer`,baseOrigin:this.workerBaseOrigin});return new Worker(e,{type:rw.WORKER.TYPE,name:rw.WORKER.NAME})}if(e===`ecdsaDerivationClient`){let e=ip(rw.ECDSA_DERIVATION_CLIENT_WORKER.URL,{worker:`ecdsaDerivationClient`,baseOrigin:this.workerBaseOrigin});return new Worker(e,{type:rw.ECDSA_DERIVATION_CLIENT_WORKER.TYPE,name:rw.ECDSA_DERIVATION_CLIENT_WORKER.NAME})}if(e===`ecdsaPresignClient`){let e=ip(rw.ECDSA_PRESIGN_CLIENT_WORKER.URL,{worker:`ecdsaPresignClient`,baseOrigin:this.workerBaseOrigin});return new Worker(e,{type:rw.ECDSA_PRESIGN_CLIENT_WORKER.TYPE,name:rw.ECDSA_PRESIGN_CLIENT_WORKER.NAME})}if(e===`ecdsaOnlineClient`){let e=ip(rw.ECDSA_ONLINE_CLIENT_WORKER.URL,{worker:`ecdsaOnlineClient`,baseOrigin:this.workerBaseOrigin});return new Worker(e,{type:rw.ECDSA_ONLINE_CLIENT_WORKER.TYPE,name:rw.ECDSA_ONLINE_CLIENT_WORKER.NAME})}if(e===`emailOtp`){let e=sw({baseOrigin:this.workerBaseOrigin});return new Worker(e,{type:`module`,name:`email-otp-worker`})}if(e===`walletCustodyCeremony`){let e=cw({baseOrigin:this.workerBaseOrigin});return new Worker(e,{type:`module`,name:`wallet-custody-ceremony-worker`})}let t=ow(e,{baseOrigin:this.workerBaseOrigin});return new Worker(t,{type:`module`,name:`${e}-worker`})}catch(t){let n=t instanceof Error?t.message:String(t);throw Error(`Failed to create ${e} worker: ${n}`)}}handleWorkerMessage(e,t){let n=t.data;if(gw(n)){if(_w(e)){let t=this.workerReadiness.get(e);t&&yw(t)}return}if(e===`nearSigner`){this.handleNearWorkerMessage(n);return}if(e===`ecdsaDerivationClient`){this.handleEcdsaDerivationWorkerMessage(n);return}if(Ew(n)){let t=this.getPendingMap(e).get(n.id);if(!t)return;t.onEvent?.(n.payload);return}if(ww(n)){this.resolveRequest(e,n.id,n.result);return}if(Tw(n)){this.rejectRequest(e,n.id,new rd({message:n.error||`[${e}] worker error`,code:n.code,coreCode:n.coreCode,workerKind:e}));return}let r=j(n)&&typeof n.id==`string`?n.id:void 0;if(r&&this.getPendingMap(e).has(r)){this.rejectRequest(e,r,new rd({message:`Malformed worker response frame for request ${r}`,code:`WORKER_PROTOCOL_ERROR`,workerKind:e}));return}this.getPendingMap(e).size!==0&&(this.rejectAllPending(e,new rd({message:`Unknown worker response frame: ${JSON.stringify(n)}`,code:`WORKER_PROTOCOL_ERROR`,workerKind:e})),this.resetWorker(e))}handleNearWorkerMessage(e){if(xw(e)){let t=this.getPendingMap(`nearSigner`).get(e.id);if(!t)return;t.onEvent?.(e.payload);return}if(Sw(e)){this.resolveNearResponse(e.id,e.result);return}if(Cw(e)){this.rejectRequest(`nearSigner`,e.id,new rd({message:e.error,code:e.code,coreCode:e.coreCode,workerKind:`nearSigner`}));return}let t=j(e)&&typeof e.id==`string`?e.id:void 0;if(t&&this.getPendingMap(`nearSigner`).has(t)){this.rejectRequest(`nearSigner`,t,new rd({message:`Malformed worker response frame for request ${t}`,code:`WORKER_PROTOCOL_ERROR`,workerKind:`nearSigner`}));return}this.getPendingMap(`nearSigner`).size!==0&&(this.rejectAllPending(`nearSigner`,new rd({message:`Unknown worker response frame: ${JSON.stringify(e)}`,code:`WORKER_PROTOCOL_ERROR`,workerKind:`nearSigner`})),this.resetWorker(`nearSigner`))}handleEcdsaDerivationWorkerMessage(e){if(ww(e)){this.resolveRequest(`ecdsaDerivationClient`,e.id,e.result);return}if(Tw(e)){this.rejectRequest(`ecdsaDerivationClient`,e.id,new rd({message:e.error||`[ecdsaDerivationClient] worker error`,code:e.code,coreCode:e.coreCode,workerKind:`ecdsaDerivationClient`}));return}let t=j(e)&&typeof e.id==`string`?e.id:void 0;if(t&&this.getPendingMap(`ecdsaDerivationClient`).has(t)){this.rejectRequest(`ecdsaDerivationClient`,t,new rd({message:`Malformed worker response frame for request ${t}`,code:`WORKER_PROTOCOL_ERROR`,workerKind:`ecdsaDerivationClient`}));return}this.getPendingMap(`ecdsaDerivationClient`).size!==0&&(this.rejectAllPending(`ecdsaDerivationClient`,new rd({message:`Unknown worker response frame: ${JSON.stringify(e)}`,code:`WORKER_PROTOCOL_ERROR`,workerKind:`ecdsaDerivationClient`})),this.resetWorker(`ecdsaDerivationClient`))}resolveNearResponse(e,t){this.getPendingMap(`nearSigner`).get(e)&&this.resolveRequest(`nearSigner`,e,t)}handleWorkerError(e,t){let n=new rd({message:`[${e}] worker runtime error: ${t.message||`unknown error`}`,code:`WORKER_RUNTIME_ERROR`,workerKind:e});if(_w(e)){let t=this.workerReadiness.get(e);t&&bw(t,n)}this.rejectAllPending(e,n),this.resetWorker(e)}getPendingMap(e){let t=this.pendingByKind.get(e);if(t)return t;let n=new Map;return this.pendingByKind.set(e,n),n}resolveRequest(e,t,n){let r=this.getPendingMap(e).get(t);r&&(this.clearRequest(e,t),r.resolve(n))}rejectRequest(e,t,n){let r=this.getPendingMap(e).get(t);r&&(this.clearRequest(e,t),r.reject(n))}rejectAllPending(e,t){let n=Array.from(this.getPendingMap(e).keys());for(let r of n)this.rejectRequest(e,r,t)}clearRequest(e,t){let n=this.getPendingMap(e).get(t);n&&(n.timeoutId&&clearTimeout(n.timeoutId),this.getPendingMap(e).delete(t))}resetWorker(e){e===`ecdsaDerivationClient`?(this.presignAuthorityKind=null,this.resetWorker(`ecdsaPresignClient`)):e===`ecdsaPresignClient`?(this.presignAuthorityKind=null,this.presignOnlineConnected=!1,this.resetWorker(`ecdsaOnlineClient`),this.terminateWorkerOnly(`ecdsaDerivationClient`)):e===`ecdsaOnlineClient`&&(this.presignOnlineConnected=!1),(e===`ecdsaDerivationClient`||e===`ecdsaPresignClient`||e===`ecdsaOnlineClient`)&&pd(),this.terminateWorkerOnly(e)}terminateWorkerOnly(e){let t=this.workers.get(e),n=this.readinessForWorker(e);if(!t){n&&(bw(n,Error(`${e} worker was reset`)),this.deleteWorkerReadiness(e));return}this.rejectAllPending(e,Error(`${e} worker was reset`)),n&&(bw(n,Error(`${e} worker was reset`)),this.deleteWorkerReadiness(e));let r=this.messageHandlers.get(e),i=this.errorHandlers.get(e);r&&t.removeEventListener(`message`,r),i&&t.removeEventListener(`error`,i),t.terminate(),this.workers.delete(e),this.messageHandlers.delete(e),this.errorHandlers.delete(e),e===`walletCustodyCeremony`&&Wt()}readinessForWorker(e){if(_w(e))return this.workerReadiness.get(e)}deleteWorkerReadiness(e){_w(e)&&this.workerReadiness.delete(e)}};function Ow(){return Dw}function kw(e){let t=String(e.metadata?.walletId||``).trim();if(!t)return null;try{return R(t)}catch{return null}}function Aw(e){let t=[],n=new Set;for(let r of e){let e=kw(r);if(!e)continue;let i=String(e);n.has(i)||(n.add(i),t.push(e))}return t}async function jw(e){let t=Aw(await e.store.listAccountSignersByProfile({profileId:e.profileId,status:`active`}).catch(()=>[]));return t.length===1?t[0]:null}var Mw=class{constructor(e){this.deps=e,this.confirmationConfigChangeListeners=new Set,this.currentWalletChangeListeners=new Set,this.confirmationConfig=wl,this.subscribeToIndexedDBChanges()}onConfirmationConfigChange(e){return this.confirmationConfigChangeListeners.add(e),()=>{this.confirmationConfigChangeListeners.delete(e)}}onCurrentWalletChange(e){return this.currentWalletChangeListeners.add(e),()=>{this.currentWalletChangeListeners.delete(e)}}notifyConfirmationConfigChange(e){if(this.confirmationConfigChangeListeners.size!==0)for(let t of this.confirmationConfigChangeListeners)t(e)}notifyCurrentWalletChange(e){if(this.currentWalletChangeListeners.size!==0)for(let t of this.currentWalletChangeListeners)try{t(e)}catch{}}sanitizeConfirmationConfig(e){if(!e)return{};let{uiMode:t,behavior:n,autoProceedDelay:r}=e,i={};return t!=null&&(i.uiMode=t),n!=null&&(i.behavior=n),r!=null&&(i.autoProceedDelay=r),i}mergeConfirmationConfig(e,t){let n={...e,...t};return{uiMode:n.uiMode??wl.uiMode,behavior:n.behavior??wl.behavior,autoProceedDelay:n.autoProceedDelay??wl.autoProceedDelay}}async initFromIndexedDB(){await this.loadUserSettings().catch(e=>{console.warn(`[SigningEngine]: Failed to initialize user settings:`,e)})}subscribeToIndexedDBChanges(){this.unsubscribeFromIndexedDB=this.deps.store.onChange(e=>{this.handleIndexedDBEvent(e).catch(e=>{console.warn(`[SigningEngine]: Error handling IndexedDB event:`,e)})})}async handleIndexedDBEvent(e){switch(e.type){case`preferences-updated`:case`user-updated`:this.currentWalletId&&String(e.accountId)===String(this.currentWalletId)&&await this.reloadUserSettings();break;case`user-deleted`:this.currentWalletId&&String(e.accountId)===String(this.currentWalletId)&&(this.currentWalletId=void 0,this.confirmationConfig=wl);break}}destroy(){this.unsubscribeFromIndexedDB&&=(this.unsubscribeFromIndexedDB(),void 0),this.confirmationConfigChangeListeners.clear(),this.currentWalletChangeListeners.clear()}getCurrentWalletId(){return this.currentWalletId??null}getConfirmationConfig(){return this.confirmationConfig}applyWalletHostConfirmationConfig(e){let t=e?.walletId,n=e?.confirmationConfig??wl,r=this.sanitizeConfirmationConfig(n),i=this.mergeConfirmationConfig(wl,r);if(t){let e=this.currentWalletId;this.currentWalletId=t,(!e||String(e)!==String(t))&&this.notifyCurrentWalletChange(t)}this.confirmationConfig=i,this.notifyConfirmationConfigChange(this.confirmationConfig)}setCurrentWallet(e){let t=this.currentWalletId;this.currentWalletId=e,(!t||String(t)!==String(e))&&this.notifyCurrentWalletChange(e),this.deps.store.isDisabled()||this.loadSettingsForWallet(e).catch(()=>void 0)}projectCurrentWallet(e){let t=this.currentWalletId;this.setCurrentWallet(e),t&&String(t)===String(e)&&this.notifyCurrentWalletChange(e)}applyStoredPreferences(e){if(!e?.confirmationConfig)return;let t=this.sanitizeConfirmationConfig(e.confirmationConfig);this.confirmationConfig=this.mergeConfirmationConfig(this.confirmationConfig,t),this.notifyConfirmationConfigChange(this.confirmationConfig)}async loadSettingsForWallet(e){if(this.deps.store.isDisabled())return;let t=await this.deps.store.getWalletPreferences(e).catch(()=>void 0);this.applyStoredPreferences(t)}async reloadUserSettings(){let e=this.getCurrentWalletId();e&&await this.loadSettingsForWallet(e)}setConfirmBehavior(e){this.confirmationConfig=this.mergeConfirmationConfig(this.confirmationConfig,{behavior:e}),this.notifyConfirmationConfigChange(this.confirmationConfig),this.saveUserSettings()}setConfirmationConfig(e,t){let n=this.sanitizeConfirmationConfig(e);this.confirmationConfig=this.mergeConfirmationConfig(this.confirmationConfig,n),this.notifyConfirmationConfigChange(this.confirmationConfig),t?.persist!==!1&&this.saveUserSettings()}async loadUserSettings(){if(this.deps.store.isDisabled())return;let e=await mi(this.deps.store).catch(()=>null);if(!e){console.debug(`[SigningEngine]: No last user found, using default settings`);return}let t=await jw({store:this.deps.store,profileId:e.profileId});if(!t){console.debug(`[SigningEngine]: Last profile has no wallet-bound signer metadata`);return}this.currentWalletId=t,await this.loadSettingsForWallet(this.currentWalletId)}async saveUserSettings(){try{let e=this.currentWalletId??void 0;if(!e){console.warn(`[UserPreferences]: No current wallet set; keeping confirmation config in memory only`);return}await this.deps.store.updateWalletPreferences({walletId:e,preferences:{confirmationConfig:this.confirmationConfig}})}catch(e){console.warn(`[SigningEngine]: Failed to save user settings:`,e)}}};function Nw(e){let t=new YC(e.seamsWebConfigs.wallet.iframe?.rpIdOverride),n=new Mw({store:e.stores.userPreferencesStore}),r=e.seamsWebConfigs.network.chains,i=Nu({evmNonceBackend:Vf({chains:r}),nearClient:e.nearClient,nonceLaneCoordinationStore:e.stores.nonceLaneCoordinationStore}),a=Pr(r,`near`),o=Pr(r,`tempo`),s=Pr(r,`evm`),c=AC({signingSessionPersistenceMode:e.seamsWebConfigs.signing.sessionPersistenceMode,thresholdEcdsaSigningQueueByKey:e.thresholdEcdsaSigningQueueByKey,resolveCurrentEcdsaCapabilityRuntime:e.resolveActiveEcdsaCapabilityRuntime}),l=Lx({},{touchIdPrompt:t,nearClient:e.nearClient,webauthnCredentialStore:e.stores.webauthnCredentialStore,passkeyAuthenticatorStore:e.stores.passkeyAuthenticatorStore,userPreferencesManager:n,nonceCoordinator:i,operationStepUpPreparation:Fl,nearImplicitAccountFunding:Ll,relayerUrl:e.seamsWebConfigs.network.relayer.url,chains:r,rpIdOverride:t.getRpId(),nearExplorerUrl:a,tempoExplorerUrl:o,evmExplorerUrl:s,getTheme:e.getTheme,getAppearance:e.getAppearance,loadEcdsaRoleLocalReadyRecord:e.loadEcdsaRoleLocalReadyRecord,surfaceMeasurementBinding:{kind:`disabled`}});return{touchIdPrompt:t,userPreferencesManager:n,nonceCoordinator:i,touchConfirm:l,passkeyMpcExport:tS(l.getContext()),passkeyMpcSession:c,signerWorkerManager:new nw({resolveOperationStepUpCredential:e.resolveOperationStepUpCredential,nearKeyMaterialStore:e.stores.nearKeyMaterialStore,touchIdPrompt:t,touchConfirm:l,passkeyMpcSession:c,nearClient:e.nearClient,userPreferencesManager:n,nonceCoordinator:i,relayerUrl:e.seamsWebConfigs.network.relayer.url,workerTransport:Ow(),chains:r,nearExplorerUrl:a,tempoExplorerUrl:o,evmExplorerUrl:s,getTheme:e.getTheme})}}const Pw=new Map;function Fw(e){return typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null?null:new Map(Object.entries(e))}function Iw(e,t){let n=e.get(t);if(typeof n==`string`)return n.trim()||void 0}function Lw(e){if(typeof e!=`string`)return null;let t=e.trim().toLowerCase();return t===`none`?`none`:t===`sealed_refresh_v1`?`sealed_refresh_v1`:null}function Rw(e){let t=Fw(e);if(!t)return null;let n=Lw(t.get(`mode`));if(!n)return null;if(n===`none`)return{mode:`none`};let r=Fw(t.get(`protocol`)),i=r?Iw(r,`algorithm`):void 0,a=r?Iw(r,`groupId`):void 0,o=Iw(t,`currentKeyVersion`);return i!==`shamir3pass-v2`||a!==`rfc2409-group2`||!o?null:{mode:`sealed_refresh_v1`,protocol:{algorithm:As,groupId:Ns},currentKeyVersion:o}}function zw(e){let t=Fw(e);return t&&Rw(Fw(t.get(`capabilities`))?.get(`signingSessionSeal`))||{mode:`none`}}function Bw(e){return e.signing.sessionPersistenceMode===`sealed_refresh_v1`?!(e.wallet.mode===`iframe`&&!Xl()):!1}function Vw(e){return[String(e.network.relayer.url||``).trim(),String(e.signing.sessionPersistenceMode||``).trim().toLowerCase(),As,Ns,Xl()?`wallet-host`:`app`,e.wallet.mode].join(`|`)}function Hw(e,t){let n=Number(e);return!Number.isFinite(n)||n<=0?t:Math.max(250,Math.floor(n))}function Uw(e,t){let n=Error(e);return n.code=t,n}function Ww(e){if(e.signal?.aborted)throw Uw(`Parity check aborted`,`sealed_refresh_parity_aborted`);let t=new AbortController,n=setTimeout(()=>t.abort(`timeout`),e.timeoutMs),r=()=>{try{t.abort(e.signal?.reason)}catch{}};return e.signal?.addEventListener(`abort`,r,{once:!0}),e.task(t.signal).finally(()=>{clearTimeout(n),e.signal?.removeEventListener(`abort`,r)}).catch(e=>{let n=e instanceof Error?e.message:String(e||`Unknown error`);throw t.signal.aborted?Uw(`[sealed-refresh-parity] Failed to fetch relayer well-known capabilities: ${n}`,`sealed_refresh_parity_fetch_failed`):e})}async function Gw(e){let t=String(e.relayerUrl||``).trim();if(!t)throw Uw(`[sealed-refresh-parity] Missing relayer URL for capability check`,`sealed_refresh_parity_invalid_config`);let n=e.fetchImpl||fetch.bind(globalThis),r=Hw(e.timeoutMs,8e3),i=`${t.replace(/\/+$/,``)}/.well-known/webauthn`;return await Ww({timeoutMs:r,task:async e=>{let t=await n(i,{method:`GET`,headers:{Accept:`application/json`},signal:e});if(!t.ok)throw Uw(`[sealed-refresh-parity] Well-known endpoint returned HTTP ${t.status}`,`sealed_refresh_parity_http_error`);let r={};try{r=await t.json()}catch{throw Uw(`[sealed-refresh-parity] Well-known response is not valid JSON`,`sealed_refresh_parity_invalid_payload`)}return zw(r)}})}async function Kw(e){if(!Bw(e.configs))return;let t=Vw(e.configs),n=Pw.get(t);if(n){await n;return}let r=(async()=>{let t=String(e.configs.network.relayer.url||``).trim(),n=e.configs.signing.sessionPersistenceMode,r=await Gw({relayerUrl:t,fetchImpl:e.fetchImpl,timeoutMs:e.timeoutMs}),i=[];if(r.mode!==n&&i.push(`mode`),r.mode===`sealed_refresh_v1`&&r.protocol.algorithm!==`shamir3pass-v2`&&i.push(`algorithm`),r.mode===`sealed_refresh_v1`&&r.protocol.groupId!==`rfc2409-group2`&&i.push(`groupId`),i.length>0)throw Uw(`[sealed-refresh-parity] Client/server mismatch for fields: ${i.join(`, `)}. client={mode:${n},algorithm:${As},groupId:${Ns}} server={mode:${r.mode}${r.mode===`sealed_refresh_v1`?`,algorithm:${r.protocol.algorithm},groupId:${r.protocol.groupId}`:``}}`,`sealed_refresh_parity_mismatch`)})().catch(e=>{throw Pw.delete(t),e});Pw.set(t,r),await r}function qw(e,t){let n=String(e??``).trim();if(!n)throw Error(`${t} is required`);return n}function Jw(e){return{kind:e.kind,scope:{lifecycle_id:e.scope.lifecycle_id,root_share_epoch:e.scope.root_share_epoch,account_id:e.scope.account_id,threshold_session_id:e.scope.threshold_session_id,signer_set_id:e.scope.signer_set_id,signing_worker_id:e.scope.signing_worker_id,material_activation:e.scope.material_activation},applicationBinding:{wallet_id:e.applicationBinding.wallet_id,near_ed25519_signing_key_id:e.applicationBinding.near_ed25519_signing_key_id,signing_root_id:e.applicationBinding.signing_root_id,key_creation_signer_slot:e.applicationBinding.key_creation_signer_slot},participantIds:[e.participantIds[0],e.participantIds[1]],registeredPublicKey:e.registeredPublicKey.slice(),signingWorkerVerifyingShare:e.signingWorkerVerifyingShare.slice(),stateEpoch:e.stateEpoch,transcript:e.transcript.slice(),activeCapabilityBinding:[...e.activeCapabilityBinding],materialActivation:e.materialActivation}}function Yw(e){if(e.kind===`active`)return e.handle;throw Error(`Wallet custody Ed25519 active client is disposed`)}function Xw(e){e.workerContext.requestWorkerOperation({kind:`emailOtp`,request:{type:`disposeEmailOtpEd25519YaoActiveClient`,payload:{activeClientHandle:e.handle}}}).catch(()=>void 0)}async function Zw(e){return(await e.workerContext.requestWorkerOperation({kind:`emailOtp`,request:{type:`disposeEmailOtpEd25519YaoActiveClient`,payload:{activeClientHandle:qw(e.activeClientHandle,`activeClientHandle`)}}})).removed}var Qw=class{constructor(e,t,n){this.workerContext=e,this.lifecycle={kind:`active`,handle:qw(t,`activeClientHandle`)},this.activeMetadata=Jw(n)}async createSigningShare(e){return await this.workerContext.requestWorkerOperation({kind:`emailOtp`,request:{type:`createEmailOtpEd25519YaoSigningShare`,payload:{activeClientHandle:Yw(this.lifecycle),input:e}}})}metadata(){return Jw(this.activeMetadata)}status(){return this.lifecycle.kind===`active`?{kind:`active`}:{kind:`disposed`}}dispose(){if(this.lifecycle.kind!==`active`)return;let e=this.lifecycle.handle;this.lifecycle={kind:`disposed`},Xw({workerContext:this.workerContext,handle:e})}};function $w(e,t){let n=String(e??``).trim();if(!n)throw Error(`${t} is required`);return n}function eT(e,t){let n=Number(e);if(!Number.isSafeInteger(n)||n<1)throw Error(`${t} must be a positive integer`);return n}function tT(e){let t=s(e);if(!t.ok)throw Error(`thresholdSessionId is invalid`);return t.value}function nT(e){let t=e.bootstrap.session,n=e.bootstrap.capability;if(!t.walletId||!t.walletSessionId||!t.quotaId||!t.thresholdSessionId)throw Error(`Wallet custody Ed25519 bootstrap Wallet Session binding is invalid`);if(e.operationCredential.walletSessionId!==t.walletSessionId)throw Error(`Wallet custody Ed25519 operation credential does not identify the bootstrap session`);let r=String(e.identity.walletId);if(String(t.walletId)!==r||t.nearAccountId!==String(e.identity.nearAccountId)||t.thresholdSessionId!==e.identity.expectedThresholdSessionId||n.applicationBinding.wallet_id!==r||n.applicationBinding.key_creation_signer_slot!==e.identity.signerSlot||n.nearAccountId!==String(e.identity.nearAccountId)||n.lifecycle.accountId!==r||n.lifecycle.thresholdSessionId!==e.identity.expectedThresholdSessionId||n.lifecycle.signerSetId!==String(Ws(e.identity.signerSlot))||`ed25519:${zi(Uint8Array.from(n.registeredPublicKey))}`!==e.identity.expectedOperationalPublicKey)throw Error(`Wallet custody Ed25519 bootstrap identity changed`)}async function rT(e){let t=e.bootstrap.session,n=t.authorityScope;if(n.kind!==`email_otp`)throw Error(`Wallet custody Ed25519 bootstrap returned another authority kind`);let r=$w(e.providerSubject,`providerSubject`);if(n.providerUserId!==r)throw Error(`Wallet custody Ed25519 bootstrap provider subject changed`);if(e.authority.walletId!==t.walletId)throw Error(`Wallet custody Ed25519 Wallet Session authority changed wallets`);let i=Qe({walletId:String(t.walletId),nearAccountId:t.nearAccountId,nearEd25519SigningKeyId:t.nearEd25519SigningKeyId,walletSessionId:t.walletSessionId,authorizationId:t.authorizationId,quotaId:t.quotaId,thresholdSessionId:t.thresholdSessionId,remainingUses:t.remainingUses,expiresAtMs:t.expiresAtMs,runtimePolicyScope:t.runtimePolicyScope,signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion,routerAbNormalSigning:t.routerAbNormalSigning,walletSessionToken:e.operationCredential.token,nowMs:Date.now()});if(!i.ok)throw Error(`Wallet custody Ed25519 Wallet Session is unusable (${i.reason})`);return Mt({walletId:t.walletId,nearAccountId:Hi(t.nearAccountId),nearEd25519SigningKeyId:Ho(t.nearEd25519SigningKeyId),providerSubjectId:r,signerSlot:eT(e.bootstrap.capability.applicationBinding.key_creation_signer_slot,`server capability signerSlot`),relayerUrl:$w(e.relayerUrl,`relayerUrl`),authority:e.authority,signingWalletSession:i.value})}function iT(e,t){return{activeClient:t,facts:{thresholdSessionId:e.thresholdSessionId,signer:e.signingLane.identity.signer,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,routerAbNormalSigning:e.routerAbNormalSigning,runtimePolicyScope:e.runtimePolicyScope,relayerUrl:e.relayerUrl}}}async function aT(e){let t={walletId:e.walletSession.walletId,nearAccountId:$w(e.nearAccountId,`nearAccountId`),signerSlot:eT(e.signerSlot,`signerSlot`),expectedOperationalPublicKey:$w(e.expectedOperationalPublicKey,`expectedOperationalPublicKey`),expectedThresholdSessionId:$w(e.expectedThresholdSessionId,`expectedThresholdSessionId`)};if(nT({bootstrap:e.bootstrap,identity:t,operationCredential:e.operationCredential}),e.metadata.applicationBinding.wallet_id!==String(e.walletSession.walletId)||e.metadata.applicationBinding.key_creation_signer_slot!==t.signerSlot||e.metadata.scope.threshold_session_id!==t.expectedThresholdSessionId||!b(e.metadata.materialActivation,e.bootstrap.capability.materialActivation))throw Error(`Wallet custody Ed25519 active client metadata changed`);let n=await rT({bootstrap:e.bootstrap,operationCredential:e.operationCredential,providerSubject:e.providerSubject,relayerUrl:e.relayerUrl,authority:e.authority}),r=new Qw(e.workerContext,e.activeClientHandle,e.metadata);try{let i=iT(n,r),a=await e.activateCapability(i);if(String(a.walletId)!==String(t.walletId)||String(a.nearAccountId)!==t.nearAccountId||!b(a.materialActivation,e.metadata.materialActivation))throw Error(`Wallet custody Ed25519 active client identity changed during activation`);return r=null,{thresholdSessionId:tT(n.thresholdSessionId),material:i,walletSessionState:n}}finally{r?.dispose()}}function oT(e,t){let n=e.trim();if(!n)throw Error(`Wallet custody Ed25519 projection requires ${t}`);return n}async function sT(e,t,n,r){let i=String(t.walletId),a=oT(String(n),`providerSubject`),o=(await e.listPublicCapabilityReferences()).filter(e=>String(e.walletId)===i&&b(e.materialActivation,r));if(o.length===0)return null;if(o.length!==1||!o[0])throw Error(`Wallet custody Ed25519 requires one exact public capability reference`);let s=o[0],c=(await e.listUsers()).filter(e=>String(e.walletId)===i&&String(e.nearAccountId)===String(s.nearAccountId));if(c.length!==1||!c[0])throw Error(`Wallet custody Ed25519 requires one exact persisted signer projection`);return{identity:s,user:c[0],providerSubject:a}}function cT(e){if(!e.authorization)throw Error(`Available Ed25519 lane requires Wallet Session authorization`);return Rc({signer:Bc({walletId:e.walletId,nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:e.signerSlot}),auth:e.auth,walletSessionId:e.authorization.operationCredential.walletSessionId,quotaId:e.authorization.session.quotaId,thresholdSessionId:e.thresholdSessionId})}function lT(e){let t=e.signer;return JSON.stringify([String(t.account.wallet.walletId),String(t.account.nearAccountId),String(t.nearEd25519SigningKeyId),t.signerSlot,Zs(e.auth),String(e.thresholdSessionId)])}function uT(e){return{kind:`near_ed25519_material_identity`,signer:Bc({walletId:e.walletId,nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:e.signerSlot}),auth:e.auth,thresholdSessionId:Xs.thresholdEd25519Session(e.thresholdSessionId)}}function dT(e){return{kind:`near_ed25519_material_identity`,signer:e.signer,auth:e.auth,thresholdSessionId:e.thresholdSessionId}}function fT(e){switch(e.kind){case`exact_lane`:return{kind:`near_ed25519_material_identity`,signer:e.laneIdentity.signer,auth:e.laneIdentity.auth,thresholdSessionId:e.laneIdentity.thresholdSessionId};case`export_exact_lane`:return dT(e.laneIdentity);case`material_identity`:return e.materialIdentity;default:return hT(e)}}function pT(e,t){if(!Mf(e)||e.curve!==`ed25519`)return!1;let n=fT(t),r=n.signer;if(String(e.walletId)!==String(r.account.wallet.walletId)||String(e.nearAccountId)!==String(r.account.nearAccountId)||e.signerSlot!==r.signerSlot||String(e.thresholdSessionId)!==n.thresholdSessionId)return!1;switch(t.kind){case`exact_lane`:return e.authorizationState===`authorized`&&Uc(cT(e),t.laneIdentity);case`export_exact_lane`:return lT(uT(e))===lT(n)&&b(e.materialActivation,t.materialActivation);case`material_identity`:return lT(uT(e))===lT(n);default:return hT(t)}}function mT(e){switch(e.kind){case`exact_lane`:return JSON.stringify([e.kind,zc(e.laneIdentity)]);case`export_exact_lane`:return JSON.stringify([e.kind,lT(dT(e.laneIdentity)),Lf(e.materialActivation)]);case`material_identity`:return JSON.stringify([e.kind,lT(e.materialIdentity)]);default:return hT(e)}}function hT(e){throw Error(`Unknown Ed25519 capability rehydration subject: ${String(e)}`)}function gT(e){return e.binding.kind===`ed25519_yao_client_root_v1`}function _T(e){if(!gT(e))throw Error(`[SigningEngine][ed25519-export] export envelope has the wrong secret kind`);return e}function vT(e,t,n){let r=Object.keys(e).sort(),i=[...t].sort();if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`${n} fields are invalid`)}function yT(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<1)throw Error(`${t} is invalid`);return e}function bT(e){if(!Array.isArray(e)||e.length!==2||!Number.isSafeInteger(e[0])||!Number.isSafeInteger(e[1])||Number(e[0])<1||Number(e[1])<1||e[0]===e[1])throw Error(`Ed25519 export bootstrap participantIds are invalid`);return[Number(e[0]),Number(e[1])]}async function xT(e){let t=e.authorization.operationCredential,n=e.authorization.status,r=e.authorization.record.authorizationId,i=e.subject.signer,a=e.source;if(e.authorization.record.walletId!==i.account.wallet.walletId||e.authorization.record.authMethodId!==e.authorization.selectedAuthMethod.walletAuthMethodId||e.authorization.factorAuthority.factor.providerUserId!==e.subject.auth.providerSubjectId||!a.signingWorkerId||a.participantIds.length!==2||!a.registeredPublicKeyB64u)throw Error(`[SigningEngine][ed25519-export] sealed custody identity mismatch`);let o=_o({kind:`router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1`,walletId:String(i.account.wallet.walletId),nearAccountId:String(i.account.nearAccountId),nearEd25519SigningKeyId:String(i.nearEd25519SigningKeyId),signerSlot:i.signerSlot,thresholdSessionId:e.subject.thresholdSessionId,signingWorkerId:a.signingWorkerId,participantIds:a.participantIds});if(!o.ok)throw Error(o.message);let c=await e.fetch(`${new URL(e.relayerUrl).origin}${so}`,{method:`POST`,headers:{Authorization:`Bearer ${t.token}`,"Content-Type":`application/json`},body:JSON.stringify(o.value)}),l=await c.json().catch(()=>null);if(!c.ok){let e=l&&typeof l==`object`?l:null;throw Error(`[SigningEngine][ed25519-export] capability bootstrap failed (HTTP ${c.status}): ${String(e?.message||`invalid response`)}`)}let u=E(l,`Ed25519 export bootstrap`);if(vT(u,[`kind`,`walletId`,`nearAccountId`,`nearEd25519SigningKeyId`,`signerSlot`,`thresholdSessionId`,`walletSessionId`,`quotaId`,`signingWorkerId`,`thresholdExpiresAtMs`,`participantIds`,`runtimePolicyScope`,`routerAbNormalSigning`,`capability`],`Ed25519 export bootstrap`),u.kind!==`router_ab_ed25519_yao_v2_session_bootstrap_v1`)throw Error(`Ed25519 export bootstrap kind is invalid`);let d=O(u.walletId,`bootstrap.walletId`),f=O(u.nearAccountId,`bootstrap.nearAccountId`),p=O(u.nearEd25519SigningKeyId,`bootstrap.nearEd25519SigningKeyId`),m=s(u.thresholdSessionId),h=br(u.walletSessionId),g=vr(u.quotaId),_=e.authorization.factorAuthority,v=Tn(u.runtimePolicyScope),y=vn(v),x=js(u.routerAbNormalSigning),S={kind:`router_ab_ed25519_yao_active_capability_v1`,...mt(u.capability)},C=bT(u.participantIds),w=F(Uint8Array.from(S.registeredPublicKey));if(!m.ok||!h.ok||!g.ok||!y||!x||d!==String(i.account.wallet.walletId)||f!==String(i.account.nearAccountId)||p!==String(i.nearEd25519SigningKeyId)||m.value!==S.lifecycle.thresholdSessionId||h.value!==t.walletSessionId||g.value!==e.authorization.record.quotaId||yT(u.signerSlot,`bootstrap.signerSlot`)!==i.signerSlot||O(u.signingWorkerId,`bootstrap.signingWorkerId`)!==a.signingWorkerId||C[0]!==a.participantIds[0]||C[1]!==a.participantIds[1]||_.factor.providerUserId!==e.subject.auth.providerSubjectId||w!==a.registeredPublicKeyB64u||!b(S.materialActivation,e.expectedMaterialActivation))throw Error(`[SigningEngine][ed25519-export] capability bootstrap identity mismatch`);return{emailHashHex:_.verifier.emailHashHex,bootstrap:{kind:`router_ab_ed25519_yao_email_otp_recovery_v1`,session:{walletId:i.account.wallet.walletId,nearAccountId:f,nearEd25519SigningKeyId:p,authorityScope:{kind:`email_otp`,provider:_.factor.provider,providerUserId:_.factor.providerUserId},thresholdSessionId:m.value,authorizationId:r,walletSessionId:h.value,quotaId:g.value,expiresAtMs:Math.min(yT(u.thresholdExpiresAtMs,`bootstrap.thresholdExpiresAtMs`),n.expiresAtMs),participantIds:C,remainingUses:n.remainingUses,signingRootId:y.signingRootId,signingRootVersion:v.signingRootVersion,runtimePolicyScope:v,routerAbNormalSigning:x},capability:S}}}async function ST(e){let t=ET({subject:e.subject,expectedMaterialActivation:e.expectedMaterialActivation,result:e.authorization});return(await xT({subject:e.subject,authorization:t,source:e.source,expectedMaterialActivation:e.expectedMaterialActivation,relayerUrl:e.relayerUrl,fetch:e.fetch})).bootstrap}async function CT(e){let t=e.authorization.operationCredential,n=e.subject.signer;if(e.authorization.record.walletId!==n.account.wallet.walletId||e.authorization.record.authMethodId!==e.authorization.selectedAuthMethod.walletAuthMethodId||e.authorization.factorAuthority.factor.providerUserId!==e.subject.auth.providerSubjectId)throw Error(`[SigningEngine][ed25519-export] linked Wallet Session is unavailable`);let r=_o({kind:`router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1`,walletId:String(n.account.wallet.walletId),nearAccountId:String(n.account.nearAccountId),nearEd25519SigningKeyId:String(n.nearEd25519SigningKeyId),signerSlot:n.signerSlot,thresholdSessionId:e.subject.thresholdSessionId,signingWorkerId:e.source.signingWorkerId,participantIds:e.source.participantIds});if(!r.ok)throw Error(r.message);let i=await e.fetch(`${new URL(e.relayerUrl).origin}${so}`,{method:`POST`,headers:{Authorization:`Bearer ${t.token}`,"Content-Type":`application/json`},body:JSON.stringify(r.value)}),a=await i.json().catch(()=>null);if(!i.ok){let e=a&&typeof a==`object`?a:null;throw Error(`[SigningEngine][ed25519-export] linked capability bootstrap failed (HTTP ${i.status}): ${String(e?.message||`invalid response`)}`)}let o=E(a,`linked Ed25519 export bootstrap`);if(vT(o,[`kind`,`walletId`,`nearAccountId`,`nearEd25519SigningKeyId`,`signerSlot`,`thresholdSessionId`,`walletSessionId`,`quotaId`,`signingWorkerId`,`thresholdExpiresAtMs`,`participantIds`,`runtimePolicyScope`,`routerAbNormalSigning`,`capability`],`linked Ed25519 export bootstrap`),o.kind!==`router_ab_ed25519_yao_v2_session_bootstrap_v1`)throw Error(`linked Ed25519 export bootstrap kind is invalid`);let c=s(o.thresholdSessionId),l=br(o.walletSessionId),u=vr(o.quotaId),d=Tn(o.runtimePolicyScope),f=js(o.routerAbNormalSigning),p={kind:`router_ab_ed25519_yao_active_capability_v1`,...mt(o.capability)},m=bT(o.participantIds),h=F(Uint8Array.from(p.registeredPublicKey));if(!c.ok||!l.ok||!u.ok||!d||!f||O(o.walletId,`bootstrap.walletId`)!==String(n.account.wallet.walletId)||O(o.nearAccountId,`bootstrap.nearAccountId`)!==String(n.account.nearAccountId)||O(o.nearEd25519SigningKeyId,`bootstrap.nearEd25519SigningKeyId`)!==String(n.nearEd25519SigningKeyId)||yT(o.signerSlot,`bootstrap.signerSlot`)!==n.signerSlot||c.value!==p.lifecycle.thresholdSessionId||l.value!==t.walletSessionId||u.value!==e.authorization.record.quotaId||O(o.signingWorkerId,`bootstrap.signingWorkerId`)!==e.source.signingWorkerId||m[0]!==e.source.participantIds[0]||m[1]!==e.source.participantIds[1]||h!==e.source.registeredPublicKeyB64u||!b(p.materialActivation,e.expectedMaterialActivation))throw Error(`[SigningEngine][ed25519-export] linked capability identity mismatch`);return p}function wT(e,t){let n=0;for(let r of e)switch(r.kind){case`export_keys`:r.keyFamily===`ed25519`&&b(r.materialActivation,t)&&(n+=1);break;case`sign`:case`link_devices`:case`revoke_devices`:break;default:break}return n}function TT(e){let{authorization:t}=e,n=t.selectedAuthority,r=t.selectedAuthMethod,i=t.factorAuthority,a=t.record,o=t.operationCredential,s=t.status,c=s.status===`active`&&s.quotaLifecycle===`active`&&s.remainingUses>0||s.status===`exhausted`&&s.quotaLifecycle===`exhausted`&&s.remainingUses===0;if(n.state!==`active`||n.walletId!==e.subject.signer.account.wallet.walletId||r.status!==`active`||r.walletId!==e.subject.signer.account.wallet.walletId||r.walletAuthorityId!==n.authorityId||i.walletId!==e.subject.signer.account.wallet.walletId||i.bindingId!==r.walletAuthMethodId||i.verifier.emailHashHex!==r.emailHashHex||i.factor.providerUserId!==e.subject.auth.providerSubjectId||a.walletId!==e.subject.signer.account.wallet.walletId||a.authorityId!==n.authorityId||a.authMethodId!==r.walletAuthMethodId||String(a.authorityDigestB64u)!==String(n.authorityDigestB64u)||a.authorityRevocationEpoch!==n.revocationEpoch||!c||s.walletSessionId!==o.walletSessionId||s.quotaId!==a.quotaId||!ar(s.authorization,a)||o.walletSessionId.trim().length===0||o.token.trim().length===0||s.expiresAtMs<=Date.now()||wT(a.capabilitySubjects,e.expectedMaterialActivation)!==1)throw Error(`[SigningEngine][ed25519-export] exact Email OTP authorization identity mismatch`)}function ET(e){switch(e.result.kind){case`found`:return TT({subject:e.subject,expectedMaterialActivation:e.expectedMaterialActivation,authorization:e.result.authorization}),e.result.authorization;case`missing`:throw Error(`[SigningEngine][ed25519-export] exact Email OTP authorization is missing`);case`upgrade_required`:throw Error(`[SigningEngine][ed25519-export] exact Email OTP authorization requires an upgrade`);case`corrupt`:throw Error(`[SigningEngine][ed25519-export] exact Email OTP authorization is corrupt`);case`persistence_unavailable`:throw Error(`[SigningEngine][ed25519-export] exact Email OTP authorization persistence is unavailable`);case`exhausted`:throw Error(`[SigningEngine][ed25519-export] exact Email OTP authorization is exhausted`);case`expired`:throw Error(`[SigningEngine][ed25519-export] exact Email OTP authorization is expired`);case`superseded`:throw Error(`[SigningEngine][ed25519-export] exact Email OTP authorization is superseded`);case`authority_unavailable`:throw Error(`[SigningEngine][ed25519-export] exact Email OTP authority is unavailable`);case`method_unavailable`:throw Error(`[SigningEngine][ed25519-export] exact Email OTP method is unavailable`);case`capability_unavailable`:throw Error(`[SigningEngine][ed25519-export] exact Email OTP export capability is unavailable`);default:return e.result}}function DT(e){if(e.material.activeClient.status().kind!==`active`)throw Error(`[SigningEngine][ed25519-export] wallet custody client is inactive`);let t=e.material.activeClient.metadata(),n=e.subject.signer;if(!b(t.materialActivation,e.expectedMaterialActivation)||e.material.facts.signer.account.wallet.walletId!==n.account.wallet.walletId||String(e.material.facts.signer.account.nearAccountId)!==String(n.account.nearAccountId)||e.material.facts.signer.nearEd25519SigningKeyId!==n.nearEd25519SigningKeyId||e.material.facts.signer.signerSlot!==n.signerSlot||t.applicationBinding.wallet_id!==n.account.wallet.walletId||t.applicationBinding.near_ed25519_signing_key_id!==n.nearEd25519SigningKeyId||t.applicationBinding.key_creation_signer_slot!==n.signerSlot)throw Error(`[SigningEngine][ed25519-export] wallet custody client changed the exact lane`);let r=s(t.scope.threshold_session_id);if(!r.ok)throw Error(`[SigningEngine][ed25519-export] threshold session id is invalid: ${r.error.message}`);return{kind:`router_ab_ed25519_yao_active_capability_v1`,materialActivation:t.materialActivation,activeCapabilityBinding:t.activeCapabilityBinding,registeredPublicKey:[...t.registeredPublicKey],nearAccountId:String(n.account.nearAccountId),applicationBinding:t.applicationBinding,runtimePolicyScope:e.material.facts.runtimePolicyScope,participantIds:t.participantIds,lifecycle:{lifecycleId:t.scope.lifecycle_id,rootShareEpoch:t.scope.root_share_epoch,accountId:t.scope.account_id,thresholdSessionId:r.value,signerSetId:t.scope.signer_set_id,signingWorkerId:t.scope.signing_worker_id},stateEpoch:Number(t.stateEpoch),registrationContinuity:{kind:`recovery`,activationTranscript:[...t.transcript]}}}async function OT(e){let t=e.subject.signer.account.wallet.walletId,n=ET({subject:e.subject,expectedMaterialActivation:e.expectedMaterialActivation,result:await e.readExactWalletSessionAuthorization({subject:e.subject,expectedMaterialActivation:e.expectedMaterialActivation})}),r=e.resolveActiveCapability(t,e.subject.signer.account.nearAccountId,e.expectedMaterialActivation),i=r?DT({subject:e.subject,expectedMaterialActivation:e.expectedMaterialActivation,material:r}):null,a=e.resolveEd25519YaoClientRootEnvelope?await e.resolveEd25519YaoClientRootEnvelope({subject:e.subject,capability:i,selectedMaterialActivation:e.expectedMaterialActivation}):null,o=a&&`envelope`in a?a.envelope:a,s=i;if(a&&`envelope`in a&&(s=await CT({subject:e.subject,authorization:n,source:a.source,expectedMaterialActivation:a.source.materialActivation,relayerUrl:e.relayerUrl,fetch:e.fetch})),o){if(!s)throw Error(`[SigningEngine][ed25519-export] Ed25519 export-root capability is unavailable`);return{kind:`wallet_custody_ed25519_export_context_v1`,lane:e.subject,authorization:n,material:{kind:`sealed_export_root`,materialActivation:s.materialActivation,capability:s,exportRootEnvelope:_T(o)}}}if(r){if(!i)throw Error(`[SigningEngine][ed25519-export] active Email OTP capability is unavailable`);return{kind:`wallet_custody_ed25519_export_context_v1`,lane:e.subject,authorization:n,material:{kind:`active_capability`,materialActivation:e.expectedMaterialActivation,capability:i}}}let c=await e.loadWalletCustodyMaterial();if(c.kind!==`found`)throw Error(`[SigningEngine][ed25519-export] sealed wallet custody material is unavailable`);let l=await xT({subject:e.subject,authorization:n,source:c.material.binding,expectedMaterialActivation:e.expectedMaterialActivation,relayerUrl:e.relayerUrl,fetch:e.fetch});return{kind:`wallet_custody_ed25519_export_context_v1`,lane:e.subject,authorization:n,material:{kind:`sealed_custody`,materialActivation:e.expectedMaterialActivation,capability:l.bootstrap.capability,walletCustodyEd25519Material:c.material,bootstrap:l.bootstrap,activateRecoveredCapability:t=>{if(t.operationCredential.walletSessionId!==n.operationCredential.walletSessionId||t.operationCredential.token!==n.operationCredential.token)throw Error(`[SigningEngine][ed25519-export] recovered capability credential does not match authorization`);return e.activateRecoveredCapability({activation:{...t.activation,bootstrap:l.bootstrap,emailHashHex:l.emailHashHex},operationCredential:t.operationCredential})}}}}async function kT(e){return await e.workerCtx.requestWorkerOperation({kind:`emailOtp`,request:{type:`sealEmailOtpWarmSessionMaterial`,timeoutMs:3e4,payload:{target:e.target,transport:{...e.transport,authorizationThresholdSessionId:e.authorizationThresholdSessionId}}}})}async function AT(e){return await e.worker.requestWorkerOperation({kind:`emailOtp`,request:{type:`getEmailOtpWarmSessionStatus`,timeoutMs:5e3,payload:{target:e.target}}})}async function jT(e){return await e.worker.requestWorkerOperation({kind:`emailOtp`,request:{type:`consumeEmailOtpWarmSessionUses`,timeoutMs:5e3,payload:{target:e.target,...typeof e.uses==`number`?{uses:e.uses}:{}}}})}async function MT(e){return await e.worker.requestWorkerOperation({kind:`emailOtp`,request:{type:`clearEmailOtpWarmSessionMaterial`,timeoutMs:5e3,payload:{target:e.target}}})}async function NT(e){return await e.workerCtx.requestWorkerOperation({kind:`emailOtp`,request:{type:`rehydrateEmailOtpEcdsaWarmSessionMaterial`,timeoutMs:6e4,payload:{target:e.target,sealedSecretB64u:e.sealedSecretB64u,remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs,transport:{...e.transport,authorizationThresholdSessionId:e.authorizationThresholdSessionId},restore:e.restore}}})}async function PT(e){return await e.workerCtx.requestWorkerOperation({kind:`emailOtp`,request:{type:`rehydrateEmailOtpEd25519YaoOperationMaterial`,timeoutMs:12e4,payload:e.payload}})}function FT(e){let t=e.available.capability,n=t.manifest.signer;if(!n.scope.targetMemberships.some(t=>z(t)===z(e.chainTarget)))return null;let r=n.registeredPublicFacts,i={capability:t,key:$a({walletId:n.walletId,ecdsaThresholdKeyId:t.manifest.durableMaterial.roleLocalBinding.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,participantIds:r.participantIds,thresholdOwnerAddress:r.thresholdOwnerAddress}),materialActivation:t.manifest.activation.materialActivation,publicFacts:r,curve:`ecdsa`,chainTarget:e.chainTarget,source:`canonical_capability`},a=e.available.kind===`authorized_evm_family_ecdsa_signing_capability`?e.available.authorization:null;if(Jn(t.authority)){let e={kind:`passkey`,rpId:wo(t.authority.verifier.rpId),credentialIdB64u:t.authority.factor.credentialIdB64u},o=Ma({walletId:n.walletId,publicFacts:r,authBinding:uo(e)});return a?{...i,auth:e,resolvedKey:o,state:`ready`,authorization:a,remainingUses:a.runtime.remainingUses,expiresAtMs:a.runtime.expiresAtMs}:{...i,auth:e,resolvedKey:o,state:`deferred`}}if(!$n(t.authority))return null;let o={kind:`email_otp`,providerSubjectId:t.authority.factor.providerUserId};return a?{...i,auth:o,state:`ready`,authorization:a,remainingUses:a.runtime.remainingUses,expiresAtMs:a.runtime.expiresAtMs}:{...i,auth:o,state:`deferred`}}function IT(e){throw Error(`Unsupported persisted Ed25519 auth method: ${String(e)}`)}async function LT(e,t,n){return await UT(e,{...t,ecdsaChainTargets:n,requiredEcdsaCapability:`sign`},new wt,`all`)}async function RT(e,t,n){return await UT(e,{walletId:t.walletId,authMethod:Js(t.ownerScope.auth),ownerScope:t.ownerScope,ecdsaChainTargets:t.ecdsaChainTargets,requiredEcdsaCapability:t.requiredEcdsaCapability,...t.nowMs===void 0?{}:{nowMs:t.nowMs}},n,`all`)}async function zT(e,t,n){if(t.curve===`ecdsa`){let{curve:r,...i}=t,a=new Map;for(let e of[...t.ecdsaChainTargets,...n])a.set(z(e),e);return await UT(e,{...i,ecdsaChainTargets:[...a.values()],requiredEcdsaCapability:`sign`},new wt,`ecdsa`)}let{curve:r,...i}=t;return await LT(e,i,[])}function BT(e){return String(e.thresholdSessionIds?.ed25519||``).trim().length>0}function VT(e,t){let n=e.ecdsaRestore?.chainTarget;if(!n)return!1;let r=z(n);for(let e of t)if(r===z(e))return!0;return!1}function HT(e,t){let n=[];for(let r of e)`recordKind`in r||BT(r)&&(t.length>0&&!VT(r,t)||n.push(r));return n}async function UT(e,t,n,r){let i=String(R(t.walletId)).trim();return await jf({...t,walletId:i,ecdsaChainTargets:t.ecdsaChainTargets},{listPublicCapabilityReferences:r===`all`&&e.ed25519YaoPublicCapabilityLanes?e.ed25519YaoPublicCapabilityLanes.listLanes.bind(e.ed25519YaoPublicCapabilityLanes):void 0,isPublicCapabilityActive:e.isEd25519YaoPublicCapabilityActive,readActiveWalletSessionAuthorization:r===`all`?e.readActiveWalletSessionAuthorization?.bind(null,n):void 0,listSealedRecordsForWallet:async({walletId:e,filter:n})=>{if(r===`ecdsa`)return[];let i=async n=>{let r=await Lt({walletId:e,filter:{authMethod:n,curve:`ed25519`}});switch(n){case V.passkey:return r;case V.emailOtp:{let n=HT(await Ke({walletId:e,filter:{authMethod:V.emailOtp,curve:`ecdsa`}}),t.ecdsaChainTargets);return[...r,...n]}default:return IT(n)}};if(n.authMethod)return await i(n.authMethod);let[a,o]=await Promise.all([i(V.emailOtp),i(V.passkey)]);return[...a,...o]},listCanonicalEcdsaLanesForWallet:async({walletId:r})=>{let i=[],a=new Set,o=await e.listEcdsaSigningCapabilitiesForWallet({walletId:r,chainTargets:t.ecdsaChainTargets,...t.authMethod?{authMethod:t.authMethod}:{}},n);for(let e of o)for(let n of t.ecdsaChainTargets){let t=FT({available:e,chainTarget:n});if(!t)continue;let r=Pf(t);!r||a.has(r)||(a.add(r),i.push(t))}return i},listActiveWalletAuthorityEcdsaLanesForWallet:async({walletId:n,chainTargets:r})=>(await Promise.all(r.map(async r=>{let i=await qd({ports:e.activeWalletAuthorityEcdsaRuntimeReadPorts,input:{walletId:R(n),chainTarget:r,requiredCapability:t.requiredEcdsaCapability}});return i.kind===`resolved`&&i.lane?i.lane:null}))).filter(e=>e!==null).map(Nf)})}async function WT(e){let{authMethod:t,authority:n}=e.selected;if(n.state!==`active`)return{kind:`rejected`,reason:{kind:`authority_not_active`}};if(t.status!==`active`)return{kind:`rejected`,reason:{kind:`auth_method_not_active`}};if(n.walletId!==t.walletId)return{kind:`rejected`,reason:{kind:`wallet_id_mismatch`}};if(n.authorityId!==t.walletAuthorityId)return{kind:`rejected`,reason:{kind:`authority_id_mismatch`}};if(await Io(n.signerActivations)!==n.signerActivationSetDigestB64u)return{kind:`rejected`,reason:{kind:`authority_activation_set_digest_mismatch`}};if(await zo(n)!==n.authorityDigestB64u)return{kind:`rejected`,reason:{kind:`authority_digest_mismatch`}};let r=GT(e.operation);if(!n.permissions.includes(r))return{kind:`rejected`,reason:{kind:`permission_missing`}};switch(e.operation.kind){case`near_sign`:case`near_export`:return KT(n,t);case`evm_sign`:case`evm_export`:return qT(n,t);default:return XT(e.operation)}}function GT(e){switch(e.kind){case`near_sign`:case`evm_sign`:return`sign`;case`near_export`:case`evm_export`:return`export_keys`;default:return XT(e)}}function KT(e,t){let n=JT(e.signerActivations);return n===null?{kind:`rejected`,reason:{kind:`signer_family_unavailable`}}:n.signer.walletId===e.walletId?{kind:`resolved`,value:{kind:`resolved`,keyFamily:`ed25519`,walletId:e.walletId,authorityId:e.authorityId,authMethodId:t.walletAuthMethodId,materialActivation:n.materialActivation,registeredPublicKeyB64u:n.signer.registeredPublicKeyB64u}}:{kind:`rejected`,reason:{kind:`signer_wallet_id_mismatch`}}}function qT(e,t){let n=YT(e.signerActivations);return n===null?{kind:`rejected`,reason:{kind:`signer_family_unavailable`}}:n.signer.walletId===e.walletId?{kind:`resolved`,value:{kind:`resolved`,keyFamily:`ecdsa_secp256k1`,walletId:e.walletId,authorityId:e.authorityId,authMethodId:t.walletAuthMethodId,materialActivation:n.materialActivation,thresholdPublicKey33B64u:n.signer.thresholdPublicKey33B64u,evmAddress:n.signer.evmAddress}}:{kind:`rejected`,reason:{kind:`signer_wallet_id_mismatch`}}}function JT(e){return e.keyFamilies[0]!==`ed25519`||e.ed25519===void 0?null:e.ed25519}function YT(e){return e.keyFamilies[0]!==`ecdsa_secp256k1`&&e.keyFamilies.length!==2||e.ecdsa===void 0?null:e.ecdsa}function XT(e){throw Error(`unsupported wallet authority operation: ${String(e)}`)}const ZT={listed:0,discovered:0,truncated:0};async function QT(e,t){let n=R(t.walletId);switch(t.authMethod){case V.emailOtp:return await e.discovery.emailOtp({...t,walletId:n,authMethod:V.emailOtp});case V.passkey:return await e.discovery.passkey?.({...t,walletId:n,authMethod:V.passkey})??ZT;default:throw t.authMethod,Error(`Unsupported signer auth method`)}}async function $T(e,t){return await LT(e.availableLanes,t,e.getConfiguredEcdsaChainTargets())}async function eE(e,t,n){return await RT(e.availableLanes,{walletId:t.walletId,ownerScope:t.ownerScope,ecdsaChainTargets:e.getConfiguredEcdsaChainTargets(),requiredEcdsaCapability:`sign`},n)}function tE(e){let t=typeof e?.getWarmSessionStatus==`function`?t=>e.getWarmSessionStatus(t):null,n=typeof e?.getWarmSessionStatuses==`function`?t=>e.getWarmSessionStatuses(t):null;return t&&n?{statusPort:`single_and_batch`,getWarmSessionStatus:t,getWarmSessionStatuses:n}:t?{statusPort:`single`,getWarmSessionStatus:t}:n?{statusPort:`batch`,getWarmSessionStatuses:n}:null}function nE(e){console.warn(`[WarmSessionStore] warm-session availability failure`,{operation:e.operation,thresholdSessionId:e.thresholdSessionId,code:String(e.code||`worker_error`).trim()||`worker_error`})}async function rE(e,t){let n=String(t||``).trim();return!e||!n||e.statusPort===`batch`?null:iE({thresholdSessionId:n,status:await e.getWarmSessionStatus({thresholdSessionId:n}).catch(()=>({ok:!1,code:`worker_error`,message:`worker_error`}))})}function iE(e){let t=String(e.thresholdSessionId||``).trim();return e.status.ok?{state:`warm`,thresholdSessionId:t,expiresAtMs:e.status.expiresAtMs,remainingUses:e.status.remainingUses}:e.status.code===`expired`?{state:`expired`,thresholdSessionId:t}:e.status.code===`exhausted`?{state:`exhausted`,thresholdSessionId:t}:e.status.code===`not_found`?{state:`missing`,thresholdSessionId:t}:(nE({operation:`status_read`,thresholdSessionId:t,code:e.status.code}),{state:`unavailable`,thresholdSessionId:t,code:String(e.status.code||`worker_error`).trim()||`worker_error`})}function aE(e){if(!e.auth||String(e.auth.session.walletId)!==String(e.runtime.walletId)||e.auth.selectedAuthMethod.kind!==e.runtime.factor.kind||e.auth.status.remainingUses<=0||e.auth.status.quotaId!==e.auth.session.quotaId||!Xc({session:e.auth.session,materialActivation:e.runtime.sealedRecord.ed25519Restore.materialActivation})||e.runtime.factor.kind===`passkey`&&(e.auth.selectedAuthMethod.kind!==`passkey`||String(e.auth.selectedAuthMethod.rpId)!==String(e.runtime.factor.rpId)||e.auth.selectedAuthMethod.credentialIdB64u!==e.runtime.factor.credentialIdB64u||e.auth.selectedFactorAuthority.factor.kind!==`passkey`||e.auth.selectedFactorAuthority.factor.credentialIdB64u!==e.runtime.factor.credentialIdB64u)||e.runtime.factor.kind===`email_otp`&&(e.auth.selectedAuthMethod.kind!==`email_otp`||e.auth.selectedFactorAuthority.factor.kind!==`email_otp`||e.auth.selectedFactorAuthority.factor.providerUserId!==e.runtime.factor.providerSubjectId||e.auth.selectedFactorAuthority.verifier.kind!==`email_otp_wallet_auth_method`||e.auth.selectedFactorAuthority.verifier.emailHashHex!==e.runtime.factor.emailHashHex))return`authorization_required`;let t=Zc({remainingUses:e.runtime.remainingUses,expiresAtMs:e.runtime.expiresAtMs});if(t===`expired`||t===`exhausted`)return`authorization_required`;if(!e.prfClaim)return`prf_missing`;switch(e.prfClaim.state){case`unavailable`:return`prf_unavailable`;case`warm`:return`ready`;case`missing`:case`expired`:case`exhausted`:return`prf_missing`}}function oE(e){if(!e.auth)return`authorization_required`;let t=Zc({remainingUses:e.runtime.remainingUses,expiresAtMs:e.runtime.expiresAtMs});if(t===`expired`||t===`exhausted`)return`authorization_required`;let n=e.emailOtpAuthContext;return n&&el(n)===`single_use`&&Number($c(n))>0||!e.prfClaim?`prf_missing`:e.prfClaim.state===`unavailable`?`prf_unavailable`:e.prfClaim.state===`warm`?`ready`:`prf_missing`}function sE(e){let t=String(e.sessionId||``).trim(),n=e.claim,r={...e.authMethod?{authMethod:e.authMethod}:{},...e.retention?{retention:e.retention}:{}};return n?n.state===`unavailable`?{sessionId:t,status:`unavailable`,statusCode:n.code,...r}:n.state===`warm`?{sessionId:t,status:`active`,...r,remainingUses:n.remainingUses,expiresAtMs:n.expiresAtMs}:{sessionId:t,...r,status:n.state===`expired`?`expired`:n.state===`exhausted`?`exhausted`:`not_found`}:{sessionId:t,status:`not_found`,...r}}function cE(e){if(!e.auth?.operationCredential.token||!String(e.runtime.relayerUrl||``).trim())return null;let t=String(e.groupId||``).trim();return{curve:`ecdsa`,...e.signingSessionSealKeyVersion?{signingSessionSealKeyVersion:e.signingSessionSealKeyVersion}:{},...t?{groupId:t}:{}}}function lE(e){let{capability:t}=e;if(!t.auth||!e.hasWalletSessionAuthorization)return t.capability===`ed25519`?`authorization_required`:`auth_missing`;if(e.emailOtpSingleUseConsumed)return`prf_missing`;let n=t.prfClaim;if(t.capability===`ed25519`){let e=Zc({remainingUses:t.runtime.remainingUses,expiresAtMs:t.runtime.expiresAtMs});return e===`expired`||e===`exhausted`?`authorization_required`:n?.state===`unavailable`?`prf_unavailable`:n?.state===`warm`?`ready`:`prf_missing`}let r=Zc({remainingUses:t.runtime.remainingUses,expiresAtMs:t.runtime.expiresAtMs});return r===`expired`||r===`exhausted`?`authorization_required`:n?n.state===`unavailable`?`prf_unavailable`:n.state===`warm`?`ready`:`prf_missing`:`prf_missing`}function uE(e){let{capability:t}=e,n=t.runtime,r=t.auth,i=t.prfClaim,a=String(n?.thresholdSessionId||``).trim();if(!n){if(t.state!==`missing`&&t.state!==`invalid`)throw Error(`[WarmSessionStore] invalid ${e.label} capability: missing runtime must be missing or invalid`);if(r)throw Error(`[WarmSessionStore] invalid ${e.label} capability: missing runtime cannot have auth`);if(i)throw Error(`[WarmSessionStore] invalid ${e.label} capability: missing runtime cannot have warm-session status`);return}if(String(n.walletId)!==String(e.walletId))throw Error(`[WarmSessionStore] invalid ${e.label} capability: runtime wallet does not match envelope wallet`);if(!a)throw Error(`[WarmSessionStore] invalid ${e.label} capability: runtime is missing thresholdSessionId`);if(r){if(String(r.session.walletId)!==String(n.walletId))throw Error(`[WarmSessionStore] invalid ${e.label} capability: authorization wallet does not match runtime`);if(r.selectedAuthMethod.kind!==n.factor.kind)throw Error(`[WarmSessionStore] invalid ${e.label} capability: authorization factor does not match runtime`)}if(i){if(String(i.thresholdSessionId||``).trim()!==a)throw Error(`[WarmSessionStore] invalid ${e.label} capability: warm-session status thresholdSessionId does not match record thresholdSessionId`);switch(i.state){case`warm`:if(i.remainingUses<=0||i.expiresAtMs<=0)throw Error(`[WarmSessionStore] invalid ${e.label} capability: warm warm-session status requires positive remainingUses and expiresAtMs`);break;case`unavailable`:if(!String(i.code||``).trim())throw Error(`[WarmSessionStore] invalid ${e.label} capability: unavailable warm-session status requires a code`);break;case`missing`:case`expired`:case`exhausted`:break;default:throw Error(`[WarmSessionStore] unsupported warm-session claim state`)}}let o=lE({capability:t,hasWalletSessionAuthorization:!!r,emailOtpSingleUseConsumed:!1});if(t.state!==o)throw Error(`[WarmSessionStore] invalid ${e.label} capability: state=${t.state} does not match derived state=${o}`)}function dE(e){let{capability:t}=e,n=t.runtime,r=t.manifest.durableMaterial.roleLocalPublicFacts;if(String(n.walletId)!==String(e.walletId))throw Error(`[WarmSessionStore] invalid ${e.label} capability: runtime wallet does not match envelope wallet`);if(String(t.key.walletId)!==String(e.walletId))throw Error(`[WarmSessionStore] invalid ${e.label} capability: key wallet does not match envelope wallet`);if(String(t.key.thresholdOwnerAddress).toLowerCase()!==String(r.ethereumAddress).toLowerCase())throw Error(`[WarmSessionStore] invalid ${e.label} capability: key owner address does not match manifest public facts`);if(t.state===`authorization_required`){if(t.lane)throw Error(`[WarmSessionStore] invalid ${e.label} capability: authorization_required cannot carry a lane`);return}if(!t.lane)throw Error(`[WarmSessionStore] invalid ${e.label} capability: authorized ECDSA capability requires a lane`);if(!Vr(t.lane.identity.signer.chainTarget,n.chainTarget))throw Error(`[WarmSessionStore] invalid ${e.label} capability: lane chain target does not match runtime chain target`);if(String(t.lane.materialActivation.activationId)!==String(n.materialActivation.activationId))throw Error(`[WarmSessionStore] invalid ${e.label} capability: lane material activation does not match runtime`);if(Js(t.lane.auth)!==n.authBinding.kind)throw Error(`[WarmSessionStore] invalid ${e.label} capability: lane authMethod does not match sealed auth binding`);if(t.emailOtpAuthContext&&n.authBinding.kind!==`email_otp`)throw Error(`[WarmSessionStore] invalid ${e.label} capability: non-email_otp binding cannot carry email-otp auth context`)}function fE(e){let{capability:t}=e;if(t.state!==`missing`){if(t.capability===`ecdsa`){if(t.state===`invalid`)return;dE({walletId:e.walletId,label:e.label,capability:t});return}uE(e)}}function pE(e){return fE({walletId:e.walletId,label:`ed25519`,capability:e.capabilities.ed25519}),fE({walletId:e.walletId,label:`ecdsa.evm`,capability:e.capabilities.ecdsa.evm}),fE({walletId:e.walletId,label:`ecdsa.tempo`,capability:e.capabilities.ecdsa.tempo}),e}function mE(e,t){let n=String(e||``).trim();if(!n)throw Error(`[WalletSessionStatus] ${t} is required`);return n}function hE(e){let t=br(e.walletSessionId),n=vr(e.quotaId);return!t.ok||!n.ok?null:{walletSessionId:t.value,quotaId:n.value}}function gE(e){let t=hE(e.authorization);if(!t)throw Error(`[WalletSessionStatus] canonical Wallet Session identity is invalid`);return{kind:`wallet_session_status_check`,owner:e.owner,authorization:t}}function _E(e){return{curve:`ed25519`,walletId:R(e)}}function vE(e){return _E(e.identity.signer.account.wallet.walletId)}function yE(e){return e.walletId}function bE(e){return`${e.curve}:${yE(e)}`}function xE(e){return`${e.walletSessionId}:${e.quotaId}`}function SE(e){let t=String(e.walletSessionId);switch(e.status){case`active`:return{sessionId:t,status:`active`,remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs};case`exhausted`:return{sessionId:t,status:`exhausted`,remainingUses:0,expiresAtMs:e.expiresAtMs};case`expired`:return{sessionId:t,status:`expired`,expiresAtMs:e.expiresAtMs};case`missing`:case`superseded`:return{sessionId:t,status:`not_found`,statusCode:e.status};case`authority_unavailable`:case`method_unavailable`:case`capability_unavailable`:return{sessionId:t,status:`unavailable`,statusCode:e.status,expiresAtMs:e.expiresAtMs};case`invalid`:return{sessionId:t,status:`status_unknown`,statusCode:`invalid_wallet_session_status`};default:throw Error(`[WalletSessionStatus] unsupported canonical status`)}}function CE(e){return{sessionId:String(e.walletSessionId),status:`status_unknown`,statusCode:e.reason}}async function wE(e,t){return await e.getAvailableStatus(t).catch(()=>null)}function TE(e,t){if(!t||t.status===`status_unknown`)return e;if(t.status!==`active`)return{...e,...t,sessionId:e.sessionId};let n=Math.max(0,Math.floor(Number(t.remainingUses)||0)),r=Math.floor(Number(e.expiresAtMs)||0),i=Math.floor(Number(t.expiresAtMs)||0);return{...e,status:`active`,remainingUses:n,expiresAtMs:r>0&&i>0?Math.min(r,i):r||i,...t.authMethod?{authMethod:t.authMethod}:{},...t.retention?{retention:t.retention}:{}}}function EE(e){return gE(e)}function DE(e){return String(e||``).trim()}function OE(e){let t=DE(e.thresholdSessionId),n=Math.max(0,Math.floor(Number(e.remainingUses)||0)),r=Math.floor(Number(e.expiresAtMs)||0);return r<=Date.now()?{state:`expired`,thresholdSessionId:t}:n<=0?{state:`exhausted`,thresholdSessionId:t}:{state:`warm`,thresholdSessionId:t,remainingUses:n,expiresAtMs:r}}function kE(e){let t=e.status,n=Math.floor(Number(e.expiresAtMs)||0),r=Math.max(0,Math.floor(Number(e.remainingUses)||0)),i=e.walletSessionStatus;if(i){if(i.status===`not_found`)t=`missing_session`,r=0;else if(i.status===`status_unknown`&&t===`ready`)t=`status_unknown`,r=0;else if(i.status===`unavailable`)t=`status_unavailable`,r=0;else if(i.status===`expired`)t=`expired`,r=0;else if(i.status===`exhausted`)t=`exhausted`,r=0;else if(i.status===`active`){let e=Math.max(0,Math.floor(Number(i.remainingUses)||0)),a=Math.floor(Number(i.expiresAtMs)||0);r=e,a>0&&(n=a),t===`exhausted`&&(t=`ready`)}}let a=Math.max(1,Math.floor(Number(e.usesNeeded)||1));return t===`ready`&&e.missingWhenExpiresAtMissing&&n<=0&&(t=`missing_session`),t===`ready`&&n<=(e.nowMs??Date.now())&&(t=`expired`),t===`ready`&&r<a&&(t=`exhausted`),{readiness:t===`ready`||t===`exhausted`?{status:t,curve:`ed25519`,thresholdSessionId:e.thresholdSessionId,remainingUses:r,expiresAtMs:n}:t===`expired`?{status:t,curve:`ed25519`,thresholdSessionId:e.thresholdSessionId,expiresAtMs:n}:{status:t,curve:`ed25519`,thresholdSessionId:e.thresholdSessionId},expiresAtMs:n,remainingUses:r}}function AE(e){switch(e.factor.kind){case`email_otp`:return V.emailOtp;case`passkey`:return V.passkey}}function jE(e){for(let t of e){let e=t.source;switch(e){case V.emailOtp:return V.emailOtp;case V.passkey:break;default:return ME(e)}}return null}function ME(e){throw Error(`Unsupported signing session lane auth method: ${String(e)}`)}function NE(e){return _E(e.walletId)}function PE(e,t){t&&(!t.thresholdSessionId||!t.walletSessionId||e.push(t))}function FE(e,t,n){return{curve:`ed25519`,chain:`near`,source:AE(e),thresholdSessionId:e.thresholdSessionId,walletSessionId:t,quotaId:n,materialActivation:e.sealedRecord.ed25519Restore.materialActivation,backing:`record_policy`,runtime:e}}async function IE(e,t){return await zE(e,t,e.exactWalletSessionReadPorts)}function LE(e,t){return e.capabilitySubjects.some(e=>e.kind===`sign`&&e.keyFamily===`ed25519`&&b(e.materialActivation,t))}function RE(e){switch(e.runtime.factor.kind){case`passkey`:return e.authMethod.kind===`passkey`&&String(e.authMethod.rpId)===String(e.runtime.factor.rpId)&&String(e.authMethod.credentialIdB64u)===String(e.runtime.factor.credentialIdB64u);case`email_otp`:return e.authMethod.kind===`email_otp`&&e.authMethod.emailHashHex===e.runtime.factor.emailHashHex}}async function zE(e,t,n){let r=e.listExactSealedSessionsForWallet??Lt,i=(await Promise.all([r({walletId:t,filter:{authMethod:V.passkey,curve:`ed25519`}}),r({walletId:t,filter:{authMethod:V.emailOtp,curve:`ed25519`}})])).flat(),a;try{a=await n.resolveSelectedWalletAuthority(String(t))}catch{return[]}if(a.kind!==`resolved`)return[];let{selection:o,authMethod:s,authority:c}=a;if(o.lockState!==`unlocked`||o.walletId!==t||o.walletAuthMethodId!==s.walletAuthMethodId||s.status!==`active`||s.walletId!==t||s.walletAuthorityId!==c.authorityId||c.state!==`active`||c.walletId!==t)return[];let l;try{l=await WT({selected:{authMethod:s,authority:c},operation:{kind:`near_sign`,operation:`sign`,keyFamily:`ed25519`}})}catch{return[]}if(l.kind!==`resolved`||l.value.walletId!==t||l.value.authorityId!==c.authorityId||l.value.authMethodId!==s.walletAuthMethodId)return[];let u;try{u=await n.readExactWithOperationCredential({walletId:t,authorityId:c.authorityId,authMethodId:s.walletAuthMethodId})}catch{return[]}if(u.kind!==`found`)return[];let d=u.record,f=u.operationCredential;if(d.walletId!==t||d.authorityId!==c.authorityId||d.authMethodId!==s.walletAuthMethodId||d.authorityDigestB64u!==c.authorityDigestB64u||d.authorityRevocationEpoch!==c.revocationEpoch||d.expiresAtMs<=Date.now()||f.walletSessionId.length===0||f.token.trim().length===0||!LE(d,l.value.materialActivation))return[];let p=[],m=new Set;for(let e of i){if(e.curve!==`ed25519`)continue;let n=et(e);!n||n.walletId!==t||!RE({runtime:n,authMethod:s})||!b(n.sealedRecord.ed25519Restore.materialActivation,l.value.materialActivation)||m.has(n.thresholdSessionId)||(m.add(n.thresholdSessionId),PE(p,FE(n,f.walletSessionId,d.quotaId)))}return p}async function BE(e){let t=mE(e.walletSessionId,`walletSessionId`);return(await IE(e.deps,e.walletId)).filter(n=>n.walletSessionId===t&&n.quotaId===e.quotaId)}function VE(e){let t=new Map;for(let n of e.lanes){let e=xE({walletSessionId:n.walletSessionId,quotaId:n.quotaId}),r=t.get(e)||[];r.push(n),t.set(e,r)}let n=new Map;for(let r of t.values()){let t=r[0];if(!t)continue;let i=t.walletSessionId,a=t.quotaId,o=HE({walletSessionId:i,quotaId:a,lanes:r,claimsByThresholdSessionId:e.claimsByThresholdSessionId,statusOverrides:e.statusOverrides}),s=r.map(t=>({lane:t,claim:e.claimsByThresholdSessionId.get(t.thresholdSessionId)||null})),c=e=>{if(!e.length)return;let t=e.find(e=>e.claim?.state===`expired`)?.claim||e.find(e=>e.claim?.state===`exhausted`)?.claim||null,r=e.map(e=>e.claim).filter(e=>e?.state===`warm`),i=r.length?Math.min(...r.map(e=>Math.floor(Number(e.remainingUses)||0))):void 0,a=r.length?Math.min(...r.map(e=>Math.floor(Number(e.expiresAtMs)||0))):void 0;for(let r of e){if(t){n.set(r.lane.thresholdSessionId,JE(t,r.lane.thresholdSessionId));continue}if(r.claim?.state===`warm`){n.set(r.lane.thresholdSessionId,{state:`warm`,thresholdSessionId:r.lane.thresholdSessionId,remainingUses:i??r.claim.remainingUses,expiresAtMs:a??r.claim.expiresAtMs});continue}n.set(r.lane.thresholdSessionId,r.claim)}};if(o){let e=KE(o),t=s.filter(e=>o.thresholdSessionIds.has(DE(e.lane.thresholdSessionId))),r=s.filter(e=>!o.thresholdSessionIds.has(DE(e.lane.thresholdSessionId)));if(t.length===s.length){for(let t of s)n.set(t.lane.thresholdSessionId,e?JE(e,t.lane.thresholdSessionId):null);continue}for(let r of t)n.set(r.lane.thresholdSessionId,e?JE(e,r.lane.thresholdSessionId):null);c(r);continue}c(s)}return n}function HE(e){let t=e.statusOverrides;if(!t)return null;for(let n of UE(e.lanes)){let r=t.get(WE(n,e.walletSessionId,e.quotaId));if(!r)continue;let i=GE({override:r,lanes:e.lanes,claimsByThresholdSessionId:e.claimsByThresholdSessionId,statusOverrides:t});if(i)return i}return null}function UE(e){let t=new Map;for(let n of e){let e=NE(n.runtime);t.set(bE(e),e)}return[...t.values()]}function WE(e,t,n){return`${bE(e)}:${xE({walletSessionId:t,quotaId:n})}`}function GE(e){if(!e.lanes.length)return null;if(e.lanes.find(t=>{let n=DE(t.thresholdSessionId);return e.override.thresholdSessionIds.has(n)||t.runtime.sealedRecord.updatedAtMs<=e.override.updatedAtMs?!1:(e.claimsByThresholdSessionId.get(n)||null)?.state===`warm`})){for(let t of e.lanes)e.statusOverrides?.delete(WE(NE(t.runtime),e.override.walletSessionId,e.override.quotaId));return null}return e.override}function KE(e){let t=e.status;if(t.status===`active`){if(typeof t.remainingUses!=`number`||typeof t.expiresAtMs!=`number`)return{state:`unavailable`,code:`invalid_wallet_budget_status`};let e=Math.max(0,Math.floor(Number(t.remainingUses)||0)),n=Math.floor(Number(t.expiresAtMs)||0);return n<=Date.now()?{state:`expired`}:e<=0?{state:`exhausted`}:{state:`warm`,remainingUses:e,expiresAtMs:n}}return t.status===`expired`?{state:`expired`}:t.status===`exhausted`?{state:`exhausted`}:t.status===`unavailable`?{state:`unavailable`,code:String(t.statusCode||`wallet_budget_status_override`)}:null}async function qE(e){let t=new Map;for(let n of e.lanes)t.set(n.thresholdSessionId,OE({thresholdSessionId:n.thresholdSessionId,remainingUses:n.runtime.remainingUses,expiresAtMs:n.runtime.expiresAtMs}));return t}function JE(e,t){switch(e.state){case`warm`:return{state:`warm`,thresholdSessionId:t,remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs};case`unavailable`:return{state:`unavailable`,thresholdSessionId:t,code:e.code};case`missing`:return{state:`missing`,thresholdSessionId:t};case`expired`:return{state:`expired`,thresholdSessionId:t};case`exhausted`:return{state:`exhausted`,thresholdSessionId:t}}}async function YE(e){let t=await IE(e.deps,e.walletId);return XE({deps:e.deps,lanes:t,statusOverrides:e.statusOverrides})}async function XE(e){let t=await qE({deps:e.deps,lanes:e.lanes});return VE({lanes:e.lanes,claimsByThresholdSessionId:t,statusOverrides:e.statusOverrides})}async function ZE(e){let t=e.walletSessionId,n=Array.from(new Set([...e.targetThresholdSessionIds||[]].map(DE).filter(Boolean)));if(!n.length)return null;let r=tE(e.deps.touchConfirm),i=await Promise.all(n.map(e=>rE(r,e)));return sE({sessionId:t,claim:i.find(e=>e?.state===`expired`)||i.find(e=>e?.state===`exhausted`)||i.find(e=>e?.state===`unavailable`)||i.find(e=>e?.state===`warm`)||null})}function QE(e){let t=e.lanes.some(e=>e.source===V.emailOtp);return sE({sessionId:e.walletSessionId,claim:e.claim,authMethod:jE(e.lanes),retention:t?`session`:null})}async function $E(e){let t=await BE({deps:e.deps,walletId:e.walletId,walletSessionId:e.walletSessionId,quotaId:e.quotaId});e.statusOverrides.delete(WE(_E(e.walletId),e.walletSessionId,e.quotaId));let n=new Set,r=new Set;for(let i of t){if(i.backing===`record_policy`)continue;let t=String(i.materialActivation.activationId);if(n.has(t))continue;if(n.add(t),i.backing===`email_otp_worker`){try{await e.deps.clearEmailOtpWarmSessionMaterial?.(i.thresholdSessionId)}catch{r.add(`email_otp_material`)}continue}let a=s(i.thresholdSessionId);if(a.ok)try{await e.deps.touchConfirm?.clearVolatileWarmSessionMaterial?.(oS(a.value))}catch{r.add(`touch_confirm_material`)}}return r.size>0?{kind:`unavailable`,failures:[...r]}:{kind:`cleared`}}function eD(e){switch(e.kind){case`passkey`:return{kind:`passkey`,rpId:wo(e.rpId),credentialIdB64u:e.credentialIdB64u};case`email_otp`:return{kind:`email_otp`,providerSubjectId:e.providerSubjectId};default:throw Error(`[WarmSessionStore] unsupported ECDSA runtime auth binding`)}}async function tD(e){if(!e.resolve||e.resolution.kind!==`resolved`)return null;try{return await e.resolve({walletId:e.walletId,chainTarget:e.resolution.runtime.chainTarget,materialActivation:e.resolution.manifest.activation.materialActivation})}catch{return null}}function nD(e){return e.kind===`resolved`?OE({thresholdSessionId:e.runtime.sealedRecord.thresholdSessionId,remainingUses:e.runtime.remainingUses,expiresAtMs:e.runtime.expiresAtMs}):null}function rD(e){async function t(t){let n=e.resolveActiveEd25519WalletSessionAuthorization;if(!n)return null;try{return await n(t)}catch{return null}}function n(e){if(e.resolution.kind===`missing`)return{capability:`ed25519`,runtime:null,auth:null,prfClaim:null,state:`missing`};if(e.resolution.kind===`conflict`||e.resolution.kind===`corrupt`)return{capability:`ed25519`,runtime:null,auth:null,prfClaim:null,invalidReason:e.resolution.kind===`conflict`?`exact_record_conflict`:`corrupt`,state:`invalid`};let t=e.resolution.runtime,n=aE({runtime:t,auth:e.auth,prfClaim:e.prfClaim});if(n===`authorization_required`)return{capability:`ed25519`,runtime:t,auth:null,prfClaim:e.prfClaim,state:n};if(n===`missing`||n===`invalid`)throw Error(`[WarmSessionStore] Ed25519 capability state=${n} with resolved material`);if(!e.auth)throw Error(`[WarmSessionStore] Ed25519 capability state=${n} requires active authorization`);return{capability:`ed25519`,runtime:t,auth:e.auth,prfClaim:e.prfClaim,state:n}}function r(e){if(e.resolution.kind===`blocked`){let t=e.resolution.reason;return t===`missing_capability`||t===`missing_material`?{capability:`ecdsa`,manifest:null,runtime:null,key:null,lane:null,auth:null,prfClaim:null,state:`missing`}:{capability:`ecdsa`,manifest:null,runtime:null,key:null,lane:null,auth:null,prfClaim:null,invalidReason:t,state:`invalid`}}let{manifest:t,runtime:n}=e.resolution,r=t.durableMaterial.roleLocalPublicFacts,i=$a({walletId:n.walletId,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:String(r.signingRootId),signingRootVersion:String(r.signingRootVersion),participantIds:[...n.participantIds],thresholdOwnerAddress:String(r.ethereumAddress)}),a=n.authBinding,o=oE({runtime:n,auth:e.authorization,prfClaim:e.prfClaim,emailOtpAuthContext:null});if(o===`authorization_required`)return{capability:`ecdsa`,manifest:t,runtime:n,key:i,lane:null,auth:null,prfClaim:e.prfClaim,emailOtpAuthContext:null,state:o};if(!e.authorization)throw Error(`[WarmSessionStore] ECDSA capability without authorization must be authorization_required`);if(o===`missing`||o===`invalid`)throw Error(`[WarmSessionStore] ECDSA capability state=${o} with resolved material`);let s=ul({key:i,materialActivation:n.materialActivation,keyHandle:n.keyHandle,walletId:n.walletId,auth:eD(a),authorization:e.authorization,chainTarget:n.chainTarget});if(o===`ready`||o===`material_pending`){if(!e.prfClaim||e.prfClaim.state!==`warm`)throw Error(`[WarmSessionStore] ECDSA capability state=${o} requires a warm PRF claim`);return{capability:`ecdsa`,manifest:t,runtime:n,key:i,lane:s,auth:e.authorization,prfClaim:e.prfClaim,state:o}}return o===`auth_missing`?{capability:`ecdsa`,manifest:t,runtime:n,key:i,lane:s,auth:null,prfClaim:e.prfClaim,state:o}:{capability:`ecdsa`,manifest:t,runtime:n,key:i,lane:s,auth:e.authorization,prfClaim:e.prfClaim,state:o}}async function i(i){let a=R(i),[o,s,c,l]=await Promise.all([rn(a),t(a),e.resolveActiveEcdsaCapabilityRuntimeForChain({walletId:a,chain:`evm`}),e.resolveActiveEcdsaCapabilityRuntimeForChain({walletId:a,chain:`tempo`})]),[u,d]=await Promise.all([tD({resolve:e.resolveActiveEcdsaWalletSessionAuthorization,walletId:a,resolution:c}),tD({resolve:e.resolveActiveEcdsaWalletSessionAuthorization,walletId:a,resolution:l})]);return pE({walletId:a,capabilities:{ed25519:n({resolution:o,auth:s,prfClaim:o.kind===`resolved`?await e.statusReader.readEd25519WarmSessionClaim(o.runtime):null}),ecdsa:{evm:r({resolution:c,prfClaim:nD(c),authorization:u}),tempo:r({resolution:l,prfClaim:nD(l),authorization:d})}},updatedAtMs:Date.now()})}async function a(t){let n=await e.resolveActiveEcdsaCapabilityRuntime({walletId:t.lane.signer.walletId,chainTarget:t.lane.signer.chainTarget});return r({resolution:n,prfClaim:nD(n),authorization:t.authorization})}function o(){return e.signingSessionSeal.seal===`configured`?{groupId:String(e.signingSessionSeal.groupId||``).trim()}:{groupId:``}}async function s(t){let n=await e.resolveActiveEcdsaCapabilityRuntime({walletId:t.lane.signer.walletId,chainTarget:t.lane.signer.chainTarget});if(n.kind!==`resolved`)return null;let r=o();return cE({runtime:n.runtime,auth:t.authorization,groupId:r.groupId})}return{getWarmSession:i,getEcdsaCapabilityForLane:a,resolveEcdsaSealTransportForLane:s}}function iD(e){switch(e.factor.kind){case V.passkey:return{authMethod:V.passkey};case V.emailOtp:return{authMethod:V.emailOtp,retention:`session`};default:throw e.factor,Error(`[WarmSessionStore] unsupported Ed25519 runtime factor`)}}async function aD(e){return bt({runtime:e.runtime,authorization:e.authorization})}function oD(e){let t=tE(e.touchConfirm);async function n(e){let t=String(e.thresholdSessionId);return await r({authMethod:e.factor.kind,thresholdSessionId:t,materialActivation:e.sealedRecord.ed25519Restore.materialActivation})}async function r(n){if(n.authMethod===V.emailOtp){let t=await e.getEmailOtpWarmSessionStatus({kind:`ed25519_yao`,thresholdSessionId:n.thresholdSessionId,materialActivation:n.materialActivation}).catch(()=>({ok:!1,code:`worker_error`,message:`worker_error`}));return iE({thresholdSessionId:n.thresholdSessionId,status:t})}return await rE(t,n.thresholdSessionId)}async function i(e){let t=e.runtime,r=String(t.thresholdSessionId),i=iD(t);if(!e.authorization||!await aD({runtime:t,authorization:e.authorization}))return{sessionId:r,status:`unavailable`,statusCode:`auth_missing`,...i};if(e.authorization.status.expiresAtMs<=e.nowMs||t.expiresAtMs<=e.nowMs)return{sessionId:r,status:`expired`,expiresAtMs:Math.min(e.authorization.status.expiresAtMs,t.expiresAtMs),...i};if(t.remainingUses<=0)return{sessionId:r,status:`exhausted`,remainingUses:0,expiresAtMs:t.expiresAtMs,...i};let a=sE({sessionId:r,claim:await n(t),authMethod:i.authMethod,retention:i.retention??null});return a.status===`not_found`?{sessionId:r,status:`active`,remainingUses:t.remainingUses,expiresAtMs:t.expiresAtMs,...i}:a}return{getEd25519SigningSessionStatus:i,readEd25519WarmSessionClaim:n}}function sD(){return{ok:!1,code:`not_found`,message:`Email OTP warm-session status reader is unavailable`}}function cD(e){let t=tE(e.touchConfirm),n=e.getEmailOtpWarmSessionStatus;return n?{runtimeStatus:`configured`,touchConfirm:t,getEmailOtpWarmSessionStatus:n}:t?.statusPort===`single`||t?.statusPort===`single_and_batch`?{runtimeStatus:`configured`,touchConfirm:t,getEmailOtpWarmSessionStatus:async e=>await t.getWarmSessionStatus({thresholdSessionId:e.thresholdSessionId})}:t?{runtimeStatus:`configured`,touchConfirm:t,getEmailOtpWarmSessionStatus:async()=>sD()}:{runtimeStatus:`no_runtime_status`,touchConfirm:null,getEmailOtpWarmSessionStatus:async()=>sD()}}function lD(e){let t=String(e?.groupId||``).trim();return t?{seal:`configured`,groupId:t}:{seal:`unconfigured`}}function uD(e){let t=cD(e),n=oD({touchConfirm:t.touchConfirm,getEmailOtpWarmSessionStatus:t.getEmailOtpWarmSessionStatus});return rD({resolveActiveEcdsaCapabilityRuntime:e.resolveActiveEcdsaCapabilityRuntime,resolveActiveEcdsaCapabilityRuntimeForChain:e.resolveActiveEcdsaCapabilityRuntimeForChain,statusReader:n,signingSessionSeal:lD(e.signingSessionSeal),...e.resolveActiveEcdsaWalletSessionAuthorization?{resolveActiveEcdsaWalletSessionAuthorization:e.resolveActiveEcdsaWalletSessionAuthorization}:{},...e.resolveActiveEd25519WalletSessionAuthorization?{resolveActiveEd25519WalletSessionAuthorization:e.resolveActiveEd25519WalletSessionAuthorization}:{}})}function dD(e){return!e.ok&&(e.code===`not_found`||e.code===`worker_error`)}function fD(e){let{base:t,secondary:n}=e,r=async e=>{let r=await n.readWarmSessionStatusOnly(e.thresholdSessionId);return dD(r)?await t.getWarmSessionStatus(e):r},i=async e=>{let r=await Promise.all(e.thresholdSessionIds.map(async e=>({thresholdSessionId:e,result:await n.readWarmSessionStatusOnly(e)}))),i=r.filter(e=>dD(e.result)).map(e=>e.thresholdSessionId),a=i.length===0?{results:[]}:typeof t.getWarmSessionStatuses==`function`?await t.getWarmSessionStatuses({thresholdSessionIds:i}):{results:await Promise.all(i.map(async e=>({thresholdSessionId:e,result:await t.getWarmSessionStatus({thresholdSessionId:e})})))},o=new Map(a.results.map(e=>[e.thresholdSessionId,e]));return{results:r.map(e=>dD(e.result)&&o.get(e.thresholdSessionId)||e)}},a=async e=>{await Promise.all([t.clearVolatileWarmSessionMaterial(e).catch(()=>void 0),n.clearVolatileWarmSessionMaterial(e).catch(()=>void 0)])};return new Proxy(t,{get:(e,t,n)=>{if(t===`getWarmSessionStatus`)return r;if(t===`getWarmSessionStatuses`)return i;if(t===`clearVolatileWarmSessionMaterial`)return a;let o=Reflect.get(e,t,n);return typeof o==`function`?o.bind(e):o}})}function pD(e){let{base:t,secondary:n}=e;return{getWarmSessionStatus:async e=>{let r=await n.readWarmSessionStatusOnly(e.thresholdSessionId);return dD(r)?await t.getWarmSessionStatus(e):r},getWarmSessionStatuses:async e=>{let r=Array.from(new Set((Array.isArray(e.thresholdSessionIds)?e.thresholdSessionIds:[]).map(e=>String(e||``).trim()).filter(Boolean))),i=await Promise.all(r.map(async e=>({thresholdSessionId:e,result:await n.readWarmSessionStatusOnly(e)}))),a=i.filter(e=>dD(e.result)).map(e=>e.thresholdSessionId),o=a.length===0?{results:[]}:await t.getWarmSessionStatuses({thresholdSessionIds:a}),s=new Map(o.results.map(e=>[e.thresholdSessionId,e.result]));return{results:i.map(e=>dD(e.result)?{thresholdSessionId:e.thresholdSessionId,result:s.get(e.thresholdSessionId)||e.result}:e)}}}}function mD(e){if(!e)return null;switch(e.materialKind){case`role_local_worker_handle`:return e.roleLocalMaterialRef;case`role_local_durable_sealed_ref`:return e.roleLocalMaterialRef;case`role_local_durable_public_anchor`:case`role_local_ready_state_blob`:case`metadata_only`:return null}}function hD(e){let t=e.bootstrap.thresholdEcdsaKeyRef,n=t.keyHandle,r=t.ecdsaThresholdKeyId,i=t.backendBinding?.ecdsaRoleLocalReadyRecord,a=t.backendBinding?.materialKind===`role_local_worker_handle`?t.backendBinding.publicFacts:i?.publicFacts;if(!a)throw Error(`[SigningEngine] threshold-ecdsa bootstrap did not provide role-local public facts`);let o=wa({record:{signingRootId:a.signingRootId,signingRootVersion:a.signingRootVersion}}),s=String(o.signingRootId),c=String(o.signingRootVersion),l=li(t.ethereumAddress);if(!l)throw Error(`[SigningEngine] threshold-ecdsa bootstrap did not provide a threshold owner address`);let u=t.thresholdEcdsaPublicKeyB64u,d=t.backendBinding.relayerKeyId,f=t.relayerVerifyingShareB64u,p=t.participantIds,m=ci(e.chainTarget),h=mD(t.backendBinding),g={accountModel:`threshold-ecdsa`,accountAddress:l,ownerAddress:l,thresholdOwnerAddress:l,keyScope:`evm-family`,keyHandle:n,walletId:e.walletId,ecdsaThresholdKeyId:r,signingRootId:s,signingRootVersion:c,relayerKeyId:d,relayerVerifyingShareB64u:f,thresholdEcdsaPublicKeyB64u:u,participantIds:p,publicCapability:a.publicCapability,ecdsaRoleLocalPublicFacts:a,chainTarget:e.chainTarget,targetMembership:{targetKey:m,chainTarget:e.chainTarget},sharedEvmFamilyKey:{walletId:e.walletId,keyScope:`evm-family`,keyHandle:n,ecdsaThresholdKeyId:r,signingRootId:s,signingRootVersion:c,participantIds:p,thresholdOwnerAddress:l,thresholdEcdsaPublicKeyB64u:u},chainId:e.chainTarget.chainId};return h&&(g.roleLocalMaterialRef=h),{account:{profileId:e.walletId,chainIdKey:m,accountAddress:l,accountModel:`threshold-ecdsa`},signer:{signerId:l,signerType:`threshold`,signerKind:Yr.thresholdEcdsa,signerAuthMethod:e.signerAuth.authMethod,signerSource:e.signerAuth.signerSource,metadata:g},activationPolicy:{mode:`allocate_next_free`},preferredSlot:1,selectAsActive:!1,mutation:{routeThroughOutbox:!1}}}async function gD(e){let t=R(e.walletId);await e.bootstrapStore.upsertProfile({profileId:t}),await e.bootstrapStore.activateAccountSigner(hD({walletId:t,chainTarget:e.chainTarget,bootstrap:e.bootstrap,signerAuth:e.signerAuth}))}function _D(e){return{queueByWallet:e.queueByWallet,activationDeps:e.activationDeps,persistEcdsaRoleLocalReadyRecord:e.persistEcdsaRoleLocalReadyRecord}}function vD(e){return{getWarmSession:t=>e.capabilityReader.getWarmSession(t),discoverPersistedSessionsForWallet:e.passkeyMpcSession.discoverPersistedSessionsForWallet.bind(e.passkeyMpcSession)}}function yD(e){let t=u_(e),n=d_(e);return e.source===`registration`?{kind:`key_enrollment_bootstrap_parity`,walletId:t,chainTarget:n}:e.operationIntent===Ys.TransactionSign?{kind:`transaction_bootstrap_parity`,walletId:t,chainTarget:n,operationIntent:Ys.TransactionSign}:e.kind===`email_otp_ecdsa_bootstrap`?{kind:`email_otp_bootstrap_parity`,walletId:t,chainTarget:n,authMethod:`email_otp`}:{kind:`default_bootstrap_parity`,walletId:t,chainTarget:n}}async function bD(e,t){return await z_(_D(e),t)}function xD(e){let t=e.error instanceof Error?e.error.message:String(e.error||`unknown error`);return{ok:!1,code:SD(e.error),chainTargetKey:e.chainTargetKey,errorMessage:t}}function SD(e){let t=wf(e);if(t)switch(t.kind){case`expired`:return`sealed_record_expired`;case`exhausted`:return`sealed_record_exhausted`;case`missing`:case`invalid`:case`unavailable`:return`sealed_restore_failed`}switch(e&&typeof e==`object`?Reflect.get(e,`code`):void 0){case`expired`:return`sealed_record_expired`;case`exhausted`:return`sealed_record_exhausted`;default:return`sealed_restore_failed`}}async function CD(e,t,n){let r=n.chainTarget,i=z(r);if((await e.getWarmSession(t)).capabilities.ed25519.state!==`ready`)return{ok:!1,code:`missing_exact_material`,chainTargetKey:i};try{await e.discoverPersistedSessionsForWallet({kind:`discover_wallet_ecdsa_signing_sessions`,walletId:t,ecdsaChainTargets:[r],maxRecords:1})}catch(e){return console.warn(`[SigningEngine][ecdsa] reuse warm sealed discovery failed`,{walletId:t,chainTarget:r,error:e instanceof Error?e.message:String(e||`unknown error`)}),xD({chainTargetKey:i,error:e})}return{ok:!1,code:`missing_exact_material`,chainTargetKey:i}}function wD(e){switch(e.code){case`missing_exact_material`:return`[SigningEngine][ecdsa] reuse_warm_ecdsa_bootstrap requires restored passkey ECDSA material for ${e.chainTargetKey}`;case`sealed_restore_failed`:return`[SigningEngine][ecdsa] reuse_warm_ecdsa_bootstrap sealed restore failed for ${e.chainTargetKey}: ${e.errorMessage||`unknown error`}`;case`sealed_record_expired`:return`[SigningEngine][ecdsa] reuse_warm_ecdsa_bootstrap sealed record expired for ${e.chainTargetKey}`;case`sealed_record_exhausted`:return`[SigningEngine][ecdsa] reuse_warm_ecdsa_bootstrap sealed record exhausted for ${e.chainTargetKey}`}return`[SigningEngine][ecdsa] reuse_warm_ecdsa_bootstrap failed`}function TD(e){return Error(wD(e))}async function ED(e,t){await Nd(e.ensureSealedRefreshStartupParity,yD(t));let n=R(u_(t));switch(t.kind){case`reuse_warm_ecdsa_bootstrap`:{let r=await CD(vD(e),n,t);return r.ok?{ok:!0,bootstrap:r.bootstrap}:{ok:!1,kind:`reuse_failed`,failure:r}}case`passkey_fresh_ecdsa_bootstrap`:case`passkey_preauthorized_ecdsa_bootstrap`:case`wallet_session_reconnect_ecdsa_bootstrap`:case`email_otp_ecdsa_bootstrap`:return{ok:!0,bootstrap:await bD(e,t)}}throw Error(`[SigningEngine][ecdsa] unsupported warm bootstrap request`)}function DD(e){throw Error(`[threshold-ed25519] unsupported wallet auth factor kind: ${String(e)}`)}function OD(e){return Jn(e.authority)?e.authority:$n(e.authority)?null:(e.authority,DD(e.authority))}async function kD(e){let t=OD(e.authority),n=t?String(t.verifier.rpId||``).trim():``;if(t&&!n)return{ok:!1,code:`invalid_args`,message:`Missing rpId for WebAuthn`};let{policy:r,sessionPolicyDigest32:i}=await En({nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,authority:e.authority,relayerKeyId:e.relayerKeyId,...e.runtimePolicyScope?{runtimePolicyScope:e.runtimePolicyScope}:{},routerAbNormalSigning:e.routerAbNormalSigning,participantIds:e.participantIds,thresholdSessionId:e.thresholdSessionId,ttlMs:e.ttlMs,remainingUses:e.remainingUses}),a=e.auth;if(!a){if(!t)return{ok:!1,code:`invalid_args`,message:`Email OTP Ed25519 session mint requires explicit route authorization`};a={kind:`threshold_session_policy_webauthn`,policySecretSource:El({credential:await su({credentialStore:e.credentialStore,touchIdPrompt:e.touchIdPrompt,nearAccountId:e.nearAccountId,challengeB64u:i}),rpId:n})}}let o=Ml(a);if(!o)return{ok:!1,code:`unsupported`,message:`Missing PRF.first output from credential (requires a PRF-enabled passkey)`};let s=await zl({relayerUrl:e.relayerUrl,sessionKind:`opaque`,relayerKeyId:e.relayerKeyId,sessionPolicy:r,auth:a,projectEnvironmentId:e.runtimeScopeBootstrap?.projectEnvironmentId,publishableKey:e.runtimeScopeBootstrap?.publishableKey,...e.existingOperationCredential?{existingOperationCredential:e.existingOperationCredential}:{}});if(!s.ok)return s.code===`already_committed`?s:{ok:!1,code:s.code,message:s.message};let c=r.thresholdSessionId,l=s.thresholdSessionId||c,u=s.expiresAtMs,d=s.remainingUses,f=s.runtimePolicyScope;if(!l||!s.authorizationId||!s.walletSessionId||!s.quotaId||!f)return{ok:!1,code:`invalid_response`,message:`Threshold Ed25519 session mint returned incomplete lifecycle metadata`};let p={ok:!0,thresholdSessionId:Xs.thresholdEd25519Session(l),authorizationId:s.authorizationId,walletSessionId:s.walletSessionId,quotaId:s.quotaId,expiresAtMs:u,remainingUses:d,runtimePolicyScope:f,routerAbNormalSigning:e.routerAbNormalSigning,passkeyPrfFirstB64u:o};switch(s.sessionKind){case`issued_exact_wallet_session`:return s.operationCredential.walletSessionId===s.walletSessionId?{...p,sessionKind:s.sessionKind,operationCredential:s.operationCredential}:{ok:!1,code:`invalid_response`,message:`Threshold Ed25519 session mint credential does not identify its session`};case`already_committed_exact_wallet_session`:return{...p,sessionKind:s.sessionKind};default:return AD(s)}}function AD(e){throw Error(`[threshold-ed25519] unsupported Wallet Session mint kind: ${String(e)}`)}function jD(e){return{curve:`ed25519`,authMethod:`passkey`,walletId:e.walletId,relayerUrl:e.relayerUrl,walletSessionToken:e.walletSessionToken,ed25519Restore:e.ed25519Restore}}function MD(e){let t=String(e.authority.factor.credentialIdB64u||``).trim();if(!t)throw Error(`[threshold-ed25519] passkey authority credential id is required`);return t}function ND(e){switch(e.kind){case`fresh_ed25519_provisioning`:return{kind:`fresh`,walletId:e.walletId,nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:e.signerSlot,thresholdSessionId:Xs.thresholdEd25519Session(_l(`threshold-ed25519`))};case`exact_ed25519_provisioning`:{let t=Kc(e.laneIdentity,`exact Ed25519 capability provisioning`);return{kind:`exact`,walletId:String(t.walletId),nearAccountId:t.nearAccountId,nearEd25519SigningKeyId:String(t.nearEd25519SigningKeyId),signerSlot:t.signerSlot,thresholdSessionId:e.laneIdentity.thresholdSessionId,walletSessionId:e.laneIdentity.walletSessionId,quotaId:e.laneIdentity.quotaId}}}throw Error(`[threshold-ed25519] unsupported Ed25519 provisioning kind`)}function PD(e){switch(e.requested.kind){case`fresh`:return!1;case`exact`:return e.returnedThresholdSessionId!==e.requested.thresholdSessionId||e.returnedWalletSessionId!==e.requested.walletSessionId||e.returnedQuotaId!==e.requested.quotaId}throw e.requested,Error(`[threshold-ed25519] unsupported resolved provisioning identity`)}function FD(e){switch(e.connected.sessionKind){case`issued_exact_wallet_session`:return e.connected.operationCredential.walletSessionId===e.connected.walletSessionId?{ok:!0,operationCredential:e.connected.operationCredential}:{ok:!1,code:`invalid_result`,message:`Threshold Ed25519 session mint credential does not identify its session`};case`already_committed_exact_wallet_session`:{if(e.protocol.kind!==`exact`||!e.existingOperationCredential)return{ok:!1,code:`unlock_exact_method`,message:`Threshold Ed25519 session reuse returned no credential; exact-method unlock is required`};let t=e.existingOperationCredential;return t.walletSessionId===e.connected.walletSessionId?{ok:!0,operationCredential:t}:{ok:!1,code:`unlock_exact_method`,message:`Threshold Ed25519 reused session credential identifies another session`}}default:return ID(e.connected)}}function ID(e){throw Error(`[threshold-ed25519] unsupported connected session kind: ${String(e)}`)}async function LD(e,t){let n=ND(t);if(t.kind===`exact_ed25519_provisioning`&&t.operationCredential.walletSessionId!==t.laneIdentity.walletSessionId)return{ok:!1,code:`invalid_args`,message:`Threshold Ed25519 exact credential identifies another Wallet Session`};let r=Hi(n.nearAccountId),i=String(t.relayerUrl||e.defaultRelayerUrl||``).trim(),a=Sn(t.participantIds);if(!i)throw Error(`Missing relayer url (configs.network.relayer.url)`);if(!a)throw Error(`Missing participantIds for threshold Ed25519 session provision`);let o=e.getSignerWorkerContext(),s=await kD({credentialStore:e.credentialStore,touchIdPrompt:e.touchIdPrompt,relayerUrl:i,relayerKeyId:t.relayerKeyId,nearEd25519SigningKeyId:n.nearEd25519SigningKeyId,authority:t.authority,...t.auth?{auth:t.auth}:{},...t.runtimePolicyScope?{runtimePolicyScope:t.runtimePolicyScope}:{},routerAbNormalSigning:t.routerAbNormalSigning,...t.runtimeScopeBootstrap?{runtimeScopeBootstrap:t.runtimeScopeBootstrap}:{},nearAccountId:r,participantIds:a,thresholdSessionId:n.thresholdSessionId,ttlMs:t.ttlMs,remainingUses:t.remainingUses,workerCtx:o,...t.kind===`exact_ed25519_provisioning`?{existingOperationCredential:t.operationCredential}:{}});if(!s.ok)return{ok:!1,code:String(s.code||`worker_error`).trim()||`worker_error`,message:String(s.message||``).trim()||`Threshold Ed25519 session mint failed`};let c=s.thresholdSessionId||n.thresholdSessionId,l=Number(s.expiresAtMs),u=Number(s.remainingUses),d=String(s.passkeyPrfFirstB64u||``).trim(),f=s.runtimePolicyScope;if(!c||!s.walletSessionId||!s.authorizationId||!s.quotaId||!Number.isFinite(l)||!Number.isFinite(u))return{ok:!1,code:`invalid_result`,message:`Threshold Ed25519 session mint returned incomplete public session metadata`};if(PD({requested:n,returnedThresholdSessionId:c,returnedWalletSessionId:s.walletSessionId,returnedQuotaId:s.quotaId}))return{ok:!1,code:`invalid_result`,message:`Threshold Ed25519 exact provisioning returned a different lifecycle identity`};let p=FD({connected:s,protocol:n,existingOperationCredential:t.kind===`exact_ed25519_provisioning`?t.operationCredential:void 0});if(!p.ok)return p;let{operationCredential:m}=p,h=m.token,g={kind:`minted_ed25519_wallet_session_authority`,thresholdSessionId:c,walletSessionId:s.walletSessionId,authorizationId:s.authorizationId,quotaId:s.quotaId,expiresAtMs:l,remainingUses:u,runtimePolicyScope:f,operationCredential:m},_=e.touchIdPrompt.getRpId();if(d&&t.source===`email_otp`)return{ok:!1,code:`invalid_result`,message:`Passkey PRF material cannot seal an Email OTP Ed25519 session`};if(await t.onWalletSessionAuthorityReady?.(g),d&&t.source!==`email_otp`){let o=MD(t.authority),s=Me({rpId:_,nearAccountId:String(r),nearEd25519SigningKeyId:n.nearEd25519SigningKeyId,relayerKeyId:t.relayerKeyId,participantIds:a,runtimePolicyScope:f,signerSlot:n.signerSlot,routerAbNormalSigning:t.routerAbNormalSigning,credentialIdB64u:o,materialActivation:t.materialActivation}),p=jD({walletId:n.walletId,relayerUrl:i,walletSessionToken:h,ed25519Restore:s});try{await vl(e.touchConfirm,{thresholdSessionId:String(c),prfFirstB64u:d,expiresAtMs:l,remainingUses:u,transport:p})}catch(e){return{ok:!1,code:`warm_session_cache_failed`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||``).trim()||`Threshold Ed25519 session material could not be cached`}}}return{ok:!0,sessionKind:s.sessionKind,thresholdSessionId:c,walletSessionId:s.walletSessionId,authorizationId:s.authorizationId,quotaId:s.quotaId,expiresAtMs:l,remainingUses:u,runtimePolicyScope:f,operationCredential:m}}function RD(e){return typeof e?.clearAllVolatileWarmSessionMaterial==`function`}function zD(e){return typeof e?.clearVolatileWarmSessionMaterial==`function`}async function BD(e){let t=new Set,n=await Promise.all([Lt({walletId:e,filter:{authMethod:`passkey`,curve:`ed25519`}}),Lt({walletId:e,filter:{authMethod:`email_otp`,curve:`ed25519`}})]);for(let e of n.flat()){let n=s(e.thresholdSessionIds.ed25519);n.ok&&t.add(n.value)}return[...t]}async function VD(e,t){if(t==null&&RD(e.touchConfirm)){await e.touchConfirm.clearAllVolatileWarmSessionMaterial(sS()).catch(()=>void 0);return}let n=t==null?[]:await BD(t);zD(e.touchConfirm)&&await Promise.all(n.map(t=>e.clearVolatileThresholdSessionMaterial(oS(t)).catch(()=>void 0)))}function HD(e){switch(e.kind){case`rehydrated`:return e;case`device_link_required`:throw Error(`ECDSA login prefill requires local role-local material`);case`corrupt`:throw Error(`ECDSA login prefill role-local material is corrupt (${e.reason}): ${e.message}`);default:{let t=e;throw Error(`Unsupported ECDSA login prefill material state: ${String(t)}`)}}}function UD(e){return{kind:`router_ab_ecdsa_derivation_client_signing_material_source_v1`,initClientPresignSession:async t=>{let n=HD(await Rd({purpose:`wallet_unlock`,source:jd({authority:e.manifest.signer.authority,materialActivation:e.manifest.durableMaterial.materialActivation,publicFacts:e.manifest.durableMaterial.roleLocalPublicFacts}),workerCtx:t.workerCtx}));return await Gu({materialHandle:n.liveHandle.materialHandle,material:{kind:`persisted`,materialRef:n.materialRef},...t})},stepClientPresignSession:qu,abortClientPresignSession:Qu,admitClientPresignature:Bu,destroyClientPresignature:Xu,reserveClientPresignature:Ju,commitClientPresignature:md,listAvailableClientPresignatures:hd.bind(void 0,`role_local_derivation_handle`),computeSignatureShareFromPresignatureHandle:Yu}}function WD(e){let t={exportArtifactsByLane:e.ecdsaExportArtifacts.exportArtifactsByLane},n=pD({base:e.passkeyMpcSession,secondary:{readWarmSessionStatusOnly:t=>e.getEmailOtpWarmSessionStatus({kind:`ecdsa`,thresholdSessionId:t})}}),r=oD({touchConfirm:n,getEmailOtpWarmSessionStatus:e.getEmailOtpWarmSessionStatus});return{ecdsaSessions:t,statusUiConfirm:n,capabilityReader:uD({resolveActiveEcdsaCapabilityRuntime:e.resolveActiveEcdsaCapabilityRuntime,resolveActiveEcdsaCapabilityRuntimeForChain:e.resolveActiveEcdsaCapabilityRuntimeForChain,touchConfirm:e.passkeyMpcSession,signingSessionSeal:e.signingSessionSeal.mode===`sealed_refresh_v1`?{groupId:Ns}:null,getEmailOtpWarmSessionStatus:e.getEmailOtpWarmSessionStatus,...e.resolveActiveEcdsaWalletSessionAuthorization?{resolveActiveEcdsaWalletSessionAuthorization:e.resolveActiveEcdsaWalletSessionAuthorization}:{},...e.resolveActiveEd25519WalletSessionAuthorization?{resolveActiveEd25519WalletSessionAuthorization:e.resolveActiveEd25519WalletSessionAuthorization}:{}}),statusReader:r}}function GD(e){return{getWarmSession:t=>e.warmSigning.capabilityReader.getWarmSession(R(t)),provisionThresholdEd25519Session:async t=>await LD({credentialStore:e.credentialStore,touchIdPrompt:e.touchIdPrompt,touchConfirm:e.passkeyMpcSession,defaultRelayerUrl:e.seamsWebConfigs.network.relayer?.url||``,getSignerWorkerContext:()=>e.walletSessionActivationDeps.getSignerWorkerContext()},t),bootstrapEcdsaSession:async t=>{let n=await ED({ensureSealedRefreshStartupParity:e.ensureSealedRefreshStartupParity,queueByWallet:e.thresholdEcdsaBootstrapQueueByWallet,activationDeps:e.walletSessionActivationDeps,passkeyMpcSession:e.passkeyMpcSession,persistEcdsaRoleLocalReadyRecord:e.persistEcdsaRoleLocalReadyRecord,capabilityReader:e.warmSigning.capabilityReader},t);if(n.ok)return n.bootstrap;switch(n.kind){case`reuse_failed`:throw TD(n.failure)}throw Error(`[SigningEngine][ecdsa] unsupported warm bootstrap result`)}}}function KD(e){return{statusReader:e.warmSigning.statusReader,persistThresholdEcdsaBootstrapForWalletTarget:async t=>await gD({bootstrapStore:e.bootstrapStore,walletId:t.walletId,chainTarget:t.chainTarget,bootstrap:t.bootstrap,signerAuth:t.signerAuth}),hydrateSigningSession:async t=>await vl(e.passkeyMpcSession,t),clearVolatileWarmSigningMaterial:async t=>await VD({touchConfirm:e.passkeyMpcSession,clearVolatileThresholdSessionMaterial:async t=>await e.passkeyMpcSession.clearVolatileWarmSessionMaterial(t)},t),getWalletSessionStatus:t=>e.signingSessionCoordinator.getAvailableStatus(t),routerAbEcdsaDerivationPresignaturePoolPolicy:e.seamsWebConfigs.signing.routerAbEcdsaDerivation.presignaturePool,getSignerWorkerContext:()=>e.walletSessionActivationDeps.getSignerWorkerContext(),resolveClientSigningMaterialSource:UD}}function qD(e){let t=String(e.operationId||``).trim(),n=String(e.operationFingerprint||``).trim();if(!t)throw Error(`[SigningEngine] signingOperationId is required`);if(!n)throw Error(`[SigningEngine] operation fingerprint is required`);let r=e.state.callerProvidedOperationFingerprintsById,i=r.get(t);if(i&&i!==n)throw Error(`[SigningEngine] caller-provided signingOperationId reused for a different operation: ${t}`);r.set(t,n),YD(r)}var JD=class{constructor(){this.state={callerProvidedOperationFingerprintsById:new Map}}bindCallerProvidedOperationIdToFingerprint(e){qD({state:this.state,operationId:e.operationId,operationFingerprint:e.operationFingerprint})}};function YD(e){for(;e.size>1024;){let t=e.keys().next().value;if(!t)return;e.delete(t)}}function XD(e){return`${String(e.walletId)}:wallet-session:${String(e.walletSessionId)}`}function ZD(e){let t=e.state;return{kind:`wallet_session_expired`,walletId:t.walletId,walletSessionId:e.walletSessionId,authMethod:t.authMethod,expiresAtMs:t.expiresAtMs,detectedAtMs:t.detectedAtMs}}async function QD(e){let t=e.state.laneIdentity;if(!(`thresholdSessionId`in t))return{kind:`cleared`};try{return t.auth.kind===`email_otp`?await e.deps.readiness.clearEmailOtpWarmSessionMaterial(t.thresholdSessionId):await e.deps.readiness.touchConfirm.clearVolatileWarmSessionMaterial(oS(t.thresholdSessionId)),{kind:`cleared`}}catch{return{kind:`unavailable`,failures:[t.auth.kind===`email_otp`?`email_otp_material`:`touch_confirm_material`]}}}var $D=class{#e;#t=new Map;#n=new Set;constructor(e){this.#e=e}async invalidate(e){let t=e.state,n=XD(t),r=this.#t.get(n);r||(r=QD({deps:this.#e,state:t}),this.#t.set(n,r));let i=await r;return i.kind===`unavailable`?(this.#t.delete(n),{kind:`unavailable`,failures:i.failures,event:null}):this.#n.has(n)?{kind:`already_invalidated`,event:null}:(this.#n.add(n),{kind:`invalidated`,event:ZD(e)})}};function eO(e){return e.lane.curve===`ed25519`&&e.readiness.curve===`ed25519`}function tO(e){return e.lane.curve===`ecdsa`&&e.readiness.curve===`ecdsa`}var nO=class{#e;#t;#n=!0;constructor(e){this.#e=e.listeners,this.#t=e.listener}unsubscribe(){this.#n&&(this.#n=!1,this.#e.delete(this.#t))}};function rO(e){return is({walletId:e.event.walletId,walletSessionId:e.event.walletSessionId,authMethod:e.event.authMethod,expiresAtMs:e.event.expiresAtMs,detectedAtMs:e.event.detectedAtMs,source:e.source})}var iO=class{constructor(e){this.lifecycleListeners=new Set,this.walletSessionQuotaAdmissionRefreshQueues=new Map,this.exactWalletSessionReadPorts=e.exactWalletSessionReadPorts,this.onPlannerTrace=e.onPlannerTrace,this.walletSessionDeps=e,this.walletSessionState={statusOverrides:new Map},this.walletSessionExpiryInvalidator=new $D({readiness:{touchConfirm:e.touchConfirm,clearEmailOtpWarmSessionMaterial:e.clearEmailOtpWarmSessionMaterial},statusOverrides:this.walletSessionState.statusOverrides}),this.operationIdBindings=new JD,this.walletSessionStatusReader=e.getStatus}async resolveActiveAuthorizedRouterAbEd25519WalletSessionState(e){return await cn({state:e.state,nowMs:e.nowMs,ports:this.exactWalletSessionReadPorts})}subscribeLifecycle(e){return this.lifecycleListeners.add(e),new nO({listeners:this.lifecycleListeners,listener:e})}async invalidateExpiredWalletSession(e){let t=await be({ports:this.exactWalletSessionReadPorts,input:{walletId:e.state.walletId,authMethod:e.state.authMethod,walletSessionId:e.state.walletSessionId,quotaId:e.state.quotaId,requiredSigningSubject:un(e.state.laneIdentity),expiry:{kind:`expired`,nowMs:e.state.detectedAtMs}}});if(t.kind!==`resolved`)return{kind:`unavailable`,failures:[`wallet_session_authorization`],event:null};let n=await this.walletSessionExpiryInvalidator.invalidate({state:e.state,walletSessionId:t.resolved.walletSessionId});if(n.kind!==`invalidated`)return n;let r=rO({event:n.event,source:e.source});return this.emitLifecycleEvent(r),{kind:`invalidated`,event:r}}emitLifecycleEvent(e){for(let t of this.lifecycleListeners)try{t(e)}catch(e){console.error(`[SigningSessionCoordinator] lifecycle listener failed`,e)}}resolveAuthPlan(e,t){let n=Tl(e),r=jl(e,n);return t?.(r),t||this.onPlannerTrace?.(r),n}async resolveAuthPlanFromReadiness(e,t){if(eO(e)){let n=await this.applyWalletSessionStatusToEd25519Readiness(e);return{...n,signingSessionPlan:this.resolveAuthPlan({lane:e.lane,readiness:n.readiness,forceFreshAuth:e.forceFreshAuth,sensitiveOperationPolicy:e.sensitiveOperationPolicy},t)}}if(tO(e)){let n=e.readiness.status===`ready`||e.readiness.status===`exhausted`||e.readiness.status===`expired`?e.readiness.expiresAtMs:Math.floor(Number(e.expiresAtMs)||0),r=e.readiness.status===`ready`||e.readiness.status===`exhausted`?e.readiness.remainingUses:0;return{readiness:e.readiness,expiresAtMs:n,remainingUses:r,signingSessionPlan:this.resolveAuthPlan({lane:e.lane,readiness:e.readiness,forceFreshAuth:e.forceFreshAuth,sensitiveOperationPolicy:e.sensitiveOperationPolicy},t)}}throw Error(`[SigningSessionCoordinator] lane and readiness curves do not match`)}async getStatus(e){let t=R(e.walletId),n=e.walletSessionId,r=new Set((e.targetThresholdSessionIds||[]).map(DE).filter(Boolean)),i=r.size>0,a=async()=>i?await ZE({deps:this.walletSessionDeps,walletSessionId:n,targetThresholdSessionIds:r}):null,o=(await IE(this.walletSessionDeps,t)).filter(t=>t.walletSessionId===n&&t.quotaId===e.quotaId);if(!o.length)return await a();let s=i?o.filter(e=>r.has(e.thresholdSessionId)):o;if(i&&!s.length)return await a()||{sessionId:n,status:`not_found`};let c=VE({lanes:s,claimsByThresholdSessionId:await qE({deps:this.walletSessionDeps,lanes:s}),statusOverrides:this.walletSessionState.statusOverrides}),l=s.map(e=>c.get(e.thresholdSessionId)||null).filter(Boolean);return QE({walletSessionId:n,lanes:s,claim:l.find(e=>e?.state===`expired`)||l.find(e=>e?.state===`exhausted`)||l.find(e=>e?.state===`unavailable`)||l.find(e=>e?.state===`warm`)||null})}async getLaneClaimsForWallet(e){return await YE({deps:this.walletSessionDeps,walletId:R(e),statusOverrides:this.walletSessionState.statusOverrides})}async clear(e){await $E({deps:this.walletSessionDeps,statusOverrides:this.walletSessionState.statusOverrides,walletId:R(e.walletId),walletSessionId:e.walletSessionId,quotaId:e.quotaId})}async getAvailableStatus(e){return this.walletSessionStatusReader?await this.walletSessionStatusReader(e):null}bindCallerProvidedOperationIdToFingerprint(e){this.operationIdBindings.bindCallerProvidedOperationIdToFingerprint(e)}async readWalletSessionStatus(e){let t=e?.authorization.walletSessionId;if(!t)return{kind:`authorization_missing`};if(!this.walletSessionStatusReader)return{kind:`status`,status:CE({walletSessionId:t,reason:`adapter_unavailable`})};let n=await this.walletSessionStatusReader(e);return n?{kind:`status`,status:n}:{kind:`status`,status:CE({walletSessionId:t,reason:`missing_trusted_status`})}}async runWalletSessionQuotaAdmissionRetry(e){let t=String(e.queueKey),n=this.walletSessionQuotaAdmissionRefreshQueues.get(t);if(n)return await n.catch(()=>void 0),await e.retryAfterRefresh();let r=e.refresh(),i=r.catch(()=>void 0).then(()=>{this.walletSessionQuotaAdmissionRefreshQueues.get(t)===i&&this.walletSessionQuotaAdmissionRefreshQueues.delete(t)});return this.walletSessionQuotaAdmissionRefreshQueues.set(t,i),await r}async applyWalletSessionStatusToEd25519Readiness(e){let t=String(e.lane.walletSessionId).trim(),n=await aO({lane:e.lane,trustedStatusAuth:e.trustedStatusAuth,nowMs:Date.now(),exactWalletSessionReadPorts:this.exactWalletSessionReadPorts}),r=await this.readWalletSessionStatus(n).catch(()=>n?{kind:`status`,status:{sessionId:String(n.authorization.walletSessionId),status:`unavailable`}}:{kind:`authorization_missing`});if(r.kind===`authorization_missing`)return kE({status:`missing_session`,thresholdSessionId:e.readiness.thresholdSessionId,walletSessionStatus:null,expiresAtMs:Math.floor(Number(e.expiresAtMs)||0),remainingUses:0,usesNeeded:e.usesNeeded,missingWhenExpiresAtMissing:e.missingWhenExpiresAtMissing});let i=r.status,a=Js(e.lane.auth)===`email_otp`&&e.lane.curve===`ed25519`&&(i?.status===`status_unknown`||i?.status===`unavailable`),o=Js(e.lane.auth)===`passkey`&&e.readiness.status===`ready`&&(i?.status===`status_unknown`||i?.status===`unavailable`),s=i;return o?s=null:a&&(s={sessionId:t,status:`not_found`,statusCode:i.status}),a&&console.warn(`[SigningSessionCoordinator][email-otp-ed25519] session-status preflight unavailable`,{walletSessionId:t,thresholdSessionId:e.lane.thresholdSessionId,sessionStatus:i.status,readiness:e.readiness.status,remainingUses:e.remainingUses,usesNeeded:e.usesNeeded}),o&&console.debug(`[SigningSessionCoordinator][passkey-ed25519] session-status preflight deferred`,{walletSessionId:t,thresholdSessionId:e.lane.thresholdSessionId,sessionStatus:i.status,readiness:e.readiness.status,remainingUses:e.remainingUses,usesNeeded:e.usesNeeded}),kE({status:e.readiness.status,thresholdSessionId:e.readiness.thresholdSessionId,walletSessionStatus:s,expiresAtMs:Math.floor(Number(e.expiresAtMs)||0),remainingUses:Math.floor(Number(e.remainingUses)||0),usesNeeded:e.usesNeeded,missingWhenExpiresAtMissing:e.missingWhenExpiresAtMissing})}};async function aO(e){let t=vE(e.lane);if(e.trustedStatusAuth)return gE({owner:t,authorization:{walletSessionId:e.trustedStatusAuth.walletSessionId,quotaId:e.trustedStatusAuth.quotaId}});let n=await be({ports:e.exactWalletSessionReadPorts,input:{walletId:t.walletId,authMethod:Js(e.lane.auth),walletSessionId:e.lane.walletSessionId,quotaId:e.lane.quotaId,requiredSigningSubject:un(e.lane.identity),expiry:{kind:`unexpired`,nowMs:e.nowMs}}});return n.kind===`resolved`?gE({owner:t,authorization:{walletSessionId:n.resolved.walletSessionId,quotaId:n.resolved.session.quotaId}}):null}const oO={resolveSelectedWalletAuthority:K.resolveSelectedWalletAuthority.bind(K),readExactWithOperationCredential:G.readExactWithOperationCredential.bind(G)};function sO(e){return e.getEmailOtpWarmSessionStatus||(async t=>await e.passkeyMpcSession.getWarmSessionStatus({thresholdSessionId:t.thresholdSessionId}))}function cO(e){let{createArgs:t,getEmailOtpWarmSessionStatus:n}=e;return new iO({exactWalletSessionReadPorts:oO,getStatus:t.getWalletSessionStatus,touchConfirm:t.passkeyMpcSession,getEmailOtpWarmSessionStatus:e=>n({kind:`ecdsa`,thresholdSessionId:e}),clearEmailOtpWarmSessionMaterial:t.clearEmailOtpWarmSessionMaterial})}function lO(e){return{availableLanes:{activeWalletAuthorityEcdsaRuntimeReadPorts:oO,ed25519YaoPublicCapabilityLanes:e.ed25519YaoPublicCapabilityLanes,isEd25519YaoPublicCapabilityActive:e.isEd25519YaoPublicCapabilityActive,readActiveWalletSessionAuthorization:e.readActiveWalletSessionAuthorization,listEcdsaSigningCapabilitiesForWallet:e.listEcdsaSigningCapabilitiesForWallet},signingSessionSeal:e.seamsWebConfigs.signing.sessionSeal.mode===`sealed_refresh_v1`?{groupId:Ns}:void 0,getConfiguredEcdsaChainTargets:()=>Hr(e.seamsWebConfigs.network.chains),discovery:{emailOtp:t=>e.emailOtpSessions.discoverPersistedSessionsForWallet(t),passkey:t=>e.passkeyMpcSession.discoverPersistedSessionsForWallet(t)}}}async function uO(e,t){let{runtime:n,session:r,operationCredential:i}=t.capability.authorization,a=i.walletSessionId;try{let o=n.relayerUrl,s=n.clientVerifyingPublicKey33B64u,c=Date.now(),l=Math.min(n.expiresAtMs,r.expiresAtMs);if(l<=c)return{status:`skipped`,reason:`session_expired`,walletSessionId:a};let u=vd(e.routerAbEcdsaDerivationPresignaturePoolPolicy);if(!u.enabled)return{status:`skipped`,reason:`pool_disabled`,walletSessionId:a};let d=n.remainingUses,f={kind:`router_ab_ecdsa_derivation_signing_worker_pool`,scope:n.normalSigning.scope,ceremonyExpiresAtMs:l,materialExpiresAtMs:c+dr},p=e.resolveClientSigningMaterialSource({manifest:t.capability.capability.manifest}),m=xd({relayerUrl:o,keyHandle:$o(n.keyHandle),ecdsaThresholdKeyId:Qo(n.ecdsaThresholdKeyId),clientVerifyingShareB64u:Yo(s),clientSigningMaterial:p,thresholdEcdsaPublicKeyB64u:n.thresholdEcdsaPublicKeyB64u,relayerVerifyingShareB64u:n.normalSigning.scope.public_identity.server_public_key33_b64u,credential:{kind:`wallet_session_opaque`,walletSessionToken:i.token},authorization:{kind:`reusable_wallet_session`,wallet_session_id:i.walletSessionId},materialActivation:Un(n.materialActivation),routerAbEcdsaDerivationPoolFill:f,workerCtx:e.getSignerWorkerContext(),poolPolicy:u});return m.scheduled?(t.waitForPoolReady&&await cd({relayerUrl:o,scope:n.normalSigning.scope,materialActivation:Un(n.materialActivation)}),{status:`scheduled`,reason:`scheduled`,walletSessionId:a,remainingUses:d,schedule:m}):(t.waitForPoolReady&&m.reason===`in_flight_for_pool_key`&&await cd({relayerUrl:o,scope:n.normalSigning.scope,materialActivation:Un(n.materialActivation)}),{status:`skipped`,reason:`refill_not_scheduled`,walletSessionId:a,remainingUses:d,schedule:m})}catch(e){return{status:`failed`,reason:`unexpected_error`,walletSessionId:a,error:e instanceof Error?e.message:`unexpected error`}}}async function dO(e,t){let n=await e.statusReader.getEd25519SigningSessionStatus(t),r=t.authorization?EE({owner:_E(t.runtime.walletId),authorization:{walletSessionId:t.authorization.operationCredential.walletSessionId,quotaId:t.authorization.session.quotaId}}):null;return TE(n,r?await wE({getAvailableStatus:e.getWalletSessionStatus},r):null)}async function fO(e,t){return await uO({getSignerWorkerContext:e.getSignerWorkerContext,resolveClientSigningMaterialSource:e.resolveClientSigningMaterialSource,routerAbEcdsaDerivationPresignaturePoolPolicy:e.routerAbEcdsaDerivationPresignaturePoolPolicy},t)}async function pO(e,t){await e.hydrateSigningSession(t)}async function mO(e,t){await e.clearVolatileWarmSigningMaterial(t)}function hO(e){let t=e.capability===`ecdsa`?e.runtime?.sealedRecord.thresholdSessionId:e.runtime?.thresholdSessionId,n=t?String(t).trim():null;return{state:e.state,thresholdSessionId:n||null,authState:e.auth?`present`:`missing`,prfClaimState:e.prfClaim?.state||null,...e.prfClaim?.state===`warm`?{remainingUses:e.prfClaim.remainingUses,expiresAtMs:e.prfClaim.expiresAtMs}:{}}}function gO(e){return{capabilities:{ed25519:hO(e.capabilities.ed25519),ecdsa:{evm:hO(e.capabilities.ecdsa.evm),tempo:hO(e.capabilities.ecdsa.tempo)}}}}function _O(e){if(typeof e.onTransition==`function`)try{let t=e.onTransition(e.event);t&&typeof t.then==`function`&&Promise.resolve(t).catch(t=>{console.warn(`[WarmSessionStore] warm-session transition callback failed`,{type:e.event.type,walletId:e.event.walletId,error:t})})}catch(t){console.warn(`[WarmSessionStore] warm-session transition callback failed`,{type:e.event.type,walletId:e.event.walletId,error:t})}}function vO(e){return String(e||``).trim()||void 0}function yO(e){let t=String(e.persistedSessionIdRaw||``).trim();if(t!==e.expectedThresholdSessionId)throw Error(`[WarmSessionStore] provisioned Ed25519 capability was not persisted for ${e.walletId} (expected thresholdSessionId=${e.expectedThresholdSessionId}, found=${t||`missing`})`)}function bO(e){return e.kind===`exact_ed25519_provisioning`?R(Kc(e.laneIdentity,`exact Ed25519 capability provisioning`).walletId):R(e.walletId)}function xO(e){return Hi(e.kind===`exact_ed25519_provisioning`?Kc(e.laneIdentity,`exact Ed25519 capability provisioning`).nearAccountId:e.nearAccountId)}async function SO(e,t){let n=xO(t),r=bO(t);if(!r)throw Error(`[WarmSessionStore] walletId is required to provision Ed25519 capability`);if(typeof e.provisionThresholdEd25519Session!=`function`)throw Error(`[WarmSessionStore] provisionThresholdEd25519Session is required to provision Ed25519 capability`);let i=await e.getWarmSession(r);await t.beforeProvision?.(),t.assertNotCancelled?.();let a=await e.provisionThresholdEd25519Session(t);if(t.assertNotCancelled?.(),!a.ok)return a;let o=vO(a.thresholdSessionId);if(!o)throw Error(`[WarmSessionStore] provisioned Ed25519 capability is missing thresholdSessionId for ${n}`);let s=await e.getWarmSession(r);return yO({walletId:r,expectedThresholdSessionId:o,persistedSessionIdRaw:s.capabilities.ed25519.runtime?.thresholdSessionId}),_O({onTransition:e.onTransition,event:{type:`ed25519_capability_provisioned`,walletId:r,thresholdSessionId:o,before:gO(i),after:gO(s)}}),a}async function CO(e,t){return await SO({getWarmSession:t=>e.getWarmSession(t),provisionThresholdEd25519Session:async t=>await e.provisionThresholdEd25519Session(t)},t)}async function wO(e,t){return await e.bootstrapEcdsaSession(t)}function TO(e){let t=Hr(e.seamsWebConfigs.network.chains),n=e=>{if(e.ecdsaChainTargets.length===0)return e;let n=new Map;for(let r of[...e.ecdsaChainTargets,...t])n.set(z(r),r);return{...e,ecdsaChainTargets:[...n.values()]}};return{sessionLifecycle:e.sessionLifecycle,laneSelection:{readPersistedAvailableSigningLanesForTargets:t=>UT({activeWalletAuthorityEcdsaRuntimeReadPorts:oO,ed25519YaoPublicCapabilityLanes:e.ed25519YaoPublicCapabilityLanes,isEd25519YaoPublicCapabilityActive:e.isEd25519YaoPublicCapabilityActive,readActiveWalletSessionAuthorization:e.readActiveWalletSessionAuthorization,listEcdsaSigningCapabilitiesForWallet:e.listEcdsaSigningCapabilitiesForWallet},{...n(t),requiredEcdsaCapability:`export_keys`},new wt,`all`),readOwnerScopedAvailableSigningLanesForTargets:async t=>await RT({activeWalletAuthorityEcdsaRuntimeReadPorts:oO,ed25519YaoPublicCapabilityLanes:e.ed25519YaoPublicCapabilityLanes,isEd25519YaoPublicCapabilityActive:e.isEd25519YaoPublicCapabilityActive,readActiveWalletSessionAuthorization:e.readActiveWalletSessionAuthorization,listEcdsaSigningCapabilitiesForWallet:e.listEcdsaSigningCapabilitiesForWallet},{...n(t),requiredEcdsaCapability:`export_keys`,ownerScope:await e.resolveOwnerLaneScope(String(t.walletId))},new wt)},ecdsa:{activeWalletAuthorityEcdsaRuntimeReadPorts:oO,sessionStore:{...e.ecdsaSessions,resolveActiveEcdsaCapabilityRuntime:e.resolveActiveEcdsaCapabilityRuntime,relayerUrl:String(e.relayerUrl).trim().replace(/\/+$/g,``)},touchConfirm:e.touchConfirm,emailOtp:{requestExportChallenge:t=>e.emailOtpSessions.requestExportChallenge(t),exportEcdsaKeyWithDurableAuthorization:t=>e.emailOtpSessions.exportEcdsaKeyWithDurableAuthorization(t)},provisionPasskeyEcdsaExplicitExportSession:t=>e.provisionPasskeyEcdsaExplicitExportSession(t),getSignerWorkerContext:()=>e.signerWorkerManager.getContext(),withThresholdEcdsaSigningQueue:e.withThresholdEcdsaSigningQueue},ed25519Yao:{touchConfirm:e.touchConfirm,passkeyMpcExport:e.passkeyMpcExport,resolvePasskeyExportContext:e.resolvePasskeyEd25519YaoExportContext,withThresholdEd25519CommitQueue:e.withThresholdEd25519CommitQueue,emailOtp:{requestExportChallenge:t=>e.emailOtpSessions.requestExportChallenge(t),resolveExportContext:t=>e.resolveEmailOtpEd25519YaoExportContext(t),exportSeedWithFreshAuthorization:t=>e.emailOtpSessions.exportEd25519YaoSeedWithFreshEmailOtpLane(t)}},getTheme:e.getTheme}}function EO(e){return async t=>{let n=t.authorization,r=await e.readAuthorization(t.owner.walletId);switch(r.kind){case`missing`:case`corrupt`:case`persistence_unavailable`:case`upgrade_required`:return null;case`found`:break;default:return r}if(!DO(n,t.owner.walletId,r))return null;let i=String(e.relayerUrl||``).trim();if(!i)return null;let a=await Ot({relayerUrl:i,operationCredential:r.operationCredential}).read(n).catch(()=>null);return a?SE(a):null}}function DO(e,t,n){return n.record.walletId===t&&n.record.quotaId===e.quotaId&&n.operationCredential.walletSessionId===e.walletSessionId}async function OO(e,t){let n=t.laneIdentity,r={kind:`ed25519`,laneIdentity:n},i=Jc(n),a;try{a=await e.resolveSelectedWalletAuthority(String(i))}catch{return zf({observation:{kind:`unavailable`,source:r},nowMs:t.nowMs})}if(a.kind!==`resolved`)return zf({observation:a.kind===`integrity_error`?{kind:`invalid`,source:r}:{kind:`missing`,source:r},nowMs:t.nowMs});if(!kO(a,n))return zf({observation:{kind:`invalid`,source:r},nowMs:t.nowMs});let o;try{o=await e.readExactActiveForWallet({walletId:i,authorityId:a.authority.authorityId,authMethodId:a.authMethod.walletAuthMethodId})}catch{return zf({observation:{kind:`unavailable`,source:r},nowMs:t.nowMs})}switch(o.kind){case`missing`:return zf({observation:{kind:`missing`,source:r},nowMs:t.nowMs});case`corrupt`:case`upgrade_required`:return zf({observation:{kind:`invalid`,source:r},nowMs:t.nowMs});case`persistence_unavailable`:return zf({observation:{kind:`unavailable`,source:r},nowMs:t.nowMs});case`found`:break}return o.record.walletId!==i||o.record.authorityId!==a.authority.authorityId||o.record.authMethodId!==a.authMethod.walletAuthMethodId||o.operationCredential.walletSessionId!==n.walletSessionId||o.record.quotaId!==n.quotaId||o.record.authorityDigestB64u!==a.authority.authorityDigestB64u||o.record.authorityRevocationEpoch!==a.authority.revocationEpoch?zf({observation:{kind:`invalid`,source:r},nowMs:t.nowMs}):zf({observation:{kind:`found`,source:r,expiresAtMs:o.record.expiresAtMs},nowMs:t.nowMs})}function kO(e,t){let n=Jc(t);if(e.selection.lockState!==`unlocked`||e.selection.walletId!==n||e.selection.walletAuthMethodId!==e.authMethod.walletAuthMethodId||e.authMethod.walletId!==n||e.authMethod.walletAuthorityId!==e.authority.authorityId||e.authMethod.status!==`active`||e.authority.walletId!==n||e.authority.state!==`active`)return!1;switch(t.auth.kind){case`passkey`:return e.authMethod.kind===`passkey`&&String(e.authMethod.rpId)===String(t.auth.rpId)&&e.authMethod.credentialIdB64u===t.auth.credentialIdB64u;case`email_otp`:return e.authMethod.kind===`email_otp`}}function AO(e){return zf({observation:{kind:`found`,source:{kind:`ecdsa`,laneIdentity:e.laneIdentity,authorization:e.authorization},expiresAtMs:e.authorization.session.expiresAtMs},nowMs:e.nowMs})}async function jO(e,t){switch(t.kind){case`ed25519`:return await OO(e,t);case`ecdsa`:return AO(t)}}async function MO(e){if(e.lane.auth.kind!==`email_otp`)return null;try{let t=await e.createArgs.resolveCanonicalEcdsaSigningCapability({walletId:e.lane.signer.walletId,chainTarget:e.lane.signer.chainTarget,materialActivation:e.lane.signer.materialActivation});if(!$n(t.authority)||t.authority.factor.providerUserId!==e.lane.auth.providerSubjectId)return null;let n=await e.createArgs.resolveActiveEcdsaWalletSessionAuthorization({walletId:e.lane.signer.walletId,chainTarget:e.lane.signer.chainTarget,materialActivation:e.lane.signer.materialActivation});if(!n)return null;let r=ef({capability:t,authorization:n,nowMs:Date.now()}),i=r.authorization.runtime;return r.authorization.selectedAuthMethod.kind!==`email_otp`||i.authBinding.kind!==`email_otp`||!ur(t.authority,i.authBinding.emailOtpAuthority)||t.authority.factor.providerUserId!==e.lane.auth.providerSubjectId||i.walletId!==e.lane.signer.walletId||!Vr(i.chainTarget,e.lane.signer.chainTarget)||!b(i.materialActivation,e.lane.signer.materialActivation)?null:r.authorization}catch{return null}}function NO(e){let{createArgs:t,signingSessionCoordinator:n,getEmailOtpWarmSessionStatus:r}=e;return{activeWalletAuthorityEcdsaRuntimeReadPorts:oO,resolveOwnerLaneScope:t.resolveOwnerLaneScope,resolveCanonicalEcdsaSigningCapability:t.resolveCanonicalEcdsaSigningCapability,resolveAuthorizedEcdsaSigningCapability:t.resolveAuthorizedEcdsaSigningCapability,resolveActiveEcdsaWalletSessionAuthorization:t.resolveActiveEcdsaWalletSessionAuthorization,walletSignerStore:e.walletSignerStore,passkeyAuthenticatorStore:e.passkeyAuthenticatorStore,seamsWebConfigs:t.seamsWebConfigs,nonceCoordinator:t.nonceCoordinator,ensureSealedRefreshStartupParity:t.ensureSealedRefreshStartupParity,getSignerWorkerContext:()=>t.signerWorkerManager.getContext(),requestEmailOtpTransactionSigningChallenge:({walletSession:e,chain:n,authority:r,operationFingerprintDigest:i})=>t.requestEmailOtpTransactionSigningChallenge?.({walletSession:e,chain:n,authority:r,operationFingerprintDigest:i})||Promise.reject(Error(`Email OTP signing challenge is not configured`)),resolveDurableEmailOtpEcdsaSigningSessionAuthority:async({lane:e})=>await MO({lane:e,createArgs:t}),restorePersistedSessionForSigning:e=>t.restorePersistedSessionForSigning(e),readAvailableSigningLanesForSigning:e=>t.readAvailableSigningLanesForSigning(e),signingSessionCoordinator:n,getEmailOtpWarmSessionStatus:e=>r({kind:`ecdsa`,thresholdSessionId:e}),provisionThresholdEcdsaSession:e=>t.provisionThresholdEcdsaSession(e),withThresholdEcdsaSigningQueue:e=>t.withThresholdEcdsaSigningQueue(e),touchConfirm:t.touchConfirm}}function PO(e){let{createArgs:t,nearRpcUrl:n,signingSessionCoordinator:r}=e;return{nearRpcUrl:n,touchConfirm:t.touchConfirm,resolveOwnerLaneScope:t.resolveOwnerLaneScope,prepareNearEd25519YaoMaterialBoundary:t.prepareNearEd25519YaoMaterialBoundary,createSigningSessionId:e=>_l(e),getSignerWorkerContext:()=>t.signerWorkerManager.getContext(),readAvailableSigningLanesForSigning:e=>t.readAvailableSigningLanesForSigning(e),...t.requestEmailOtpEd25519SigningChallenge?{requestEmailOtpEd25519SigningChallenge:e=>t.requestEmailOtpEd25519SigningChallenge(e)}:{},signingSessionCoordinator:r,withThresholdEd25519CommitQueue:e=>t.withThresholdEd25519CommitQueue(e)}}function FO(e){return{credentialStore:e.credentialStore,touchIdPrompt:e.createArgs.touchIdPrompt,getSignerWorkerContext:()=>e.createArgs.signerWorkerManager.getContext(),routerAbNormalSigning:e.createArgs.seamsWebConfigs.signing.routerAb.normalSigning,defaultRelayerUrl:e.createArgs.seamsWebConfigs.network.relayer?.url||``,persistThresholdEcdsaBootstrapForWalletTarget:e.createArgs.persistThresholdEcdsaBootstrapForWalletTarget}}function IO(e){return{accountStore:e.accountStore,userPreferencesManager:e.createArgs.userPreferencesManager,nonceCoordinator:e.createArgs.nonceCoordinator}}var LO=class{async upsert(e){}async remove(e){}async list(){return[]}async upsertLane(e){}async removeLane(e){}async listLanes(){return[]}};function RO(e,t){let n=String(e??``).trim();if(!n)throw Error(`${t} is required`);return n}function zO(e){let t=e.materialActivation;return JSON.stringify([RO(e.walletId,`walletId`),RO(e.nearAccountId,`nearAccountId`),RO(t.activationId,`materialActivation.activationId`),RO(t.capability,`materialActivation.capability`),RO(t.materialOwner,`materialActivation.materialOwner`),RO(t.keyBinding,`materialActivation.keyBinding`),RO(t.lifecycleBinding,`materialActivation.lifecycleBinding`),RO(t.signingWorker,`materialActivation.signingWorker`)])}function BO(e){if(e.activeClient.status().kind!==`active`)throw Error(`Ed25519 Yao active Client registry rejects disposed state`);let t=e.activeClient.metadata(),n=e.facts,r=n.signer,i=r.account.wallet.walletId,a=r.account.nearAccountId,o=RO(n.thresholdSessionId,`material.facts.thresholdSessionId`),s=Mc(t);if(t.scope.threshold_session_id!==o||!Vn(t.scope.material_activation,Un(s))||t.scope.account_id!==String(i)||t.applicationBinding.wallet_id!==String(i)||t.applicationBinding.near_ed25519_signing_key_id!==String(r.nearEd25519SigningKeyId)||t.applicationBinding.signing_root_id!==n.signingRootId||t.scope.root_share_epoch!==n.signingRootVersion||t.applicationBinding.key_creation_signer_slot!==r.signerSlot||t.scope.signing_worker_id!==n.routerAbNormalSigning.signingWorkerId)throw Error(`Ed25519 Yao active Client registry subject identity mismatch`);if(t.participantIds[0]!==kn[0]||t.participantIds[1]!==kn[1])throw Error(`Ed25519 Yao active Client registry participant identity mismatch`);return{walletId:i,nearAccountId:a,materialActivation:s}}function VO(e,t){return String(e.walletId)===String(t.walletId)&&String(e.nearAccountId)===String(t.nearAccountId)&&b(e.materialActivation,t.materialActivation)}var HO=class{constructor(e=new LO){this.publicReferences=e,this.entries=new Map,this.lifecycleGeneration=0}async activate(e){let t=BO(e),n=zO(t),r=this.lifecycleGeneration;for(let n of this.entries.values())if(n.material.activeClient===e.activeClient&&!VO(n.identity,t))throw Error(`Ed25519 Yao active Client state is already bound to another identity`);let i=this.entries.get(n);if(!i&&this.entries.size>=64)throw Error(`Ed25519 Yao active Client registry capacity is exhausted`);if(await this.publicReferences.upsert({walletId:t.walletId,nearAccountId:t.nearAccountId,thresholdSessionId:e.facts.thresholdSessionId,runtimePolicyScope:e.facts.runtimePolicyScope,materialActivation:t.materialActivation}),r!==this.lifecycleGeneration||e.activeClient.status().kind!==`active`)throw e.activeClient.dispose(),await this.publicReferences.remove(t),await this.publicReferences.removeLane(t),Error(`Ed25519 Yao active Client activation was interrupted`);return i&&i.material.activeClient!==e.activeClient&&i.material.activeClient.dispose(),this.entries.set(n,{identity:t,material:e}),t}resolve(e){let t=zO(e),n=this.entries.get(t);return n?n.material.activeClient.status().kind===`disposed`?(this.entries.delete(t),null):n.material:null}resolveExact(e){return this.resolve(e)}resolveForWalletAccount(e){let t=null;for(let n of this.entries.values())if(!(String(n.identity.walletId)!==String(e.walletId)||String(n.identity.nearAccountId)!==String(e.nearAccountId))&&n.material.activeClient.status().kind!==`disposed`){if(t)throw Error(`Ed25519 Yao active Client lookup scope is ambiguous`);t=n.material}return t}async rollbackActivation(e){this.lifecycleGeneration+=1;let t=zO(e),n=this.entries.get(t);return n&&(this.entries.delete(t),n.material.activeClient.dispose()),await this.publicReferences.remove(e),await this.publicReferences.removeLane(e),n!==void 0}disposeWallet(e){this.lifecycleGeneration+=1;let t=RO(e,`walletId`),n=0;for(let[e,r]of this.entries)String(r.identity.walletId)===t&&(this.entries.delete(e),r.material.activeClient.dispose(),n+=1);return n}dispose(){this.lifecycleGeneration+=1;for(let e of this.entries.values())e.material.activeClient.dispose();this.entries.clear()}};function UO(e){return e.workerWarmupPolicy.shouldPrewarmWorkers(e.workerBaseOrigin)}function WO(e){return e.workerWarmupPolicy.shouldPrewarmUiConfirmUi(e.workerBaseOrigin)}function GO(e){return Math.max(0,Math.round(performance.now()-e))}async function KO(e){let t=performance.now();try{await e()}catch{}return GO(t)}async function qO(e,t){if(!e)return null;try{return await Nl(e,t)}catch{return null}}async function JO(e,t={kind:`none`}){let n=t.kind===`near_account_bound`?t.account:null,r=n?Hi(n.nearAccountId):null,i=await qO(r,e.store),a=n&&r&&i?await KO(()=>e.activateAuthenticatedWalletState({walletId:n.wallet.walletId,nearAccountId:r,signerSlot:i,nearClient:e.nearClient})):0,o=await KO(()=>e.nonceCoordinator.prefetchNearContext({kind:`initialized_state`,nearClient:e.nearClient})),s=r&&i?await KO(async()=>{await mh({clientDB:e.store,keyMaterialStore:e.store},r,i).catch(()=>null)}):0,c=WO(e),l=UO(e),[u,d]=await Promise.all([c?KO(()=>e.prewarmUiConfirmUi()):Promise.resolve(0),l?KO(()=>e.prewarmWorkers()):Promise.resolve(0)]);return{kind:`worker_resource_warmup_diagnostics_v1`,authenticatedWalletStateMs:a,noncePrefetchMs:o,keyMaterialReadMs:s,uiConfirmPrewarmMs:u,signerWorkerPrewarmMs:d}}function YO(e){return Or(e.seamsWebConfigs.network.chains)}function XO(e,t){return()=>({workerBaseOrigin:e.getWorkerBaseOrigin(),store:t.warmupStore,nearClient:e.nearClient,nonceCoordinator:e.nonceCoordinator,prewarmWorkers:e.signerWorkerManager.prewarmWorkers.bind(e.signerWorkerManager),workerWarmupPolicy:e.workerWarmupPolicy,prewarmUiConfirmUi:async()=>{await Promise.all([e.touchConfirm.initialize(),e.passkeyMpcSession.prewarmShamir3Pass(),Iu().catch(()=>{}),Lu().catch(()=>{}),Ru().catch(()=>{}),Fu().catch(()=>{})])},activateAuthenticatedWalletState:e.activateAuthenticatedWalletState})}function ZO(e){let{createArgs:t,getWorkerResourceWarmupDeps:n}=e;return()=>({signTempo:t.signTempo,warmCriticalResources:e=>JO(n(),e)})}function QO(e){let t=new HO(e.ed25519YaoPublicCapabilityReferences),n=YO(e),r=sO(e),i=cO({createArgs:e,getEmailOtpWarmSessionStatus:r}),a=XO(e,{warmupStore:e.stores.warmup.store});return{ed25519YaoActiveClients:t,nearSigningDeps:PO({createArgs:e,nearRpcUrl:n,signingSessionCoordinator:i}),tempoSigningDeps:NO({createArgs:e,walletSignerStore:e.stores.walletProfileAndSignerRecords.walletSignerStore,passkeyAuthenticatorStore:e.stores.walletProfileAndSignerRecords.passkeyAuthenticatorStore,signingSessionCoordinator:i,getEmailOtpWarmSessionStatus:r}),registrationAccountLifecycleDeps:IO({createArgs:e,accountStore:e.stores.walletProfileAndSignerRecords.accountStore}),registrationSessionDeps:{touchConfirm:e.touchConfirm,touchIdPrompt:e.touchIdPrompt},walletSessionActivationDeps:FO({createArgs:e,credentialStore:e.stores.recoveryAndDeviceLinking.credentialStore}),signingSessionCoordinator:i,getWorkerResourceWarmupDeps:a,getManagerConveniencePorts:ZO({createArgs:e,getWorkerResourceWarmupDeps:a})}}const $O=new gs;function ek(e,t){return e.kind===t.kind&&e.walletId===t.walletId&&e.authorityId===t.authorityId&&e.authMethodId===t.authMethodId&&e.authorizationId===t.authorizationId&&e.quotaId===t.quotaId&&e.issuedAtMs===t.issuedAtMs&&e.expiresAtMs===t.expiresAtMs}function tk(e,t){return e.walletId===t.authority.walletId&&e.authorityId===t.authority.authorityId&&e.authMethodId===t.authMethod.walletAuthMethodId&&e.authorityDigestB64u===t.authority.authorityDigestB64u&&e.authorityRevocationEpoch===t.authority.revocationEpoch}function nk(e){if(e.authMethod!==`passkey`)throw Error(`Passkey restore adapter received a non-Passkey request`);let{authMethod:t,...n}=e;return n}const rk={getWalletAuthMethodV2:K.getWalletAuthMethodV2.bind(K),listWalletAuthMethodsForWallet:K.listWalletAuthMethodsForWallet.bind(K),readEmailOtpProviderSubjectForWallet:_s.bind(null,K)};async function ik(){return null}async function ak(e,t){let n=await t.getWalletAuthMethodV2(String(e.walletAuthMethodId));if(!n||n.status!==`active`||n.walletId!==e.walletId)throw Error(`Exact wallet authentication authority is unavailable`);let r;try{r=await Hd({authMethod:n,stores:{...t,getWalletPasskeyAuthenticator:ik}})}catch{throw Error(`Exact wallet authentication authority is unavailable`)}let i=await L({authority:r});if(i.walletId===e.walletId&&i.walletAuthMethodId===e.walletAuthMethodId&&i.authorityDigest===e.authorityDigest)return r;throw Error(`Exact wallet authentication authority is unavailable`)}function ok(e){return EO({relayerUrl:String(e.seamsWebConfigs.network.relayer?.url||``).trim(),readAuthorization:zk})}function sk(e,t){return e.kind!==`resolved`||e.selection.lockState!==`unlocked`||e.selection.walletId!==t||e.selection.walletAuthMethodId!==e.authMethod.walletAuthMethodId||e.authMethod.status!==`active`||e.authMethod.walletId!==t||e.authMethod.walletAuthorityId!==e.authority.authorityId||e.authority.state!==`active`||e.authority.walletId!==t?null:{kind:e.kind,selection:e.selection,authMethod:e.authMethod,authority:e.authority,signerMaterials:e.signerMaterials,exportRoot:e.exportRoot}}async function ck(e){return await Hd({authMethod:e.authMethod,stores:{...rk,getWalletPasskeyAuthenticator:ik}})}async function lk(e){let t;try{t=await K.resolveSelectedWalletAuthority(String(e.walletId))}catch{throw Error(`[SigningEngine][near] exact Passkey authority is unavailable`)}let n=sk(t,e.walletId);if(!n||n.authMethod.kind!==B.passkey)throw Error(`[SigningEngine][near] exact Passkey authority is unavailable`);if(e.runtime.walletId!==e.walletId||e.runtime.factor.kind!==B.passkey||String(e.runtime.factor.rpId)!==String(n.authMethod.rpId)||e.runtime.factor.credentialIdB64u!==n.authMethod.credentialIdB64u)throw Error(`[SigningEngine][near] exact Passkey authority changed`);let r;try{r=await on({runtime:e.runtime,walletAuthMethodId:n.authMethod.walletAuthMethodId})}catch{throw Error(`[SigningEngine][near] exact Passkey authority changed`)}let i;try{i=await ck(n)}catch{throw Error(`[SigningEngine][near] exact Passkey authority changed`)}let a=await L({authority:i});if(a.walletId!==r.walletId||a.walletAuthMethodId!==r.walletAuthMethodId||a.authorityDigest!==r.authorityDigest)throw Error(`[SigningEngine][near] exact Passkey authority changed`);return a}async function uk(e){switch(e.authorizationRead.kind){case`expired`:case`exhausted`:return await lk(e);case`found`:{let t=e.authorizationRead.authorization;if(t.selectedAuthMethod.kind!==B.passkey||e.runtime.factor.kind!==B.passkey||String(e.runtime.factor.rpId)!==String(t.selectedAuthMethod.rpId)||e.runtime.factor.credentialIdB64u!==t.selectedAuthMethod.credentialIdB64u)throw Error(`[SigningEngine][near] exact Passkey authority changed`);let n=await on({runtime:e.runtime,walletAuthMethodId:t.selectedAuthMethod.walletAuthMethodId}),r=await L({authority:t.selectedFactorAuthority});if(n.walletId!==r.walletId||n.walletAuthMethodId!==r.walletAuthMethodId||n.authorityDigest!==r.authorityDigest)throw Error(`[SigningEngine][near] exact Passkey authority changed`);return n}default:throw e.authorizationRead,Error(`[SigningEngine][near] unsupported exact Passkey authorization read`)}}function dk(e){switch(e.status){case`missing`:return{kind:`missing`};case`exhausted`:return{kind:`exhausted`};case`expired`:return{kind:`expired`};case`superseded`:return{kind:`superseded`};case`authority_unavailable`:return{kind:`authority_unavailable`};case`method_unavailable`:return{kind:`method_unavailable`};case`capability_unavailable`:return{kind:`capability_unavailable`};case`invalid`:return{kind:`unavailable`};case`active`:throw Error(`[SigningEngine][near] active status must be resolved as authorization`);default:throw Error(`[SigningEngine][near] unsupported Wallet Session status`)}}async function fk(e,t,n){let r=R(n),i;try{i=await K.resolveSelectedWalletAuthority(String(r))}catch{return{kind:`persistence_unavailable`}}let a=sk(i,r);if(!a)return{kind:`missing`};let o;try{o=await G.readExactActiveForWallet({walletId:r,authorityId:a.authority.authorityId,authMethodId:a.authMethod.walletAuthMethodId})}catch{return{kind:`persistence_unavailable`}}switch(o.kind){case`missing`:case`corrupt`:case`persistence_unavailable`:case`upgrade_required`:return o;case`found`:break;default:throw Error(`[SigningEngine][near] unsupported exact Wallet Session read result`)}let s=String(e||``).trim();if(!s)return{kind:`unavailable`};let c=Date.now();if(o.record.expiresAtMs<=c)return{kind:`expired`};let l;try{l=await t.read({relayerUrl:s,operationCredential:o.operationCredential},{walletSessionId:o.operationCredential.walletSessionId,quotaId:o.record.quotaId})}catch{return{kind:`unavailable`}}if(l.status!==`active`)return dk(l);let u;try{u=await K.resolveSelectedWalletAuthority(String(r))}catch{return{kind:`persistence_unavailable`}}let d=sk(u,r);if(!d)return{kind:`missing`};let f=Date.now();if(l.authorization.expiresAtMs<=f)return{kind:`expired`};if(l.walletSessionId!==o.operationCredential.walletSessionId||l.quotaId!==o.record.quotaId||l.expiresAtMs!==l.authorization.expiresAtMs||!ek(l.authorization,o.record)||!tk(l.authorization,d))return{kind:`corrupt`};let p;try{p=await K.replaceExactActiveWalletSessionFromStatus({active:l.authorization,operationCredential:o.operationCredential})}catch{return{kind:`persistence_unavailable`}}if(p.kind===`superseded`)return bl(`near`,{event:`wallet_session_status_superseded`,walletSessionId:o.operationCredential.walletSessionId}),{kind:`unavailable`};let m;try{m=await ck(d)}catch{return{kind:`unavailable`}}try{return{kind:`found`,authorization:sl({selectedAuthority:d.authority,selectedAuthMethod:d.authMethod,selectedFactorAuthority:m,session:l.authorization,operationCredential:o.operationCredential,status:l,nowMs:f})}}catch{return{kind:`corrupt`}}}async function pk(e,t){let n=await fk(t,new wt,e);return n.kind===`found`?n.authorization:null}function mk(e){return e.curve===`ecdsa`}function hk(e){let{manifest:t,selected:n,walletId:r,chainTarget:i,materialActivation:a}=e;return t.signer.walletId===r&&t.signer.authority.walletId===r&&t.signer.authority.walletAuthMethodId===n.authMethod.walletAuthMethodId&&b(t.activation.materialActivation,a)&&t.signer.scope.targetMemberships.some(e=>z(e)===z(i))}async function gk(e){let t=(await Ak(String(e.walletId))).filter(t=>hk({manifest:t,selected:e.selected,walletId:e.walletId,chainTarget:e.chainTarget,materialActivation:e.materialActivation}));if(t.length!==1)return{kind:`inactive`,reason:`Expected one exact ECDSA capability manifest; found ${t.length}`};let[n]=t;if(!n)return{kind:`inactive`,reason:`Exact ECDSA capability manifest is missing`};let r=await wk(n),i=await e.context.sealedSigningSessionStore.listExactSealedSessionsForWallet({walletId:String(e.walletId),filter:{authMethod:e.selected.authMethod.kind,curve:`ecdsa`,chainTarget:e.chainTarget}}),a=nf({manifest:n,walletId:e.walletId,chainTarget:e.chainTarget,sealedRecords:i.filter(mk)}),o;if(a.kind===`resolved`){let t=a.runtime;o={kind:`exact_ecdsa_sealed_runtime_v1`,walletId:t.walletId,chainTarget:t.chainTarget,materialActivation:t.materialActivation,normalSigning:t.normalSigning,relayerUrl:t.relayerUrl,relayerKeyId:t.relayerKeyId,clientVerifyingPublicKey33B64u:t.clientVerifyingPublicKey33B64u,participantIds:t.participantIds,ecdsaThresholdKeyId:t.ecdsaThresholdKeyId,thresholdEcdsaPublicKeyB64u:t.thresholdEcdsaPublicKeyB64u,keyHandle:t.keyHandle,runtimePolicyScope:t.runtimePolicyScope,roleLocalMaterialRef:t.roleLocalMaterialRef,authBinding:t.authBinding,sealedRecord:t.sealedRecord,expiresAtMs:Math.min(t.expiresAtMs,e.status.expiresAtMs),remainingUses:e.status.remainingUses}}else{if(a.reason!==`missing_material`)return{kind:`inactive`,reason:`Exact sealed ECDSA runtime is ${a.reason}`};let t=await of({manifest:n,chainTarget:e.chainTarget,relayerUrl:e.context.seamsWebConfigs.network.relayer?.url??``});if(t.kind!==`resolved`)return{kind:`inactive`,reason:`Exact durable ECDSA capability runtime is ${t.reason}`};try{o=Id({runtime:t.runtime,authority:r.authority,status:e.status})}catch{return{kind:`inactive`,reason:`Exact durable ECDSA quota facts are invalid`}}}try{return{kind:`resolved`,capability:$d({capability:r,selected:e.selected,session:e.session,operationCredential:e.operationCredential,runtime:o,nowMs:e.nowMs})}}catch(e){return{kind:`inactive`,reason:e instanceof Error?e.message:`Exact ECDSA Wallet Session authorization is invalid`}}}async function _k(e,t,n){let r=R(t.walletId),i=Date.now(),a=sk(await K.resolveSelectedWalletAuthority(String(r)),r);if(!a)return{kind:`inactive`,reason:`Selected wallet authentication authority is unavailable`};let o=String(e.seamsWebConfigs.network.relayer?.url||``).trim();if(!o)throw Error(`Exact Wallet Session status requires a relayer URL`);let s=await zk(r);if(s.kind!==`found`)return{kind:`inactive`,reason:`Exact Wallet Session authorization is ${s.kind}`};if(s.record.expiresAtMs<=i)return{kind:`inactive`,reason:`Exact Wallet Session authorization is expired`};let c=await n.read({relayerUrl:o,operationCredential:s.operationCredential},{walletSessionId:s.operationCredential.walletSessionId,quotaId:s.record.quotaId});if(c.status!==`active`&&c.status!==`exhausted`)return{kind:`inactive`,reason:`Exact Wallet Session is ${c.status}`};if(ek(c.authorization,s.record)&&!tk(c.authorization,a))try{await K.reconcilePendingNearRegistrationAuthority({walletSession:c.authorization,operationCredential:s.operationCredential})}catch{return{kind:`inactive`,reason:`NEAR authority reconciliation was superseded`}}let l=sk(await K.resolveSelectedWalletAuthority(String(r)),r);if(!l||c.walletSessionId!==s.operationCredential.walletSessionId||c.quotaId!==s.record.quotaId||c.expiresAtMs!==c.authorization.expiresAtMs||!ek(c.authorization,s.record)||!tk(c.authorization,l))return{kind:`inactive`,reason:`Exact Wallet Session status identity is inconsistent`};let u=Date.now();if(c.authorization.expiresAtMs<=u)return{kind:`inactive`,reason:`Exact Wallet Session authorization is expired`};let d;try{d=await K.replaceExactActiveWalletSessionFromStatus({active:c.authorization,operationCredential:s.operationCredential})}catch{return{kind:`inactive`,reason:`Exact Wallet Session promotion reconciliation could not be persisted`}}if(d.kind===`superseded`)return bl(`evm-family`,{event:`wallet_session_status_superseded`,walletSessionId:s.operationCredential.walletSessionId}),{kind:`inactive`,reason:`Exact Wallet Session status was superseded by a newer wallet authority`};let f=await gk({context:e,walletId:r,selected:l,session:c.authorization,operationCredential:s.operationCredential,status:c,chainTarget:t.chainTarget,materialActivation:t.materialActivation,nowMs:u});return f.kind===`resolved`?{kind:`active`,capability:f.capability}:f}async function vk(e,t,n){let r=await _k(e,t,n);if(r.kind===`inactive`)return r;let i=zd(r.capability,Date.now());return i?{kind:`active`,authorization:i}:{kind:`inactive`,reason:`Exact Wallet Session signing quota is exhausted`}}async function yk(e,t,n){let r=await kk({walletId:R(t.walletId),chainTargets:t.chainTargets}),i=[];for(let a of r)for(let r of t.chainTargets){let t=await _k(e,{walletId:a.manifest.signer.walletId,materialActivation:a.manifest.activation.materialActivation,chainTarget:r},n);if(t.kind===`active`){i.push(t.capability);break}}return i}function bk(e){return async t=>{let n=await vk(e,t,new wt);return n.kind===`active`?n.authorization:null}}async function xk(e){for(let t of e.subjects){let n=await $O.lookup(t);if(n.kind===`persistence_unavailable`)throw Error(`ECDSA capability persistence is unavailable`);if(n.kind!==`active`)continue;let r=n.manifest;if(r.signer.walletId===e.walletId&&r.signer.scope.targetMemberships.some(t=>z(t)===z(e.chainTarget)))return r}return null}async function Sk(e){let t=await K.resolveSelectedWalletAuthority(String(e.walletId));if(t.kind!==`resolved`)throw Error(`ECDSA material activation is ambiguous and the wallet selection is ${t.kind}`);let n=e.authorities.find(e=>e.walletAuthMethodId===t.selection.walletAuthMethodId);if(!n)throw Error(`ECDSA material activation has no access projection for the selected wallet auth method`);return await $O.lookupByMaterialActivation({walletId:e.walletId,materialActivation:e.materialActivation,authority:n})}async function Ck(e,t){let n=R(t.walletId),r=await $O.listActiveWalletCapabilitySubjects(n);if(r.kind!==`resolved`)throw Error(`ECDSA capability subjects are ${r.kind}`);let i=async e=>{let i=await xk({walletId:n,subjects:r.subjects,chainTarget:t.chainTarget});if(i)throw new Gf({kind:`superseded`,supersessionKind:`material_activation_replaced`,preparedMaterialActivation:t.materialActivation,currentMaterialActivation:i.activation.materialActivation});return e()},a=await $O.lookupByMaterialActivation({walletId:n,materialActivation:t.materialActivation});if(a.kind===`ambiguous_authority`&&(a=await Sk({walletId:n,materialActivation:t.materialActivation,authorities:a.authorities})),a.kind===`persistence_unavailable`||a.kind===`exact_record_conflict`||a.kind===`corrupt`)throw Error(`ECDSA material activation is ${a.kind}`);if(a.kind!==`active`)return await i(()=>{throw Error(`ECDSA capability manifest is missing`)});let o=a.manifest;if(o.signer.walletId!==n||!o.signer.scope.targetMemberships.some(e=>z(e)===z(t.chainTarget)))throw Error(`ECDSA capability manifest does not match the requested signer`);return{capability:await wk(o),lookup:a}}async function wk(e){return await Od({authority:await ak(e.signer.authority,{getWalletAuthMethodV2:e=>K.getWalletAuthMethodV2(e),listWalletAuthMethodsForWallet:e=>K.listWalletAuthMethodsForWallet(e),readEmailOtpProviderSubjectForWallet:e=>_s(K,e)}),manifest:e,material:Md({authority:e.signer.authority,materialActivation:e.activation.materialActivation,publicFacts:e.durableMaterial.roleLocalPublicFacts})})}async function Tk(e,t){return(await Ck(e,t)).capability}async function Ek(e,t){let n=await vk(e,t,new wt);if(n.kind!==`active`)throw Error(n.reason);let r=n.authorization,i=await Ck(e,t),a=await Gm({relayerUrl:String(e.seamsWebConfigs.network.relayer?.url||``).trim(),walletSessionToken:r.operationCredential.token,curve:`ecdsa_secp256k1`,expectedMaterialActivation:i.capability.manifest.activation.materialActivation}),o=oh({walletKey:a.walletKey,lane:a.lane,material:{keyFamily:`ecdsa_secp256k1`,laneShareEpoch:a.lane.laneShareEpoch,lookup:i.lookup,runtime:{kind:`absent`}}});if(o.kind!==`active_wallet_execution_lane_v1`)throw Error(`Owner ECDSA execution lane is ${o.reason}`);return ef({capability:i.capability,authorization:r,nowMs:Date.now()})}async function Dk(e,t,n){let r=await kk({walletId:R(t.walletId),chainTargets:t.chainTargets,...t.authMethod?{authMethod:t.authMethod}:{}});return await Promise.all(r.map(Ok.bind(null,e,t.chainTargets,n)))}async function Ok(e,t,n,r){let i=r.manifest,a=t.find(e=>i.signer.scope.targetMemberships.some(t=>z(e)===z(t)));if(!a)return{kind:`authorization_required`,capability:r};let o=await vk(e,{walletId:i.signer.walletId,chainTarget:a,materialActivation:i.activation.materialActivation},n);if(o.kind===`active`)try{return ef({capability:r,authorization:o.authorization,nowMs:Date.now()})}catch{}return{kind:`authorization_required`,capability:r}}async function kk(e){let t=await $O.listActiveWalletCapabilitySubjects(e.walletId);if(t.kind!==`resolved`)return[];let n=[];for(let r of t.subjects){let t=await $O.lookup(r);if(t.kind!==`active`)continue;let i=t.manifest;if(!i.signer.scope.targetMemberships.some(t=>e.chainTargets.some(e=>z(e)===z(t))))continue;let a;try{a=await wk(i)}catch{continue}let o=Jn(a.authority)?`passkey`:$n(a.authority)?`email_otp`:null;!o||e.authMethod&&o!==e.authMethod||n.push(a)}return n}async function Ak(e){let t=R(e),n=await $O.listActiveWalletCapabilitySubjects(t);if(n.kind!==`resolved`)return[];let r=[];for(let e of n.subjects){let t=await $O.lookup(e);t.kind===`active`&&r.push(t.manifest)}return r}const jk={listActiveEcdsaCapabilityManifestsForWallet:Ak,listExactSealedSessionsForWallet:Lt,resolveSelectedWalletAuthority:K.resolveSelectedWalletAuthority.bind(K)},Mk=Yd(jk),Nk=Jd(jk);async function Pk(e){switch(e.authority.kind){case`live_session`:return await e.coordinator.requestTransactionSigningChallenge({kind:`wallet_session_challenge`,walletSession:e.walletSession,chain:e.chain,authLane:e.authority.authLane,operationFingerprintDigest:e.operationFingerprintDigest});case`capability_step_up`:return await e.coordinator.requestTransactionSigningChallenge({kind:`wallet_login_challenge`,walletSession:e.walletSession,chain:e.chain,operationFingerprintDigest:e.operationFingerprintDigest})}}function Fk(e){let t=ok(e);return QO({runtimePorts:e.runtimePorts,stores:e.stores,ed25519YaoPublicCapabilityReferences:e.ed25519YaoPublicCapabilityReferences,seamsWebConfigs:e.seamsWebConfigs,nearClient:e.nearClient,touchIdPrompt:e.touchIdPrompt,userPreferencesManager:e.userPreferencesManager,nonceCoordinator:e.nonceCoordinator,ensureSealedRefreshStartupParity:e.ensureSealedRefreshStartupParity,touchConfirm:e.touchConfirm,passkeyMpcSession:e.passkeyMpcSession,passkeyMpcExport:e.passkeyMpcExport,getEmailOtpWarmSessionStatus:t=>e.emailOtpSessions.readWarmSessionStatusOnly(t),consumeEmailOtpWarmSessionUses:t=>e.emailOtpSessions.consumeWarmSessionUses(t),clearEmailOtpWarmSessionMaterial:t=>e.emailOtpSessions.clearVolatileWarmSessionMaterial({kind:`ecdsa`,thresholdSessionId:t}),getWalletSessionStatus:e=>t(e),resolveCanonicalEcdsaSigningCapability:t=>Tk(e,t),resolveAuthorizedEcdsaSigningCapability:t=>Ek(e,t),resolveActiveEcdsaWalletSessionAuthorization:bk(e),resolveOwnerLaneScope:e.resolveOwnerLaneScope,signerWorkerManager:e.signerWorkerManager,getWorkerBaseOrigin:e.getWorkerBaseOrigin,workerWarmupPolicy:e.workerWarmupPolicy,getTheme:e.getTheme,signTempo:t=>af(e.getEnginePorts().tempoSigningDeps,t),activateAuthenticatedWalletState:t=>qy(e.getRegistrationPublicDeps(),{walletId:t.walletId,nearAccountId:t.nearAccountId,signerSlot:t.signerSlot,nearClient:t.nearClient}),persistThresholdEcdsaBootstrapForWalletTarget:t=>gD({bootstrapStore:e.ecdsaBootstrapStore,walletId:t.walletId,chainTarget:t.chainTarget,bootstrap:t.bootstrap,signerAuth:t.signerAuth}),requestEmailOtpTransactionSigningChallenge:t=>Pk({coordinator:e.emailOtpSessions,walletSession:t.walletSession,chain:t.chain,authority:t.authority,operationFingerprintDigest:t.operationFingerprintDigest}),requestEmailOtpEd25519SigningChallenge:({walletSession:t,operationFingerprintDigest:n})=>e.emailOtpSessions.requestTransactionSigningChallenge({kind:`wallet_login_challenge`,walletSession:t,chain:`near`,operationFingerprintDigest:n}),prepareNearEd25519YaoMaterialBoundary:e.prepareNearEd25519YaoMaterialBoundary,provisionThresholdEd25519Session:t=>LD({credentialStore:e.stores.recoveryAndDeviceLinking.credentialStore,touchIdPrompt:e.touchIdPrompt,touchConfirm:e.passkeyMpcSession,defaultRelayerUrl:e.seamsWebConfigs.network.relayer?.url||``,getSignerWorkerContext:()=>e.getEnginePorts().walletSessionActivationDeps.getSignerWorkerContext()},t),restorePersistedSessionForSigning:t=>t.authMethod===`passkey`?e.passkeyMpcSession.restorePersistedSessionForSigning(nk(t)):e.emailOtpSessions.restorePersistedSessionForSigning(t),readAvailableSigningLanesForSigning:async t=>zT({activeWalletAuthorityEcdsaRuntimeReadPorts:{resolveSelectedWalletAuthority:K.resolveSelectedWalletAuthority.bind(K),readExactWithOperationCredential:G.readExactWithOperationCredential.bind(G)},ed25519YaoPublicCapabilityLanes:e.ed25519YaoPublicCapabilityReferences,isEd25519YaoPublicCapabilityActive:t=>{switch(t.auth.kind){case`email_otp`:return!0;case`passkey`:return e.getEnginePorts().ed25519YaoActiveClients.resolve({walletId:t.walletId,nearAccountId:t.nearAccountId,materialActivation:t.materialActivation})!==null}},readActiveWalletSessionAuthorization:fk.bind(null,e.seamsWebConfigs.network.relayer.url),listEcdsaSigningCapabilitiesForWallet:Dk.bind(null,e)},t,Hr(e.seamsWebConfigs.network.chains)),provisionThresholdEcdsaSession:t=>B_({queueByWallet:e.thresholdEcdsaBootstrapQueueByWallet,activationDeps:e.getEnginePorts().walletSessionActivationDeps,persistEcdsaRoleLocalReadyRecord:e.runtimePorts.storage.persistEcdsaRoleLocalReadyRecord},t),withThresholdEcdsaSigningQueue:t=>pf({queueByKey:e.thresholdEcdsaSigningQueueByKey,...t,walletId:R(t.walletId)}),withThresholdEd25519CommitQueue:t=>Il({queueByKey:e.thresholdEd25519CommitQueueByKey,...t})})}const Ik={resolveSelectedWalletAuthority:K.resolveSelectedWalletAuthority.bind(K),readExactActiveForWallet:G.readExactActiveForWallet.bind(G)};async function Lk(e){return await jO(Ik,e)}function Rk(e,t){return e.selection.lockState===`unlocked`&&e.selection.walletId===t&&e.selection.walletAuthMethodId===e.authMethod.walletAuthMethodId&&e.authMethod.status===`active`&&e.authMethod.walletId===t&&e.authMethod.walletAuthorityId===e.authority.authorityId&&e.authority.state===`active`&&e.authority.walletId===t}async function zk(e){let t;try{t=await K.resolveSelectedWalletAuthority(String(e))}catch{return{kind:`persistence_unavailable`}}if(t.kind!==`resolved`||!Rk(t,e))return{kind:`missing`};try{return await G.readExactActiveForWallet({walletId:e,authorityId:t.authority.authorityId,authMethodId:t.authMethod.walletAuthMethodId})}catch{return{kind:`persistence_unavailable`}}}function Bk(e){let t=EO({relayerUrl:String(e.seamsWebConfigs.network.relayer?.url||``).trim(),readAuthorization:zk});return TO({resolveActiveEcdsaCapabilityRuntime:Mk,seamsWebConfigs:e.seamsWebConfigs,signerWorkerManager:e.signerWorkerManager,getTheme:e.getTheme,withThresholdEcdsaSigningQueue:t=>pf({queueByKey:e.thresholdEcdsaSigningQueueByKey,...t}),withThresholdEd25519CommitQueue:t=>Il({queueByKey:e.thresholdEd25519CommitQueueByKey,...t}),ecdsaSessions:e.warmSigning.ecdsaSessions,relayerUrl:String(e.seamsWebConfigs.network.relayer?.url||``).trim(),readActiveWalletSessionAuthorization:e.readActiveWalletSessionAuthorization,ed25519YaoPublicCapabilityLanes:e.ed25519YaoPublicCapabilityLanes,isEd25519YaoPublicCapabilityActive:e.isEd25519YaoPublicCapabilityActive,listEcdsaSigningCapabilitiesForWallet:e.listEcdsaSigningCapabilitiesForWallet,resolveOwnerLaneScope:e.resolveOwnerLaneScope,touchConfirm:e.touchConfirm,passkeyMpcSession:e.passkeyMpcSession,passkeyMpcExport:e.passkeyMpcExport,emailOtpSessions:{readWarmSessionStatusOnly:t=>e.emailOtpSessions.readWarmSessionStatusOnly(t),requestExportChallenge:t=>e.emailOtpSessions.requestExportChallenge(t),exportEcdsaKeyWithDurableAuthorization:t=>e.emailOtpSessions.exportEcdsaKeyWithDurableAuthorization(t),exportEd25519YaoSeedWithFreshEmailOtpLane:t=>e.emailOtpSessions.exportEd25519YaoSeedWithFreshEmailOtpLane(t)},provisionPasskeyEcdsaExplicitExportSession:t=>V_({queueByWallet:e.thresholdEcdsaBootstrapQueueByWallet,activationDeps:e.getWalletSessionActivationDeps(),persistEcdsaRoleLocalReadyRecord:e.runtimePorts.storage.persistEcdsaRoleLocalReadyRecord},t),getWalletSessionStatus:e=>t(e),resolvePasskeyEd25519YaoExportContext:e.resolvePasskeyEd25519YaoExportContext,resolveEmailOtpEd25519YaoExportContext:e.resolveEmailOtpEd25519YaoExportContext,sessionLifecycle:{readAuthorization:Lk,invalidateExpiredAuthorization:async t=>{if((await e.getSigningSessionCoordinator().invalidateExpiredWalletSession({state:t.state,source:t.source})).kind===`unavailable`)throw Error(`[SigningEngine][key-export] expired Wallet Session cleanup failed`)}}})}function Vk(e){switch(e){case`email_otp`:return{authMethod:V.emailOtp,signerSource:Kr.emailOtpRegistration};case`login`:case`registration`:case`manual-bootstrap`:return{authMethod:V.passkey,signerSource:Kr.passkeyRegistration};default:throw Error(`[SigningEngine] unsupported threshold ECDSA session source`)}}function Hk(e){throw Error(`[SigningEngine] unsupported threshold ECDSA bootstrap backend binding: ${JSON.stringify(e)}`)}async function Uk(e){let t=e.bootstrap.thresholdEcdsaKeyRef.backendBinding;if(!t)throw Error(`[SigningEngine] ECDSA bootstrap is missing its backend binding`);let n=Wk(t);if(!n)return;let r=await e.deps.persistEcdsaRoleLocalReadyRecord({record:n,storageKeyFacts:tc(n)});if(!r.ok)throw Error(`[SigningEngine] ECDSA role-local ready record persistence failed (${r.code}): ${r.message}`)}function Wk(e){switch(e.materialKind){case`role_local_ready_state_blob`:return e.ecdsaRoleLocalReadyRecord;case`role_local_worker_handle`:case`role_local_durable_public_anchor`:case`role_local_durable_sealed_ref`:case`metadata_only`:return null;default:return Hk(e)}}async function Gk(e,t){return t.source===`email_otp`?await e.ensureSealedRefreshStartupParityForThresholdEcdsaBootstrap({kind:`email_otp_bootstrap_parity`,walletId:t.walletId,chainTarget:t.chainTarget,authMethod:V.emailOtp}):await e.ensureSealedRefreshStartupParityForThresholdEcdsaBootstrap({kind:`default_bootstrap_parity`,walletId:t.walletId,chainTarget:t.chainTarget}),await x_(e.queueByWallet,t.walletId,async()=>{let n=t.bootstrap;if(!String(n.thresholdEcdsaKeyRef.ecdsaThresholdKeyId||``).trim())throw Error(`[SigningEngine] threshold-ecdsa bootstrap did not provide canonical ecdsaThresholdKeyId`);return await gD({bootstrapStore:e.bootstrapStore,walletId:t.walletId,chainTarget:t.chainTarget,bootstrap:n,signerAuth:Vk(t.source)}),await Uk({deps:e,bootstrap:n}),{bootstrap:n,authorization:await Rt(G,{walletId:t.walletId,authority:t.authority,bootstrap:n})}})}async function Kk(e,t){let n=t.source===`email_otp`?await Gk(e,{walletId:t.walletId,chainTarget:t.chainTarget,bootstrap:t.bootstrap,source:`email_otp`,authority:t.authority,emailOtpAuthContext:t.emailOtpAuthContext}):await Gk(e,{walletId:t.walletId,chainTarget:t.chainTarget,bootstrap:t.bootstrap,source:t.source,authority:t.authority});return{bootstrap:n.bootstrap,authorization:n.authorization}}function qk(e){let t=[],n=new Set;for(let r of e.network.chains){let e=Nr(r.network);if(e!==`evm`&&e!==`tempo`)continue;let i=zr(r),a=z(i);n.has(a)||(n.add(a),t.push(i))}if(!t.length)throw Error(`[EmailOtpSession] exact ECDSA snapshot requires configured ECDSA targets`);return t}function Jk(){return typeof performance<`u`&&typeof performance.now==`function`?performance.now():Date.now()}function Yk(){return{signingSessionSealApplyMs:0,warmCapabilityPersistenceMs:0}}function Xk(e,t,n){e[t]+=Math.max(0,Math.round(Jk()-n))}function Zk(e,t){e.signingSessionSealApplyMs+=t.signingSessionSealApplyMs,e.warmCapabilityPersistenceMs+=t.warmCapabilityPersistenceMs}function Qk(e){let t=String(e||``).trim().toLowerCase();return/^0x[0-9a-f]{40}$/.test(t)?t:null}function $k(e){let t=[],n=new Set,r=e=>{let r=z(e);n.has(r)||(n.add(r),t.push(e))};r(e.chainTarget);let i=e.additionalChainTargets!==void 0;for(let t of e.additionalChainTargets||[])r(t);if(!i&&el(e.emailOtpAuthContext)===`session`)for(let t of qk(e.configs))r(t);return t}function eA(e){let t=vn(e.runtimePolicyScope),n=String(t.signingRootId).trim(),r=String(t.signingRootVersion||`default`).trim();if(!n||!r)throw Error(`Email OTP ECDSA persisted identity is incomplete`);return{signingRootId:n,signingRootVersion:r}}function tA(e){let t=e.existingKey.persistedRoleLocalMaterial.publicFacts,n=$s({walletId:t.walletId,chainTarget:e.chainTarget,keyHandle:t.keyHandle,ecdsaThresholdKeyId:t.ecdsaThresholdKeyId,signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion,applicationBindingDigestB64u:t.applicationBindingDigestB64u,clientParticipantId:t.clientParticipantId,relayerParticipantId:t.relayerParticipantId,participantIds:t.participantIds,contextBinding32B64u:t.contextBinding32B64u,derivationClientSharePublicKey33B64u:t.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:t.relayerPublicKey33B64u,groupPublicKey33B64u:t.groupPublicKey33B64u,ethereumAddress:t.ethereumAddress,publicCapability:t.publicCapability});return{keyHandle:e.existingKey.keyHandle,publicCapability:n.publicCapability,walletKey:Da({walletId:n.walletId,keyHandle:n.keyHandle,chainTarget:e.chainTarget,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,participantIds:n.participantIds,thresholdOwnerAddress:n.ethereumAddress,thresholdEcdsaPublicKeyB64u:n.groupPublicKey33B64u}),persistedRoleLocalMaterial:Md({authority:e.existingKey.persistedRoleLocalMaterial.authority,materialActivation:e.existingKey.persistedRoleLocalMaterial.materialActivation,publicFacts:n}),runtimePolicyScope:e.existingKey.runtimePolicyScope}}function nA(e){let t=e.durableMaterial.roleLocalPublicFacts,n=Da({walletId:t.walletId,keyHandle:t.keyHandle,chainTarget:t.chainTarget,ecdsaThresholdKeyId:t.ecdsaThresholdKeyId,signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion,participantIds:t.participantIds,thresholdOwnerAddress:t.ethereumAddress,thresholdEcdsaPublicKeyB64u:t.groupPublicKey33B64u});return{keyHandle:String(n.keyHandle),publicCapability:t.publicCapability,walletKey:n,persistedRoleLocalMaterial:Md({authority:e.signer.authority,materialActivation:e.activation.materialActivation,publicFacts:t}),runtimePolicyScope:e.durableMaterial.runtimePolicyScope}}async function rA(e){let t=e.scope.kind===`exact`?eA({runtimePolicyScope:e.scope.runtimePolicyScope}):null,n=String(e.keyHandle||``).trim(),r=e.scope.kind===`durable_manifest`?null:e.scope.authorityRef,i=(await e.listActiveEcdsaCapabilityManifestsForWallet(e.walletId)).filter(i=>{let a=i.durableMaterial.roleLocalPublicFacts;return i.signer.walletId===e.walletId&&(!r||i.signer.authority.walletAuthMethodId===r.walletAuthMethodId&&String(i.signer.authority.authorityDigest)===String(r.authorityDigest))&&i.signer.scope.targetMemberships.some(t=>Vr(t,e.chainTarget))&&(!n||String(a.keyHandle).trim()===n)&&(!t||String(a.signingRootId).trim()===t.signingRootId)&&(!t||String(a.signingRootVersion||`default`).trim()===t.signingRootVersion)}).map(nA).reduce((t,n)=>{let r=t.find(e=>e.keyHandle===n.keyHandle);if(!r)return t.push(n),t;if(!Qn(r.publicCapability,n.publicCapability)||!b(r.persistedRoleLocalMaterial.materialActivation,n.persistedRoleLocalMaterial.materialActivation))throw Error(`Email OTP ECDSA has conflicting persisted role-local material for ${z(e.chainTarget)}`);return t},[]);if(i.length===0)return null;if(i.length!==1)throw Error(`Email OTP ECDSA has multiple persisted public capabilities for ${z(e.chainTarget)}`);return tA({existingKey:i[0],chainTarget:e.chainTarget})}function iA(e){return{authMethod:`email_otp`,curve:`ecdsa`,walletId:e.walletId,chainTarget:e.chainTarget,walletSessionId:e.walletSessionId,quotaId:e.quotaId,thresholdSessionId:Xs.thresholdEcdsaSession(e.thresholdSessionId),emailOtpAuthContext:e.emailOtpAuthContext,material:{kind:`worker_handle`,workerSessionId:e.thresholdSessionId}}}function aA(e){let t=String(e.warmThresholdSessionId).trim();if(!t)throw Error(`Email OTP sealed refresh requires a warm threshold session`);return{warmMaterialTarget:{kind:`ecdsa`,thresholdSessionId:t},authorizationThresholdSessionId:oA(e.normalSigning)}}function oA(e){return qn(e)}async function sA(e,t){if(e.bootstraps.length!==e.publicationChainTargets.length)throw Error(`Email OTP ECDSA publication returned an unexpected lane count`);let n=Yk(),r=[],i=e.bootstraps[0]?.session;if(!i)throw Error(`Email OTP ECDSA publication has no primary session`);for(let[t,n]of e.bootstraps.entries()){let a=e.publicationChainTargets[t],o=n.thresholdEcdsaKeyRef.chainTarget;if(!Vr(o,a))throw Error(`Email OTP ECDSA publication returned ${z(o)} for ${z(a)}`);if(n.session.walletSessionId!==i.walletSessionId||n.session.quotaId!==i.quotaId)throw Error(`Email OTP ECDSA publication returned mismatched Wallet Session authority`);r.push({chainTarget:a,bootstrap:n})}let a={args:e,ports:t},o=await Promise.all(r.map(lA.bind(null,a))),s=o.map(cA);for(let e of o)Zk(n,e.timings);let[c,...l]=s;if(!c)throw Error(`Email OTP ECDSA publication did not commit a primary lane`);return{bootstrap:c.bootstrap,authorization:c.authorization,authorizations:[c.authorization,...l.map(e=>e.authorization)],timings:n}}function cA(e){return e.result}async function lA(e,t){let n=Yk(),r=t.bootstrap,i=Jk(),a=await e.ports.commitEvmFamilyThresholdEcdsaSessions({walletId:e.args.walletId,chainTarget:t.chainTarget,bootstrap:r,source:`email_otp`,authority:e.args.authority,emailOtpAuthContext:e.args.emailOtpAuthContext});return Xk(n,`warmCapabilityPersistenceMs`,i),Zk(n,await uA({walletId:e.args.walletId,chainTarget:t.chainTarget,bootstrap:a.bootstrap,runtimePolicyScope:e.args.runtimePolicyScope,emailOtpAuthContext:e.args.emailOtpAuthContext,relayerUrl:e.args.relayerUrl,groupId:e.args.groupId},e.ports)),{result:a,timings:n}}async function uA(e,t){let n=Yk();if(t.configs.signing.sessionPersistenceMode!==`sealed_refresh_v1`||el(e.emailOtpAuthContext)!==`session`)return n;let r=t.getSignerWorkerContext();if(!r)throw Error(`Email OTP sealed refresh requires the dedicated emailOtp worker`);let i=e.bootstrap.thresholdEcdsaKeyRef,a=e.bootstrap.session,o=String(a.thresholdSessionId||``).trim(),s=String(e.relayerUrl||i.relayerUrl||``).trim();if(e.groupId&&e.groupId!==`rfc2409-group2`)throw Error(`Email OTP sealed refresh received an unsupported Shamir group`);let c=Ns;if(!o||!s)throw Error(`Email OTP sealed refresh is missing threshold-session persistence metadata`);let l=iA({walletId:e.walletId,chainTarget:e.chainTarget,walletSessionId:a.walletSessionId,quotaId:a.quotaId,thresholdSessionId:o,emailOtpAuthContext:e.emailOtpAuthContext}),u=a.operationCredential,d=e.runtimePolicyScope,f=vn(d),p=String(f?.signingRootId||``).trim(),m=String(f?.signingRootVersion||``).trim(),h=String(i.ecdsaThresholdKeyId||``).trim(),g=String(i.userId||``).trim(),_=String(tl(e.emailOtpAuthContext)||g).trim(),v=String(al(e.emailOtpAuthContext)).trim(),y=Qk(i.ethereumAddress),x=String(i.backendBinding?.clientVerifyingShareB64u||``).trim(),S=String(i.thresholdEcdsaPublicKeyB64u||``).trim(),C=String(i.backendBinding?.relayerKeyId||``).trim(),w=i.routerAbEcdsaDerivationNormalSigning,T=i.backendBinding,E=null,ee=null;(T?.materialKind===`role_local_worker_handle`||T?.materialKind===`role_local_durable_sealed_ref`)&&(E=T.roleLocalMaterialRef,ee=T.publicFacts.publicCapability);let D=Array.isArray(i.participantIds)?i.participantIds.map(e=>Math.floor(Number(e))).filter(e=>Number.isFinite(e)&&e>0):[];if(!h||!g||!_||!v||!y||!x||!C||!w||!ee||!E||!D.length||!u.token||!p||!m)throw Error(`Email OTP sealed refresh is missing ECDSA restore metadata`);if(l.material.kind!==`worker_handle`)throw Error(`Email OTP sealed refresh requires worker-owned warm material`);let O=l.material.workerSessionId,k=i.chainTarget;if(!k)throw Error(`Email OTP sealed refresh requires exact ECDSA chain target`);if(!Vr(k,l.chainTarget))throw Error(`Email OTP sealed refresh chain target drifted from ${z(l.chainTarget)} to ${z(k)}`);let A=String(i.keyHandle||``).trim();if(!A)throw Error(`Email OTP sealed refresh requires exact ECDSA key handle`);let j=E.materialActivation,te=aA({warmThresholdSessionId:O,normalSigning:w}),M=await L({authority:e.emailOtpAuthContext.authority}),ne=await rA({walletId:e.walletId,chainTarget:e.chainTarget,scope:{kind:`exact`,runtimePolicyScope:d,authorityRef:M},keyHandle:A,listActiveEcdsaCapabilityManifestsForWallet:t.listActiveEcdsaCapabilityManifestsForWallet});if(!ne||!b(ne.persistedRoleLocalMaterial.materialActivation,j))throw Error(`Email OTP sealed refresh material activation was superseded`);let re=Jk(),ie=await kT({workerCtx:r,target:te.warmMaterialTarget,authorizationThresholdSessionId:te.authorizationThresholdSessionId,transport:{relayerUrl:s,operationCredential:u,groupId:c}}).catch(e=>{let t=e instanceof Error?e.message:String(e||`unknown error`);throw Error(`Email OTP sealed refresh seal failed: ${t}`)});if(Xk(n,`signingSessionSealApplyMs`,re),!ie?.ok){let e=String(ie?.message||ie?.code||`unknown error`).trim();throw Error(`Email OTP sealed refresh seal failed: ${e}`)}let ae=String(ie.sealedSecretB64u||``).trim(),oe=Math.floor(Number(ie.expiresAtMs)||Number(a?.expiresAtMs)||0),se=Math.floor(Number(ie.remainingUses)||Number(a?.remainingUses)||0);if(!ae||oe<=0||se<0)throw Error(`Email OTP sealed refresh seal returned invalid persistence metadata`);let ce=String(ie.keyVersion||``).trim();if(!ce)throw Error(`Email OTP sealed refresh seal returned no key version`);let le=Date.now(),ue={thresholdSessionId:l.thresholdSessionId,sealedSecretB64u:ae,curve:`ecdsa`,authMethod:`email_otp`,thresholdSessionIds:{ecdsa:l.thresholdSessionId},walletId:String(e.walletId||``).trim(),relayerUrl:s,keyVersion:ce,groupId:c,issuedAtMs:le,expiresAtMs:oe,remainingUses:se},N=Jk(),P=await rA({walletId:e.walletId,chainTarget:k,scope:{kind:`exact`,runtimePolicyScope:d,authorityRef:M},keyHandle:A,listActiveEcdsaCapabilityManifestsForWallet:t.listActiveEcdsaCapabilityManifestsForWallet});if(!P||!b(P.persistedRoleLocalMaterial.materialActivation,j))throw Error(`Email OTP sealed refresh material activation was superseded`);let F=P.persistedRoleLocalMaterial.authority;await t.registerSigningSession({...ue,ecdsaRestore:{chainTarget:k,source:`email_otp`,signingRootId:p,signingRootVersion:m,provider:rl(e.emailOtpAuthContext),providerSubjectId:_,emailHashHex:v,authority:F,emailOtpAuthority:e.emailOtpAuthContext.authority,...d?{runtimePolicyScope:d}:{},keyHandle:A,ecdsaThresholdKeyId:h,ethereumAddress:y,relayerKeyId:C,clientVerifyingShareB64u:x,...S?{thresholdEcdsaPublicKeyB64u:S}:{},participantIds:D,routerAbEcdsaDerivationNormalSigning:w,publicCapability:ee,roleLocalMaterialRef:E},updatedAtMs:le});let de=await t.readExactSealedSession(o,{authMethod:`email_otp`,curve:`ecdsa`,chainTarget:k}).catch(e=>{let t=e instanceof Error?e.message:String(e||`unknown error`);throw Error(`Email OTP sealed refresh read-back failed: ${t}`)});if(Xk(n,`warmCapabilityPersistenceMs`,N),!de)throw Error(`Email OTP sealed refresh ${z(k)} record was not durably persisted`);let I=de.ecdsaRestore?.roleLocalMaterialRef;if(de.authMethod!==`email_otp`||de.secretKind!==`signing_session_secret32`||de.thresholdSessionIds.ecdsa!==o||de.sealedSecretB64u!==ae||!I||!dA(I,E)||!de.ecdsaRestore?.chainTarget||!Vr(de.ecdsaRestore.chainTarget,k))throw Error(`Email OTP sealed refresh read-back record does not match ${z(k)} unlock session`);return n}function dA(e,t){return e.kind===t.kind&&e.durableMaterialRef===t.durableMaterialRef&&e.bindingDigest===t.bindingDigest&&b(e.materialActivation,t.materialActivation)}function fA(e){return{thresholdSessionId:Xs.thresholdEcdsaSession(e.thresholdSessionId)}}function pA(e){if(!e)return{kind:`not_requested`};switch(e.kind){case`wallet_custody_cache_absent`:return{kind:`cache_absent`,bootstrap:e.ed25519YaoRecovery};case`ed25519_yao_capability`:return{kind:`capability`,activeClientHandle:e.activeClientHandle,metadata:e.metadata,bootstrap:e.ed25519YaoCapability}}throw Error(`Unsupported Email OTP Ed25519 unlock material`)}async function mA(e){if(e.workerResult){switch(e.workerResult.kind){case`wallet_custody_cache_absent`:return;case`ed25519_yao_capability`:if(!await Zw({workerContext:e.workerContext,activeClientHandle:e.workerResult.activeClientHandle}))throw Error(`Email OTP capability unlock local Ed25519 client was unavailable`);return}e.workerResult}}function hA(){return typeof performance<`u`&&typeof performance.now==`function`?performance.now():Date.now()}async function gA(e){try{await Bt(en(e.workerContext),{existingEnvelope:e.unlock.ed25519ExportRootCustody.existingEnvelope,existingFactorSecret:e.unlock.ed25519ExportRootCustody.factorSecret32,walletId:String(e.authorization.record.walletId),walletAuthMethodId:e.walletAuthMethodId,walletSessionId:String(e.authorization.operationCredential.walletSessionId),expiresAtMs:e.authorization.record.expiresAtMs})}catch(e){console.warn(`[SigningEngine][email-otp] unlocked Ed25519 export-root capability was not established:`,e instanceof Error?e.message:String(e||`unknown error`))}}function _A(){return{emailOtpProofVerificationMs:0,ecdsaMaterialRestoreMs:0,signingSessionSealApplyMs:0,warmCapabilityPersistenceMs:0}}function vA(e,t,n){e[t]+=Math.max(0,Math.round(hA()-n))}function yA(e,t){e.signingSessionSealApplyMs+=t.signingSessionSealApplyMs,e.warmCapabilityPersistenceMs+=t.warmCapabilityPersistenceMs}function bA(e,t){let n=String(e||``).trim();if(!n)throw Error(`[SigningEngine][email-otp] ${t} is required`);return n}function xA(e){return{provider:e.identity.provider,providerUserId:bA(e.identity.providerUserId,`Email OTP provider user id`)}}async function SA(e){let t=await e.ownerLaneScopeStores.listWalletAuthMethodsForWallet(String(e.walletId)),n=[];for(let r of t){if(r.kind!==`email_otp`||r.status!==`active`||String(r.walletId)!==String(e.walletId)||String(r.emailHashHex)!==String(e.emailHashHex))continue;let t=r.authority;String(t.walletId)!==String(e.walletId)||t.factor.provider!==e.provider||String(t.factor.providerUserId)!==String(e.providerUserId)||String(t.verifier.emailHashHex)!==String(e.emailHashHex)||n.push(t)}let[r,...i]=n;if(!r)return{kind:`canonical_boundary`};if(i.length>0)throw Error(`Email OTP identity matches more than one active wallet auth method`);return{kind:`selected_v2`,authority:r}}function CA(e){let t=c(e.walletAuthMethodId);if(!t.ok)throw Error(`Selected Email OTP wallet auth method is invalid`);let n=Kn({walletId:e.walletId,provider:e.provider,providerUserId:e.providerUserId,emailHashHex:e.emailHashHex});return{kind:`selected_v2`,authority:{walletId:n.walletId,factor:n.factor,verifier:n.verifier,bindingId:t.value}}}async function wA(e){if(e.authoritySelector.kind===`wallet_auth_method`)return await CA({walletId:e.walletId,walletAuthMethodId:e.authoritySelector.walletAuthMethodId,emailHashHex:e.emailHashHex,provider:e.provider,providerUserId:e.providerUserId});let t=await e.authorityPorts.resolveSelectedWalletAuthority(String(e.walletId));if(t.kind===`missing_selection`)return{kind:`canonical_boundary`};if(t.kind!==`resolved`)throw Error(`Email OTP authority selection is unavailable: ${t.kind}`);if(t.authMethod.kind!==`email_otp`)return await SA({walletId:e.walletId,emailHashHex:e.emailHashHex,provider:e.provider,providerUserId:e.providerUserId,ownerLaneScopeStores:e.authorityPorts.ownerLaneScopeStores});if(t.authMethod.status!==`active`||t.authority.state!==`active`||String(t.authMethod.walletId)!==String(e.walletId)||String(t.authority.walletId)!==String(e.walletId)||String(t.authMethod.walletAuthorityId)!==String(t.authority.authorityId))throw Error(`Email OTP authority selected by the wallet is not active`);let n=t.authMethod,r=String(n.walletAuthMethodId),i=await Hd({authMethod:n,stores:e.authorityPorts.ownerLaneScopeStores});if(!$n(i))throw Error(`Email OTP authority selected by the wallet session has the wrong factor`);let a=await L({authority:i});if(String(a.walletId)!==String(t.authority.walletId)||String(a.walletAuthMethodId)!==r||String(i.verifier.emailHashHex)!==String(e.emailHashHex)||i.factor.provider!==e.provider||String(i.factor.providerUserId)!==String(e.providerUserId))throw Error(`Email OTP authority selected by the wallet session does not match the request`);return{kind:`selected_v2`,authority:i}}function TA(e){return e.source.kind===`selected_v2`&&!e.runtimePolicyScope?{kind:`exact_authority`,authorityRef:e.authorityRef}:e.runtimePolicyScope?{kind:`exact`,runtimePolicyScope:e.runtimePolicyScope,authorityRef:e.authorityRef}:{kind:`durable_manifest`}}function EA(e){if(`persistedExportMaterial`in e&&`explicitExportAuthorization`in e&&e.operation===`export_key`)return e;throw Error(`Email OTP ECDSA export requires prepared operation authorization`)}function DA(e){switch(e.unseal.kind){case`email_otp_grant`:return{kind:`email_otp_unseal_grant`,grant:e.unseal.grant,challengeId:e.unseal.challenge_id};case`not_requested`:throw Error(`Email OTP ECDSA export requires its verified unseal grant`);default:{let t=e.unseal;throw Error(`Unsupported Email OTP ECDSA export unseal state: ${String(t)}`)}}}function OA(e){if(e.operation!==e.routePlan.operation)throw Error(`Email OTP operation does not match its route plan`)}function kA(e){let t=e.existingKey.walletKey;if(String(e.handle.walletId)!==String(t.walletId)||String(e.handle.keyHandle)!==String(t.keyHandle)||e.handle.authSubjectId!==tl(e.emailOtpAuthContext)||!Vr(e.handle.chainTarget,t.chainTarget)||!Vr(e.handle.chainTarget,e.chainTarget))throw Error(`Email OTP ECDSA export worker handle does not match the resolved lane`)}function AA(e){if(!Yc(e))throw Error(`Email OTP ECDSA export requires single-use authorization`);return e}function jA(e){let t=yn({ttlMs:e.ttlMs??Nn.ttlMs,remainingUses:e.remainingUses});return{ttlMs:t.ttlMs,remainingUses:t.remainingUses}}function MA(e){let t=e.bootstrap.session,n=Math.floor(Number(t.expiresAtMs)),r=Math.floor(Number(t.remainingUses)),i=n-Date.now();if(!Number.isSafeInteger(n)||i<1)throw Error(`Email OTP capability unlock returned an invalid server signing budget`);if(r!==e.expectedRemainingUses)throw Error(`Email OTP capability unlock changed the requested signing budget uses`);return{ttlMs:i,remainingUses:r}}function NA(e){return e.ed25519YaoResult?MA({bootstrap:e.ed25519YaoResult.kind===`wallet_custody_cache_absent`?e.ed25519YaoResult.ed25519YaoRecovery:e.ed25519YaoResult.ed25519YaoCapability,expectedRemainingUses:e.requestedRemainingUses}):jA({ttlMs:e.requestedTtlMs,remainingUses:e.requestedRemainingUses})}function PA(e){if(!e)throw Error(`Email OTP capability recovery requires explicit wallet unlock`);return e}function FA(e){return{kind:`router_ab_ecdsa_post_registration_session_activation_policy_v1`,key_handle:String(e.keyHandle),session_policy:e.request.session_policy}}function IA(e){return{kind:`router_ab_ecdsa_post_registration_session_activation_policy_v1`,key_handle:String(e.keyHandle),session_policy:{threshold_session_id:HA(e.thresholdSessionId),wallet_session_mint_id:UA(e.walletSessionMintId),ttl_ms:e.ttlMs,remaining_uses:e.remainingUses,runtime_policy_scope:e.runtimePolicyScope}}}function LA(e,t){if(e.operation!==`wallet_unlock`||!e.ecdsaSession)throw Error(`Email OTP unlock did not return its ECDSA Wallet Session`);if(e.ecdsaSession.kind===`router_ab_ecdsa_credential_free_session_activated_v1`){if(!t)throw Error(`Email OTP combined unlock did not return its exact Wallet Session`);return{kind:`credential_free_ecdsa_session_activation_authorization_v1`,activation:e.ecdsaSession,authorization:t}}return e.ecdsaSession}function RA(e){if(!e)throw Error(`Email OTP unlock did not return its prepared ECDSA Wallet Session`);return e}function zA(e,t,n){let r=e.signers[0];if(!r)throw Error(`Email OTP ECDSA custody continuity is empty`);if(r.walletKey.walletId!==t||r.walletKey.keyHandle!==n)throw Error(`Email OTP ECDSA custody continuity changed the requested wallet key`);for(let t of e.signers)if(t.walletKey.walletId!==r.walletKey.walletId||t.walletKey.keyHandle!==r.walletKey.keyHandle||t.walletKey.ecdsaThresholdKeyId!==r.walletKey.ecdsaThresholdKeyId||t.walletKey.signingRootId!==r.walletKey.signingRootId||t.walletKey.signingRootVersion!==r.walletKey.signingRootVersion||t.walletKey.relayerKeyId!==r.walletKey.relayerKeyId||!Qn(t.walletKey.publicCapability,r.walletKey.publicCapability)||!Zn(t.activationReceipt,r.activationReceipt)||!wn(t.runtimePolicyScope,r.runtimePolicyScope))throw Error(`Email OTP ECDSA custody continuity conflicts across targets`);return r}function BA(e){let[t,...n]=e.signers;if(!t)throw Error(`Email OTP ECDSA custody continuity is empty`);return[t.chainTarget,...n.map(e=>e.chainTarget)]}async function VA(e){let t=e.restore.ecdsaCustody,n=zA(t.continuity,e.walletId,e.keyHandle);await e.restoreWalletCustodyEcdsaContinuity({authority:e.authority,chainTargets:BA(t.continuity),walletId:n.walletKey.walletId,keyHandle:n.walletKey.keyHandle,ecdsaThresholdKeyId:n.walletKey.ecdsaThresholdKeyId,signingRootId:n.walletKey.signingRootId,signingRootVersion:n.walletKey.signingRootVersion,relayerKeyId:n.walletKey.relayerKeyId,participantIds:n.walletKey.participantIds,publicCapability:n.walletKey.publicCapability,activationReceipt:n.activationReceipt,runtimePolicyScope:n.runtimePolicyScope,readyStateBlobB64u:t.readyStateBlobB64u,publicFacts:t.publicFacts})}function HA(e){let t=T(e);if(!t.ok)throw Error(`Failed to create Email OTP threshold session identity`);return t.value}function UA(e){let t=yr(e);if(!t.ok)throw Error(`Failed to create Email OTP Wallet Session mint identity`);return t.value}function WA(e){if(!e)throw Error(`Email OTP ECDSA bootstrap requires route auth`);return e}function GA(e){switch(e){case Gr:return`sign`;case Zr:return`export`;case Jr:throw Error(`Email OTP wallet unlock requires first-session activation`);case qr:throw Error(`Email OTP device linking requires linked-device activation`);case`registration`:throw Error(`Email OTP ECDSA registration requires wallet-registration prepare`)}throw Error(`Unsupported Email OTP non-unlock operation`)}function KA(e){switch(e.operation){case`sign`:return{keyHandle:e.keyHandle,authSubjectId:e.authSubjectId,operation:`sign`,chainTarget:e.chainTarget};case`export`:return{keyHandle:e.keyHandle,authSubjectId:e.authSubjectId,operation:`export`,chainTarget:e.chainTarget}}throw e.operation,Error(`Unsupported Email OTP non-unlock handle operation`)}function qA(e){if(e.emailOtpWorkerSessionHandle.action!==`threshold_ecdsa_bootstrap`)throw Error(`Email OTP ECDSA activation requires a threshold ECDSA worker handle`);let t=fA({thresholdSessionId:e.thresholdSessionId}),n=Wa({chainTarget:e.chainTarget,thresholdSessionId:t.thresholdSessionId,ttlMs:e.ttlMs,remainingUses:e.remainingUses,runtimePolicyScope:e.runtimePolicyScope});if(ll(e.emailOtpAuthContext)){let r={source:`email_otp`,relayerUrl:e.relayerUrl,sessionIdentity:t,sessionKind:`opaque`,sessionBudgetUses:e.remainingUses,runtimePolicy:{kind:`scoped_policy`,scope:e.runtimePolicyScope},emailOtpWorkerSessionHandle:e.emailOtpWorkerSessionHandle,emailOtpAuthContext:e.emailOtpAuthContext,walletKey:e.existingKey.walletKey,lanePolicy:n,publicCapability:e.existingKey.publicCapability,existingRoleLocalMaterial:e.existingKey.persistedRoleLocalMaterial};return e.authorization.kind===`preauthorized_wallet_unlock`?D_({...r,preauthorizedSessionActivation:e.authorization.sessionActivation}):T_({...r,walletSessionRouteAuth:e.authorization.routeAuth})}if(Yc(e.emailOtpAuthContext)){if(e.authorization.kind===`preauthorized_wallet_unlock`)throw Error(`Email OTP operation step-up cannot adopt a reusable Wallet Session`);return O_({source:`email_otp`,relayerUrl:e.relayerUrl,sessionIdentity:t,sessionKind:`opaque`,sessionBudgetUses:e.remainingUses,runtimePolicy:{kind:`scoped_policy`,scope:e.runtimePolicyScope},emailOtpWorkerSessionHandle:e.emailOtpWorkerSessionHandle,emailOtpAuthContext:e.emailOtpAuthContext,walletSessionRouteAuth:e.authorization.routeAuth,walletKey:e.existingKey.walletKey,lanePolicy:n,publicCapability:e.existingKey.publicCapability,existingRoleLocalMaterial:e.existingKey.persistedRoleLocalMaterial})}throw Error(`Email OTP ECDSA activation cannot use a consumed single-use context`)}function JA(e){if(e.emailOtpWorkerSessionHandle.action!==`threshold_ecdsa_bootstrap`)throw Error(`Email OTP ECDSA recovery requires a threshold ECDSA worker handle`);let t=Xs.thresholdEcdsaSession(e.thresholdSessionId);return E_({source:`email_otp`,relayerUrl:e.relayerUrl,sessionIdentity:{kind:`recovered_material_session`,thresholdSessionId:t,materialActivation:e.existingKey.persistedRoleLocalMaterial.materialActivation},sessionKind:`opaque`,sessionBudgetUses:e.remainingUses,runtimePolicy:{kind:`scoped_policy`,scope:e.runtimePolicyScope},emailOtpWorkerSessionHandle:e.emailOtpWorkerSessionHandle,emailOtpAuthContext:e.emailOtpAuthContext,walletSessionRouteAuth:e.routeAuth,walletKey:e.existingKey.walletKey,lanePolicy:co({chainTarget:e.chainTarget,thresholdSessionId:t,ttlMs:e.ttlMs,remainingUses:e.remainingUses,runtimePolicyScope:e.runtimePolicyScope}),publicCapability:e.existingKey.publicCapability,existingRoleLocalMaterial:e.existingKey.persistedRoleLocalMaterial})}function YA(e){switch(e.kind){case`route_authorized`:return{sessionIdentity:e.sessionIdentity,authorization:{kind:`route_authorized`,routeAuth:e.routeAuth}};case`preauthorized_wallet_unlock`:{let t=e.request.session_policy,n=Mg(e.response)?e.response.activation.session:e.response.session;if(t.threshold_session_id!==n.threshold_session_id)throw Error(`Email OTP unlock returned a different prepared ECDSA session identity`);return{sessionIdentity:fA({thresholdSessionId:n.threshold_session_id}),authorization:{kind:`preauthorized_wallet_unlock`,sessionActivation:e.response}}}}}async function XA(e){let t=Ol(e.emailOtpSessionHandle);if(t.action!==`threshold_ecdsa_bootstrap`)throw Error(`Email OTP wallet unlock returned an invalid ECDSA worker handle`);let n=YA(e.primarySession),r={args:e,sessionIdentity:n.sessionIdentity,authorization:n.authorization,emailOtpWorkerSessionHandle:t},i=e.publicationChainTargets[0];if(!i)throw Error(`Email OTP ECDSA activation requires a primary target`);let a=await ZA(r,i),o=e.primarySession.kind===`preauthorized_wallet_unlock`?n.authorization:{kind:`route_authorized`,routeAuth:a.session.operationCredential},s={...r,args:{...e,primarySession:{kind:`route_authorized`,sessionIdentity:n.sessionIdentity,routeAuth:a.session.operationCredential}},authorization:o},c=[a,...await Promise.all(e.publicationChainTargets.slice(1).map(ZA.bind(null,s)))];if(!a)throw Error(`Email OTP ECDSA activation did not return a primary warm session`);return c}async function ZA(e,t){let n=tA({existingKey:e.args.primaryExistingKey,chainTarget:t});return await e.args.ports.provisionThresholdEcdsaSession(qA({existingKey:n,chainTarget:t,thresholdSessionId:e.sessionIdentity.thresholdSessionId,ttlMs:e.args.ttlMs,remainingUses:e.args.remainingUses,runtimePolicyScope:e.args.runtimePolicyScope,relayerUrl:e.args.relayerUrl,emailOtpAuthContext:e.args.emailOtpAuthContext,emailOtpWorkerSessionHandle:e.emailOtpWorkerSessionHandle,authorization:e.authorization}))}async function QA(e){return await e.ports.provisionEmailOtpEcdsaExplicitExportSession(k_({relayerUrl:e.relayerUrl,existingRoleLocalMaterial:e.persistedMaterial,authorization:e.authorization}))}function $A(e){let t=Math.floor(Number(e)||0);if(!Number.isFinite(t)||t<=0)throw Error(`[SigningEngine][email-otp][ecdsa] signing remainingUses is required`);return t}function ej(e){let t=e.runtimePolicyScope;if(!t)throw Error(`Email OTP ECDSA signing refresh requires runtimePolicyScope`);return t}function tj(e){if(e.authority.factor.kind!==`email_otp`||!e.authLane)throw Error(`[SigningEngine][email-otp][ecdsa] committed lane requires Email OTP authority`);return{keyHandle:String(Do(e.lane.identity.signer.keyHandle)),participantIds:e.lane.identity.signer.key.participantIds.map(Number),emailHashHex:e.authority.verifier.emailHashHex,providerIdentity:{kind:`explicit_provider_user`,provider:e.authority.factor.provider,providerUserId:e.authority.factor.providerUserId}}}async function nj(e){let t=await e.resolveCurrentEcdsaCapabilityRuntime({walletId:R(e.committedLane.lane.identity.signer.walletId),chainTarget:e.chainTarget});if(t.kind!==`resolved`)throw Error(`[SigningEngine][email-otp][ecdsa] signing refresh runtime unavailable: ${t.reason}`);if(!b(t.runtime.materialActivation,e.committedLane.lane.materialActivation))throw Error(`[SigningEngine][email-otp][ecdsa] signing refresh runtime material activation mismatch`);return{...tj(e.committedLane),runtimePolicyScope:ej({runtimePolicyScope:t.runtime.runtimePolicyScope})}}async function rj(e,t){let n=Gr,r=$A(e.remainingUses),i=e.committedLane,a=await nj({committedLane:i,chainTarget:e.chainTarget,resolveCurrentEcdsaCapabilityRuntime:t.resolveCurrentEcdsaCapabilityRuntime}),o=pl({authLane:gl(i.authLane),operation:n});return await t.loginWithEcdsaCapabilityInternal({walletSession:e.walletSession,authoritySelector:{kind:`wallet_auth_method`,walletAuthMethodId:String((await L({authority:i.authority})).walletAuthMethodId)},chainTarget:e.chainTarget,emailOtpAuthPolicy:`session`,emailOtpAuthReason:`sign`,challengeId:e.challengeId,otpCode:e.otpCode,operation:n,keyHandle:a.keyHandle,participantIds:a.participantIds,routePlan:o,emailHashHex:a.emailHashHex,providerIdentity:a.providerIdentity,ecdsaBootstrapAuthorization:{kind:`route_plan_auth`},remainingUses:r,runtimePolicyScope:a.runtimePolicyScope,ed25519YaoRecovery:{kind:`not_requested`}})}async function ij(e,t){let n=e.operation??e.routePlan.operation;OA({operation:n,routePlan:e.routePlan});let r=_A(),i=e.chainTarget,a=e.emailOtpAuthPolicy||t.configs.signing.emailOtp.authPolicy,o=e.emailOtpAuthReason||`login`,s=o===`sign`,c=s&&a===`per_operation`?`single_use`:`session`,l=c===`session`?`session`:a,u=String(e.relayUrl||t.requireRelayUrl()).trim(),d=String(e.groupId||t.requireSigningSessionSealGroupId()).trim(),f=e.remainingUses,p=t.configs.signing.sessionDefaults?.remainingUses,m=Math.min(Math.max(1,Math.floor(Number(f??p??Mn)||1)),Mn),h=Math.max(1,Math.floor(Number(f)||1)),g=xn({requestedRemainingUses:m})||(()=>{throw Error(`[SigningEngine][email-otp] unlock session uses are required`)})(),_=s?h:g,v=t.getSignerWorkerContext(),y=e.routePlan,b=e.ecdsaBootstrapAuthorization.kind===`route_plan_auth`?fl(y):e.ecdsaBootstrapAuthorization.routeAuth,x=b?b.operationCredential:void 0,S=e.runtimePolicyScope;if(!v)throw Error(`Email OTP login requires the dedicated emailOtp worker`);let C=xA({identity:e.providerIdentity}),w=await wA({walletId:e.walletSession.walletId,authoritySelector:e.authoritySelector,emailHashHex:e.emailHashHex,provider:C.provider,providerUserId:C.providerUserId,authorityPorts:t}),T=c===`single_use`?w.kind===`selected_v2`?Qc({policy:l,authority:w.authority,retention:`single_use`}):cl({policy:l,walletId:R(e.walletSession.walletId),emailHashHex:e.emailHashHex,retention:`single_use`,provider:C.provider,providerUserId:C.providerUserId}):w.kind===`selected_v2`?Qc({policy:l,authority:w.authority,retention:`session`,reason:o}):cl({policy:l,walletId:R(e.walletSession.walletId),emailHashHex:e.emailHashHex,retention:`session`,reason:o,provider:C.provider,providerUserId:C.providerUserId}),E=TA({source:w,runtimePolicyScope:S,authorityRef:await L({authority:T.authority})}),ee=$k({configs:t.configs,chainTarget:i,emailOtpAuthContext:T,...e.publicationChainTargets?{additionalChainTargets:e.publicationChainTargets}:{}}),D=t.publicationPorts,O=n===Jr,k=String(e.keyHandle||``).trim(),A=await rA({walletId:R(e.walletSession.walletId),chainTarget:i,scope:E,keyHandle:e.keyHandle,listActiveEcdsaCapabilityManifestsForWallet:D.listActiveEcdsaCapabilityManifestsForWallet});if(!A&&!O)throw Error(`device_link_required: local threshold ECDSA material is unavailable for ${i.kind}:${i.chainId}`);let j=String(A?.keyHandle||k).trim();if(!j)throw Error(`Email OTP ECDSA wallet unlock requires an exact key handle`);let te=A?.runtimePolicyScope||S;if(!te)throw Error(`Email OTP ECDSA wallet unlock requires runtime policy scope`);let M=e.ed25519YaoRecovery.kind===`requested`?await t.loadWalletCustodyEd25519Material({nearAccountId:e.ed25519YaoRecovery.nearAccountId,signerSlot:e.ed25519YaoRecovery.signerSlot}):null,ne=O?yn({ttlMs:e.ttlMs??Nn.ttlMs,remainingUses:_}):null,re=ne?HA(_l(`threshold-ecdsa-login`)):null,ie=ne&&re&&A?Pg({publicCapability:A.publicCapability,thresholdSessionId:re,walletSessionMintId:UA(_l(`wallet-session-mint`)),ttlMs:ne.ttlMs,remainingUses:ne.remainingUses,runtimePolicyScope:te}):null,ae=ne&&re?IA({keyHandle:j,thresholdSessionId:re,walletSessionMintId:UA(_l(`wallet-session-mint`)),ttlMs:ne.ttlMs,remainingUses:ne.remainingUses,runtimePolicyScope:te}):null,oe=hA(),se=n===`export_key`?EA(e):null,ce=se?{walletSession:e.walletSession,authoritySelector:e.authoritySelector,relayUrl:u,groupId:d,verification:DA(se.explicitExportAuthorization),routePlan:y,workerCtx:v,runtimePolicyScope:te,...e.onProgress?{onProgress:e.onProgress}:{}}:{walletSession:e.walletSession,authoritySelector:e.authoritySelector,relayUrl:u,groupId:d,verification:{kind:`otp`,...e.challengeId?{challengeId:e.challengeId}:{},otpCode:e.otpCode},routePlan:y,workerCtx:v,runtimePolicyScope:te,...e.onProgress?{onProgress:e.onProgress}:{}},le=e.ed25519YaoRecovery.kind===`not_requested`?await Zt({...ce,...ae?{ecdsaSessionHandleBinding:{keyHandle:j,authSubjectId:C.providerUserId,operation:`wallet_unlock`,chainTarget:i},ecdsaSessionPolicy:ie?FA({request:ie,keyHandle:j}):ae}:{ecdsaSessionHandleBinding:KA({keyHandle:j,authSubjectId:C.providerUserId,operation:GA(y.operation),chainTarget:i})}}):await Ht({...ce,ecdsaSessionHandleBinding:{keyHandle:j,authSubjectId:C.providerUserId,operation:`wallet_unlock`,chainTarget:i},providerSubject:e.ed25519YaoRecovery.providerSubject,signerSlot:e.ed25519YaoRecovery.signerSlot,nearAccountId:e.ed25519YaoRecovery.nearAccountId,expectedOperationalPublicKey:e.ed25519YaoRecovery.expectedOperationalPublicKey,expectedThresholdSessionId:e.ed25519YaoRecovery.expectedThresholdSessionId,walletCustodyEd25519Material:M||{kind:`absent`},remainingUses:_,ecdsaSessionPolicy:ie?FA({request:ie,keyHandle:j}):PA(ae)}),ue=le.kind===`wallet_unlock_capabilities`?le.ecdsa:le,N=le.kind===`wallet_unlock_capabilities`?le.ed25519Yao:null,P=le.kind===`wallet_unlock_capabilities`?le.walletSessionAuthorization:void 0;try{if(ue.operation===`wallet_unlock`&&!A){let n=await L({authority:T.authority});await VA({restore:ue,walletId:String(e.walletSession.walletId),keyHandle:j,authority:n,restoreWalletCustodyEcdsaContinuity:t.restoreWalletCustodyEcdsaContinuity})}if(!A&&(A=await rA({walletId:R(e.walletSession.walletId),chainTarget:i,scope:E,keyHandle:j,listActiveEcdsaCapabilityManifestsForWallet:D.listActiveEcdsaCapabilityManifestsForWallet}),!A))throw Error(`Email OTP ECDSA custody restore did not publish the canonical key`);let a=ie||(ae?Pg({publicCapability:A.publicCapability,thresholdSessionId:ae.session_policy.threshold_session_id,walletSessionMintId:ae.session_policy.wallet_session_mint_id,ttlMs:ae.session_policy.ttl_ms,remainingUses:ae.session_policy.remaining_uses,runtimePolicyScope:te}):null),o=n===`export_key`?AA(T):null,s=n===`export_key`?Dl(ue.emailOtpSessionHandle):null;s&&o&&kA({handle:s,existingKey:A,chainTarget:i,emailOtpAuthContext:o}),vA(r,`emailOtpProofVerificationMs`,oe);let c=a?LA(ue,P):null,l=c?jA({ttlMs:e.ttlMs,remainingUses:_}):NA({ed25519YaoResult:N,requestedTtlMs:e.ttlMs,requestedRemainingUses:_});if(oe=hA(),n===`export_key`){if(!s||!o)throw Error(`Email OTP ECDSA export worker handle is unavailable`);let n=EA(e),i=await QA({relayerUrl:u,persistedMaterial:n.persistedExportMaterial,authorization:n.explicitExportAuthorization,ports:t});return vA(r,`ecdsaMaterialRestoreMs`,oe),{kind:`transient_export`,value:{bootstrap:i}}}let f=await XA({primaryExistingKey:A,publicationChainTargets:ee,runtimePolicyScope:te,relayerUrl:u,ttlMs:l.ttlMs,remainingUses:l.remainingUses,emailOtpAuthContext:T,emailOtpSessionHandle:ue.emailOtpSessionHandle,primarySession:a?{kind:`preauthorized_wallet_unlock`,request:a,response:RA(c)}:{kind:`route_authorized`,sessionIdentity:fA({thresholdSessionId:_l(`threshold-ecdsa-login`)}),routeAuth:WA(x)},ports:t});vA(r,`ecdsaMaterialRestoreMs`,oe);let{bootstrap:p,authorization:m,authorizations:h,timings:g}=await sA({walletId:R(e.walletSession.walletId),publicationChainTargets:ee,bootstraps:f,runtimePolicyScope:te,authority:A.persistedRoleLocalMaterial.authority,emailOtpAuthContext:T,relayerUrl:u,groupId:d},D);return le.kind===`wallet_unlock_capabilities`&&await gA({workerContext:v,unlock:le,authorization:m,walletAuthMethodId:String(T.authority.bindingId)}),yA(r,g),{kind:`published_signing_session`,value:{recovery:le.recovery,bootstrap:p,authorization:m,authorizations:h,emailOtpSessionHandle:ue.emailOtpSessionHandle,ed25519YaoRecovery:pA(N),timings:r}}}catch(e){try{await mA({workerResult:N,workerContext:v})}catch(t){throw AggregateError([e,t],`Email OTP unlock failed and Ed25519 material disposal failed`)}throw e}finally{le.kind===`wallet_unlock_capabilities`&&le.ed25519ExportRootCustody.factorSecret32.fill(0)}}async function aj(e,t){if((e.operation??e.routePlan.operation)===`export_key`)throw Error(`Email OTP ECDSA export must use transient export preparation`);let n=await ij(e,t);if(n.kind!==`published_signing_session`)throw Error(`Email OTP ECDSA login did not publish a signing session`);return n.value}async function oj(e,t){let n=await ij(e,t);if(n.kind!==`transient_export`)throw Error(`Email OTP ECDSA export preparation published a signing session`);return n.value}var sj=class extends Error{constructor(e){super(`Email OTP sealed refresh material activation was superseded ${e.replace(`_`,` `)}`),this.phase=e,this.code=`material_activation_superseded`,this.name=`EmailOtpEcdsaSealedRestoreSupersededError`}};function cj(e){return Qc({policy:`session`,authority:e,retention:`session`,reason:`login`})}function lj(e){if(e.length!==2||e[0]!==1||e[1]!==2)throw Error(`Email OTP sealed refresh requires participantIds [1, 2]`);return[1,2]}async function uj(e){if((await L({authority:e.emailOtpAuthority})).walletId!==e.authority.walletId)throw Error(`Email OTP sealed refresh route authority wallet mismatch`);let t=e.publicCapability,n=t.public_identity,r=$s({walletId:R(e.walletId),chainTarget:e.chainTarget,keyHandle:e.keyHandle,ecdsaThresholdKeyId:mr(e.ecdsaThresholdKeyId),signingRootId:gr(e.signingRootId),signingRootVersion:nr(e.signingRootVersion),applicationBindingDigestB64u:t.context.application_binding_digest_b64u,participantIds:lj(e.participantIds),clientParticipantId:1,relayerParticipantId:2,contextBinding32B64u:n.context_binding_b64u,derivationClientSharePublicKey33B64u:n.derivation_client_share_public_key33_b64u,relayerPublicKey33B64u:n.server_public_key33_b64u,groupPublicKey33B64u:n.threshold_public_key33_b64u,ethereumAddress:e.ethereumAddress,publicCapability:t}),i=Da({walletId:r.walletId,keyHandle:r.keyHandle,chainTarget:r.chainTarget,ecdsaThresholdKeyId:r.ecdsaThresholdKeyId,signingRootId:r.signingRootId,signingRootVersion:r.signingRootVersion,participantIds:r.participantIds,thresholdOwnerAddress:r.ethereumAddress,thresholdEcdsaPublicKeyB64u:r.groupPublicKey33B64u});return{keyHandle:String(i.keyHandle),publicCapability:t,walletKey:i,runtimePolicyScope:e.runtimePolicyScope,persistedRoleLocalMaterial:Md({authority:e.authority,materialActivation:e.roleLocalMaterialRef.materialActivation,publicFacts:r})}}function dj(e){let t=String(e.keyVersion||``).trim(),n=String(e.groupId||``).trim();if(!t||!n)throw Error(`Email OTP sealed refresh is missing normalized seal transport metadata`);return{signingSessionSealKeyVersion:t,signingSessionSealGroupId:n}}function fj(e){let{sealedRecord:t}=e,n=dj(t);if(!t.thresholdSessionId||!t.relayerUrl||!t.keyHandle||!t.relayerKeyId||!t.participantIds.length)throw Error(`Email OTP sealed refresh is missing durable ECDSA restore metadata`);return{kind:`sealed_record_restore`,sealedRecord:t,emailOtpAuthContext:cj(t.emailOtpAuthority),authorization:e.authorization,relayerUrl:t.relayerUrl,chainTarget:t.chainTarget,keyHandle:t.keyHandle,...n,...t.runtimePolicyScope?{runtimePolicyScope:t.runtimePolicyScope}:{}}}async function pj(e,t){let n=await e(String(t));if(n.kind!==`resolved`||n.selection.lockState!==`unlocked`||n.selection.walletId!==t||n.selection.walletAuthMethodId!==n.authMethod.walletAuthMethodId||n.authMethod.kind!==`email_otp`||n.authMethod.status!==`active`||n.authMethod.walletId!==t||n.authMethod.walletAuthorityId!==n.authority.authorityId||n.authority.state!==`active`||n.authority.walletId!==t)throw Error(`Email OTP sealed refresh selected authority is invalid`);return{kind:`resolved`,selection:n.selection,authMethod:n.authMethod,authority:n.authority,signerMaterials:n.signerMaterials,exportRoot:n.exportRoot}}function mj(e){if(e.authBinding.kind!==`email_otp`)throw Error(`Email OTP sealed refresh runtime is not Email OTP bound`);return e.authBinding.emailOtpAuthority}function hj(e){if(e.authorizationRead.kind!==`found`)throw Error(`Email OTP sealed refresh requires active Wallet Session authorization: ${e.authorizationRead.kind}`);let{record:t,operationCredential:n}=e.authorizationRead;if(e.runtime.kind!==`exact_ecdsa_sealed_runtime_v1`)throw Error(`Email OTP sealed refresh ECDSA runtime is unavailable`);if(e.sealedRecord.authMethod!==`email_otp`||t.walletId!==R(e.sealedRecord.walletId)||t.authorityId!==e.selected.authority.authorityId||t.authMethodId!==e.selected.authMethod.walletAuthMethodId||t.authorityDigestB64u!==e.selected.authority.authorityDigestB64u||t.authorityRevocationEpoch!==e.selected.authority.revocationEpoch||t.expiresAtMs<=e.nowMs||n.walletSessionId.trim().length===0||n.token.trim().length===0||e.runtime.walletId!==t.walletId||!Vr(e.runtime.chainTarget,e.sealedRecord.chainTarget)||e.runtime.sealedRecord.thresholdSessionId!==e.sealedRecord.thresholdSessionId||e.runtime.sealedRecord.authMethod!==e.selected.authMethod.kind||e.runtime.authBinding.kind!==`email_otp`||e.runtime.authBinding.emailOtpAuthority.bindingId!==e.selected.authMethod.walletAuthMethodId||e.runtime.authBinding.emailOtpAuthority.walletId!==t.walletId)throw Error(`Email OTP sealed refresh Wallet Session authorization mismatch`);return Ld({capability:e.capability,selected:e.selected,session:t,operationCredential:n,runtime:e.runtime,nowMs:e.nowMs})}function gj(e){return async t=>await _j({...e,...t})}async function _j(e){let t=e.sealedRecord;if(t.authMethod!==`email_otp`||t.curve!==`ecdsa`)return null;let n=t.roleLocalMaterialRef.materialActivation;return await e.withThresholdEcdsaSigningQueue({queueKey:Ef({materialActivation:n}),walletId:R(t.walletId),enabled:!0,task:async()=>await vj(e)})}async function vj(e){let t=e.sealedRecord,n=t.roleLocalMaterialRef.materialActivation,r=R(t.walletId),i=await e.resolveCurrentEcdsaCapabilityRuntime({walletId:r,chainTarget:t.chainTarget});if(i.kind!==`resolved`||!b(i.runtime.materialActivation,n))throw new sj(`before_rehydrate`);let a=await pj(e.resolveSelectedWalletAuthority,r),o=await e.readExactWalletSessionAuthorization({walletId:r,authorityId:a.authority.authorityId,authMethodId:a.authMethod.walletAuthMethodId}),s=await uj(t),c=await Od({authority:mj(i.runtime),manifest:i.manifest,material:s.persistedRoleLocalMaterial}),l=fj({sealedRecord:t,authorization:hj({sealedRecord:t,authorizationRead:o,selected:a,runtime:i.runtime,capability:c,nowMs:Date.now()})});if(l.authorization.runtime.kind!==`exact_ecdsa_sealed_runtime_v1`)throw Error(`Email OTP sealed refresh requires a sealed ECDSA runtime`);let u=l.authorization.operationCredential;if(el(l.emailOtpAuthContext)!==`session`)return null;let d=e.getSignerWorkerContext();if(!d)throw Error(`Email OTP sealed refresh requires the dedicated emailOtp worker`);if(t.expiresAtMs<=Date.now())throw Error(`Email OTP sealed refresh expired sealed record`);if(t.remainingUses<=0)throw Error(`Email OTP sealed refresh exhausted sealed record`);let f=n,p=l.authorization.runtime.sealedRecord.thresholdSessionId,m=oA(t.routerAbEcdsaDerivationNormalSigning),h=await NT({workerCtx:d,target:{kind:`ecdsa`,thresholdSessionId:p},authorizationThresholdSessionId:m,sealedSecretB64u:t.sealedSecretB64u,remainingUses:t.remainingUses,expiresAtMs:t.expiresAtMs,transport:{relayerUrl:l.relayerUrl,operationCredential:u,signingSessionSealKeyVersion:qo(l.signingSessionSealKeyVersion),groupId:l.signingSessionSealGroupId},restore:{thresholdSessionId:p,walletId:t.walletId,keyHandle:l.keyHandle,chainTarget:l.chainTarget,authSubjectId:tl(l.emailOtpAuthContext)}});if(!h.ok)throw Error(h.message||h.code||`Email OTP sealed refresh failed`);if(!l.runtimePolicyScope)throw Error(`Email OTP sealed refresh requires runtime policy scope`);let g=Ol(h.emailOtpSessionHandle),_=await e.provisionThresholdEcdsaSession(JA({existingKey:s,chainTarget:l.chainTarget,thresholdSessionId:p,ttlMs:Math.max(1,h.expiresAtMs-Date.now()),remainingUses:h.remainingUses,runtimePolicyScope:l.runtimePolicyScope,relayerUrl:l.relayerUrl,emailOtpAuthContext:l.emailOtpAuthContext,emailOtpWorkerSessionHandle:g,routeAuth:u})),v=await e.resolveCurrentEcdsaCapabilityRuntime({walletId:R(t.walletId),chainTarget:l.chainTarget});if(v.kind!==`resolved`||!b(v.runtime.materialActivation,f))throw new sj(`before_commit`);let y=await e.commitEvmFamilyThresholdEcdsaSessions({walletId:r,chainTarget:l.chainTarget,bootstrap:_,source:`email_otp`,authority:s.persistedRoleLocalMaterial.authority,emailOtpAuthContext:l.emailOtpAuthContext});return{authorization:Ld({capability:c,selected:a,session:y.bootstrap.session.walletSession,operationCredential:y.bootstrap.session.operationCredential,runtime:v.runtime,nowMs:Date.now()}),remainingUses:y.bootstrap.session.remainingUses,expiresAtMs:y.bootstrap.session.expiresAtMs}}var yj=class{constructor(e){this.ports=e}async loginWithEcdsaCapabilityForSigning(e){return await rj(e,{resolveCurrentEcdsaCapabilityRuntime:this.ports.resolveCurrentEcdsaCapabilityRuntime,loginWithEcdsaCapabilityInternal:e=>this.loginWithEcdsaCapabilityInternal(e)})}async loginWithEcdsaCapabilityInternal(e){return await aj(e,{configs:this.ports.configs,getSignerWorkerContext:this.ports.getSignerWorkerContext,loadWalletCustodyEd25519Material:this.ports.loadWalletCustodyEd25519Material,restoreWalletCustodyEcdsaContinuity:this.ports.restoreWalletCustodyEcdsaContinuity,provisionThresholdEcdsaSession:this.ports.provisionThresholdEcdsaSession,provisionEmailOtpEcdsaExplicitExportSession:this.ports.provisionEmailOtpEcdsaExplicitExportSession,requireRelayUrl:()=>this.ports.runtimeConfig.requireRelayUrl(),requireSigningSessionSealGroupId:()=>this.ports.runtimeConfig.requireSigningSessionSealGroupId(),ownerLaneScopeStores:this.ports.ownerLaneScopeStores,resolveSelectedWalletAuthority:this.ports.resolveSelectedWalletAuthority,publicationPorts:this.ports.publicationPorts()})}async prepareEcdsaExportCapability(e){return await oj(e,{configs:this.ports.configs,getSignerWorkerContext:this.ports.getSignerWorkerContext,loadWalletCustodyEd25519Material:this.ports.loadWalletCustodyEd25519Material,restoreWalletCustodyEcdsaContinuity:this.ports.restoreWalletCustodyEcdsaContinuity,provisionThresholdEcdsaSession:this.ports.provisionThresholdEcdsaSession,provisionEmailOtpEcdsaExplicitExportSession:this.ports.provisionEmailOtpEcdsaExplicitExportSession,requireRelayUrl:()=>this.ports.runtimeConfig.requireRelayUrl(),requireSigningSessionSealGroupId:()=>this.ports.runtimeConfig.requireSigningSessionSealGroupId(),ownerLaneScopeStores:this.ports.ownerLaneScopeStores,resolveSelectedWalletAuthority:this.ports.resolveSelectedWalletAuthority,publicationPorts:this.ports.publicationPorts()})}};async function bj(e,t){let n=await e.resolveSelectedWalletAuthority(String(t));if(n.kind===`missing_selection`)return{kind:`canonical`};if(n.kind!==`resolved`)throw Error(`Email OTP challenge authority selection is unavailable: ${n.kind}`);if(n.authMethod.kind!==`email_otp`)return{kind:`canonical`};if(n.authMethod.status!==`active`||n.authority.state!==`active`||String(n.authMethod.walletId)!==String(t)||String(n.authority.walletId)!==String(t)||String(n.authMethod.walletAuthorityId)!==String(n.authority.authorityId))throw Error(`Email OTP challenge selected authority is not active`);return{kind:`exact`,walletAuthMethodId:String(n.authMethod.walletAuthMethodId)}}function xj(e){return e===`near`?`ed25519`:`ecdsa`}function Sj(e){let t=e.authLane;return t?.kind!==`signing_session`&&dl({kind:`auth_lane_missing`,source:`provided_route_auth`,expectedCurve:xj(e.chain)}),t}async function Cj(e,t){let n=t.kind===`wallet_session`?t.walletId:t.walletSession.walletId,r=e.requireRelayUrl(),i=e.getSignerWorkerContext();if(!i)throw Error(`Email OTP signing requires the dedicated emailOtp worker`);let a=await bj(e,n),o=await i.requestWorkerOperation({kind:`emailOtp`,request:{type:`requestEmailOtpChallenge`,timeoutMs:3e4,payload:{relayUrl:r,walletId:String(n),...a.kind===`exact`?{walletAuthMethodId:a.walletAuthMethodId}:{},routePlan:t.routePlan,otpChannel:Xr,...t.operationFingerprintDigest?{operationFingerprintDigest:t.operationFingerprintDigest}:{}}}}),s=String(o.challengeId||``).trim();if(!s)throw Error(`Email OTP signing challenge response did not include challengeId`);let c=o.delivery;return{challengeId:s,emailHint:c.emailHint,delivery:c}}async function wj(e,t){let n=Tj(e,t);return t.kind===`near_account_challenge`?await Cj(e,{kind:`near_account`,walletSession:t.walletSession,routePlan:n,...t.operationFingerprintDigest?{operationFingerprintDigest:t.operationFingerprintDigest}:{}}):t.kind===`wallet_export_challenge`?await Cj(e,{kind:`wallet_session`,walletId:t.walletId,routePlan:n}):await Cj(e,{kind:`wallet_session`,walletId:t.walletSession.walletId,routePlan:n,...t.operationFingerprintDigest?{operationFingerprintDigest:t.operationFingerprintDigest}:{}})}function Tj(e,t){switch(t.kind){case`wallet_login_challenge`:return ml({routeFamily:`login`,operation:Gr});case`wallet_session_challenge`:case`near_account_challenge`:return e.buildSigningSessionRoutePlan({authLane:Sj({authLane:t.authLane,chain:t.chain}),operation:Gr});case`wallet_export_challenge`:throw Error(`Email OTP export challenge cannot authorize transaction signing`)}}async function Ej(e,t){let n=Dj(e,t);return t.kind===`near_account_challenge`?await Cj(e,{kind:`near_account`,walletSession:t.walletSession,routePlan:n}):t.kind===`wallet_export_challenge`?await Cj(e,{kind:`wallet_session`,walletId:t.walletId,routePlan:n}):await Cj(e,{kind:`wallet_session`,walletId:t.walletSession.walletId,routePlan:n})}function Dj(e,t){switch(t.kind){case`wallet_login_challenge`:return ml({routeFamily:`login`,operation:Zr});case`wallet_session_challenge`:case`near_account_challenge`:return e.buildSigningSessionRoutePlan({authLane:Sj({authLane:t.authLane,chain:t.chain}),operation:Zr});case`wallet_export_challenge`:return ml({routeFamily:`login`,operation:Zr})}}function Oj(e){return ml({routeFamily:`login`,operation:Zr})}function kj(e){switch(e.material.kind){case`active_capability`:return e.material;case`sealed_custody`:return{kind:`sealed_custody`,materialActivation:e.material.materialActivation,walletCustodyEd25519Material:e.material.walletCustodyEd25519Material,bootstrap:e.material.bootstrap};case`sealed_export_root`:return{kind:`sealed_export_root`,materialActivation:e.material.materialActivation,capability:e.material.capability,exportRootEnvelope:e.material.exportRootEnvelope};default:throw e.material,Error(`Email OTP Ed25519 export material is invalid`)}}async function Aj(e,t){let n=e.getSignerWorkerContext();if(!n)throw Error(`Email OTP Ed25519 Yao export requires the dedicated emailOtp worker`);let r=e.requireRelayUrl(),i=t.exportContext.lane.signer.account.wallet.walletId,a=await n.requestWorkerOperation({kind:`emailOtp`,request:{type:`exportEmailOtpEd25519YaoSeed`,timeoutMs:6e4,payload:{relayUrl:r,challengeId:t.challengeId,otpCode:t.otpCode,lane:{walletId:String(i),providerSubjectId:t.exportContext.lane.auth.providerSubjectId,walletAuthMethodId:String(t.exportContext.authorization.record.authMethodId),nearAccountId:String(t.exportContext.lane.signer.account.nearAccountId),nearEd25519SigningKeyId:String(t.exportContext.lane.signer.nearEd25519SigningKeyId),signerSlot:t.exportContext.lane.signer.signerSlot},material:kj(t.exportContext)}}});switch(a.kind){case`exported`:return a;case`exported_and_rehydrated`:if(t.exportContext.material.kind!==`sealed_custody`)throw await Zw({workerContext:n,activeClientHandle:a.activeClientHandle}).catch(()=>void 0),Error(`Email OTP Ed25519 export returned unexpected recovered material`);if(t.exportContext.authorization.status.status===`exhausted`)return await Zw({workerContext:n,activeClientHandle:a.activeClientHandle}),a;try{await t.exportContext.material.activateRecoveredCapability({activation:{activeClientHandle:a.activeClientHandle,metadata:a.metadata,bootstrap:a.bootstrap},operationCredential:t.exportContext.authorization.operationCredential})}catch(e){throw await Zw({workerContext:n,activeClientHandle:a.activeClientHandle}).catch(()=>void 0),e}return a;default:throw Error(`Email OTP Ed25519 export returned an invalid result`)}}async function jj(e,t){let n=Oj(t.explicitExportAuthorization);return await Mj({walletSession:t.walletSession,authority:await L({authority:t.authority}),chainTarget:t.chainTarget,challengeId:t.challengeId,otpCode:t.otpCode,routePlan:n,keyHandle:String(t.publicFacts.keyHandle),participantIds:t.publicFacts.participantIds.map(Number),emailHashHex:t.authority.verifier.emailHashHex,provider:t.authority.factor.provider,providerUserId:t.authority.factor.providerUserId,runtimePolicyScope:t.runtimePolicyScope,relayUrl:e.requireRelayUrl(),getSignerWorkerContext:e.getSignerWorkerContext,prepareEcdsaExportCapability:t.prepareEcdsaExportCapability,persistedMaterial:t.persistedMaterial,explicitExportAuthorization:t.explicitExportAuthorization})}async function Mj(e){let t=await e.prepareEcdsaExportCapability({walletSession:e.walletSession,authoritySelector:{kind:`wallet_auth_method`,walletAuthMethodId:String(e.authority.walletAuthMethodId)},chainTarget:e.chainTarget,relayUrl:e.relayUrl,emailOtpAuthPolicy:`per_operation`,emailOtpAuthReason:`sign`,challengeId:e.challengeId,otpCode:e.otpCode,operation:Zr,routePlan:e.routePlan,ecdsaBootstrapAuthorization:{kind:`route_plan_auth`},keyHandle:e.keyHandle,participantIds:e.participantIds,remainingUses:1,emailHashHex:e.emailHashHex,providerIdentity:{kind:`explicit_provider_user`,provider:e.provider,providerUserId:e.providerUserId},runtimePolicyScope:e.runtimePolicyScope,ed25519YaoRecovery:{kind:`not_requested`},persistedExportMaterial:e.persistedMaterial,explicitExportAuthorization:e.explicitExportAuthorization}),n=e.getSignerWorkerContext();if(!n)throw Error(`Email OTP ECDSA export requires the dedicated signer worker`);return await qh({getSignerWorkerContext:()=>n},{walletSessionUserId:e.walletSession.walletSessionUserId,exportProvision:t.bootstrap,factorAuthorization:{kind:`email_otp_verified`}})}var Nj=class{constructor(e){this.ports=e}async requestTransactionSigningChallenge(e){return await wj(this.workerPorts(),e)}async requestExportChallenge(e){return await Ej(this.workerPorts(),e)}async exportEcdsaKeyWithDurableAuthorization(e){return await jj({getSignerWorkerContext:this.ports.getSignerWorkerContext,requireRelayUrl:this.ports.requireRelayUrl},{walletSession:e.walletSession,chainTarget:e.chainTarget,challengeId:e.challengeId,otpCode:e.otpCode,publicFacts:e.publicFacts,runtimePolicyScope:e.runtimePolicyScope,authority:e.authority,persistedMaterial:e.persistedMaterial,explicitExportAuthorization:e.explicitExportAuthorization,prepareEcdsaExportCapability:this.ports.prepareEcdsaExportCapability})}async exportEd25519YaoSeedWithFreshEmailOtpLane(e){return await Aj({getSignerWorkerContext:this.ports.getSignerWorkerContext,requireRelayUrl:this.ports.requireRelayUrl},e)}workerPorts(){return{getSignerWorkerContext:this.ports.getSignerWorkerContext,requireRelayUrl:this.ports.requireRelayUrl,requireSigningSessionSealGroupId:this.ports.requireSigningSessionSealGroupId,resolveSelectedWalletAuthority:this.ports.resolveSelectedWalletAuthority,buildSigningSessionRoutePlan:pl}}},Pj=class{constructor(e){this.ports=e}requireRelayUrl(){let e=String(this.ports.configs.network.relayer?.url||``).trim();if(!e)throw Error(`Missing relayer url (configs.network.relayer.url)`);return e}requireSigningSessionSealGroupId(){return Ns}requireRpId(e){let t=String(this.ports.getRpId()||``).trim();if(!t)throw Error(`${e} requires an RP ID for ECDSA bootstrap`);return t}},Fj=class{constructor(e){this.ports=e}async registerSigningSession(e){let t=Pe(e);if(!t)throw Error(`[SigningSessionSealedStore] invalid sealed session record write input`);await this.ports.writeExactSealedSession(t),this.ports.clearEcdsaRestoreCaches()}ecdsaPublicationPorts(){return{configs:this.ports.configs,getSignerWorkerContext:this.ports.getSignerWorkerContext,commitEvmFamilyThresholdEcdsaSessions:this.ports.commitEvmFamilyThresholdEcdsaSessions,registerSigningSession:e=>this.registerSigningSession(e),readExactSealedSession:this.ports.readExactSealedSession,listActiveEcdsaCapabilityManifestsForWallet:this.ports.listActiveEcdsaCapabilityManifestsForWallet}}async persistEcdsaSessionForRefresh(e){await uA({walletId:e.walletId,chainTarget:e.chainTarget,bootstrap:e.bootstrap,runtimePolicyScope:e.runtimePolicyScope,emailOtpAuthContext:e.emailOtpAuthContext,relayerUrl:this.ports.configs.network.relayer?.url||``,groupId:Ns},this.ecdsaPublicationPorts())}},Ij=class{constructor(e){this.ports=e}sealedRecordFilter(e){return{authMethod:`email_otp`,curve:`ecdsa`,chainTarget:e.chainTarget}}async recordSessionUseConsumed(e,t){await this.recordSessionPolicyResult({purpose:e,result:t})}async recordSessionMaterialRestored(e,t){await this.recordSessionPolicyResult({purpose:e,result:t})}async recordSessionPolicyResult(e){let t=String(e.purpose.thresholdSessionId||``).trim();if(t){if(!e.result.ok){this.ports.clearEcdsaRestoreCaches();return}await this.ports.updateExactSealedSessionPolicy({thresholdSessionId:t,filter:this.sealedRecordFilter(e.purpose),expiresAtMs:e.result.expiresAtMs,remainingUses:e.result.remainingUses,updatedAtMs:Date.now()}).catch(()=>void 0),this.ports.clearEcdsaRestoreCaches()}}};const Lj={listed:0,discovered:0,truncated:0},Rj={kind:`completed`,attempted:0,restored:0,deferred:0};var zj=class{constructor(e){this.ports=e,this.restoreCache=LS(),this.restoreAttempts=RS(),this.requestedChainTarget=null}clearCache(){this.restoreCache.clear(),this.restoreAttempts.clear()}async tryRestoreEcdsaWarmSessionStatusFromSealedRecord(e){if(this.ports.sessionPersistenceMode!==`sealed_refresh_v1`)return null;let t=String(e.thresholdSessionId||``).trim();if(!t)return null;this.requestedChainTarget=e.chainTarget;let n=t,r=await this.readEcdsaSealedRecord(t);if(!r)return null;if(r.remainingUses<=0||Date.now()>=r.expiresAtMs)return console.debug(`[EmailOtpSession] sealed refresh restore deferred by durable policy hint`,{thresholdSessionId:n,remainingUses:r.remainingUses,expiresAtMs:r.expiresAtMs}),null;if(r.authMethod!==`email_otp`||r.thresholdSessionId!==n)return console.warn(`[EmailOtpSession] sealed refresh restore deferred by store metadata mismatch`,{thresholdSessionId:n,authMethod:r.authMethod,ecdsaThresholdSessionId:r.thresholdSessionId}),null;let i=await this.ports.acquireSigningSessionRestoreLease({thresholdSessionId:n,authMethod:`email_otp`,curve:`ecdsa`,chainTarget:r.chainTarget}).catch(()=>null);if(!i){let e=`lease-unavailable:${n}`;return this.ports.shouldLogDiagnostic(e)&&console.debug(`[EmailOtpSession] sealed refresh restore deferred; lease unavailable`,{thresholdSessionId:n}),null}try{console.debug(`[EmailOtpSession] sealed refresh restore started`,{thresholdSessionId:n});let e=await this.ports.restoreEcdsaSigningSessionMaterialFromSealedRecord({sealedRecord:r}).catch(e=>(console.warn(`[EmailOtpSession] sealed refresh restore failed`,{thresholdSessionId:n,error:e instanceof Error?e.message:String(e||`unknown error`)}),null));if(!e)return null;console.debug(`[EmailOtpSession] sealed refresh restore succeeded`,{thresholdSessionId:n,remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs});let t={ok:!0,remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs};return await this.ports.recordSessionMaterialRestored({thresholdSessionId:n,chainTarget:r.chainTarget},t),t}finally{await this.ports.releaseSigningSessionRestoreLease(i).catch(()=>void 0)}}async discoverPersistedSessionsForWallet(e){if(this.ports.sessionPersistenceMode!==`sealed_refresh_v1`)return{...Lj};let t=String(R(e.walletId)||``).trim();if(!t)return{...Lj};let n=await BS({...e,walletId:t},{listExactSealedSessionsForWallet:({walletId:e,...t})=>this.ports.listExactSealedSessionsForWallet({walletId:e,filter:t}),onListError:({walletId:e,error:t})=>{console.warn(`[EmailOtpSession] wallet-scoped sealed ECDSA discovery list failed`,{walletId:e,error:t instanceof Error?t.message:String(t||`unknown error`)})}});if(!n.listed){let e=`wallet-sealed-ecdsa-empty:${t}`;this.ports.shouldLogDiagnostic(e)&&console.debug(`[EmailOtpSession] no durable sealed ECDSA records for wallet discovery`,{walletId:t})}return n}async restorePersistedSessionForSigning(e){if(this.ports.sessionPersistenceMode!==`sealed_refresh_v1`)return{...Rj};let t=String(R(e.walletId)||``).trim();return t?await zS({...e,walletId:t},{listExactSealedSessionsForWallet:({walletId:e,...t})=>t.curve===`ecdsa`?this.ports.listExactSealedSessionsForWallet({walletId:e,filter:{authMethod:t.authMethod,curve:`ecdsa`,chainTarget:t.chainTarget}}):Promise.resolve([]),restoreSealedRecordForWallet:e=>this.restoreEmailOtpSealedRecordForWallet(e),cache:this.restoreCache,onListError:({walletId:e,target:t,reason:n,error:r})=>{console.warn(`[EmailOtpSession] signing-intent sealed ECDSA restore list failed`,{walletId:e,target:t,reason:n,error:r instanceof Error?r.message:String(r||`unknown error`)})}}):{...Rj}}async readEcdsaSealedRecord(e){let t=this.requestedChainTarget;return t?await this.readEcdsaSealedRecordForTarget(e,t):null}async readEcdsaSealedRecordForTarget(e,t){let n=await this.ports.readExactSealedSession(e,{authMethod:`email_otp`,curve:`ecdsa`,chainTarget:t}).catch(n=>(console.warn(`[EmailOtpSession] sealed refresh ECDSA read failed`,{thresholdSessionId:e,chain:t.kind,error:n instanceof Error?n.message:String(n||`unknown error`)}),null));if(!n)return null;let r=SS(n);return r.kind===`accepted`&&r.record.authMethod===`email_otp`&&r.record.curve===`ecdsa`?r.record:null}async restoreEmailOtpSealedRecordForWallet(e){return e.purpose.authMethod!==`email_otp`||e.purpose.curve!==`ecdsa`||e.record.authMethod!==`email_otp`||e.record.curve!==`ecdsa`?`deferred`:await this.restoreEcdsaSealedRecordForWallet({...e,record:e.record,purpose:e.purpose})}async restoreEcdsaSealedRecordForWallet(e){let t=String(e.purpose.thresholdSessionId||``).trim();if(!t||e.record.authMethod!==e.purpose.authMethod||e.record.thresholdSessionId!==t||!Vr(e.record.chainTarget,e.purpose.chainTarget)||!b(e.record.roleLocalMaterialRef.materialActivation,e.purpose.materialActivation))return`deferred`;let n=[e.walletId,e.purpose.authMethod,e.purpose.curve,z(e.purpose.chainTarget),Lf(e.purpose.materialActivation),t].join(`:`);if(this.restoreAttempts.hasCompleted(n))return`ready`;let r=this.restoreAttempts.getInFlight(n);if(r)return await r,this.restoreAttempts.hasCompleted(n)?`ready`:`deferred`;let i=`deferred`,a=(async()=>{let r=await this.ports.restoreEcdsaSigningSessionMaterialFromSealedRecord({sealedRecord:e.record});r&&(await this.ports.recordSessionMaterialRestored({thresholdSessionId:t,chainTarget:e.record.chainTarget},{ok:!0,remainingUses:r.remainingUses,expiresAtMs:r.expiresAtMs}),this.restoreAttempts.rememberCompleted(n),i=`restored`)})().catch(n=>{console.warn(`[EmailOtpSession] wallet-scoped sealed ECDSA restore failed`,{walletId:e.walletId,thresholdSessionId:t,error:n instanceof Error?n.message:String(n||`unknown error`)})}).finally(()=>{this.restoreAttempts.clearInFlight(n)});return this.restoreAttempts.setInFlight(n,a),await a,i}};async function Bj(e){let t=Uj(e.target);return t?await e.readWarmSessionStatusFromWorker(t).catch(e=>({ok:!1,code:`worker_error`,message:e instanceof Error?e.message:String(e||`Email OTP worker error`)})):{ok:!1,code:`invalid_args`,message:`Missing thresholdSessionId`}}async function Vj(e){let t=Uj(e.target);if(!t)return{ok:!1,code:`invalid_args`,message:`Missing thresholdSessionId`};try{let n=await e.consumeWarmSessionUsesFromWorker({target:t,...typeof e.uses==`number`?{uses:e.uses}:{}});if(!n.ok&&n.code===`not_found`&&e.ecdsaPurpose){let r=await e.tryRestoreEcdsaWarmSessionStatusFromSealedRecord(e.ecdsaPurpose);if(r?.ok){let n=await e.consumeWarmSessionUsesFromWorker({target:t,...typeof e.uses==`number`?{uses:e.uses}:{}});return e.ecdsaPurpose&&await e.recordSessionUseConsumed(e.ecdsaPurpose,n),n}return r&&e.ecdsaPurpose&&await e.recordSessionMaterialRestored(e.ecdsaPurpose,r),n}return e.ecdsaPurpose&&await e.recordSessionUseConsumed(e.ecdsaPurpose,n),n}catch(e){return{ok:!1,code:`worker_error`,message:e instanceof Error?e.message:String(e||`Email OTP worker error`)}}}async function Hj(e){let t=Uj(e.target);t&&await e.clearVolatileWarmSessionMaterialFromWorker(t).catch(()=>void 0)}function Uj(e){let t=String(e.thresholdSessionId||``).trim();return t?e.kind===`ecdsa`?{kind:`ecdsa`,thresholdSessionId:t}:{kind:`ed25519_yao`,thresholdSessionId:t,materialActivation:e.materialActivation}:null}function Wj(e){return{async readStatus(t){return await AT({worker:e.worker,target:t})},async consumeUses(t){return await jT({worker:e.worker,target:t.target,...typeof t.uses==`number`?{uses:t.uses}:{}})},async clearMaterial(t){await MT({worker:e.worker,target:t})}}}var Gj=class{constructor(e){this.ports=e}async readWarmSessionStatusOnly(e){return await Bj({target:e,readWarmSessionStatusFromWorker:e=>this.ports.workerClient.readStatus(e)})}async consumeWarmSessionUses(e){return await Vj({target:Kj(e),...typeof e.uses==`number`?{uses:e.uses}:{},consumeWarmSessionUsesFromWorker:e=>this.ports.workerClient.consumeUses(e),ecdsaPurpose:rS(e.purpose),tryRestoreEcdsaWarmSessionStatusFromSealedRecord:e=>this.ports.sealedRestoreOrchestrator.tryRestoreEcdsaWarmSessionStatusFromSealedRecord(e),recordSessionUseConsumed:(e,t)=>this.ports.sealedRefreshPolicy.recordSessionUseConsumed(e,t),recordSessionMaterialRestored:(e,t)=>this.ports.sealedRefreshPolicy.recordSessionMaterialRestored(e,t)})}async clearVolatileWarmSessionMaterial(e){await Hj({target:e,clearVolatileWarmSessionMaterialFromWorker:e=>this.ports.workerClient.clearMaterial(e)})}};function Kj(e){let t=nS(e);return e.purpose.curve===`ecdsa`?{kind:`ecdsa`,thresholdSessionId:t}:{kind:`ed25519_yao`,thresholdSessionId:t,materialActivation:e.purpose.materialActivation}}var qj=class{constructor(e){this.sealedRefreshDiagnosticLogAtMsByKey=new Map,this.runtimeConfig=new Pj({configs:e.configs,getRpId:e.getRpId}),this.sealedSessionRegistry=new Fj({configs:e.configs,getSignerWorkerContext:e.getSignerWorkerContext,commitEvmFamilyThresholdEcdsaSessions:e.commitEvmFamilyThresholdEcdsaSessions,listActiveEcdsaCapabilityManifestsForWallet:e.listActiveEcdsaCapabilityManifestsForWallet,writeExactSealedSession:e.writeExactSealedSession,readExactSealedSession:e.readExactSealedSession,clearEcdsaRestoreCaches:()=>this.clearEcdsaRestoreCaches()}),this.ecdsaLifecycleRuntime=new yj({configs:e.configs,getSignerWorkerContext:e.getSignerWorkerContext,loadWalletCustodyEd25519Material:e.loadWalletCustodyEd25519Material,restoreWalletCustodyEcdsaContinuity:e.restoreWalletCustodyEcdsaContinuity,provisionThresholdEcdsaSession:e.provisionThresholdEcdsaSession,provisionEmailOtpEcdsaExplicitExportSession:e.provisionEmailOtpEcdsaExplicitExportSession,runtimeConfig:this.runtimeConfig,ownerLaneScopeStores:e.ownerLaneScopeStores,resolveSelectedWalletAuthority:e.resolveSelectedWalletAuthority,resolveCurrentEcdsaCapabilityRuntime:e.resolveCurrentEcdsaCapabilityRuntime,publicationPorts:()=>this.sealedSessionRegistry.ecdsaPublicationPorts()}),this.exportRecoveryRuntime=new Nj({getSignerWorkerContext:e.getSignerWorkerContext,requireRelayUrl:()=>this.runtimeConfig.requireRelayUrl(),requireSigningSessionSealGroupId:()=>this.runtimeConfig.requireSigningSessionSealGroupId(),resolveSelectedWalletAuthority:e.resolveSelectedWalletAuthority,prepareEcdsaExportCapability:e=>this.ecdsaLifecycleRuntime.prepareEcdsaExportCapability(e)});let t=gj({withThresholdEcdsaSigningQueue:e.withThresholdEcdsaSigningQueue,getSignerWorkerContext:e.getSignerWorkerContext,resolveSelectedWalletAuthority:e.resolveSelectedWalletAuthority,readExactWalletSessionAuthorization:e.readExactWalletSessionAuthorization,provisionThresholdEcdsaSession:e.provisionThresholdEcdsaSession,commitEvmFamilyThresholdEcdsaSessions:e.commitEvmFamilyThresholdEcdsaSessions,resolveCurrentEcdsaCapabilityRuntime:e.resolveCurrentEcdsaCapabilityRuntime}),n=Wj({worker:e.signerWorkerManager});this.sealedRefreshPolicy=new Ij({updateExactSealedSessionPolicy:e.updateExactSealedSessionPolicy,clearEcdsaRestoreCaches:()=>this.clearEcdsaRestoreCaches()}),this.sealedRestoreOrchestrator=new zj({sessionPersistenceMode:e.configs.signing.sessionPersistenceMode,listExactSealedSessionsForWallet:e.listExactSealedSessionsForWallet,readExactSealedSession:e.readExactSealedSession,acquireSigningSessionRestoreLease:e.acquireSigningSessionRestoreLease,releaseSigningSessionRestoreLease:e.releaseSigningSessionRestoreLease,readWarmSessionStatusFromWorker:e=>n.readStatus({kind:`ecdsa`,thresholdSessionId:e}),restoreEcdsaSigningSessionMaterialFromSealedRecord:e=>t(e),recordSessionMaterialRestored:(e,t)=>this.sealedRefreshPolicy.recordSessionMaterialRestored(e,t),shouldLogDiagnostic:e=>this.shouldLogSealedRefreshDiagnostic(e)}),this.warmSessionRuntime=new Gj({workerClient:n,sealedRefreshPolicy:this.sealedRefreshPolicy,sealedRestoreOrchestrator:this.sealedRestoreOrchestrator})}async persistEcdsaSessionForRefresh(e){await this.sealedSessionRegistry.persistEcdsaSessionForRefresh(e)}clearEcdsaRestoreCaches(){this.sealedRestoreOrchestrator.clearCache()}shouldLogSealedRefreshDiagnostic(e,t=Date.now()){let n=String(e||``).trim();return!n||t-(this.sealedRefreshDiagnosticLogAtMsByKey.get(n)||0)<6e4?!1:(this.sealedRefreshDiagnosticLogAtMsByKey.set(n,t),!0)}async discoverPersistedSessionsForWallet(e){return await this.sealedRestoreOrchestrator.discoverPersistedSessionsForWallet(e)}async restorePersistedSessionForSigning(e){return await this.sealedRestoreOrchestrator.restorePersistedSessionForSigning(e)}async readWarmSessionStatusOnly(e){return await this.warmSessionRuntime.readWarmSessionStatusOnly(e)}async consumeWarmSessionUses(e){return await this.warmSessionRuntime.consumeWarmSessionUses(e)}async clearVolatileWarmSessionMaterial(e){await this.warmSessionRuntime.clearVolatileWarmSessionMaterial(e)}async requestTransactionSigningChallenge(e){return await this.exportRecoveryRuntime.requestTransactionSigningChallenge(e)}async requestExportChallenge(e){return await this.exportRecoveryRuntime.requestExportChallenge(e)}async exportEcdsaKeyWithDurableAuthorization(e){return await this.exportRecoveryRuntime.exportEcdsaKeyWithDurableAuthorization(e)}async exportEd25519YaoSeedWithFreshEmailOtpLane(e){return await this.exportRecoveryRuntime.exportEd25519YaoSeedWithFreshEmailOtpLane(e)}async loginWithEcdsaCapabilityForSigning(e){return await this.ecdsaLifecycleRuntime.loginWithEcdsaCapabilityForSigning(e)}async loginWithEcdsaCapabilityInternal(e){return await this.ecdsaLifecycleRuntime.loginWithEcdsaCapabilityInternal(e)}};function Jj(e){let t=new qj({configs:e.seamsWebConfigs,signerWorkerManager:e.signerWorkerManager,getRpId:()=>e.touchIdPrompt.getRpId(),getSignerWorkerContext:e.getSignerWorkerContext,loadWalletCustodyEd25519Material:e.loadWalletCustodyEd25519Material,restoreWalletCustodyEcdsaContinuity:e.restoreWalletCustodyEcdsaContinuity,resolveSelectedWalletAuthority:K.resolveSelectedWalletAuthority.bind(K),ownerLaneScopeStores:{getWalletAuthMethodV2:K.getWalletAuthMethodV2.bind(K),listWalletAuthMethodsForWallet:K.listWalletAuthMethodsForWallet.bind(K),getWalletPasskeyAuthenticator:K.getWalletPasskeyAuthenticator.bind(K)},readExactWalletSessionAuthorization:G.readExactWithOperationCredential.bind(G),provisionThresholdEcdsaSession:e.provisionThresholdEcdsaSession,withThresholdEcdsaSigningQueue:t=>pf({queueByKey:e.thresholdEcdsaSigningQueueByKey,...t}),provisionEmailOtpEcdsaExplicitExportSession:e.provisionEmailOtpEcdsaExplicitExportSession,commitEvmFamilyThresholdEcdsaSessions:t=>Kk({queueByWallet:e.thresholdEcdsaBootstrapQueueByWallet,bootstrapStore:e.ecdsaBootstrapStore,persistEcdsaRoleLocalReadyRecord:e.persistEcdsaRoleLocalReadyRecord,ensureSealedRefreshStartupParityForThresholdEcdsaBootstrap:t=>Nd(e.ensureSealedRefreshStartupParity,t)},t),listActiveEcdsaCapabilityManifestsForWallet:t=>e.listActiveEcdsaCapabilityManifestsForWallet(String(t)),resolveCurrentEcdsaCapabilityRuntime:e.resolveActiveEcdsaCapabilityRuntime,writeExactSealedSession:e.sealedSessionStore.writeExactSealedSession,readExactSealedSession:e.sealedSessionStore.readExactSealedSession,listExactSealedSessionsForWallet:e.sealedSessionStore.listExactSealedSessionsForWallet,acquireSigningSessionRestoreLease:e.sealedSessionStore.acquireSigningSessionRestoreLease,releaseSigningSessionRestoreLease:e.sealedSessionStore.releaseSigningSessionRestoreLease,updateExactSealedSessionPolicy:e.sealedSessionStore.updateExactSealedSessionPolicy}),n=fD({base:e.passkeyMpcSession,secondary:{readWarmSessionStatusOnly:e=>t.readWarmSessionStatusOnly({kind:`ecdsa`,thresholdSessionId:String(e)}),clearVolatileWarmSessionMaterial:e=>t.clearVolatileWarmSessionMaterial({kind:`ecdsa`,thresholdSessionId:String(e.scope.thresholdSessionId)})}});return{emailOtpSessions:t,touchConfirm:e.baseTouchConfirm,passkeyMpcSession:n}}function Yj(e){return Jj({resolveActiveEcdsaCapabilityRuntime:Mk,seamsWebConfigs:e.seamsWebConfigs,touchIdPrompt:e.touchIdPrompt,signerWorkerManager:e.signerWorkerManager,ecdsaBootstrapStore:e.stores.walletProfileAndSignerRecords.ecdsaBootstrapStore,sealedSessionStore:e.sealedSigningSessionStore,baseTouchConfirm:e.baseTouchConfirm,passkeyMpcSession:e.passkeyMpcSession,getSignerWorkerContext:()=>e.getEnginePorts().walletSessionActivationDeps.getSignerWorkerContext(),provisionThresholdEcdsaSession:t=>e.getEnginePorts().tempoSigningDeps.provisionThresholdEcdsaSession(t),provisionEmailOtpEcdsaExplicitExportSession:t=>H_({queueByWallet:e.thresholdEcdsaBootstrapQueueByWallet,activationDeps:e.getEnginePorts().walletSessionActivationDeps,persistEcdsaRoleLocalReadyRecord:e.runtimePorts.storage.persistEcdsaRoleLocalReadyRecord},t),thresholdEcdsaBootstrapQueueByWallet:e.thresholdEcdsaBootstrapQueueByWallet,thresholdEcdsaSigningQueueByKey:e.thresholdEcdsaSigningQueueByKey,loadWalletCustodyEd25519Material:e.loadWalletCustodyEd25519Material,restoreWalletCustodyEcdsaContinuity:e.restoreWalletCustodyEcdsaContinuity,persistEcdsaRoleLocalReadyRecord:e.runtimePorts.storage.persistEcdsaRoleLocalReadyRecord,listActiveEcdsaCapabilityManifestsForWallet:e.listActiveEcdsaCapabilityManifestsForWallet,ensureSealedRefreshStartupParity:e.ensureSealedRefreshStartupParity})}function Xj(e){return{passkeyPublicDeps:GD({seamsWebConfigs:e.seamsWebConfigs,credentialStore:e.stores.recoveryAndDeviceLinking.credentialStore,touchIdPrompt:e.touchIdPrompt,passkeyMpcSession:e.passkeyMpcSession,warmSigning:e.warmSigning,thresholdEcdsaBootstrapQueueByWallet:e.thresholdEcdsaBootstrapQueueByWallet,ensureSealedRefreshStartupParity:e.ensureSealedRefreshStartupParity,walletSessionActivationDeps:e.enginePorts.walletSessionActivationDeps,persistEcdsaRoleLocalReadyRecord:e.runtimePorts.storage.persistEcdsaRoleLocalReadyRecord}),warmCapabilitiesPublicDeps:KD({seamsWebConfigs:e.seamsWebConfigs,bootstrapStore:e.stores.walletProfileAndSignerRecords.ecdsaBootstrapStore,passkeyMpcSession:e.passkeyMpcSession,warmSigning:e.warmSigning,walletSessionActivationDeps:e.enginePorts.walletSessionActivationDeps,signingSessionCoordinator:e.enginePorts.signingSessionCoordinator})}}async function Zj(e){let t=`${Ic(e.relayUrl)}/wallets/custody/envelope`,n=e.fetchImpl||fetch,r;try{r=await n(t,Fc({body:{locator:e.locator,challengeId:e.challengeId,expectedOrigin:e.expectedOrigin,webauthnAuthentication:e.webauthnAuthentication}}))}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`custody envelope request failed`}}let i=await r.json().catch(()=>void 0);if(r.status===200&&nM(i))try{return{kind:`active`,envelope:$j(i).envelope}}catch{return{kind:`corrupt`,message:`custody envelope response was incomplete`}}let a=tM(i,`custody envelope response`),o=a.code??``,s=a.message??``;switch(r.status){case 404:return{kind:`missing`,message:s||`no custody envelope for this credential`};case 409:return{kind:`retired`,message:s||`this envelope was superseded`};case 401:case 403:return{kind:`credential_rejected`,message:s||`this credential does not open the wallet`};case 500:return o===`envelope_digest_mismatch`?{kind:`corrupt`,message:s||`stored custody envelope failed its digest`}:{kind:`transport_failed`,message:s||`custody envelope request failed (HTTP ${r.status})`};default:return{kind:`request_rejected`,message:s||`custody envelope request rejected (HTTP ${r.status})`}}}async function Qj(e){let t=`${Ic(e.relayUrl)}/wallets/${encodeURIComponent(e.walletId)}/custody/envelope/ownership`,n=e.fetchImpl||fetch,r;try{r=await n(t,Fc({body:{envelope:e.envelope},headers:Lc({token:e.walletSessionToken,missingMessage:`custody envelope upgrade needs an active Wallet Session`})}))}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`custody envelope upgrade failed`}}let i=await r.json().catch(()=>void 0);if(r.status===200)try{let e=eM(i);if(e.kind===`already_owned`)return e;let t=Number(e.envelopeRevision);if(!Number.isSafeInteger(t)||t<=0)throw Error(`invalid envelope revision`);return{kind:`upgraded`}}catch{return{kind:`rejected`,message:`custody envelope upgrade returned an invalid response`}}return{kind:`rejected`,message:tM(i,`custody envelope upgrade response`).message||`custody envelope upgrade rejected (HTTP ${r.status})`}}function $j(e){let t=iM(e,[`ok`,`envelope`,`storeVersion`],`custody envelope response`);if(sM(t,`ok`)!==!0)throw Error(`custody envelope response did not succeed`);let n=cM(t,`storeVersion`);if(!n)throw Error(`custody envelope response is missing its store version`);return{envelope:ti(sM(t,`envelope`),`custody envelope response.envelope`),storeVersion:n}}function eM(e){let t=rM(e,`custody envelope upgrade response`),n=sM(t,`upgraded`);if(n===!0){if(iM(t,[`ok`,`upgraded`,`envelopeRevision`],`custody envelope upgrade response`),sM(t,`ok`)!==!0)throw Error(`custody envelope upgrade response did not succeed`);return{kind:`upgraded`,envelopeRevision:sM(t,`envelopeRevision`)}}if(n===!1){if(iM(t,[`ok`,`upgraded`],`custody envelope upgrade response`),sM(t,`ok`)!==!0)throw Error(`custody envelope upgrade response did not succeed`);return{kind:`already_owned`}}throw Error(`custody envelope upgrade response has an invalid branch`)}function tM(e,t){try{let n=rM(e,t),r=Object.keys(n);if(!r.includes(`ok`)||!oM(r,[`ok`,`code`,`message`]))throw Error(`${t} has an unexpected response shape`);if(sM(n,`ok`)!==!1)throw Error(`${t} is not a failure`);return{code:lM(n,`code`),message:lM(n,`message`)}}catch{return{code:null,message:null}}}function nM(e){if(typeof e!=`object`||!e||Array.isArray(e))return!1;let t=Object.getPrototypeOf(e);if(t!==Object.prototype&&t!==null)return!1;let n=Object.getOwnPropertyDescriptor(e,`ok`);return!!(n&&`value`in n&&n.value===!0)}function rM(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be a JSON object`);let n=Object.getPrototypeOf(e);if(n!==Object.prototype&&n!==null)throw Error(`${t} must be a plain JSON object`);return e}function iM(e,t,n){let r=rM(e,n),i=Object.keys(r);if(i.length!==t.length||!aM(i,t))throw Error(`${n} has an unexpected response shape`);return r}function aM(e,t){for(let n of t)if(!e.includes(n))return!1;return!0}function oM(e,t){for(let n of e)if(!t.includes(n))return!1;return!0}function sM(e,t){let n=Object.getOwnPropertyDescriptor(e,t);if(!n||!(`value`in n))throw Error(`response field ${t} is missing`);return n.value}function cM(e,t){let n=sM(e,t);return typeof n==`string`?n.trim():``}function lM(e,t){let n=Object.getOwnPropertyDescriptor(e,t);return!n||!(`value`in n)?null:(typeof n.value==`string`?n.value.trim():``)||null}function uM(e){return e.session.chainTargets.length===e.walletKeys.length?e.walletKeys.every((t,n)=>{let r=e.session.chainTargets[n];return r!==void 0&&z(r)===z(t.chainTarget)}):!1}function dM(e){let t=e.walletKey;return{keyScope:t.keyScope,chainTarget:t.chainTarget,walletId:t.walletId,evmFamilySigningKeySlotId:t.evmFamilySigningKeySlotId,keyHandle:t.keyHandle,ecdsaThresholdKeyId:t.ecdsaThresholdKeyId,signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion,thresholdEcdsaPublicKeyB64u:t.thresholdEcdsaPublicKeyB64u,thresholdOwnerAddress:t.thresholdOwnerAddress,relayerKeyId:t.relayerKeyId,relayerVerifyingShareB64u:t.relayerVerifyingShareB64u,participantIds:t.participantIds,publicCapability:t.publicCapability,roleLocalMaterialRef:e.materialRef,ecdsaRoleLocalPublicFacts:e.publicFacts}}async function fM(e){if(!uM({session:e.session,walletKeys:e.walletKeys}))throw Error(`[SigningEngine] strict ECDSA registration requires one family activation projected to every wallet target`);let t=R(e.walletId);if(e.session.authority.walletId!==t)throw Error(`[SigningEngine] strict ECDSA registration authority does not match the target wallet`);let n=e.session.roleLocalMaterial,r=Go({kind:`ecdsa_role_local_persisted_material_ref_v1`,durableMaterialRef:n.durableMaterialRef,bindingDigest:n.bindingDigest,materialActivation:e.session.materialActivation}),[i,...a]=e.walletKeys.map(n=>dM({walletKey:n,publicFacts:$s({walletId:t,chainTarget:n.chainTarget,keyHandle:n.keyHandle,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,applicationBindingDigestB64u:e.session.bootstrap.applicationBindingDigestB64u,clientParticipantId:1,relayerParticipantId:2,participantIds:n.participantIds,contextBinding32B64u:e.session.clientPublicFacts.contextBinding32B64u,derivationClientSharePublicKey33B64u:e.session.clientPublicFacts.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:e.session.clientPublicFacts.relayerPublicKey33B64u,groupPublicKey33B64u:e.session.clientPublicFacts.groupPublicKey33B64u,ethereumAddress:e.session.clientPublicFacts.ethereumAddress,publicCapability:e.session.publicCapability}),materialRef:r}));if(!i)throw Error(`[SigningEngine] strict ECDSA registration did not persist any wallet keys`);return[i,...a]}function pM(e){let t=e.clientExtensionResults.prf?.results?.first;if(typeof t!=`string`||!t)throw Error(`the replacement passkey returned no wallet-custody PRF output`);let n=I(t);if(n.length!==32)throw Error(`the replacement passkey returned an invalid wallet-custody PRF output`);return Uint8Array.from(n).buffer}function mM(e){let t=m(String(e.rawId||e.id||``).trim());if(!t.ok)throw Error(`replacement passkey credential id ${t.error.message}`);return{registration:e,credentialIdB64u:t.value,factorSecret:pM(e)}}async function hM(e,t){return await pk(e,t)}function gM(e,t){let n=null;for(let r of e)if(r.signer.authority.authorityDigest===t){if(n&&n.durableMaterial.roleLocalBinding.keyHandle!==r.durableMaterial.roleLocalBinding.keyHandle)throw Error(`[SigningEngine][near] Email OTP ECDSA session identity is ambiguous`);n=r}if(!n)throw Error(`[SigningEngine][near] Email OTP ECDSA capability is unavailable`);return n}function _M(e){let t=yr(_l(`wallet-session-mint`));if(!t.ok)throw Error(`[SigningEngine][near] failed to generate an ECDSA Wallet Session mint id`);return{kind:`router_ab_ecdsa_post_registration_session_activation_policy_v1`,key_handle:String(e.manifest.durableMaterial.roleLocalBinding.keyHandle),session_policy:{threshold_session_id:Xs.thresholdEcdsaSession(_l(`threshold-ecdsa-login`)),wallet_session_mint_id:t.value,ttl_ms:Nn.ttlMs,remaining_uses:e.remainingUses,runtime_policy_scope:e.manifest.durableMaterial.runtimePolicyScope}}}function vM(e){let t=Xn(e.activation.public_capability.material_activation),n=0;for(let r of e.walletSession.capabilitySubjects)r.kind===`sign`&&r.keyFamily===`ecdsa_secp256k1`&&b(r.materialActivation,t)&&(n+=1);return n===1}async function yM(e){let t=e.response.session,n=e.authorization.record,r=e.authorization.operationCredential;if(String(n.walletId)!==String(e.walletId)||String(e.response.public_capability.client_id)!==String(n.walletId)||n.authorizationId!==t.authorization_id||n.quotaId!==t.quota_id||n.expiresAtMs!==t.expires_at_ms||r.walletSessionId!==t.wallet_session_id||!vM({walletSession:n,activation:e.response}))throw Error(`[SigningEngine][near] refreshed ECDSA exact Wallet Session is inconsistent`);await G.writeExactWithOperationCredential({record:n,operationCredential:r})}async function bM(e){return await _s(K,e)}async function xM(){return null}const SM={getWalletAuthMethodV2:e=>K.getWalletAuthMethodV2(e),listWalletAuthMethodsForWallet:e=>K.listWalletAuthMethodsForWallet(e),getWalletPasskeyAuthenticator:xM,readEmailOtpProviderSubjectForWallet:bM};async function CM(e){let t=(await K.listWalletAuthMethodsV2ForWallet(String(e.walletId))).filter(t=>t.kind===B.passkey&&t.status===`active`&&t.walletId===e.walletId&&String(t.rpId)===e.rpId&&String(t.credentialIdB64u)===e.credentialIdB64u),[n]=t;return t.length!==1||!n||n.kind!==B.passkey?null:await L({authority:{walletId:n.walletId,factor:{kind:B.passkey,credentialIdB64u:n.credentialIdB64u},verifier:{kind:`webauthn`,rpId:n.rpId},bindingId:n.walletAuthMethodId}})}function wM(e){let t=or({kind:`wallet_auth_authority_ref`,walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId,authorityDigest:e.authorityDigestB64u});if(!t)throw Error(`[SigningEngine][near] exact Email OTP authority digest is invalid`);return t}async function TM(e){let t=await Hd({authMethod:e.authMethod,stores:SM});if(!$n(t)||t.walletId!==e.authMethod.walletId||t.bindingId!==e.authMethod.walletAuthMethodId||t.verifier.emailHashHex!==e.emailHashHex||t.factor.providerUserId!==e.providerSubject)throw Error(`[SigningEngine][near] exact Email OTP factor authority changed`);return t}function EM(e){let t=e.auth;switch(t.kind){case B.emailOtp:return{kind:e.kind,signer:e.signer,auth:t,thresholdSessionId:e.thresholdSessionId};case B.passkey:throw Error(`[SigningEngine][near] Email OTP material identity is required`);default:throw Error(`[SigningEngine][near] unsupported Ed25519 material authority`)}}async function DM(e){if(String(e.identity.signer.account.wallet.walletId)!==String(e.walletId)||String(e.identity.signer.account.nearAccountId)!==String(e.nearAccountId)||e.identity.signer.signerSlot!==e.signerSlot)return null;let t;try{t=await K.resolveSelectedWalletAuthority(String(e.walletId))}catch{return null}if(t.kind!==`resolved`)return null;let{selection:n,authMethod:r,authority:i}=t,a=i.signerActivations.ed25519;if(n.lockState!==`unlocked`||n.walletId!==e.walletId||n.walletAuthMethodId!==r.walletAuthMethodId||r.kind!==B.emailOtp||r.status!==`active`||r.walletId!==e.walletId||r.walletAuthorityId!==i.authorityId||i.state!==`active`||i.walletId!==e.walletId||!a||a.signer.walletId!==e.walletId||!b(a.materialActivation,e.materialActivation))return null;try{let t=await L({authority:await TM({authMethod:r,emailHashHex:r.emailHashHex,providerSubject:e.identity.auth.providerSubjectId})});return t.walletId!==e.walletId||t.walletAuthMethodId!==r.walletAuthMethodId?null:t}catch{return null}}async function OM(e){let t=e.bootstrap.session,n=e.exactAuthorization?.record??await G.readExact(t.walletSessionId);if(!n||n.kind!==`active_wallet_session_v1`||n.walletId!==e.walletId||n.authorizationId!==t.authorizationId||n.quotaId!==t.quotaId||n.expiresAtMs<=Date.now())throw Error(`[SigningEngine][near] exact Email OTP activation session is unavailable`);let[r,i]=await Promise.all([K.getWalletAuthMethodV2(String(n.authMethodId)),K.getWalletAuthority(String(n.authorityId))]);if(!r||r.kind!==`email_otp`||r.status!==`active`||r.walletId!==e.walletId||r.walletAuthorityId!==n.authorityId||r.emailHashHex!==e.emailHashHex||!i||i.state!==`active`||i.walletId!==e.walletId||i.authorityId!==n.authorityId||i.authorityDigestB64u!==n.authorityDigestB64u||i.revocationEpoch!==n.authorityRevocationEpoch)throw Error(`[SigningEngine][near] exact Email OTP activation authority is unavailable`);let a=wM({walletId:e.walletId,walletAuthMethodId:r.walletAuthMethodId,authorityDigestB64u:i.authorityDigestB64u}),o=await L({authority:await TM({authMethod:r,emailHashHex:e.emailHashHex,providerSubject:e.providerSubject})});if(e.verifiedAuthority&&(e.verifiedAuthority.walletId!==o.walletId||e.verifiedAuthority.walletAuthMethodId!==o.walletAuthMethodId))throw Error(`[SigningEngine][near] verified Email OTP activation authority changed`);let s=e.exactAuthorization;if(s){if(!ar(s.record,n)||s.operationCredential.walletSessionId!==t.walletSessionId)throw Error(`[SigningEngine][near] exact Email OTP activation credential is unavailable`);return{authority:a,operationCredential:s.operationCredential}}let c=await G.readExactActiveForWallet({walletId:e.walletId,authorityId:n.authorityId,authMethodId:n.authMethodId});if(c.kind!==`found`||!ar(c.record,n)||c.operationCredential.walletSessionId!==t.walletSessionId)throw Error(`[SigningEngine][near] exact Email OTP activation credential is unavailable`);return{authority:a,operationCredential:c.operationCredential}}function kM(e){switch(e.status){case`missing`:return{kind:`missing`};case`expired`:return{kind:`expired`};case`superseded`:return{kind:`superseded`};case`authority_unavailable`:return{kind:`authority_unavailable`};case`method_unavailable`:return{kind:`method_unavailable`};case`capability_unavailable`:return{kind:`capability_unavailable`};case`invalid`:return{kind:`corrupt`};default:throw Error(`[SigningEngine][ed25519-export] unsupported exact session status`)}}async function AM(e){let t=e.subject.signer.account.wallet.walletId,n;try{n=await K.resolveSelectedWalletAuthority(String(t))}catch{return{kind:`persistence_unavailable`}}if(n.kind!==`resolved`)return n.kind===`integrity_error`?{kind:`corrupt`}:{kind:`missing`};let{selection:r,authority:i,authMethod:a}=n;if(r.lockState!==`unlocked`||r.walletId!==t||r.walletAuthMethodId!==a.walletAuthMethodId||i.state!==`active`||i.walletId!==t||a.kind!==`email_otp`||a.status!==`active`||a.walletId!==t||a.walletAuthorityId!==i.authorityId)return{kind:`corrupt`};let o;try{o=await TM({authMethod:a,emailHashHex:a.emailHashHex,providerSubject:e.subject.auth.providerSubjectId})}catch{return{kind:`corrupt`}}let s=await G.readExactActiveForWallet({walletId:t,authorityId:i.authorityId,authMethodId:a.walletAuthMethodId});switch(s.kind){case`missing`:case`upgrade_required`:case`corrupt`:case`persistence_unavailable`:return s;case`found`:break;default:throw Error(`[SigningEngine][ed25519-export] unsupported exact local session result`)}if(s.record.expiresAtMs<=Date.now())return{kind:`expired`};let c;try{c=await Ot({relayerUrl:e.relayerUrl,operationCredential:s.operationCredential}).read({walletSessionId:s.operationCredential.walletSessionId,quotaId:s.record.quotaId})}catch{return{kind:`persistence_unavailable`}}return c.status!==`active`&&c.status!==`exhausted`?kM(c):{kind:`found`,authorization:{selectedAuthority:i,selectedAuthMethod:a,factorAuthority:o,record:s.record,operationCredential:s.operationCredential,status:c}}}function jM(e,t){return globalThis.fetch(e,t)}function MM(e){let t=e.walletSessionState.thresholdSessionId;switch(e.subject.kind){case`exact_lane`:return{kind:`exact_lane`,laneIdentity:e.walletSessionState.signingLane.identity};case`export_exact_lane`:return{kind:`export_exact_lane`,laneIdentity:Hc({signer:e.walletSessionState.signingLane.identity.signer,auth:e.walletSessionState.signingLane.identity.auth,thresholdSessionId:t}),materialActivation:e.subject.materialActivation};case`material_identity`:return{kind:`material_identity`,materialIdentity:{kind:`near_ed25519_material_identity`,signer:e.walletSessionState.signingLane.identity.signer,auth:e.walletSessionState.signingLane.identity.auth,thresholdSessionId:t}};default:return NM(e.subject)}}function NM(e){throw Error(`Unknown Ed25519 capability rehydration subject: ${String(e)}`)}async function PM(e){let t=e.walletSessionState.thresholdSessionId,n=await e.claimWarmSessionMaterial({thresholdSessionId:t,purpose:{curve:`ed25519`,materialActivation:e.materialActivation},consume:!1});if(n.ok||n.code!==`not_found`)return n;if(e.runtime.factor.kind!==`passkey`)throw Error(`[SigningEngine][near] persisted Ed25519 credential is unavailable`);let r=String(e.walletSessionState.walletSessionAuth.walletSessionToken||``).trim(),i=String(e.runtime.sealedRecord.groupId||``).trim();if(!r||!i)return{ok:!1,code:`invalid_args`,message:`Passkey Ed25519 sealed restore metadata is incomplete`};if(!b(e.runtime.sealedRecord.ed25519Restore.materialActivation,e.materialActivation))throw Error(`[SigningEngine][near] persisted Ed25519 material activation mismatch`);let a=qo(e.runtime.sealedRecord.keyVersion),o=await e.rehydrateWarmSessionMaterial({thresholdSessionId:t,sealedSecretB64u:e.runtime.sealedRecord.sealedSecretB64u,signingSessionSealKeyVersion:a,expiresAtMs:e.runtime.sealedRecord.expiresAtMs,remainingUses:e.runtime.sealedRecord.remainingUses,transport:{curve:`ed25519`,authMethod:`passkey`,walletId:String(e.runtime.walletId),relayerUrl:e.runtime.relayerUrl,signingSessionSealKeyVersion:a,groupId:i,walletSessionToken:r,ed25519Restore:Me({rpId:e.runtime.factor.rpId,nearAccountId:e.runtime.nearAccountId,nearEd25519SigningKeyId:e.runtime.nearEd25519SigningKeyId,relayerKeyId:e.runtime.relayerKeyId,participantIds:e.runtime.participantIds,runtimePolicyScope:e.runtime.runtimePolicyScope,signerSlot:e.runtime.signerSlot,routerAbNormalSigning:e.runtime.routerAbNormalSigning,credentialIdB64u:e.runtime.factor.credentialIdB64u,materialActivation:e.materialActivation})}});return o.ok?(n=await e.claimWarmSessionMaterial({thresholdSessionId:t,purpose:{curve:`ed25519`,materialActivation:e.materialActivation},consume:!1}),n):o}async function FM(e){let t=e.identity.signer,n=(await e.store.listLanes()).filter(n=>String(n.walletId)===String(t.account.wallet.walletId)&&String(n.nearAccountId)===String(t.account.nearAccountId)&&String(n.nearEd25519SigningKeyId)===String(t.nearEd25519SigningKeyId)&&n.signerSlot===t.signerSlot&&String(n.thresholdSessionId)===String(e.identity.thresholdSessionId)&&uN(n.auth,e.identity.auth));if(n.length>1)throw Error(`[SigningEngine][near] public Ed25519 capability lane is conflicting`);return n[0]?.materialActivation??null}function IM(e){let t=e.walletSessionState.signingLane,n=t.identity.signer;if(t.auth.kind!==`email_otp`)throw Error(`[SigningEngine][near] Email OTP recovery returned another auth lane`);return{walletId:n.account.wallet.walletId,nearAccountId:n.account.nearAccountId,thresholdSessionId:e.walletSessionState.thresholdSessionId,runtimePolicyScope:e.walletSessionState.runtimePolicyScope,materialActivation:e.materialActivation,auth:{kind:`email_otp`,providerSubjectId:t.auth.providerSubjectId},nearEd25519SigningKeyId:n.nearEd25519SigningKeyId,signerSlot:n.signerSlot,remainingUses:e.walletSessionState.signingWalletSession.remainingUses,expiresAtMs:e.walletSessionState.signingWalletSession.expiresAtMs}}function LM(e){return e.kind===`wallet_authority_linked_signer_material_v1`&&e.keyFamily===`ed25519`}function RM(e){let t=e.selected;if(t.kind!==`resolved`){let e=t.kind===`integrity_error`?`: ${t.reason}`:``;throw Error(`[SigningEngine][ed25519-export] selected Wallet Authority is ${t.kind}${e}`)}if(t.authority.provenance.kind===`wallet_registration`||t.authority.provenance.kind===`wallet_recovery`)return null;let{selection:n,authMethod:r,authority:i,signerMaterials:a,exportRoot:o}=t,s=e.subject.signer,c=i.signerActivations.ed25519;if(n.lockState!==`unlocked`||r.kind!==B.emailOtp||r.status!==`active`||i.state!==`active`||String(n.walletId)!==String(s.account.wallet.walletId)||n.walletAuthMethodId!==r.walletAuthMethodId||r.walletAuthorityId!==i.authorityId||String(r.walletId)!==String(s.account.wallet.walletId)||!i.permissions.includes(`export_keys`)||!c||!b(c.materialActivation,e.expectedMaterialActivation)||!o)throw Error(`[SigningEngine][ed25519-export] selected linked Email OTP authority has no exact export root`);let l=null;for(let t of a)if(!(!LM(t)||t.authorityId!==i.authorityId||t.walletAuthMethodId!==r.walletAuthMethodId||!b(t.materialActivation,e.expectedMaterialActivation))){if(l)throw Error(`[SigningEngine][ed25519-export] linked Ed25519 material is ambiguous`);l=t}if(!l)throw Error(`[SigningEngine][ed25519-export] linked Ed25519 material is unavailable`);let u=l.targetFactor,d=l.publicFacts.applicationBinding,f=l.publicFacts.targetBinding.lifecycle,p=c.signer.registeredPublicKeyB64u;if(u.kind!==B.emailOtp||u.walletAuthMethodId!==r.walletAuthMethodId||u.emailHashHex!==r.emailHashHex||u.registrationAuthorityId!==r.registrationAuthorityId||o.authorityId!==i.authorityId||o.walletAuthMethodId!==r.walletAuthMethodId||o.walletKeyId!==c.signer.walletKeyId||o.envelope.binding.kind!==`ed25519_yao_client_root_v1`||o.envelope.binding.registeredPublicKeyB64u!==p||o.envelope.factor.kind!==B.emailOtp||d.wallet_id!==String(s.account.wallet.walletId)||d.near_ed25519_signing_key_id!==String(s.nearEd25519SigningKeyId)||d.key_creation_signer_slot!==s.signerSlot||f.account_id!==String(s.account.wallet.walletId)||f.session_id!==String(e.subject.thresholdSessionId)||f.selected_server_id!==e.expectedMaterialActivation.signingWorker||F(Uint8Array.from(l.publicFacts.activationReceipt.registered_public_key))!==p)throw Error(`[SigningEngine][ed25519-export] linked Email OTP export identity changed`);if(e.activeCapability){if(!b(e.activeCapability.materialActivation,e.expectedMaterialActivation)||F(Uint8Array.from(e.activeCapability.registeredPublicKey))!==p)throw Error(`[SigningEngine][ed25519-export] active Email OTP capability changed`);return o.envelope}return{envelope:o.envelope,source:{materialActivation:e.expectedMaterialActivation,signingWorkerId:f.selected_server_id,participantIds:l.publicFacts.participantIds,registeredPublicKeyB64u:p}}}async function zM(e){let t=null;for(let n of e.signerMaterials)if(!(!LM(n)||n.authorityId!==e.authMethod.walletAuthorityId||n.walletAuthMethodId!==e.authMethod.walletAuthMethodId)){if(t)throw Error(`[SigningEngine] linked Passkey Ed25519 signer material is conflicting`);t=n}if(!t)throw Error(`[SigningEngine] linked Passkey Ed25519 signer material is unavailable`);let n=t.publicFacts.applicationBinding,r=ks(n.key_creation_signer_slot,{min:1}),i=t.targetFactor;if(!r||n.wallet_id!==String(e.walletId)||String(t.materialActivation.materialOwner)!==String(e.walletId)||i.kind!==B.passkey||i.walletAuthMethodId!==e.authMethod.walletAuthMethodId||String(i.rpId)!==String(e.authMethod.rpId)||String(i.credentialIdB64u)!==String(e.authMethod.credentialIdB64u))throw Error(`[SigningEngine] linked Passkey Ed25519 signer material identity is invalid`);let a=0;for(let i of await e.publicLaneStore.listLanes())i.auth.kind===`passkey`&&(String(i.walletId)!==String(e.walletId)||String(i.auth.rpId)!==String(e.authMethod.rpId)||i.auth.credentialIdB64u!==e.authMethod.credentialIdB64u||String(i.nearEd25519SigningKeyId)!==String(n.near_ed25519_signing_key_id)||i.signerSlot!==r||!b(i.materialActivation,t.materialActivation)||(a+=1));if(a===0)throw Error(`[SigningEngine] linked Passkey Ed25519 public lane is unavailable`);if(a!==1)throw Error(`[SigningEngine] linked Passkey Ed25519 public lane is ambiguous`);return r}async function BM(e){let t=e.laneIdentity.signer,n=(await e.store.listLanes()).filter(n=>n.auth.kind===B.emailOtp&&e.laneIdentity.auth.kind===B.emailOtp&&n.auth.providerSubjectId===e.laneIdentity.auth.providerSubjectId&&String(n.walletId)===String(t.account.wallet.walletId)&&String(n.nearAccountId)===String(t.account.nearAccountId)&&String(n.nearEd25519SigningKeyId)===String(t.nearEd25519SigningKeyId)&&n.signerSlot===t.signerSlot&&String(n.thresholdSessionId)===String(e.laneIdentity.thresholdSessionId)&&b(n.materialActivation,e.materialActivation));if(n.length!==1)throw Error(n.length===0?`[SigningEngine][near] Email OTP public lane is unavailable`:`[SigningEngine][near] Email OTP public lane is ambiguous`);return n[0]}async function VM(e){if(e.laneIdentity.auth.kind!==B.passkey)throw Error(`[SigningEngine][near] Passkey public lane authority is required`);let t=e.laneIdentity.auth,n=e.laneIdentity.signer,r=(await e.store.listLanes()).filter(r=>r.auth.kind===B.passkey&&r.auth.rpId===t.rpId&&r.auth.credentialIdB64u===t.credentialIdB64u&&String(r.walletId)===String(n.account.wallet.walletId)&&String(r.nearAccountId)===String(n.account.nearAccountId)&&String(r.nearEd25519SigningKeyId)===String(n.nearEd25519SigningKeyId)&&r.signerSlot===n.signerSlot&&String(r.thresholdSessionId)===String(e.laneIdentity.thresholdSessionId));if(r.length!==1)throw Error(r.length===0?`[SigningEngine][near] Passkey public lane is unavailable`:`[SigningEngine][near] Passkey public lane is ambiguous`);return r[0]}async function HM(e){let t=e.identity.signer,n=(await e.store.listLanes()).filter(n=>String(n.walletId)===String(t.account.wallet.walletId)&&String(n.nearAccountId)===String(t.account.nearAccountId)&&String(n.nearEd25519SigningKeyId)===String(t.nearEd25519SigningKeyId)&&n.signerSlot===t.signerSlot&&String(n.thresholdSessionId)===String(e.identity.thresholdSessionId)&&uN(n.auth,e.identity.auth)&&b(n.materialActivation,e.materialActivation));if(n.length!==1)throw Error(n.length===0?`[SigningEngine][near] exact Ed25519 public lane is unavailable`:`[SigningEngine][near] exact Ed25519 public lane is ambiguous`);return n[0]}async function UM(e){if(e.reference.auth.kind!==B.passkey)throw Error(`[SigningEngine][near] Passkey public lane authority is required`);if(e.authorization.selectedAuthMethod.kind!==B.passkey||String(e.authorization.session.walletId)!==String(e.reference.walletId))throw Error(`[SigningEngine][near] Passkey Wallet Session authority does not match lane`);let t=await K.getWalletAuthMethodV2(e.authorization.selectedAuthMethod.walletAuthMethodId);if(!t||t.kind!==B.passkey||t.status!==`active`||String(t.walletId)!==String(e.reference.walletId)||String(t.rpId)!==String(e.reference.auth.rpId)||String(t.credentialIdB64u)!==String(e.reference.auth.credentialIdB64u))throw Error(`[SigningEngine][near] Passkey Wallet Session method does not match lane`);let n=await L({authority:{walletId:t.walletId,factor:{kind:B.passkey,credentialIdB64u:t.credentialIdB64u},verifier:{kind:`webauthn`,rpId:t.rpId},bindingId:t.walletAuthMethodId}}),r=await L({authority:e.authorization.selectedFactorAuthority});if(n.authorityDigest!==r.authorityDigest||n.walletAuthMethodId!==r.walletAuthMethodId)throw Error(`[SigningEngine][near] Passkey Wallet Session authority changed`);return n}async function WM(e){if(e.reference.auth.kind!==B.passkey)throw Error(`[SigningEngine][near] Passkey public lane authority is required`);if(!Xc({session:e.authorization.session,materialActivation:e.materialActivation}))throw Error(`[SigningEngine][near] Passkey Wallet Session material changed`);let t=await UM({reference:e.reference,authorization:e.authorization}),n=Cr(e.authorization.session.authorizationId);if(!n.ok||e.authorization.operationCredential.token.trim().length===0)throw Error(`[SigningEngine][near] Passkey Ed25519 Wallet Session credential is unavailable`);let r=e.material.facts,i=Qe({walletId:String(e.reference.walletId),nearAccountId:String(e.reference.nearAccountId),nearEd25519SigningKeyId:String(e.reference.nearEd25519SigningKeyId),walletSessionId:e.authorization.operationCredential.walletSessionId,authorizationId:n.value,quotaId:e.authorization.session.quotaId,thresholdSessionId:e.reference.thresholdSessionId,remainingUses:e.authorization.status.remainingUses,expiresAtMs:e.authorization.status.expiresAtMs,runtimePolicyScope:r.runtimePolicyScope,signingRootId:r.signingRootId,signingRootVersion:r.signingRootVersion,routerAbNormalSigning:r.routerAbNormalSigning,walletSessionToken:e.authorization.operationCredential.token,nowMs:Date.now()});if(!i.ok)throw Error(`[SigningEngine][near] Passkey Wallet Session is unusable (${i.reason})`);return At({walletId:e.reference.walletId,nearAccountId:e.reference.nearAccountId,nearEd25519SigningKeyId:e.reference.nearEd25519SigningKeyId,signerSlot:e.reference.signerSlot,rpId:e.reference.auth.rpId,credentialIdB64u:e.reference.auth.credentialIdB64u,relayerUrl:e.relayerUrl,authority:t,signingWalletSession:i.value})}async function GM(e){let t=await Se(e);if(t.kind!==`resolved`)throw vf(t.kind===`conflict`?`runtime_conflict`:`missing_runtime`);return t.runtime}async function KM(e){let t=await ve(Df({authMethod:e.laneIdentity.auth.kind,materialActivation:e.materialActivation}));if(!t||t.curve!==`ed25519`)throw Error(`[SigningEngine][near] exact persisted Ed25519 runtime is missing`);let n=et(t);if(!n||String(n.walletId)!==String(e.walletId)||String(n.nearAccountId)!==String(e.laneIdentity.signer.account.nearAccountId)||String(n.nearEd25519SigningKeyId)!==String(e.laneIdentity.signer.nearEd25519SigningKeyId)||n.signerSlot!==e.laneIdentity.signer.signerSlot||String(n.thresholdSessionId)!==String(e.laneIdentity.thresholdSessionId)||!uN(n.auth,e.laneIdentity.auth)||!b(n.sealedRecord.ed25519Restore.materialActivation,e.materialActivation))throw Error(`[SigningEngine][near] exact persisted Ed25519 runtime identity mismatch`);return n}async function qM(e){let t=(await Lt({walletId:e.walletId,filter:{authMethod:e.identity.auth.kind,curve:`ed25519`}})).filter(e=>e.curve===`ed25519`).map(et).filter(t=>t!==null&&dN({runtime:t,identity:e.identity}));if(t.length===0)throw vf(`missing_runtime`);if(t.length!==1)throw vf(`runtime_conflict`);return t[0]}function JM(e){let{selection:t,authMethod:n,authority:r}=e.selected;if(t.lockState!==`unlocked`||t.walletId!==e.walletId||t.walletAuthMethodId!==n.walletAuthMethodId||n.walletId!==e.walletId||n.walletAuthorityId!==r.authorityId||r.walletId!==e.walletId)return!1;switch(e.proof.kind){case`passkey`:return n.kind===B.passkey&&e.proof.authority.walletId===e.walletId&&e.proof.authority.bindingId===n.walletAuthMethodId&&e.proof.authority.factor.credentialIdB64u===n.credentialIdB64u&&e.proof.authority.verifier.rpId===n.rpId;case`email_otp`:return n.kind===B.emailOtp&&e.proof.authorityRef.walletId===e.walletId&&e.proof.authorityRef.walletAuthMethodId===n.walletAuthMethodId;default:throw e.proof,Error(`[SigningEngine][near] unsupported operation step-up proof`)}}async function YM(e){let t=await K.resolveSelectedWalletAuthority(String(e.walletId));if(t.kind!==`resolved`){let e=t.kind===`integrity_error`?`: ${t.reason}`:``;throw Error(`[SigningEngine][near] selected Wallet Authority is ${t.kind}${e}`)}if(!JM({walletId:e.walletId,proof:e.proof,selected:t}))throw Error(`[SigningEngine][near] operation step-up authority does not match selection`);let n=await WT({selected:{authMethod:t.authMethod,authority:t.authority},operation:{kind:`near_sign`,operation:`sign`,keyFamily:`ed25519`}});if(n.kind!==`resolved`)throw Error(`[SigningEngine][near] selected Wallet Authority rejected signing (${n.reason.kind})`);let r=pb(await G.readExactWithOperationCredential({walletId:e.walletId,authorityId:t.authority.authorityId,authMethodId:t.authMethod.walletAuthMethodId}),`[SigningEngine][near] exact Wallet Session requires a newer client`),i=r?.record.capabilitySubjects.filter(e=>e.kind===`sign`&&e.keyFamily===`ed25519`&&b(e.materialActivation,n.value.materialActivation)).length===1;if(!r||r.record.walletId!==e.walletId||r.record.authorityId!==t.authority.authorityId||r.record.authMethodId!==t.authMethod.walletAuthMethodId||r.record.authorityDigestB64u!==t.authority.authorityDigestB64u||r.record.authorityRevocationEpoch!==t.authority.revocationEpoch||r.record.expiresAtMs<=Date.now()||!i)throw Error(`[SigningEngine][near] exact Wallet Session is unavailable for operation step-up`);return r.operationCredential}async function XM(e){let t=await pk(e.runtime.walletId,e.relayerUrl);if(!t)throw Error(`[SigningEngine][near] active Wallet Session authorization is unavailable`);return await tn({runtime:e.runtime,authorization:t,nowMs:Date.now()})}async function ZM(e){let{identity:t}=e;if(t.auth.kind!==B.passkey)throw vf(`binding_mismatch`);let n=await K.resolveSelectedWalletAuthority(String(e.walletId));if(n.kind!==`resolved`||n.selection.lockState!==`unlocked`||n.selection.walletId!==e.walletId||n.authMethod.kind!==B.passkey||String(n.authMethod.rpId)!==String(t.auth.rpId)||n.authMethod.credentialIdB64u!==t.auth.credentialIdB64u)throw vf(`binding_mismatch`);let r=await WT({selected:{authMethod:n.authMethod,authority:n.authority},operation:{kind:`near_sign`,operation:`sign`,keyFamily:`ed25519`}});if(r.kind!==`resolved`)throw vf(`missing_capability`);let i=await CM({walletId:e.walletId,rpId:t.auth.rpId,credentialIdB64u:t.auth.credentialIdB64u});if(!i||i.walletAuthMethodId!==n.authMethod.walletAuthMethodId)throw vf(`binding_mismatch`);let a=await tt({store:K,walletId:String(e.walletId),nearAccountId:String(t.signer.account.nearAccountId),nearEd25519SigningKeyId:String(t.signer.nearEd25519SigningKeyId),signerSlot:t.signer.signerSlot,rpId:t.auth.rpId,credentialIdB64u:t.auth.credentialIdB64u,authority:i});if(a.kind!==`available`)throw vf(`missing_runtime`);if(!b(a.locator.materialActivation,r.value.materialActivation))throw vf(`binding_mismatch`);let o=a.locator.stableServerScope,s=vn(o.runtimePolicyScope);if(!s.signingRootVersion)throw vf(`binding_mismatch`);let c={walletId:String(e.walletId),nearAccountId:String(t.signer.account.nearAccountId),nearEd25519SigningKeyId:String(t.signer.nearEd25519SigningKeyId),thresholdSessionId:String(t.thresholdSessionId),signerSlot:t.signer.signerSlot,rpId:t.auth.rpId,credentialIdB64u:t.auth.credentialIdB64u,signingRootId:s.signingRootId,signingRootVersion:s.signingRootVersion,signingWorkerId:o.routerAbNormalSigning.signingWorkerId},l={kind:`available`,walletId:c.walletId,nearAccountId:c.nearAccountId,signerSlot:c.signerSlot,materialActivation:a.locator.materialActivation},u=await $M({store:K,identity:c,authority:i,publicLocator:l});if(u.kind===`blocked`)throw yf(u.plan.reason);return{prepared:u,localIdentity:c,authority:i,publicLocator:l,facts:{thresholdSessionId:t.thresholdSessionId,signer:t.signer,signingRootId:s.signingRootId,signingRootVersion:s.signingRootVersion,routerAbNormalSigning:o.routerAbNormalSigning,runtimePolicyScope:o.runtimePolicyScope,relayerUrl:e.relayerUrl},participantIds:o.participantIds}}function QM(e){if(e.factor.kind!==B.passkey)throw vf(`binding_mismatch`);return{walletId:String(e.walletId),nearAccountId:String(e.nearAccountId),nearEd25519SigningKeyId:String(e.nearEd25519SigningKeyId),thresholdSessionId:String(e.thresholdSessionId),signerSlot:e.signerSlot,rpId:String(e.factor.rpId),credentialIdB64u:e.factor.credentialIdB64u,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,signingWorkerId:e.routerAbNormalSigning.signingWorkerId}}async function $M(e){try{return await nn(e)}catch{throw vf(`binding_mismatch`)}}async function eN(e){try{return await $e(e)}catch{throw vf(`corrupt`)}}function tN(e){if(!e||e.activeClient.status().kind!==`active`)return{kind:`absent`};let t=Mc(e.activeClient.metadata());return{kind:`live`,runtime:kc(t),materialActivation:t}}function nN(e){return e.laneIdentity===void 0?e.materialIdentity:{kind:`near_ed25519_material_identity`,signer:e.laneIdentity.signer,auth:e.laneIdentity.auth,thresholdSessionId:e.laneIdentity.thresholdSessionId}}function rN(e){return nN(e).auth}function iN(e){return e.auth===void 0?e.materialIdentity.auth:e.auth}function aN(e){return nN(e).signer}function oN(e){return String(nN(e).thresholdSessionId)}function sN(e){if(e.laneIdentity===void 0||e.auth===void 0)throw Error(`[SigningEngine][near] authorized lane identity is required`);return{walletId:e.walletId,nearAccountId:e.nearAccountId,laneIdentity:e.laneIdentity,auth:e.auth}}function cN(e){return{walletId:e.walletId,nearAccountId:e.nearAccountId,materialIdentity:nN(e)}}async function lN(e){if(e.reference.auth.kind!==B.emailOtp)throw Error(`[SigningEngine][near] Email OTP public lane authority is required`);if(!Xc({session:e.authorization.session,materialActivation:e.materialActivation}))throw Error(`[SigningEngine][near] Email OTP Wallet Session material changed`);let t=Cr(e.authorization.session.authorizationId);if(!t.ok||e.authorization.operationCredential.token.trim().length===0)throw Error(`[SigningEngine][near] Email OTP Ed25519 Wallet Session credential is unavailable`);let n=await L({authority:e.authorization.selectedFactorAuthority}),r=e.material.facts,i=Qe({walletId:String(e.reference.walletId),nearAccountId:String(e.reference.nearAccountId),nearEd25519SigningKeyId:String(e.reference.nearEd25519SigningKeyId),walletSessionId:e.authorization.operationCredential.walletSessionId,authorizationId:t.value,quotaId:e.authorization.session.quotaId,thresholdSessionId:e.reference.thresholdSessionId,remainingUses:e.authorization.status.remainingUses,expiresAtMs:e.authorization.status.expiresAtMs,runtimePolicyScope:r.runtimePolicyScope,signingRootId:r.signingRootId,signingRootVersion:r.signingRootVersion,routerAbNormalSigning:r.routerAbNormalSigning,walletSessionToken:e.authorization.operationCredential.token,nowMs:Date.now()});if(!i.ok)throw Error(`[SigningEngine][near] Email OTP Wallet Session is unusable (${i.reason})`);return Mt({walletId:e.reference.walletId,nearAccountId:e.reference.nearAccountId,nearEd25519SigningKeyId:e.reference.nearEd25519SigningKeyId,providerSubjectId:e.reference.auth.providerSubjectId,signerSlot:e.reference.signerSlot,relayerUrl:e.relayerUrl,authority:n,signingWalletSession:i.value})}function uN(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case B.passkey:return t.kind===B.passkey&&e.rpId===t.rpId&&e.credentialIdB64u===t.credentialIdB64u;case B.emailOtp:return t.kind===B.emailOtp&&e.providerSubjectId===t.providerSubjectId;default:throw Error(`[SigningEngine][near] unsupported Ed25519 material authority`)}}function dN(e){let t=e.identity.signer;return String(e.runtime.walletId)===String(t.account.wallet.walletId)&&String(e.runtime.nearAccountId)===String(t.account.nearAccountId)&&String(e.runtime.nearEd25519SigningKeyId)===String(t.nearEd25519SigningKeyId)&&e.runtime.signerSlot===t.signerSlot&&String(e.runtime.thresholdSessionId)===String(e.identity.thresholdSessionId)&&uN(e.runtime.auth,e.identity.auth)}function fN(e){let t=vn(e.publicLane.runtimePolicyScope);if(!t.signingRootVersion)throw Error(`[SigningEngine][near] Email OTP lane requires a signing-root version`);return{thresholdSessionId:e.publicLane.thresholdSessionId,signer:aN(e.input),signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion,routerAbNormalSigning:{kind:Ps,signingWorkerId:String(e.publicLane.materialActivation.signingWorker)},runtimePolicyScope:e.publicLane.runtimePolicyScope,relayerUrl:e.relayerUrl}}function pN(e){let t=rN(e),n=iN(e);if(t.kind!==n.kind)throw Error(`[SigningEngine][near] prepared material factor changed`);switch(n.kind){case B.passkey:if(t.kind!==B.passkey||t.rpId!==n.rpId||t.credentialIdB64u!==n.credentialIdB64u)throw Error(`[SigningEngine][near] prepared Passkey material binding changed`);return;case B.emailOtp:if(t.kind!==B.emailOtp||t.providerSubjectId!==n.providerSubjectId)throw Error(`[SigningEngine][near] prepared Email OTP material binding changed`);return;default:throw Error(`[SigningEngine][near] unsupported Ed25519 material authority`)}}function mN(e){let t=e.material.facts,n=e.material.activeClient.metadata(),r=oN(e.input),i=aN(e.input),a=t.signer;if(String(t.thresholdSessionId)!==r)throw Error(`[SigningEngine][near] active Ed25519 Yao capability session mismatch`);if(n.scope.threshold_session_id!==String(t.thresholdSessionId))throw Error(`[SigningEngine][near] active Ed25519 Yao metadata session mismatch`);if(n.scope.account_id!==String(e.input.walletId)||n.applicationBinding.wallet_id!==String(e.input.walletId))throw Error(`[SigningEngine][near] active Ed25519 Yao capability subject mismatch`);if(String(a.account.wallet.walletId)!==String(i.account.wallet.walletId)||String(a.account.nearAccountId)!==String(i.account.nearAccountId)||a.signerSlot!==i.signerSlot||String(a.nearEd25519SigningKeyId)!==String(i.nearEd25519SigningKeyId))throw Error(`[SigningEngine][near] active Ed25519 Yao capability signer mismatch`);let o=Mc(n);if(!b(e.expectedActivation,o))throw Error(`[SigningEngine][near] active Ed25519 Yao capability activation mismatch`);return e.material}async function hN(e){let t=Mc(e.material.activeClient.metadata());if(!Xc({session:e.authorization.session,materialActivation:t}))throw Error(`Owner Ed25519 execution-lane material changed`);let n=e.authorization.operationCredential.token,r=mN({material:e.material,input:e.input,expectedActivation:t}),i=await on({runtime:e.sealedRuntime,walletAuthMethodId:e.authorization.selectedAuthMethod.walletAuthMethodId}),a=await L({authority:e.authorization.selectedFactorAuthority});if(i.walletId!==a.walletId||i.walletAuthMethodId!==a.walletAuthMethodId||i.authorityDigest!==a.authorityDigest)throw Error(`Owner Ed25519 execution-lane authority does not match sealed material`);let o=tN(r);if(o.kind!==`live`)throw Error(`Owner Ed25519 execution-lane preflight requires active Yao material`);let s={publicLocator:{kind:`available`,walletId:String(r.facts.signer.account.wallet.walletId),nearAccountId:String(r.facts.signer.account.nearAccountId),signerSlot:r.facts.signer.signerSlot,materialActivation:t,authority:i},sealed:{kind:`missing`},runtime:o,unlockSource:{kind:`unavailable`}};return gN({projection:await Gm({relayerUrl:r.facts.relayerUrl,walletSessionToken:n,curve:`ed25519`,expectedMaterialActivation:t}),material:r,hydration:s})}function gN(e){let t=oh({walletKey:e.projection.walletKey,lane:e.projection.lane,material:{keyFamily:`ed25519`,laneShareEpoch:e.projection.lane.laneShareEpoch,metadata:e.material.activeClient.metadata(),hydration:e.hydration}});if(t.kind!==`active_wallet_execution_lane_v1`)throw Error(`Owner Ed25519 execution lane is ${t.reason}`);if(!b(t.materialActivation,e.projection.materialActivation)||t.activationReceiptDigestB64u!==String(e.projection.verifiedActivationReceiptDigestB64u))throw Error(`Owner Ed25519 execution-lane projection activation changed`);return t}function _N(e){let t=e.hydration.materialActivation;if(!t)throw Error(`[SigningEngine][near] prepared material has no activation`);return t}function vN(e){let t=_N(e.preparation);if(!e.context.materialActivation||!b(e.context.materialActivation,t))throw Error(`[SigningEngine][near] prepared material boundary changed activation`);return t}function yN(e){return cc({credential:e,firstPrfOutput:!0,secondPrfOutput:!0})}async function bN(e,t){return e.current?await e.current.storage.loadEcdsaRoleLocalReadyRecord(t):{ok:!1,code:`unavailable`,message:`Signing runtime storage is not initialized`}}function xN(e){let t=e.event;switch(t){case`signing_session.expired`:return`${String(e.walletId)}:${String(e.walletSessionId)}`;case`registration.near_provisioning_changed`:return`${String(e.walletId)}:${e.state.status}:${e.state.updatedAtMs}`;default:return SN(t)}}function SN(e){throw Error(`Unsupported SDK lifecycle event: ${String(e)}`)}async function CN(e){if(!K.isDisabled())return await K.getAppState(e)}async function wN(e,t){K.isDisabled()||await K.setAppState(e,t)}const TN={readCacheEntry:CN,writeCacheEntry:wN};var EN=class{readExactNearEd25519WalletSessionAuthorization(e){return fk(String(this.seamsWebConfigs.network.relayer?.url||``).trim(),new wt,e)}resolveActiveNearEd25519WalletSessionAuthorization(e){return pk(e,String(this.seamsWebConfigs.network.relayer?.url||``).trim())}constructor(e,t,n){this.workerBaseOrigin=``,this.thresholdEcdsaBootstrapQueueByWallet=new Map,this.thresholdEcdsaSigningQueueByKey=new Map,this.thresholdEd25519CommitQueueByKey=new Map,this.nearEd25519CapabilityRehydrationBySubject=new Map,this.hostWarmCriticalResourcesTask=null,this.sealedRefreshStartupParityError=null,this.sdkLifecycleEventListeners=new Set,this.deliveredSdkLifecycleEventKeys=new Set,this.walletAuthenticationState={kind:`signed_out`},this.walletAuthenticationRestoreGeneration=0,this.volatileWarmSigningMaterialCleanupInFlight=null,this.requestWorkerOperation=e=>this.signerWorkerManager.getContext().requestWorkerOperation(e),Pt(TN),this.seamsWebConfigs=e,this.ed25519YaoPublicCapabilityReferences=n.ed25519YaoPublicCapabilityReferences,this.appearance=e.ui.appearance,this.nearClient=t,this.ecdsaBootstrapStore=n.signingEngineStores.walletProfileAndSignerRecords.ecdsaBootstrapStore,this.sealedRefreshStartupParityPromise=Kw({configs:this.seamsWebConfigs}).catch(e=>{this.sealedRefreshStartupParityError=e instanceof Error?e:Error(String(e||`sealed refresh parity check failed`))});let r={current:null},i=bN.bind(null,r),a=Nw({resolveActiveEcdsaCapabilityRuntime:Mk,resolveOperationStepUpCredential:this.resolveOperationStepUpCredential.bind(this),stores:n.managerStores,seamsWebConfigs:this.seamsWebConfigs,nearClient:this.nearClient,loadEcdsaRoleLocalReadyRecord:i,getTheme:()=>this.appearance.theme.mode,getAppearance:()=>this.appearance,thresholdEcdsaSigningQueueByKey:this.thresholdEcdsaSigningQueueByKey});this.touchIdPrompt=a.touchIdPrompt,this.userPreferencesManager=a.userPreferencesManager,this.nonceCoordinator=a.nonceCoordinator,this.signerWorkerManager=a.signerWorkerManager;let o=n.createRuntime({config:this.seamsWebConfigs,workerCtx:this.signerWorkerManager.getContext(),accountLifecycle:{accountStore:n.signingEngineStores.walletProfileAndSignerRecords.accountStore,userPreferencesManager:this.userPreferencesManager,nonceCoordinator:this.nonceCoordinator},ecdsaBootstrapStore:this.ecdsaBootstrapStore,getWarmSessionMaterialWriter:()=>this.passkeyMpcSession,getNearSigningDeps:()=>this.enginePorts.nearSigningDeps,getEvmFamilySigningDeps:()=>this.enginePorts.tempoSigningDeps});r.current=o.runtimePorts;let s=o.state.ecdsaSessions;this.runtimePorts=o.runtimePorts;let c=Yj({seamsWebConfigs:this.seamsWebConfigs,touchIdPrompt:this.touchIdPrompt,signerWorkerManager:this.signerWorkerManager,stores:n.signingEngineStores,runtimePorts:this.runtimePorts,sealedSigningSessionStore:n.sealedSigningSessionStore,baseTouchConfirm:a.touchConfirm,passkeyMpcSession:a.passkeyMpcSession,getEnginePorts:()=>this.enginePorts,thresholdEcdsaBootstrapQueueByWallet:this.thresholdEcdsaBootstrapQueueByWallet,thresholdEcdsaSigningQueueByKey:this.thresholdEcdsaSigningQueueByKey,loadWalletCustodyEd25519Material:this.loadEmailOtpWalletCustodyEd25519Material.bind(this),restoreWalletCustodyEcdsaContinuity:this.restoreWalletCustodyEcdsaContinuity.bind(this),getWarmSigning:()=>this.warmSigning,ensureSealedRefreshStartupParity:()=>this.ensureSealedRefreshStartupParity(),listActiveEcdsaCapabilityManifestsForWallet:Ak});this.emailOtpSessions=c.emailOtpSessions,this.touchConfirm=c.touchConfirm,this.passkeyMpcSession=c.passkeyMpcSession,this.warmSigning=WD({resolveActiveEcdsaCapabilityRuntime:Mk,resolveActiveEcdsaCapabilityRuntimeForChain:Nk,touchConfirm:this.touchConfirm,passkeyMpcSession:this.passkeyMpcSession,getEmailOtpWarmSessionStatus:e=>this.emailOtpSessions.readWarmSessionStatusOnly(e),signingSessionSeal:this.seamsWebConfigs.signing.sessionSeal,ecdsaExportArtifacts:s,resolveActiveEcdsaWalletSessionAuthorization:bk({seamsWebConfigs:this.seamsWebConfigs,touchIdPrompt:this.touchIdPrompt,stores:n.signingEngineStores,emailOtpSessions:this.emailOtpSessions,sealedSigningSessionStore:n.sealedSigningSessionStore}),resolveActiveEd25519WalletSessionAuthorization:this.resolveActiveNearEd25519WalletSessionAuthorization.bind(this)}),this.listPreprocessingCapabilities=yk.bind(null,{seamsWebConfigs:this.seamsWebConfigs,touchIdPrompt:this.touchIdPrompt,stores:n.signingEngineStores,emailOtpSessions:this.emailOtpSessions,sealedSigningSessionStore:n.sealedSigningSessionStore}),this.sessionPublicDeps=lO({seamsWebConfigs:this.seamsWebConfigs,touchConfirm:this.touchConfirm,passkeyMpcSession:this.passkeyMpcSession,emailOtpSessions:this.emailOtpSessions,ed25519YaoPublicCapabilityLanes:n.ed25519YaoPublicCapabilityReferences,isEd25519YaoPublicCapabilityActive:this.isEd25519YaoPublicCapabilityActive.bind(this),readActiveWalletSessionAuthorization:fk.bind(null,this.seamsWebConfigs.network.relayer.url),listEcdsaSigningCapabilitiesForWallet:(e,t)=>Dk({seamsWebConfigs:this.seamsWebConfigs,touchIdPrompt:this.touchIdPrompt,stores:n.signingEngineStores,emailOtpSessions:this.emailOtpSessions,sealedSigningSessionStore:n.sealedSigningSessionStore},e,t),getWalletSessionStatus:ok({seamsWebConfigs:this.seamsWebConfigs,touchIdPrompt:this.touchIdPrompt,stores:n.signingEngineStores,emailOtpSessions:this.emailOtpSessions,sealedSigningSessionStore:n.sealedSigningSessionStore})}),this.emailOtpPublicDeps={relayerUrl:this.seamsWebConfigs.network.relayer?.url||``,groupId:Ns,signingSessionAuthorityPorts:{resolveActiveEcdsaCapabilityRuntime:Mk,factorStores:SM,resolveSelectedWalletAuthority:K.resolveSelectedWalletAuthority.bind(K),readExactWalletSessionAuthorization:G.readExactWithOperationCredential.bind(G)},getSignerWorkerContext:()=>this.enginePorts.walletSessionActivationDeps.getSignerWorkerContext(),withThresholdEcdsaSigningQueue:e=>pf({queueByKey:this.thresholdEcdsaSigningQueueByKey,...e}),emailOtpSessions:this.emailOtpSessions},this.recoveryPublicDeps=Bk({seamsWebConfigs:this.seamsWebConfigs,runtimePorts:this.runtimePorts,signerWorkerManager:this.signerWorkerManager,warmSigning:this.warmSigning,touchConfirm:this.touchConfirm,passkeyMpcSession:this.passkeyMpcSession,passkeyMpcExport:a.passkeyMpcExport,emailOtpSessions:this.emailOtpSessions,thresholdEcdsaBootstrapQueueByWallet:this.thresholdEcdsaBootstrapQueueByWallet,thresholdEcdsaSigningQueueByKey:this.thresholdEcdsaSigningQueueByKey,thresholdEd25519CommitQueueByKey:this.thresholdEd25519CommitQueueByKey,getWalletSessionActivationDeps:()=>this.enginePorts.walletSessionActivationDeps,resolvePasskeyEd25519YaoExportContext:this.resolveExactPasskeyEd25519YaoExportContext.bind(this),resolveEmailOtpEd25519YaoExportContext:this.resolveEmailOtpEd25519YaoExportContext.bind(this),getSigningSessionCoordinator:()=>this.enginePorts.signingSessionCoordinator,getTheme:()=>this.appearance.theme.mode,ed25519YaoPublicCapabilityLanes:n.ed25519YaoPublicCapabilityReferences,isEd25519YaoPublicCapabilityActive:this.isEd25519YaoPublicCapabilityActive.bind(this),readActiveWalletSessionAuthorization:fk.bind(null,this.seamsWebConfigs.network.relayer.url),listEcdsaSigningCapabilitiesForWallet:(e,t)=>Dk({seamsWebConfigs:this.seamsWebConfigs,touchIdPrompt:this.touchIdPrompt,stores:n.signingEngineStores,emailOtpSessions:this.emailOtpSessions,sealedSigningSessionStore:n.sealedSigningSessionStore},e,t),resolveOwnerLaneScope:e=>this.resolveSelectedOwnerLaneScope(e)}),this.enginePorts=Fk({runtimePorts:this.runtimePorts,stores:n.signingEngineStores,ed25519YaoPublicCapabilityReferences:n.ed25519YaoPublicCapabilityReferences,seamsWebConfigs:this.seamsWebConfigs,nearClient:this.nearClient,touchIdPrompt:this.touchIdPrompt,userPreferencesManager:this.userPreferencesManager,nonceCoordinator:this.nonceCoordinator,touchConfirm:this.touchConfirm,passkeyMpcSession:this.passkeyMpcSession,passkeyMpcExport:a.passkeyMpcExport,signerWorkerManager:this.signerWorkerManager,emailOtpSessions:this.emailOtpSessions,warmSigning:this.warmSigning,sealedSigningSessionStore:n.sealedSigningSessionStore,ecdsaBootstrapStore:this.ecdsaBootstrapStore,thresholdEcdsaBootstrapQueueByWallet:this.thresholdEcdsaBootstrapQueueByWallet,thresholdEcdsaSigningQueueByKey:this.thresholdEcdsaSigningQueueByKey,thresholdEd25519CommitQueueByKey:this.thresholdEd25519CommitQueueByKey,getWorkerBaseOrigin:()=>this.workerBaseOrigin,workerWarmupPolicy:n.workerWarmupPolicy,getTheme:()=>this.appearance.theme.mode,ensureSealedRefreshStartupParity:()=>this.ensureSealedRefreshStartupParity(),resolveOwnerLaneScope:e=>this.resolveSelectedOwnerLaneScope(e),getEnginePorts:()=>this.enginePorts,getRegistrationPublicDeps:()=>this.registrationPublicDeps,prepareNearEd25519YaoMaterialBoundary:this.prepareExactNearEd25519YaoMaterialBoundary.bind(this)}),this.signingSessionLifecycleSubscription=this.enginePorts.signingSessionCoordinator.subscribeLifecycle(this.publishSdkLifecycleEvent.bind(this)),this.nearProvisioningUnsubscribe=ye(this.publishNearProvisioningLifecycleEvent.bind(this)),this.ed25519YaoPageLifecycleOwner=new up(typeof window>`u`?null:window,this.enginePorts.ed25519YaoActiveClients);let l=Xj({seamsWebConfigs:this.seamsWebConfigs,stores:n.signingEngineStores,touchIdPrompt:this.touchIdPrompt,touchConfirm:this.touchConfirm,passkeyMpcSession:this.passkeyMpcSession,warmSigning:this.warmSigning,runtimePorts:this.runtimePorts,thresholdEcdsaBootstrapQueueByWallet:this.thresholdEcdsaBootstrapQueueByWallet,ensureSealedRefreshStartupParity:()=>this.ensureSealedRefreshStartupParity(),enginePorts:this.enginePorts});this.passkeyPublicDeps=l.passkeyPublicDeps,this.warmCapabilitiesPublicDeps=l.warmCapabilitiesPublicDeps,this.registrationPublicDeps={accountLifecycle:this.enginePorts.registrationAccountLifecycleDeps,session:this.enginePorts.registrationSessionDeps},ht(e=>{this.persistUpgradedWalletCustodyEnvelopeV1(e)}),n.initializeRuntime({config:this.seamsWebConfigs,userPreferencesManager:this.userPreferencesManager,getWorkerBaseOrigin:()=>this.workerBaseOrigin,setWorkerBaseOrigin:e=>{this.workerBaseOrigin=e,this.signerWorkerManager.setWorkerBaseOrigin(e),this.touchConfirm.setWorkerBaseOrigin?.(e),a.passkeyMpcExport.setWorkerBaseOrigin(e),this.passkeyMpcSession.setWorkerBaseOrigin(e)}})}async resolveOperationStepUpCredential(e){return{kind:`wallet_session_opaque`,walletSessionToken:(await YM({walletId:e.walletId,proof:e.proof})).token}}async ensureSealedRefreshStartupParity(){if(await this.sealedRefreshStartupParityPromise,this.sealedRefreshStartupParityError)throw this.sealedRefreshStartupParityError}async establishWalletCustodyNearEd25519KeySet(e){let t=new ut({routerOrigin:e.routerOrigin,authorization:{kind:`bearer`,value:e.authorization},fetch:globalThis.fetch,...e.traceContext?{traceContext:e.traceContext}:{}}),n=null,r=await Nt({runStep:yt(this.walletCustodyCeremonyTransportV1()),walletId:e.walletId,factorJson:e.factorJson,factorSecret:e.factorSecret,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,registrationCeremonyId:e.registrationCeremonyId,yaoAdmission:e.admissionReceipt,yaoApplication:e.admissionRequest.application_binding,participantIds:e.participantIds,runRouterRound:async e=>{let r=await t.send({kind:`execute`,path:ia,body:JSON.parse(e)});if(!r.ok)throw Error(`Router Ed25519 Yao execute failed: ${r.message}`);return n=JSON.stringify(r.value),n}});if(!n)throw Error(`the wallet custody NEAR run completed without a Router activation result`);if(!r.localMaterial)throw Error(`the wallet custody NEAR run sealed no local material`);return{recoveryCodes:r.recoveryCodes,commitPayload:r.commitPayload,activationReference:r.activationReference,localMaterial:r.localMaterial,metadata:dp({admissionRequest:e.admissionRequest,activationResultJson:n})}}async recoverWalletCustodyManifest(e){return await Np({...e,runStep:yt(this.walletCustodyCeremonyTransportV1()),workerCtx:this.signerWorkerManager.getContext()})}async createWalletRecoveryReplacementCredential(e){let t=se(`wallet-recovery:${e.registration.challengeId}`),n=mM(yN(await this.touchIdPrompt.generateRegistrationCredentialsInternal({kind:`wallet_recovery`,walletId:e.walletId,intendedUserName:e.walletId,recoveryRegistration:e.registration,prompt:{kind:`immediate`,requestId:t,cancellation:e.cancellation}})));return{registration:fc(n.registration),credentialIdB64u:n.credentialIdB64u,factorSecret:n.factorSecret}}async joinWalletCustodyNearEd25519KeySet(e){let t=new ut({routerOrigin:e.routerOrigin,authorization:{kind:`bearer`,value:e.authorization},fetch:globalThis.fetch,...e.traceContext?{traceContext:e.traceContext}:{}}),n=null,r=await Ut({runStep:yt(this.walletCustodyCeremonyTransportV1()),preparation:e.preparation,beforeRouterRound:e.beforeRouterRound,custodyJson:e.custodyJson,factorSecret:e.factorSecret,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,registrationCeremonyId:e.registrationCeremonyId,yaoAdmission:e.admissionReceipt,yaoApplication:e.admissionRequest.application_binding,participantIds:e.participantIds,runRouterRound:async e=>{let r=await t.send({kind:`execute`,path:ia,body:JSON.parse(e)});if(!r.ok)throw Error(`Router Ed25519 Yao execute failed: ${r.message}`);return n=JSON.stringify(r.value),n}});if(!n||!r.localMaterial)throw Error(`the wallet custody NEAR join produced no local signing material`);return{commitPayload:r.commitPayload,activationReference:r.activationReference,localMaterial:r.localMaterial,metadata:dp({admissionRequest:e.admissionRequest,activationResultJson:n})}}async rejoinWalletCustodyNearEd25519KeySet(e){let t=new ut({routerOrigin:e.routerOrigin,authorization:{kind:`bearer`,value:`Bearer ${e.walletSessionToken}`},fetch:globalThis.fetch}),n=await _p({basis:e.recoveryBasis}),r=await vp({request:n,transport:t}),i=await $t({runStep:yt(this.walletCustodyCeremonyTransportV1()),walletId:e.walletId,custodyJson:e.custodyJson,factorSecret:e.factorSecret,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,recoveryLifecycleId:n.scope.lifecycle_id,yaoAdmission:r.receipt,yaoApplication:r.request.application_binding,participantIds:e.recoveryBasis.participantIds,registeredPublicKeyB64u:F(Uint8Array.from(e.recoveryBasis.registeredPublicKey)),runRouterRound:e=>yp({executeRequestJson:e,transport:t}),activateRouterRecovery:e=>bp({request:n,protocolResultJson:e,transport:t})});if(!i.localMaterial)throw Error(`the wallet custody NEAR cold rejoin produced no local signing material`);return{commitPayload:i.commitPayload,activationReference:i.activationReference,localMaterial:i.localMaterial,metadata:fp({admissionRequest:n,activationResultJson:i.activationResultJson,activationReceipt:i.activationReceipt})}}async establishWalletCustodyEvmFamilyKeySet(e){return await Jt({...e,runStep:yt(this.walletCustodyCeremonyTransportV1())})}async joinWalletCustodyEvmFamilyKeySet(e){return await vt({...e,runStep:yt(this.walletCustodyCeremonyTransportV1())})}async rejoinWalletCustodyEvmFamilyKeySet(e){return await zt({...e,runStep:yt(this.walletCustodyCeremonyTransportV1())})}async restoreWalletCustodyEcdsaContinuity(e){let t=await Cs({...e,store:new gs});if(t.kind!==`committed`)throw Error(`wallet custody ECDSA import returned ${t.kind}`);let n=Xn(e.publicCapability.material_activation),r=await Td({workerCtx:this.signerWorkerManager.getContext(),authority:e.authority,materialActivation:n});if(!r.ok)throw Error(`wallet custody ECDSA material open returned ${r.reason}`);return{materialActivation:n,materialRef:r.materialRef}}async persistWalletCustodyEd25519Material(e){await ws({store:this.signerWorkerManager.getContext().nearKeyMaterialStore,binding:e.binding,sealed:e.sealed})}async loadWalletCustodyEd25519Material(e){return await ps({store:this.signerWorkerManager.getContext().nearKeyMaterialStore,nearAccountId:e.nearAccountId,signerSlot:e.signerSlot,expectedRegisteredPublicKeyB64u:e.expectedRegisteredPublicKeyB64u})}async loadEmailOtpWalletCustodyEd25519Material(e){let t=await this.loadWalletCustodyEd25519Material({nearAccountId:e.nearAccountId,signerSlot:e.signerSlot,expectedRegisteredPublicKeyB64u:``});return t.kind===`found`?t:{kind:`absent`}}async deleteWalletCustodyEd25519Material(e){await vs({store:this.signerWorkerManager.getContext().nearKeyMaterialStore,nearAccountId:e.nearAccountId,signerSlot:e.signerSlot})}async assertSealedRefreshStartupParity(){await this.ensureSealedRefreshStartupParity()}async discoverPersistedSessionsForWallet(e){return await QT(this.sessionPublicDeps,e)}isEd25519YaoPublicCapabilityActive(e){switch(e.auth.kind){case B.emailOtp:return!0;case B.passkey:return this.enginePorts.ed25519YaoActiveClients.resolve({walletId:e.walletId,nearAccountId:e.nearAccountId,materialActivation:e.materialActivation})!==null;default:throw e.auth,Error(`Unsupported Ed25519 public capability auth method`)}}async readPersistedAvailableSigningLanes(e){return await $T(this.sessionPublicDeps,e)}async readOwnerScopedSigningLanes(e,t){return await eE(this.sessionPublicDeps,e,t)}async resolveSelectedOwnerLaneScope(e){let t=o(e);if(!t.ok)throw Error(t.error.message);let n={getWalletAuthMethodV2:e=>K.getWalletAuthMethodV2(e),listWalletAuthMethodsForWallet:e=>K.listWalletAuthMethodsForWallet(e),getWalletPasskeyAuthenticator:e=>K.getWalletPasskeyAuthenticator(e),readEmailOtpProviderSubjectForWallet:e=>_s(K,e)},r=await K.resolveSelectedWalletAuthority(String(t.value));if(r.kind===`resolved`){let{selection:e,authMethod:i,authority:a}=r;if(e.walletId!==t.value||e.walletAuthMethodId!==i.walletAuthMethodId||i.walletId!==t.value||i.walletAuthorityId!==a.authorityId||a.walletId!==t.value)throw Error(`[SigningEngine] selected Wallet Authority identity mismatch`);if(e.lockState!==`unlocked`)throw _f(`wallet_locked`);if(i.status!==`active`)throw _f(`method_unavailable`);if(a.state!==`active`)throw _f(`authority_unavailable`);if(a.provenance.kind===`device_link`&&i.kind===`passkey`&&a.signerActivations.ed25519)return Vd({authMethod:i,signerSlot:await zM({walletId:t.value,authMethod:i,signerMaterials:r.signerMaterials,publicLaneStore:this.ed25519YaoPublicCapabilityReferences})});if(a.provenance.kind===`device_link`&&i.kind===`passkey`&&a.signerActivations.ecdsa)return Kd({authMethod:i});if(a.provenance.kind===`device_link`&&i.kind===`email_otp`&&a.signerActivations.ecdsa){let e=Ud({walletId:t.value,materialActivation:a.signerActivations.ecdsa.materialActivation});if(!e||e.authorityId!==a.authorityId||!$n(e.factorAuthority))throw Error(`[SigningEngine] selected linked Email OTP authority has no exact ECDSA holder runtime`);let n=await L({authority:e.factorAuthority});if(n.walletId!==t.value||n.walletAuthMethodId!==i.walletAuthMethodId)throw Error(`[SigningEngine] selected linked Email OTP authority has no exact ECDSA holder runtime`);return ff({authMethod:i,factorAuthority:e.factorAuthority,authorityRef:n})}return await df({authMethod:i,stores:n})}let i=r.kind===`integrity_error`?`: ${r.reason}`:``;throw Error(`[SigningEngine] selected Wallet Authority is ${r.kind}${i}`)}readWalletAuthenticationState(){return this.walletAuthenticationState}async retireActiveWalletSessionAuthorizationForLock(e){let t=Date.now();(await G.retireExactActiveForWallet({walletId:e,reason:`wallet_locked`,retiredAtMs:t})).length>0&&this.destroyUnlockedWalletEd25519ExportRootCapabilitiesV1({kind:`wallet`,walletId:String(e)})}async advanceWalletLockGeneration(e){return K.advanceWalletLockGeneration({walletId:e,lockedAtMs:Date.now()})}async markWalletSelectionUnlocked(e){await K.markWalletSelectionUnlocked({walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId,unlockedAtMs:Date.now()})}async markSelectedEmailOtpWalletAuthorityUnlocked(e){await this.markWalletSelectionUnlocked(e)}applyAuthenticatedWalletState(e){this.walletAuthenticationState=e,this.userPreferencesManager.setCurrentWallet(e.walletId)}setWalletAuthenticated(e){let t=this.walletAuthenticationState;t.kind===`authenticated`&&String(t.walletId)!==String(e.walletId)&&this.destroyUnlockedWalletEd25519ExportRootCapabilitiesV1({kind:`wallet`,walletId:String(t.walletId)}),this.walletAuthenticationRestoreGeneration+=1,this.applyAuthenticatedWalletState(e)}clearWalletAuthentication(){this.walletAuthenticationRestoreGeneration+=1,this.walletAuthenticationState={kind:`signed_out`},this.destroyUnlockedWalletEd25519ExportRootCapabilitiesV1({kind:`all`})}clearWalletAuthenticationIfCurrent(e){return this.walletAuthenticationState===e?(this.clearWalletAuthentication(),!0):!1}walletCustodyCeremonyTransportV1(){let e=this.getSignerWorkerContext();return{requestOperation:sn.bind(void 0,e)}}async establishUnlockedWalletEd25519ExportRootCapabilityV1(e){try{let t=e.existingEnvelope.binding;if(!ni(t)&&t.kind!==`ed25519_yao_client_root_v1`)return;if(e.existingEnvelope.factor.kind!==`passkey`)throw Error(`unlocked export-root capability requires a passkey envelope factor`);let n=I(e.passkeyPrfFirstB64u);try{await Bt(this.walletCustodyCeremonyTransportV1(),{existingEnvelope:e.existingEnvelope,existingFactorSecret:n,walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId,walletSessionId:e.walletSessionId,expiresAtMs:e.expiresAtMs})}finally{n.fill(0)}}catch(e){console.warn(`[BrowserSigningSurface] unlocked Ed25519 export-root capability was not established:`,e instanceof Error?e.message:String(e||`unknown error`))}}async persistUpgradedWalletCustodyEnvelopeV1(e){try{let t=String(this.seamsWebConfigs.network.relayer?.url||``).trim();if(!t)return;let n=o(e.walletId);if(!n.ok)return;let r=(await hM(n.value,t))?.operationCredential.token;if(!r)return;let i=await Qj({relayUrl:t,walletId:e.walletId,walletSessionToken:String(r),envelope:e.envelope});if(i.kind===`upgraded`||i.kind===`already_owned`)return;console.warn(`[BrowserSigningSurface] the upgraded custody envelope was not stored:`,i.message)}catch(e){console.warn(`[BrowserSigningSurface] the upgraded custody envelope was not stored:`,e instanceof Error?e.message:String(e||`unknown error`))}}async destroyUnlockedWalletEd25519ExportRootCapabilitiesV1(e){await Dt(this.walletCustodyCeremonyTransportV1(),e)}async runWarmCriticalResources(e){try{await this.ensureSealedRefreshStartupParity()}catch(e){if(!Pd(e))throw e;console.warn(`[BrowserSigningSurface] warmCriticalResources skipped retryable sealed-refresh capability fetch failure`,e instanceof Error?e.message:String(e||`unknown error`))}return await this.enginePorts.getManagerConveniencePorts().warmCriticalResources(e)}async warmCriticalResources(e){if(Xl()&&e===void 0){let e=this.hostWarmCriticalResourcesTask;if(e)return await e;let t=this.runWarmCriticalResources();return this.hostWarmCriticalResourcesTask=t,t.catch(()=>{this.hostWarmCriticalResourcesTask===t&&(this.hostWarmCriticalResourcesTask=null)}),await t}return await this.runWarmCriticalResources(e)}async prewarmEmailOtpYao(e){return await this.signerWorkerManager.prewarmEmailOtpYao(e)}async prewarmEcdsaRegistrationCrypto(){return await this.signerWorkerManager.prewarmEcdsaRegistrationCrypto()}getRpId(){return this.touchIdPrompt.getRpId()}getSignerWorkerContext(){return this.enginePorts.walletSessionActivationDeps.getSignerWorkerContext()}getNonceCoordinator(){return this.nonceCoordinator}setAppearance(e){this.appearance=e}setWalletIframeSurfaceMeasurementBinding(e){this.touchConfirm.getContext().surfaceMeasurementBinding=e}getWalletIframeSurfaceMeasurementBinding(){return this.touchConfirm.getContext().surfaceMeasurementBinding}getUserPreferences(){return this.userPreferencesManager}async signNear(e){let t=e.args.commandSubject.walletSession.walletId;try{return await Rl(this.enginePorts.nearSigningDeps,e)}catch(e){throw bf(e)&&await this.terminateWalletStateAfterSigningFailure(t),e}}async terminateWalletStateAfterSigningFailure(e){let t=this.readWalletAuthenticationState(),n=!1;try{await this.advanceWalletLockGeneration(e)}catch{}try{await this.retireActiveWalletSessionAuthorizationForLock(e)}catch{}try{n=this.clearWalletAuthenticationIfCurrent(t)}catch{}if(n){try{this.nonceCoordinator.clearAll()}catch{}try{this.clearThresholdEcdsaSigningQueue()}catch{}}try{await this.clearVolatileWarmSigningMaterial(e)}catch{}}async ensureNearEd25519YaoCapabilityForSigning(e){let t=mT(e),n=this.nearEd25519CapabilityRehydrationBySubject.get(t);if(n){let e=await n,t=await this.resolveActiveNearEd25519YaoSigningLane(e.subject);if(t)return t;throw Error(`[SigningEngine][near] joined rehydration did not publish an active lane`)}let r=this.rehydrateNearEd25519YaoCapabilityForSigning(e);this.nearEd25519CapabilityRehydrationBySubject.set(t,r);try{return(await r).material}finally{this.nearEd25519CapabilityRehydrationBySubject.get(t)===r&&this.nearEd25519CapabilityRehydrationBySubject.delete(t)}}async rehydrateExactPasskeyEd25519YaoCapabilityForSigning(e){let t=nN(e);return await this.ensureNearEd25519YaoCapabilityForSigning(e.laneIdentity===void 0?{kind:`material_identity`,materialIdentity:t}:{kind:`exact_lane`,laneIdentity:e.laneIdentity})}async prepareMaterialIdentityNearEd25519YaoSigning(e){let t=e.materialIdentity,n=this.enginePorts.ed25519YaoActiveClients.resolveForWalletAccount({walletId:t.signer.account.wallet.walletId,nearAccountId:t.signer.account.nearAccountId}),r=await FM({store:this.ed25519YaoPublicCapabilityReferences,identity:t}),i=t.auth.kind===B.passkey?await this.readExactNearEd25519WalletSessionAuthorization(e.walletId):null,a=i?nl(i):null;if(t.auth.kind===B.passkey&&r){let e=this.enginePorts.ed25519YaoActiveClients.resolve({walletId:t.signer.account.wallet.walletId,nearAccountId:t.signer.account.nearAccountId,materialActivation:r}),n=tN(e);if(e&&n.kind===`live`){if(a?.kind===`authorized`){let e=a.authorization;if(e.selectedAuthMethod.kind!==B.passkey)throw Error(`[SigningEngine][near] active Wallet Session method is unavailable`);return await ol({hydration:Ac({authority:await L({authority:e.selectedFactorAuthority}),runtime:n.runtime,materialActivation:r}),requirement:t.auth,authorization:e})}if(a?.kind!==`operation_step_up`)throw a?.kind===`full_login_required`?_f(a.reason):Error(`[SigningEngine][near] Wallet Session status is temporarily unavailable`)}}if(a?.kind===`full_login_required`)throw _f(a.reason);if(a?.kind===`temporarily_unavailable`)throw Error(`[SigningEngine][near] Wallet Session persistence is temporarily unavailable`);if(t.auth.kind===B.passkey&&a?.kind===`operation_step_up`)return il({hydration:(await ZM({walletId:e.walletId,identity:t,relayerUrl:this.seamsWebConfigs.network.relayer.url})).prepared.plan,requirement:t.auth});let o=t.auth.kind===B.passkey?await qM({walletId:e.walletId,identity:t}):null,s=o?.sealedRecord.ed25519Restore.materialActivation??(n?Mc(n.activeClient.metadata()):r);if(!s)throw vf(`missing_capability`);let c=tN(this.enginePorts.ed25519YaoActiveClients.resolve({walletId:t.signer.account.wallet.walletId,nearAccountId:t.signer.account.nearAccountId,materialActivation:s})),l;switch(t.auth.kind){case B.passkey:{if(!o)throw vf(`missing_runtime`);if(a?.kind!==`authorized`)throw Error(`[SigningEngine][near] exact Passkey authorization is unavailable`);let n={kind:`found`,authorization:a.authorization},r=await tn({runtime:o,authorization:a.authorization,nowMs:Date.now()}),i=await this.ensurePasskeyEd25519WarmSessionForSigning({runtime:o,walletSessionState:r,materialActivation:s}),u;try{u=await uk({walletId:e.walletId,runtime:o,authorizationRead:n})}catch{throw vf(`binding_mismatch`)}let d=QM(o),f=await tt({store:K,walletId:String(t.signer.account.wallet.walletId),nearAccountId:String(t.signer.account.nearAccountId),nearEd25519SigningKeyId:String(t.signer.nearEd25519SigningKeyId),signerSlot:t.signer.signerSlot,rpId:t.auth.rpId,credentialIdB64u:t.auth.credentialIdB64u,authority:u}),p={kind:`available`,walletId:String(t.signer.account.wallet.walletId),nearAccountId:String(t.signer.account.nearAccountId),signerSlot:t.signer.signerSlot,materialActivation:s,authority:u};l=jc({publicLocator:p,sealed:f.kind===`available`?{kind:`available`,authority:f.locator.authority,materialActivation:f.locator.materialActivation,sealedMaterial:f.locator.sealedMaterial}:{kind:`missing`},runtime:c,unlockSource:i.ok?{kind:`available`,authority:u}:{kind:`unavailable`}}),l.kind===`blocked`&&l.reason===`missing_material`&&(l=(await $M({store:K,identity:d,authority:u,publicLocator:p})).plan);break}case B.emailOtp:l=await this.resolveWalletCustodyEmailOtpHydration({walletId:e.walletId,nearAccountId:e.nearAccountId,identity:EM(t),signerSlot:t.signer.signerSlot,materialActivation:s});break;default:throw t.auth,Error(`[SigningEngine][near] unsupported Ed25519 material authority`)}if(l.kind===`blocked`)throw l.reason===`persistence_unavailable`?Error(`[SigningEngine][near] signing material persistence is unavailable`):yf(l.reason);return il({hydration:l,requirement:t.auth})}async resolveWalletCustodyEmailOtpHydration(e){let t=this.enginePorts.ed25519YaoActiveClients.resolve({walletId:e.walletId,nearAccountId:e.nearAccountId,materialActivation:e.materialActivation}),n=await this.readExactNearEd25519WalletSessionAuthorization(e.walletId),r;if(n.kind===`found`){if(n.authorization.selectedAuthMethod.kind!==B.emailOtp)return Tc({capability:e.materialActivation.capability,reason:`missing_material`});if(r=await L({authority:n.authorization.selectedFactorAuthority}),t)return Ac({authority:r,runtime:kc(e.materialActivation),materialActivation:e.materialActivation})}else if(n.kind===`exhausted`){let n=await DM({walletId:e.walletId,nearAccountId:e.nearAccountId,identity:e.identity,signerSlot:e.signerSlot,materialActivation:e.materialActivation,authorizationRead:{kind:`exhausted`}});if(!n)return Tc({capability:e.materialActivation.capability,reason:`missing_material`});if(r=n,t)try{mN({material:t,input:{walletId:e.walletId,nearAccountId:e.nearAccountId,materialIdentity:e.identity},expectedActivation:e.materialActivation})}catch{return Tc({capability:e.materialActivation.capability,reason:`binding_mismatch`})}}else return Tc({capability:e.materialActivation.capability,reason:`missing_material`});if(t)return Ac({authority:r,runtime:kc(e.materialActivation),materialActivation:e.materialActivation});let i=await this.loadEmailOtpWalletCustodyEd25519Material({nearAccountId:String(e.nearAccountId),signerSlot:e.signerSlot});return i.kind===`found`&&i.material.binding.walletId===String(e.walletId)&&i.material.binding.nearAccountId===String(e.nearAccountId)&&i.material.binding.signerSlot===e.signerSlot&&String(e.materialActivation.materialOwner)===String(e.walletId)&&(n.kind===`found`||i.material.binding.nearEd25519SigningKeyId===String(e.identity.signer.nearEd25519SigningKeyId)&&i.material.binding.signingWorkerId===String(e.materialActivation.signingWorker))?Sc({authority:r,materialActivation:e.materialActivation,sealedMaterial:qp(JSON.stringify([i.material.binding.walletId,i.material.binding.nearAccountId,i.material.binding.signerSlot,e.materialActivation.activationId]))}):Tc({capability:e.materialActivation.capability,reason:`missing_material`})}async rehydrateActiveEmailOtpEd25519YaoSessionMaterial(e){let t=sN(e.input);if(t.auth.kind!==B.emailOtp)throw Error(`[SigningEngine][near] Email OTP session restore requires Email OTP material`);let n=await BM({store:this.ed25519YaoPublicCapabilityReferences,laneIdentity:t.laneIdentity,materialActivation:e.materialActivation}),r=await this.getUserBySignerSlot(t.nearAccountId,t.laneIdentity.signer.signerSlot);if(!r||String(r.walletId)!==String(t.walletId)||String(r.nearAccountId)!==String(t.nearAccountId)||r.signerSlot!==t.laneIdentity.signer.signerSlot||r.authMethod!==B.emailOtp)throw Error(`[SigningEngine][near] Email OTP signer record is unavailable`);let i=await this.loadEmailOtpWalletCustodyEd25519Material({nearAccountId:String(t.nearAccountId),signerSlot:r.signerSlot}),a=e.authorization.operationCredential;if(i.kind!==`found`)throw Error(`[SigningEngine][near] Email OTP session material is unavailable`);let o=gM(await Ak(String(t.walletId)),String((await L({authority:e.authorization.selectedFactorAuthority})).authorityDigest)),s=_M({manifest:o,remainingUses:e.remainingUses}),c=await this.signerWorkerManager.requestWorkerOperation({kind:`emailOtp`,request:{type:`rehydrateActiveEmailOtpEd25519YaoSessionMaterial`,payload:{relayUrl:String(this.seamsWebConfigs.network.relayer?.url||``).trim(),walletId:String(t.walletId),walletAuthMethodId:String(e.authorization.selectedAuthMethod.walletAuthMethodId),orgId:n.runtimePolicyScope.orgId,providerSubjectId:t.auth.providerSubjectId,nearAccountId:String(t.nearAccountId),signerSlot:r.signerSlot,remainingUses:e.remainingUses,expectedOperationalPublicKey:r.operationalPublicKey,expectedThresholdSessionId:n.thresholdSessionId,operationCredential:a,ecdsa:{sessionHandleBinding:{operation:`wallet_unlock`,keyHandle:String(o.durableMaterial.roleLocalBinding.keyHandle),authSubjectId:t.auth.providerSubjectId,chainTarget:o.signer.scope.targetMemberships[0]},runtimePolicyScope:o.durableMaterial.runtimePolicyScope,sessionPolicy:s},walletCustodyEd25519Material:i}}});return await yM({walletId:t.walletId,authorization:c.walletSessionAuthorization,response:c.ecdsaSession}),await this.activateEmailOtpEd25519CustodyCapabilityInternal({commitQueue:`acquire`,walletSession:{walletId:t.walletId,walletSessionUserId:String(t.walletId)},providerSubject:t.auth.providerSubjectId,emailHashHex:await Ar(r.loginDisplayName.trim().toLowerCase()),signerSlot:r.signerSlot,expectedOperationalPublicKey:r.operationalPublicKey,expectedThresholdSessionId:String(n.thresholdSessionId),bootstrap:c.bootstrap,activeClientHandle:c.activeClientHandle,metadata:c.metadata,exactAuthorization:c.walletSessionAuthorization}),Ac({authority:await L({authority:e.authorization.selectedFactorAuthority}),runtime:kc(e.materialActivation),materialActivation:e.materialActivation})}async prepareExactNearEd25519YaoSigning(e){if(e.laneIdentity!==void 0&&e.auth?.kind===B.emailOtp){let t=await this.prepareMaterialIdentityNearEd25519YaoSigning(cN(e)),n=await this.readExactNearEd25519WalletSessionAuthorization(e.walletId);if(n.kind!==`found`||n.authorization.selectedAuthMethod.kind!==B.emailOtp)return t;let r=n.authorization;switch(t.hydration.kind){case`use_live_runtime`:break;case`rehydrate_material_activation`:t=il({hydration:await this.rehydrateActiveEmailOtpEd25519YaoSessionMaterial({input:e,materialActivation:t.hydration.materialActivation,authorization:r,remainingUses:r.status.remainingUses}),requirement:e.auth});break;case`reauthorize_public_anchor`:case`blocked`:return t;default:throw t.hydration,Error(`[SigningEngine][near] unsupported Email OTP hydration state`)}let i=await this.readExactNearEd25519WalletSessionAuthorization(e.walletId);return i.kind!==`found`||i.authorization.selectedAuthMethod.kind!==B.emailOtp?t:await ol({hydration:t.hydration,requirement:e.auth,authorization:i.authorization})}if(e.laneIdentity===void 0)return await this.prepareMaterialIdentityNearEd25519YaoSigning(e);let t=await this.readExactNearEd25519WalletSessionAuthorization(e.walletId);switch(t.kind){case`found`:{let n=t.authorization;if(n.selectedAuthMethod.kind!==e.auth.kind)return await this.prepareMaterialIdentityNearEd25519YaoSigning(cN(e));let r=await Se({walletId:e.walletId,laneIdentity:e.laneIdentity});if(r.kind===`missing`&&e.auth.kind===B.passkey){let t=await VM({store:this.ed25519YaoPublicCapabilityReferences,laneIdentity:e.laneIdentity}),r=t.materialActivation,i=this.enginePorts.ed25519YaoActiveClients.resolve({walletId:e.walletId,nearAccountId:e.nearAccountId,materialActivation:r});if(!i)throw Error(`[SigningEngine][near] active Passkey Ed25519 material is unavailable`);let a=mN({material:i,input:e,expectedActivation:r}),o=await WM({reference:t,material:a,authorization:n,materialActivation:r,relayerUrl:String(this.seamsWebConfigs.network.relayer?.url||``).trim()}),s=tN(a);if(s.kind!==`live`)throw Error(`[SigningEngine][near] active Passkey Ed25519 material is unavailable`);return await ol({hydration:Ac({authority:o.authority,runtime:s.runtime,materialActivation:r}),requirement:e.auth,authorization:n})}if(r.kind!==`resolved`)throw Error(`[SigningEngine][near] exact persisted Ed25519 runtime is ${r.kind}`);let i=r.runtime,a=i.sealedRecord.ed25519Restore.materialActivation,o=await XM({runtime:i,relayerUrl:String(this.seamsWebConfigs.network.relayer?.url||``).trim()}),s=o.signingLane.identity.signer,c={kind:`available`,walletId:String(s.account.wallet.walletId),nearAccountId:String(s.account.nearAccountId),signerSlot:s.signerSlot,materialActivation:a},l=this.enginePorts.ed25519YaoActiveClients.resolve({walletId:s.account.wallet.walletId,nearAccountId:s.account.nearAccountId,materialActivation:a}),u=e.auth.kind===B.passkey?await this.passkeyMpcSession.claimWarmSessionMaterial({thresholdSessionId:i.thresholdSessionId,purpose:{curve:`ed25519`,materialActivation:a},consume:!1}):null,d={kind:`unavailable`};u?.ok===!0&&(d={kind:`available`,passkeyPrfFirstB64u:u.prfFirstB64u});let f=await this.resolveExactNearEd25519YaoSigningHydration({args:e,walletSessionState:o,publicLocator:c,runtime:tN(l),unlockSource:d});if(f.kind===`use_live_runtime`){if(!l)throw Error(`[SigningEngine][near] live Ed25519 material is unavailable`);await hN({input:e,authorization:n,sealedRuntime:i,material:l})}return await ol({hydration:f,requirement:e.auth,authorization:n})}case`missing`:case`expired`:case`exhausted`:case`superseded`:case`authority_unavailable`:case`method_unavailable`:case`capability_unavailable`:case`unavailable`:return await this.prepareMaterialIdentityNearEd25519YaoSigning(cN(e));case`upgrade_required`:throw new Os(`[SigningEngine][near] Wallet Session authorization requires a newer client`);case`corrupt`:case`persistence_unavailable`:throw Error(`[SigningEngine][near] Wallet Session authorization is ${t.kind}`);default:throw Error(`[SigningEngine][near] unsupported Wallet Session authorization state`)}}async prepareExactNearEd25519YaoMaterialBoundary(e){pN(e);let t=await this.prepareExactNearEd25519YaoSigning(e),n={input:e,materialActivation:t.hydration.materialActivation||null};return{preparation:t,executor:{resolveSigningKeyMaterial:this.resolveExactNearEd25519SigningKeyMaterial.bind(this,n),resolve:this.resolveExactNearEd25519YaoPreparedMaterial.bind(this,n),resolveWalletSessionState:this.resolveExactNearEd25519YaoWalletSessionState.bind(this,n),resolveFundingSession:this.resolveExactNearEd25519FundingSession.bind(this,n),preparePasskeyOperationStepUp:this.prepareExactNearEd25519YaoOperationStepUpAtBoundary.bind(this,n),prepareEmailOtpOperationStepUp:this.prepareExactNearEmailOtpEd25519YaoOperationStepUpAtBoundary.bind(this,n)}}}async resolveExactNearEd25519SigningKeyMaterial(e){let t=nN(e.input),n=t.signer,r=t.auth,i=e.materialActivation;if(!i)throw Error(`[SigningEngine][near] prepared material has no activation`);if(String(n.account.wallet.walletId)!==String(e.input.walletId)||String(n.account.nearAccountId)!==String(e.input.nearAccountId))throw Error(`[SigningEngine][near] selected Ed25519 lane identity changed`);let a=await K.resolveSelectedWalletAuthority(String(e.input.walletId));if(a.kind!==`resolved`){let e=a.kind===`integrity_error`?`: ${a.reason}`:``;throw Error(`[SigningEngine][near] selected Wallet Authority is ${a.kind}${e}`)}let{selection:o,authMethod:s,authority:c,signerMaterials:l}=a,u;switch(r.kind){case B.passkey:u=s.kind===B.passkey&&String(s.rpId)===String(r.rpId)&&s.credentialIdB64u===r.credentialIdB64u;break;case B.emailOtp:u=s.kind===B.emailOtp;break;default:throw Error(`[SigningEngine][near] unsupported Ed25519 material authority`)}if(o.lockState!==`unlocked`||c.state!==`active`||s.status!==`active`||String(o.walletId)!==String(e.input.walletId)||o.walletAuthMethodId!==s.walletAuthMethodId||s.walletAuthorityId!==c.authorityId||String(s.walletId)!==String(e.input.walletId)||!u)throw Error(`[SigningEngine][near] selected Wallet Authority does not match the lane`);let d=await WT({selected:{authMethod:s,authority:c},operation:{kind:`near_sign`,operation:`sign`,keyFamily:`ed25519`}});if(d.kind!==`resolved`)throw Error(`[SigningEngine][near] selected Wallet Authority rejected signing (${d.reason.kind})`);let f=d.value;if(f.keyFamily!==`ed25519`||String(f.walletId)!==String(e.input.walletId)||f.authMethodId!==s.walletAuthMethodId||!b(f.materialActivation,i))throw Error(`[SigningEngine][near] selected Wallet Authority activation changed`);if(c.signerActivations.keyFamilies[0]!==`ed25519`||c.signerActivations.ed25519===void 0||!b(c.signerActivations.ed25519.materialActivation,i)||c.signerActivations.ed25519.signer.registeredPublicKeyB64u!==f.registeredPublicKeyB64u)throw Error(`[SigningEngine][near] selected Ed25519 authority activation changed`);let p=I(f.registeredPublicKeyB64u);if(p.byteLength!==32)throw Error(`[SigningEngine][near] selected Ed25519 public key is invalid`);let m=i.signingWorker,h=[1,2],g=null;if(c.provenance.kind===`device_link`){await HM({store:this.ed25519YaoPublicCapabilityReferences,identity:t,materialActivation:i});for(let e of l)if(!(!LM(e)||e.authorityId!==c.authorityId||e.walletAuthMethodId!==s.walletAuthMethodId||!b(e.materialActivation,i))){if(g)throw Error(`[SigningEngine][near] linked Ed25519 signer material is ambiguous`);g=e}if(!g)throw Error(`[SigningEngine][near] linked Ed25519 signer material is unavailable`);let a=g.publicFacts.applicationBinding,o=g.publicFacts.targetBinding,u=o.lifecycle,d=g.targetFactor,p;switch(r.kind){case B.passkey:p=d.kind===B.passkey&&d.walletAuthMethodId===s.walletAuthMethodId&&String(d.rpId)===String(r.rpId)&&d.credentialIdB64u===r.credentialIdB64u;break;case B.emailOtp:p=d.kind===B.emailOtp&&s.kind===B.emailOtp&&d.walletAuthMethodId===s.walletAuthMethodId&&d.emailHashHex===s.emailHashHex;break;default:throw Error(`[SigningEngine][near] unsupported Ed25519 material authority`)}if(a.wallet_id!==String(e.input.walletId)||a.near_ed25519_signing_key_id!==String(n.nearEd25519SigningKeyId)||a.key_creation_signer_slot!==n.signerSlot||u.account_id!==String(e.input.walletId)||u.session_id!==String(t.thresholdSessionId)||u.selected_server_id!==String(m)||!b(Xn(o.material_activation),i)||!b(Xn(g.publicFacts.activationReceipt.material_activation),i)||F(Uint8Array.from(g.publicFacts.activationReceipt.registered_public_key))!==f.registeredPublicKeyB64u||!p)throw Error(`[SigningEngine][near] linked Ed25519 signer identity changed`);h=g.publicFacts.participantIds}let _=this.enginePorts.ed25519YaoActiveClients.resolve({walletId:e.input.walletId,nearAccountId:e.input.nearAccountId,materialActivation:i});if(_){let r=mN({material:_,input:e.input,expectedActivation:i}),a=r.activeClient.metadata(),o=r.facts;if(F(a.registeredPublicKey)!==f.registeredPublicKeyB64u||a.participantIds[0]!==h[0]||a.participantIds[1]!==h[1]||a.applicationBinding.wallet_id!==String(e.input.walletId)||a.applicationBinding.near_ed25519_signing_key_id!==String(n.nearEd25519SigningKeyId)||a.applicationBinding.key_creation_signer_slot!==n.signerSlot||a.scope.account_id!==String(e.input.walletId)||a.scope.threshold_session_id!==String(t.thresholdSessionId)||a.scope.signing_worker_id!==String(m)||o.routerAbNormalSigning.signingWorkerId!==String(m)||o.signingRootId!==a.applicationBinding.signing_root_id||o.signingRootVersion!==a.scope.root_share_epoch)throw Error(`[SigningEngine][near] active Ed25519 public material changed`);if(g){let e=g.publicFacts.applicationBinding,t=g.publicFacts.targetBinding.lifecycle;if(a.applicationBinding.wallet_id!==e.wallet_id||a.applicationBinding.near_ed25519_signing_key_id!==e.near_ed25519_signing_key_id||a.applicationBinding.signing_root_id!==e.signing_root_id||a.applicationBinding.key_creation_signer_slot!==e.key_creation_signer_slot||a.scope.lifecycle_id!==t.lifecycle_id||a.scope.root_share_epoch!==t.root_share_epoch||a.scope.account_id!==t.account_id||a.scope.threshold_session_id!==t.session_id||a.scope.signing_worker_id!==t.selected_server_id)throw Error(`[SigningEngine][near] linked Ed25519 runtime identity changed`)}}let v=`ed25519:${zi(p)}`;return{nearAccountId:e.input.nearAccountId,signerSlot:n.signerSlot,kind:`threshold_ed25519_v1`,publicKey:v,relayerKeyId:m,keyVersion:qs,participants:Pn({clientParticipantId:h[0],relayerParticipantId:h[1],relayerKeyId:m,clientShareDerivation:`prf_first_v1`}),timestamp:c.activatedAtMs}}async resolveExactNearEd25519YaoPreparedMaterial(e,t){let n=vN({context:e,preparation:t});switch(t.hydration.kind){case`use_live_runtime`:{let t=this.enginePorts.ed25519YaoActiveClients.resolve({walletId:e.input.walletId,nearAccountId:e.input.nearAccountId,materialActivation:n});if(!t)throw Error(`[SigningEngine][near] active Ed25519 Yao capability is unavailable`);return mN({material:t,input:e.input,expectedActivation:n})}case`rehydrate_material_activation`:{let t=sN(e.input);switch(t.auth.kind){case B.passkey:{let e=await this.rehydrateExactPasskeyEd25519YaoCapabilityForSigning(t);try{let r=await this.readExactNearEd25519WalletSessionAuthorization(t.walletId);if(r.kind!==`found`||r.authorization.selectedAuthMethod.kind!==B.passkey)throw Error(`[SigningEngine][near] Wallet Session authorization is ${r.kind}`);let i=await GM({walletId:t.walletId,laneIdentity:t.laneIdentity});return await hN({input:t,authorization:r.authorization,sealedRuntime:i,material:e}),mN({material:e,input:t,expectedActivation:n})}catch(t){throw e.activeClient.dispose(),t}}case B.emailOtp:throw Error(`[SigningEngine][near] Email OTP custody cache is unavailable; link the device before signing`);default:throw t.auth,Error(`[SigningEngine][near] unsupported Ed25519 material authority`)}}case`reauthorize_public_anchor`:throw Error(`[SigningEngine][near] retired material requires reauthorization`);case`blocked`:throw Error(`[SigningEngine][near] prepared material is blocked: ${t.hydration.reason}`);default:throw t.hydration,Error(`[SigningEngine][near] unsupported prepared material hydration`)}}async resolveExactNearEd25519YaoWalletSessionState(e){let t=sN(e.input);if(t.auth.kind===B.emailOtp){if(!e.materialActivation)throw Error(`[SigningEngine][near] prepared material has no activation`);let n=await BM({store:this.ed25519YaoPublicCapabilityReferences,laneIdentity:t.laneIdentity,materialActivation:e.materialActivation}),r=this.enginePorts.ed25519YaoActiveClients.resolve({walletId:t.walletId,nearAccountId:t.nearAccountId,materialActivation:e.materialActivation});if(!r)throw Error(`[SigningEngine][near] active Email OTP Ed25519 material is unavailable`);let i=await this.readExactNearEd25519WalletSessionAuthorization(t.walletId);if(i.kind!==`found`||i.authorization.selectedAuthMethod.kind!==B.emailOtp)throw Error(`[SigningEngine][near] Wallet Session authorization is ${i.kind}`);return await lN({reference:n,material:mN({material:r,input:t,expectedActivation:e.materialActivation}),authorization:i.authorization,materialActivation:e.materialActivation,relayerUrl:String(this.seamsWebConfigs.network.relayer?.url||``).trim()})}let n=await Se({walletId:t.walletId,laneIdentity:t.laneIdentity});if(n.kind===`missing`&&t.auth.kind===B.passkey){if(!e.materialActivation)throw Error(`[SigningEngine][near] prepared material has no activation`);let n=await VM({store:this.ed25519YaoPublicCapabilityReferences,laneIdentity:t.laneIdentity});if(!b(n.materialActivation,e.materialActivation))throw Error(`[SigningEngine][near] Passkey public lane activation changed`);let r=this.enginePorts.ed25519YaoActiveClients.resolve({walletId:t.walletId,nearAccountId:t.nearAccountId,materialActivation:e.materialActivation});if(!r)throw Error(`[SigningEngine][near] active Passkey Ed25519 material is unavailable`);let i=mN({material:r,input:t,expectedActivation:e.materialActivation}),a=await this.readExactNearEd25519WalletSessionAuthorization(t.walletId);if(a.kind!==`found`||a.authorization.selectedAuthMethod.kind!==B.passkey)throw Error(`[SigningEngine][near] Wallet Session authorization is ${a.kind}`);return await WM({reference:n,material:i,authorization:a.authorization,materialActivation:e.materialActivation,relayerUrl:String(this.seamsWebConfigs.network.relayer?.url||``).trim()})}if(n.kind!==`resolved`)throw Error(`[SigningEngine][near] exact persisted Ed25519 runtime is ${n.kind}`);let r=n.runtime;return await XM({runtime:r,relayerUrl:String(this.seamsWebConfigs.network.relayer?.url||``).trim()})}async resolveExactNearEd25519FundingSession(e){let t=nN(e.input),n=await this.readExactNearEd25519WalletSessionAuthorization(t.signer.account.wallet.walletId);if(n.kind!==`found`||n.authorization.selectedAuthMethod.kind!==t.auth.kind)throw Error(`[SigningEngine][near] authenticated funding session is unavailable`);if(!e.materialActivation)throw Error(`[SigningEngine][near] funding session material activation is unavailable`);if(!Xc({session:n.authorization.session,materialActivation:e.materialActivation}))throw Error(`[SigningEngine][near] authenticated funding session material changed`);let r=n.authorization.operationCredential.token;if(n.authorization.session.walletId!==t.signer.account.wallet.walletId||n.authorization.selectedAuthMethod.kind!==t.auth.kind||!n.authorization.operationCredential.walletSessionId||!n.authorization.session.quotaId)throw Error(`[SigningEngine][near] funding session identity does not match`);return{kind:`near_ed25519_funding_session`,signer:t.signer,thresholdSessionId:t.thresholdSessionId,walletSessionToken:r}}async prepareExactNearEd25519YaoOperationStepUpAtBoundary(e,t){if(iN(e.input).kind!==B.passkey)throw Error(`[SigningEngine][near] Email OTP material cannot use Passkey rehydration`);let n=vN({context:e,preparation:t}),r=await this.prepareExactPasskeyEd25519YaoOperationStepUpForSigning(e.input);if(!b(n,r.materialActivation))throw Error(`[SigningEngine][near] operation step-up changed material activation`);return r}async prepareExactNearEmailOtpEd25519YaoOperationStepUpAtBoundary(e,t){let n=nN(e.input);if(n.auth.kind!==B.emailOtp)throw Error(`[SigningEngine][near] Passkey material cannot use Email OTP rehydration`);let r=vN({context:e,preparation:t});switch(t.hydration.kind){case`use_live_runtime`:return{kind:`live`,materialActivation:r,material:await this.resolveExactNearEd25519YaoPreparedMaterial(e,t)};case`rehydrate_material_activation`:{let t=await BM({store:this.ed25519YaoPublicCapabilityReferences,laneIdentity:n,materialActivation:r}),i=await this.getUserBySignerSlot(e.input.nearAccountId,n.signer.signerSlot);if(!i||String(i.walletId)!==String(e.input.walletId)||String(i.nearAccountId)!==String(e.input.nearAccountId)||i.signerSlot!==n.signer.signerSlot||i.authMethod!==B.emailOtp)throw Error(`[SigningEngine][near] Email OTP signer record is unavailable`);let a=await this.loadEmailOtpWalletCustodyEd25519Material({nearAccountId:String(e.input.nearAccountId),signerSlot:i.signerSlot});if(a.kind!==`found`)throw Error(`[SigningEngine][near] Email OTP custody material is unavailable`);if(`ed25519:${zi(I(a.material.binding.registeredPublicKeyB64u))}`!==i.operationalPublicKey||a.material.binding.walletId!==String(e.input.walletId)||a.material.binding.nearAccountId!==String(e.input.nearAccountId)||a.material.binding.signerSlot!==i.signerSlot||a.material.binding.signingWorkerId!==String(r.signingWorker))throw Error(`[SigningEngine][near] Email OTP custody material binding changed`);let o=this.seamsWebConfigs.network.relayer?.url||``;if(!o)throw Error(`[SigningEngine][near] Email OTP recovery requires a relay URL`);let s={input:e.input,materialActivation:r,facts:fN({input:e.input,publicLane:t,relayerUrl:o}),publicLane:t,sealedMaterial:a.material,operationalPublicKey:i.operationalPublicKey,emailHashHex:await Ar(i.loginDisplayName.trim().toLowerCase())};return{kind:`sealed`,materialActivation:r,facts:s.facts,authorizeAndRehydrate:this.authorizeAndRehydrateEmailOtpEd25519OperationMaterial.bind(this,s)}}case`reauthorize_public_anchor`:throw Error(`[SigningEngine][near] retired Email OTP material cannot sign`);case`blocked`:throw Error(`[SigningEngine][near] Email OTP operation material is blocked: ${t.hydration.reason}`);default:throw t.hydration,Error(`[SigningEngine][near] unsupported Email OTP operation material`)}}async authorizeAndRehydrateEmailOtpEd25519OperationMaterial(e,t){let n=nN(e.input);if(n.auth.kind!==B.emailOtp||t.proof.providerSubjectId!==n.auth.providerSubjectId)throw Error(`[SigningEngine][near] Email OTP operation authority changed`);let r=await YM({walletId:e.input.walletId,proof:t.proof}),i={kind:`exact_ed25519_export_material`,signer:n.signer,auth:n.auth,thresholdSessionId:n.thresholdSessionId},a=await ST({subject:i,expectedMaterialActivation:e.materialActivation,authorization:await this.readExactEmailOtpEd25519ExportAuthorization({subject:i,expectedMaterialActivation:e.materialActivation}),source:{signingWorkerId:e.sealedMaterial.binding.signingWorkerId,participantIds:e.sealedMaterial.binding.participantIds,registeredPublicKeyB64u:e.sealedMaterial.binding.registeredPublicKeyB64u},relayerUrl:e.facts.relayerUrl,fetch:globalThis.fetch.bind(globalThis)}),o=await PT({workerCtx:this.signerWorkerManager.getContext(),payload:{relayUrl:e.facts.relayerUrl,walletId:String(e.input.walletId),orgId:e.publicLane.runtimePolicyScope.orgId,providerSubjectId:n.auth.providerSubjectId,nearAccountId:String(e.input.nearAccountId),signerSlot:e.publicLane.signerSlot,expectedOperationalPublicKey:e.operationalPublicKey,expectedThresholdSessionId:e.publicLane.thresholdSessionId,expectedMaterialActivation:e.materialActivation,ed25519YaoRecovery:{kind:fa,signerSlot:e.publicLane.signerSlot,remainingUses:Mn,orgId:e.publicLane.runtimePolicyScope.orgId},walletCustodyEd25519Material:{kind:`found`,material:e.sealedMaterial},bootstrap:a,normalSigningRequest:t.normalSigningRequest,displayDigest:t.displayDigest,proof:t.proof,operationCredential:r}});if(o.walletCustodyEd25519Material)try{await this.persistWalletCustodyEd25519Material(o.walletCustodyEd25519Material)}catch(e){throw await Zw({workerContext:this.signerWorkerManager.getContext(),activeClientHandle:o.activeClientHandle}).catch(()=>void 0),e}let s=new Qw(this.signerWorkerManager.getContext(),o.activeClientHandle,o.metadata),c;try{c=mN({material:{activeClient:s,facts:e.facts},input:e.input,expectedActivation:e.materialActivation})}catch(e){throw s.dispose(),e}return{material:c,issuedAuthorization:{kind:o.issuedAuthorization.kind,authorization:o.issuedAuthorization.authorization,expiresAtMs:o.issuedAuthorization.expiresAtMs}}}async resolveExactNearEd25519YaoSigningHydration(e){let t=sN(e.args);switch(t.auth.kind){case B.passkey:{let n=await this.resolvePasskeyEd25519YaoHydration({walletSessionState:e.walletSessionState,credentialIdB64u:t.auth.credentialIdB64u,publicLocator:e.publicLocator,unlockSource:e.unlockSource}),r;switch(n.kind){case`live`:case`blocked`:r=n.plan;break;case`rehydrated`:n.activeClient.dispose(),r=n.plan;break;default:throw Error(`[SigningEngine][near] unsupported Passkey hydration result`)}return r.kind===`blocked`&&r.reason===`missing_material`?(await nn({store:K,identity:an(e.walletSessionState,t.auth.rpId,t.auth.credentialIdB64u),authority:e.walletSessionState.authority,publicLocator:e.publicLocator})).plan:r}case B.emailOtp:if(e.publicLocator.kind!==`available`)throw Error(`[SigningEngine][near] Email OTP custody locator is unavailable`);return await this.resolveWalletCustodyEmailOtpHydration({walletId:t.walletId,nearAccountId:t.nearAccountId,identity:EM(nN(t)),signerSlot:t.laneIdentity.signer.signerSlot,materialActivation:e.publicLocator.materialActivation});default:throw t.auth,Error(`[SigningEngine][near] unsupported Ed25519 material authority`)}}async prepareExactPasskeyEd25519YaoOperationStepUpForSigning(e){let t=nN(e);if(t.auth.kind!==B.passkey)throw Error(`[SigningEngine][near] Passkey operation step-up requires Passkey material`);if(!await this.resolveNearEd25519YaoSigningLane({...e.laneIdentity===void 0?{kind:`material_identity`,materialIdentity:t}:{kind:`exact_lane`,laneIdentity:e.laneIdentity}}))throw Error(`[SigningEngine][near] sealed Ed25519 operation lane is unavailable`);let n=await ZM({walletId:e.walletId,identity:t,relayerUrl:this.seamsWebConfigs.network.relayer.url});return{materialActivation:n.prepared.plan.materialActivation,facts:n.facts,participantIds:[...n.participantIds],rehydrate:this.rehydratePreparedPasskeyEd25519YaoOperationStepUp.bind(this,{input:e,identity:n.localIdentity,facts:n.facts,authority:n.authority,rpId:t.auth.rpId,credentialIdB64u:t.auth.credentialIdB64u,publicLocator:n.publicLocator,materialActivation:n.prepared.plan.materialActivation})}}async rehydratePreparedPasskeyEd25519YaoOperationStepUp(e,t){if(String(t.rawId||t.id||``).trim()!==e.credentialIdB64u)throw vf(`binding_mismatch`);let n=El({credential:t,rpId:e.rpId}),r=await eN({store:K,identity:e.identity,authority:e.authority,publicLocator:e.publicLocator,unlockSource:{kind:`available`,passkeyPrfFirstB64u:n.secretSource.prfFirstB64u},liveMaterial:null});if(r.kind===`blocked`)throw yf(r.plan.reason);if(r.kind!==`rehydrated`)throw vf(`corrupt`);if(!b(e.materialActivation,r.plan.materialActivation))throw r.activeClient.dispose(),vf(`binding_mismatch`);let i={activeClient:r.activeClient,facts:e.facts};try{return mN({material:i,input:e.input,expectedActivation:e.materialActivation})}catch{throw i.activeClient.dispose(),vf(`binding_mismatch`)}}async resolveExactPasskeyEd25519YaoExportContext(e){let t=String(this.seamsWebConfigs.network.relayer?.url||``).trim();if(!t)throw Error(`[SigningEngine][ed25519-export] passkey export requires relayerUrl`);let n=R(String(e.laneIdentity.signer.account.wallet.walletId));if(!await ve(Df({authMethod:e.laneIdentity.auth.kind,materialActivation:e.materialActivation})))return await this.resolveLinkedPasskeyEd25519YaoExportContext({...e,walletId:n,relayerUrl:t});let r=await KM({walletId:n,laneIdentity:e.laneIdentity,materialActivation:e.materialActivation}),i=e.laneIdentity.thresholdSessionId;if(await hM(r.walletId,t)){let t=await XM({runtime:r,relayerUrl:String(this.seamsWebConfigs.network.relayer?.url||``).trim()});(await this.ensurePasskeyEd25519WarmSessionForSigning({runtime:r,walletSessionState:t,materialActivation:e.materialActivation})).ok&&(i=t.thresholdSessionId)}return await Kp({subject:{kind:`owner_sealed_runtime`,walletId:R(String(e.laneIdentity.signer.account.wallet.walletId)),nearAccountId:String(e.laneIdentity.signer.account.nearAccountId),nearEd25519SigningKeyId:String(e.laneIdentity.signer.nearEd25519SigningKeyId),signerSlot:e.laneIdentity.signer.signerSlot,thresholdSessionId:i,materialActivation:e.materialActivation},relayerUrl:t,fetch:jM},{readExactEd25519SealedSession:ve,readPasskeyCustodySessionEnvelope:Ve,resolveSelectedWalletAuthority:K.resolveSelectedWalletAuthority.bind(K),readExactWalletSessionAuthorization:G.readExactActiveForWallet.bind(G),resolveExactPasskeyWalletAuthAuthorityRef:CM,nowMs:this.runtimePorts.clock.nowMs})}async resolveLinkedPasskeyEd25519YaoExportContext(e){if(e.laneIdentity.auth.kind!==B.passkey)throw Error(`[SigningEngine][ed25519-export] linked export requires a Passkey lane`);let t=await K.resolveSelectedWalletAuthority(String(e.walletId));if(t.kind!==`resolved`){let e=t.kind===`integrity_error`?`: ${t.reason}`:``;throw Error(`[SigningEngine][ed25519-export] selected Wallet Authority is ${t.kind}${e}`)}let{selection:n,authMethod:r,authority:i,signerMaterials:a,exportRoot:o}=t;if(n.lockState!==`unlocked`||r.kind!==B.passkey||r.status!==`active`||i.state!==`active`||i.provenance.kind!==`device_link`||String(r.walletId)!==String(e.walletId)||r.walletAuthorityId!==i.authorityId||r.walletAuthMethodId!==n.walletAuthMethodId||String(r.rpId)!==String(e.laneIdentity.auth.rpId)||r.credentialIdB64u!==e.laneIdentity.auth.credentialIdB64u)throw Error(`[SigningEngine][ed25519-export] selected linked Passkey authority is unavailable`);let c=i.signerActivations.ed25519;if(!i.permissions.includes(`export_keys`)||!c||!b(c.materialActivation,e.materialActivation)||!o)throw Error(`[SigningEngine][ed25519-export] selected authority has no exact Ed25519 export capability`);let l=null;for(let t of a)if(!(!LM(t)||t.authorityId!==i.authorityId||t.walletAuthMethodId!==r.walletAuthMethodId||!b(t.materialActivation,e.materialActivation))){if(l)throw Error(`[SigningEngine][ed25519-export] linked Ed25519 material is ambiguous`);l=t}if(!l)throw Error(`[SigningEngine][ed25519-export] linked Ed25519 material is unavailable`);let u=l.targetFactor;if(u.kind!==B.passkey||u.walletAuthMethodId!==r.walletAuthMethodId||u.rpId!==r.rpId||u.credentialIdB64u!==r.credentialIdB64u)throw Error(`[SigningEngine][ed25519-export] linked Ed25519 factor binding changed`);let d=pb(await G.readExactWithOperationCredential({walletId:e.walletId,authorityId:i.authorityId,authMethodId:r.walletAuthMethodId}),`[SigningEngine][ed25519-export] exact linked Wallet Session requires a newer client`),f=!1;if(d){for(let t of d.record.capabilitySubjects)if(t.kind===`export_keys`&&t.keyFamily===`ed25519`&&b(t.materialActivation,e.materialActivation)){f=!0;break}}if(!d||!f||d.record.authorityDigestB64u!==i.authorityDigestB64u||d.record.authorityRevocationEpoch!==i.revocationEpoch||d.record.expiresAtMs<=Date.now())throw Error(`[SigningEngine][ed25519-export] exact linked Wallet Session is unavailable`);let p=await VM({store:this.ed25519YaoPublicCapabilityReferences,laneIdentity:e.laneIdentity});if(!b(p.materialActivation,e.materialActivation))throw Error(`[SigningEngine][ed25519-export] linked public lane activation changed`);let m=await L({authority:{walletId:r.walletId,factor:{kind:B.passkey,credentialIdB64u:r.credentialIdB64u},verifier:{kind:`webauthn`,rpId:r.rpId},bindingId:r.walletAuthMethodId}});if(m.walletAuthMethodId!==r.walletAuthMethodId)throw Error(`[SigningEngine][ed25519-export] Passkey Wallet Session authority changed`);let h=this.enginePorts.ed25519YaoActiveClients.resolve({walletId:e.walletId,nearAccountId:e.laneIdentity.signer.account.nearAccountId,materialActivation:e.materialActivation});if(!h||h.activeClient.status().kind!==`active`)throw Error(`[SigningEngine][ed25519-export] linked Ed25519 runtime is unavailable`);let g=h.activeClient.metadata(),_=Mc(g),v=h.facts,y=e.laneIdentity.signer,x=l.publicFacts.applicationBinding,S=F(g.registeredPublicKey),C=Number(g.stateEpoch),w=s(g.scope.threshold_session_id),T=v.runtimePolicyScope,E=p.runtimePolicyScope;if(!w.ok||!Number.isSafeInteger(C)||C<1||!b(_,e.materialActivation)||String(v.thresholdSessionId)!==String(e.laneIdentity.thresholdSessionId)||String(v.signer.account.wallet.walletId)!==String(e.walletId)||String(v.signer.account.nearAccountId)!==String(y.account.nearAccountId)||String(v.signer.nearEd25519SigningKeyId)!==String(y.nearEd25519SigningKeyId)||v.signer.signerSlot!==y.signerSlot||x.wallet_id!==String(e.walletId)||x.near_ed25519_signing_key_id!==String(y.nearEd25519SigningKeyId)||x.key_creation_signer_slot!==y.signerSlot||g.applicationBinding.wallet_id!==x.wallet_id||g.applicationBinding.near_ed25519_signing_key_id!==x.near_ed25519_signing_key_id||g.applicationBinding.signing_root_id!==x.signing_root_id||g.applicationBinding.key_creation_signer_slot!==x.key_creation_signer_slot||g.scope.lifecycle_id!==l.publicFacts.targetBinding.lifecycle.lifecycle_id||g.scope.root_share_epoch!==l.publicFacts.targetBinding.lifecycle.root_share_epoch||g.scope.account_id!==String(e.walletId)||g.scope.threshold_session_id!==String(e.laneIdentity.thresholdSessionId)||g.scope.signing_worker_id!==v.routerAbNormalSigning.signingWorkerId||v.signingRootId!==x.signing_root_id||v.signingRootVersion!==g.scope.root_share_epoch||T.orgId!==E.orgId||T.projectId!==E.projectId||T.envId!==E.envId||T.signingRootVersion!==E.signingRootVersion||l.publicFacts.participantIds[0]!==g.participantIds[0]||l.publicFacts.participantIds[1]!==g.participantIds[1]||F(Uint8Array.from(l.publicFacts.activationReceipt.registered_public_key))!==S||c.signer.registeredPublicKeyB64u!==S)throw Error(`[SigningEngine][ed25519-export] linked Ed25519 runtime identity changed`);let ee={authority:m,walletId:y.account.wallet.walletId,nearAccountId:y.account.nearAccountId,nearEd25519SigningKeyId:String(y.nearEd25519SigningKeyId),signerSlot:y.signerSlot,operationalPublicKey:`ed25519:${zi(g.registeredPublicKey)}`,relayerKeyId:g.scope.signing_worker_id,credentialIdB64u:r.credentialIdB64u,capability:{materialActivation:_,activeCapabilityBinding:[...g.activeCapabilityBinding],registeredPublicKey:[...g.registeredPublicKey],nearAccountId:y.account.nearAccountId,applicationBinding:g.applicationBinding,participantIds:g.participantIds,runtimePolicyScope:v.runtimePolicyScope,lifecycle:{lifecycleId:g.scope.lifecycle_id,rootShareEpoch:g.scope.root_share_epoch,accountId:g.scope.account_id,thresholdSessionId:w.value,signerSetId:g.scope.signer_set_id,signingWorkerId:g.scope.signing_worker_id},stateEpoch:C}};return{kind:`ready`,context:{kind:`passkey_ed25519_yao_export_context_v1`,selectedLaneMaterialActivation:e.materialActivation,material:ee,authorization:d,relayerUrl:e.relayerUrl,rpId:r.rpId,walletCustodyEnvelope:o.envelope}}}readExactEmailOtpEd25519ExportAuthorization(e){return AM({subject:e.subject,relayerUrl:String(this.seamsWebConfigs.network.relayer?.url||``).trim()})}async activateRecoveredEmailOtpEd25519ExportCapability(e,t){let n=t.activation;await this.activateEmailOtpEd25519CustodyCapabilityWithExactCredential({commitQueue:`acquire`,walletSession:{walletId:e.signer.account.wallet.walletId,walletSessionUserId:String(e.signer.account.wallet.walletId)},providerSubject:e.auth.providerSubjectId,emailHashHex:n.emailHashHex,signerSlot:e.signer.signerSlot,expectedOperationalPublicKey:`ed25519:${zi(n.metadata.registeredPublicKey)}`,expectedThresholdSessionId:String(e.thresholdSessionId),bootstrap:n.bootstrap,activeClientHandle:n.activeClientHandle,metadata:n.metadata,credentialExpectation:{kind:`expect_exact_operation_credential`,operationCredential:t.operationCredential}})}async resolveEmailOtpEd25519YaoExportContext(e){return await OT({subject:e.laneIdentity,expectedMaterialActivation:e.materialActivation,readExactWalletSessionAuthorization:this.readExactEmailOtpEd25519ExportAuthorization.bind(this),resolveActiveCapability:(e,t,n)=>this.enginePorts.ed25519YaoActiveClients.resolve({walletId:e,nearAccountId:Hi(t),materialActivation:n}),resolveEd25519YaoClientRootEnvelope:async({subject:e,capability:t,selectedMaterialActivation:n})=>RM({selected:await K.resolveSelectedWalletAuthority(String(e.signer.account.wallet.walletId)),subject:e,expectedMaterialActivation:n,activeCapability:t}),loadWalletCustodyMaterial:()=>this.loadEmailOtpWalletCustodyEd25519Material({nearAccountId:String(e.laneIdentity.signer.account.nearAccountId),signerSlot:e.laneIdentity.signer.signerSlot}),relayerUrl:this.seamsWebConfigs.network.relayer?.url||``,fetch:jM,activateRecoveredCapability:this.activateRecoveredEmailOtpEd25519ExportCapability.bind(this,e.laneIdentity)})}async resolveActiveNearEd25519YaoSigningLane(e){if(!await this.resolveNearEd25519YaoSigningLane(e))return null;let t=fT(e),n=e.kind===`export_exact_lane`?this.enginePorts.ed25519YaoActiveClients.resolve({walletId:t.signer.account.wallet.walletId,nearAccountId:t.signer.account.nearAccountId,materialActivation:e.materialActivation}):this.enginePorts.ed25519YaoActiveClients.resolveForWalletAccount({walletId:t.signer.account.wallet.walletId,nearAccountId:t.signer.account.nearAccountId});return n?.activeClient.status().kind===`active`?n:null}async resolveNearEd25519YaoSigningLane(e){let t=fT(e).signer.account.wallet.walletId,n=await this.readPersistedAvailableSigningLanes({walletId:t,ownerScope:await this.resolveSelectedOwnerLaneScope(t)}),r=[];for(let t of n.candidates.ed25519.near)pT(t,e)&&(!Mf(t)||t.curve!==`ed25519`||r.push(t));if(r.length>1)throw Error(`[SigningEngine][near] local Ed25519 material lane is ambiguous`);return r[0]||null}async ensurePasskeyEd25519WarmSessionForSigning(e){let t=await PM({...e,claimWarmSessionMaterial:this.passkeyMpcSession.claimWarmSessionMaterial.bind(this.passkeyMpcSession),rehydrateWarmSessionMaterial:this.passkeyMpcSession.rehydrateWarmSessionMaterial.bind(this.passkeyMpcSession)});return t.ok&&e.runtime.factor.kind===`passkey`&&String(e.runtime.thresholdSessionId)!==String(e.walletSessionState.thresholdSessionId)&&await it({persistence:this,session:e.walletSessionState,prfFirstB64u:t.prfFirstB64u,ed25519Restore:Me({rpId:e.runtime.factor.rpId,nearAccountId:e.runtime.nearAccountId,nearEd25519SigningKeyId:e.runtime.nearEd25519SigningKeyId,relayerKeyId:e.runtime.relayerKeyId,participantIds:e.runtime.participantIds,runtimePolicyScope:e.runtime.runtimePolicyScope,signerSlot:e.runtime.signerSlot,routerAbNormalSigning:e.runtime.routerAbNormalSigning,credentialIdB64u:e.runtime.factor.credentialIdB64u,materialActivation:e.materialActivation}),materialActivation:e.materialActivation}),t}async rehydrateNearEd25519YaoCapabilityForSigning(e){let t=fT(e),n=await this.resolveNearEd25519YaoSigningLane(e);if(!n)throw Error(`[SigningEngine][near] local Ed25519 material lane is unavailable`);let r;if(e.kind===`export_exact_lane`)r=await KM({walletId:t.signer.account.wallet.walletId,laneIdentity:e.laneIdentity,materialActivation:e.materialActivation});else{let i=e.kind===`exact_lane`?e.laneIdentity:cT(n);r=await GM({walletId:t.signer.account.wallet.walletId,laneIdentity:i})}let i=await XM({runtime:r,relayerUrl:String(this.seamsWebConfigs.network.relayer?.url||``).trim()});if(r.factor.kind!==`passkey`)throw Error(`[SigningEngine][near] persisted Ed25519 credential is unavailable`);let a=r.factor.credentialIdB64u,o=r.sealedRecord.ed25519Restore.materialActivation;if(!b(o,n.materialActivation))throw Error(`[SigningEngine][near] persisted Ed25519 material activation mismatch`);let s=await this.ensurePasskeyEd25519WarmSessionForSigning({runtime:r,walletSessionState:i,materialActivation:o}),c={kind:`available`,walletId:String(i.signingLane.identity.signer.account.wallet.walletId),nearAccountId:String(i.signingLane.identity.signer.account.nearAccountId),signerSlot:i.signingLane.identity.signer.signerSlot,materialActivation:o},l=await this.resolvePasskeyEd25519YaoHydration({walletSessionState:i,credentialIdB64u:a,publicLocator:c,unlockSource:s.ok?{kind:`available`,passkeyPrfFirstB64u:s.prfFirstB64u}:{kind:`unavailable`}});if(l.kind===`live`){let t=await this.resolveActiveNearEd25519YaoSigningLane(e);if(!t)throw Error(`[SigningEngine][near] local material rehydration did not publish a lane`);return{subject:e,material:t}}if(l.kind===`rehydrated`){if(!s.ok)throw l.activeClient.dispose(),Error(`[SigningEngine][near] local material rehydration lost the PRF secret`);try{await it({persistence:this,session:i,prfFirstB64u:s.prfFirstB64u,ed25519Restore:Me({rpId:r.factor.rpId,nearAccountId:r.nearAccountId,nearEd25519SigningKeyId:r.nearEd25519SigningKeyId,relayerKeyId:r.relayerKeyId,participantIds:r.participantIds,runtimePolicyScope:r.runtimePolicyScope,signerSlot:r.signerSlot,routerAbNormalSigning:r.routerAbNormalSigning,credentialIdB64u:a,materialActivation:o}),materialActivation:o}),await this.enginePorts.ed25519YaoActiveClients.activate({activeClient:l.activeClient,facts:gt(i)});let t=MM({subject:e,walletSessionState:i}),n=await this.resolveActiveNearEd25519YaoSigningLane(t);if(!n)throw Error(`[SigningEngine][near] local material rehydration did not publish an active lane`);return{subject:t,material:n}}catch(e){throw l.activeClient.dispose(),e}}throw l.plan.reason===`missing_material`?Error(`[SigningEngine][near] local threshold Ed25519 material requires Passkey reauthorization`):Error(`[SigningEngine][near] local threshold Ed25519 hydration blocked: ${l.plan.reason}`)}async resolvePasskeyEd25519YaoHydration(e){let t=e.walletSessionState.signingLane.identity.signer;return $e({store:K,identity:an(e.walletSessionState,this.getRpId(),e.credentialIdB64u),authority:e.walletSessionState.authority,publicLocator:e.publicLocator,unlockSource:e.unlockSource,liveMaterial:e.publicLocator.kind===`available`?this.enginePorts.ed25519YaoActiveClients.resolve({walletId:t.account.wallet.walletId,nearAccountId:t.account.nearAccountId,materialActivation:e.publicLocator.materialActivation}):null})}async signEvmFamily(e){return await af(this.enginePorts.tempoSigningDeps,e)}async reportTempoBroadcastAccepted(e){await rf(this.enginePorts.tempoSigningDeps,e)}async reportTempoBroadcastRejected(e){await sf(this.enginePorts.tempoSigningDeps,e)}async reportTempoFinalized(e){await Gd(this.enginePorts.tempoSigningDeps,e)}async reportTempoDroppedOrReplaced(e){await Qd(this.enginePorts.tempoSigningDeps,e)}async reconcileTempoNonceLane(e){return await cf(this.enginePorts.tempoSigningDeps,e)}storeUserData(e){return zy(this.registrationPublicDeps,e)}async storeNearThresholdKeyMaterial(e){await gh({clientDB:K,keyMaterialStore:K},e)}getAllUsers(){return By(this.registrationPublicDeps)}getUserBySignerSlot(e,t){return Vy(this.registrationPublicDeps,e,t)}getLastUser(){return Hy(this.registrationPublicDeps)}nearAuthenticatorsByAccount(e){return Uy(this.registrationPublicDeps,e)}setLastUser(e,t){return Wy(this.registrationPublicDeps,e,t)}activateAuthenticatedWalletState(e){return qy(this.registrationPublicDeps,e)}async upsertEd25519YaoPublicCapabilityReference(e){await this.ed25519YaoPublicCapabilityReferences.upsert(e)}async upsertEd25519YaoPublicCapabilityLaneReference(e){await Ss(this.ed25519YaoPublicCapabilityReferences,e)}setWalletNearProvisioningState(e){return Gy(this.registrationPublicDeps,e)}getWalletNearProvisioningState(e){return Ky(this.registrationPublicDeps,e)}storeAuthenticator(e){return Jy(this.registrationPublicDeps,e)}rollbackUserRegistration(e){return Yy(this.registrationPublicDeps,e)}hasPasskeyCredential(e){return Xy(this.registrationPublicDeps,e)}storeWalletEd25519RegistrationData(e){return Zy(this.registrationPublicDeps,e)}storeWalletMixedRegistrationData(e){return Qy(this.registrationPublicDeps,e)}storeWalletEd25519RecoveryRegistrationData(e){return $y(this.registrationPublicDeps,e)}storeWalletEmailOtpEd25519RegistrationData(e){return eb(this.registrationPublicDeps,e)}storeWalletEmailOtpMixedRegistrationData(e){return tb(this.registrationPublicDeps,e)}finalizeWalletEd25519SignerRegistration(e){return nb(this.registrationPublicDeps,e)}rollbackWalletEd25519SignerRegistration(e){return rb(this.registrationPublicDeps,e)}createRouterAbEcdsaRegistrationCeremony(e){return this.runtimePorts.signerCrypto.createRouterAbEcdsaRegistrationCeremony(e)}verifyRouterAbEcdsaRegistrationClientProofs(e){return this.runtimePorts.signerCrypto.verifyRouterAbEcdsaRegistrationClientProofs(e)}persistInitialCanonicalEcdsaActivation(e){return this.runtimePorts.signerCrypto.persistInitialCanonicalEcdsaActivation(e)}finalizeRouterAbEcdsaRegistrationActivation(e){return this.runtimePorts.signerCrypto.finalizeRouterAbEcdsaRegistrationActivation(e)}closeRouterAbEcdsaRegistrationCeremony(e){return this.runtimePorts.signerCrypto.closeRouterAbEcdsaRegistrationCeremony(e)}finalizeWalletRegistrationEcdsaSessions(e){return fM(e)}storeWalletEcdsaSignerRecords(e){return ib(this.registrationPublicDeps,e)}storeWalletEcdsaRecoverySignerRecords(e){return ab(this.registrationPublicDeps,e)}storeWalletEmailOtpEcdsaSignerRecords(e){return ob(this.registrationPublicDeps,e)}finalizeWalletEcdsaRegistration(e){return sb(this.registrationPublicDeps,e)}async activateVerifiedNearEd25519YaoMaterial(e){return await this.enginePorts.ed25519YaoActiveClients.activate(e)}async withExactEd25519MaterialOwner(e){return await Il({queueByKey:this.thresholdEd25519CommitQueueByKey,queueKey:Ef({materialActivation:e.materialActivation}),nearAccountId:e.nearAccountId,enabled:!0,task:e.task})}storeWalletEmailOtpEcdsaRegistrationData(e){return cb(this.registrationPublicDeps,e)}prepareSigningSessionHydration(e){return this.passkeyMpcSession.prepareSigningSessionHydration(e)}readPreparedSigningSessionHydration(e){return this.passkeyMpcSession.readPreparedSigningSessionHydration(e)}discardSigningSessionHydration(e){return this.passkeyMpcSession.discardSigningSessionHydration(e)}hydrateSigningSession(e){return pO(this.warmCapabilitiesPublicDeps,e)}persistSigningSessionSealForThresholdSession(e){return this.passkeyMpcSession.persistSigningSessionSealForThresholdSession(e)}async requestEmailOtpEnrollmentConfirmation(e){let t=e.challengeId,n={challengeId:e.challengeId,...e.emailHint?{emailHint:e.emailHint}:{},title:e.confirmerText?.title||`Enter email code to add sign-in`,body:e.confirmerText?.body||`This one-time code confirms ${e.emailAddress} can unlock this wallet.`,helperText:`Enter the 6-digit code sent to your email`,onResend:async()=>{let n=await e.onResend();return t=n.challengeId,{challengeId:n.challengeId,...n.emailHint?{emailHint:n.emailHint}:{},delivery:{mode:`email_provider`}}}},r=await this.touchConfirm.requestUserConfirmation({requestId:pe(`add-auth-method-email-otp`,32,`Email OTP enrollment UI ids`),type:q.SIGN_INTENT_DIGEST,summary:{type:`add_auth_method`,operation:`Add email code sign-in`,title:n.title,body:n.body,warning:`Security note: Adding email code lowers this wallet’s security because your inbox becomes another way to unlock it.`},payload:{signingSubject:{kind:`evm_wallet`,walletId:e.walletId},challengeB64u:e.challengeId,signingAuthPlan:{kind:hf.EmailOtpReauth,method:`email_otp`,emailOtpPrompt:n},emailOtpPrompt:n},intentDigest:`add-auth-method:${e.walletId}:email-otp`,...e.confirmationConfigOverride?{confirmationConfigOverride:e.confirmationConfigOverride}:{}});if(!r.confirmed)throw Error(r.error||`Adding an email code was cancelled`);let i=String(r.otpCode||``).replace(/\D/g,``).slice(0,6);if(i.length!==6)throw Error(`Adding an email code requires a 6-digit code`);return{challengeId:String(r.emailOtpChallengeId||t).trim(),otpCode:i}}requestRegistrationCredentialConfirmation(e){return lb(this.registrationPublicDeps,e)}openRegistrationPreparationModal(e){return this.touchConfirm.openRegistrationPreparationModal(e)}closeRegistrationPreparationModal(){this.touchConfirm.closeRegistrationPreparationModal()}startPreparedPasskeyRegistrationCredential(e){if(this.touchIdPrompt.getRpId()!==e.expectedRpId)throw Error(`Prepared registration rpId does not match the wallet runtime`);return this.touchIdPrompt.generateRegistrationCredentialsInternal({kind:`wallet_registration`,walletId:e.walletId,challengeB64u:e.challengeB64u,signerSlot:e.signerSlot,intendedUserName:e.walletId,prompt:{kind:`reserved`,reservation:e.reservation,owner:e.owner,cancellation:e.cancellation}}).then(yN)}getAuthenticationCredentialsSerialized(e){return e.cancellation?this.touchIdPrompt.getAuthenticationCredentialsSerializedForChallengeB64u(e):ub(this.registrationPublicDeps,e)}async exportKeypairWithUI(e){return await Fy(this.recoveryPublicDeps,e)}async resolveExactKeyExportLane(e){return await Iy(this.recoveryPublicDeps,e)}async connectEd25519Session(e){return await CO(this.passkeyPublicDeps,e)}async bootstrapEcdsaSession(e){return await wO(this.passkeyPublicDeps,e)}async loginWithEmailOtpEcdsaCapabilityInternal(e){return await kb(this.emailOtpPublicDeps,e)}async resolveEmailOtpEd25519CustodyProjectionInternal(e){let t=String(e.walletSession.walletId),n;switch(e.selector.kind){case`material_activation`:n=e.selector.materialActivation;break;case`wallet_auth_method`:{let r=await K.resolveWalletAuthorityForMethod(t,e.selector.walletAuthMethodId);n=r.kind===`resolved`&&r.authority.state===`active`?r.authority.signerActivations.ed25519?.materialActivation:void 0;break}case`selected_wallet_authority`:{let e=await K.resolveSelectedWalletAuthority(t);n=e.kind===`resolved`&&e.authority.state===`active`?e.authority.signerActivations.ed25519?.materialActivation:void 0;break}default:e.selector}return n?await sT({listPublicCapabilityReferences:this.ed25519YaoPublicCapabilityReferences.list.bind(this.ed25519YaoPublicCapabilityReferences),listUsers:this.getAllUsers.bind(this)},e.walletSession,e.providerSubjectId,n):null}async resolveOwnerAuthorityEd25519UnlockRequestInternal(e){let t=await this.resolveEmailOtpEd25519CustodyProjectionInternal({walletSession:e.walletSession,providerSubjectId:e.providerSubjectId,selector:{kind:`wallet_auth_method`,walletAuthMethodId:e.walletAuthMethodId}});if(!t)return null;let n=t.user.signerSlot;return{kind:`owner_authority`,signerSlot:n,remainingUses:e.remainingUses,recovery:{ed25519YaoRecovery:{kind:fa,signerSlot:n,remainingUses:e.remainingUses,orgId:t.identity.runtimePolicyScope.orgId},providerSubject:t.providerSubject,nearAccountId:String(t.identity.nearAccountId),expectedOperationalPublicKey:t.user.operationalPublicKey,expectedThresholdSessionId:String(t.identity.thresholdSessionId),walletCustodyEd25519Material:await this.loadEmailOtpWalletCustodyEd25519Material({nearAccountId:String(t.identity.nearAccountId),signerSlot:n})}}}async activateOwnerAuthorityEd25519RuntimeInternal(e){let t=await this.resolveEmailOtpEd25519CustodyProjectionInternal({walletSession:e.walletSession,providerSubjectId:e.providerSubjectId,selector:{kind:`wallet_auth_method`,walletAuthMethodId:e.walletAuthMethodId}});if(!t)throw Error(`Owner Email OTP Ed25519 activation has no signer projection`);await this.activateEmailOtpEd25519CustodyCapabilityInternal({walletSession:e.walletSession,providerSubject:t.providerSubject,emailHashHex:e.emailHashHex,signerSlot:t.user.signerSlot,expectedOperationalPublicKey:t.user.operationalPublicKey,expectedThresholdSessionId:String(t.identity.thresholdSessionId),bootstrap:e.bootstrap,activeClientHandle:e.activeClientHandle,metadata:e.metadata,authority:e.authority,commitQueue:`acquire`})}async activateEmailOtpEd25519RegistrationMaterialInternal(e){let t=await this.signerWorkerManager.requestWorkerOperation({kind:`emailOtp`,request:{type:`activateEmailOtpEd25519YaoRegistrationMaterial`,payload:{material:e.material,bootstrap:e.bootstrap,envelope:e.envelope,factorSecret32:e.factorSecret32},transfer:[e.factorSecret32]}});try{let n=await this.activateEmailOtpEd25519CustodyCapabilityInternal({commitQueue:`acquire`,walletSession:e.walletSession,providerSubject:e.providerSubject,emailHashHex:e.emailHashHex,signerSlot:e.signerSlot,expectedOperationalPublicKey:e.expectedOperationalPublicKey,expectedThresholdSessionId:e.expectedThresholdSessionId,bootstrap:e.bootstrap,activeClientHandle:t.activeClientHandle,metadata:t.metadata});return await OM({walletId:e.walletSession.walletId,emailHashHex:e.emailHashHex,providerSubject:e.providerSubject,bootstrap:e.bootstrap}),n}catch(n){try{await MT({worker:this.signerWorkerManager.getContext(),target:{kind:`ed25519_yao`,thresholdSessionId:e.bootstrap.session.thresholdSessionId,materialActivation:t.metadata.materialActivation}})}catch{}try{await Zw({workerContext:this.signerWorkerManager.getContext(),activeClientHandle:t.activeClientHandle})}catch{}throw n}}async activateEmailOtpEd25519CustodyCapabilityInternal(e){return await this.activateEmailOtpEd25519CustodyCapabilityWithExactCredential({...e,credentialExpectation:{kind:`resolve_exact_operation_credential`}})}async activateEmailOtpEd25519CustodyCapabilityWithExactCredential(e){let t=await OM({walletId:e.walletSession.walletId,emailHashHex:e.emailHashHex,providerSubject:e.providerSubject,bootstrap:e.bootstrap,...e.authority?{verifiedAuthority:e.authority}:{},...e.exactAuthorization?{exactAuthorization:e.exactAuthorization}:{}});if(e.credentialExpectation.kind===`expect_exact_operation_credential`&&(e.credentialExpectation.operationCredential.walletSessionId!==t.operationCredential.walletSessionId||e.credentialExpectation.operationCredential.token!==t.operationCredential.token))throw Error(`[SigningEngine][near] expected Email OTP operation credential changed`);return await Il({queueByKey:this.thresholdEd25519CommitQueueByKey,queueKey:Ef({materialActivation:e.metadata.materialActivation}),nearAccountId:Hi(e.bootstrap.session.nearAccountId),enabled:e.commitQueue===`acquire`,task:async()=>{let n=await aT({walletSession:e.walletSession,nearAccountId:e.bootstrap.session.nearAccountId,providerSubject:e.providerSubject,relayerUrl:this.seamsWebConfigs.network.relayer?.url||``,authority:t.authority,signerSlot:e.signerSlot,expectedOperationalPublicKey:e.expectedOperationalPublicKey,expectedThresholdSessionId:e.expectedThresholdSessionId,bootstrap:e.bootstrap,operationCredential:t.operationCredential,activeClientHandle:e.activeClientHandle,metadata:e.metadata,workerContext:this.signerWorkerManager.getContext(),activateCapability:this.enginePorts.ed25519YaoActiveClients.activate.bind(this.enginePorts.ed25519YaoActiveClients)}),r=n.walletSessionState;if(await this.upsertEd25519YaoPublicCapabilityLaneReference(IM({walletSessionState:r,materialActivation:n.material.activeClient.metadata().materialActivation})),!this.enginePorts.ed25519YaoActiveClients.resolve({walletId:r.signingLane.identity.signer.account.wallet.walletId,nearAccountId:r.signingLane.identity.signer.account.nearAccountId,materialActivation:n.material.activeClient.metadata().materialActivation}))throw Error(`[SigningEngine][near] wallet custody activation was superseded`);return r.signingLane.identity.signer}})}async loginWithEmailOtpWalletCustodyEd25519Internal(e){if(e.authoritySelector.kind!==`wallet_auth_method`)throw Error(`Email OTP Ed25519 unlock requires an exact wallet auth method`);let t=e.authoritySelector.walletAuthMethodId,n=e.ed25519Selection,r=await Et({walletSession:e.walletSession,authoritySelector:e.authoritySelector,relayUrl:this.seamsWebConfigs.network.relayer?.url||``,groupId:Ns,verification:{kind:`otp`,challengeId:e.challengeId,otpCode:e.otpCode},routePlan:hl({freshRouteFamily:`login`,operation:Jr}),workerCtx:this.signerWorkerManager.getContext(),providerSubject:e.providerSubjectId,signerSlot:n.signerSlot,remainingUses:e.remainingUses,orgId:n.runtimePolicyScope.orgId,nearAccountId:n.nearAccountId,expectedOperationalPublicKey:n.operationalPublicKey,expectedThresholdSessionId:n.thresholdSessionId,walletCustodyEd25519Material:await this.loadEmailOtpWalletCustodyEd25519Material({nearAccountId:n.nearAccountId,signerSlot:n.signerSlot})});if(r.kind===`wallet_custody_cache_absent`)throw Error(`Email OTP wallet custody material is unavailable; recover with a recovery code`);try{await _h({walletId:String(e.walletSession.walletId),walletAuthMethodId:t,projection:r.recovery.verifiedAuthorityProjection});let i=await vh({walletId:String(e.walletSession.walletId),walletAuthMethodId:t,providerSubject:e.providerSubjectId,emailHashHex:e.emailHashHex,projection:r.recovery.verifiedAuthorityProjection});r.walletCustodyEd25519Material&&await this.persistWalletCustodyEd25519Material(r.walletCustodyEd25519Material),await G.replaceExactActive({active:r.walletSessionAuthorization.record,operationCredential:r.walletSessionAuthorization.operationCredential});let a=await this.activateEmailOtpEd25519CustodyCapabilityInternal({commitQueue:`acquire`,walletSession:e.walletSession,providerSubject:e.providerSubjectId,emailHashHex:e.emailHashHex,signerSlot:n.signerSlot,expectedOperationalPublicKey:n.operationalPublicKey,expectedThresholdSessionId:n.thresholdSessionId,bootstrap:r.ed25519YaoCapability,activeClientHandle:r.activeClientHandle,metadata:r.metadata,authority:i,exactAuthorization:r.walletSessionAuthorization});return await Bt(this.walletCustodyCeremonyTransportV1(),{existingEnvelope:r.ed25519ExportRootCustody.existingEnvelope,existingFactorSecret:r.ed25519ExportRootCustody.factorSecret32,walletId:String(e.walletSession.walletId),walletAuthMethodId:String(r.walletSessionAuthorization.record.authMethodId),walletSessionId:String(r.walletSessionAuthorization.operationCredential.walletSessionId),expiresAtMs:r.walletSessionAuthorization.record.expiresAtMs}),a}catch(e){throw await Zw({workerContext:this.signerWorkerManager.getContext(),activeClientHandle:r.activeClientHandle}).catch(()=>void 0),e}finally{r.ed25519ExportRootCustody.factorSecret32.fill(0)}}async requestEmailOtpSigningSessionChallenge(e){return await Ab(this.emailOtpPublicDeps,e)}async refreshEmailOtpSigningSession(e){return await jb(this.emailOtpPublicDeps,e)}async enrollEmailOtpInternal(e){return await Mb(this.emailOtpPublicDeps,e)}async prepareEmailOtpRegistrationEnrollmentMaterialInternal(e){return await Nb(this.emailOtpPublicDeps,e)}async getWarmThresholdEd25519SessionStatus(e){let t=R(e.walletId),n=await nt({walletId:t,nearAccountId:Hi(e.nearAccountId),nearEd25519SigningKeyId:Ho(e.nearEd25519SigningKeyId)});if(n.kind===`missing`)return null;if(n.kind!==`resolved`)throw Error(`[WarmSessionStore] Ed25519 sealed runtime is ${n.kind}`);let r=await this.resolveActiveNearEd25519WalletSessionAuthorization(t);return await dO(this.warmCapabilitiesPublicDeps,{runtime:n.runtime,authorization:r,nowMs:Date.now()})}async scheduleRouterAbEcdsaDerivationLoginPresignaturePrefill(e,t){let n=await this.listPreprocessingCapabilities({walletId:e.walletId,chainTargets:[e.chainTarget]},t),r=n.length===1?n[0]:null;return r?await fO(this.warmCapabilitiesPublicDeps,{capability:r,waitForPoolReady:e.waitForPoolReady}):{status:`skipped`,reason:`exact_wallet_session_unavailable`,walletSessionId:null}}async clearVolatileWarmSigningMaterial(e){let t=this.clearVolatileWarmSigningMaterialInternal(e);this.volatileWarmSigningMaterialCleanupInFlight=t;try{await t}finally{this.volatileWarmSigningMaterialCleanupInFlight===t&&(this.volatileWarmSigningMaterialCleanupInFlight=null)}}async deleteDurableEcdsaPresignatures(e){return await new gs().deleteClientPresignatures(e)}async clearVolatileWarmSigningMaterialInternal(e){try{e?this.enginePorts.ed25519YaoActiveClients.disposeWallet(e):this.enginePorts.ed25519YaoActiveClients.dispose()}finally{try{await mO(this.warmCapabilitiesPublicDeps,e)}finally{try{e===void 0?await this.clearLinkedEcdsaHolderMaterials():await this.clearLinkedEcdsaHolderMaterialsForWallet(e)}finally{await this.signerWorkerManager.clearEcdsaClientWorkerState(e===void 0?{kind:`all`}:{kind:`wallet`,walletId:e})}}}}onSdkLifecycleEvent(e){return this.sdkLifecycleEventListeners.add(e),this.removeSdkLifecycleEventListener.bind(this,e)}publishSdkLifecycleEvent(e){let t=xN(e);if(!this.deliveredSdkLifecycleEventKeys.has(t)){this.deliveredSdkLifecycleEventKeys.add(t);for(let t of Array.from(this.sdkLifecycleEventListeners))t(e)}}publishNearProvisioningLifecycleEvent(e,t){this.publishSdkLifecycleEvent(ns({walletId:e,state:t}))}removeSdkLifecycleEventListener(e){this.sdkLifecycleEventListeners.delete(e)}dispose(){this.signingSessionLifecycleSubscription.unsubscribe(),this.nearProvisioningUnsubscribe(),this.sdkLifecycleEventListeners.clear(),this.deliveredSdkLifecycleEventKeys.clear(),this.ed25519YaoPageLifecycleOwner.dispose()}clearThresholdEcdsaSigningQueue(){Rf(this.thresholdEcdsaSigningQueueByKey)}async clearLinkedEcdsaHolderMaterials(){await gd({workerCtx:this.signerWorkerManager.getContext()}),Fd()}async clearLinkedEcdsaHolderMaterialsForWallet(e){let t=mf(e),n;for(let e of t)try{await dd({holderHandleIds:[e.holderHandleId],workerCtx:this.signerWorkerManager.getContext()}),kd(e)}catch(e){n??=e}if(n!==void 0)throw n}};function DN(e){let t=i(e.rpId);if(!t.ok)throw Error(t.error.message);let n=m(e.credentialIdB64u);if(!n.ok)throw Error(n.error.message);let r=String(e.credentialPublicKeyB64u||``).trim();if(!r)throw Error(`Wallet add-passkey finalize omitted credential public key`);if(I(r).byteLength===0)throw Error(`Wallet add-passkey finalize returned an empty credential public key`);if(!Number.isSafeInteger(e.counter)||e.counter<0)throw Error(`Wallet add-passkey finalize returned an invalid credential counter`);let a=Date.now();return{version:`wallet_auth_method_v1`,kind:`passkey`,status:`active`,localStatus:`synced`,walletId:e.walletId,rpId:t.value,credentialIdB64u:n.value,credentialPublicKeyB64u:r,counter:e.counter,createdAtMs:a,updatedAtMs:a}}async function ON(e){await K.upsertWalletAuthMethod(DN(e))}async function kN(e){await ON(e);let t=c(e.walletAuthMethodId),n=r(e.walletAuthorityId);if(!t.ok||!n.ok)throw Error(`added passkey identity is invalid`);await jN({walletId:e.walletId,walletAuthMethodId:t.value,walletAuthorityId:n.value,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,credentialPublicKeyB64u:e.credentialPublicKeyB64u,counter:e.counter});let i=new Date().toISOString();await K.upsertProfileAuthenticator({profileId:String(e.walletId),signerSlot:e.signerSlot,credentialId:e.credentialIdB64u,credentialPublicKey:I(e.credentialPublicKeyB64u),registered:i,syncedAt:i})}function AN(e){let t=i(e.rpId),n=m(e.credentialIdB64u),a=c(e.walletAuthMethodId),o=r(e.walletAuthorityId),s=String(e.credentialPublicKeyB64u||``).trim();if(!t.ok||!n.ok||!a.ok||!o.ok)throw Error(`Synced passkey auth-method identity is invalid`);if(!s||I(s).byteLength===0)throw Error(`Synced passkey auth method omitted credential public key`);if(!Number.isSafeInteger(e.counter)||e.counter<0)throw Error(`Synced passkey auth method returned an invalid credential counter`);let l=Date.now(),u=Mo({version:`wallet_auth_method_v2`,walletAuthMethodId:a.value,walletId:e.walletId,walletAuthorityId:o.value,kind:`passkey`,status:`active`,rpId:t.value,credentialIdB64u:n.value,credentialPublicKeyB64u:s,counter:e.counter,createdAtMs:l,updatedAtMs:l,activatedAtMs:l});if(u.kind!==`passkey`||u.status!==`active`)throw Error(`Synced passkey auth method branch is invalid`);return u}async function jN(e){await K.upsertWalletAuthMethodV2(AN(e))}function MN(e){if(!e||!(e instanceof PublicKeyCredential))throw Error(`Passkey registration did not return a public-key credential`);return e}function NN(e){return{challenge:I(e.challengeB64u),rp:{id:e.rpId,name:e.rpId},user:{id:I(e.user.idB64u),name:e.user.name,displayName:e.user.displayName},pubKeyCredParams:e.pubKeyCredParams.map(e=>({type:e.type,alg:e.alg})),authenticatorSelection:e.authenticatorSelection,timeout:e.timeoutMs,attestation:e.attestation,excludeCredentials:e.excludeCredentials.map(e=>({type:e.type,id:I(e.id)})),extensions:{prf:{eval:{first:I(e.extensions.prf.eval.firstB64u),second:I(e.extensions.prf.eval.secondB64u)}}}}}function PN(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`Passkey custody worker returned no resealed envelope`);let t=e;return{nonceB64u:dn(t.nonceB64u,`resealed envelope nonceB64u`),sealedCustodySecretB64u:gn(t.sealedCustodySecretB64u,`resealed envelope sealedCustodySecretB64u`),aadHashB64u:bn(t.aadHashB64u,`resealed envelope aadHashB64u`),ciphertextDigestB64u:bn(t.ciphertextDigestB64u,`resealed envelope ciphertextDigestB64u`)}}function FN(e){if(e.kind!==`unlocked_capability`)throw Error(`wallet custody reseal source is not an unlocked capability`);return e.capability}function IN(e){let t=m(e);if(!t.ok)throw Error(`Passkey registration credential id is invalid: ${t.error.message}`);return t.value}async function LN(e){let t=e.registrationCredential?e.registrationCredential:cc({credential:MN(await navigator.credentials.create({publicKey:NN(e.registration)})),firstPrfOutput:!0,secondPrfOutput:!1}),n=uc(t);if(!n)throw Error(`New passkey did not return PRF.first`);let r=IN(t.rawId||t.id),i=C(pe(`wallet-custody-envelope`,24,`wallet custody envelope ids`));if(!i.ok)throw Error(i.error.message);let a=ei({rpId:e.registration.rpId,credentialIdB64u:r}),o=oi(e.walletAuthMethodId),s=ii({walletId:e.existingEnvelope.walletId,envelopeId:i.value,factor:a,envelopeRevision:In(1),binding:e.existingEnvelope.binding,ownership:o}),c=I(n),l=e.sealSource.kind===`factor_secret`?e.sealSource.existingFactorSecret.slice():null,u;try{u=PN(l===null?await e.worker.requestOperation({kind:`walletCustodyCeremony`,request:{type:`resealWalletCustodyFromUnlockedCapability`,payload:{capability:FN(e.sealSource),replacementEnvelopeBindingJson:s,replacementFactorSecret:c.buffer},transfer:[c.buffer]}}):await e.worker.requestOperation({kind:`walletCustodyCeremony`,request:{type:`linkWalletCustodyPasskey`,payload:{existingEnvelope:e.existingEnvelope,existingFactorSecret:l.buffer,replacementEnvelopeBindingJson:s,replacementFactorSecret:c.buffer},transfer:[l.buffer,c.buffer]}}))}finally{l&&l.byteLength>0&&l.fill(0),c.byteLength>0&&c.fill(0)}let d=(e.nowMs??Date.now)();return{registration:t,custodyEnvelope:ti(si({envelopeId:i.value,walletId:e.existingEnvelope.walletId,ownership:o,binding:e.existingEnvelope.binding,factor:a,envelopeRevision:In(1),nonceB64u:u.nonceB64u,sealedCustodySecretB64u:u.sealedCustodySecretB64u,ciphertextDigestB64u:u.ciphertextDigestB64u,aadHashB64u:u.aadHashB64u,lifecycle:{state:`active`,activatedAtMs:d},createdAtMs:d,updatedAtMs:d}))}}async function RN(e){let t=await bc({relayerUrl:e.relayerUrl,walletId:e.walletId,addAuthMethodIntentGrant:e.addAuthMethodIntentGrant,addAuthMethodIntentDigestB64u:e.addAuthMethodIntentDigestB64u,intent:e.intent,auth:e.auth,authority:{kind:`passkey`}});if(!t.custodyEnvelope||!t.registration)throw Error(`Passkey add-auth-method start omitted custody envelope or registration options`);let n=await LN({registration:t.registration,walletAuthMethodId:e.walletAuthMethodId,existingEnvelope:t.custodyEnvelope,sealSource:e.sealSource,worker:e.worker,...e.createRegistrationCredential?{registrationCredential:await e.createRegistrationCredential(t.registration)}:{},nowMs:e.nowMs});return{finalized:await Pc({relayerUrl:e.relayerUrl,walletId:e.walletId,addAuthMethodCeremonyId:t.addAuthMethodCeremonyId,webauthnRegistration:n.registration,custodyEnvelope:n.custodyEnvelope})}}async function zN(e){let t=await K.resolveSelectedWalletAuthority(String(e));if(t.kind!==`resolved`)return{kind:`unavailable`,reason:`selected wallet authority is ${t.kind}`};if(t.authMethod.status!==`active`)return{kind:`unavailable`,reason:`selected auth method is not active`};if(t.authority.state!==`active`)return{kind:`unavailable`,reason:`selected wallet authority is not active`};if(t.selection.lockState!==`unlocked`||t.selection.walletId!==e||t.selection.walletAuthMethodId!==t.authMethod.walletAuthMethodId||t.authMethod.walletId!==e||t.authMethod.walletAuthorityId!==t.authority.authorityId||t.authority.walletId!==e)return{kind:`unavailable`,reason:`selected wallet authority identity is invalid`};let n;try{n=await G.readExactWithOperationCredential({walletId:e,authorityId:t.authority.authorityId,authMethodId:t.authMethod.walletAuthMethodId})}catch{return{kind:`unavailable`,reason:`exact Wallet Session state is corrupt`}}return n.kind===`found`?n.record.walletId!==e||n.record.authorityId!==t.authority.authorityId||n.record.authMethodId!==t.authMethod.walletAuthMethodId||n.record.authorityDigestB64u!==t.authority.authorityDigestB64u||n.record.authorityRevocationEpoch!==t.authority.revocationEpoch||n.record.expiresAtMs<=Date.now()?{kind:`unavailable`,reason:`exact Wallet Session identity is invalid or expired`}:{kind:`resolved`,sourceAuthMethod:t.authMethod,source:{walletAuthorityId:t.authMethod.walletAuthorityId,walletAuthMethodId:t.authMethod.walletAuthMethodId,walletSessionId:String(n.operationCredential.walletSessionId),authorityDigestB64u:String(t.authority.authorityDigestB64u),revocationEpoch:t.authority.revocationEpoch}}:{kind:`unavailable`,reason:`exact Wallet Session is ${n.kind}`}}function BN(e){return[{id:e.credentialIdB64u,type:`public-key`,transports:[]}]}async function VN(e){if(e.finalized.walletId!==e.walletId||e.finalized.rpId!==e.rpId||e.finalized.authMethod.kind!==`passkey`||e.finalized.authMethod.status!==`active`)throw Error(`Wallet add-passkey finalize returned a mismatched auth method`);return await ON({walletId:e.finalized.walletId,rpId:e.finalized.rpId,credentialIdB64u:e.finalized.authMethod.credentialIdB64u,credentialPublicKeyB64u:e.finalized.authMethod.credentialPublicKeyB64u,counter:e.finalized.authMethod.counter}),{ok:!0,walletId:e.finalized.walletId,rpId:e.finalized.rpId,walletAuthMethodId:e.walletAuthMethodId,authMethod:{kind:`passkey`,status:`active`}}}function HN(e){let t=e.signingEngine.getSignerWorkerContext();return{requestOperation:sn.bind(void 0,t)}}async function UN(e){let t=String(e.context.configs.network.relayer.url||``).trim();if(!t)throw Error(`registration.addPasskey requires relayer.url`);let n=ze(e.context.configs);if(!n)throw Error(`registration.addPasskey requires registration.publishableKey and registration.projectEnvironmentId`);let r=await zN(e.walletId);if(r.kind!==`resolved`)throw Error(`Wallet add-passkey requires a selected active source: ${r.reason}`);let i=await Oc({relayerUrl:t,walletId:e.walletId,request:{walletId:e.walletId,rpId:e.rpId,authMethod:{kind:`passkey`,rpId:e.rpId},caller:{caller:`same_device_addition`,source:r.source}},auth:{publishableKey:n.publishableKey,environmentId:n.projectEnvironmentId}});if(await Qr(i.intent)!==i.addAuthMethodIntentDigestB64u)throw Error(`Add-auth-method intent digest mismatch`);if(i.intent.walletId!==e.walletId||i.intent.authMethod.kind!==`passkey`||i.intent.authMethod.rpId!==e.rpId)throw Error(`Add-auth-method intent identity changed`);let a=await K.getProfile(String(e.walletId));if(!a||!Number.isSafeInteger(a.defaultSignerSlot)||a.defaultSignerSlot<1)throw Error(`Wallet add-passkey requires an initialized wallet profile`);if(r.sourceAuthMethod.kind===`email_otp`)return await WN({context:e.context,walletId:e.walletId,rpId:e.rpId,relayerUrl:t,profile:a,sourceWalletAuthorityId:r.source.walletAuthorityId,sourceWalletAuthMethodId:r.source.walletAuthMethodId,intentResponse:i,...e.options?{options:e.options}:{}});let o=BN(r.sourceAuthMethod),s=await e.context.signingEngine.getAuthenticationCredentialsSerialized({subjectId:String(e.walletId),challengeB64u:i.addAuthMethodIntentDigestB64u,allowCredentials:o,includeSecondPrfOutput:!1}),c=st(s);if(!c||!o.some(e=>e.id===c))throw Error(`Wallet add-passkey selected a credential outside the authorized wallet`);let l=I(Le(s,`Wallet add-passkey custody linking`));try{let n=await RN({relayerUrl:t,walletId:e.walletId,addAuthMethodIntentGrant:i.addAuthMethodIntentGrant,addAuthMethodIntentDigestB64u:i.addAuthMethodIntentDigestB64u,intent:i.intent,auth:{kind:`webauthn_assertion`,rpId:e.rpId,credential:hc(s),expectedChallengeDigestB64u:i.addAuthMethodIntentDigestB64u},sealSource:{kind:`factor_secret`,existingFactorSecret:l},walletAuthMethodId:i.intent.targetWalletAuthMethodId,worker:HN(e.context),createRegistrationCredential:async t=>{let n=await e.context.signingEngine.requestRegistrationCredentialConfirmation({walletId:String(e.walletId),signerSlot:a.defaultSignerSlot,confirmerText:e.options?.confirmerText,confirmationConfigOverride:e.options?.confirmationConfig,registrationOptions:t});if(!n.confirmed)throw Error(`Wallet add-passkey registration was cancelled`);return n.credential}});return await VN({walletId:e.walletId,rpId:e.rpId,walletAuthMethodId:i.intent.targetWalletAuthMethodId,finalized:n.finalized})}finally{l.fill(0)}}async function WN(e){let t=kt(String(e.walletId));if(!t)throw Error(`Wallet add-passkey from an Email OTP source requires an unlocked wallet`);let n=async()=>await vc({relayerUrl:e.relayerUrl,walletId:e.walletId,addAuthMethodIntentGrant:e.intentResponse.addAuthMethodIntentGrant,addAuthMethodIntentDigestB64u:e.intentResponse.addAuthMethodIntentDigestB64u}),r=await n(),i=await e.context.signingEngine.requestEmailOtpEnrollmentConfirmation({walletId:String(e.walletId),emailAddress:r.emailHint||`your email`,challengeId:r.challengeId,...r.emailHint?{emailHint:r.emailHint}:{},confirmerText:{title:`Enter email code to add a passkey`,body:`This one-time code confirms you can add a new passkey to this wallet.`},...e.options?.confirmationConfig?{confirmationConfigOverride:e.options.confirmationConfig}:{},onResend:n}),a=(await RN({relayerUrl:e.relayerUrl,walletId:e.walletId,addAuthMethodIntentGrant:e.intentResponse.addAuthMethodIntentGrant,addAuthMethodIntentDigestB64u:e.intentResponse.addAuthMethodIntentDigestB64u,intent:e.intentResponse.intent,auth:{kind:`email_otp`,challengeId:i.challengeId,otpCode:i.otpCode,expectedChallengeDigestB64u:e.intentResponse.addAuthMethodIntentDigestB64u},sealSource:{kind:`unlocked_capability`,capability:t},walletAuthMethodId:e.intentResponse.intent.targetWalletAuthMethodId,worker:HN(e.context),createRegistrationCredential:async t=>{let n=await e.context.signingEngine.requestRegistrationCredentialConfirmation({walletId:String(e.walletId),signerSlot:e.profile.defaultSignerSlot,confirmerText:e.options?.confirmerText,confirmationConfigOverride:e.options?.confirmationConfig,registrationOptions:t});if(!n.confirmed)throw Error(`Wallet add-passkey registration was cancelled`);return n.credential}})).finalized;if(a.walletId!==e.walletId||a.authMethod.kind!==`passkey`||a.authMethod.status!==`active`)throw Error(`Wallet add-passkey finalize returned a mismatched auth method`);return await kN({walletId:e.walletId,walletAuthMethodId:e.intentResponse.intent.targetWalletAuthMethodId,walletAuthorityId:e.sourceWalletAuthorityId,rpId:String(e.rpId),credentialIdB64u:a.authMethod.credentialIdB64u,credentialPublicKeyB64u:a.authMethod.credentialPublicKeyB64u,counter:a.authMethod.counter,signerSlot:e.profile.defaultSignerSlot,credential:{id:a.authMethod.credentialIdB64u,rawId:a.authMethod.credentialIdB64u}}),await Ds({walletId:e.walletId,walletAuthorityId:e.sourceWalletAuthorityId,sourceWalletAuthMethodId:e.sourceWalletAuthMethodId,targetAuthority:await L({authority:a.authority})}),{ok:!0,walletId:e.walletId,rpId:String(e.rpId),walletAuthMethodId:e.intentResponse.intent.targetWalletAuthMethodId,authMethod:{kind:`passkey`,status:`active`}}}async function GN(e){let t=Uo(String(e.walletId||``).trim()),n=i(String(e.rpId||``).trim());if(!n.ok)throw Error(n.error.message);try{let r=await UN({context:e.context,walletId:t,rpId:n.value,options:e.options});return await e.options?.afterCall?.(!0,r),r}catch(t){let n=N(t);try{e.options?.onError?.(n)}finally{await e.options?.afterCall?.(!1)}throw n}}function KN(e){return Array.isArray(e)?e.filter(e=>[`ble`,`hybrid`,`internal`,`nfc`,`smart-card`,`usb`].includes(String(e))):[]}function qN(e){let t=new Set;for(let n of e.authMethods)n.kind===`passkey`&&n.status===`active`&&n.walletId===e.walletId&&t.add(n.credentialIdB64u);let n=[];for(let r of e.authenticators){let i=String(r.credentialId||``).trim();!i||i===e.excludeCredentialIdB64u||!t.has(i)||n.push({id:i,type:`public-key`,transports:KN(r.transports)})}return n}async function JN(e){let[t,n]=await Promise.all([K.listProfileAuthenticators(String(e.walletId)),K.listWalletAuthMethodsV2ForWallet(String(e.walletId))]);return qN({walletId:e.walletId,authenticators:t,authMethods:n,excludeCredentialIdB64u:e.excludeCredentialIdB64u})}async function YN(e){let t=await e.context.signingEngine.getAuthenticationCredentialsSerialized({subjectId:String(e.walletId),challengeB64u:e.operationFingerprintDigest,allowCredentials:e.allowCredentials,includeSecondPrfOutput:!1}),n=st(t);if(!n||!e.allowCredentials.some(e=>e.id===n))throw Error(`registration.revokeAuthMethod used a credential outside the wallet`);return{kind:`webauthn_assertion`,rpId:e.rpId,credential:hc(t),expectedChallengeDigestB64u:e.operationFingerprintDigest}}async function XN(e){let[t,...n]=(await K.listWalletAuthMethodsForWallet(String(e.walletId))).filter(t=>t.kind===`email_otp`&&t.status===`active`&&String(t.walletId)===String(e.walletId)&&String(t.authority.bindingId)!==String(e.targetWalletAuthMethodId));if(!t||n.length>0||t.kind!==`email_otp`)throw Error(`registration.revokeAuthMethod needs exactly one other active method to authorize with`);let r=String(t.authority.bindingId),i=async()=>await Ge({relayUrl:e.relayerUrl,walletId:String(e.walletId),walletAuthMethodId:r,operation:Gr,operationFingerprintDigest:Lr(e.operationFingerprintDigest)}),a=await i(),o=await e.context.signingEngine.requestEmailOtpEnrollmentConfirmation({walletId:String(e.walletId),emailAddress:String(a.emailHint||``),challengeId:a.challengeId,...a.emailHint?{emailHint:a.emailHint}:{},onResend:async()=>{let e=await i();return e.emailHint?{challengeId:e.challengeId,emailHint:e.emailHint}:{challengeId:e.challengeId}}});return{kind:`email_otp`,challengeId:o.challengeId,otpCode:o.otpCode,ownerProofBindingDigest:a.ownerProofBindingDigest}}async function ZN(e){let t=String(e.context.configs.network.relayer.url||``).trim();if(!t)throw Error(`registration.revokeAuthMethod requires relayer.url`);let n=i(String(e.context.signingEngine.getRpId()||``).trim());if(!n.ok)throw Error(`registration.revokeAuthMethod ${n.error.message}`);let r=Date.now(),a=await Ao({walletId:e.walletId,targetWalletAuthMethodId:e.walletAuthMethodId,requestedAtMs:r}),o=await K.getWalletAuthMethodV2(e.walletAuthMethodId),s=o&&o.kind===`passkey`?String(o.credentialIdB64u):null,c=await JN({walletId:e.walletId,excludeCredentialIdB64u:s}),l;l=c.length>0?B.passkey:B.emailOtp;let u;switch(l){case B.passkey:u=await YN({context:e.context,walletId:e.walletId,rpId:n.value,operationFingerprintDigest:String(a),allowCredentials:c});break;case B.emailOtp:u=await XN({context:e.context,relayerUrl:t,walletId:e.walletId,targetWalletAuthMethodId:e.walletAuthMethodId,operationFingerprintDigest:String(a)});break;default:throw Error(`registration.revokeAuthMethod encountered an unsupported source method`)}let d=await yc({relayerUrl:t,walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId,requestedAtMs:r,sourceProof:u});if(!d.ok||d.authMethod.status!==`revoked`)throw Error(`registration.revokeAuthMethod did not revoke the method`);let f=await K.getWalletAuthMethodV2(e.walletAuthMethodId);if(f&&f.status!==`revoked`){let e=Date.now(),t=f.status===`active`?f.activatedAtMs:e,n=Bo({...f,status:`revoked`,activatedAtMs:t,revokedAtMs:e,updatedAtMs:e});n&&await K.upsertWalletAuthMethodV2(n)}return{ok:!0,walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId,authMethod:d.authMethod}}async function QN(e){let t=Uo(String(e.walletId||``).trim()),n=c(String(e.walletAuthMethodId||``).trim());if(!n.ok)throw Error(`registration.revokeAuthMethod requires a wallet auth method id`);try{return await ZN({context:e.context,walletId:t,walletAuthMethodId:n.value})}catch(e){throw N(e)}}function $N(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`Email OTP custody worker returned no resealed envelope`);let t=e;return{nonceB64u:dn(t.nonceB64u,`resealed envelope nonceB64u`),sealedCustodySecretB64u:gn(t.sealedCustodySecretB64u,`resealed envelope sealedCustodySecretB64u`),aadHashB64u:bn(t.aadHashB64u,`resealed envelope aadHashB64u`),ciphertextDigestB64u:bn(t.ciphertextDigestB64u,`resealed envelope ciphertextDigestB64u`)}}async function eP(e){let t=await bc({relayerUrl:e.relayerUrl,walletId:e.walletId,addAuthMethodIntentGrant:e.addAuthMethodIntentGrant,addAuthMethodIntentDigestB64u:e.addAuthMethodIntentDigestB64u,intent:e.intent,auth:e.auth,authority:e.authority});if(!t.custodyEnvelope)throw Error(`Email OTP add-auth-method start omitted the source custody envelope`);let n=t.custodyEnvelope,r=crypto.getRandomValues(new Uint8Array(32)),i=r.slice(),a;try{a=await e.context.signingEngine.prepareEmailOtpRegistrationEnrollmentMaterialInternal({relayUrl:e.relayerUrl,walletId:R(String(e.walletId)),userId:e.providerSubject,clientSecret32:r})}catch(e){throw i.fill(0),e}finally{r.fill(0)}let o=C(pe(`wallet-custody-envelope`,24,`wallet custody envelope ids`));if(!o.ok)throw Error(o.error.message);let s=$r({enrollmentId:a.enrollmentId,enrollmentSealKeyVersion:a.enrollmentSealKeyVersion}),c=oi(e.walletAuthMethodId),l=In(1),u=ii({walletId:n.walletId,envelopeId:o.value,factor:s,envelopeRevision:l,binding:n.binding,ownership:c}),d=e.existingFactorSecret.slice(),f;try{f=$N(await e.worker.requestOperation({kind:`walletCustodyCeremony`,request:{type:`linkWalletCustodyPasskey`,payload:{existingEnvelope:n,existingFactorSecret:d.buffer,replacementEnvelopeBindingJson:u,replacementFactorSecret:i.buffer},transfer:[d.buffer,i.buffer]}}))}finally{d.byteLength>0&&d.fill(0),i.byteLength>0&&i.fill(0)}let p=(e.nowMs??Date.now)(),m=ti(si({envelopeId:o.value,walletId:n.walletId,ownership:c,binding:n.binding,factor:s,envelopeRevision:l,nonceB64u:f.nonceB64u,sealedCustodySecretB64u:f.sealedCustodySecretB64u,ciphertextDigestB64u:f.ciphertextDigestB64u,aadHashB64u:f.aadHashB64u,lifecycle:{state:`active`,activatedAtMs:p},createdAtMs:p,updatedAtMs:p}));return{finalized:await Pc({relayerUrl:e.relayerUrl,walletId:e.walletId,addAuthMethodCeremonyId:t.addAuthMethodCeremonyId,custodyEnvelope:m,emailOtpTarget:{kind:`new_enrollment`,enrollment:a.emailOtpEnrollment}})}}async function tP(e){if(!$n(e.authority))throw Error(`Wallet add-email-code finalize returned a non-Email authority`);let t=c(e.walletAuthMethodId);if(!t.ok)throw Error(t.error.message);let n=r(e.walletAuthorityId);if(!n.ok)throw Error(n.error.message);let i=String(e.authority.verifier.emailHashHex||``).trim();if(!i)throw Error(`Wallet add-email-code finalize returned no verified email digest`);let a=String(e.authority.factor.providerUserId||``).trim();if(!a)throw Error(`Wallet add-email-code finalize returned no provider identity`);let o=w(e.emailAddress);if(!o.ok)throw Error(o.error.message);let s=Date.now();await K.upsertWalletAuthMethod({version:`wallet_auth_method_v1`,kind:`email_otp`,status:`active`,localStatus:`synced`,walletId:e.walletId,emailHashHex:i,registrationAuthorityId:a,authority:e.authority,createdAtMs:s,updatedAtMs:s}),await K.upsertWalletAuthMethodV2(Mo({version:`wallet_auth_method_v2`,walletAuthMethodId:t.value,walletId:e.walletId,walletAuthorityId:n.value,kind:`email_otp`,status:`active`,emailHashHex:i,registrationAuthorityId:a,createdAtMs:s,updatedAtMs:s,activatedAtMs:s}));let l=await K.retainVerifiedEmailOtpLocalPresentation({walletId:e.walletId,walletAuthMethodId:t.value,emailAddress:o.value});if(l.kind!==`retained`)throw Error(`Verified Email OTP presentation was not retained: ${l.reason}`)}function nP(e){let t=e.signingEngine.getSignerWorkerContext();return{requestOperation:sn.bind(void 0,t)}}function rP(e){return e}function iP(e){let t=String(e||``).trim().toLowerCase();if(!t||!t.includes(`@`))throw Error(`registration.addEmailOtp requires an email address`);return t}async function aP(e){let t=String(e.context.configs.network.relayer.url||``).trim();if(!t)throw Error(`registration.addEmailOtp requires relayer.url`);let n=ze(e.context.configs);if(!n)throw Error(`registration.addEmailOtp requires registration.publishableKey and registration.projectEnvironmentId`);let r=iP(e.emailAddress),a=rP(r),o=i(String(e.context.signingEngine.getRpId()||``).trim());if(!o.ok)throw Error(`registration.addEmailOtp ${o.error.message}`);let s=o.value,c=await zN(e.walletId);if(c.kind!==`resolved`)throw Error(`Wallet add-email-code requires a selected active source: ${c.reason}`);if(c.sourceAuthMethod.kind!==`passkey`)throw Error(`Wallet add-email-code requires a selected active passkey source`);let l=await Oc({relayerUrl:t,walletId:e.walletId,request:{walletId:e.walletId,rpId:String(s),authMethod:{kind:`email_otp`,email:r},caller:{caller:`same_device_addition`,source:c.source}},auth:{publishableKey:n.publishableKey,environmentId:n.projectEnvironmentId}});if(await Qr(l.intent)!==l.addAuthMethodIntentDigestB64u)throw Error(`Add-auth-method intent digest mismatch`);if(l.intent.walletId!==e.walletId||l.intent.authMethod.kind!==`email_otp`||l.intent.authMethod.email!==r)throw Error(`Add-auth-method intent identity changed`);let u=await K.getProfile(String(e.walletId));if(!u||!Number.isSafeInteger(u.defaultSignerSlot)||u.defaultSignerSlot<1)throw Error(`Wallet add-email-code requires an initialized wallet profile`);let d=BN(c.sourceAuthMethod),f=await e.context.signingEngine.getAuthenticationCredentialsSerialized({subjectId:String(e.walletId),challengeB64u:l.addAuthMethodIntentDigestB64u,allowCredentials:d,includeSecondPrfOutput:!1}),p=st(f);if(!p||!d.some(e=>e.id===p))throw Error(`Wallet add-email-code selected a credential outside the authorized wallet`);let m=Le(f,`Wallet add-email-code custody linking`),h=async()=>await vc({relayerUrl:t,walletId:e.walletId,addAuthMethodIntentGrant:l.addAuthMethodIntentGrant,addAuthMethodIntentDigestB64u:l.addAuthMethodIntentDigestB64u}),g=await h(),_=await e.context.signingEngine.requestEmailOtpEnrollmentConfirmation({walletId:String(e.walletId),emailAddress:r,challengeId:g.challengeId,...g.emailHint?{emailHint:g.emailHint}:{},...e.options?.confirmerText?{confirmerText:e.options.confirmerText}:{},...e.options?.confirmationConfig?{confirmationConfigOverride:e.options.confirmationConfig}:{},onResend:h}),v=await Ce({authMethod:{kind:`email_otp`,proofKind:`otp_challenge`,email:r,providerSubject:a,otpCode:_.otpCode,challengeId:_.challengeId},relayUrl:t,walletId:String(e.walletId),registrationIntentDigestB64u:l.addAuthMethodIntentDigestB64u}),y=I(m);try{let n=await eP({context:e.context,relayerUrl:t,walletId:e.walletId,addAuthMethodIntentGrant:l.addAuthMethodIntentGrant,addAuthMethodIntentDigestB64u:l.addAuthMethodIntentDigestB64u,intent:l.intent,auth:{kind:`webauthn_assertion`,rpId:s,credential:hc(f),expectedChallengeDigestB64u:l.addAuthMethodIntentDigestB64u},authority:{kind:`email_otp`,emailOtpRegistrationProof:v.proof},existingFactorSecret:y,walletAuthMethodId:l.intent.targetWalletAuthMethodId,providerSubject:a,worker:nP(e.context)});if(n.finalized.walletId!==e.walletId||n.finalized.authMethod.kind!==`email_otp`||n.finalized.authMethod.status!==`active`)throw Error(`Wallet add-email-code finalize returned a mismatched auth method`);return await tP({walletId:e.walletId,walletAuthMethodId:l.intent.targetWalletAuthMethodId,walletAuthorityId:c.source.walletAuthorityId,emailAddress:r,authority:n.finalized.authority}),await Ds({walletId:e.walletId,walletAuthorityId:c.source.walletAuthorityId,sourceWalletAuthMethodId:c.source.walletAuthMethodId,targetAuthority:await L({authority:n.finalized.authority})}),{ok:!0,walletId:e.walletId,emailAddress:r,walletAuthMethodId:l.intent.targetWalletAuthMethodId,authMethod:{kind:`email_otp`,status:`active`}}}finally{y.fill(0)}}async function oP(e){let t=Uo(String(e.walletId||``).trim());try{let n=await aP({context:e.context,walletId:t,emailAddress:e.emailAddress,options:e.options});return await e.options?.afterCall?.(!0,n),n}catch(t){let n=N(t);try{e.options?.onError?.(n)}finally{await e.options?.afterCall?.(!1)}throw n}}function sP(e){return{controller:new wu({ensureIframe:e.ensureIframe})}}let cP=!1;function lP(e){if(!cP)try{let t=new URL(e);typeof window<`u`&&t.origin===window.location.origin&&(cP=!0,console.warn(`[SeamsWeb] wallet.iframe.origin matches the host origin. Consider moving the wallet to a dedicated origin for stronger isolation.`))}catch{}}async function uP(e){lP(e.walletOrigin);let{WalletIframeRouter:t}=await import(`./router-Dd3fFHk3.js`),n=e.configs.signing.sessionPersistenceMode;return new t({walletOrigin:e.walletOrigin,servicePath:e.configs.wallet.iframe?.servicePath||`/wallet-service`,connectTimeoutMs:2e4,requestTimeoutMs:6e4,chains:e.configs.network.chains,relayerAccount:e.configs.network.relayer.accountId,relayer:e.configs.network.relayer,registration:e.configs.registration,signingSessionDefaults:e.configs.signing.sessionDefaults,signingSessionPersistenceMode:n,routerAb:e.configs.signing.routerAb,routerAbEcdsaDerivationPresignaturePool:e.configs.signing.routerAbEcdsaDerivation.presignaturePool,provisioningDefaults:e.configs.signing.thresholdEcdsa.provisioningDefaults,rpIdOverride:e.configs.wallet.iframe?.rpIdOverride,authenticatorOptions:lr(e.configs.webauthn.authenticatorOptions),appearance:e.getAppearance(),getAppearance:e.getAppearance,sdkBasePath:e.configs.wallet.iframe?.sdkBasePath,createOverlayState:sP})}function dP(e,t){let n=i(e);if(!n.ok)throw Error(`${t}: ${n.error.message}`);return n.value}function fP(e){try{return new URL(e).hostname}catch{throw Error(`[SeamsWeb] Wallet iframe origin is not a valid URL.`)}}var pP=class{constructor(e){this.iframeRouter=null,this.walletIframeRouterCreationInFlight=null,this.walletIframeInitInFlight=null,this.walletIframeDisposed=!1,this.walletIframePrefsUnsubscribe=null,this.walletIframeLifecycleUnsubscribe=null,this.walletIframeAuthMenuUnsubscribe=null,this.walletIframeAuthMenuDemoOtpUnsubscribe=null,this.sdkLifecycleEventListeners=new Set,this.hostedAuthMenuExternalAuthRequestListeners=new Set,this.hostedAuthMenuDemoEmailOtpDeliveryListeners=new Set,this.configs=e.configs,this.signingEngine=e.signingEngine,this.userPreferences=e.userPreferences,this.getAppearance=e.getAppearance,this.forwardSdkLifecycleEventListener=this.forwardSdkLifecycleEvent.bind(this),this.forwardHostedAuthMenuExternalAuthRequestListener=this.forwardHostedAuthMenuExternalAuthRequest.bind(this),this.forwardHostedAuthMenuDemoEmailOtpDeliveryListener=this.forwardHostedAuthMenuDemoEmailOtpDelivery.bind(this)}shouldUseWalletIframe(){return this.configs.wallet.mode===`iframe`&&!Xl()}resolveRegistrationRpId(e){if(!this.shouldUseWalletIframe())return dP(e,`[SeamsWeb] Local registration RP ID is invalid`);let t=this.configs.wallet.iframe,n=String(t.rpIdOverride||``).trim();if(n)return dP(n,`[SeamsWeb] Wallet iframe registration RP ID is invalid`);let r=t.origin;if(!r)throw Error(`[SeamsWeb] Wallet iframe registration requires a wallet origin.`);return dP(fP(r),`[SeamsWeb] Wallet iframe origin hostname is not a valid registration RP ID`)}isReady(){return!!this.iframeRouter?.isReady()}getTransportDiagnosticsSnapshot(){return this.iframeRouter?.getTransportDiagnosticsSnapshot()??null}dispose(){this.walletIframeDisposed||(this.walletIframeDisposed=!0,this.iframeRouter?.dispose())}onReady(e){let t=this.iframeRouter;return t?t.onReady(e):()=>{}}onLoginStatusChanged(e){let t=this.iframeRouter;return t?t.onLoginStatusChanged(e):()=>{}}onSdkLifecycleEvent(e){return this.sdkLifecycleEventListeners.add(e),this.iframeRouter&&this.ensureWalletIframeLifecycleMirror(this.iframeRouter),this.removeSdkLifecycleEventListener.bind(this,e)}onPreferencesChanged(e){let t=this.iframeRouter;return t?t.onPreferencesChanged(e):()=>{}}async init(e){if(!this.shouldUseWalletIframe())return await this.signingEngine.warmCriticalResources({kind:`none`}),{kind:`wallet_locked`};if(Xl())return{kind:`wallet_locked`};let t=this.configs.wallet.iframe?.origin;if(!t)return{kind:`wallet_locked`};if(this.iframeRouter){this.ensureWalletIframePreferencesMirror(this.iframeRouter),this.ensureWalletIframeLifecycleMirror(this.iframeRouter),this.ensureWalletIframeAuthMenuMirror(this.iframeRouter),await this.iframeRouter.init();try{await this.iframeRouter.prefetchBlockheight()}catch{}}else{this.walletIframeInitInFlight||=(async()=>{let e=await this.getOrCreateRouter(t);await e.init();try{await e.prefetchBlockheight()}catch{}})();try{await this.walletIframeInitInFlight}finally{this.walletIframeInitInFlight=null}}if(this.iframeRouter){let e=this.iframeRouter.getMirroredExactSessionState();e.kind!==`wallet_locked`&&this.userPreferences.setCurrentWallet(e.walletId);let t=await this.iframeRouter.getConfirmationConfig().catch(()=>null);if(t){let n=e.kind===`wallet_locked`?null:e.walletId;this.userPreferences.applyWalletHostConfirmationConfig({walletId:n,confirmationConfig:t})}return e}return{kind:`wallet_locked`}}async getExactSessionState(){return await(await this.requireRouter()).getExactSessionState()}async openHostedAuthMenu(e,t){return await(await this.requireTransportRouter()).openHostedAuthMenu(e,t)}async cancelHostedAuthMenu(e){await(await this.requireRouter()).cancelHostedAuthMenu(e)}onHostedAuthMenuExternalAuthRequest(e){return this.hostedAuthMenuExternalAuthRequestListeners.add(e),this.iframeRouter&&this.ensureWalletIframeAuthMenuMirror(this.iframeRouter),this.removeHostedAuthMenuExternalAuthRequestListener.bind(this,e)}onHostedAuthMenuDemoEmailOtpDelivery(e){return this.hostedAuthMenuDemoEmailOtpDeliveryListeners.add(e),this.iframeRouter&&this.ensureWalletIframeAuthMenuMirror(this.iframeRouter),this.removeHostedAuthMenuDemoEmailOtpDeliveryListener.bind(this,e)}async resolveHostedAuthMenuExternalAuth(e){await(await this.requireRouter()).resolveHostedAuthMenuExternalAuth(e)}async lockExactSession(e){return await(await this.requireRouter(String(e.walletId))).lockExactSession(e)}async requireRouter(e){if(!this.shouldUseWalletIframe())throw Error(`[SeamsWeb] Wallet iframe is not configured.`);if(this.iframeRouter||await this.init(e),!this.iframeRouter)throw Error(`[SeamsWeb] Wallet iframe is configured but unavailable.`);return this.iframeRouter}async requireTransportRouter(){if(!this.shouldUseWalletIframe())throw Error(`[SeamsWeb] Wallet iframe is not configured.`);let e=this.configs.wallet.iframe?.origin;if(!e)throw Error(`[SeamsWeb] Wallet iframe is configured but unavailable.`);return await this.getOrCreateRouter(e)}async getOrCreateRouter(e){if(this.iframeRouter)return this.iframeRouter;this.walletIframeRouterCreationInFlight??=uP({configs:this.configs,walletOrigin:e,getAppearance:this.getAppearance});try{let e=await this.walletIframeRouterCreationInFlight;return this.iframeRouter=e,this.ensureWalletIframePreferencesMirror(e),this.ensureWalletIframeLifecycleMirror(e),this.ensureWalletIframeAuthMenuMirror(e),e}finally{this.walletIframeRouterCreationInFlight=null}}ensureWalletIframePreferencesMirror(e){this.walletIframePrefsUnsubscribe||=e.onPreferencesChanged?.(e=>{let t=e?.walletId,n=t?R(t):null;this.userPreferences.applyWalletHostConfirmationConfig({walletId:n,confirmationConfig:e?.confirmationConfig})})??null}ensureWalletIframeLifecycleMirror(e){this.walletIframeLifecycleUnsubscribe||=e.onSdkLifecycleEvent(this.forwardSdkLifecycleEventListener)}ensureWalletIframeAuthMenuMirror(e){this.walletIframeAuthMenuUnsubscribe||=e.onHostedAuthMenuExternalAuthRequest(this.forwardHostedAuthMenuExternalAuthRequestListener),this.walletIframeAuthMenuDemoOtpUnsubscribe||=e.onHostedAuthMenuDemoEmailOtpDelivery(this.forwardHostedAuthMenuDemoEmailOtpDeliveryListener)}forwardSdkLifecycleEvent(e){for(let t of Array.from(this.sdkLifecycleEventListeners))t(e)}removeSdkLifecycleEventListener(e){this.sdkLifecycleEventListeners.delete(e)}forwardHostedAuthMenuExternalAuthRequest(e){for(let t of Array.from(this.hostedAuthMenuExternalAuthRequestListeners))try{t(e)}catch{}}removeHostedAuthMenuExternalAuthRequestListener(e){this.hostedAuthMenuExternalAuthRequestListeners.delete(e)}forwardHostedAuthMenuDemoEmailOtpDelivery(e){for(let t of Array.from(this.hostedAuthMenuDemoEmailOtpDeliveryListeners))try{t(e)}catch{}}removeHostedAuthMenuDemoEmailOtpDeliveryListener(e){this.hostedAuthMenuDemoEmailOtpDeliveryListeners.delete(e)}};function mP(e){return!1}function hP(e){return!(typeof window>`u`||window.Worker===void 0||e&&e!==window.location.origin)}const gP={kind:`local_worker_warmup_disabled`,shouldPrewarmWorkers:mP,shouldPrewarmUiConfirmUi:mP},_P={kind:`local_worker_warmup_enabled`,shouldPrewarmWorkers:hP,shouldPrewarmUiConfirmUi:hP};function vP(e){return e.wallet.mode===`iframe`&&!Xl()}function yP(e){return vP(e)?gP:_P}function bP(e){ms({mode:Xl()?`wallet`:e.wallet.mode===`iframe`?`disabled`:`app`})}function xP(e){let t;return()=>(t??=e().catch(e=>{throw t=void 0,e}),t)}function SP(){return{ecdsaSessions:{exportArtifactsByLane:new Map}}}function CP(e){let t=xP(async()=>{let{createWarmSessionHydrationService:t}=await import(`./warmSessionHydration-BPGM0YRU.js`);return t({getWarmSessionMaterialWriter:e.ui.warmSessions.getWarmSessionMaterialWriter})}),n={hydrateSigningSession:async e=>(await t()).hydrateSigningSession(e)},r=xP(async()=>{let{createRegistrationAccountsService:t}=await import(`./registrationAccounts-DIeEVy6W.js`);return t(e.registration.accountLifecycle)}),i={storeUserData:async e=>(await r()).storeUserData(e),getAllUsers:async()=>(await r()).getAllUsers(),getUserBySignerSlot:async(e,t)=>(await r()).getUserBySignerSlot(e,t),getLastUser:async()=>(await r()).getLastUser(),nearAuthenticatorsByAccount:async e=>(await r()).nearAuthenticatorsByAccount(e),setLastUser:async(e,t)=>(await r()).setLastUser(e,t),activateAuthenticatedWalletState:async e=>(await r()).activateAuthenticatedWalletState(e),setWalletNearProvisioningState:async e=>(await r()).setWalletNearProvisioningState(e),getWalletNearProvisioningState:async e=>(await r()).getWalletNearProvisioningState(e),storeAuthenticator:async e=>(await r()).storeAuthenticator(e),rollbackUserRegistration:async e=>(await r()).rollbackUserRegistration(e),hasPasskeyCredential:async e=>(await r()).hasPasskeyCredential(e),storeWalletEd25519RegistrationData:async e=>(await r()).storeWalletEd25519RegistrationData(e),storeWalletEd25519RecoveryRegistrationData:async e=>(await r()).storeWalletEd25519RecoveryRegistrationData(e),storeWalletEmailOtpEd25519RegistrationData:async e=>(await r()).storeWalletEmailOtpEd25519RegistrationData(e),storeWalletEmailOtpMixedRegistrationData:async e=>(await r()).storeWalletEmailOtpMixedRegistrationData(e),finalizeWalletEd25519SignerRegistration:async e=>(await r()).finalizeWalletEd25519SignerRegistration(e),rollbackWalletEd25519SignerRegistration:async e=>(await r()).rollbackWalletEd25519SignerRegistration(e)},a=xP(async()=>{let{createEcdsaWalletRecordsService:t}=await import(`./ecdsaWalletRecords-Cm1DdexN.js`);return t({accountLifecycle:e.registration.accountLifecycle})}),o={storeWalletEcdsaSignerRecords:async e=>(await a()).storeWalletEcdsaSignerRecords(e),storeWalletEmailOtpEcdsaSignerRecords:async e=>(await a()).storeWalletEmailOtpEcdsaSignerRecords(e),storeWalletEcdsaRecoverySignerRecords:async e=>(await a()).storeWalletEcdsaRecoverySignerRecords(e),finalizeWalletEcdsaRegistration:async e=>(await a()).finalizeWalletEcdsaRegistration(e),storeWalletEmailOtpEcdsaRegistrationData:async e=>(await a()).storeWalletEmailOtpEcdsaRegistrationData(e)},s={signNear:async t=>{let{signNear:n}=await import(`./signNear-mWbTE2Dl.js`).then(e=>e.n);return n(e.signing.near.getDeps(),t)}},c={signEvmFamily:async t=>{let{signEvmFamily:n}=await import(`./signEvmFamily-CcLVBm0f.js`).then(e=>e.s);return n(e.signing.evmFamily.getDeps(),t)},reportTempoBroadcastAccepted:async t=>{let{reportTempoBroadcastAccepted:n}=await import(`./signEvmFamily-CcLVBm0f.js`).then(e=>e.s);return n(e.signing.evmFamily.getDeps(),t)},reportTempoBroadcastRejected:async t=>{let{reportTempoBroadcastRejected:n}=await import(`./signEvmFamily-CcLVBm0f.js`).then(e=>e.s);return n(e.signing.evmFamily.getDeps(),t)},reportTempoFinalized:async t=>{let{reportTempoFinalized:n}=await import(`./signEvmFamily-CcLVBm0f.js`).then(e=>e.s);return n(e.signing.evmFamily.getDeps(),t)},reportTempoDroppedOrReplaced:async t=>{let{reportTempoDroppedOrReplaced:n}=await import(`./signEvmFamily-CcLVBm0f.js`).then(e=>e.s);return n(e.signing.evmFamily.getDeps(),t)},reconcileTempoNonceLane:async t=>{let{reconcileTempoNonceLane:n}=await import(`./signEvmFamily-CcLVBm0f.js`).then(e=>e.s);return n(e.signing.evmFamily.getDeps(),t)}};return{...e,services:{warmSessions:n,registrationAccounts:i,nearSigning:s,evmFamilySigning:c,ecdsaWalletRecords:o}}}function wP(e){return{network:e.network,registration:e.registration,signing:e.signing}}function TP(e){return jg({indexedDB:K,workerCtx:e})}function EP(e){let t=SP(),n=wP(e.config);return CP({runtimePorts:TP(e.workerCtx),workers:{emailOtp:e.workerCtx},signing:{near:{getDeps:e.getNearSigningDeps},evmFamily:{getDeps:e.getEvmFamilySigningDeps}},registration:{accountLifecycle:e.accountLifecycle,ecdsaBootstrapStore:e.ecdsaBootstrapStore},ui:{warmSessions:{getWarmSessionMaterialWriter:e.getWarmSessionMaterialWriter}},config:n,state:t})}async function DP(e){switch(e.state.kind){case`active_session`:break;case`wallet_unlocked_without_signing_session`:if(e.state.reason!==`exhausted`)return;break;case`wallet_locked`:case`wallet_authenticated_identity_unresolvable`:case`expired_session`:return;default:e.state;return}let t=Ur({walletId:e.state.walletId}),n=new wt,r=[];for(let i of e.chainTargets)r.push(e.prefill({walletSession:t,chainTarget:i},n));await Promise.all(r)}function OP(e){return{managerStores:{userPreferencesStore:e,nonceLaneCoordinationStore:hs({indexedDB:e}),webauthnCredentialStore:e,passkeyAuthenticatorStore:e,nearKeyMaterialStore:e},signingEngineStores:{walletProfileAndSignerRecords:{accountStore:e,walletSignerStore:e,passkeyAuthenticatorStore:e,ecdsaBootstrapStore:e},recoveryAndDeviceLinking:{credentialStore:e},warmup:{store:e}},sealedSigningSessionStore:{writeExactSealedSession:Oe,readExactSealedSession:Ft,listExactSealedSessionsForWallet:Lt,listEcdsaSealedSessionsForWallet:Ke,acquireSigningSessionRestoreLease:Ee,releaseSigningSessionRestoreLease:He,updateExactSealedSessionPolicy:Je},ed25519YaoPublicCapabilityReferences:new Ts(e)}}function kP(){return rp()||(typeof window<`u`?window.location.origin:``)}function AP(e){e.setWorkerBaseOrigin(kP()),typeof window<`u`&&ae(()=>{let t=kP();t!==e.getWorkerBaseOrigin()&&e.setWorkerBaseOrigin(t)}),e.config.wallet.mode===`iframe`&&!Xl()||e.userPreferencesManager.initFromIndexedDB().catch(()=>void 0)}async function jP(e){try{let t=e.runtime.activationReceipt.normalSigning.scope,n=Zd({routerAbState:e.runtime.activationReceipt.normalSigning}),r=await go({ecdsaThresholdKeyId:t.ecdsa_threshold_key_id,signingRootId:t.signing_root_id,signingRootVersion:t.signing_root_version});if(Ud(e.runtime)!==e.runtime)return;let i=xd({relayerUrl:e.relayerUrl,keyHandle:$o(r),ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,clientVerifyingShareB64u:n.clientVerifier33B64u,clientSigningMaterial:bd(e.runtime.holderHandleId),thresholdEcdsaPublicKeyB64u:n.thresholdVerifier33B64u,relayerVerifyingShareB64u:n.serverVerifier33B64u,credential:{kind:`wallet_session_opaque`,walletSessionToken:e.operationCredential.token},authorization:{kind:`reusable_wallet_session`,wallet_session_id:e.operationCredential.walletSessionId},materialActivation:Un(e.runtime.materialActivation),routerAbEcdsaDerivationPoolFill:{kind:`router_ab_ecdsa_derivation_signing_worker_pool`,scope:t,ceremonyExpiresAtMs:e.expiresAtMs,materialExpiresAtMs:Date.now()+dr},workerCtx:e.workerCtx});bl(`evm-family`,{event:`ecdsa_linked_device_prefill`,scheduled:i.scheduled,reason:i.reason,depth:i.depth,targetDepth:i.targetDepth})}catch{bl(`evm-family`,{event:`ecdsa_linked_device_prefill`,scheduled:!1,reason:`unexpected_error`})}}function MP(e){throw Error(`Unexpected Router A/B normal-signing config branch: ${String(e)}`)}function NP(e){let t=e.signing.routerAb.normalSigning;switch(t.mode){case`disabled`:throw Error(`[threshold-warm-session] Router A/B normal signing must be enabled for Ed25519 sessions`);case`enabled`:return{kind:Ps,signingWorkerId:t.signingWorkerId};default:return MP(t)}}var PP=class extends Error{constructor(e){super(`[WalletRuntimePostcondition] ${e.code} ${JSON.stringify(e.details)}`),this.name=`WalletRuntimePostconditionError`,this.code=e.code,this.details=e.details}};function FP(e){let t=Math.floor(Number(e));return Number.isFinite(t)&&t>0?t:null}function IP(e,t){let n=Math.floor(Number(e));return Number.isFinite(n)&&n>t?n:null}function LP(e){return FP(e.remainingUses??e.policyHint?.remainingUses)}function RP(e,t){return IP(e.expiresAtMs??e.policyHint?.expiresAtMs,t)}function zP(e){if(e.state===`missing`)return null;switch(e.source){case`durable_sealed_record`:case`public_capability_reference`:return{kind:e.source};default:return null}}function BP(e){let t=e.lanes.lanes.ed25519.near;if(t.state===`missing`)return`ed25519_lane_missing`;if(kf(t)!==e.authMethod)return`auth_method_route_mismatch`;if(t.state!==`ready`&&t.state!==`restorable`)return`ed25519_lane_missing`;let n=LP(t),r=RP(t,e.nowMs);if(t.authorizationState!==`authorized`||!t.authorization.operationCredential.walletSessionId||!t.authorization.session.quotaId||!t.thresholdSessionId||!n||!r)return`lane_inventory_mismatch`;let i=zP(t);if(!i)return`lane_material_missing`;let a={authMethod:e.authMethod,target:{curve:`ed25519`},walletSessionId:t.authorization.operationCredential.walletSessionId,quotaId:t.authorization.session.quotaId,thresholdSessionId:t.thresholdSessionId,remainingSignatureUses:n,expiresAtMs:r,material:i};return t.state===`restorable`?{...a,state:`restorable`}:{...a,state:`ready`}}function VP(e){let t=z(e.chainTarget),n=e.lanes.ecdsa.lanesByTarget[t];if(!n||n.state===`missing`)return`ecdsa_lane_missing`;if(If(n)!==e.authMethod)return`auth_method_route_mismatch`;if(n.state!==`ready`)return`ecdsa_lane_missing`;let r=LP(n),i=RP(n,e.nowMs);return!n.authorization||!r||!i?`lane_inventory_mismatch`:{state:n.state,authMethod:e.authMethod,target:{curve:`ecdsa`,chainTarget:e.chainTarget},authorizationId:n.authorization.session.authorizationId,materialActivationId:String(n.materialActivation.activationId),remainingSignatureUses:r,expiresAtMs:i,material:{kind:`canonical_capability`}}}async function HP(e){let t=String(e.walletId||``).trim();if(!t)return{ok:!1,code:`wallet_missing`,details:{source:e.source}};let n=Js(e.ownerScope.auth),r=await e.readOwnerScopedSigningLanes({walletId:t,ownerScope:e.ownerScope}),i=e.nowMs??Date.now(),a,o=new Map;for(let s of e.requiredTargets){if(s.curve===`ed25519`){let o=BP({lanes:r,authMethod:n,nowMs:i});if(typeof o==`string`)return{ok:!1,code:o,details:{source:e.source,walletId:t,authMethod:n,curve:`ed25519`,state:r.lanes.ed25519.near.state,candidateCount:r.candidates.ed25519.near.length}};a=o;continue}let c=VP({lanes:r,chainTarget:s.chainTarget,authMethod:n,nowMs:i});if(typeof c==`string`){let i=z(s.chainTarget);return{ok:!1,code:c,details:{source:e.source,walletId:t,authMethod:n,curve:`ecdsa`,targetKey:i,state:r.ecdsa.lanesByTarget[i]?.state||`missing`,candidateCount:r.ecdsa.candidatesByTarget[i]?.length||0}}}o.set(z(s.chainTarget),c)}return{ok:!0,inventory:{...a?{ed25519:a}:{},ecdsaByTarget:o}}}async function UP(e){let t=await HP(e);if(!t.ok)throw new PP(t);return t.inventory}function WP(e){switch(e.mode){case`ed25519_only`:return!1;case`ecdsa_only`:case`ed25519_and_ecdsa`:return!0}return!1}function GP(e){switch(e.reason){case`missing_chain_target`:case`missing_key_handle`:case`invalid_key_handle`:case`duplicate_key_handles`:return e.reason;case`invalid_chain_target`:return`invalid_signer_record`}return e.reason,`invalid_signer_record`}function KP(e){let t=e.signer,n=Ec({walletId:e.walletId,configuredTargets:e.configuredTargets,signer:e.signer}),r=typeof t.signerId==`string`&&t.signerId.trim()?t.signerId.trim():void 0;switch(n.kind){case`active_wallet_key`:return{kind:`active_ecdsa_signer_record`,targetKey:n.targetKey,chainTarget:n.chainTarget,walletKey:n.walletKey,publicCapability:n.publicCapability,source:`profile_continuity`,...r?{signerId:r}:{}};case`key_facts_inventory_required`:return{kind:`key_facts_inventory_required`,targetKey:n.targetKey,chainTarget:n.chainTarget,keyHandle:n.keyHandle,reason:n.reason,...r?{signerId:r}:{}};case`blocked`:return{kind:`blocked`,targetKey:n.targetKey,reason:GP(n),...r?{signerId:r}:{}};case`skipped`:return{kind:`skipped`}}return{kind:`skipped`}}function qP(e){let t=new Map;for(let n of e){let e=t.get(n.targetKey);if(!e){t.set(n.targetKey,n);continue}if(e.kind!==`active_ecdsa_signer_record`)continue;let r=Fa(Za(e.walletKey)),i=Fa(Za(n.walletKey));(String(e.walletKey.keyHandle)!==String(n.walletKey.keyHandle)||r!==i)&&t.set(n.targetKey,{kind:`blocked`,targetKey:n.targetKey,reason:`duplicate_key_handles`,...n.signerId?{signerId:n.signerId}:{}})}return t}function JP(e){let t=String(e.keyHandle||``).trim();if(!t)throw Error(`[login] configured-target ECDSA warm key requires keyHandle`);let n=String(e.passkeyCredentialIdB64u||``).trim();if(e.key&&e.publicCapability&&String(e.publicCapability.client_id)!==String(e.key.walletId))throw Error(`[login] configured-target ECDSA public capability wallet mismatch`);return{chainTarget:e.chainTarget,targetKey:z(e.chainTarget),keyHandle:t,...e.key?{key:e.key}:{},...n?{passkeyCredentialIdB64u:n}:{},...e.existingRoleLocalMaterial?{existingRoleLocalMaterial:e.existingRoleLocalMaterial}:{},publicCapability:e.publicCapability?{kind:`persisted_public_capability`,value:e.publicCapability}:{kind:`missing_public_capability`}}}function YP(e){let t=new Map;for(let n of e.keys){let r=z(n.chainTarget),i=String(n.keyHandle||``).trim();if(!i)continue;let a=t.get(r),o=String(a?.keyHandle||``).trim();if(o&&i&&o!==i)throw Error(`[login] threshold ECDSA warm-up received ambiguous ${e.source} key handles for ${r}`);if(a?.key&&n.key&&Fa(a.key)!==Fa(n.key))throw Error(`[login] threshold ECDSA warm-up received ambiguous ${e.source} key fingerprints for ${r}`);let s=a?.publicCapability.kind===`persisted_public_capability`?a.publicCapability.value:null,c=n.publicCapability.kind===`persisted_public_capability`?n.publicCapability.value:null;if(s&&c&&!Qn(s,c))throw Error(`[login] threshold ECDSA warm-up received ambiguous ${e.source} public capabilities for ${r}`);let l=c||s,u=String(n.passkeyCredentialIdB64u||a?.passkeyCredentialIdB64u||``).trim(),d=n.existingRoleLocalMaterial||a?.existingRoleLocalMaterial;if(n.existingRoleLocalMaterial&&a?.existingRoleLocalMaterial&&!b(n.existingRoleLocalMaterial.materialActivation,a.existingRoleLocalMaterial.materialActivation))throw Error(`[login] threshold ECDSA warm-up received ambiguous ${e.source} role-local material for ${r}`);t.set(r,{chainTarget:n.chainTarget,targetKey:r,keyHandle:i||o,...n.key||a?.key?{key:n.key||a?.key}:{},...u?{passkeyCredentialIdB64u:u}:{},...d?{existingRoleLocalMaterial:d}:{},publicCapability:l?{kind:`persisted_public_capability`,value:l}:{kind:`missing_public_capability`}})}return[...t.values()]}function XP(e,t){return{ecdsaKeys:YP({source:`stored/relay`,keys:[...e.ecdsaKeys,...t?.ecdsaKeys||[]]}),...t?.runtimePolicyScope?{runtimePolicyScope:t.runtimePolicyScope}:e.runtimePolicyScope?{runtimePolicyScope:e.runtimePolicyScope}:{}}}function ZP(e){if(!e.configuredTargets.length)return{kind:`complete_configured_target_keys`,context:e.context};let t=new Map;for(let n of e.context.ecdsaKeys)t.set(n.targetKey,n);let n=e.configuredTargets.map(e=>z(e.chainTarget)).filter(e=>!t.has(e));if(n.length)return{kind:`missing_configured_target_keys`,missingTargets:n};let r={ecdsaKeys:YP({source:`configured ECDSA target completion`,keys:[...t.values()]}),...e.context.runtimePolicyScope?{runtimePolicyScope:e.context.runtimePolicyScope}:{}},i=e.configuredTargets.filter(e=>!r.ecdsaKeys.some(t=>t.targetKey===z(e.chainTarget)));return i.length?{kind:`missing_configured_target_keys`,missingTargets:i.map(e=>z(e.chainTarget))}:{kind:`complete_configured_target_keys`,context:r}}function QP(e){switch(e.completion.kind){case`complete_configured_target_keys`:return e.completion.context;case`missing_configured_target_keys`:throw Error(`[login] threshold ECDSA warm-up could not resolve configured target key facts from ${e.source} for ${e.completion.missingTargets.join(`, `)}`)}throw e.completion,Error(`[login] unsupported ECDSA warm-up key completion state`)}function $P(e){let t=new Map;for(let n of e){let e=`${n.targetKey}:${n.keyHandle}`;t.set(e,{keyHandle:n.keyHandle,chainTarget:n.chainTarget})}return[...t.values()]}function eF(e){if(!WP(e.selection)||e.configuredTargets.length===0)return{kind:`no_configured_ecdsa_targets`};let t=[...e.blockedRecords||[]],n=qP(e.activeSignerRecords);for(let e of n.values())e.kind===`blocked`&&t.push(e);if(t.length)return{kind:`blocked`,blockedRecords:t};let r=new Map;for(let t of e.keyFactsInventoryRequiredRecords||[])r.set(t.targetKey,t);let i=[],a=[];for(let t of e.configuredTargets){let e=z(t),o=n.get(e);if(o?.kind===`active_ecdsa_signer_record`){a.push({targetKey:e,chainTarget:t,walletKey:o.walletKey,publicCapability:o.publicCapability});continue}let s=r.get(e);if(s){i.push(s);continue}i.push({kind:`key_facts_inventory_required`,targetKey:e,chainTarget:t,keyHandle:``,reason:`missing_key_facts`})}if(i.length===0)return{kind:`ready`,readyTargets:a};let o=i.filter(e=>String(e.keyHandle||``).trim()),s=e.runtimeConfig?.explicitKeyFactsInventoryMode??e.explicitKeyFactsInventoryMode,c=e.runtimeConfig?.allowAuthenticatedKeyFactsInventory??e.allowAuthenticatedKeyFactsInventory;return s===!0&&c===!0&&o.length===i.length?{kind:`awaiting_authenticated_key_facts_inventory`,keyFactsInventoryRequiredRecords:o,keyTargets:$P(o)}:{kind:`key_facts_inventory_required`,keyFactsInventoryRequiredRecords:i}}async function tF(e){let t=e.authenticators.map(e=>{let t=String(e.credentialId||``).trim();return t?{id:t,type:`public-key`,transports:Array.isArray(e.transports)?e.transports:[]}:null}).filter(e=>!!e);e.onPromptStarted();let n=await e.signingEngine.getAuthenticationCredentialsSerialized({subjectId:e.subjectId,challengeB64u:e.challengeB64u,allowCredentials:t,includeSecondPrfOutput:!1});return e.onPromptSucceeded(),n}function nF(){if(typeof crypto>`u`||typeof crypto.getRandomValues!=`function`)throw Error(`Secure random is unavailable for passkey wallet unlock`);let e=new Uint8Array(32);return crypto.getRandomValues(e),F(e)}async function rF(e){if(!e.currentCredential)return await e.collectCredentialForChallenge(nF())}const iF=new gs;async function aF(e){let t=await iF.listActiveWalletCapabilitySubjects(e);if(t.kind===`persistence_unavailable`)return{kind:`failed`,reason:`capability_subject_lookup_failed`};if(t.kind===`invalid_current_state`)return{kind:`failed`,reason:`invalid_capability_subject`};let n=[];for(let r of t.subjects)n.push({kind:`evm_family_ecdsa_wallet`,walletId:e,capability:r.capability,authority:r.authority,ecdsaThresholdKeyId:r.ecdsaThresholdKeyId});return{kind:`resolved`,subjects:n}}async function oF(e){return await iF.listWalletActivationJournalSelectors(e)}function sF(e,t){let n=e?.[t];if(typeof n!=`string`||!n.trim())throw Error(`wallet unlock signer metadata requires ${t}`);return n.trim()}function cF(e,t){try{let n=String(t.metadata?.walletId||``).trim();if(n&&n!==String(e))return{kind:`invalid`};let r=ks(t.signerSlot);return r?{kind:`valid`,subject:{kind:`near_ed25519_wallet`,walletId:e,nearAccountId:Hi(sF(t.metadata,`nearAccountId`)),nearEd25519SigningKeyId:Vo(sF(t.metadata,`nearEd25519SigningKeyId`)),signerSlot:r}}:{kind:`invalid`}}catch{return{kind:`invalid`}}}async function lF(e){let t=[],n;try{n=await K.listActiveWalletSigners({walletId:e,signerFamily:`ed25519`})}catch{return{kind:`failed`,reason:`capability_subject_lookup_failed`}}for(let r of n){let n=cF(e,r);if(n.kind!==`valid`)return{kind:`failed`,reason:`invalid_capability_subject`};t.push(n.subject)}return{kind:`resolved`,subjects:t}}function uF(e){switch(e.kind){case`near_ed25519_wallet`:return[e.kind,e.walletId,e.nearAccountId,e.nearEd25519SigningKeyId,e.signerSlot].join(`\0`);case`evm_family_ecdsa_wallet`:return[e.kind,e.walletId,e.capability,e.authority.authorityDigest,e.ecdsaThresholdKeyId].join(`\0`)}return``}function dF(e,t){for(let n of e)if(uF(n)===t)return!0;return!1}function fF(e,t){dF(e,uF(t))||e.push(t)}function pF(e){return e.kind===`near_ed25519_wallet`}function mF(e){let t=String(e||``).trim();if(!t)return null;try{return R(t)}catch{return null}}function hF(e){return String(e||``).trim()||null}function gF(e){let t=hF(e?.profileId);return t?{kind:`last_used_profile`,profileId:t}:{kind:`none`}}async function _F(){return gF(await K.getLastProfileState().catch(()=>null))}async function vF(e){let t=mF(e);return t?{kind:`explicit_wallet`,walletId:t}:e?{kind:`none`}:await _F()}function yF(e){let t=String(e.metadata?.walletId||``).trim();if(!t)return null;try{return R(t)}catch{return null}}function bF(e){let t=[],n=new Set;for(let r of e){let e=yF(r);if(!e)return{kind:`invalid`};let i=String(e);n.has(i)||(n.add(i),t.push(e))}return{kind:`resolved`,walletIds:t}}async function xF(e){let t;try{t=await K.getProfile(e)}catch{return{kind:`unresolvable_profile`,reason:`capability_subject_lookup_failed`}}if(!t)return{kind:`unresolvable_profile`,reason:`missing_wallet_profile`};let n;try{n=await K.listAccountSignersByProfile({profileId:e,status:`active`})}catch{return{kind:`unresolvable_profile`,reason:`capability_subject_lookup_failed`}}if(n.length===0)return{kind:`unresolvable_profile`,reason:`missing_requested_capability_subject`};let r=bF(n);if(r.kind===`invalid`)return{kind:`unresolvable_profile`,reason:`invalid_wallet_profile`};let i=r.walletIds;return i.length===0?{kind:`unresolvable_profile`,reason:`invalid_wallet_profile`}:i.length>1?{kind:`unresolvable_profile`,reason:`ambiguous_wallet_profile`}:{kind:`resolved_wallet`,walletId:i[0]}}function SF(e,t){let n=t[0];return n?{kind:`resolved`,subjectSet:{kind:`wallet_unlock_subject_set`,walletId:e,subjects:[n,...t.slice(1)]}}:{kind:`missing_requested_capability_subject`}}function CF(e){return e.subjects.filter(pF).length>1?`ambiguous_wallet_profile`:null}async function wF(e){let t=R(e.walletId),n=[];switch(e.requestedCapabilityFamilies.kind){case`near_ed25519_only`:case`all_registered_mpc`:{let r=await lF(t);if(r.kind===`failed`)return{kind:`capability_subject_resolution_failed`,reason:r.reason};for(let e of r.subjects)fF(n,e);if(e.requestedCapabilityFamilies.kind===`near_ed25519_only`)return SF(t,n);break}case`evm_family_ecdsa_only`:break;default:e.requestedCapabilityFamilies}let r=await aF(t);if(r.kind===`failed`)return{kind:`capability_subject_resolution_failed`,reason:r.reason};for(let e of r.subjects)fF(n,e);return SF(t,n)}async function TF(e){let t=await vF(e);if(t.kind===`none`)return{kind:`no_session_request`};let n,r;if(t.kind===`last_used_profile`){let e=await xF(t.profileId);if(e.kind===`unresolvable_profile`)return{kind:`unresolvable_profile`,profileId:t.profileId,reason:e.reason};n=e.walletId,r=`host_last_used_profile`}else n=t.walletId,r=`profile_projection`;let i=await wF({walletId:String(n),requestedCapabilityFamilies:{kind:`all_registered_mpc`}});if(i.kind===`missing_requested_capability_subject`)return{kind:`no_session_for_wallet`,walletId:n,reason:`missing_requested_capability_subject`};if(i.kind===`capability_subject_resolution_failed`)return{kind:`unresolvable`,walletId:n,reason:i.reason};let a=i.subjectSet,o=CF(a);return o?{kind:`unresolvable`,walletId:n,reason:o}:{kind:`resolved`,walletId:n,subjectSet:a,source:r}}function EF(e,t){return globalThis.fetch(e,t)}function Q(e,t,n){e?.(rs({flowId:`unlock:${t}`,accountId:t,...n}))}function DF(e){switch(e?.mode){case`ed25519_only`:return{mode:`ed25519_only`,ed25519:!0};case`ecdsa_only`:return{mode:`ecdsa_only`,ecdsa:!0};case`ed25519_and_ecdsa`:case void 0:return{mode:`ed25519_and_ecdsa`,ed25519:!0,ecdsa:!0}}return $(e)}function OF(e){if(e.selection)return DF(e.selection);let t=!1,n=!1;for(let r of e.subjectSet.subjects)switch(r.kind){case`near_ed25519_wallet`:t=!0;break;case`evm_family_ecdsa_wallet`:n=!0;break;default:return $(r)}if(t&&n)return{mode:`ed25519_and_ecdsa`,ed25519:!0,ecdsa:!0};if(t)return{mode:`ed25519_only`,ed25519:!0};if(n)return{mode:`ecdsa_only`,ecdsa:!0};throw Error(`[login] wallet unlock subject set has no supported capability`)}function kF(){return{appIdentity:{kind:`anonymous`},authentication:{kind:`signed_out`},capabilityProjection:{kind:`not_requested`},nonceDiagnostics:null}}function AF(e){return e.kind===`near_ed25519_wallet`}function jF(e){return e.kind===`evm_family_ecdsa_wallet`}function MF(e){let t=e.subjects.filter(AF);if(t.length===0)return null;if(t.length>1)throw Error(`[WalletSession] multiple NEAR Ed25519 subjects found for wallet session`);return t[0]||null}function NF(e){let t=MF(e.subjectSet),n=e.subjectSet.subjects.filter(jF);for(let t of e.subjectSet.subjects)if(String(t.walletId)!==String(e.subjectSet.walletId))throw Error(`[login] wallet unlock subject belongs to a different wallet`);switch(e.selection.mode){case`ed25519_only`:if(!t||n.length!==0)throw Error(`[login] NEAR Ed25519 unlock requires one exact NEAR subject set`);return{kind:`near_ed25519_capable_wallet`,walletId:e.subjectSet.walletId,subjectSet:e.subjectSet,nearAccountId:t.nearAccountId,nearEd25519SigningKeyId:t.nearEd25519SigningKeyId,signerSlot:t.signerSlot};case`ecdsa_only`:{let[r,...i]=n;if(t||!r)throw Error(`[login] ECDSA-only unlock requires exact ECDSA subjects`);return{kind:`evm_family_ecdsa_only_wallet`,walletId:e.subjectSet.walletId,subjectSet:e.subjectSet,ecdsaSubjects:[r,...i]}}case`ed25519_and_ecdsa`:if(!t||n.length===0)throw Error(`[login] combined unlock requires exact NEAR and ECDSA subjects`);return{kind:`near_ed25519_capable_wallet`,walletId:e.subjectSet.walletId,subjectSet:e.subjectSet,nearAccountId:t.nearAccountId,nearEd25519SigningKeyId:t.nearEd25519SigningKeyId,signerSlot:t.signerSlot}}return $(e.selection)}function PF(e){if(e.kind===`near_ed25519_capable_wallet`)return e;throw Error(`[login] NEAR Ed25519 warm-up requires an exact NEAR subject`)}function FF(e){let t=new Set;for(let n of e.identity.subjectSet.subjects)n.kind===`evm_family_ecdsa_wallet`&&t.add(String(n.ecdsaThresholdKeyId));if(t.size===0)throw Error(`[login] ECDSA warm-up requires an exact ECDSA unlock subject`);for(let n of e.context.ecdsaKeys){let e=String(n.key?.ecdsaThresholdKeyId||``).trim();if(e&&!t.has(e))throw Error(`[login] ECDSA warm-up key does not match the unlock subject set`)}}function IF(e){let t=[];for(let n of e.subjects)n.kind===`evm_family_ecdsa_wallet`&&t.push({capability:n.capability,authority:n.authority});return t}async function LF(e){let t=!1,n=!1;for(let r of e.selectors){let i=await td({workerCtx:e.workerCtx,command:{kind:`reconcile_canonical_ecdsa_activation_v1`,capability:r.capability,authority:r.authority}});switch(i.kind){case`canonical_ecdsa_activation_reconciliation_absent_v1`:break;case`canonical_ecdsa_activation_reconciliation_finalized_v1`:t=!0;break;case`canonical_ecdsa_activation_reconciliation_pending_v1`:n=!0;break;case`canonical_ecdsa_activation_reconciliation_failed_v1`:return{kind:`failed`,didFinalize:t,code:i.code};default:$(i)}}return n?{kind:`pending`,didFinalize:t}:{kind:`settled`,didFinalize:t}}function RF(e){switch(e.kind){case`settled`:return;case`pending`:console.warn(`[login] ECDSA activation remains prepared and requires confirmation`);return;case`failed`:console.warn(`[login] ECDSA activation reconciliation failed without changing active state`,{code:e.code});return}$(e)}function zF(e){let t=Xi({walletId:e.walletId});switch(e.kind){case`passkey`:{let n=da(e.rpId);return n.ok?ca({walletAuthMethodId:e.walletAuthMethodId,scope:aa({wallet:t,rpId:n.value}),credentialIdB64u:e.credentialIdB64u}):null}case`email_otp`:return Ja({walletAuthMethodId:e.walletAuthMethodId,wallet:t,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId});default:return null}}function BF(e){return{walletId:e.walletId,factor:{kind:`passkey`,credentialIdB64u:e.credentialIdB64u},verifier:{kind:`webauthn`,rpId:e.rpId},bindingId:e.walletAuthMethodId}}async function VF(e){return await L({authority:BF(e)})}async function HF(e){let t=zn({walletId:e.authMethod.walletId,factor:{kind:`email_otp`,provider:e.provider,providerUserId:e.providerSubjectId},verifier:{kind:`email_otp_wallet_auth_method`,emailHashHex:e.authMethod.emailHashHex},bindingId:e.authMethod.walletAuthMethodId});if(!t)throw Error(`[login] linked Email OTP provider identity does not match selected authority`);return t}async function UF(e){if(e.selection.authMethod.kind===`passkey`)return BF(e.selection.authMethod);let t=e.providerIdentity;if(!t)throw Error(`[login] linked Email OTP authority provider identity is missing`);return await HF({authMethod:e.selection.authMethod,provider:t.provider,providerSubjectId:t.providerSubjectId})}async function WF(e){return await L({authority:await UF(e)})}function GF(e,t,n,r){let i=null;for(let a of e)if(!(a.authorityId!==t||a.walletAuthMethodId!==n||a.activationId!==r.activationId)){if(i)return null;i=a}return i}function KF(e){let t=[];return e.selection.walletId!==e.walletId&&t.push(`selection_wallet_id`),!e.allowUnselectedSibling&&e.selection.walletAuthMethodId!==e.authMethod.walletAuthMethodId&&t.push(`selection_auth_method_id`),e.authMethod.walletId!==e.walletId&&t.push(`auth_method_wallet_id`),e.authMethod.status!==`active`&&t.push(`auth_method_inactive`),e.expectedKind&&e.authMethod.kind!==e.expectedKind&&t.push(`auth_method_not_${e.expectedKind}`),e.authority.walletId!==e.walletId&&t.push(`authority_wallet_id`),e.authority.state!==`active`&&t.push(`authority_inactive`),e.authority.authorityId!==e.authMethod.walletAuthorityId&&t.push(`authority_auth_method_id`),t}async function qF(e){let t=o(e);if(!t.ok)return null;let n=t.value;try{let e=await K.resolveSelectedWalletAuthority(String(n));if(e.kind!==`resolved`)return null;let{selection:t,authMethod:r,authority:i}=e;return KF({walletId:n,selection:t,authMethod:r,authority:i,expectedKind:`passkey`}).length>0||r.status!==`active`||r.kind!==`passkey`||i.state!==`active`||i.provenance.kind!==`device_link`?null:{kind:`linked_device_passkey_authority_selection_v1`,walletId:n,selection:t,authMethod:r,authority:i,signerMaterials:e.signerMaterials,exportRoot:e.exportRoot}}catch{return null}}async function JF(e){let t=o(e.walletIdInput),n=String(e.emailHashHex||``).trim().toLowerCase(),r=String(e.providerSubjectId||``).trim();if(!t.ok||!n||!r)return{kind:`none`};let i=t.value,a;try{a=e.walletAuthMethodId?await K.resolveWalletAuthorityForMethod(String(i),e.walletAuthMethodId):await K.resolveSelectedWalletAuthority(String(i))}catch(e){return{kind:`rejected`,message:e instanceof Error?e.message:`Selected Email OTP authority is unavailable`}}if(a.kind===`missing_selection`)return{kind:`none`};if(a.kind!==`resolved`)return{kind:`rejected`,message:`Selected Email OTP authority is unavailable`};let{selection:s,authMethod:c,authority:l}=a;if(c.kind!==`email_otp`)return{kind:`none`};if(KF({walletId:i,selection:s,authMethod:c,authority:l,expectedKind:`email_otp`,allowUnselectedSibling:!!e.walletAuthMethodId}).length>0||c.emailHashHex.toLowerCase()!==n)return{kind:`rejected`,message:`Selected Email OTP authority is inactive or does not match the verified email`};if(c.status!==`active`||l.state!==`active`)return{kind:`rejected`,message:`Selected Email OTP authority is inactive`};try{await HF({authMethod:c,provider:e.provider,providerSubjectId:r})}catch(e){return{kind:`rejected`,message:e instanceof Error?e.message:`Selected Email OTP provider identity does not match the local authority`}}return l.provenance.kind===`device_link`&&a.signerMaterials.length===0?{kind:`rejected`,message:`Selected linked Email OTP authority has no signer material`}:a.signerMaterials.some(e=>e.kind!==`wallet_authority_linked_signer_material_v1`)?{kind:`rejected`,message:`Selected Email OTP authority has an invalid linked signer material set`}:{kind:`selected`,selection:{kind:`linked_device_email_otp_authority_selection_v1`,walletId:i,selection:s,authMethod:c,authority:l,signerMaterials:a.signerMaterials,exportRoot:a.exportRoot}}}function YF(e,t){let n=t.keyFamily===`ed25519`?e.signerActivations.ed25519:e.signerActivations.ecdsa;if(!n)throw Error(`[login] linked Wallet Session requested unavailable ${t.keyFamily} material`);if(!b(n.materialActivation,t.materialActivation))throw Error(`[login] linked Wallet Session material activation does not match authority`);return n.materialActivation}function XF(e,t){if(t.walletId!==e.walletId||t.authorityId!==e.authority.authorityId||t.authMethodId!==e.authMethod.walletAuthMethodId||t.authorityDigestB64u!==e.authority.authorityDigestB64u||t.authorityRevocationEpoch!==e.authority.revocationEpoch)throw Error(`[login] linked Wallet Session identity does not match selected authority`);for(let n of t.capabilitySubjects)switch(n.kind){case`sign`:case`export_keys`:{let t=YF(e.authority,n),r=GF(e.signerMaterials,e.authority.authorityId,e.authMethod.walletAuthMethodId,t);if(!r||r.keyFamily!==n.keyFamily)throw Error(`[login] linked Wallet Session signer material is unavailable`);if(!b(r.materialActivation,n.materialActivation))throw Error(`[login] linked Wallet Session signer material activation is invalid`);break}case`link_devices`:case`revoke_devices`:break;default:return $(n)}}function ZF(e,t){let n=e.targetFactor;if(n.kind!==`passkey`||n.walletAuthMethodId!==t.authMethod.walletAuthMethodId||n.rpId!==t.authMethod.rpId||n.credentialIdB64u!==t.authMethod.credentialIdB64u)throw Error(`[login] linked passkey signer material target factor does not match V2 auth`)}async function QF(e){let t=ke(e.credential);if(!t)throw Error(`[login] linked passkey unlock requires WebAuthn PRF.first output`);let n;try{n=I(t)}catch{throw Error(`[login] linked passkey unlock returned an invalid PRF.first output`)}try{if(n.byteLength!==32)throw Error(`[login] linked passkey unlock requires a 32-byte PRF.first output`);return await $F({selection:e.selection,factorSecret32:n})}finally{n.fill(0)}}async function $F(e){if(e.factorSecret32.byteLength!==32)throw Error(`[login] linked signer material requires a 32-byte factor secret`);let t=e.factorSecret32.slice();try{let n=[];for(let r of e.selection.signerMaterials){if(r.kind!==`wallet_authority_linked_signer_material_v1`)throw Error(`[login] linked signer material is not a linked sealed record`);e.selection.kind===`linked_device_passkey_authority_selection_v1`?ZF(r,e.selection):eI(r,e.selection);let i=await ys({record:r,factorSecret:t,expected:{authorityId:e.selection.authority.authorityId,walletId:e.selection.walletId,walletAuthMethodId:e.selection.authMethod.walletAuthMethodId,packageSetDigestB64u:r.packageSetDigestB64u,targetFactor:r.targetFactor,materialActivation:r.materialActivation,keyFamily:r.keyFamily}});if(i.kind!==`opened_wallet_authority_linked_signer_material_v1`)throw Error(`[login] linked signer material open failed: ${i.reason}`);n.push(i)}let[r,...i]=n;if(!r)throw Error(`[login] linked signer material set is empty`);return[r,...i]}finally{t.fill(0)}}function eI(e,t){let n=e.targetFactor;if(n.kind!==`email_otp`||n.walletAuthMethodId!==t.authMethod.walletAuthMethodId||n.emailHashHex.toLowerCase()!==t.authMethod.emailHashHex.toLowerCase()||n.registrationAuthorityId!==t.authMethod.registrationAuthorityId)throw Error(`[login] linked Email OTP signer material target factor does not match V2 auth`)}async function tI(e){if(e.factorSecret32.byteLength!==32)throw Error(`[login] linked Email OTP unlock requires a 32-byte factor secret`);return await $F({selection:e.selection,factorSecret32:e.factorSecret32})}function nI(e){let t=String(e.walletId||``).trim();if(!t)throw Error(`[login] recent unlock account is missing walletId`);let n=String(e.loginDisplayName||``).trim()||t;return{walletId:t,nearAccountId:e.nearAccountId,displayName:n,signerSlot:e.signerSlot,...typeof e.lastLogin==`number`?{lastLogin:e.lastLogin}:{},authMethod:e.authMethod||null}}async function rI(e){let t=await K.resolveSelectedWalletAuthority(String(e.walletId)).catch(()=>null);if(!t||t.kind!==`resolved`||t.selection.walletAuthMethodId!==e.walletAuthMethodId||t.authMethod.status!==`active`||t.authority.state!==`active`||t.authority.provenance.kind!==`device_link`)return null;let n=await VI({walletId:e.walletId,authMethod:t.authMethod,authority:t.authority,signerMaterials:t.signerMaterials});if(n.kind!==`resolved`)return null;let r;switch(t.authMethod.kind){case V.passkey:r=V.passkey;break;case V.emailOtp:r=V.emailOtp;break;default:return $(t.authMethod)}return{walletId:String(e.walletId),nearAccountId:n.subject.nearAccountId,displayName:String(e.walletId),signerSlot:n.subject.signerSlot,lastLogin:e.updatedAtMs,authMethod:r}}function iI(e){return`${e.walletId}:${e.authMethod??``}`}function aI(e){let t=null;for(let n of e)(!t||(n.lastLogin??0)>(t.lastLogin??0))&&(t=n);return t}async function oI(e){return e?(await K.listWalletAuthMethodsV2ForWallet(String(e)).catch(()=>[])).filter(e=>e.status===`active`).map(zF).filter(e=>!!e):[]}function sI(e){if(e.authMethod===V.passkey)return null;if(e.authMethod!==V.emailOtp)throw Error(`[login] unsupported wallet auth method for warm-up: ${e.authMethod}`);let t=e.authMethods.filter(e=>e.kind===`email_otp`);if(t.length!==1)throw Error(`[login] Email OTP warm-up requires one active wallet auth-method binding`);let n=t[0];if(String(n.wallet.walletId)!==String(e.walletId))throw Error(`[login] Email OTP warm-up auth-method binding wallet mismatch`);return n}async function cI(e){return sI({authMethods:await oI(e.walletId),authMethod:e.authMethod,walletId:e.walletId})}async function lI(e){let[t,n]=await Promise.all([K.listWalletPasskeyAuthenticators(String(e)),K.listWalletAuthMethodsV2ForWallet(String(e)).catch(()=>[])]),r=new Set;for(let e of n)e.kind===`passkey`&&e.status===`active`&&r.add(e.credentialIdB64u);return t.filter(e=>r.has(e.credentialId))}function uI(e){return e?.status===`active`}function dI(e){if(!e.request)return null;switch(e.request.mode){case`wallet_session_operation_credential_v1`:try{return{kind:`wallet_session_operation_credential_v1`,operationCredential:fI(e.request.operationCredential)}}catch{return null}case`webauthn`:return{kind:`webauthn`}}return null}function fI(e){if(e.kind===`opaque_wallet_session_operation_credential_v1`)return ir(e);if(e.kind!==`opaque_hosted_wallet_session_operation_credential_v1`||!/^wsh_[A-Za-z0-9_-]{43}$/.test(e.token))throw Error(`Hosted Wallet Session operation credential is invalid`);let t=br(e.walletSessionId);if(!t.ok)throw Error(`Hosted Wallet Session ID is invalid: ${t.error.message}`);return{kind:e.kind,token:e.token,walletSessionId:t.value}}function pI(){return{kind:`none`}}function mI(e){return String(e.authenticators.find(t=>t.signerSlot===e.signerSlot)?.credentialId||e.authenticators[0]?.credentialId||``).trim()}function hI(e){return cr({walletId:e.walletId,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u})}function gI(e){if(!e.wantsEd25519Warmup)return{kind:`not_requested`};if(e.authMethod===V.passkey)return{kind:`passkey`,authority:{kind:`wallet_auth_authority`,authority:hI({walletId:e.walletId,rpId:e.rpId,credentialIdB64u:e.passkeyCredentialIdB64u})},source:`login`};throw e.authMethod===V.emailOtp?Error(`[login] Email OTP warm-up requires its proof-bound unlock flow`):Error(`[login] unsupported wallet auth method for Ed25519 warm-up: ${e.authMethod}`)}function _I(e){if(e.kind===`not_requested`)throw Error(`[login] threshold Ed25519 warm-up authority is missing`);return e}function vI(e){return e.authority.kind===`email_otp`?e.authority:{kind:`passkey`,authority:{kind:`wallet_auth_authority`,authority:hI({walletId:e.walletId,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u})},source:`login`}}function yI(e){switch(e.kind){case`passkey`:return{kind:`passkey`,rpId:wo(e.authority.authority.verifier.rpId),credentialIdB64u:String(e.authority.authority.factor.credentialIdB64u||``).trim()};case`email_otp`:return{kind:`email_otp`,providerSubjectId:String(e.authority.authority.factor.providerUserId||``).trim()}}throw Error(`[login] unsupported Ed25519 exact provision authority`)}function bI(e){return Rc({signer:Bc({walletId:e.walletBinding.walletId,nearAccountId:e.walletBinding.nearAccountId,nearEd25519SigningKeyId:e.walletBinding.nearEd25519SigningKeyId,signerSlot:e.signerSlot}),auth:yI(e.authority),walletSessionId:e.walletSessionId,quotaId:e.quotaId,thresholdSessionId:e.thresholdSessionId})}function xI(e){switch(e.mintPlan.kind){case`not_requested`:throw Error(`[login] threshold Ed25519 mint plan is missing`);case`wallet_custody`:return e.ecdsaMint?{kind:`exact_ed25519_provisioning`,operationCredential:e.ecdsaMint.operationCredential,laneIdentity:bI({walletBinding:e.walletBinding,signerSlot:e.signerSlot,thresholdSessionId:e.mintPlan.thresholdSessionId,walletSessionId:e.ecdsaMint.operationCredential.walletSessionId,quotaId:e.ecdsaMint.quotaId,authority:e.authority})}:{kind:`fresh_ed25519_provisioning`,materialActivation:e.mintPlan.custody.ed25519.capability.materialActivation};case`fresh`:throw Error(`[login] fresh Ed25519 passkey provisioning requires canonical material activation`);case`ecdsa_authorized`:if(!e.ecdsaMint)throw Error(`[login] threshold Ed25519 warm-up requires the ECDSA bootstrap session minted during unlock`);return{kind:`exact_ed25519_provisioning`,operationCredential:e.ecdsaMint.operationCredential,laneIdentity:bI({walletBinding:e.walletBinding,signerSlot:e.signerSlot,thresholdSessionId:e.mintPlan.thresholdSessionId,walletSessionId:e.ecdsaMint.operationCredential.walletSessionId,quotaId:e.ecdsaMint.quotaId,authority:e.authority})}}return $(e.mintPlan)}function SI(e,t){if(e.kind===`fresh_ed25519_provisioning`&&e.materialActivation)return e.materialActivation;if(t.kind===`wallet_custody`)return t.custody.ed25519.capability.materialActivation;throw Error(`[login] passkey Ed25519 warm-up requires a canonical material activation`)}function CI(e){return e.mintPlan.kind===`wallet_custody`?{relayerKeyId:e.mintPlan.custody.ed25519.relayerKeyId,participantIds:e.mintPlan.custody.ed25519.participantIds,runtimePolicyScope:e.mintPlan.custody.ed25519.capability.runtimePolicyScope,routerAbNormalSigning:e.fallback.routerAbNormalSigning}:e.fallback}function wI(e){let t=e.session,n=e.custody.ed25519,r=e.credential?ke(e.credential):``;if(t.walletId!==String(e.walletBinding.walletId)||t.nearAccountId!==String(e.walletBinding.nearAccountId)||t.nearEd25519SigningKeyId!==String(e.walletBinding.nearEd25519SigningKeyId)||n.signerSlot!==e.signerSlot||t.relayerKeyId!==e.provisionScope.relayerKeyId||t.thresholdSessionId!==n.capability.lifecycle.thresholdSessionId||t.remainingUses!==e.remainingUses||!RL(t.participantIds,e.provisionScope.participantIds)||!e.provisionScope.runtimePolicyScope||!BL(t.runtimePolicyScope,e.provisionScope.runtimePolicyScope)||!zL(t.routerAbNormalSigning,e.provisionScope.routerAbNormalSigning)||!r)throw Error(`[login] verified unlock returned an invalid Ed25519 Wallet Session`);switch(t.sessionKind){case`issued_exact_wallet_session`:if(t.operationCredential.walletSessionId!==t.walletSessionId)throw Error(`[login] verified unlock returned a mismatched Ed25519 credential`);return{ok:!0,...t,passkeyPrfFirstB64u:r};case`already_committed_exact_wallet_session`:{let n=e.unlockAuthorization;if(!n)throw Error(`[login] verified unlock reused an Ed25519 Wallet Session without its authorization`);if(n.operationCredential.walletSessionId!==t.walletSessionId||n.record.walletId!==t.walletId||n.record.authorizationId!==t.authorizationId||n.record.quotaId!==t.quotaId||n.record.expiresAtMs!==t.expiresAtMs)throw Error(`[login] verified unlock reused a mismatched Ed25519 Wallet Session`);return{ok:!0,...t,operationCredential:n.operationCredential,passkeyPrfFirstB64u:r}}default:return $(t)}}function TI(e){return e.hasLoginCredential?{kind:`passkey_credential_already_collected`}:e.requiresLocalPasskeyUnlock?e.requireThresholdWarmup?{kind:`wallet_unlock_owns_passkey_credential`}:{kind:`local_unlock_passkey_assertion`}:{kind:`no_local_passkey_required`}}function EI(e){if(e.warmupPlan.signersToWarm.includes(`ed25519`)&&e.requiresLocalPasskeyUnlock)return{kind:`wallet_custody`};if(e.hasLoginCredential)return{kind:`existing_passkey_credential`};if(e.routeAuthorization.kind,e.requiresLocalPasskeyUnlock)throw Error(`[login] passkey warm-up requires the verified wallet-unlock credential`);return{kind:`no_passkey_credential_required`}}function DI(e){if(!e.credentialIds)return e.authenticators;let t=new Set;for(let n of e.credentialIds)t.add(n.trim());let n=[];for(let r of e.authenticators)t.has(String(r.credentialId||``).trim())&&n.push(r);if(!n.length)throw Error(`[login] no local authenticator matches the required credential`);return n}function OI(e){let t=[],n=new Set;for(let r of e){let e=String(r.credentialId||``).trim();!e||n.has(e)||(n.add(e),t.push(e))}return t}function kI(e){if(!Array.isArray(e))return[];let t=[],n=new Set;for(let r of e){let e=typeof r==`string`?r.trim():``;!e||n.has(e)||(n.add(e),t.push(e))}return t}function AI(e){let t=[];for(let n of e.authenticators)n.signerSlot===e.signerSlot&&t.push(n);let n=OI(t.length>0?t:e.authenticators);if(n.length===0)throw Error(`[login] selected wallet has no local passkey credential ID`);if(e.serverCredentialIds.length===0)return n;let r=new Set(e.serverCredentialIds),i=[];for(let e of n)r.has(e)&&i.push(e);if(i.length===0)throw Error(`[login] server passkey allow-list does not match local wallet credentials`);return i}function jI(e){let t=NF({subjectSet:e.subjectSet,selection:e.selection});switch(e.selection.mode){case`ed25519_only`:return{kind:`near_ed25519_only`,wantsEd25519Warmup:!0,wantsEcdsaWarmup:!1};case`ecdsa_only`:if(t.kind!==`evm_family_ecdsa_only_wallet`)throw Error(`[login] ECDSA-only warm-up requires exact ECDSA subjects`);return{kind:`evm_family_ecdsa_only`,wantsEd25519Warmup:!1,wantsEcdsaWarmup:e.hasConfiguredEcdsaTargets};case`ed25519_and_ecdsa`:return{kind:`near_ed25519_and_evm_family_ecdsa`,wantsEd25519Warmup:!0,wantsEcdsaWarmup:e.hasConfiguredEcdsaTargets}}return $(e.selection)}function MI(e){let t=String(e.context.configs?.network.relayer?.url||``).trim();if(!t)throw Error(`[login] threshold warm session requires relayer.url to be configured`);let n=Xe(e.context.configs.network.chains),r=jI({subjectSet:e.subjectSet,selection:e.selection,hasConfiguredEcdsaTargets:n.length>0}),i=r.wantsEcdsaWarmup,a=r.wantsEd25519Warmup,o=String(e.context.signingEngine.getRpId()||``).trim();return{kind:`threshold_login_warmup_phase_input`,signerSlot:e.signerSlot,selection:e.selection,relayerUrl:t,rpId:o,configuredEcdsaTargets:n,selectedEcdsaTargets:i?n:[],wantsEd25519Warmup:a,wantsEcdsaWarmup:i,ed25519SessionAuthority:gI({wantsEd25519Warmup:a,authMethod:e.authMethod,walletId:e.subjectSet.walletId,rpId:o,passkeyCredentialIdB64u:mI({authenticators:e.authenticators,signerSlot:e.signerSlot}),routeAuthorization:e.routeAuthorization}),keyFactsInventoryAuthority:e.keyFactsInventoryAuthority,routeAuthorization:e.routeAuthorization}}async function NI(e){let t=[...e.signersWarmed.includes(`ed25519`)?[{curve:`ed25519`}]:[],...e.signersWarmed.includes(`ecdsa`)?Xe(e.context.configs.network.chains).map(e=>({curve:`ecdsa`,chainTarget:e.chainTarget})):[]],n=st(e.credential);if(!n)throw Error(`[login] runtime lane selection requires the authenticated credential`);let r=String(e.walletIdentity.walletId),i=await K.getWalletPasskeyAuthenticator({walletId:r,credentialId:n}),a=ks(i?.signerSlot,{min:1});if(!i||a===null)throw Error(`[login] authenticated credential resolves no exact local authenticator for its signer slot`);let o={auth:{kind:`passkey`,rpId:wo(e.context.signingEngine.getRpId()),credentialIdB64u:n},signerSlot:a};t.length!==0&&await UP({source:`wallet_unlock`,walletId:String(e.walletIdentity.walletId),ownerScope:o,requiredTargets:t,readOwnerScopedSigningLanes:async t=>await e.context.signingEngine.readOwnerScopedSigningLanes(t,e.statusReads)})}async function PI(e){let t=st(e.credential);if(!t)throw Error(`[login] successful Passkey unlock omitted its credential identity`);let n=await De({walletId:e.walletIdentity.walletId,rpId:e.context.signingEngine.getRpId(),credentialIdB64u:t});await e.context.signingEngine.markWalletSelectionUnlocked({walletId:e.walletIdentity.walletId,walletAuthMethodId:n.walletAuthMethodId})}function FI(e){if(e.userData&&String(e.userData.walletId)!==String(e.walletId))throw Error(`[login] NEAR account projection belongs to a different wallet`);let t=typeof e.userData?.operationalPublicKey==`string`?e.userData.operationalPublicKey.trim():``;return{kind:`near_wallet`,walletId:e.walletId,operationalPublicKey:t||null}}async function II(e){Q(e.onEvent,String(e.identity.nearAccountId),{phase:W.STEP_02_ACCOUNT_LOOKUP_STARTED,status:`running`,authMethod:`passkey`});let t=e.signerSlotHint===null?Promise.resolve(null):e.signingEngine.getUserBySignerSlot(e.identity.nearAccountId,e.signerSlotHint).catch(()=>null),[n,r,i,a]=await Promise.all([t,e.signingEngine.getLastUser().catch(()=>null),hi(K,e.identity.nearAccountId).catch(()=>null),lI(e.identity.walletId)]);if(a.length===0)throw Error(`No authenticators found for account ${e.identity.nearAccountId}. Please register an account.`);let o=null;o=n&&n.nearAccountId===e.identity.nearAccountId?n:i&&i.nearAccountId===e.identity.nearAccountId?i:r&&r.nearAccountId===e.identity.nearAccountId?r:await e.signingEngine.getUserBySignerSlot(e.identity.nearAccountId,Number(e.identity.signerSlot)).catch(()=>null);let s=FI({userData:o,walletId:e.identity.walletId});return Q(e.onEvent,String(e.identity.nearAccountId),{phase:W.STEP_02_ACCOUNT_LOOKUP_SUCCEEDED,status:`succeeded`,authMethod:`passkey`,data:{signerSlot:Number(e.identity.signerSlot),...s.operationalPublicKey?{operationalPublicKey:s.operationalPublicKey}:{walletKind:s.kind}}}),{kind:`login_unlock_account_phase_ready`,accountSubject:s,authenticators:a,baseSignerSlot:e.signerSlotHint??Number(e.identity.signerSlot),localUnlockAuthMethod:V.passkey,requiresLocalPasskeyUnlock:!0}}async function LI(e){let t=String(e.identity.walletId);Q(e.onEvent,t,{phase:W.STEP_02_ACCOUNT_LOOKUP_STARTED,status:`running`,authMethod:`passkey`});let[n,r]=await Promise.all([K.getProfile(t),lI(e.identity.walletId)]);if(!n||r.length===0)throw Error(`[login] ECDSA wallet ${t} has no local passkey profile`);let i=ks(n.defaultSignerSlot,{min:1}),a=e.signerSlotHint??i;if(a===null)throw Error(`[login] ECDSA wallet profile is missing its exact signerSlot`);return Q(e.onEvent,t,{phase:W.STEP_02_ACCOUNT_LOOKUP_SUCCEEDED,status:`succeeded`,authMethod:`passkey`,data:{signerSlot:a,walletKind:`ecdsa_wallet_only`}}),{kind:`login_unlock_account_phase_ready`,accountSubject:{kind:`ecdsa_wallet_only`,walletId:e.identity.walletId,operationalPublicKey:null},authenticators:r,baseSignerSlot:a,localUnlockAuthMethod:V.passkey,requiresLocalPasskeyUnlock:!0}}async function RI(e){switch(e.identity.kind){case`near_ed25519_capable_wallet`:return await II({signingEngine:e.signingEngine,identity:e.identity,signerSlotHint:e.signerSlotHint,onEvent:e.onEvent});case`evm_family_ecdsa_only_wallet`:return await LI({identity:e.identity,signerSlotHint:e.signerSlotHint,onEvent:e.onEvent})}return $(e.identity)}function zI(e){switch(e.identity.kind){case`near_ed25519_capable_wallet`:if(e.accountSubject.kind!==`near_wallet`)throw Error(`[login] NEAR unlock returned an ECDSA-only account subject`);return{success:!0,kind:`near_wallet_unlocked`,walletId:e.identity.walletId,loggedInNearAccountId:String(e.identity.nearAccountId),operationalPublicKey:e.accountSubject.operationalPublicKey,nearAccountId:e.identity.nearAccountId};case`evm_family_ecdsa_only_wallet`:if(e.accountSubject.kind!==`ecdsa_wallet_only`)throw Error(`[login] ECDSA-only unlock returned a NEAR account subject`);return{success:!0,kind:`ecdsa_wallet_unlocked`,walletId:e.identity.walletId}}return $(e.identity)}async function BI(e,t,n){return await pL(e,t,n,{kind:`wallet_only`})}async function VI(e){let t=e.authority.signerActivations.ed25519;if(!t)return{kind:`absent`};let n=GF(e.signerMaterials,e.authority.authorityId,e.authMethod.walletAuthMethodId,t.materialActivation);if(!n||n.kind!==`wallet_authority_linked_signer_material_v1`||n.keyFamily!==`ed25519`||!b(n.materialActivation,t.materialActivation))return{kind:`invalid`};let r=n.publicFacts.applicationBinding;if(r.wallet_id!==String(e.walletId))return{kind:`invalid`};let i=null,a=await new Ts(K).listLanes();for(let o of a){let a;switch(e.authMethod.kind){case V.passkey:a=o.auth.kind===V.passkey&&String(o.auth.rpId)===String(e.authMethod.rpId)&&String(o.auth.credentialIdB64u)===String(e.authMethod.credentialIdB64u);break;case V.emailOtp:a=o.auth.kind===V.emailOtp;break;default:return $(e.authMethod)}if(!(!a||String(o.walletId)!==String(e.walletId)||o.signerSlot!==r.key_creation_signer_slot||String(o.nearEd25519SigningKeyId)!==r.near_ed25519_signing_key_id||String(o.thresholdSessionId)!==n.publicFacts.targetBinding.lifecycle.session_id||!b(o.materialActivation,t.materialActivation))){if(i)return{kind:`invalid`};i=o}}if(!i)return{kind:`invalid`};let o=ks(i.signerSlot,{min:1});return o?{kind:`resolved`,subject:{kind:`near_ed25519_wallet`,walletId:e.walletId,nearAccountId:i.nearAccountId,nearEd25519SigningKeyId:i.nearEd25519SigningKeyId,signerSlot:o}}:{kind:`invalid`}}function HI(e){let t=or({kind:`wallet_auth_authority_ref`,walletId:e.authority.walletId,authorityDigest:e.authority.authorityDigestB64u,walletAuthMethodId:e.authMethod.walletAuthMethodId});if(!t)throw Error(`[login] linked device wallet authority reference is invalid`);return t}async function UI(e){let t=o(e);if(!t.ok)return null;let n=t.value;try{let e=await K.resolveSelectedWalletAuthority(String(n));if(e.kind!==`resolved`)return null;let{selection:t,authMethod:r,authority:i}=e;if(KF({walletId:n,selection:t,authMethod:r,authority:i}).length>0||r.status!==`active`||i.state!==`active`)return null;let a=[],o=await VI({walletId:n,authMethod:r,authority:i,signerMaterials:e.signerMaterials});if(o.kind===`invalid`)return null;o.kind===`resolved`&&a.push(o.subject);let s=i.signerActivations.ecdsa;if(s){let t=GF(e.signerMaterials,i.authorityId,r.walletAuthMethodId,s.materialActivation);if(!t||t.keyFamily!==`ecdsa_secp256k1`||!b(t.materialActivation,s.materialActivation))return null;let o;try{o=r.kind===V.passkey?await VF(r):HI({authority:i,authMethod:r})}catch{return null}a.push({kind:`evm_family_ecdsa_wallet`,walletId:n,capability:s.materialActivation.capability,authority:o,ecdsaThresholdKeyId:t.ecdsaThresholdKeyId})}let c=a[0];return c?{kind:`wallet_unlock_subject_set`,walletId:n,subjects:[c,...a.slice(1)]}:null}catch{return null}}async function WI(e){let t=await EF(a(e.relayUrl,`/wallet/unlock/challenge`),{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({unlockBackend:`passkey`,userId:String(e.walletId),rpId:e.rpId})}),n=await t.json().catch(()=>({})),r=j(n)?n:{};if(!t.ok||r.ok!==!0)throw Error(typeof r.message==`string`?r.message:`wallet/unlock/challenge failed (HTTP ${t.status})`);let i=String(r.challengeId||``).trim(),o=String(r.challengeB64u||``).trim();if(!i||!o)throw Error(`[login] linked passkey challenge is incomplete`);return{challengeId:i,challengeB64u:o}}function GI(e){return{id:e,type:`public-key`,transports:[]}}function KI(e,t){return e.capabilitySubjects.some(e=>(e.kind===`sign`||e.kind===`export_keys`)&&e.keyFamily===(t===`ed25519`?`ed25519`:`ecdsa_secp256k1`))}function qI(e){let t=e.filter(e=>e.keyFamily===`ed25519`);if(t.length>1)throw Error(`[login] linked passkey has multiple active Ed25519 materials`);return t[0]??null}function JI(e){let t=e.filter(e=>e.keyFamily===`ecdsa_secp256k1`);if(t.length>1)throw Error(`[login] linked passkey has multiple active ECDSA materials`);return t[0]??null}async function YI(e){let t=Ud({walletId:e.selection.walletId,materialActivation:e.material.materialActivation});if(t){let[n,r]=await Promise.all([L({authority:t.factorAuthority}),L({authority:e.factorAuthority})]);if(t.authorityId!==e.selection.authority.authorityId||t.walletAuthMethodId!==e.selection.authMethod.walletAuthMethodId||t.ecdsaThresholdKeyId!==e.material.publicFacts.ecdsaThresholdKeyId||n.authorityDigest!==r.authorityDigest)throw Error(`[login] linked ECDSA holder runtime conflicts with the selected authority`);return{runtime:t,installed:!1}}let n=pe(`linked-ecdsa-holder`);try{let t=await Zu({holderHandleId:n,ownedSigningShare32:e.material.material.slice(),activationReceiptJson:JSON.stringify(e.material.publicFacts.activationReceipt),workerCtx:e.context.signingEngine.getSignerWorkerContext()}),r={kind:`linked_ecdsa_holder_runtime_v1`,walletId:e.selection.walletId,authorityId:e.selection.authority.authorityId,walletAuthMethodId:e.selection.authMethod.walletAuthMethodId,factorAuthority:e.factorAuthority,materialActivation:e.material.materialActivation,holderHandleId:t.holderHandleId,ecdsaThresholdKeyId:e.material.publicFacts.ecdsaThresholdKeyId,activationReceipt:e.material.publicFacts.activationReceipt};return Bd(r),{runtime:r,installed:!0}}catch(t){throw await fd({holderHandleId:n,workerCtx:e.context.signingEngine.getSignerWorkerContext()}).catch(()=>void 0),t}}async function XI(e){if(e.kind===`passkey`){let t=await qF(String(e.walletId));if(!t)throw Error(`[login] linked Passkey authority is unavailable after link`);return t}let t=await JF({walletIdInput:String(e.walletId),walletAuthMethodId:String(e.walletAuthMethodId),emailHashHex:e.emailHashHex,provider:e.providerIdentity.provider,providerSubjectId:e.providerIdentity.providerSubjectId});if(t.kind!==`selected`)throw Error(t.kind===`rejected`?t.message:`[login] linked Email OTP authority is unavailable after link`);return t.selection}async function ZI(e){let t=$I(e.material),n=Vi(`ed25519:${zi(t.registeredPublicKey)}`),r=_o({kind:`router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1`,walletId:String(e.selection.walletId),nearAccountId:n,nearEd25519SigningKeyId:t.applicationBinding.near_ed25519_signing_key_id,signerSlot:t.applicationBinding.key_creation_signer_slot,thresholdSessionId:t.scope.threshold_session_id,signingWorkerId:t.scope.signing_worker_id,participantIds:t.participantIds});if(!r.ok)throw Error(r.message);let i=await fetch(`${new URL(e.relayerUrl).origin}${so}`,{method:`POST`,headers:{Authorization:`Bearer ${e.operationCredential.token}`,"Content-Type":`application/json`},body:JSON.stringify(r.value)}),a=await i.json().catch(()=>null);if(!i.ok||!j(a)){let e=j(a)?String(a.message||``).trim():``;throw Error(`[login] linked Ed25519 post-link bootstrap failed (HTTP ${i.status}): ${e||`invalid response`}`)}let o=s(a.thresholdSessionId),c=br(a.walletSessionId),l=vr(a.quotaId),u=Tn(a.runtimePolicyScope),d=js(a.routerAbNormalSigning),f=Array.isArray(a.participantIds)?a.participantIds:[];if(a.kind!==`router_ab_ed25519_yao_warm_recovery_bootstrap_v1`&&a.kind!==`router_ab_ed25519_yao_v2_session_bootstrap_v1`||String(a.walletId)!==String(e.selection.walletId)||String(a.nearAccountId)!==r.value.nearAccountId||String(a.nearEd25519SigningKeyId)!==r.value.nearEd25519SigningKeyId||String(a.signingWorkerId)!==r.value.signingWorkerId||!o.ok||!c.ok||!l.ok||!u||!d||f.length!==2||!Number.isSafeInteger(f[0])||!Number.isSafeInteger(f[1])||String(c.value)!==String(e.operationCredential.walletSessionId)||String(o.value)!==r.value.thresholdSessionId)throw Error(`[login] linked Ed25519 post-link bootstrap identity is invalid`);let p=Number(a.thresholdExpiresAtMs);if(!Number.isSafeInteger(p)||p<=Date.now())throw Error(`[login] linked Ed25519 post-link bootstrap is expired`);return{walletId:String(e.selection.walletId),nearAccountId:r.value.nearAccountId,nearEd25519SigningKeyId:r.value.nearEd25519SigningKeyId,relayerKeyId:r.value.signingWorkerId,participantIds:[f[0],f[1]],thresholdSessionId:o.value,authorizationId:e.walletSession.authorizationId,walletSessionId:c.value,quotaId:l.value,expiresAtMs:p,remainingUses:Mn,runtimePolicyScope:u,routerAbNormalSigning:d,operationCredential:e.operationCredential}}async function QI(e){let t=await XI(e.factor);XF(t,e.walletSession);let n=String(e.context.configs.network.relayer?.url||``).trim();if(!n)throw Error(`[login] linked post-link activation requires relayer.url`);await G.writeExactWithOperationCredential({record:e.walletSession,operationCredential:e.operationCredential});let r=await $F({selection:t,factorSecret32:e.factorSecret32});try{let i=e.factor.kind===`email_otp`?e.factor.providerIdentity:void 0,a=await UF({selection:t,...i?{providerIdentity:i}:{}}),o=JI(r);if(o){let{runtime:r}=await YI({context:e.context,selection:t,factorAuthority:a,material:o});jP({runtime:r,operationCredential:e.operationCredential,expiresAtMs:e.walletSession.expiresAtMs,relayerUrl:n,workerCtx:e.context.signingEngine.getSignerWorkerContext()})}let s=qI(r);if(s){let r=await ZI({relayerUrl:n,selection:t,walletSession:e.walletSession,operationCredential:e.operationCredential,material:s});await iL({context:e.context,selection:t,session:r,material:s,relayerUrl:n,...i?{providerIdentity:i}:{}})}t.exportRoot&&(e.factor.kind===`passkey`?await e.context.signingEngine.establishUnlockedWalletEd25519ExportRootCapabilityV1({existingEnvelope:t.exportRoot.envelope,passkeyPrfFirstB64u:F(e.factorSecret32),walletId:String(t.walletId),walletAuthMethodId:String(t.authMethod.walletAuthMethodId),walletSessionId:String(e.operationCredential.walletSessionId),expiresAtMs:e.walletSession.expiresAtMs}):(ni(t.exportRoot.envelope.binding)||t.exportRoot.envelope.binding.kind===`ed25519_yao_client_root_v1`)&&await Bt(en(e.context.signingEngine.getSignerWorkerContext()),{existingEnvelope:t.exportRoot.envelope,existingFactorSecret:e.factorSecret32,walletId:String(t.walletId),walletAuthMethodId:String(t.authMethod.walletAuthMethodId),walletSessionId:String(e.operationCredential.walletSessionId),expiresAtMs:e.walletSession.expiresAtMs})),await e.context.signingEngine.markWalletSelectionUnlocked({walletId:t.walletId,walletAuthMethodId:t.authMethod.walletAuthMethodId})}finally{for(let e of r)e.material.fill(0)}}function $I(e){let t=e.publicFacts.targetBinding,n=e.publicFacts.activationReceipt;return{kind:Ie,scope:{lifecycle_id:t.lifecycle.lifecycle_id,root_share_epoch:t.lifecycle.root_share_epoch,account_id:t.lifecycle.account_id,threshold_session_id:t.lifecycle.session_id,signer_set_id:t.lifecycle.signer_set_id,signing_worker_id:t.lifecycle.selected_server_id,material_activation:t.material_activation},applicationBinding:e.publicFacts.applicationBinding,participantIds:e.publicFacts.participantIds,registeredPublicKey:Uint8Array.from(n.registered_public_key),signingWorkerVerifyingShare:Uint8Array.from(n.signing_worker_verifying_share),stateEpoch:BigInt(n.state_epoch),transcript:Uint8Array.from(n.transcript),activeCapabilityBinding:t.session_id,materialActivation:e.materialActivation}}function eL(e){let t=String(e?.providerSubjectId||``).trim();if(!t)throw Error(`[login] linked Email OTP lane provider identity is missing`);return t}function tL(e){let t=e.session;if(t.walletSessionId!==e.operationCredential.walletSessionId||t.sessionKind===`issued_exact_wallet_session`&&t.operationCredential.walletSessionId!==e.operationCredential.walletSessionId)throw Error(`[login] linked Passkey Ed25519 credentials identify different sessions`);return{walletId:t.walletId,nearAccountId:t.nearAccountId,nearEd25519SigningKeyId:t.nearEd25519SigningKeyId,relayerKeyId:t.relayerKeyId,participantIds:t.participantIds,thresholdSessionId:t.thresholdSessionId,authorizationId:t.authorizationId,walletSessionId:t.walletSessionId,quotaId:t.quotaId,expiresAtMs:t.expiresAtMs,remainingUses:t.remainingUses,runtimePolicyScope:t.runtimePolicyScope,routerAbNormalSigning:t.routerAbNormalSigning,operationCredential:e.operationCredential}}function nL(e){let t=e.session;if(t.authorityScope.kind!==`email_otp`||String(t.authorityScope.providerUserId)!==String(e.providerIdentity.providerSubjectId)){let n=[...t.authorityScope.kind===`email_otp`?[]:[`scope.kind`],...t.authorityScope.kind===`email_otp`&&String(t.authorityScope.providerUserId)!==String(e.providerIdentity.providerSubjectId)?[`scope.providerUserId`]:[]];throw Error(`[login] linked Email OTP Ed25519 session authority mismatch: ${n.join(`, `)}`)}let n=s(t.thresholdSessionId),r=Cr(t.authorizationId),i=br(t.walletSessionId),a=vr(t.quotaId);if(!n.ok||!r.ok||!i.ok||!a.ok)throw Error(`[login] linked Email OTP Ed25519 session identity is invalid`);if(e.operationCredential.walletSessionId!==i.value)throw Error(`[login] linked Email OTP Ed25519 credential identifies another session`);return{walletId:String(t.walletId),nearAccountId:t.nearAccountId,nearEd25519SigningKeyId:t.nearEd25519SigningKeyId,relayerKeyId:t.routerAbNormalSigning.signingWorkerId,participantIds:t.participantIds,thresholdSessionId:n.value,authorizationId:r.value,walletSessionId:i.value,quotaId:a.value,expiresAtMs:t.expiresAtMs,remainingUses:t.remainingUses,runtimePolicyScope:t.runtimePolicyScope,routerAbNormalSigning:t.routerAbNormalSigning,operationCredential:e.operationCredential}}function rL(e){let t=Hi(e.session.nearAccountId),n={walletId:e.selection.walletId,nearAccountId:t,thresholdSessionId:e.session.thresholdSessionId,runtimePolicyScope:e.session.runtimePolicyScope,materialActivation:e.material.materialActivation,nearEd25519SigningKeyId:Ho(e.session.nearEd25519SigningKeyId),signerSlot:e.material.publicFacts.applicationBinding.key_creation_signer_slot};return e.selection.authMethod.kind===`passkey`?{...n,auth:{kind:`passkey`,rpId:wo(e.selection.authMethod.rpId),credentialIdB64u:e.selection.authMethod.credentialIdB64u}}:{...n,auth:{kind:`email_otp`,providerSubjectId:eL(e.providerIdentity)},remainingUses:e.session.remainingUses,expiresAtMs:e.session.expiresAtMs}}async function iL(e){let t=$I(e.material),n=t.applicationBinding,r=[];if(e.session.walletId!==String(e.selection.walletId)&&r.push(`walletId`),n.wallet_id!==String(e.selection.walletId)&&r.push(`application.walletId`),t.scope.account_id!==String(e.selection.walletId)&&r.push(`material.walletId`),e.session.nearEd25519SigningKeyId!==n.near_ed25519_signing_key_id&&r.push(`nearEd25519SigningKeyId`),e.session.thresholdSessionId!==t.scope.threshold_session_id&&r.push(`thresholdSessionId`),e.session.relayerKeyId!==t.scope.signing_worker_id&&r.push(`signingWorkerId`),r.length>0)throw Error(`[login] linked Ed25519 Wallet Session does not match local material: ${r.join(`, `)}`);let i=(await ft.initializeBundled()).importLinkedMaterial({ownedClientScalarShare:e.material.material,publicReceipt:e.material.publicFacts.activationReceipt,metadata:t}),a=!1;try{let r=await e.context.signingEngine.activateVerifiedNearEd25519YaoMaterial({activeClient:i,facts:{thresholdSessionId:e.session.thresholdSessionId,signer:Bc({walletId:e.selection.walletId,nearAccountId:Hi(e.session.nearAccountId),nearEd25519SigningKeyId:Ho(e.session.nearEd25519SigningKeyId),signerSlot:n.key_creation_signer_slot}),signingRootId:n.signing_root_id,signingRootVersion:t.scope.root_share_epoch,routerAbNormalSigning:e.session.routerAbNormalSigning,runtimePolicyScope:e.session.runtimePolicyScope,relayerUrl:e.relayerUrl}}),o=Hi(e.session.nearAccountId);if(String(r.walletId)!==String(e.selection.walletId)||String(r.nearAccountId)!==String(o)||!b(r.materialActivation,e.material.materialActivation))throw Error(`[login] linked Ed25519 activation identity does not match the V2 session`);await Ss(new Ts(K),rL({selection:e.selection,session:e.session,material:e.material,...e.providerIdentity?{providerIdentity:e.providerIdentity}:{}})),a=!0}finally{a||i.dispose()}let o=Hi(e.session.nearAccountId);return{success:!0,kind:`near_wallet_unlocked`,walletId:e.selection.walletId,loggedInNearAccountId:String(o),operationalPublicKey:`ed25519:${zi(t.registeredPublicKey)}`,nearAccountId:o}}function aL(e){let[t,...n]=e.signerMaterials;if(e.authority.provenance.kind===`device_link`){if(!t)throw Error(`[login] linked Email OTP authority has no signer material`);return{kind:`linked_device`,selection:e,signerMaterials:[t,...n]}}if(t)throw Error(`[login] owner Email OTP authority must not carry linked signer material`);return{kind:`owner_authority`,selection:e}}async function oL(e){let{source:t}=e;if(t.kind===`linked_device`){let e=t.signerMaterials.find(e=>e.kind===`wallet_authority_linked_signer_material_v1`&&e.keyFamily===`ed25519`);return e?{kind:`linked_device`,signerSlot:e.publicFacts.applicationBinding.key_creation_signer_slot,remainingUses:Mn}:{kind:`no_ed25519`}}return!t.selection.authority.signerActivations.ed25519||await sL(t.selection)?{kind:`no_ed25519`}:await e.context.signingEngine.resolveOwnerAuthorityEd25519UnlockRequestInternal({walletSession:{walletId:t.selection.walletId,walletSessionUserId:String(t.selection.walletId)},providerSubjectId:e.providerIdentity.providerSubjectId,walletAuthMethodId:String(t.selection.authMethod.walletAuthMethodId),remainingUses:Mn})??{kind:`no_ed25519`}}async function sL(e){let t=e.authority.signerActivations.ed25519?.materialActivation;return t?(await K.listPendingWalletRegistrationCommits()).some(cL.bind(void 0,e,t)):!1}function cL(e,t,n){return n.operation===`near_provisioning`&&n.phase===`joined`&&n.signerPlanKind===`near_ed25519_and_evm_family_ecdsa`&&n.walletId===e.walletId&&n.walletAuthMethodId===e.authMethod.walletAuthMethodId&&b(n.localMaterial.ed25519.metadata.materialActivation,t)}async function lL(e){let{selection:t,unlocked:n}=e,r=n.walletSession;if(r.walletId!==t.walletId||r.authorityId!==t.authority.authorityId||r.authMethodId!==t.authMethod.walletAuthMethodId||r.authorityDigestB64u!==t.authority.authorityDigestB64u||r.authorityRevocationEpoch!==t.authority.revocationEpoch)throw Error(`[login] owner Email OTP Wallet Session does not match the selected authority`);let i=t.authority.signerActivations.ed25519?.materialActivation;if(!i)return;if(n.ed25519Activation.kind!==`ed25519_activation_ready`){if(await sL(t))return;throw Error(`[login] owner Email OTP unlock built no Ed25519 runtime to install`)}let a=n.ed25519Activation;if(!b(a.bootstrap.capability.materialActivation,i))throw Error(`[login] owner Email OTP Ed25519 capability names another activation`);if(!b(a.metadata.materialActivation,i))throw Error(`[login] owner Email OTP Ed25519 runtime names another activation`);if(a.bootstrap.session.walletSessionId!==n.operationCredential.walletSessionId)throw Error(`[login] owner Email OTP Ed25519 session credential mismatch`);let o=await WF({selection:t,providerIdentity:e.providerIdentity});await e.context.signingEngine.activateOwnerAuthorityEd25519RuntimeInternal({walletSession:{walletId:t.walletId,walletSessionUserId:String(t.walletId)},providerSubjectId:e.providerIdentity.providerSubjectId,walletAuthMethodId:String(t.authMethod.walletAuthMethodId),emailHashHex:e.emailHashHex,authority:o,activeClientHandle:a.activeClientHandle,metadata:a.metadata,bootstrap:a.bootstrap})}function uL(e){switch(e.walletCustodySeed.kind){case`owner_authority_seed_envelope`:return e.walletCustodySeed.existingEnvelope;case`linked_device_seed_unavailable`:throw Error(`[login] owner Email OTP unlock returned linked-device custody state`);default:return $(e.walletCustodySeed)}}async function dL(e){let t={provider:e.providerSubjectId.startsWith(`google:`)?`google`:`email`,providerSubjectId:e.providerSubjectId},n=await JF({walletIdInput:e.walletIdInput,emailHashHex:e.emailHashHex,provider:t.provider,providerSubjectId:t.providerSubjectId,walletAuthMethodId:e.walletAuthMethodId});if(n.kind===`none`)throw Error(`[login] linked Email OTP authority is unavailable`);if(n.kind===`rejected`)throw Error(n.message);let r=n.selection;if(String(r.authMethod.walletAuthMethodId)!==String(e.walletAuthMethodId))throw Error(`[login] linked Email OTP selected auth method changed during unlock`);let i=String(e.relayUrl||``).trim();if(!i)throw Error(`[login] linked Email OTP unlock requires relayer.url`);let a=aL(r),o=await oL({context:e.context,source:a,providerIdentity:t}),s=await he({relayUrl:i,walletId:String(r.walletId),walletAuthMethodId:String(r.authMethod.walletAuthMethodId),challengeId:e.challengeId,otpCode:e.otpCode,ed25519:o,workerCtx:e.context.signingEngine.getSignerWorkerContext()}),c=s.factorSecret32,l=t,u=null,d=null,f=s.ed25519Activation.kind===`ed25519_activation_ready`?s.ed25519Activation.activeClientHandle:null;try{if(a.kind===`owner_authority`){if(await G.writeExactWithOperationCredential({record:s.walletSession,operationCredential:s.operationCredential}),await lL({context:e.context,selection:r,unlocked:s,providerIdentity:l,emailHashHex:e.emailHashHex}),f=null,!c)throw Error(`[login] owner Email OTP factor secret ownership was lost`);await Bt(en(e.context.signingEngine.getSignerWorkerContext()),{existingEnvelope:uL(s),existingFactorSecret:c,walletId:String(r.walletId),walletAuthMethodId:String(r.authMethod.walletAuthMethodId),walletSessionId:String(s.operationCredential.walletSessionId),expiresAtMs:s.walletSession.expiresAtMs}),await e.context.signingEngine.markWalletSelectionUnlocked({walletId:r.walletId,walletAuthMethodId:r.authMethod.walletAuthMethodId}),e.context.signingEngine.setWalletAuthenticated({kind:`authenticated`,walletId:r.walletId,authMethod:V.emailOtp}),oz({context:e.context,sessionAuthority:{record:s.walletSession,operationCredential:s.operationCredential},factor:{kind:`email_otp`,provider:t.provider,providerSubject:t.providerSubjectId,emailHashHex:e.emailHashHex},ownedFactorSecret:c.slice().buffer,custodyEnvelope:uL(s)});return}if(XF(r,s.walletSession),!c)throw Error(`[login] linked Email OTP factor secret ownership was lost`);u=await tI({selection:r,factorSecret32:c});let n=qI(u),o=JI(u);if(KI(s.walletSession,`ed25519`)){if(!n||!s.ed25519Activation.bootstrap)throw Error(`[login] linked Email OTP Ed25519 runtime material or capability is missing`);if(!b(s.ed25519Activation.bootstrap.capability.materialActivation,n.materialActivation))throw Error(`[login] linked Email OTP Ed25519 capability activation is invalid`)}if(KI(s.walletSession,`ecdsa`)){if(!o)throw Error(`[login] linked Email OTP ECDSA runtime material is missing`);let t=await YI({context:e.context,selection:r,factorAuthority:await UF({selection:r,providerIdentity:l}),material:o});t.installed&&(d=t.runtime)}let p;if(n&&s.ed25519Activation.bootstrap){let t=nL({session:s.ed25519Activation.bootstrap.session,operationCredential:s.operationCredential,providerIdentity:l});if(t.walletSessionId!==s.operationCredential.walletSessionId)throw Error(`[login] linked Email OTP Ed25519 session credential mismatch`);p=await iL({context:e.context,selection:r,session:t,material:n,relayerUrl:i,providerIdentity:l})}else if(o)p={success:!0,kind:`ecdsa_wallet_unlocked`,walletId:r.walletId};else throw Error(`[login] linked Email OTP has no unlockable signing runtime`);await G.writeExactWithOperationCredential({record:s.walletSession,operationCredential:s.operationCredential}),r.exportRoot&&ni(r.exportRoot.envelope.binding)&&await Bt(en(e.context.signingEngine.getSignerWorkerContext()),{existingEnvelope:r.exportRoot.envelope,existingFactorSecret:c,walletId:String(r.walletId),walletAuthMethodId:String(r.authMethod.walletAuthMethodId),walletSessionId:String(s.operationCredential.walletSessionId),expiresAtMs:s.walletSession.expiresAtMs}),await e.context.signingEngine.markWalletSelectionUnlocked({walletId:r.walletId,walletAuthMethodId:r.authMethod.walletAuthMethodId}),e.context.signingEngine.setWalletAuthenticated({kind:`authenticated`,walletId:p.walletId,authMethod:V.emailOtp})}catch(t){d&&(kd({walletId:d.walletId,materialActivation:d.materialActivation,holderHandleId:d.holderHandleId}),await fd({holderHandleId:d.holderHandleId,workerCtx:e.context.signingEngine.getSignerWorkerContext()}).catch(()=>void 0));let n=e.context.signingEngine.getSignerWorkerContext();throw n&&await Dt(en(n),{kind:`wallet_session`,walletSessionId:String(s.operationCredential.walletSessionId)}),await Promise.allSettled([e.context.signingEngine.clearVolatileWarmSigningMaterial(r.walletId),G.clearWallet(r.walletId)]),t}finally{if(f){let t=e.context.signingEngine.getSignerWorkerContext();t&&await Zw({workerContext:t,activeClientHandle:f}).catch(()=>void 0),f=null}for(let e of u||[])e.material.fill(0);c?.fill(0)}}async function fL(e,t,n){let r=String(t).trim()||`linked-passkey`,{onEvent:i,onError:a,afterCall:o}=n||{};Q(i,r,{phase:W.STEP_01_STARTED,status:`started`,authMethod:`passkey`});try{let n=await qF(t);if(!n)throw Error(`[login] linked passkey authority is unavailable`);let a=String(e.configs.network.relayer?.url||``).trim();if(!a)throw Error(`[login] linked passkey unlock requires relayer.url`);Q(i,r,{phase:W.STEP_03_PASSKEY_CHALLENGE_STARTED,status:`running`,authMethod:`passkey`});let s=await WI({relayUrl:a,walletId:n.walletId,rpId:n.authMethod.rpId});Q(i,r,{phase:W.STEP_03_PASSKEY_PROMPT_STARTED,status:`running`,authMethod:`passkey`,interaction:{kind:`passkey_assert`,overlay:`show`}});let c=await e.signingEngine.getAuthenticationCredentialsSerialized({subjectId:String(n.walletId),challengeB64u:s.challengeB64u,allowCredentials:[GI(n.authMethod.credentialIdB64u)],includeSecondPrfOutput:!0});Q(i,r,{phase:W.STEP_03_PASSKEY_PROMPT_SUCCEEDED,status:`succeeded`,authMethod:`passkey`,interaction:{kind:`passkey_assert`,overlay:`hide`}});let l=String(typeof window<`u`?window.location.origin:``).trim(),u={challengeId:s.challengeId,webauthn_authentication:c,ed25519SessionRequest:n.signerMaterials.some(e=>e.keyFamily===`ed25519`)?{kind:`requested`,remainingUses:Mn}:{kind:`not_requested`},...l?{expected_origin:l}:{}};Q(i,r,{phase:W.STEP_04_WALLET_UNLOCK_EXCHANGE_STARTED,status:`running`,authMethod:`passkey`});let d=await Kt(a,u);if(!d.success)throw Error(d.error);XF(n,d.walletSession);let f=await QF({selection:n,credential:c}),p;try{let t=qI(f),r=JI(f);if(KI(d.walletSession,`ed25519`)&&(!t||!d.ed25519Session))throw Error(`[login] linked Ed25519 runtime material or Wallet Session is missing`);if(KI(d.walletSession,`ecdsa`)){if(!r)throw Error(`[login] linked ECDSA runtime material is missing`);await YI({context:e,selection:n,factorAuthority:await UF({selection:n}),material:r})}if(t&&d.ed25519Session)p=await iL({context:e,selection:n,session:tL({session:d.ed25519Session,operationCredential:d.operationCredential}),material:t,relayerUrl:a});else if(r)p={success:!0,kind:`ecdsa_wallet_unlocked`,walletId:n.walletId};else throw Error(`[login] linked passkey has no unlockable signing runtime`);if(await G.writeExactWithOperationCredential({record:d.walletSession,operationCredential:d.operationCredential}),n.exportRoot){let t=ke(c);if(!t)throw Error(`[login] linked export-root unlock requires WebAuthn PRF.first output`);await e.signingEngine.establishUnlockedWalletEd25519ExportRootCapabilityV1({existingEnvelope:n.exportRoot.envelope,passkeyPrfFirstB64u:t,walletId:String(n.walletId),walletAuthMethodId:String(n.authMethod.walletAuthMethodId),walletSessionId:String(d.operationCredential.walletSessionId),expiresAtMs:d.walletSession.expiresAtMs})}await e.signingEngine.markWalletSelectionUnlocked({walletId:n.walletId,walletAuthMethodId:n.authMethod.walletAuthMethodId})}catch(t){throw await Promise.allSettled([e.signingEngine.clearVolatileWarmSigningMaterial(n.walletId),G.clearWallet(n.walletId)]),t}finally{for(let e of f)e.material.fill(0)}return Q(i,r,{phase:W.STEP_04_WALLET_UNLOCK_EXCHANGE_SUCCEEDED,status:`succeeded`,authMethod:`passkey`}),await hL({context:e,authMethod:V.passkey,unlockSubjectId:r,loginResult:p,onEvent:i,afterCall:o})}catch(e){let t=N(e);return await gL({unlockSubjectId:r,message:t.message,error:t,onEvent:i,onError:a,afterCall:o,cancelled:le(t)})}}async function pL(e,t,n,r){let{onEvent:i,onError:a,afterCall:o}=n||{},{signingEngine:s}=e,c=OF({selection:n?.unlockSelection,subjectSet:t}),l=NF({subjectSet:t,selection:c}),u=l.kind===`near_ed25519_capable_wallet`?String(l.nearAccountId):String(l.walletId),d;Q(i,u,{phase:W.STEP_01_STARTED,status:`started`,authMethod:`passkey`});try{if(s.assertSealedRefreshStartupParity().catch(e=>{console.warn(`[login] sealed refresh startup parity check failed during unlock; continuing to local passkey prompt`,e instanceof Error?e.message:String(e||`unknown error`))}),typeof window<`u`&&!window.isSecureContext){let e=`Passkey operations require a secure context (HTTPS or localhost).`;return await gL({unlockSubjectId:u,message:e,error:Error(e),onEvent:i,onError:a,afterCall:o,callAfterCall:!1})}let{accountSubject:t,authenticators:r,baseSignerSlot:f,localUnlockAuthMethod:p,requiresLocalPasskeyUnlock:m}=await RI({signingEngine:s,identity:l,signerSlotHint:ks(n?.signerSlot,{min:1}),onEvent:i}),h=async e=>{let t=DI({authenticators:r,credentialIds:e.credentialIds}),n=await tF({signingEngine:s,subjectId:u,challengeB64u:e.challengeB64u,authenticators:t,onPromptStarted:()=>{Q(i,u,{phase:W.STEP_03_PASSKEY_PROMPT_STARTED,status:`waiting_for_user`,authMethod:`passkey`,interaction:{kind:`passkey_assert`,overlay:`show`}})},onPromptSucceeded:()=>{Q(i,u,{phase:W.STEP_03_PASSKEY_PROMPT_SUCCEEDED,status:`succeeded`,authMethod:`passkey`,interaction:{kind:`passkey_assert`,overlay:`hide`}})}});return e.saveAsLoginCredential&&(d=n),n},g=async()=>{let e=await rF({currentCredential:d,collectCredentialForChallenge:async e=>await h({challengeB64u:e,saveAsLoginCredential:!0,credentialIds:AI({authenticators:r,signerSlot:f,serverCredentialIds:[]})})});e&&(d=e)},_=(()=>{let t=n?.signingSession?.ttlMs??e.configs?.signing.sessionDefaults?.ttlMs,r=n?.signingSession?.remainingUses,i=e.configs?.signing.sessionDefaults?.remainingUses,a=r??i??Mn,o=typeof t==`number`?Math.floor(t):Math.floor(Number(t)||0),s=xn({requestedRemainingUses:a});return{ttlMs:Math.max(0,o),unlockRemainingUses:s}})(),v=_.ttlMs>0&&_.unlockRemainingUses!=null,y=v&&l.kind===`near_ed25519_capable_wallet`?mh({clientDB:K,keyMaterialStore:K},l.nearAccountId,f).catch(()=>null):Promise.resolve(null),b=null,x=null,S=null,C=null,w=pI(),T=null,E=(e,t)=>{if(uI(t))return t;let n=String(t?.status||`not_found`);throw Error(`[login] ${e} did not produce an active warm signing session (status=${n})`)},ee=async t=>{Q(i,u,{phase:W.STEP_05_SIGNING_SESSION_WARMUP_STARTED,status:`running`,authMethod:d?`passkey`:`warm_session`});let a=t.wantsEd25519Warmup?PF(l):null,o=ze(e.configs),c=!1,h=async()=>{c||(c=!0,await s.clearVolatileWarmSigningMaterial(l.walletId))};t.wantsEcdsaWarmup&&RF(await LF({workerCtx:s.getSignerWorkerContext(),selectors:IF(l.subjectSet)}));let g=t.wantsEcdsaWarmup?await AR(e,l.walletId,{keyFactsInventoryAuthority:t.keyFactsInventoryAuthority,keyFactsInventoryRequested:!!n?.ecdsaKeyFactsInventory,relayerUrl:t.relayerUrl,rpId:t.rpId},p):{ecdsaKeys:[]},v=await y,w=v?.participants.map(e=>e.id)||[];t.wantsEcdsaWarmup&&FF({identity:l,context:g});let T=mR({selection:t.selection,selectedEcdsaTargets:t.selectedEcdsaTargets,storedCanonicalEcdsaContext:g,wantsEd25519Warmup:t.wantsEd25519Warmup}),ee=b,D=!!(ee&&T.signersToWarm.includes(`ecdsa`)),O=D?T.signersToWarm.includes(`ed25519`):T.ed25519DependsOnEcdsa,k=D?!1:T.ecdsaDependsOnEd25519,j=EI({requiresLocalPasskeyUnlock:m,hasLoginCredential:!!d,routeAuthorization:t.routeAuthorization,warmupPlan:T});await h();let te=hR(`threshold-login`),M=T.signersToWarm.includes(`ed25519`)?O?{kind:`ecdsa_authorized`,thresholdSessionId:te}:{kind:`fresh`}:{kind:`not_requested`};switch(j.kind){case`existing_passkey_credential`:case`no_passkey_credential_required`:break;case`wallet_custody`:if(t.ed25519SessionAuthority.kind!==`passkey`)throw Error(`[login] wallet custody requires passkey wallet authority`);if(!C||C.ed25519.kind!==`active`)throw bR();M={kind:`wallet_custody`,thresholdSessionId:te,custody:{...C,ed25519:C.ed25519}};break;default:return $(j)}if(a&&!v&&M.kind!==`wallet_custody`)throw Error(`[login] threshold warm-up requires threshold key material for ${a.nearAccountId} signer slot ${t.signerSlot}`);let ne=d?st(d):``,re=String(ne||r.find(e=>e.signerSlot===f)?.credentialId||r[0]?.credentialId||``).trim(),ie=d?{kind:`available`,credential:d,localPasskeyCredentialIdB64u:re}:re?{kind:`credential_id_only`,localPasskeyCredentialIdB64u:re}:{kind:`unavailable`,localPasskeyCredentialIdB64u:``},ae=o?{kind:`available`,runtimeScopeBootstrap:o}:{kind:`unavailable`},oe=await rR({statusReads:A,context:e,signingEngine:s,walletIdentity:l,signerSlot:t.signerSlot,thresholdKeyMaterial:v,relayerUrl:t.relayerUrl,relayerKeyId:v?.relayerKeyId||``,participantIds:w,ttlMs:_.ttlMs,unlockRemainingUses:vR(_.unlockRemainingUses),ecdsaContext:T.ecdsaContext,credentialState:ie,runtimeScopeBootstrapState:ae,signersToWarm:T.signersToWarm,ed25519DependsOnEcdsa:O,ecdsaDependency:k?{kind:`ed25519_wallet_session_authority`}:{kind:`none`},ed25519MintPlan:M,ed25519SessionAuthority:t.ed25519SessionAuthority,routeAuthorization:t.routeAuthorization,passkeyExchangeEcdsaActivation:ee,passkeyUnlockEd25519Session:x,passkeyUnlockWalletSessionAuthorization:S});if(T.signersToWarm.includes(`ed25519`)){let e=oe.ed25519Session;if(!e)throw Error(`[login] threshold warm-up omitted the Ed25519 session result`);let t=E(`threshold warm-up`,NL({session:e,authMethod:p}));return Q(i,u,{phase:W.STEP_05_ED25519_SIGNING_SESSION_READY,status:`succeeded`,authMethod:`warm_session`}),T.signersToWarm.includes(`ecdsa`)&&Q(i,u,{phase:W.STEP_05_ECDSA_SIGNING_SESSION_READY,status:`succeeded`,authMethod:`warm_session`}),{kind:`threshold_login_warmup_ready`,signingSession:t,signersWarmed:T.signersToWarm}}if(T.signersToWarm.length!==1||T.signersToWarm[0]!==`ecdsa`)throw Error(`[login] threshold warm-up signer selection is invalid`);return Q(i,u,{phase:W.STEP_05_ECDSA_SIGNING_SESSION_READY,status:`succeeded`,authMethod:`warm_session`}),{kind:`threshold_login_ecdsa_only_warmup_ready`,signersWarmed:[`ecdsa`]}},D=async n=>{await s.setLastUser(l.walletId,n),l.kind===`near_ed25519_capable_wallet`&&(t.kind===`near_wallet`&&t.operationalPublicKey===null||await s.activateAuthenticatedWalletState({walletId:l.walletId,nearAccountId:Hi(l.nearAccountId),signerSlot:n,nearClient:e.nearClient}))},O=async()=>{await s.getNonceCoordinator().recoverDurableLeases({walletId:l.walletId}).catch(e=>{console.warn(`[login] nonce lane durable recovery after unlock failed`,e)})},k=TI({requiresLocalPasskeyUnlock:m,requireThresholdWarmup:v,hasLoginCredential:!!d});switch(k.kind){case`wallet_unlock_owns_passkey_credential`:case`passkey_credential_already_collected`:case`no_local_passkey_required`:break;case`local_unlock_passkey_assertion`:await g();break;default:return $(k)}let A=new wt;if(v&&p===V.passkey){let t=await CL({context:e,walletIdentity:l,selection:c,ttlMs:_.ttlMs,remainingUses:vR(_.unlockRemainingUses)}),n=String(e.configs.network.relayer.url||``).trim(),a=String(s.getRpId()||``).trim();if(!n||!a)throw Error(`[login] passkey wallet unlock requires relayer URL and rpId`);let o=await kL({context:e,walletIdentity:l,unlockSubjectId:u,onEvent:i,authenticators:r,signerSlot:f,remainingUses:vR(_.unlockRemainingUses),relayUrl:n,rpId:a,expectedOrigin:void 0,activation:t,collectCredentialForChallenge:async e=>await h({challengeB64u:e.challengeB64u,saveAsLoginCredential:!0,credentialIds:e.credentialIds})},A);d=o.credential,b=o.activation,x=o.result.ed25519Session,S=o.result.walletSessionAuthorization??(o.activation?vL(o.activation.sessionActivation):null),C=o.custody,await SL({walletId:String(l.walletId),unlock:o}),w=pI()}if(!d)throw Error(`[login] successful Passkey unlock omitted its credential`);if(await PI({context:e,walletIdentity:l,credential:d}),v){let t=await cI({walletId:l.walletId,authMethod:p}),i=yL({completedActivation:b,request:n?.ecdsaKeyFactsInventory,routeAuthorization:w,wantsEcdsaWarmup:jI({subjectSet:l.subjectSet,selection:c,hasConfiguredEcdsaTargets:Xe(e.configs.network.chains).length>0}).wantsEcdsaWarmup});if(T=await ee(MI({context:e,signerSlot:f,authenticators:r,selection:c,subjectSet:l.subjectSet,authMethod:p,authMethodBinding:t,keyFactsInventoryAuthority:i,routeAuthorization:w})),p===V.passkey){let t=d;if(!t)throw Error(`[login] passkey threshold warm-up completed without a credential`);await NI({context:e,statusReads:A,walletIdentity:l,signersWarmed:T.signersWarmed,credential:t})}}if(await D(f),O(),S&&d&&C){let t=ke(d);t&&oz({context:e,sessionAuthority:S,factor:{kind:`passkey`,rpId:s.getRpId(),credentialIdB64u:st(d),prfFirstB64u:t},ownedFactorSecret:I(t).slice().buffer,custodyEnvelope:C.envelope})}let j=zI({identity:l,accountSubject:t}),te=T?{...j,...T.kind===`threshold_login_warmup_ready`?{signingSession:T.signingSession}:{}}:j;return Q(i,u,{phase:W.STEP_06_SESSION_READY,status:`succeeded`,authMethod:d?`passkey`:void 0}),await hL({context:e,authMethod:p,unlockSubjectId:u,loginResult:te,onEvent:i,afterCall:o})}catch(t){return console.warn(`[login] unlock failed before active session commit`,{unlockSubjectId:u,message:t&&typeof t==`object`&&`message`in t?String(t.message||``):String(t||``)}),await mL({context:e,walletId:l.walletId}),await gL({unlockSubjectId:u,message:ue(t,`login`)||`Login failed`,error:t,cancelled:le(t),onEvent:i,onError:a,afterCall:o})}}async function mL(e){await K.clearLastProfileSelection().catch(()=>void 0);try{e.context.signingEngine.getNonceCoordinator().clearAll()}catch{}try{await e.context.signingEngine.clearVolatileWarmSigningMaterial(e.walletId)}catch{}}async function hL(e){let{context:t,authMethod:n,unlockSubjectId:r,loginResult:i,onEvent:a,afterCall:o}=e;return i.success&&t.signingEngine.setWalletAuthenticated({kind:`authenticated`,walletId:i.walletId,authMethod:n}),Q(a,r,{phase:W.STEP_07_COMPLETED,status:`succeeded`,data:{...i.success&&i.kind===`near_wallet_unlocked`?{operationalPublicKey:i.operationalPublicKey??``}:{walletId:i.success?String(i.walletId):``}}}),await o?.(!0,i),i}async function gL(e){let{message:t,unlockSubjectId:n,error:r,onEvent:i,onError:a,afterCall:o,callOnError:s=!0,callAfterCall:c=!0,cancelled:l=!1}=e;return s&&a?.(N(r)),Q(i,n,{phase:l?W.CANCELLED:W.FAILED,status:l?`cancelled`:`failed`,...l?{}:{message:t},interaction:{kind:`passkey_assert`,overlay:`hide`},error:{message:t}}),c&&await o?.(!1),{success:!1,error:t}}function _L(e){return Mg(e)?e.activation.session.threshold_session_id:e.session.threshold_session_id}function vL(e){return Mg(e)?e.authorization:{record:e.session.wallet_session,operationCredential:e.session.operation_credential}}function yL(e){if(!e.wantsEcdsaWarmup)return null;if(e.completedActivation){let t;try{let n=e.completedActivation.sessionActivation;if(Mg(n))t=ir(n.authorization.operationCredential);else{let n=e.completedActivation.response;if(n.kind!==`router_ab_ecdsa_post_registration_session_activated_v1`)throw Error(`completed ECDSA unlock activation branch is invalid`);t=ir(n.session.operation_credential)}}catch{throw Error(`[login] completed ECDSA unlock omitted a valid Wallet Session operation credential`)}return{kind:`wallet_session_operation_credential_v1`,operationCredential:t}}let t=dI({request:e.request??null,routeAuthorization:e.routeAuthorization});if(t?.kind===`webauthn`)throw Error(`[login] ECDSA warm-up requires the Wallet Session minted by the unlock assertion`);return t}function bL(e){let t=e.continuity.signers.find(t=>z(t.chainTarget)===e.prepared.targetKey);if(!t)throw Error(`Passkey ECDSA custody continuity omitted the requested chain target`);let n=t.walletKey.publicCapability,r=t.activationReceipt,i=r.ecdsa_activation,a=e.response.normal_signing.scope;if(t.walletKey.walletId!==e.walletId||t.walletKey.keyHandle!==e.prepared.policy.key_handle||e.response.session.threshold_session_id!==e.prepared.policy.session_policy.threshold_session_id||!BL(t.runtimePolicyScope,e.prepared.policy.session_policy.runtime_policy_scope)||!Qn(e.response.public_capability,n)||!Zn(e.activationReceipt,r)||n.context.application_binding_digest_b64u!==i.context.application_binding_digest_b64u||!Gn(n.public_identity,i.public_identity)||!Vn(n.material_activation,i.material_activation)||!Wn(n.signer_set.selected_server,i.signing_worker)||n.activation_epoch!==i.activation_epoch||a.context.application_binding_digest_b64u!==i.context.application_binding_digest_b64u||!Gn(a.public_identity,i.public_identity)||!Vn(a.material_activation,i.material_activation)||!Wn(a.signing_worker,i.signing_worker)||a.activation_epoch!==i.activation_epoch||a.wallet_id!==e.walletId||a.ecdsa_threshold_key_id!==t.walletKey.ecdsaThresholdKeyId||a.signing_root_id!==t.walletKey.signingRootId||a.signing_root_version!==t.walletKey.signingRootVersion)throw Error(`Passkey ECDSA session activation changed custody continuity`)}function xL(e){let t=e.signer.walletKey.publicCapability.public_identity;if(e.publicFacts.contextBinding32B64u!==t.context_binding_b64u||e.publicFacts.derivationClientSharePublicKey33B64u!==t.derivation_client_share_public_key33_b64u||e.publicFacts.relayerPublicKey33B64u!==t.server_public_key33_b64u||e.publicFacts.groupPublicKey33B64u!==t.threshold_public_key33_b64u||e.publicFacts.ethereumAddress!==eR(t.ethereum_address20_b64u)||e.publicFacts.clientShareRetryCounter!==t.client_share_retry_counter||e.publicFacts.relayerShareRetryCounter!==t.server_share_retry_counter)throw Error(`Passkey ECDSA custody rejoin changed registered public identity`)}async function SL(e){let t=String(e.unlock.credential.rawId||e.unlock.credential.id||``).trim();if(!t)throw Error(`[login] passkey assertion credential id is missing`);await Ue({walletId:e.walletId,credentialIdB64u:t,envelope:e.unlock.custody.envelope})}async function CL(e){let t=Xe(e.context.configs.network.chains);if(!jI({subjectSet:e.walletIdentity.subjectSet,selection:e.selection,hasConfiguredEcdsaTargets:t.length>0}).wantsEcdsaWarmup)return null;let n=t[0];if(!n)return null;let r=await AR(e.context,e.walletIdentity.walletId,void 0,`passkey`),i=z(n.chainTarget),a=r.ecdsaKeys.find(e=>e.targetKey===i);if(!a)throw yR(i);let o=r.runtimePolicyScope;if(!o)throw Error(`[login] passkey ECDSA activation requires runtime policy scope`);let s=gR(hR(`threshold-ecdsa-login`)),c=_R(hR(`wallet-session-mint`));return{targetKey:i,requiresCustodyRejoin:!a.existingRoleLocalMaterial,policy:{kind:`router_ab_ecdsa_post_registration_session_activation_policy_v1`,key_handle:a.keyHandle,session_policy:{threshold_session_id:s,wallet_session_mint_id:c,ttl_ms:e.ttlMs,remaining_uses:e.remainingUses,runtime_policy_scope:o}}}}function wL(e){switch(e.walletIdentity.kind){case`near_ed25519_capable_wallet`:return{kind:`requested`,remainingUses:e.remainingUses};case`evm_family_ecdsa_only_wallet`:return{kind:`not_requested`};default:return $(e.walletIdentity)}}function TL(e){return e.activation?{type:`passkey_assertion`,challengeId:e.challengeId,walletId:String(e.walletIdentity.walletId),webauthn_authentication:e.credential,ed25519SessionRequest:e.ed25519SessionRequest,expected_origin:e.expectedOrigin,ecdsaSessionPolicy:e.activation.policy}:{type:`passkey_assertion`,challengeId:e.challengeId,webauthn_authentication:e.credential,ed25519SessionRequest:e.ed25519SessionRequest,expected_origin:e.expectedOrigin}}async function EL(e){let t=await K.getWalletAuthMethodV2(e.authorization.record.authMethodId);if(!t||t.kind!==`passkey`||t.status!==`active`||t.walletId!==e.walletId||t.walletAuthorityId!==e.authorization.record.authorityId)throw Error(`Passkey Wallet Session authorization changed auth-method identity`);let n=await K.getWalletAuthority(t.walletAuthorityId);if(!n||n.state!==`active`||n.walletId!==e.walletId||n.authorityId!==e.authorization.record.authorityId||n.authorityDigestB64u!==e.authorization.record.authorityDigestB64u||n.revocationEpoch!==e.authorization.record.authorityRevocationEpoch)throw Error(`Passkey Wallet Session authorization changed authority identity`);return{reference:await VF(t),identity:xt({authority:n,walletAuthMethodId:t.walletAuthMethodId})}}async function DL(e){let t=st(e.credential);if(!t)throw Error(`Passkey Wallet Session adoption requires WebAuthn credential identity`);let n=await Ne({walletId:e.walletIdentity.walletId,rpId:e.rpId,credentialIdB64u:t}),r=await EL({walletId:e.walletIdentity.walletId,authorization:e.authorization});if(e.authorization.record.walletId!==e.walletIdentity.walletId||e.authorization.record.authMethodId!==n.walletAuthMethodId||e.authorization.record.authorityId!==n.walletAuthorityId||r.reference.walletId!==e.walletIdentity.walletId)throw Error(`Passkey Wallet Session authorization changed auth-method identity`);return r}function OL(e,t){return{...e,session_policy:{...e.session_policy,wallet_session_mint_id:_R(t)}}}async function kL(e,t){Q(e.onEvent,e.unlockSubjectId,{phase:W.STEP_03_PASSKEY_CHALLENGE_STARTED,status:`running`,authMethod:`passkey`});let n=await fetch(a(e.relayUrl,`/wallet/unlock/challenge`),{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({unlockBackend:`passkey`,userId:String(e.walletIdentity.walletId),rpId:e.rpId})}),r=await n.json().catch(()=>({})),i=j(r)?r:{},o=typeof i.message==`string`?i.message:``;if(!n.ok||i.ok!==!0)throw Error(o||`wallet/unlock/challenge failed (HTTP ${n.status})`);let s=String(i.challengeId||``).trim(),c=String(i.challengeB64u||``).trim();if(!s||!c)throw Error(`wallet/unlock/challenge returned invalid challenge`);let l=e.activation?{...e.activation,policy:OL(e.activation.policy,s)}:null,u=AI({authenticators:e.authenticators,signerSlot:e.signerSlot,serverCredentialIds:kI(i.credentialIds)}),d=await e.collectCredentialForChallenge({challengeB64u:c,credentialIds:u}),f=String(e.expectedOrigin??(typeof window<`u`?window.location.origin:``)).trim();if(!f)throw Error(`[login] passkey wallet unlock requires an expected origin`);let p=TL({challengeId:s,credential:d,ed25519SessionRequest:wL({walletIdentity:e.walletIdentity,remainingUses:e.remainingUses}),expectedOrigin:f,walletIdentity:e.walletIdentity,activation:l}),m=await Fe(e.relayUrl,p,t);if(!m.success)throw Error(m.error||`Passkey wallet unlock failed`);if(!m.walletCustody)throw Error(`Passkey wallet unlock omitted wallet custody continuity`);if(l&&(!m.ecdsaSession||!m.ecdsaActivationReceipt||!m.ecdsaCustody))throw Error(`Passkey wallet unlock omitted the requested ECDSA activation`);let h=m.walletSessionAuthorization??null,g=h?await DL({walletIdentity:e.walletIdentity,rpId:e.rpId,credential:d,authorization:h}):null,_=null;if(l&&m.ecdsaSession&&m.ecdsaActivationReceipt&&m.ecdsaCustody&&m.ecdsaSession.kind===`router_ab_ecdsa_credential_free_session_activated_v1`){let e=m.walletSessionAuthorization;if(!e)throw Error(`Passkey credential-free activation omitted exact Wallet Session authority`);if(!g)throw Error(`Passkey credential-free activation omitted exact Passkey authority`);_={kind:`credential_free_ecdsa_session_activation_authorization_v1`,activation:m.ecdsaSession,authorization:e}}l&&m.ecdsaSession&&m.ecdsaActivationReceipt&&m.ecdsaCustody&&(bL({walletId:String(e.walletIdentity.walletId),prepared:l,response:m.ecdsaSession,activationReceipt:m.ecdsaActivationReceipt,continuity:m.ecdsaCustody}),m.ecdsaSession.kind===`router_ab_ecdsa_post_registration_session_activated_v1`&&(_=m.ecdsaSession));let v=_?await DL({walletIdentity:e.walletIdentity,rpId:e.rpId,credential:d,authorization:vL(_)}):null;if(h&&await G.writeExactWithOperationCredential(h),l?.requiresCustodyRejoin){if(!(`ecdsaCustody`in m)||!m.ecdsaCustody)throw Error(`Passkey wallet unlock omitted ECDSA custody rejoin continuity`);let t=ke(d);if(!t)throw Error(`Passkey ECDSA custody rejoin requires WebAuthn PRF.first`);let n=st(d),r=v?.reference??g?.reference??await De({walletId:e.walletIdentity.walletId,rpId:e.rpId,credentialIdB64u:n});await nR({signingEngine:e.context.signingEngine,walletId:String(e.walletIdentity.walletId),custody:m.walletCustody,continuity:m.ecdsaCustody,authority:r,passkeyPrfFirstB64u:t})}return{credential:d,activation:l&&m.ecdsaSession&&_&&v?{...l,response:m.ecdsaSession,sessionActivation:_,authorizationIdentity:v.identity,activationReceipt:m.ecdsaActivationReceipt,continuity:m.ecdsaCustody}:null,custody:m.walletCustody,result:m}}var AL=class{constructor(){this.settled=!1,this.promise=new Promise(this.capturePromise.bind(this))}resolve(e){this.settled||(this.settled=!0,this.resolvePromise(e))}reject(e){this.settled||(this.settled=!0,this.rejectPromise(N(e)))}async wait(){return await this.promise}capturePromise(e,t){this.resolvePromise=e,this.rejectPromise=t}};async function jL(e,t){e.sharedState.ed25519.thresholdSessionId=String(t.thresholdSessionId),e.sharedState.ed25519.authorizationId=t.authorizationId,e.sharedState.ed25519.walletSessionId=t.walletSessionId,e.sharedState.ed25519.quotaId=t.quotaId,e.sharedState.ed25519.operationCredential=t.operationCredential,e.sharedState.ed25519.expiresAtMs=t.expiresAtMs,e.sharedState.ed25519.remainingUses=t.remainingUses,e.sharedState.ed25519.runtimePolicyScope=t.runtimePolicyScope,e.authorityDeferred?.resolve(t)}function ML(e,t){e?.reject(t)}function NL(e){return{sessionId:String(e.session.thresholdSessionId),status:`active`,authMethod:e.authMethod,...e.authMethod===V.emailOtp?{retention:`session`}:{},remainingUses:e.session.remainingUses,expiresAtMs:e.session.expiresAtMs}}function PL(e){return e?.kind===`opaque_wallet_session_operation_credential_v1`}function FL(e){let t=e.thresholdEcdsaKeyRef.backendBinding;if(t)switch(t.materialKind){case`role_local_worker_handle`:case`role_local_durable_sealed_ref`:case`role_local_durable_public_anchor`:return t.publicFacts.publicCapability;case`role_local_ready_state_blob`:return t.ecdsaRoleLocalReadyRecord.publicFacts.publicCapability;case`metadata_only`:return}}function IL(e){return JSON.stringify(e)}function LL(e){let t=FL(e);if(!t)throw Error(`[login] ECDSA bootstrap is missing its public capability`);let n=e.session,r=e.thresholdEcdsaKeyRef.routerAbEcdsaDerivationNormalSigning;if(!r)throw Error(`[login] ECDSA bootstrap is missing normal-signing state`);return{kind:`router_ab_ecdsa_post_registration_session_activated_v1`,public_capability:t,session:{authorization_session_id:n.authorizationSessionId,authorization_id:n.authorizationId,threshold_session_id:gR(n.thresholdSessionId),wallet_session_id:n.walletSessionId,quota_id:n.quotaId,expires_at_ms:n.expiresAtMs,remaining_uses:n.remainingUses,wallet_session:n.walletSession,operation_credential:n.operationCredential},normal_signing:r}}function RL(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function zL(e,t){return e.kind===t.kind&&e.signingWorkerId===t.signingWorkerId}function BL(e,t){return e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}function VL(e){if(e.current.runtimePolicyScope&&e.incoming.runtimePolicyScope&&!BL(e.current.runtimePolicyScope,e.incoming.runtimePolicyScope))throw Error(`[login] threshold ECDSA ${e.source} has a conflicting runtime policy scope`);return XP(e.current,e.incoming)}async function HL(e){if(e.targetEcdsaKey.publicCapability.kind===`persisted_public_capability`){let t=e.targetEcdsaKey.publicCapability.value;if(String(t.client_id)!==String(e.walletId))throw Error(`[login] threshold ECDSA persisted public capability wallet mismatch for ${z(e.chainTarget)}`);return t}let t=await Mk({walletId:e.walletId,chainTarget:e.chainTarget});if(t.kind!==`resolved`)throw yR(z(e.chainTarget));let n=t.manifest.durableMaterial.roleLocalPublicFacts;if(String(n.keyHandle)!==String(e.targetEcdsaKey.keyHandle)||String(n.walletId)!==String(e.walletId))throw yR(z(e.chainTarget));return n.publicCapability}function UL(e){let t=[];for(let n of e)n!==`ed25519`&&n!==`ecdsa`||t.includes(n)||t.push(n);return t}async function WL(e){try{return await e.run(),{kind:`succeeded`,task:e}}catch(t){return e.onFailure?.(t),{kind:`failed`,task:e,error:N(t)}}}async function GL(e){let t=new Map;for(let n of e)t.set(n.signer,n);let n=new Set;for(;t.size>0;){let e=[];for(let r of t.values())r.dependencies.every(e=>n.has(e))&&e.push(r);if(e.length===0)throw Error(`[login] threshold warm-up task dependency graph is unsatisfied`);let r=await Promise.all(e.map(WL)),i=null;for(let e of r)switch(e.kind){case`succeeded`:n.add(e.task.signer),t.delete(e.task.signer);break;case`failed`:i??=e.error;break;default:return $(e)}if(i)throw i}}function KL(e){if(e.routeAuthorization.kind,e.credentialState.kind===`available`)return{};throw Error(`[login] threshold ECDSA warm-up requires route authorization`)}function qL(e){return String((e&&typeof e==`object`&&`message`in e?e.message:e)||``)}function $(e){throw Error(`[login] unexpected state: ${String(e)}`)}async function JL(e){switch(e.runtimeScopeBootstrapState.kind){case`available`:return await e.signingEngine.bootstrapEcdsaSession({...e.request,runtimeScopeBootstrap:e.runtimeScopeBootstrapState.runtimeScopeBootstrap});case`unavailable`:return await e.signingEngine.bootstrapEcdsaSession(e.request);default:return $(e.runtimeScopeBootstrapState)}}function YL(e){if(`operationCredential`in e)return e.operationCredential;throw Error(`[login] wallet custody Ed25519 activation requires the exact issued operation credential`)}async function XL(e){let t=await e.signingEngine.getUserBySignerSlot(e.walletBinding.nearAccountId,e.signerSlot).catch(()=>null);if(t){if(t.walletId!==String(e.walletBinding.walletId)||t.nearEd25519SigningKeyId!==String(e.walletBinding.nearEd25519SigningKeyId)||t.signerSlot!==e.signerSlot)throw Error(`[login] local Ed25519 owner profile identity is invalid`);return}await e.signingEngine.storeUserData({walletId:String(e.walletBinding.walletId),nearAccountId:e.walletBinding.nearAccountId,nearEd25519SigningKeyId:String(e.walletBinding.nearEd25519SigningKeyId),signerSlot:e.signerSlot,operationalPublicKey:`ed25519:${zi(e.registeredPublicKey)}`,passkeyCredential:{id:e.credentialIdB64u,rawId:e.credentialIdB64u},lastUpdated:Date.now(),version:2})}function ZL(e,t){let n=e.ed25519.capability,r=n.registrationContinuity;return{materialActivation:n.materialActivation,lifecycleId:n.lifecycle.lifecycleId,signingRootVersion:n.lifecycle.rootShareEpoch,signingRootId:n.applicationBinding.signing_root_id,signerSetId:n.lifecycle.signerSetId,thresholdSessionId:t,activationTranscriptB64u:F(Uint8Array.from(r.activationTranscript)),activationCapabilityBindingB64u:F(Uint8Array.from(n.activeCapabilityBinding))}}function QL(e){let t=e.custody.ed25519,n=t.capability;if(t.nearAccountId!==String(e.walletBinding.nearAccountId)||t.nearEd25519SigningKeyId!==String(e.walletBinding.nearEd25519SigningKeyId)||t.signerSlot!==e.signerSlot||n.applicationBinding.wallet_id!==String(e.walletBinding.walletId)||n.applicationBinding.near_ed25519_signing_key_id!==String(e.walletBinding.nearEd25519SigningKeyId)||n.applicationBinding.key_creation_signer_slot!==e.signerSlot||n.nearAccountId!==e.walletBinding.nearAccountId||n.lifecycle.accountId!==String(e.walletBinding.walletId)||n.lifecycle.signingWorkerId!==t.relayerKeyId)throw Error(`[login] wallet custody identity does not match the selected signing lane`)}async function $L(e){QL(e);let t=e.custody.ed25519.capability,n=await e.signingEngine.loadWalletCustodyEd25519Material({nearAccountId:String(e.walletBinding.nearAccountId),signerSlot:e.signerSlot,expectedRegisteredPublicKeyB64u:F(Uint8Array.from(t.registeredPublicKey))}),r=s(e.walletSession.thresholdSessionId);if(!r.ok)throw Error(`[login] wallet custody returned an invalid threshold session identity`);let i=ZL(e.custody,r.value),a=qt(e.custody.envelope),o=null,c=null,l=null;try{if(n.kind===`found`)l=I(e.passkeyPrfFirstB64u),o=await Ae({material:n.material,activation:i,envelope:a,ownedFactorSecret:l});else{let n=Vt(e.custody.envelope);if(!n.ok)throw Error(n.reason);c=I(e.passkeyPrfFirstB64u),l=I(e.passkeyPrfFirstB64u);let r=await e.signingEngine.rejoinWalletCustodyNearEd25519KeySet({walletId:String(e.walletBinding.walletId),custodyJson:n.custodyJson,factorSecret:c.buffer,nearEd25519SigningKeyId:String(e.walletBinding.nearEd25519SigningKeyId),recoveryBasis:t,routerOrigin:new URL(e.relayerUrl).origin,walletSessionToken:YL(e.walletSession).token}),i={kind:gi,applicationBindingDigestB64u:r.localMaterial.applicationBindingDigestB64u,registeredPublicKeyB64u:F(r.metadata.registeredPublicKey),participantIds:r.metadata.participantIds,stateEpoch:String(r.metadata.stateEpoch),walletId:String(e.walletBinding.walletId),nearAccountId:String(e.walletBinding.nearAccountId),nearEd25519SigningKeyId:String(e.walletBinding.nearEd25519SigningKeyId),signerSlot:e.signerSlot,signingWorkerId:e.custody.ed25519.relayerKeyId,signingWorkerVerifyingShareB64u:F(r.metadata.signingWorkerVerifyingShare)},s={ciphertextB64u:r.localMaterial.b64u,nonceB64u:r.localMaterial.nonceB64u};try{await e.signingEngine.persistWalletCustodyEd25519Material({binding:i,sealed:s})}catch(e){console.warn(`[login] wallet custody cache write failed; continuing with verified material`,{error:e})}o=await Ae({material:{binding:i,sealed:s},activation:Re(r.metadata),envelope:a,ownedFactorSecret:l})}if(!o)throw Error(`[login] wallet custody produced no active client`);let r=s(o.metadata().scope.threshold_session_id);if(!r.ok)throw Error(`[login] wallet custody returned an invalid threshold session identity`);if(r.value!==e.walletSession.thresholdSessionId)throw Error(`[login] wallet custody changed the threshold session identity`);let u=e.custody.envelope.factor;if(u.kind!==`passkey`)throw Error(`[login] wallet custody returned a different factor authority`);await XL({signingEngine:e.signingEngine,walletBinding:e.walletBinding,signerSlot:e.signerSlot,credentialIdB64u:u.credentialIdB64u,registeredPublicKey:o.metadata().registeredPublicKey}),await xe({store:K,activeClient:o,identity:{walletId:String(e.walletBinding.walletId),nearAccountId:String(e.walletBinding.nearAccountId),nearEd25519SigningKeyId:String(e.walletBinding.nearEd25519SigningKeyId),thresholdSessionId:r.value,signerSlot:e.signerSlot,rpId:u.rpId,credentialIdB64u:u.credentialIdB64u,signingRootId:t.applicationBinding.signing_root_id,signingRootVersion:t.lifecycle.rootShareEpoch,signingWorkerId:e.custody.ed25519.relayerKeyId},stableServerScope:{relayerKeyId:e.custody.ed25519.relayerKeyId,participantIds:e.custody.ed25519.participantIds,runtimePolicyScope:t.runtimePolicyScope,routerAbNormalSigning:e.routerAbNormalSigning},passkeyPrfFirstB64u:e.passkeyPrfFirstB64u});let d=await e.signingEngine.activateVerifiedNearEd25519YaoMaterial({activeClient:o,facts:{thresholdSessionId:r.value,signer:Bc({walletId:e.walletBinding.walletId,nearAccountId:e.walletBinding.nearAccountId,nearEd25519SigningKeyId:e.walletBinding.nearEd25519SigningKeyId,signerSlot:e.signerSlot}),signingRootId:t.applicationBinding.signing_root_id,signingRootVersion:t.lifecycle.rootShareEpoch,routerAbNormalSigning:e.routerAbNormalSigning,runtimePolicyScope:t.runtimePolicyScope,relayerUrl:e.relayerUrl}}),f=Qe({walletId:String(e.walletBinding.walletId),nearAccountId:String(e.walletBinding.nearAccountId),nearEd25519SigningKeyId:String(e.walletBinding.nearEd25519SigningKeyId),walletSessionId:e.walletSession.walletSessionId,authorizationId:e.walletSession.authorizationId,quotaId:e.walletSession.quotaId,thresholdSessionId:r.value,remainingUses:e.walletSession.remainingUses,expiresAtMs:e.walletSession.expiresAtMs,runtimePolicyScope:e.walletSession.runtimePolicyScope,signingRootId:t.applicationBinding.signing_root_id,signingRootVersion:t.lifecycle.rootShareEpoch,routerAbNormalSigning:e.routerAbNormalSigning,walletSessionToken:YL(e.walletSession).token,nowMs:Math.min(Date.now(),e.walletSession.expiresAtMs-1)});if(!f.ok)throw Error(`[login] wallet custody returned an unusable Ed25519 Wallet Session: ${f.reason}`);let p=At({walletId:e.walletBinding.walletId,nearAccountId:e.walletBinding.nearAccountId,nearEd25519SigningKeyId:e.walletBinding.nearEd25519SigningKeyId,signerSlot:e.signerSlot,rpId:wo(u.rpId),credentialIdB64u:u.credentialIdB64u,relayerUrl:e.relayerUrl,authority:e.authority,signingWalletSession:f.value});await it({persistence:e.signingEngine,session:p,prfFirstB64u:e.passkeyPrfFirstB64u,ed25519Restore:Me({rpId:u.rpId,nearAccountId:String(e.walletBinding.nearAccountId),nearEd25519SigningKeyId:String(e.walletBinding.nearEd25519SigningKeyId),relayerKeyId:e.custody.ed25519.relayerKeyId,participantIds:e.custody.ed25519.participantIds,runtimePolicyScope:e.walletSession.runtimePolicyScope,signerSlot:e.signerSlot,routerAbNormalSigning:e.routerAbNormalSigning,credentialIdB64u:u.credentialIdB64u,materialActivation:d.materialActivation}),materialActivation:d.materialActivation}),await e.signingEngine.establishUnlockedWalletEd25519ExportRootCapabilityV1({existingEnvelope:e.custody.envelope,passkeyPrfFirstB64u:e.passkeyPrfFirstB64u,walletId:String(e.walletBinding.walletId),walletAuthMethodId:String(e.authority.walletAuthMethodId),walletSessionId:String(e.walletSession.walletSessionId),expiresAtMs:e.walletSession.expiresAtMs})}catch(e){throw o?.dispose(),e}finally{c?.fill(0),l?.fill(0)}}function eR(e){let t=I(e);if(t.length!==20)throw Error(`[login] ECDSA custody address is invalid`);let n=`0x`;for(let e of t)n+=e.toString(16).padStart(2,`0`);return n}function tR(e){let[t,...n]=e;if(!t)throw Error(`[login] passkey ECDSA custody continuity is empty`);return[t.chainTarget,...n.map(e=>e.chainTarget)]}async function nR(e){let t=e.continuity.signers[0];if(!t)throw Error(`[login] passkey ECDSA custody continuity is empty`);if(t.walletKey.walletId!==e.walletId)throw Error(`[login] passkey ECDSA custody continuity changed wallet identity`);for(let n of e.continuity.signers)if(n.walletKey.walletId!==t.walletKey.walletId||n.walletKey.keyHandle!==t.walletKey.keyHandle||n.walletKey.ecdsaThresholdKeyId!==t.walletKey.ecdsaThresholdKeyId||n.walletKey.signingRootId!==t.walletKey.signingRootId||n.walletKey.signingRootVersion!==t.walletKey.signingRootVersion||n.walletKey.relayerKeyId!==t.walletKey.relayerKeyId||!Qn(n.walletKey.publicCapability,t.walletKey.publicCapability)||!Zn(n.activationReceipt,t.activationReceipt)||!BL(n.runtimePolicyScope,t.runtimePolicyScope))throw Error(`[login] passkey ECDSA custody continuity conflicts across targets`);let n=Vt(e.custody.envelope);if(!n.ok)throw Error(n.reason);let r=I(e.passkeyPrfFirstB64u);try{let i=await e.signingEngine.rejoinWalletCustodyEvmFamilyKeySet({walletId:e.walletId,custodyJson:n.custodyJson,factorSecret:r.buffer,evmFamilySigningKeySlotId:ro({walletId:e.walletId,signingRootId:t.walletKey.signingRootId,signingRootVersion:t.walletKey.signingRootVersion}),applicationBindingDigestB64u:t.walletKey.publicCapability.context.application_binding_digest_b64u,registeredClientRootPublicKey33B64u:t.walletKey.derivationClientSharePublicKey33B64u,relayerPublicIdentityJson:JSON.stringify({relayerKeyId:t.walletKey.relayerKeyId,relayerPublicKey33B64u:t.activationReceipt.ecdsa_activation.public_identity.server_public_key33_b64u,groupPublicKey33B64u:t.activationReceipt.ecdsa_activation.public_identity.threshold_public_key33_b64u,ethereumAddress:eR(t.activationReceipt.ecdsa_activation.public_identity.ethereum_address20_b64u),relayerShareRetryCounter:t.activationReceipt.ecdsa_activation.public_identity.server_share_retry_counter})});xL({publicFacts:i.publicFacts,signer:t}),await e.signingEngine.restoreWalletCustodyEcdsaContinuity({authority:e.authority,chainTargets:tR(e.continuity.signers),walletId:t.walletKey.walletId,keyHandle:t.walletKey.keyHandle,ecdsaThresholdKeyId:t.walletKey.ecdsaThresholdKeyId,signingRootId:t.walletKey.signingRootId,signingRootVersion:t.walletKey.signingRootVersion,relayerKeyId:t.walletKey.relayerKeyId,participantIds:t.walletKey.participantIds,publicCapability:t.walletKey.publicCapability,activationReceipt:t.activationReceipt,runtimePolicyScope:t.runtimePolicyScope,readyStateBlobB64u:i.readyStateBlobB64u,publicFacts:i.publicFacts})}finally{r.fill(0)}}async function rR(e){let t=UL(e.signersToWarm),n=e.credentialState.kind===`available`?e.credentialState.credential:void 0,r=e.credentialState.localPasskeyCredentialIdB64u,i=e.runtimeScopeBootstrapState.kind===`available`?e.runtimeScopeBootstrapState.runtimeScopeBootstrap:null,a=e.ecdsaContext,o={activeCanonicalEcdsaContext:a,ed25519:{thresholdSessionId:``,authorizationId:null,walletSessionId:null,quotaId:null,operationCredential:null,expiresAtMs:0,remainingUses:0,runtimePolicyScope:null}},s=e.ecdsaDependency.kind===`ed25519_wallet_session_authority`?new AL:null,c={generatedThresholdSessionId:e.passkeyExchangeEcdsaActivation?.policy.session_policy.threshold_session_id||``},l=e.unlockRemainingUses,u=[],d=null,f=null,p=[];return t.includes(`ed25519`)&&p.push({signer:`ed25519`,dependencies:e.ed25519DependsOnEcdsa?[`ecdsa`]:[],onFailure:s?ML.bind(void 0,s):null,run:async()=>{let t=PF(e.walletIdentity),c=f,u=vI({authority:_I(e.ed25519SessionAuthority),walletId:t.walletId,rpId:e.context.signingEngine.getRpId(),credentialIdB64u:r}),p=xI({mintPlan:e.ed25519MintPlan,ecdsaMint:c,walletBinding:t,signerSlot:e.signerSlot,authority:u}),m=CI({mintPlan:e.ed25519MintPlan,fallback:{relayerKeyId:e.relayerKeyId,participantIds:e.participantIds,runtimePolicyScope:a.runtimePolicyScope??null,routerAbNormalSigning:NP(e.context.configs)}}),h={relayerUrl:e.relayerUrl,relayerKeyId:m.relayerKeyId,runtimePolicyScope:m.runtimePolicyScope||void 0,routerAbNormalSigning:m.routerAbNormalSigning,runtimeScopeBootstrap:i||void 0,participantIds:m.participantIds,ttlMs:e.ttlMs,remainingUses:l,onWalletSessionAuthorityReady:jL.bind(void 0,{sharedState:o,authorityDeferred:s})},g=p.kind===`fresh_ed25519_provisioning`?{...p,walletId:String(t.walletId),nearAccountId:t.nearAccountId,nearEd25519SigningKeyId:t.nearEd25519SigningKeyId,signerSlot:e.signerSlot,...h}:{...p,...h},_;switch(u.kind){case`email_otp`:_=await e.signingEngine.connectEd25519Session({...g,source:`email_otp`,authority:u.authority,emailOtpAuthContext:u.emailOtpAuthContext,materialActivation:void 0});break;case`passkey`:if(!e.passkeyUnlockEd25519Session)throw Error(`[login] verified wallet unlock omitted its Ed25519 Wallet Session`);if(e.ed25519MintPlan.kind!==`wallet_custody`)throw Error(`[login] verified unlock Ed25519 session requires wallet custody`);_=wI({session:e.passkeyUnlockEd25519Session,walletBinding:t,signerSlot:e.signerSlot,custody:e.ed25519MintPlan.custody,provisionScope:m,credential:n,remainingUses:l,unlockAuthorization:e.passkeyUnlockWalletSessionAuthorization});break;default:return $(u)}if(!_.ok){let e=String(_.message||_.code||`Failed to connect threshold Ed25519 session`);throw Error(`[login] threshold Ed25519 warm-up failed: ${e}`)}if(d=_,!_.thresholdSessionId)throw Error(`[login] threshold Ed25519 warm-up did not return a thresholdSessionId`);let v=u.kind===`passkey`?await De({walletId:t.walletId,rpId:e.context.signingEngine.getRpId(),credentialIdB64u:st(n||void 0)||r}):await L({authority:u.authority.authority});if(e.ed25519MintPlan.kind===`wallet_custody`){if(u.kind!==`passkey`)throw Error(`[login] wallet custody requires passkey authority`);let r=SI(p,e.ed25519MintPlan),i=n?ke(n):``;if(!i)throw Error(`[login] wallet custody requires WebAuthn PRF.first`);await e.signingEngine.withExactEd25519MaterialOwner({materialActivation:r,nearAccountId:t.nearAccountId,task:$L.bind(void 0,{signingEngine:e.signingEngine,custody:e.ed25519MintPlan.custody,walletBinding:t,signerSlot:e.signerSlot,passkeyPrfFirstB64u:i,walletSession:_,authority:v,routerAbNormalSigning:m.routerAbNormalSigning,relayerUrl:e.relayerUrl})})}}}),t.includes(`ecdsa`)&&p.push({signer:`ecdsa`,dependencies:[],onFailure:null,run:async()=>{await s?.promise;let t=null,i=!1,a=new Map,d=Xe(e.context.configs.network.chains),p=e=>{let t=ZP({context:o.activeCanonicalEcdsaContext,configuredTargets:d});if(t.kind===`complete_configured_target_keys`){o.activeCanonicalEcdsaContext=t.context;return}t.kind!==`missing_configured_target_keys`&&QP({completion:t,source:e})},m=e=>{if(f)return;let t=e.session.operationCredential,i=n?ke(n):``,a=st(n||void 0)||r;!t.token||!i||!a||(f={operationCredential:t,passkeyPrfFirstB64u:i,passkeyCredentialIdB64u:a,quotaId:e.session.quotaId})},h=()=>{if(o.ed25519.operationCredential)return{routeAuth:o.ed25519.operationCredential};let n=f?.operationCredential;return n?{routeAuth:n}:t||(t=KL({credentialState:e.credentialState,routeAuthorization:e.routeAuthorization}),t)},g=async(t,n)=>{if(!n.key)throw Error(`[login] threshold ECDSA warm-up requires configured target key identity`);let s=await HL({walletId:e.walletIdentity.walletId,chainTarget:t.chainTarget,targetEcdsaKey:n}),u=a.get(IL(s)),d=e.passkeyExchangeEcdsaActivation,f=d&&!i&&d.targetKey===z(t.chainTarget)?d:null,p=f?{sessionActivation:f.sessionActivation,authorizationIdentity:f.authorizationIdentity}:u??null,m=p?_L(p.sessionActivation):xR({sharedState:c}),g=o.activeCanonicalEcdsaContext.runtimePolicyScope;if(!g)throw Error(`[login] ECDSA session lane requires runtimePolicyScope`);let _=Wa({chainTarget:t.chainTarget,thresholdSessionId:m,ttlMs:e.ttlMs,remainingUses:l,runtimePolicyScope:g}),v=n.existingRoleLocalMaterial;if(!v)throw yR(z(t.chainTarget));if(!r)throw Error(`[login] ECDSA role-local activation requires passkey identity`);let y=v.authority;if(p)return f&&(i=!0),await JL({signingEngine:e.signingEngine,runtimeScopeBootstrapState:e.runtimeScopeBootstrapState,request:{kind:`passkey_preauthorized_ecdsa_bootstrap`,source:`login`,relayerUrl:e.relayerUrl,keyHandle:Do(n.keyHandle),key:n.key,lanePolicy:_,publicCapability:s,existingRoleLocalMaterial:v,authorizationAuthority:y,authorizationIdentity:p.authorizationIdentity,passkeyCredentialIdB64u:r,sessionActivation:p.sessionActivation}});let b=h().routeAuth;if(!PL(b))throw Error(`[login] ECDSA role-local activation requires a verified Wallet Session`);return await JL({signingEngine:e.signingEngine,runtimeScopeBootstrapState:e.runtimeScopeBootstrapState,request:{kind:`wallet_session_reconnect_ecdsa_bootstrap`,source:`login`,relayerUrl:e.relayerUrl,keyHandle:Do(n.keyHandle),key:n.key,lanePolicy:_,publicCapability:s,existingRoleLocalMaterial:v,authorizationAuthority:y,passkeyCredentialIdB64u:r,routeAuth:b}})},_=async()=>{p(`login ECDSA warm-up preflight`);let t=[],n=e.passkeyExchangeEcdsaActivation?.targetKey||null;if(n)for(let e of d)z(e.chainTarget)===n&&t.push(e);for(let e of d)z(e.chainTarget)!==n&&t.push(e);for(let n of t){let t=z(n.chainTarget),r=o.activeCanonicalEcdsaContext.ecdsaKeys.find(e=>e.targetKey===t),i=String(r?.keyHandle||``).trim();if(!r?.key||!i)throw yR(t);let s=await g(n,r);u.push(s),at({statusReads:e.statusReads,trigger:`unlock`,signingEngine:e.signingEngine,walletId:e.walletIdentity.walletId,chainTarget:n.chainTarget}),m(s);let c=LL(s),l=IL(c.public_capability);if(!a.has(l)){let t=await EL({walletId:e.walletIdentity.walletId,authorization:{record:s.session.walletSession,operationCredential:s.session.operationCredential}});a.set(l,{sessionActivation:c,authorizationIdentity:t.identity})}if(String(s.thresholdEcdsaKeyRef?.keyHandle||``).trim()!==r.keyHandle)throw Error(`[login] threshold ECDSA warm-up returned a different keyHandle for ${t}`)}if(e.passkeyExchangeEcdsaActivation&&!i)throw Error(`[login] passkey exchange ECDSA activation did not match a configured target`)};try{await _()}catch(e){let t=qL(e)||`Failed to bootstrap threshold ECDSA session`;throw Error(`[login] threshold ECDSA warm-up failed: ${t}`)}}}),await GL(p),{ecdsaBootstraps:u,ed25519Session:d}}async function iR(e,t){let n=e.signingEngine.readWalletAuthenticationState(),r=t??(n.kind===`signed_out`?void 0:n.walletId),i=null,a=null;if(r!==void 0){let e=o(String(r));if(e.ok){if(i=e.value,a=await fb({walletId:e.value,ports:oO}),a.kind===`upgrade_required`)throw new Os(`[WalletSession] Wallet Session authorization requires a newer client`);a.kind===`missing`&&(n={kind:`signed_out`})}}let s=await TF(r);if(s.kind===`no_session_for_wallet`){let e=await UI(String(s.walletId));e&&(s={kind:`resolved`,walletId:s.walletId,subjectSet:e,source:`local_wallet_authority`})}let c=!1;if(s.kind===`no_session_request`)return kF();if(s.kind===`no_session_for_wallet`){let t=await oF(s.walletId);if(t.kind!==`resolved`)return await sR({context:e,walletId:s.walletId,reason:`activation_reconciliation_failed`});if(t.selectors.length>0){c=!0;let n=await LF({workerCtx:e.signingEngine.getSignerWorkerContext(),selectors:t.selectors});if(n.didFinalize&&(s=await TF(s.walletId)),s.kind===`no_session_for_wallet`&&n.kind!==`settled`)return await sR({context:e,walletId:s.walletId,reason:n.kind===`pending`?`activation_reconciliation_pending`:`activation_reconciliation_failed`})}}if(s.kind===`no_session_for_wallet`)return await sR({context:e,walletId:s.walletId,reason:s.reason});if(s.kind===`no_session_request`)return kF();if(s.kind===`unresolvable_profile`)return console.warn(`[WalletSession] wallet session profile is unresolvable`,{profileId:s.profileId,reason:s.reason}),kF();if(s.kind===`unresolvable`)return console.warn(`[WalletSession] wallet session identity is unresolvable`,{walletId:String(s.walletId),reason:s.reason}),await sR({context:e,walletId:s.walletId,reason:s.reason});let l=IF(s.subjectSet);!c&&l.length>0&&RF(await LF({workerCtx:e.signingEngine.getSignerWorkerContext(),selectors:l})),await e.signingEngine.assertSealedRefreshStartupParity().catch(e=>{console.warn(`[WalletSession] sealed refresh startup parity check failed during session read; continuing with cached login state`,e instanceof Error?e.message:String(e||`unknown error`))});let[u,d]=await Promise.all([XR(e,s),cR(e,s.walletId)]),f=a&&i&&String(i)===String(s.walletId)?a:await fb({walletId:s.walletId,ports:oO}),p={kind:`signed_out`};switch(f.kind){case`authenticated`:await oR(e,f.state)&&(p=f.state);break;case`missing`:break;case`upgrade_required`:throw new Os(`[WalletSession] Wallet Session authorization requires a newer client`)}let m=UR({subjectSet:p.kind===`authenticated`&&f.kind===`authenticated`?aR(s.subjectSet,f.walletAuthMethodId):s.subjectSet,availableLanes:d,configuredEcdsaTargets:Xe(e.configs.network.chains).map(e=>e.chainTarget)});return{appIdentity:u,authentication:p,capabilityProjection:m,nonceDiagnostics:lR(e,u.nearAccountId)}}function aR(e,t){let[n,...r]=e.subjects.filter(e=>e.kind!==`evm_family_ecdsa_wallet`||String(e.authority.walletAuthMethodId)===String(t));return n?{...e,subjects:[n,...r]}:e}async function oR(e,t){let n=!1;try{let e=await K.resolveSelectedWalletAuthority(String(t.walletId));n=e.kind!==`resolved`||e.selection.lockState!==`unlocked`}catch{n=!0}return n?!1:(e.signingEngine.setWalletAuthenticated(t),!0)}async function sR(e){let[t,n]=await Promise.all([YR(e.context,e.walletId),fb({walletId:e.walletId,ports:oO})]),r={kind:`signed_out`};switch(n.kind){case`authenticated`:await oR(e.context,n.state)&&(r=n.state);break;case`missing`:break;case`upgrade_required`:throw new Os(`[WalletSession] Wallet Session authorization requires a newer client`)}return{appIdentity:t,authentication:r,capabilityProjection:{kind:`unresolvable`,reason:e.reason},nonceDiagnostics:lR(e.context,t.nearAccountId)}}function cR(e,t){return e.signingEngine.readPersistedAvailableSigningLanes({walletId:t}).then(e=>({kind:`available`,lanes:e})).catch(()=>({kind:`unavailable`}))}function lR(e,t){let n=String(t||``).trim();if(!n)return null;try{return e.signingEngine.getNonceCoordinator().getDiagnostics({accountId:n,emitMetrics:!0})}catch{return null}}function uR(e){let t=String(e||``).trim().toLowerCase();return/^0x[0-9a-f]{40}$/.test(t)?t:``}async function dR(e,t){let n=Xe(e.configs.network.chains).map(e=>e.chainTarget);if(!n.length)return[];let r=await K.listAccountSignersByProfile({profileId:String(t),status:`active`}).catch(()=>[]),i=[];for(let e of r){let r=KP({walletId:t,configuredTargets:n,signer:e});r.kind===`active_ecdsa_signer_record`&&i.push(r.walletKey)}return i}async function fR(e,t){let n=[...new Set((await dR(e,t)).map(e=>uR(e.keyFacts.thresholdOwnerAddress)).filter(Boolean))];return n.length===1?n[0]:(n.length>1&&console.warn(`[WalletSession] conflicting profile threshold ECDSA addresses`,{walletId:String(t),addresses:n}),null)}function pR(e){if(e.selection.mode===`ed25519_only`)return[`ed25519`];if(!e.configuredEcdsaTargets.length)return e.selection.mode===`ecdsa_only`?[]:[`ed25519`];let t=new Set((e.canonicalEcdsaContext?.ecdsaKeys||[]).map(e=>e.targetKey));if(t.size===0)throw Error(`[login] threshold ECDSA warm-up missing canonical key identity`);let n=e.configuredEcdsaTargets.map(e=>z(e.chainTarget)).filter(e=>!t.has(e));if(n.length)throw Error(`[login] threshold ECDSA warm-up missing configured-target key ids for ${n.join(`, `)}`);return e.selection.mode===`ecdsa_only`?[`ecdsa`]:[`ed25519`,`ecdsa`]}function mR(e){let t=ZP({context:e.storedCanonicalEcdsaContext,configuredTargets:e.selectedEcdsaTargets}),n=QP({completion:t,source:`stored ECDSA key facts`}),r=pR({selection:e.selection,configuredEcdsaTargets:e.selectedEcdsaTargets,canonicalEcdsaContext:n});e.wantsEd25519Warmup&&!r.includes(`ed25519`)&&(r=[`ed25519`,...r]);let i=r.includes(`ed25519`)&&r.includes(`ecdsa`);if(!r.length)throw Error(`[login] ECDSA unlock requested with no configured ECDSA targets`);return{kind:`threshold_login_warmup_plan_ready`,storedCanonicalEcdsaContext:e.storedCanonicalEcdsaContext,configuredTargetKeyCompletion:t,ecdsaContext:n,signersToWarm:r,ed25519DependsOnEcdsa:!1,ecdsaDependsOnEd25519:i}}function hR(e){return pe(e,32,`threshold login warm session IDs`)}function gR(e){let t=T(e);if(!t.ok)throw Error(`[login] failed to create threshold ECDSA session identity`);return t.value}function _R(e){let t=yr(e);if(!t.ok)throw Error(`[login] failed to create Wallet Session mint identity`);return t.value}function vR(e){if(e==null||e<=0)throw Error(`[login] unlock warm-up requires positive unlock session uses`);return e}function yR(e){let t=Error(`[login] device_link_required: local threshold ECDSA material is unavailable for ${e}`);return t.code=`device_link_required`,t}function bR(){let e=Error(`[login] device_link_required: local threshold Ed25519 material is unavailable`);return e.code=`device_link_required`,e}function xR(e){let t=String(e.sharedState.generatedThresholdSessionId||``).trim();if(t)return t;let n=hR(`threshold-ecdsa-login`);return e.sharedState.generatedThresholdSessionId=n,n}async function SR(e){if(!e.collectCredential)throw Error(`[login] WebAuthn ECDSA key-facts inventory requires a credential collector`);let t=nF(),n=await bs({walletId:e.walletId,rpId:e.rpId,keyTargets:e.keyTargets,serverNonceB64u:t,...e.runtimePolicyScope?{runtimePolicyScope:e.runtimePolicyScope}:{}}),r=await e.collectCredential(n);return await xc({relayerUrl:e.relayerUrl,walletId:e.walletId,rpId:e.rpId,credential:r,keyTargets:e.keyTargets,serverNonceB64u:t,expectedChallengeDigestB64u:n,...e.runtimePolicyScope?{runtimePolicyScope:e.runtimePolicyScope}:{}})}async function CR(e){let t=String(e.relayerUrl||``).trim(),n=String(e.rpId||``).trim();if(!t||!n)throw Error(`[login] threshold ECDSA key-facts inventory requires relayerUrl and rpId`);return e.authority?.kind===`wallet_session_operation_credential_v1`?await wc({relayerUrl:t,walletId:e.walletId,rpId:n,operationCredential:e.authority.operationCredential,keyTargets:e.keyTargets}):await SR({walletId:e.walletId,relayerUrl:t,rpId:n,keyTargets:e.keyTargets,...e.runtimePolicyScope?{runtimePolicyScope:e.runtimePolicyScope}:{},collectCredential:e.collectWebAuthnInventoryCredential})}function wR(e){let t=KP({walletId:e.walletId,configuredTargets:e.configuredTargets,signer:e.signer});switch(t.kind){case`active_ecdsa_signer_record`:return t.targetKey===z(e.record.walletKey.chainTarget)&&String(t.walletKey.keyHandle)===String(e.record.walletKey.keyHandle);case`key_facts_inventory_required`:return t.targetKey===z(e.record.walletKey.chainTarget)&&t.keyHandle===String(e.record.walletKey.keyHandle);case`blocked`:case`skipped`:return!1}return!1}function TR(e){let t=e.record.walletKey,n=t.keyFacts,r=z(t.chainTarget);return{...e.signer.metadata||{},accountModel:`threshold-ecdsa`,accountAddress:e.record.accountAddress,ownerAddress:e.record.ownerAddress,thresholdOwnerAddress:n.thresholdOwnerAddress,keyScope:n.keyScope,keyHandle:t.keyHandle,walletId:t.walletId,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,publicCapability:e.record.publicCapability,thresholdEcdsaPublicKeyB64u:n.thresholdEcdsaPublicKeyB64u,participantIds:[...n.participantIds],chainTarget:t.chainTarget,targetMembership:{targetKey:r,chainTarget:t.chainTarget},sharedEvmFamilyKey:{walletId:t.walletId,keyScope:n.keyScope,keyHandle:t.keyHandle,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,participantIds:[...n.participantIds],thresholdOwnerAddress:n.thresholdOwnerAddress,thresholdEcdsaPublicKeyB64u:n.thresholdEcdsaPublicKeyB64u},chainId:t.chainTarget.chainId}}async function ER(e){for(let t of e.records){let n=e.walletSigners.filter(n=>wR({walletId:e.walletId,configuredTargets:e.configuredTargets,signer:n,record:t}));if(n.length!==1)throw Error(`[login] authenticated ECDSA key inventory could not identify one profile signer for ${z(t.walletKey.chainTarget)}`);let r=n[0];if(String(t.walletKey.walletId)!==String(e.walletId)||t.accountAddress!==r.accountAddress||t.ownerAddress!==r.accountAddress||String(t.walletKey.keyFacts.thresholdOwnerAddress)!==r.accountAddress)throw Error(`[login] authenticated ECDSA key inventory profile identity mismatch for ${z(t.walletKey.chainTarget)}`);await e.store.activateAccountSigner({account:{profileId:r.profileId,chainIdKey:r.chainIdKey,accountAddress:r.accountAddress,accountModel:`threshold-ecdsa`},signer:{signerId:r.signerId,signerType:r.signerType,signerKind:r.signerKind,signerAuthMethod:r.signerAuthMethod,signerSource:r.signerSource,metadata:TR({signer:r,record:t})},activationPolicy:{mode:`allocate_next_free`},preferredSlot:r.signerSlot,selectAsActive:!1,mutation:{routeThroughOutbox:!1}})}}function DR(e,t){return t?{ecdsaKeys:e,runtimePolicyScope:t}:{ecdsaKeys:e}}function OR(e){let t=e.input?.keyFactsInventoryAuthority||null,n=e.input?.keyFactsInventoryRequested===!0,r=e.input?.relayerUrl||``,i=e.input?.rpId||``,a=e.input?.collectWebAuthnInventoryCredential;return e.runtimePolicyScope?{kind:`runtime_policy_scoped`,keyFactsInventoryAuthority:t,keyFactsInventoryRequested:n,relayerUrl:r,rpId:i,runtimePolicyScope:e.runtimePolicyScope,collectWebAuthnInventoryCredential:a}:{kind:`runtime_policy_unscoped`,keyFactsInventoryAuthority:t,keyFactsInventoryRequested:n,relayerUrl:r,rpId:i,collectWebAuthnInventoryCredential:a}}async function kR(e,t,n){let r=t.map(e=>e.chainTarget),i=await K.listAccountSignersByProfile({profileId:String(e),status:`active`}).catch(()=>[]),a=[],o=[],s=[];for(let t of i){let n=KP({walletId:e,configuredTargets:r,signer:t});switch(n.kind){case`active_ecdsa_signer_record`:a.push(n);break;case`key_facts_inventory_required`:o.push(n);break;case`blocked`:s.push(n);break;case`skipped`:break;default:}}if(!a.length&&!o.length&&!s.length)return[];let c=eF({selection:{mode:`ecdsa_only`,ecdsa:!0},configuredTargets:r,activeSignerRecords:a,keyFactsInventoryRequiredRecords:o,blockedRecords:s,runtimeConfig:{explicitKeyFactsInventoryMode:n?.keyFactsInventoryRequested===!0,allowAuthenticatedKeyFactsInventory:!!n?.keyFactsInventoryAuthority}});switch(c.kind){case`ready`:{let t=c.readyTargets.filter(e=>e.publicCapability.kind===`missing_public_capability`),a=new Map,o=[];if(t.length){let r=await CR({walletId:e,relayerUrl:n?.relayerUrl||``,rpId:n?.rpId||``,keyTargets:t.map(e=>({keyHandle:e.walletKey.keyHandle,chainTarget:e.chainTarget})),authority:n?.keyFactsInventoryAuthority||null,...n?.runtimePolicyScope?{runtimePolicyScope:n.runtimePolicyScope}:{},collectWebAuthnInventoryCredential:n?.collectWebAuthnInventoryCredential});o=r.records;for(let e of r.records)a.set(z(e.walletKey.chainTarget),e.publicCapability)}let s=YP({source:`profile continuity`,keys:c.readyTargets.map(e=>JP({chainTarget:e.chainTarget,keyHandle:e.walletKey.keyHandle,key:Za(e.walletKey),publicCapability:e.publicCapability.kind===`persisted_public_capability`?e.publicCapability.value:a.get(e.targetKey)}))}),l=s.filter(e=>e.publicCapability.kind===`missing_public_capability`).map(e=>e.targetKey);if(l.length)throw Error(`[login] authenticated ECDSA key inventory did not return public capabilities for ${l.join(`, `)}`);return await ER({store:K,walletId:e,configuredTargets:r,walletSigners:i,records:o}),s}case`no_configured_ecdsa_targets`:return[];case`awaiting_authenticated_key_facts_inventory`:{let a=n?.keyFactsInventoryAuthority;if(!a)throw Error(`[login] threshold ECDSA key-facts inventory requires authenticated inventory authority`);let o=await CR({walletId:e,relayerUrl:n.relayerUrl,rpId:n.rpId,keyTargets:c.keyTargets,authority:a,...n.runtimePolicyScope?{runtimePolicyScope:n.runtimePolicyScope}:{},collectWebAuthnInventoryCredential:n.collectWebAuthnInventoryCredential}),s=ZP({context:{ecdsaKeys:YP({source:`profile continuity inventory`,keys:o.records.map(e=>JP({chainTarget:e.walletKey.chainTarget,keyHandle:e.walletKey.keyHandle,key:Za(e.walletKey),publicCapability:e.publicCapability}))})},configuredTargets:t});if(s.kind!==`complete_configured_target_keys`)throw Error(`[login] threshold ECDSA key-facts inventory returned incomplete key facts`);return await ER({store:K,walletId:e,configuredTargets:r,walletSigners:i,records:o.records}),s.context.ecdsaKeys}case`key_facts_inventory_required`:{let e=c.keyFactsInventoryRequiredRecords.map(e=>e.targetKey).join(`, `);throw n?.keyFactsInventoryRequested?Error(`[login] threshold ECDSA key-facts inventory requires authenticated inventory authority for ${e}`):Error(`[login] threshold ECDSA warm-up requires complete local key facts for ${e}; run explicit authenticated ECDSA key-facts inventory before unlock`)}case`blocked`:{let e=c.blockedRecords.map(e=>`${e.targetKey||`unknown`}:${e.reason}`).join(`, `);throw Error(`[login] threshold ECDSA warm-up requires complete local key facts before unlock; run explicit authenticated ECDSA key-facts inventory before unlock; blocked profile signer records: ${e}`)}}return[]}async function AR(e,t,n,r){let i=Xe(e.configs.network.chains),a=DR(YP({source:`stored`,keys:[]}),void 0),o=await kk({walletId:t,chainTargets:i.map(e=>e.chainTarget),...r?{authMethod:r}:{}}),s=[],c;for(let e of o){let t=e.manifest;for(let{chainTarget:n}of i){if(!t.signer.scope.targetMemberships.some(e=>z(e)===z(n)))continue;let r=t.durableMaterial.roleLocalPublicFacts,i=String(r.keyHandle),a=r.publicCapability,o=e.material,l=t.durableMaterial.runtimePolicyScope,u=yo({runtimePolicyScope:l});if(String(u.signingRootId)!==String(t.signer.signingRootId)||String(u.signingRootVersion)!==String(t.signer.signingRootVersion))throw Error(`[login] threshold ECDSA canonical runtime policy scope mismatch for ${z(n)}`);if(c&&l&&!BL(c,l))throw Error(`[login] threshold ECDSA durable lanes have conflicting runtime policy scopes`);!c&&l&&(c=l),s.push(JP({chainTarget:n,keyHandle:i,key:$a({walletId:t.signer.walletId,ecdsaThresholdKeyId:t.durableMaterial.roleLocalBinding.ecdsaThresholdKeyId,signingRootId:t.signer.signingRootId,signingRootVersion:t.signer.signingRootVersion,participantIds:t.signer.registeredPublicFacts.participantIds,thresholdOwnerAddress:t.signer.registeredPublicFacts.thresholdOwnerAddress}),publicCapability:a,existingRoleLocalMaterial:o}))}}let l=YP({source:`available lane`,keys:s});a=VL({current:a,incoming:DR(l,c),source:`durable lanes`});let u=ZP({context:a,configuredTargets:i});if(u.kind===`complete_configured_target_keys`)return u.context;let d=new Set(u.missingTargets),f=await kR(t,i.filter(e=>d.has(z(e.chainTarget))),OR({input:n,runtimePolicyScope:a.runtimePolicyScope}));return a=VL({current:a,incoming:{ecdsaKeys:f},source:`profile continuity`}),a}async function jR(e,t){let n=[...new Set((await dR(e,t)).map(e=>String(e.keyFacts.thresholdEcdsaPublicKeyB64u||``).trim()).filter(Boolean))];return n.length===1?n[0]:(n.length>1&&console.warn(`[WalletSession] conflicting profile threshold ECDSA public keys`,{walletId:String(t),publicKeyCount:n.length}),null)}async function MR(e,t){let[n,r]=await Promise.all([fR(e,t),jR(e,t)]);if(n&&r)return{ethereumAddress:n,thresholdEcdsaPublicKeyB64u:r};let i=await kk({walletId:t,chainTargets:Xe(e.configs.network.chains).map(e=>e.chainTarget)}),a=new Set,o=new Set;for(let e of i){let t=e.manifest.signer.registeredPublicFacts;a.add(uR(t.thresholdOwnerAddress)),o.add(t.publicKeyB64u)}return{ethereumAddress:n??(a.size===1?[...a][0]:null),thresholdEcdsaPublicKeyB64u:r??(o.size===1?[...o][0]:null)}}function NR(e){return{kind:`failed`,reason:e}}function PR(){return{kind:`failed`,reason:`persistence_unavailable`}}function FR(e){switch(e.state){case`ready`:return{kind:`ready`};case`restorable`:return{kind:`pending`,resume:`restore_material`};case`deferred`:return{kind:`pending`,resume:`resolve_deferred_state`};case`expired`:return{kind:`authorization_required`,requirement:`wallet_session_expired`};case`exhausted`:return{kind:`authorization_required`,requirement:`wallet_session_exhausted`}}throw Error(`[SeamsWeb] unsupported capability lane readiness`)}function IR(e,t){let n=e.diagnostics?.invalidLanes.find(e=>e.curve===t);return n?n.reason===`ambiguous_material`||n.reason===`conflicting_key_material`?`ambiguous_lane`:`malformed`:null}function LR(e,t){let n=z(t),r=e.diagnostics?.invalidLanes.find(e=>e.curve===`ecdsa`&&(e.targetKey===void 0||e.targetKey===n));return r?r.reason===`ambiguous_material`||r.reason===`conflicting_key_material`?`ambiguous_lane`:`malformed`:null}function RR(e,t){return String(t.walletId)===String(e.walletId)&&String(t.nearAccountId)===String(e.nearAccountId)&&String(t.nearEd25519SigningKeyId)===String(e.nearEd25519SigningKeyId)&&t.signerSlot===e.signerSlot}function zR(e,t){return String(t.key.walletId)===String(e.walletId)&&String(t.key.ecdsaThresholdKeyId)===String(e.ecdsaThresholdKeyId)}function BR(e){if(e.availableLanes.kind===`unavailable`)return{kind:`near_ed25519`,subject:e.subject,lane:PR()};let t=e.availableLanes.lanes;if(String(t.walletId)!==String(e.subject.walletId))return{kind:`near_ed25519`,subject:e.subject,lane:NR(`identity_mismatch`)};let n=IR(t,`ed25519`);if(n)return{kind:`near_ed25519`,subject:e.subject,lane:NR(n)};let r=t.lanes.ed25519.near;return Mf(r)?{kind:`near_ed25519`,subject:e.subject,lane:RR(e.subject,r)?FR(r):NR(`identity_mismatch`)}:{kind:`near_ed25519`,subject:e.subject,lane:NR(`missing`)}}function VR(e){if(e.availableLanes.kind===`unavailable`)return PR();let t=e.availableLanes.lanes;if(String(t.walletId)!==String(e.subject.walletId))return NR(`identity_mismatch`);let n=LR(t,e.chainTarget);if(n)return NR(n);let r=Ff(t,e.chainTarget);return Mf(r)?zR(e.subject,r)?r.source===`canonical_capability`&&!r.authorization?{kind:`authorization_required`,requirement:`same_method_step_up`}:FR(r):NR(`identity_mismatch`):NR(`missing`)}function HR(e){let[t,...n]=e.configuredTargets;return t?{kind:`evm_family_ecdsa`,subject:e.subject,targets:{kind:`configured_targets`,lanes:[{chainTarget:t,readiness:VR({subject:e.subject,availableLanes:e.availableLanes,chainTarget:t})},...n.map(t=>({chainTarget:t,readiness:VR({subject:e.subject,availableLanes:e.availableLanes,chainTarget:t})}))]}}:{kind:`evm_family_ecdsa`,subject:e.subject,targets:{kind:`no_configured_target`}}}function UR(e){let t=e.subjectSet.subjects.map(t=>{switch(t.kind){case`near_ed25519_wallet`:return BR({subject:t,availableLanes:e.availableLanes});case`evm_family_ecdsa_wallet`:return HR({subject:t,availableLanes:e.availableLanes,configuredTargets:e.configuredEcdsaTargets})}return $(t)}),n=t[0];if(!n)throw Error(`[WalletSession] resolved capability subjects must be non-empty`);return{kind:`resolved`,subjectSet:e.subjectSet,capabilities:[n,...t.slice(1)]}}function WR(e){return e?e.operationalPublicKey:null}function GR(e,t){return!!(e&&String(e.walletId)===String(t.walletId)&&String(e.nearAccountId)===String(t.nearAccountId)&&e.signerSlot===t.signerSlot)}async function KR(e,t){let n=await e.getLastUser().catch(()=>null);if(GR(n,t))return n;let r=await hi(K,t.nearAccountId,t.signerSlot).catch(()=>null);if(GR(r,t))return r;let i=await e.getUserBySignerSlot(t.nearAccountId,t.signerSlot).catch(()=>null);return GR(i,t)?i:null}function qR(e,t){return e.walletId===t.walletId&&e.nearAccountId===t.nearAccountId&&e.nearEd25519SigningKeyId===t.nearEd25519SigningKeyId&&e.signerSlot===t.signerSlot}async function JR(e){let t=o(String(e.walletId));if(!t.ok)return null;let n=t.value,r;try{r=await K.resolveSelectedWalletAuthority(String(n))}catch{return null}if(r.kind!==`resolved`)return null;let{selection:i,authMethod:a,authority:s}=r;if(KF({walletId:n,selection:i,authMethod:a,authority:s}).length>0||a.status!==`active`||s.state!==`active`||s.provenance.kind!==`device_link`)return null;let c=await VI({walletId:n,authMethod:a,authority:s,signerMaterials:r.signerMaterials});if(c.kind!==`resolved`||!qR(c.subject,e))return null;let l=s.signerActivations.ed25519;return l?`ed25519:${zi(I(l.signer.registeredPublicKeyB64u))}`:null}async function YR(e,t){let[n,r]=await Promise.all([oI(t),MR(e,t).catch(()=>({ethereumAddress:null,thresholdEcdsaPublicKeyB64u:null}))]);return{kind:`resolved`,walletId:t,nearAccountId:null,nearOperationalPublicKey:null,userData:null,authMethods:n,thresholdEcdsaEthereumAddress:r.ethereumAddress,thresholdEcdsaPublicKeyB64u:r.thresholdEcdsaPublicKeyB64u}}async function XR(e,t){let n=t.walletId,r=MF(t.subjectSet),i=r?.nearAccountId||null,[a,o]=await Promise.all([r?KR(e.signingEngine,r):null,YR(e,n)]),s=WR(a)||(r?await JR(r):null);return{...o,nearAccountId:i,nearOperationalPublicKey:s,userData:a}}async function ZR(e){let[t,n,r]=await Promise.all([e.signingEngine.getAllUsers(),K.listWalletSelections(),e.signingEngine.getLastUser()]),i=(await Promise.all(n.map(rI))).filter(e=>e!==null),a=new Map;for(let e of t){let t=nI(e);a.set(iI(t),t)}for(let e of i)a.set(iI(e),e);let o=[...a.values()],s=[...new Set([...o.map(e=>e.walletId),...n.map(e=>String(e.walletId))])],c=[...new Set(o.map(e=>e.nearAccountId))],l=r?nI(r):null;return{walletIds:s,accountIds:c,accounts:o,lastUsedAccount:aI([...i,...l?[l]:[]])}}function QR(e){if(e.record.status!==`active`)return null;switch(e.kind){case`passkey`:return{walletId:e.record.walletId,authMethod:`passkey`};case`email_otp`:{let t=e.presentation.email.kind===`verified`?String(e.presentation.email.address):null;return{walletId:e.record.walletId,authMethod:`email_otp`,emailAddress:t}}default:return $(e)}}function $R(e){let t=[];for(let n of e){let e=QR(n);e&&t.push(e)}return t}async function ez(e){return $R(await nz(e,await K.listLocalWalletAuthMethodProjectionsV2ForWallet(e)))}function tz(e){return e.kind===`email_otp`&&e.record.status===`active`&&e.presentation.email.kind===`unavailable`}async function nz(e,t){let n=[];for(let e of t)tz(e)&&n.push(e);if(n.length===0)return[...t];let r=w(await _s(K,e));if(!r.ok)return[...t];let i=!1;for(let t of n){let n=await K.retainVerifiedEmailOtpLocalPresentation({walletId:e,walletAuthMethodId:t.record.walletAuthMethodId,emailAddress:r.value});switch(n.kind){case`retained`:i=!0;break;case`not_retained`:break;default:$(n)}}return i?await K.listLocalWalletAuthMethodProjectionsV2ForWallet(e):[...t]}async function rz(){let e=await K.listWalletSelectionWalletIds();return(await Promise.all([...new Set(e)].map(ez))).flat()}async function iz(e){let{signingEngine:t}=e,n=t.readWalletAuthenticationState(),r,i=!1,a=!1;if(n.kind===`authenticated`){try{await t.advanceWalletLockGeneration(n.walletId)}catch(e){r=e,i=!0}try{await t.retireActiveWalletSessionAuthorizationForLock(n.walletId)}catch(e){i||=(r=e,!0)}}try{a=t.clearWalletAuthenticationIfCurrent(n)}catch(e){i||=(r=e,!0)}if(a){try{t.getNonceCoordinator().clearAll()}catch{}try{t.clearThresholdEcdsaSigningQueue()}catch{}}try{await t.clearVolatileWarmSigningMaterial(n.kind===`authenticated`?n.walletId:void 0)}catch(e){i||=(r=e,!0)}if(i)throw r}async function az(e){let t=e.signingEngine.readWalletAuthenticationState(),n=t.kind===`authenticated`?{kind:`wallet`,walletId:t.walletId}:null,r,i=!1;try{await iz(e)}catch(e){r=e,i=!0}if(n)try{await e.signingEngine.deleteDurableEcdsaPresignatures(n)}catch(e){i||(r=e),i=!0}if(i)throw r}async function oz(e){try{await(await import(`./registration-CSAG_h4Y.js`).then(e=>e.o)).resumeNearRegistrationAfterUnlock(e)}catch(e){console.warn(`[login] NEAR continuation could not start`,e instanceof Error?e.message:`module unavailable`)}finally{new Uint8Array(e.ownedFactorSecret).fill(0)}}function sz(e){switch(e?.mode){case`ed25519_only`:return{kind:`near_ed25519_only`};case`ecdsa_only`:return{kind:`evm_family_ecdsa_only`};case`ed25519_and_ecdsa`:case void 0:return{kind:`all_registered_mpc`}}throw Error(`wallet unlock selection is unsupported`)}async function cz(e){let t=await wF({walletId:e.walletId,requestedCapabilityFamilies:sz(e.selection)});switch(t.kind){case`resolved`:return t.subjectSet;case`missing_requested_capability_subject`:throw Error(`wallet unlock is missing the requested capability subject`);case`capability_subject_resolution_failed`:throw Error(`wallet unlock subject resolution failed: ${t.reason}`)}throw Error(`wallet unlock subject resolution returned an unknown result`)}function lz(e){let t=null;for(let n of e.subjects)if(n.kind===`near_ed25519_wallet`){if(t)throw Error(`wallet unlock resolved multiple NEAR Ed25519 subjects`);t=n}return t}async function uz(e,t,n){let r=String(t||``).trim();if(!r)throw Error(`unlock requires walletId`);if(e.walletIframe.shouldUseWalletIframe())try{let t=await(await e.walletIframe.requireRouter(r)).unlock(Su({walletId:r,options:n}));if(!t.success){let e=Error(t.error||`Login failed`);return await n?.onError?.(e),await n?.afterCall?.(!1,void 0,e),t}return await e.initWalletIframe(r),await n?.afterCall?.(!0,t),t}catch(e){let t=N(e);throw await n?.onError?.(t),await n?.afterCall?.(!1),t}let i=await cz({walletId:r,selection:n?.unlockSelection}),a=await BI(e.getContext(),i,n),o=null;if(a?.success){o=String(i.walletId);let t=lz(i);t&&await e.signingEngine.activateAuthenticatedWalletState({walletId:t.walletId,nearAccountId:t.nearAccountId,signerSlot:t.signerSlot,nearClient:e.nearClient})}return await e.initWalletIframe(o||void 0),a}async function dz(e){if(e.walletIframe.shouldUseWalletIframe()){await(await e.walletIframe.requireRouter()).lock();return}await iz(e.getContext())}async function fz(e){if(e.walletIframe.shouldUseWalletIframe()){await(await e.walletIframe.requireRouter()).logout();return}await az(e.getContext())}async function pz(e,t){if(e.walletIframe.shouldUseWalletIframe()){let n=await e.walletIframe.requireRouter(t),r=await n.getWalletSession(t);try{await n.prefetchBlockheight()}catch{}return r}return await iR(e.getContext(),t)}async function mz(e,t){let n=String(t||``).trim();return n?e.walletIframe.shouldUseWalletIframe()?await(await e.walletIframe.requireRouter()).hasPasskeyCredential(n):(await K.listWalletAuthMethodsV2ForWallet(n).catch(()=>[])).some(e=>e.kind===V.passkey&&e.status===`active`):!1}async function hz(e){if(e.walletIframe.shouldUseWalletIframe())try{return await(await e.walletIframe.requireRouter()).getRecentUnlocks()}catch{return{walletIds:[],accountIds:[],lastUsedAccount:null}}return await ZR(e.getContext())}async function gz(e,t,n){if(e.walletIframe.shouldUseWalletIframe())return await(await e.walletIframe.requireRouter(t.walletSession.walletId)).prefillRouterAbEcdsaDerivationPresignaturePool({walletSession:t.walletSession,options:{chainTarget:t.chainTarget,...typeof t.waitForPoolReady==`boolean`?{waitForPoolReady:t.waitForPoolReady}:{}}});let r=R(t.walletSession.walletId);return await e.signingEngine.scheduleRouterAbEcdsaDerivationLoginPresignaturePrefill({walletId:r,chainTarget:t.chainTarget,...typeof t.waitForPoolReady==`boolean`?{waitForPoolReady:t.waitForPoolReady}:{}},n)}const _z=new WeakMap;function vz(e,t){_z.set(e,t)}function yz(e){return{unlock:async(t,n)=>await uz(e.getWalletAuthDeps(),t,n),lock:async()=>await dz(e.getWalletAuthDeps()),logout:async()=>await fz(e.getWalletAuthDeps()),getWalletSession:async t=>await pz(e.getWalletAuthDeps(),t),getRecentUnlocks:async()=>await hz(e.getWalletAuthDeps()),hasPasskeyCredential:async t=>await mz(e.getWalletAuthDeps(),t),prefillRouterAbEcdsaDerivationPresignaturePool:async t=>await gz(e.getWalletAuthDeps(),t,new wt),requestEmailOtpChallenge:e.domain.requestEmailOtpChallenge,requestEmailOtpSigningSessionChallenge:e.domain.requestEmailOtpSigningSessionChallenge,refreshEmailOtpSigningSession:e.domain.refreshEmailOtpSigningSession,loginWithEmailOtpEcdsaCapability:e.domain.loginWithEmailOtpEcdsaCapability,unlockAddedEmailOtpWallet:e.domain.unlockAddedEmailOtpWallet,beginGoogleEmailOtpWalletAuth:e.domain.beginGoogleEmailOtpWalletAuth}}const bz=`/wallet/device-linking/v1/sessions`,xz=4e3,Sz=[`ok`,`outcome`,`session`],Cz=[`ok`,`outcome`,`session`,`targetCredential`],wz=[`ok`,`code`,`message`],Tz=[`ok`,`outcome`,`code`,`message`],Ez=[`ok`,`outcome`,`expectedRevision`,`actualRevision`,`session`],Dz=[`ok`,`outcome`,`session`],Oz=[`ok`,`outcome`,`state`,`session`],kz=[`ok`,`outcome`,`reason`,`session`];function Az(e,t){let n=Math.min(e,xz),r=Math.min(Math.max(t,0),5),i=Math.min(xz,n*2**r),a=Math.max(1,Math.min(n,i/4)),o=Math.floor(Math.random()*a);return Math.min(xz,i+o)}async function jz(e){let t=e.options.nowMs()+6e4,n=0;for(;e.options.nowMs()<t;){let t=await zz({options:e.options,baseUrl:e.baseUrl,method:`GET`,canonicalPath:Qz(e.linkSessionId,`approval`),linkSessionId:e.linkSessionId});if(t.status!==204)return qa(t.body);let r=Az(e.options.pollIntervalMs,n);await new Promise(e=>setTimeout(e,r)),n+=1}throw Error(`committed authority packages were not ready before the activation deadline`)}function Mz(e){let t=Xz(e.relayerUrl);if(!Number.isSafeInteger(e.pollIntervalMs)||e.pollIntervalMs<=0)throw Error(`linked-device session poll interval must be a positive integer`);return{...Pz(e),...Nz(e),createUnclaimedSessionV1:async n=>{await Rz({options:e,baseUrl:t,method:`POST`,canonicalPath:bz,linkSessionId:n.payload.linkSessionId,body:{kind:`linked_device_session_create_request_v1`,payload:n.payload}})},getSessionV1:async({linkSessionId:n})=>await Lz({options:e,baseUrl:t,linkSessionId:n}),getApprovalV1:async({linkSessionId:n})=>ao((await zz({options:e,baseUrl:t,method:`GET`,canonicalPath:Qz(n,`approval`),linkSessionId:n})).body).approval,getTargetPreparationV1:async({linkSessionId:n,deliveryRecipientPublicKey65B64u:r})=>{let i=qi({kind:`linked_device_target_preparation_request_v1`,linkSessionId:n,deliveryRecipientPublicKey65B64u:r});return sa((await zz({options:e,baseUrl:t,method:`POST`,canonicalPath:Qz(n,`target-preparation`),linkSessionId:n,body:i})).body)},startTargetEmailOtpChallengeV1:async({request:n})=>{let r=xo(n);return Ea((await zz({options:e,baseUrl:t,method:`POST`,canonicalPath:Qz(r.linkSessionId,`email-otp/challenge`),linkSessionId:r.linkSessionId,body:r})).body)},resendTargetEmailOtpChallengeV1:async({request:n})=>{let r=Va(n);return Ea((await zz({options:e,baseUrl:t,method:`POST`,canonicalPath:Qz(r.linkSessionId,`email-otp/challenge/resend`),linkSessionId:r.linkSessionId,body:r})).body)},verifyTargetEmailOtpChallengeV1:async({request:n})=>{let r=ko(n);return pa((await zz({options:e,baseUrl:t,method:`POST`,canonicalPath:Qz(r.linkSessionId,`email-otp/challenge/verify`),linkSessionId:r.linkSessionId,body:r})).body)},registerTargetCredentialV1:async({registration:n})=>Uz((await zz({options:e,baseUrl:t,method:`POST`,canonicalPath:Qz(n.linkSessionId,`credential`),linkSessionId:n.linkSessionId,body:n})).body),registerEd25519ExportRootRecipientV1:async({recipient:n})=>{let r=Iz(n.linkSessionId);await zz({options:e,baseUrl:t,method:`POST`,canonicalPath:Qz(r,`ed25519-export-root-recipient`),linkSessionId:r,body:n})},getEd25519ExportRootPackageV1:async({linkSessionId:n})=>{let r=await zz({options:e,baseUrl:t,method:`GET`,canonicalPath:Qz(n,`ed25519-export-root`),linkSessionId:n});return r.status===204?null:Ta(r.body)},retryCommittedDeliveryV1:async({request:n})=>{await Rz({options:e,baseUrl:t,method:`POST`,canonicalPath:Qz(n.linkSessionId,`retry`),linkSessionId:n.linkSessionId,body:n})},cancelSessionV1:async({request:n})=>{await Rz({options:e,baseUrl:t,method:`POST`,canonicalPath:Qz(n.linkSessionId,`cancel`),linkSessionId:n.linkSessionId,body:n})},subscribeSessionV1:async({linkSessionId:n,onEvent:r})=>await Vz({options:e,baseUrl:t,linkSessionId:n,onEvent:r})}}function Nz(e){let t=Xz(e.relayerUrl);return{acknowledgeLocalAuthorityActivationWithWalletSessionV1:async({acknowledgement:n,operationCredential:r})=>{let i=na(n),a=ir(r);if(a.walletSessionId!==i.walletSessionId)throw Error(`linked-device acknowledgement credential does not match Wallet Session`);await Bz({options:e,baseUrl:t,linkSessionId:i.linkSessionId,token:a.token,body:i})}}}function Pz(e){let t=Xz(e.relayerUrl);return{receiveCommittedAuthorityPackagesV1:async({linkSessionId:n})=>await jz({options:e,baseUrl:t,linkSessionId:n}),activateInstalledAuthorityV1:async({linkSessionId:n,receipt:r})=>{let i=Sa(r);return oo((await zz({options:e,baseUrl:t,method:`POST`,canonicalPath:Qz(n,`receipt`),linkSessionId:n,body:i})).body)},acknowledgeLocalAuthorityActivationV1:async({acknowledgement:n})=>{let r=na(n);await zz({options:e,baseUrl:t,method:`POST`,canonicalPath:Qz(n.linkSessionId,`receipt`),linkSessionId:n.linkSessionId,body:r})}}}function Fz(e){return{...e.owner,createAuthenticatedSessionTransportV1:({keyMaterial:t,devicePublicKeyB64u:n})=>Mz({http:e.http,relayerUrl:e.relayerUrl,publishableKey:e.publishableKey,projectEnvironmentId:e.projectEnvironmentId,keyMaterial:e.keyMaterial,keyMaterialHandle:t,devicePublicKeyB64u:n,nowMs:e.nowMs,pollIntervalMs:e.pollIntervalMs})}}function Iz(e){let t=g(e);if(!t.ok)throw Error(t.error.message);return t.value}async function Lz(e){return Hz((await zz({options:e.options,baseUrl:e.baseUrl,method:`GET`,canonicalPath:Zz(e.linkSessionId),linkSessionId:e.linkSessionId})).body).session}async function Rz(e){return Hz((await zz(e)).body)}async function zz(e){let t=e.options.publishableKey.trim(),n=e.options.projectEnvironmentId.trim();if(!t||!n)throw Error(`linked-device Passkey ceremony requires registration API credentials`);let r=await Fr(Yz(e.body)),i=e.options.nowMs();if(!Number.isSafeInteger(i)||i<=0)throw Error(`linked-device request clock is invalid`);let a=i+$i,o=fe(32,`linked-device request proof nonce`),s=await ga(e.options.devicePublicKeyB64u),c=await e.options.keyMaterial.signDeviceSessionRequestV1({handle:e.options.keyMaterialHandle,linkSessionId:e.linkSessionId,method:e.method,canonicalPath:e.canonicalPath,bodyDigestB64u:r,devicePublicKeyDigestB64u:s,challengeB64u:o,issuedAtMs:i,expiresAtMs:a}),l={kind:`linked_device_request_proof_v1`,linkSessionId:e.linkSessionId,devicePublicKeyDigestB64u:s,requestNonceB64u:o,method:e.method,canonicalPath:e.canonicalPath,bodyDigestB64u:r,issuedAtMs:i,expiresAtMs:a,signatureB64u:c.signatureB64u},u=F(new TextEncoder().encode(JSON.stringify(l))),d=await e.options.http.request({method:e.method,url:`${e.baseUrl}${e.canonicalPath}`,headers:{Accept:`application/json`,Authorization:`Bearer ${t}`,"Content-Type":`application/json`,"X-Seams-Environment-Id":n,[_a]:u},...e.body===void 0?{}:{body:e.body}});if(!d.ok)throw Error(`linked-device request failed: ${d.message}`);if(d.value.status<200||d.value.status>=300)throw Error(Gz(d.value));return d.value}async function Bz(e){let t=e.token.trim(),n=e.options.projectEnvironmentId.trim();if(!t||!n)throw Error(`linked-device Wallet Session acknowledgement requires session credentials`);let r=await e.options.http.request({method:`POST`,url:`${e.baseUrl}${Qz(e.linkSessionId,`receipt`)}`,headers:{Accept:`application/json`,Authorization:`Bearer ${t}`,"Content-Type":`application/json`,"X-Seams-Environment-Id":n},body:e.body});if(!r.ok)throw Error(`linked-device request failed: ${r.message}`);if(r.value.status<200||r.value.status>=300)throw Error(Gz(r.value))}async function Vz(e){let t=!1,n,r=null,i=!0,a=0,o=null,s=async()=>{if(!t)try{let t=await Lz({...e});r===null||t.revision!==r?(r=t.revision,a=0,e.onEvent(za({kind:`linked_device_session_event_v1`,linkSessionId:t.linkSessionId,state:t.state,emittedAtMs:t.updatedAtMs}))):a+=1}catch(e){if(i)throw t=!0,e;a+=1}finally{i=!1,t||(n=setTimeout(()=>{o=s()},Az(e.options.pollIntervalMs,Math.max(0,a-1))))}};return await(o=s()),{close:async()=>{t=!0,n!==void 0&&clearTimeout(n),await o?.catch(()=>void 0)}}}function Hz(e){let t=Kz(e);if(t===null)throw Error(`linked-device response must be an object`);if(!Jz(t,Sz))throw Error(`linked-device response contains invalid fields`);if(t.ok!==!0)throw Error(`linked-device response outcome is invalid`);switch(t.outcome){case`applied`:return{ok:!0,outcome:`applied`,session:Ia(t.session)};case`replayed`:return{ok:!0,outcome:`replayed`,session:Ia(t.session)};default:throw Error(`linked-device response outcome is invalid`)}}function Uz(e){let t=Kz(e);if(t===null)throw Error(`linked-device target credential response must be an object`);if(!Jz(t,Cz))throw Error(`linked-device target credential response contains invalid fields`);if(t.ok!==!0)throw Error(`linked-device target credential response outcome is invalid`);switch(t.outcome){case`applied`:return Wz(t,`applied`);case`replayed`:return Wz(t,`replayed`);default:throw Error(`linked-device target credential response outcome is invalid`)}}function Wz(e,t){let n=Ia(e.session),r=Yi(e.targetCredential);if(r.outcome!==t)throw Error(`linked-device target credential response outcome does not match its result`);if(r.linkSessionId!==n.linkSessionId)throw Error(`linked-device target credential response session identity differs`);return r}function Gz(e){let t=Kz(e.body);if(t===null||t.ok!==!1)return`linked-device request failed with HTTP ${e.status}`;if(Jz(t,wz)&&typeof t.code==`string`&&typeof t.message==`string`&&t.message.trim()||Jz(t,Tz)&&typeof t.outcome==`string`&&typeof t.code==`string`&&typeof t.message==`string`&&t.message.trim())return`linked-device request failed: ${t.message}`;switch(t.outcome){case`conflict`:if(Jz(t,Ez))return`linked-device request failed: conflict`;break;case`expired`:if(Jz(t,Dz))return`linked-device request failed: expired`;break;case`invalid_state`:if(Jz(t,Oz))return`linked-device request failed: invalid_state`;break;case`integrity_error`:if(Jz(t,kz))return`linked-device request failed: integrity_error`;break;default:break}return`linked-device request failed with HTTP ${e.status}`}function Kz(e){return qz(e)?e:null}function qz(e){if(typeof e!=`object`||!e||Array.isArray(e))return!1;try{let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}catch{return!1}}function Jz(e,t){try{return Dc(e,t)}catch{return!1}}function Yz(e){if(e===void 0)return new Uint8Array;let t=JSON.stringify(e);if(typeof t!=`string`)throw Error(`linked-device request body is not JSON serializable`);return new TextEncoder().encode(t)}function Xz(e){let t=e.trim().replace(/\/+$/,``);if(!t)throw Error(`linked-device relayer URL is required`);return t}function Zz(e){return`${bz}/${String(e)}`}function Qz(e,t){return`${Zz(e)}/${t}`}function $z(e){return e?String(e.linkSessionId):`link-device-scan`}function eB(e){return new J(e,Y.INVALID_QR_DATA,`authorization`)}function tB(e,t){try{e?.(t)}catch{}}function nB(e,t,n){e?.(ts({flowId:$z(t),...n,data:{role:`scanner`,...n.data??{}}}))}function rB(e,t){if(e.walletSessionId!==t.walletSessionId||e.authorizationId!==t.authorizationId)throw Error(`wallet-session authorization source changed during linking`)}function iB(e){if(e instanceof J)return e;let t=P(e)||`Device linking failed`;return/expired|expiry/i.test(t)?new J(t,Y.SESSION_EXPIRED,`authorization`):new J(t,Y.REGISTRATION_FAILED,`registration`)}function aB(e){let t;try{t=Ya(e)}catch(e){throw eB(P(e)||`Invalid linked-device QR payload`)}let n=Date.now();if(t.issuedAtMs>n+6e4)throw eB(`QR payload was issued in the future`);if(t.expiresAtMs<=n)throw new J(`QR code expired`,Y.SESSION_EXPIRED,`authorization`);return t}async function oB(e,t,n,r,i){let a=null,o=null;nB(n.onEvent,a,{phase:ls.STEP_02_QR_SCAN_STARTED,status:`started`,message:`Scanning QR code`,interaction:{kind:`qr_scan`,overlay:`hide`}});try{a=aB(t);let e=await r.ownerAuthorization.authenticateOwnerForLinkingV1({payload:a,requestedAtMs:Date.now()});rB(e.ownerAuthorization,e.authentication.source);let s=await r.transport.claimSessionV1({request:fo(a),authentication:e.authentication});if(s.linkSessionId!==a.linkSessionId||s.devicePublicKeyB64u!==a.devicePublicKeyB64u||s.walletId!==e.walletId)throw Error(`linked-device claim does not match the scanned QR payload`);o={linkSessionId:s.linkSessionId,expectedRevision:s.sessionRevision,authentication:e.authentication},i?.(o);let c=await cB({targetFactor:a.targetFactor,targetEmail:a.targetFactor.kind===`email_otp`?a.targetEmail:void 0,linkSessionId:s.linkSessionId,sessionRevision:s.sessionRevision,transport:r.transport,authentication:e.authentication,onEmailOtpBaseFactorRequired:n.onEmailOtpBaseFactorRequired}),l=Ka({linkSessionId:s.linkSessionId,walletId:s.walletId,enrollmentId:s.enrollmentId,deviceId:s.deviceId,linkPublicKeyB64u:a.linkPublicKeyB64u,devicePublicKeyB64u:s.devicePublicKeyB64u,targetFactor:c,permission:a.requestedPermission,ownerAuthorization:e.ownerAuthorization,approvedAtMs:Date.now(),expiresAtMs:Math.min(e.expiresAtMs,s.claimExpiresAtMs)});pB(await r.transport.recordOwnerApprovalV1({approval:l,authentication:e.authentication})),o=null,await yB({transport:r.transport,linkSessionId:s.linkSessionId,walletId:s.walletId,enrollmentId:s.enrollmentId,deviceId:s.deviceId,expiresAtMs:Math.min(e.expiresAtMs,s.claimExpiresAtMs),exportRootRequirement:e.exportRootRequirement,ed25519ExportRootCapability:e.exportRootRequirement===`required`?e.ed25519ExportRootCapability:void 0,ed25519ExportRoot:r.ed25519ExportRoot,authentication:e.authentication}),await mB({transport:r.transport,sourceContribution:r.sourceContribution,ed25519ExportRootCapability:e.exportRootRequirement===`required`?e.ed25519ExportRootCapability:void 0,initialApproval:l,authentication:e.authentication,expiresAtMs:Math.min(e.expiresAtMs,s.claimExpiresAtMs)});let u={success:!0,kind:`approval_recorded`,walletId:s.walletId,enrollmentId:s.enrollmentId,deviceId:s.deviceId};return nB(n.onEvent,a,{phase:ls.STEP_02_QR_SCAN_STARTED,status:`succeeded`,message:`Device-link approval recorded`,walletId:String(s.walletId),data:{enrollmentId:String(s.enrollmentId)},interaction:{kind:`qr_scan`,overlay:`hide`}}),await n.afterCall?.(!0,u),u}catch(e){o&&(await sB(r.transport,o),i?.(null));let t=iB(e);throw nB(n.onEvent,a,{phase:ls.FAILED,status:`failed`,message:t.message,interaction:{kind:`qr_scan`,overlay:`hide`},error:{code:t.code,message:t.message,retryable:t.code!==Y.SESSION_EXPIRED}}),tB(n.onError,t),await n.afterCall?.(!1,void 0,t),t}}async function sB(e,t){t&&await e.cancelClaimedSessionV1(t).catch(()=>void 0)}async function cB(e){if(e.targetFactor.kind===`passkey_prf`)return{kind:`passkey_prf`};let t=dB(e.targetEmail),n=await e.transport.resolveEmailOtpBaseFactorV1({linkSessionId:e.linkSessionId,request:{kind:`resolve`,expectedRevision:e.sessionRevision},authentication:e.authentication});switch(uB(n,e.sessionRevision),n.resolution.kind){case`selected`:return{kind:`email_otp`,targetEmail:t,enrollment:{kind:`existing_enrollment`},baseWalletAuthMethodId:n.resolution.choice.baseWalletAuthMethodId};case`selection_required`:return await lB(e,n.resolution.choices);case`unavailable`:return{kind:`email_otp`,targetEmail:t,enrollment:{kind:`new_enrollment`}}}}async function lB(e,t){if(!e.onEmailOtpBaseFactorRequired)throw Error(`Choose the Email OTP method to use for the linked device`);let n=await e.onEmailOtpBaseFactorRequired(t);if(!fB(t,n))throw Error(`The selected Email OTP method is unavailable for this linked device`);let r=await e.transport.resolveEmailOtpBaseFactorV1({linkSessionId:e.linkSessionId,request:{kind:`select`,expectedRevision:e.sessionRevision,baseWalletAuthMethodId:n},authentication:e.authentication});if(uB(r,e.sessionRevision),r.resolution.kind!==`selected`||r.resolution.choice.baseWalletAuthMethodId!==n)throw Error(`The selected Email OTP method is unavailable for this linked device`);return{kind:`email_otp`,targetEmail:dB(e.targetEmail),enrollment:{kind:`existing_enrollment`},baseWalletAuthMethodId:n}}function uB(e,t){if(e.revision!==t)throw e.resolution.kind===`unavailable`?Error(`linked-device Email OTP target-factor resolution failed: ${e.resolution.reason}`):Error(`linked-device Email OTP target-factor resolution changed the session`)}function dB(e){if(!e)throw Error(`Email OTP linked-device QR omitted its target email`);return e}function fB(e,t){for(let n of e)if(n.baseWalletAuthMethodId===t)return!0;return!1}function pB(e){switch(e.outcome){case`pending`:return;case`replayed`:if(e.replay.state===`pending`)return;throw Error(`linked-device approval replay returned an unsupported session state`);default:{let t=e;throw Error(`unsupported linked-device approval result: ${String(t)}`)}}}async function mB(e){let t=null,n=0;for(;Date.now()<e.expiresAtMs&&(t=await e.transport.getSourceContributionPreparationV1({linkSessionId:e.initialApproval.linkSessionId,authentication:e.authentication}),!t);)await SB(n),n+=1;if(!t)throw new J(`Device-link approval expired before target source preparation was published`,Y.SESSION_EXPIRED,`registration`);let r=await gB({preparation:t,ports:e.sourceContribution,ed25519ExportRootCapability:e.ed25519ExportRootCapability,authentication:e.authentication}),i=hB(e.initialApproval,r);vB(await e.transport.recordSourceContributionV1({approval:i,authentication:e.authentication}))}function hB(e,t){return e.targetFactor.kind,Ka({linkSessionId:e.linkSessionId,walletId:e.walletId,enrollmentId:e.enrollmentId,deviceId:e.deviceId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,targetFactor:e.targetFactor,permission:e.permission,ownerAuthorization:e.ownerAuthorization,approvedAtMs:e.approvedAtMs,expiresAtMs:e.expiresAtMs,sourceContribution:t})}async function gB(e){let t=e.preparation[0];if(!t)throw Error(`source contribution preparation is empty`);if(_B(t)){if(!e.ed25519ExportRootCapability)throw Error(`Ed25519 export-root capability is required for source contribution`);let n=await e.ports.ed25519.produceSourceContributionV1({preparation:t,capability:e.ed25519ExportRootCapability,authentication:e.authentication}),r=e.preparation[1];if(!r)return[n];if(_B(r))throw Error(`source contribution preparation repeats Ed25519`);return[n,await e.ports.ecdsa.produceSourceContributionV1({preparation:r})]}if(e.preparation.length!==1)throw Error(`ECDSA source contribution preparation is out of order`);return[await e.ports.ecdsa.produceSourceContributionV1({preparation:t})]}function _B(e){return`kind`in e}function vB(e){if(e.state.state!==`authority_pending_local_install`&&e.state.state!==`active`)throw Error(`source contribution acknowledgement did not commit the linked device`)}async function yB(e){if(e.exportRootRequirement===`not_required`)return;if(!e.ed25519ExportRootCapability)throw Error(`Ed25519 export-root capability is required for this authority`);let t=null,n=0;for(;Date.now()<e.expiresAtMs;){if(!t){let n=await e.transport.getEd25519ExportRootRecipientV1({linkSessionId:e.linkSessionId,authentication:e.authentication});if(n){if(String(n.linkSessionId)!==String(e.linkSessionId)||String(n.walletId)!==String(e.walletId)||String(n.enrollmentId)!==String(e.enrollmentId)||String(n.deviceId)!==String(e.deviceId))throw Error(`Ed25519 export-root recipient differs from the approved linked-device session`);t=await e.ed25519ExportRoot.sealForLinkedDeviceV1({recipient:n,capability:e.ed25519ExportRootCapability,sealedAtMs:Date.now()})}}if(t)try{await e.transport.submitEd25519ExportRootPackageV1({submission:{kind:`linked_device_ed25519_export_root_submission_v1`,linkSessionId:e.linkSessionId,package:t},authentication:e.authentication});return}catch(e){let t=bB(e);if(t!==null&&t!==408&&t!==429&&t<500)throw e}await SB(n),n+=1}throw new J(`Device-link approval expired before the export root recipient was published`,Y.SESSION_EXPIRED,`registration`)}function bB(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=Reflect.get(e,`status`);return typeof t==`number`&&Number.isSafeInteger(t)?t:null}function xB(e,t){setTimeout(e,Az(250,t))}async function SB(e){await new Promise(t=>xB(t,e))}async function CB(e){let t=await e.ed25519ExportRoot.createRecipientV1({identity:e.identity,registeredAtMs:e.registeredAtMs});try{await e.transport.registerEd25519ExportRootRecipientV1({recipient:t.registration})}catch(n){throw await TB(e.ed25519ExportRoot,t),n}return t}async function wB(e){let t=e.nowMs??Date.now,n=await EB({transport:e.transport,recipient:e.recipient.registration,expiresAtMs:e.expiresAtMs,assertCurrentRun:e.assertCurrentRun,waitForPollV1:e.waitForPollV1,now:t});return await e.ed25519ExportRoot.acceptTransferV1({recipient:e.recipient,transferPackage:n,replacementEnvelope:e.replacementEnvelope,replacementFactorSecret:e.replacementFactorSecret})}async function TB(e,t){try{await e.discardRecipientV1(t)}catch{}}async function EB(e){let t=g(e.recipient.linkSessionId);if(!t.ok)throw Error(t.error.message);let n=0;for(;e.now()<e.expiresAtMs;){e.assertCurrentRun();let r=await e.transport.getEd25519ExportRootPackageV1({linkSessionId:t.value});if(r){if(!DB(r,e.recipient))throw new J(`Device-link Ed25519 export-root package is addressed to another device`,Y.REGISTRATION_FAILED,`registration`);return r}await e.waitForPollV1(n),n+=1}throw new J(`Device-link session expired before the Ed25519 export root was sealed`,Y.SESSION_EXPIRED,`registration`)}function DB(e,t){return e.linkSessionId===t.linkSessionId&&e.walletId===t.walletId&&e.walletKeyId===t.walletKeyId&&e.enrollmentId===t.enrollmentId&&e.deviceId===t.deviceId&&e.applicationBindingDigestB64u===t.applicationBindingDigestB64u&&e.registeredPublicKeyB64u===t.registeredPublicKeyB64u&&e.targetFactor.kind===t.targetFactor.kind&&e.revocationEpoch===t.revocationEpoch&&e.recipientPublicKeyB64u===t.recipientPublicKeyB64u}function OB(e){if(e.binding.kind!==`ed25519_yao_client_root_v1`)throw Error(`Ed25519 export-root replacement binding has the wrong custody kind`);if(!Number.isSafeInteger(e.createdAtMs)||e.createdAtMs<0)throw Error(`Ed25519 export-root replacement timestamp is invalid`);return{envelopeId:e.envelopeId,walletId:e.walletId,ownership:e.ownership,binding:e.binding,factor:e.factor,createdAtMs:e.createdAtMs}}function kB(e){return{async createRecipientV1(t){let n=NB(await e.requestOperation({kind:`walletCustodyCeremony`,request:{type:`createLinkedDeviceEd25519ExportRootRecipient`,payload:{}}}),`Ed25519 export-root recipient`);return{recipientHandleId:PB(n.recipientHandleId),registration:Oo({kind:`linked_device_ed25519_export_root_recipient_v1`,linkSessionId:t.identity.linkSessionId,walletId:t.identity.walletId,walletKeyId:t.identity.walletKeyId,enrollmentId:t.identity.enrollmentId,deviceId:t.identity.deviceId,transferAlg:Ha,applicationBindingDigestB64u:t.identity.applicationBindingDigestB64u,registeredPublicKeyB64u:t.identity.registeredPublicKeyB64u,targetFactor:t.identity.targetFactor,revocationEpoch:t.identity.revocationEpoch,recipientPublicKeyB64u:bo(n.recipientPublicKeyB64u),registeredAtMs:t.registeredAtMs})}},async sealForLinkedDeviceV1(t){let n=t.recipient;if(t.capability.walletId!==String(n.walletId))throw Error(`Ed25519 export-root capability names another wallet`);let r=Ba({linkSessionId:n.linkSessionId,walletId:n.walletId,walletKeyId:n.walletKeyId,targetFactor:n.targetFactor,enrollmentId:n.enrollmentId,deviceId:n.deviceId,revocationEpoch:n.revocationEpoch,applicationBindingDigestB64u:n.applicationBindingDigestB64u,registeredPublicKeyB64u:n.registeredPublicKeyB64u,recipientPublicKeyB64u:n.recipientPublicKeyB64u}),i=NB(await e.requestOperation({kind:`walletCustodyCeremony`,request:{type:`sealEd25519ExportRootForLinkedDevice`,payload:{capability:t.capability,transferBindingJson:Aa(r)}}}),`Ed25519 export-root seal`);return{kind:`linked_device_ed25519_export_root_package_v1`,linkSessionId:n.linkSessionId,walletId:n.walletId,walletKeyId:n.walletKeyId,enrollmentId:n.enrollmentId,deviceId:n.deviceId,transferAlg:Ha,applicationBindingDigestB64u:n.applicationBindingDigestB64u,registeredPublicKeyB64u:n.registeredPublicKeyB64u,targetFactor:n.targetFactor,revocationEpoch:n.revocationEpoch,recipientPublicKeyB64u:n.recipientPublicKeyB64u,ephemeralPublicKeyB64u:bo(i.ephemeralPublicKeyB64u,`Ed25519 export-root ephemeralPublicKeyB64u`),nonceB64u:dn(i.nonceB64u,`Ed25519 export-root nonceB64u`),sealedExportRootB64u:gn(i.sealedExportRootB64u,`Ed25519 export-root sealedExportRootB64u`),bindingDigestB64u:bn(i.bindingDigestB64u,`Ed25519 export-root bindingDigestB64u`),ciphertextDigestB64u:bn(i.ciphertextDigestB64u,`Ed25519 export-root ciphertextDigestB64u`),sealedAtMs:t.sealedAtMs}},async acceptTransferV1(t){let n=t.recipient.registration,r=t.transferPackage;if(!AB(r,n))throw Error(`Ed25519 export-root package is addressed to another device`);let i=Ba({linkSessionId:n.linkSessionId,walletId:n.walletId,walletKeyId:n.walletKeyId,targetFactor:n.targetFactor,enrollmentId:n.enrollmentId,deviceId:n.deviceId,revocationEpoch:n.revocationEpoch,applicationBindingDigestB64u:n.applicationBindingDigestB64u,registeredPublicKeyB64u:n.registeredPublicKeyB64u,recipientPublicKeyB64u:n.recipientPublicKeyB64u}),a=t.replacementEnvelope;if(a.walletId!==n.walletId||a.binding.kind!==`ed25519_yao_client_root_v1`||a.binding.walletKeyId!==n.walletKeyId||a.binding.linkSessionId!==n.linkSessionId||a.binding.enrollmentId!==n.enrollmentId||a.binding.deviceId!==n.deviceId||a.binding.applicationBindingDigestB64u!==n.applicationBindingDigestB64u||a.binding.registeredPublicKeyB64u!==n.registeredPublicKeyB64u||a.binding.revocationEpoch!==n.revocationEpoch||!jB(n.targetFactor,a.factor))throw Error(`Ed25519 export-root replacement envelope identity is invalid`);let o=ii({walletId:a.walletId,envelopeId:a.envelopeId,factor:a.factor,envelopeRevision:In(1),binding:a.binding,ownership:a.ownership}),s=t.replacementFactorSecret.slice();try{let n=NB(await e.requestOperation({kind:`walletCustodyCeremony`,request:{type:`acceptLinkedDeviceEd25519ExportRoot`,payload:{recipientHandleId:t.recipient.recipientHandleId,transferBindingJson:Aa(i),ephemeralPublicKeyB64u:String(r.ephemeralPublicKeyB64u),nonceB64u:String(r.nonceB64u),sealedExportRootB64u:String(r.sealedExportRootB64u),bindingDigestB64u:String(r.bindingDigestB64u),ciphertextDigestB64u:String(r.ciphertextDigestB64u),replacementEnvelopeBindingJson:o,replacementFactorSecret:s.buffer},transfer:[s.buffer]}}),`Ed25519 export-root acceptance`);return{envelope:ti(si({envelopeId:a.envelopeId,walletId:a.walletId,ownership:a.ownership,binding:a.binding,factor:a.factor,envelopeRevision:In(1),nonceB64u:dn(n.nonceB64u,`Ed25519 export-root resealed nonceB64u`),sealedCustodySecretB64u:gn(n.sealedExportRootB64u,`Ed25519 export-root resealed ciphertext`),aadHashB64u:bn(n.aadHashB64u,`Ed25519 export-root resealed aadHashB64u`),ciphertextDigestB64u:bn(n.ciphertextDigestB64u,`Ed25519 export-root resealed ciphertextDigestB64u`),lifecycle:ri({activatedAtMs:a.createdAtMs}),createdAtMs:a.createdAtMs,updatedAtMs:a.createdAtMs}))}}finally{s.byteLength>0&&s.fill(0)}},async discardRecipientV1(t){await e.requestOperation({kind:`walletCustodyCeremony`,request:{type:`discardLinkedDeviceEd25519ExportRootRecipient`,payload:{recipientHandleId:t.recipientHandleId}}})}}}function AB(e,t){return e.linkSessionId===t.linkSessionId&&e.walletId===t.walletId&&e.walletKeyId===t.walletKeyId&&e.enrollmentId===t.enrollmentId&&e.deviceId===t.deviceId&&e.applicationBindingDigestB64u===t.applicationBindingDigestB64u&&e.registeredPublicKeyB64u===t.registeredPublicKeyB64u&&e.targetFactor.kind===t.targetFactor.kind&&e.revocationEpoch===t.revocationEpoch&&e.recipientPublicKeyB64u===t.recipientPublicKeyB64u}function jB(e,t){switch(e.kind){case`passkey_prf`:return t.kind===`passkey`;case`email_otp`:return t.kind===`email_otp`}return MB(e)}function MB(e){throw Error(`Unsupported linked-device target factor kind: ${String(e)}`)}function NB(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`${t} returned no result`);return e}function PB(e){if(typeof e!=`string`||!e||e.trim()!==e)throw Error(`Ed25519 export-root recipient handle is invalid`);return e}const FB=`linked_device_committed_resume_v1`,IB=`linked_device_pending_ack_v1`,LB=`device-linking/committed-resume/v1/`,RB=`device-linking/pending-ack/v1/`,zB=[`kind`,`acknowledgement`],BB=[`kind`,`linkSessionId`,`walletId`,`enrollmentId`,`authorityId`,`authMethodId`,`deviceId`,`targetFactorKind`,`targetFactorVerificationDigestB64u`,`authorityDigestB64u`,`signerActivationSetDigestB64u`,`signerActivations`,`packageSetDigestB64u`,`committedAtMs`];function VB(e){return`${LB}${String(e)}`}function HB(e){return`${RB}${String(e)}`}function UB(e){return{kind:IB,acknowledgement:na(e)}}function WB(e){let t=YB(e);if(t===null||!Dc(t,zB)||t.kind!==IB)return null;try{return{kind:IB,acknowledgement:na(t.acknowledgement)}}catch{return null}}function GB(e){let t=e.committed.authority;if(t.provenance.kind!==`device_link`)throw Error(`committed link authority provenance is invalid`);if(t.provenance.linkSessionId!==e.linkSessionId)throw Error(`committed link session identity differs from authority provenance`);if(e.committed.authMethod.walletAuthMethodId!==e.targetFactor.authMethod.walletAuthMethodId)throw Error(`committed link auth method differs from target factor`);if(!Number.isSafeInteger(e.committedAtMs)||e.committedAtMs<=0)throw Error(`committed link resume timestamp is invalid`);return{kind:FB,linkSessionId:e.linkSessionId,walletId:t.walletId,enrollmentId:t.provenance.enrollmentId,authorityId:t.authorityId,authMethodId:e.committed.authMethod.walletAuthMethodId,deviceId:t.principal.deviceId,targetFactorKind:e.targetFactor.kind,targetFactorVerificationDigestB64u:e.targetFactor.verificationDigestB64u,authorityDigestB64u:t.authorityDigestB64u,signerActivationSetDigestB64u:t.signerActivationSetDigestB64u,signerActivations:t.signerActivations,packageSetDigestB64u:e.committed.packageSetDigestB64u,committedAtMs:e.committedAtMs}}function KB(e){let t=GB({linkSessionId:e.linkSessionId,committed:e.committed,targetFactor:e.targetFactor,committedAtMs:e.resume.committedAtMs});return e.resume.authorityId===t.authorityId?e.resume.linkSessionId!==t.linkSessionId||e.resume.enrollmentId!==t.enrollmentId?{kind:`package_set_digest_mismatch`,expectedPackageSetDigestB64u:e.resume.packageSetDigestB64u,actualPackageSetDigestB64u:t.packageSetDigestB64u}:e.resume.walletId===t.walletId?e.resume.authMethodId===t.authMethodId?e.resume.deviceId===t.deviceId?e.resume.targetFactorKind!==t.targetFactorKind||e.resume.targetFactorVerificationDigestB64u!==t.targetFactorVerificationDigestB64u?{kind:`installation_receipt_mismatch`,field:`targetFactorVerificationDigestB64u`}:e.resume.signerActivationSetDigestB64u===t.signerActivationSetDigestB64u?e.resume.authorityDigestB64u!==t.authorityDigestB64u||e.resume.packageSetDigestB64u!==t.packageSetDigestB64u?{kind:`package_set_digest_mismatch`,expectedPackageSetDigestB64u:e.resume.packageSetDigestB64u,actualPackageSetDigestB64u:t.packageSetDigestB64u}:ZB(e.resume.signerActivations,t.signerActivations)?null:{kind:`installation_receipt_mismatch`,field:`installedActivationRefs`}:{kind:`installation_receipt_mismatch`,field:`installedActivationRefs`}:{kind:`installation_receipt_mismatch`,field:`deviceId`}:{kind:`installation_receipt_mismatch`,field:`authMethodId`}:{kind:`installation_receipt_mismatch`,field:`walletId`}:{kind:`authority_id_mismatch`,expectedAuthorityId:e.resume.authorityId,actualAuthorityId:t.authorityId}}function qB(e){let t=YB(e);if(t===null||!Dc(t,BB)||t.kind!==FB)return null;let n=g(t.linkSessionId),i=o(t.walletId),a=S(t.enrollmentId),s=r(t.authorityId),l=c(t.authMethodId),u=Sr(t.deviceId);if(!n.ok||!i.ok||!a.ok||!s.ok||!l.ok||!u.ok||t.targetFactorKind!==`verified_passkey_target_v1`&&t.targetFactorKind!==`verified_email_otp_target_v1`)return null;let d=Po(t.signerActivations);if(!d.ok)return null;let f=t.committedAtMs;if(typeof f!=`number`||!Number.isSafeInteger(f)||f<=0)return null;try{return{kind:FB,linkSessionId:n.value,walletId:i.value,enrollmentId:a.value,authorityId:s.value,authMethodId:l.value,deviceId:u.value,targetFactorKind:t.targetFactorKind,targetFactorVerificationDigestB64u:Lr(t.targetFactorVerificationDigestB64u),authorityDigestB64u:Lr(t.authorityDigestB64u),signerActivationSetDigestB64u:Lr(t.signerActivationSetDigestB64u),signerActivations:d.value,packageSetDigestB64u:Lr(t.packageSetDigestB64u),committedAtMs:f}}catch{return null}}async function JB(e){let[t,n]=await Promise.all([e.installation.listCommittedDeliveryResumesV1(),e.installation.listPendingActivationAcknowledgementsV1()]),r=t.filter(t=>t.authorityId===e.authorityId),i=n.filter(t=>t.authorityId===e.authorityId);if(i.length===0)return{kind:`none`};for(let t of i){let n=r.find(e=>e.linkSessionId===t.linkSessionId&&e.packageSetDigestB64u===t.packageSetDigestB64u);if(!n)throw Error(`durable linked-device acknowledgement has no matching resume`);if(n.walletId!==e.walletId||n.authMethodId!==e.authMethodId)throw Error(`durable linked-device acknowledgement identity changed`);await e.transport.acknowledgeLocalAuthorityActivationWithWalletSessionV1({acknowledgement:t,operationCredential:e.operationCredential}),await e.installation.clearPendingActivationAcknowledgementV1({authorityId:t.authorityId}),await e.installation.clearCommittedDeliveryResumeV1({authorityId:t.authorityId})}return{kind:`replayed`}}function YB(e){return XB(e)?e:null}function XB(e){if(typeof e!=`object`||!e||Array.isArray(e))return!1;try{let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}catch{return!1}}function ZB(e,t){let n=Ro(e),r=Ro(t);return n.length===r.length&&n.every((e,t)=>e===r[t])}function QB(e,t){let n=String(e.walletId);switch(e.kind){case`passkey`:{let t=String(e.credentialIdB64u);return{profile:{profileId:n,defaultSignerSlot:1,passkeyCredential:{id:t,rawId:t}},authenticator:{profileId:n,signerSlot:1,credentialId:t,credentialPublicKey:I(e.credentialPublicKeyB64u),registered:new Date(e.createdAtMs).toISOString(),syncedAt:new Date(e.updatedAtMs).toISOString()},localAuthMethod:null}}case`email_otp`:{if(t.kind!==`verified_email_otp_target_v1`||t.authMethod.walletAuthMethodId!==e.walletAuthMethodId||t.authMethod.walletId!==e.walletId||t.authMethod.emailHashHex!==e.emailHashHex||t.authMethod.registrationAuthorityId!==e.registrationAuthorityId)throw Error(`linked Email OTP target factor does not match the committed auth method`);let r=Kn({walletId:e.walletId,provider:t.enrollment.kind===`existing_enrollment`?`google`:`email`,providerUserId:t.providerUserId,emailHashHex:e.emailHashHex});return{profile:{profileId:n,defaultSignerSlot:1},authenticator:null,localAuthMethod:{version:`wallet_auth_method_v1`,kind:`email_otp`,status:`active`,localStatus:`synced`,walletId:e.walletId,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,authority:{walletId:r.walletId,factor:r.factor,verifier:r.verifier,bindingId:e.walletAuthMethodId},createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs}}}default:{let t=e;throw Error(`Unsupported linked-device auth method: ${String(t)}`)}}}function $B(e){return{...eV({indexedDB:e.indexedDB}),persistCommittedDeliveryResumeV1:async t=>{let n=GB(t);await e.indexedDB.setAppState(VB(n.authorityId),n)},readCommittedDeliveryResumeV1:async({authorityId:t})=>qB(await e.indexedDB.getAppState(VB(t))),persistPendingActivationAcknowledgementV1:async({acknowledgement:t})=>{let n=UB(t);await e.indexedDB.setAppState(HB(t.authorityId),n)},readPendingActivationAcknowledgementV1:async({authorityId:t})=>WB(await e.indexedDB.getAppState(HB(t)))?.acknowledgement??null,readLocalAuthorityInstallationReceiptV1:async({authorityId:t})=>await e.indexedDB.getLocalAuthorityInstallationReceipt(t),installLocalAuthorityV1:t=>tV({...t,...e}),publishLocalAuthorityActivationV1:({active:t,expectedLockGeneration:n})=>nV({indexedDB:e.indexedDB,active:t,expectedLockGeneration:n}),finalizeLocalAuthorityActivationV1:({active:t,operationCredential:n,expectedLockGeneration:r})=>rV({indexedDB:e.indexedDB,active:t,operationCredential:n,expectedLockGeneration:r})}}function eV(e){return{listCommittedDeliveryResumesV1:async()=>(await e.indexedDB.listAppStateEntriesByPrefix(LB)).flatMap(e=>{if(e.value===null)return[];let t=qB(e.value);if(!t||VB(t.authorityId)!==e.key)throw Error(`durable linked-device delivery resume is corrupt`);return[t]}),listPendingActivationAcknowledgementsV1:async()=>(await e.indexedDB.listAppStateEntriesByPrefix(RB)).flatMap(e=>{if(e.value===null)return[];let t=WB(e.value);if(!t||HB(t.acknowledgement.authorityId)!==e.key)throw Error(`durable linked-device acknowledgement is corrupt`);return[t.acknowledgement]}),clearCommittedDeliveryResumeV1:async({authorityId:t})=>{await e.indexedDB.setAppState(VB(t),null)},clearPendingActivationAcknowledgementV1:async({authorityId:t})=>{await e.indexedDB.setAppState(HB(t),null)}}}async function tV(e){let t=await e.indexedDB.getLocalAuthorityInstallationReceipt(e.committed.authority.authorityId);if(t)return uV({committed:e.committed,targetFactor:e.targetFactor,receipt:t}),t;let n=await e.sealing.sealCommittedAuthorityPackagesV1({committed:e.committed,targetFactor:e.targetFactor,keyMaterial:e.keyMaterial,resealedExportRoot:e.resealedExportRoot});lV({committed:e.committed,sealed:n});let r=QB(e.committed.authMethod,e.targetFactor),i=e.nowMs();if(!Number.isSafeInteger(i)||i<=0)throw Error(`local authority installation clock is invalid`);let a={kind:`local_authority_installation_receipt_v1`,authorityId:e.committed.authority.authorityId,walletId:e.committed.authority.walletId,authMethodId:e.committed.authMethod.walletAuthMethodId,deviceId:e.committed.authority.principal.deviceId,packageSetDigestB64u:e.committed.packageSetDigestB64u,installedActivationRefs:e.committed.authority.signerActivations,installedRecordSetDigestB64u:n.installedRecordSetDigestB64u,targetFactorVerificationDigestB64u:e.targetFactor.verificationDigestB64u,installedAtMs:i},o=await e.indexedDB.installLocalAuthority({authority:e.committed.authority,authMethod:e.committed.authMethod,profile:r.profile,authenticator:r.authenticator,localAuthMethod:r.localAuthMethod,signerMaterials:n.signerMaterials,exportRoot:n.exportRoot,receipt:a,expectedLockGeneration:e.expectedLockGeneration});switch(o.kind){case`installed`:case`idempotent_replay`:return o.receipt;case`stale_lock_generation`:throw Error(`local authority installation lock generation is stale (expected ${o.expectedLockGeneration}, actual ${o.actualLockGeneration})`);case`integrity_error`:throw Error(`local authority installation integrity error: ${o.reason}`)}}async function nV(e){let t=await e.indexedDB.publishLocalAuthorityActivation({authority:e.active.authority,authMethod:e.active.authMethod,expectedLockGeneration:e.expectedLockGeneration});switch(t.kind){case`published`:return;case`stale_lock_generation`:throw Error(`local authority activation lock generation is stale (expected ${t.expectedLockGeneration}, actual ${t.actualLockGeneration})`);case`wallet_locked`:throw Error(`local authority activation refused while wallet is locked at generation ${t.lockGeneration}`);default:throw Error(`local authority activation publication returned an unknown result`)}}async function rV(e){let t={authority:e.active.authority,authMethod:e.active.authMethod,walletSession:e.active.walletSession,operationCredential:e.operationCredential,expectedLockGeneration:e.expectedLockGeneration},n=await e.indexedDB.finalizeLocalAuthorityActivation(t);switch(n.kind){case`finalized`:return;case`stale_lock_generation`:throw Error(`local authority activation lock generation is stale (expected ${n.expectedLockGeneration}, actual ${n.actualLockGeneration})`);case`wallet_locked`:throw Error(`local authority activation refused while wallet is locked at generation ${n.lockGeneration}`);default:throw Error(`local authority activation returned an unknown result`)}}async function iV(e){let t=oV({committed:e.committed,sessionState:e.sessionState});if(t)return t;let n=await e.installation.readCommittedDeliveryResumeV1({authorityId:e.committed.authority.authorityId});if(n){let t=KB({resume:n,linkSessionId:e.linkSessionId,committed:e.committed,targetFactor:e.targetFactor});if(t)return{kind:`integrity_error`,reason:t}}else await e.installation.persistCommittedDeliveryResumeV1({linkSessionId:e.linkSessionId,committed:e.committed,targetFactor:e.targetFactor,committedAtMs:e.nowMs()});let r=await e.installation.installLocalAuthorityV1({committed:e.committed,targetFactor:e.targetFactor,keyMaterial:e.keyMaterial,resealedExportRoot:e.resealedExportRoot,expectedLockGeneration:e.expectedLockGeneration}),i=await e.transport.activateInstalledAuthorityV1({linkSessionId:e.linkSessionId,receipt:r});switch(i.kind){case`pending_local_install`:return{kind:`pending_local_install`,authorityId:i.authorityId,packageSetDigestB64u:r.packageSetDigestB64u};case`integrity_error`:return i;case`active`:{let t=sV({active:i,receipt:r});if(t)return t;await e.installation.publishLocalAuthorityActivationV1({active:i,expectedLockGeneration:e.expectedLockGeneration}),await xa(i.sealedDelivery),await cV({active:i,receipt:r,linkSessionId:e.linkSessionId,deliveryRecipientPublicKey65B64u:e.deliveryRecipientPublicKey65B64u}),await e.installation.persistPendingActivationAcknowledgementV1({acknowledgement:await aV({active:i,receipt:r,linkSessionId:e.linkSessionId,acknowledgedAtMs:e.nowMs()})});let n=await e.keyMaterialPort.openWalletSessionCredentialDeliveryV1({keyMaterial:e.keyMaterial,delivery:i.sealedDelivery,expected:{linkSessionId:e.linkSessionId,walletId:i.walletSession.walletId,authorityId:i.walletSession.authorityId,walletAuthMethodId:i.walletSession.authMethodId,authorizationId:i.walletSession.authorizationId,walletSessionId:i.sealedDelivery.aad.walletSessionId,quotaId:i.walletSession.quotaId,deliveryBinding:i.deliveryBinding,credentialDigestB64u:i.sealedDelivery.aad.credentialDigestB64u,installationReceiptDigestB64u:i.sealedDelivery.installationReceiptDigestB64u,recipientPublicKey65B64u:e.deliveryRecipientPublicKey65B64u,issuedAtMs:i.walletSession.issuedAtMs,expiresAtMs:i.walletSession.expiresAtMs}});return await e.installation.finalizeLocalAuthorityActivationV1({active:i,operationCredential:n,expectedLockGeneration:e.expectedLockGeneration}),{kind:`active`,session:i.walletSession,operationCredential:n}}}}async function aV(e){if(!Number.isSafeInteger(e.acknowledgedAtMs)||e.acknowledgedAtMs<=0)throw Error(`linked-device acknowledgement clock is invalid`);return{kind:`local_authority_activation_final_ack_v1`,linkSessionId:e.linkSessionId,authorityId:e.active.authority.authorityId,packageSetDigestB64u:e.receipt.packageSetDigestB64u,authorizationId:e.active.sealedDelivery.aad.authorizationId,walletSessionId:e.active.sealedDelivery.aad.walletSessionId,credentialDigestB64u:e.active.sealedDelivery.aad.credentialDigestB64u,installationReceiptDigestB64u:await Qi(e.receipt),acknowledgedAtMs:e.acknowledgedAtMs}}function oV(e){return e.sessionState.state===`provisioning`?null:e.committed.authority.authorityId===e.sessionState.authorityId?e.sessionState.state!==`active`&&e.committed.packageSetDigestB64u!==e.sessionState.packageSetDigestB64u?{kind:`integrity_error`,reason:{kind:`package_set_digest_mismatch`,expectedPackageSetDigestB64u:e.sessionState.packageSetDigestB64u,actualPackageSetDigestB64u:e.committed.packageSetDigestB64u}}:null:{kind:`integrity_error`,reason:{kind:`authority_id_mismatch`,expectedAuthorityId:e.sessionState.authorityId,actualAuthorityId:e.committed.authority.authorityId}}}function sV(e){return e.active.authority.authorityId===e.receipt.authorityId?e.active.authority.walletId!==e.receipt.walletId||e.active.walletSession.walletId!==e.receipt.walletId?{kind:`integrity_error`,reason:{kind:`installation_receipt_mismatch`,field:`walletId`}}:e.active.authMethod.walletAuthMethodId!==e.receipt.authMethodId||e.active.walletSession.authMethodId!==e.receipt.authMethodId?{kind:`integrity_error`,reason:{kind:`installation_receipt_mismatch`,field:`authMethodId`}}:null:{kind:`integrity_error`,reason:{kind:`authority_id_mismatch`,expectedAuthorityId:e.receipt.authorityId,actualAuthorityId:e.active.authority.authorityId}}}async function cV(e){let t=e.active.sealedDelivery.aad,n=e.active.deliveryBinding,r=e.active.sealedDelivery.installationReceiptDigestB64u,i=await Qi(e.receipt);if(n.namespace!==t.namespace||n.orgId!==t.orgId||n.projectId!==t.projectId||n.envId!==t.envId||n.tenantId!==t.tenantId||n.principalId!==t.principalId||t.linkSessionId!==e.linkSessionId||t.walletId!==e.receipt.walletId||t.authorityId!==e.receipt.authorityId||t.walletAuthMethodId!==e.receipt.authMethodId||t.authorizationId!==e.active.walletSession.authorizationId||t.quotaId!==e.active.walletSession.quotaId||String(t.principalId)!==`linked-device:${String(e.active.authority.principal.deviceId)}`||t.recipientPublicKey65B64u!==e.deliveryRecipientPublicKey65B64u||t.issuedAtMs!==e.active.walletSession.issuedAtMs||t.expiresAtMs!==e.active.walletSession.expiresAtMs||r!==i)throw Error(`linked-device Wallet Session credential delivery identity changed`)}function lV(e){let t=e.committed.authority,n=e.committed.authMethod,r=pV(t.signerActivations);if(e.sealed.signerMaterials.length!==r.length)throw Error(`sealed signer material count does not match committed authority`);for(let i=0;i<r.length;i+=1){let a=r[i],o=e.sealed.signerMaterials[i];if(!o||o.authorityId!==t.authorityId||o.walletAuthMethodId!==n.walletAuthMethodId||o.keyFamily!==a.keyFamily||o.activationId!==a.materialActivation.activationId||o.materialActivation.activationId!==a.materialActivation.activationId)throw Error(`sealed signer material identity does not match committed authority`)}if((fV(t.signerActivations)&&t.permissions.includes(`export_keys`))!==(e.sealed.exportRoot!==null))throw Error(`sealed Ed25519 export root presence does not match committed authority`);if(e.sealed.exportRoot&&(e.sealed.exportRoot.authorityId!==t.authorityId||e.sealed.exportRoot.walletAuthMethodId!==n.walletAuthMethodId))throw Error(`sealed export root identity does not match committed authority`);Lr(e.sealed.installedRecordSetDigestB64u)}function uV(e){if(e.receipt.authorityId!==e.committed.authority.authorityId||e.receipt.walletId!==e.committed.authority.walletId||e.receipt.authMethodId!==e.committed.authMethod.walletAuthMethodId||e.receipt.deviceId!==e.committed.authority.principal.deviceId||e.receipt.packageSetDigestB64u!==e.committed.packageSetDigestB64u||e.receipt.targetFactorVerificationDigestB64u!==e.targetFactor.verificationDigestB64u||!dV(e.receipt.installedActivationRefs,e.committed.authority.signerActivations))throw Error(`stored local authority receipt does not match committed packages`)}function dV(e,t){let n=Ro(e),r=Ro(t);if(n.byteLength!==r.byteLength)return!1;for(let e=0;e<n.byteLength;e+=1)if(n[e]!==r[e])return!1;return!0}function fV(e){return e.keyFamilies.length===2||e.keyFamilies[0]===`ed25519`}function pV(e){if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`){if(!e.ed25519)throw Error(`Ed25519 activation is missing`);return[{keyFamily:`ed25519`,materialActivation:e.ed25519.materialActivation}]}if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`){if(!e.ecdsa)throw Error(`ECDSA activation is missing`);return[{keyFamily:`ecdsa_secp256k1`,materialActivation:e.ecdsa.materialActivation}]}if(e.keyFamilies.length===2){if(!e.ed25519||!e.ecdsa)throw Error(`combined signer activations are incomplete`);return[{keyFamily:`ed25519`,materialActivation:e.ed25519.materialActivation},{keyFamily:`ecdsa_secp256k1`,materialActivation:e.ecdsa.materialActivation}]}throw Error(`committed signer activation families are invalid`)}function mV(e,t){switch(t.targetFactor.kind){case`verified_passkey_target_v1`:return{kind:`authenticated`,walletId:e.walletId,authMethod:B.passkey};case`verified_email_otp_target_v1`:return{kind:`authenticated`,walletId:e.walletId,authMethod:B.emailOtp};default:return t.targetFactor}}function hV(){let e=g(pe(`link-session`,32));if(!e.ok)throw Error(e.error.message);return e.value}function gV(){return pe(`link-flow`,16)}function _V(e,t){try{e?.(t)}catch{}}function vV(e){console.info(`[Device2Linking]`,{flowId:e.flowId,linkSessionId:e.linkSessionId,stage:e.stage,...e.details})}function yV(e){console.error(`[Device2Linking] failed`,{flowId:e.flowId,linkSessionId:e.linkSessionId,state:e.state,error:P(e.error)})}function bV(e,t){setTimeout(e,Az(250,t))}async function xV(e){await new Promise(t=>bV(t,e))}function SV(e){switch(e.state){case`displaying_qr`:case`expired`:case`cancelled`:return ls.STEP_01_QR_PREPARE_STARTED;case`claimed`:case`awaiting_target_factor`:case`awaiting_source_contribution`:case`provisioning`:case`authority_pending_local_install`:case`active`:return ls.STEP_02_QR_SCAN_STARTED;case`failed_before_commit`:return ls.FAILED;default:return To(e)}}function CV(e,t){return e instanceof J?e:new J(P(e)||`Device linking failed`,Y.REGISTRATION_FAILED,t)}function wV(e){let t=P(e).toLowerCase();return t.includes(`device-linking key handle is unknown or discarded`)||t.includes(`recipient handle lost`)?`recipient_private_handle_lost`:t.includes(`linked-device wallet session credential delivery is expired`)?`sealed_delivery_expired`:null}function TV(e){switch(e){case`recipient_private_handle_lost`:case`sealed_delivery_expired`:return`The linked device is ready. Return to sign in and unlock the new method to finish setup.`;default:return e}}var EV=class extends Error{constructor(){super(`Device-link flow was cancelled or reset`),this.name=`LinkDeviceFlowSupersededError`}};async function DV(t){let n;try{n=await import(`./browser-CsOGMbMy.js`).then(t=>e(t.default,1))}catch{throw new J(`Device-link QR generation requires the optional qrcode package`,Y.UNSUPPORTED,`generation`)}return await n.toDataURL(t,{errorCorrectionLevel:`M`,margin:2})}function OV(e){let t=On();return e.target.targetFactor.kind===`email_otp`?Xa({linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:t,targetFactor:{kind:`email_otp`},targetEmail:cp(e.target.targetEmail),issuedAtMs:e.issuedAtMs,expiresAtMs:e.expiresAtMs}):Xa({linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:t,targetFactor:{kind:`passkey_prf`},issuedAtMs:e.issuedAtMs,expiresAtMs:e.expiresAtMs})}function kV(e){return e.targetFactor.kind===`passkey_prf`}function AV(e){return e.targetFactor.kind===`email_otp`}function jV(e){return{event:e.event,state:e.state,runEpoch:e.runEpoch,deviceId:e.deviceId,preparation:e.preparation,ordinarySignerMaterialRecipientRequests:e.ordinarySignerMaterialRecipientRequests,exportRoot:e.exportRoot}}function MV(e){if(e.kind!==`completed`||!e.factorSecret||typeof e.providerUserId!=`string`)throw Error(`linked-device Email OTP factor runtime is unavailable`);return{kind:`completed`,runEpoch:e.runEpoch,enrollment:e.enrollment,factorSecret:e.factorSecret,providerUserId:e.providerUserId}}function NV(e){throw Error(`Unknown Email OTP target activation state: ${String(e)}`)}function PV(e){throw Error(`Unknown target credential activation state: ${String(e)}`)}function FV(e){switch(e.targetFactor.kind){case`verified_passkey_target_v1`:{let t=e.targetCredentialActivationState;if(t.kind!==`factor_ready`||t.runEpoch!==e.runEpoch)throw Error(`linked-device Passkey factor runtime is unavailable`);return{factor:{kind:`passkey`,walletId:e.walletId},factorSecret32:t.factorSecret}}case`verified_email_otp_target_v1`:{let t=MV(e.emailOtpTargetActivationState);if(t.runEpoch!==e.runEpoch)throw Error(`linked-device Email OTP factor runtime is unavailable`);return{factor:{kind:`email_otp`,walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId,emailHashHex:e.targetFactor.authMethod.emailHashHex,providerIdentity:{provider:RV(t.enrollment),providerSubjectId:t.providerUserId}},factorSecret32:t.factorSecret}}default:return IV(e.targetFactor)}}function IV(e){throw Error(`Unknown verified target factor kind: ${String(e)}`)}function LV(e){e.byteLength>0&&e.fill(0)}function RV(e){return e.kind===`existing_enrollment`?`google`:`email`}function zV(e){return e.passkeyCreationOptions.rpId}function BV(e){if(!AV(e))throw Error(`linked-device Email OTP preparation is unavailable`);return e}function VV(){let e=C(pe(`linked-device-ed25519-export-root-envelope`,24,`export-root envelope ids`));if(!e.ok)throw Error(e.error.message);return e.value}function HV(){return crypto.getRandomValues(new Uint8Array(32))}async function UV(e){let t=e.factorSecret.slice();try{let n=await e.context.signingEngine.prepareEmailOtpRegistrationEnrollmentMaterialInternal({relayUrl:String(e.context.configs.network.relayer.url||``).trim(),walletId:e.walletId,userId:e.targetEmail,clientSecret32:t});if(n.emailOtpSessionHandle.kind!==`not_requested`)throw Error(`Strict linked-device Email OTP enrollment received obsolete ECDSA material`);return{enrollmentId:n.enrollmentId,enrollment:n.emailOtpEnrollment}}finally{LV(t)}}function WV(e){if(!e)throw Error(`new linked-device Email OTP enrollment material is unavailable`);return e}var GV=class{constructor(e,t,n=null){this.pendingActivationCompletion=null,this.session=null,this.keyMaterialHandle=null,this.deliveryRecipientPublicKey65B64u=null,this.resealedExportRoot=null,this.targetCredentialRegistrationResult=null,this.committedAuthorityPackages=null,this.deliveryRecoveryReason=null,this.ordinarySignerMaterialRecipientPreparation=null,this.authenticatedTransport=null,this.subscription=null,this.cancelled=!1,this.runEpoch=0,this.generationInProgress=!1,this.discardInProgress=null,this.targetCredentialActivationState={kind:`idle`},this.emailOtpTargetActivationState={kind:`idle`},this.handledStates=new Set,this.sessionEventQueue=Promise.resolve(),this.options=e,this.flowId=gV(),this.ports=t,this.getAuthenticationContext=n}async generateQR(){if(this.generationInProgress||this.keyMaterialHandle||this.subscription||this.session&&!this.cancelled)throw Error(`Device-link QR flow is already running`);let e=this.startRun(),t=this.ports;this.emit({phase:ls.STEP_01_QR_PREPARE_STARTED,status:`started`,message:`Preparing device link`,data:{role:`display`},interaction:{kind:`qr_display`,overlay:`show`}});try{let n=await t.keyMaterial.createBootstrapKeyMaterialV1();if(!this.isCurrentRun(e))throw this.keyMaterialHandle=n.handle,await this.discardKeyMaterial(),new EV;this.keyMaterialHandle=n.handle,this.deliveryRecipientPublicKey65B64u=n.deliveryRecipientPublicKey65B64u;let r=Date.now(),i=hV(),a=OV({linkSessionId:i,linkPublicKeyB64u:n.linkPublicKeyB64u,devicePublicKeyB64u:n.devicePublicKeyB64u,target:this.options,issuedAtMs:r,expiresAtMs:r+900*1e3}),o={state:`displaying_qr`},s=t.transport.createAuthenticatedSessionTransportV1({keyMaterial:n.handle,devicePublicKeyB64u:n.devicePublicKeyB64u});this.authenticatedTransport=s,this.session={linkSessionId:i,state:o,qrData:a},vV({flowId:this.flowId,linkSessionId:i,stage:`session_create_started`}),await s.createUnclaimedSessionV1({payload:a,state:o}),this.assertCurrentRun(e);let c=await s.subscribeSessionV1({linkSessionId:i,onEvent:this.handleSessionTransportEvent.bind(this)});if(!this.isCurrentRun(e))throw await c.close(),new EV;this.subscription=c,vV({flowId:this.flowId,linkSessionId:i,stage:`session_subscription_ready`});let l=await DV(Wi(a));this.assertCurrentRun(e);let u={qrData:a,qrCodeDataURL:l};return this.emit({phase:ls.STEP_01_QR_PREPARE_STARTED,status:`succeeded`,message:`Device-link QR ready`,data:{role:`display`},interaction:{kind:`qr_display`,overlay:`show`}}),await this.options.options?.afterCall?.(!0,u),u}catch(e){try{await this.cleanupLocalResources()}catch{}if(e instanceof EV)throw e;this.session=null,this.authenticatedTransport=null,this.handledStates.clear();let t=CV(e,`generation`);throw this.error=t,this.emitFailure(t,`generation`),_V(this.options.options?.onError,t),await this.options.options?.afterCall?.(!1,void 0,t),t}finally{this.generationInProgress=!1}}getState(){return{phase:this.session?SV(this.session.state):ls.STEP_01_QR_PREPARE_STARTED,session:this.session,...this.error?{error:this.error}:{},cancelled:this.cancelled}}async cancel(){if(this.hasCommittedDeliveryState())throw Error(`Device-link authority delivery is committed and must be resumed`);if(this.cancelled){await this.cleanupLocalResources();return}this.cancelled=!0,this.runEpoch+=1;let e=this.session,t=this.keyMaterialHandle,n=this.authenticatedTransport;try{if(e&&t&&n){let t=Date.now();switch(e.state.state){case`displaying_qr`:await n.cancelSessionV1({request:no({linkSessionId:e.linkSessionId,requestedAtMs:t})}),this.session={...e,state:{state:`cancelled`,cancelledAtMs:t}};break;case`claimed`:case`awaiting_target_factor`:case`awaiting_source_contribution`:case`provisioning`:await this.cancelClaimedSessionV1(n,e.linkSessionId,t),this.session={...e,state:{state:`cancelled`,cancelledAtMs:t}};break;case`authority_pending_local_install`:break;case`active`:case`expired`:case`cancelled`:case`failed_before_commit`:break;default:To(e.state)}}}finally{await this.cleanupLocalResources()}this.emit({phase:ls.CANCELLED,status:`cancelled`,message:`Device-link flow cancelled`,interaction:{kind:`qr_display`,overlay:`hide`}})}async resolveLinkIdentityV1(e){let t=this.targetCredentialRegistrationResult;if(t&&t.linkSessionId===e)return{enrollmentId:t.enrollmentId,deviceId:t.deviceId};let n=await this.requireAuthenticatedTransport().getTargetPreparationV1({linkSessionId:e,deliveryRecipientPublicKey65B64u:this.requireDeliveryRecipientPublicKey65B64u()});return{enrollmentId:n.enrollmentId,deviceId:n.deviceId}}async cancelClaimedSessionV1(e,t,n){let r=await this.resolveLinkIdentityV1(t);await e.cancelSessionV1({request:ka({linkSessionId:t,enrollmentId:r.enrollmentId,deviceId:r.deviceId,reason:`user_cancelled`,requestedAtMs:n})})}async handleSessionEvent(e){if(this.cancelled||this.deliveryRecoveryReason!==null||!this.session||e.linkSessionId!==this.session.linkSessionId)return;vV({flowId:this.flowId,linkSessionId:e.linkSessionId,stage:`session_event_received`,details:{state:e.state.state,emittedAtMs:e.emittedAtMs,runEpoch:this.runEpoch}});let t=this.runEpoch;if(this.handledStates.has(e.state.state)){vV({flowId:this.flowId,linkSessionId:e.linkSessionId,stage:`session_event_already_handled`,details:{state:e.state.state}});return}switch(this.session={...this.session,state:e.state},this.handledStates.add(e.state.state),e.state.state){case`displaying_qr`:return;case`claimed`:this.emit({phase:ls.STEP_02_QR_SCAN_STARTED,status:`running`,message:`Device link claimed by owner`,data:{role:`display`},interaction:{kind:`qr_display`,overlay:`show`}});return;case`awaiting_target_factor`:await this.prepareTargetCredentialActivation(e,t);return;case`awaiting_source_contribution`:return;case`provisioning`:case`authority_pending_local_install`:{let n=await this.activateAuthorityForStateV1(e.state,t);if(n.kind===`pending_local_install`)return;if(n.kind===`integrity_error`)throw new J(`Linked-device authority installation failed: ${n.reason}`,Y.REGISTRATION_FAILED,`registration`);if(n.kind===`failed_before_commit`||n.kind===`relink_required`)throw new J(`Linked-device authority activation cannot continue`,Y.REGISTRATION_FAILED,`registration`);await this.finishActiveAuthorityV1(e.state,n.session,n.operationCredential,t);return}case`active`:await this.replayCommittedAuthorityV1(e.state,t);return;case`expired`:{let e=new J(`Device-link session expired`,Y.SESSION_EXPIRED,`registration`);this.error=e,this.emitFailure(e,`registration`),_V(this.options.options?.onError,e),this.runEpoch+=1,await this.cleanupLocalResources();return}case`cancelled`:this.cancelled=!0,this.emit({phase:ls.CANCELLED,status:`cancelled`,message:`The other device cancelled this linking request.`,interaction:{kind:`qr_display`,overlay:`show`}}),this.runEpoch+=1,await this.cleanupLocalResources();return;case`failed_before_commit`:this.cancelled=!0,this.runEpoch+=1,await this.cleanupLocalResources();return;default:return To(e.state)}}async prepareTargetCredentialActivation(e,t){if(e.state.state!==`awaiting_target_factor`)throw Error(`target passkey activation requires an awaiting session`);let n=e.state;if(!this.keyMaterialHandle||!this.session)throw Error(`device-link key material is unavailable`);let r=this.requireAuthenticatedTransport();this.assertCurrentRun(t);let i=await r.getTargetPreparationV1({linkSessionId:e.linkSessionId,deliveryRecipientPublicKey65B64u:this.requireDeliveryRecipientPublicKey65B64u()});this.assertCurrentRun(t),this.assertTargetPreparationMatchesSession({preparation:i,state:n,linkSessionId:e.linkSessionId});let a=i.deviceId;if(this.ordinarySignerMaterialRecipientPreparation=await this.ports.keyMaterial.createOrdinarySignerMaterialRecipientRequestsV1({keyMaterial:this.keyMaterialHandle,requirements:i.ordinarySignerMaterialRecipientRequirements}),this.assertCurrentRun(t),this.requireSessionTargetFactorV1().kind===`email_otp`){await this.prepareTargetEmailOtpActivation({event:e,state:n,runEpoch:t,deviceId:a,preparation:i});return}if(!kV(i))throw Error(`Passkey session returned a non-Passkey target preparation`);let o=this.options.options?.onTargetFactorRequired;if(!o)throw new J(`Confirm passkey creation on Device 2 to continue linking`,Y.UNSUPPORTED,`registration`);o({kind:`linked_device_target_passkey_activation_v1`,createPasskey:this.activateTargetCredential.bind(this,{event:e,state:n,runEpoch:t,deviceId:a,preparation:i})})}async prepareTargetEmailOtpActivation(e){if(!AV(e.preparation))throw Error(`Email OTP session returned a non-Email OTP target preparation`);if(!this.keyMaterialHandle||!this.session||!this.deliveryRecipientPublicKey65B64u)throw Error(`Email OTP target key material is unavailable`);if(!this.options.options?.onTargetFactorRequired)throw new J(`Enter the Email OTP on Device 2 to continue linking`,Y.UNSUPPORTED,`registration`);let t=this.requireAuthenticatedTransport(),n=e.preparation.ed25519ExportRoot,r=n===null?{kind:`not_required`}:{kind:`required`,recipient:await CB({ed25519ExportRoot:this.ports.ed25519ExportRoot,transport:t,identity:{linkSessionId:e.event.linkSessionId,walletId:e.preparation.walletId,walletKeyId:n.walletKeyId,enrollmentId:e.preparation.enrollmentId,deviceId:e.deviceId,applicationBindingDigestB64u:n.applicationBindingDigestB64u,registeredPublicKeyB64u:n.registeredPublicKeyB64u,targetFactor:e.preparation.targetFactor,revocationEpoch:n.revocationEpoch},registeredAtMs:Date.now()})};this.assertCurrentRun(e.runEpoch);let i={event:e.event,state:e.state,runEpoch:e.runEpoch,deviceId:e.deviceId,preparation:e.preparation,ordinarySignerMaterialRecipientRequests:this.requireOrdinarySignerMaterialRecipientPreparationV1().recipientRequests,exportRoot:r};this.emailOtpTargetActivationState={kind:`available`,context:i},await this.startTargetEmailOtpChallengeV1(i)}notifyEmailOtpActivationV1(e){let t=this.options.options?.onTargetFactorRequired;t&&t({kind:`linked_device_target_email_otp_activation_v1`,state:e,sendCode:this.sendTargetEmailOtpCodeV1.bind(this),submitCode:this.submitTargetEmailOtpCodeV1.bind(this),resendCode:this.resendTargetEmailOtpCodeV1.bind(this)})}sendTargetEmailOtpCodeV1(){let e=this.emailOtpTargetActivationState;switch(e.kind){case`available`:{let t=this.startTargetEmailOtpChallengeV1(e.context);return this.emailOtpTargetActivationState={kind:`starting`,context:e.context,promise:t},t}case`starting`:return e.promise;case`resending`:return e.promise;case`awaiting_code`:case`submitting`:case`completed`:return Promise.resolve();case`failed`:return Promise.reject(Error(e.message));case`idle`:return Promise.reject(Error(`Email OTP activation is unavailable`));default:return NV(e)}}async startTargetEmailOtpChallengeV1(e){try{this.assertCurrentRun(e.runEpoch);let t=this.deliveryRecipientPublicKey65B64u;if(!t)throw Error(`Email OTP factor-release recipient is unavailable`);let n=await this.requireAuthenticatedTransport().startTargetEmailOtpChallengeV1({request:{kind:`linked_device_email_otp_challenge_start_request_v1`,linkSessionId:e.event.linkSessionId,workerEphemeralPublicKey65B64u:t}});this.assertCurrentRun(e.runEpoch),this.awaitTargetEmailOtpCodeV1(e,n)}catch(t){throw this.isCurrentRun(e.runEpoch)&&(this.emailOtpTargetActivationState={kind:`available`,context:e},this.notifyEmailOtpActivationV1({kind:`unavailable`,message:P(t)})),t}}awaitTargetEmailOtpCodeV1(e,t){this.emailOtpTargetActivationState={kind:`awaiting_code`,context:{...jV(e),challenge:t}},this.notifyEmailOtpActivationV1({kind:`code_input`,maskedEmailHint:t.maskedEmailHint,expiresAtMs:t.expiresAtMs,resendAvailableAtMs:t.resendAvailableAtMs})}resendTargetEmailOtpCodeV1(){let e=this.emailOtpTargetActivationState;if(e.kind===`resending`)return e.promise;if(e.kind!==`awaiting_code`)return Promise.reject(Error(`Email OTP challenge is not ready to resend`));try{this.assertCurrentRun(e.context.runEpoch)}catch(e){return Promise.reject(e)}let t=this.runTargetEmailOtpResendV1(e.context);return this.emailOtpTargetActivationState={kind:`resending`,context:e.context,promise:t},this.notifyEmailOtpActivationV1({kind:`resending`,maskedEmailHint:e.context.challenge.maskedEmailHint}),t}async runTargetEmailOtpResendV1(e){try{let t=await this.requireAuthenticatedTransport().resendTargetEmailOtpChallengeV1({request:{kind:`linked_device_email_otp_challenge_resend_request_v1`,linkSessionId:e.event.linkSessionId,challengeId:e.challenge.challengeId}});this.assertCurrentRun(e.runEpoch),this.awaitTargetEmailOtpCodeV1(e,t)}catch(t){if(this.isCurrentRun(e.runEpoch)){let n=P(t)||`Email OTP resend is unavailable`;this.emailOtpTargetActivationState={kind:`available`,context:jV(e)},this.notifyEmailOtpActivationV1({kind:`unavailable`,message:n})}throw t}}submitTargetEmailOtpCodeV1(e){let t=this.emailOtpTargetActivationState;if(t.kind!==`awaiting_code`)return Promise.reject(Error(`Email OTP challenge is not ready for verification`));this.assertCurrentRun(t.context.runEpoch);let n=this.completeTargetEmailOtpActivationV1(t.context,e);return this.emailOtpTargetActivationState={kind:`submitting`,context:t.context,promise:n},this.notifyEmailOtpActivationV1({kind:`submitting`,maskedEmailHint:t.context.challenge.maskedEmailHint,expiresAtMs:t.context.challenge.expiresAtMs,resendAvailableAtMs:t.context.challenge.resendAvailableAtMs}),n}async completeTargetEmailOtpActivationV1(e,t){let n;try{n=await this.requireAuthenticatedTransport().verifyTargetEmailOtpChallengeV1({request:{kind:`linked_device_email_otp_challenge_verify_request_v1`,linkSessionId:e.event.linkSessionId,challengeId:e.challenge.challengeId,otpCode:t}})}catch(t){throw this.isCurrentRun(e.runEpoch)&&(this.emailOtpTargetActivationState={kind:`awaiting_code`,context:e},Date.now()>=e.challenge.expiresAtMs?this.notifyEmailOtpActivationV1({kind:`expired`,maskedEmailHint:e.challenge.maskedEmailHint,message:P(t)}):this.notifyEmailOtpActivationV1({kind:`incorrect`,maskedEmailHint:e.challenge.maskedEmailHint,expiresAtMs:e.challenge.expiresAtMs,resendAvailableAtMs:e.challenge.resendAvailableAtMs,message:P(t)})),t}this.assertCurrentRun(e.runEpoch);let r=BV(e.preparation),i=e.exportRoot.kind===`required`?e.exportRoot.recipient:null,a=null,o=null,s=null,c=null,l=null,u=null,d=r.enrollment.kind===`existing_enrollment`;try{let t=await ya(r);if(n.verificationGrant.targetEmail!==r.targetEmail)throw Error(`linked-device Email OTP verification target email changed`);if(d){let i=n.verificationGrant;if(i.enrollment.kind!==`existing_enrollment`)throw Error(`linked-device Email OTP verification enrollment changed`);let o=i.baseWalletAuthMethodId;if(!o)throw Error(`linked-device Email OTP base auth method is unavailable`);let u=n.factorRelease;if(!u)throw Error(`linked-device Email OTP factor release is unavailable`);let d=await this.ports.keyMaterial.openEmailOtpFactorReleaseV1({keyMaterial:this.requireKeyMaterialHandleV1(),walletId:r.walletId,linkSessionId:r.linkSessionId,enrollmentId:r.enrollmentId,deviceId:r.deviceId,walletAuthMethodId:r.walletAuthMethodId,baseWalletAuthMethodId:o,targetPreparationDigestB64u:t,expectedChallengeId:e.challenge.challengeId,verificationGrant:i,factorRelease:u});a=d.factorSecret,s=d.verificationGrant,c=u.enrollmentId,l=u.enrollmentSealKeyVersion}else{let e=n.verificationGrant;if(e.enrollment.kind!==`new_enrollment`)throw Error(`linked-device Email OTP verification enrollment changed`);if(n.factorRelease!==null)throw Error(`new linked-device Email OTP enrollment returned a factor release`);let t=this.getAuthenticationContext?.();if(!t)throw Error(`linked-device authentication context is unavailable`);let i=HV();a=i.buffer;let o=await UV({context:t,walletId:r.walletId,targetEmail:r.targetEmail,factorSecret:i});c=o.enrollmentId,l=o.enrollment.enrollmentSealKeyVersion,u=o.enrollment,s=e}if(!a||!s||!c||!l)throw Error(`linked-device Email OTP factor material is unavailable`);if(this.assertCurrentRun(e.runEpoch),e.exportRoot.kind===`required`){if(!i)throw Error(`linked-device Ed25519 export-root recipient is unavailable`);let t=r.ed25519ExportRoot;if(!t)throw Error(`linked-device Ed25519 export-root preparation is unavailable`);let n=VV(),o=$r({enrollmentId:c,enrollmentSealKeyVersion:l});this.resealedExportRoot=await this.acceptTargetExportRootV1({preparation:r,exportRoot:t,recipient:i,envelopeId:n,factor:o,replacementFactorSecret:new Uint8Array(a),runEpoch:e.runEpoch}),i=null}let f=Pa(d?{linkSessionId:r.linkSessionId,walletId:r.walletId,enrollmentId:r.enrollmentId,deviceId:r.deviceId,walletAuthMethodId:r.walletAuthMethodId,targetFactor:{kind:`email_otp`},targetEmail:r.targetEmail,emailOtpVerificationGrant:s,targetPreparationDigestB64u:t,ordinarySignerMaterialRecipientRequests:e.ordinarySignerMaterialRecipientRequests,registeredAtMs:Date.now()}:{linkSessionId:r.linkSessionId,walletId:r.walletId,enrollmentId:r.enrollmentId,deviceId:r.deviceId,walletAuthMethodId:r.walletAuthMethodId,targetFactor:{kind:`email_otp`},targetEmail:r.targetEmail,emailOtpVerificationGrant:s,emailOtpEnrollment:WV(u),targetPreparationDigestB64u:t,ordinarySignerMaterialRecipientRequests:e.ordinarySignerMaterialRecipientRequests,registeredAtMs:Date.now()}),p=await this.requireAuthenticatedTransport().registerTargetCredentialV1({registration:f});if(this.assertCurrentRun(e.runEpoch),this.targetCredentialRegistrationResult=p,o=new Uint8Array(a).slice(),await this.ports.keyMaterial.prepareOrdinarySignerMaterialV1({keyMaterial:this.requireKeyMaterialHandleV1(),targetFactor:p.targetFactor,preparations:p.ordinarySignerMaterialPreparations,recipientRequests:p.ordinarySignerMaterialRecipientRequests,recipientInputs:this.requireOrdinarySignerMaterialRecipientPreparationV1().recipientInputs,factorSecret:a}),a=null,this.assertCurrentRun(e.runEpoch),vV({flowId:this.flowId,linkSessionId:e.preparation.linkSessionId,stage:`ordinary_signer_material_prepared`}),!o)throw Error(`linked-device Email OTP factor runtime is unavailable`);this.emailOtpTargetActivationState={kind:`completed`,runEpoch:e.runEpoch,enrollment:d?{kind:`existing_enrollment`}:{kind:`new_enrollment`},factorSecret:o,providerUserId:s.providerUserId},o=null,this.notifyEmailOtpActivationV1({kind:`completed`,maskedEmailHint:e.challenge.maskedEmailHint})}catch(t){if(a&&a.byteLength>0&&new Uint8Array(a).fill(0),o?.fill(0),i&&await TB(this.ports.ed25519ExportRoot,i),this.isCurrentRun(e.runEpoch)){let n=P(t)||`Email OTP activation is unavailable`;this.emailOtpTargetActivationState={kind:`failed`,runEpoch:e.runEpoch,message:n},this.notifyEmailOtpActivationV1({kind:`unavailable`,message:n}),await this.cancelFailedPrecommitSession(e.event).catch(()=>void 0)}throw t}}activateTargetCredential(e){if(!this.isCurrentRun(e.runEpoch))return Promise.reject(new EV);switch(this.targetCredentialActivationState.kind){case`idle`:break;case`in_progress`:return this.targetCredentialActivationState.runEpoch===e.runEpoch?this.targetCredentialActivationState.promise:Promise.reject(new EV);case`factor_ready`:return this.targetCredentialActivationState.runEpoch===e.runEpoch?Promise.reject(Error(`Device-link target passkey activation has already completed`)):Promise.reject(new EV);default:return PV(this.targetCredentialActivationState)}let t=this.runTargetCredentialActivation(e);return this.targetCredentialActivationState={kind:`in_progress`,runEpoch:e.runEpoch,promise:t},t}async runTargetCredentialActivation(e){try{let t=await this.createTargetCredential(e),n=this.targetCredentialActivationState;if(!this.isCurrentRun(e.runEpoch)||n.kind!==`in_progress`||n.runEpoch!==e.runEpoch)throw LV(t),new EV;this.targetCredentialActivationState={kind:`factor_ready`,runEpoch:e.runEpoch,factorSecret:t}}catch(t){throw this.isCurrentRun(e.runEpoch)&&await this.handleSessionTransportFailure(e.event,t),t}finally{let t=this.targetCredentialActivationState;t.kind===`in_progress`&&t.runEpoch===e.runEpoch&&(this.targetCredentialActivationState={kind:`idle`})}}async waitForTargetCredentialActivation(){switch(this.requireSessionTargetFactorV1().kind){case`passkey_prf`:{let e=this.targetCredentialActivationState;if(e.kind===`in_progress`&&await e.promise,this.targetCredentialActivationState.kind!==`factor_ready`)throw Error(`linked-device target Passkey activation is incomplete`);return}case`email_otp`:{let e=this.emailOtpTargetActivationState;if(e.kind===`submitting`&&await e.promise,this.emailOtpTargetActivationState.kind!==`completed`)throw Error(`linked-device target Email OTP activation is incomplete`);return}default:throw Error(`linked-device target factor is unsupported`)}}clearTargetCredentialActivationState(){let e=this.targetCredentialActivationState;e.kind===`factor_ready`&&LV(e.factorSecret),this.targetCredentialActivationState={kind:`idle`}}async createTargetCredential(e){let{runEpoch:t,deviceId:n,preparation:r}=e;if(!this.keyMaterialHandle||!this.session)throw Error(`device-link key material is unavailable`);let i=this.requireAuthenticatedTransport();vV({flowId:this.flowId,linkSessionId:r.linkSessionId,stage:`target_passkey_prompt_started`});let a=r.ed25519ExportRoot,o=a===null?Promise.resolve(null):CB({ed25519ExportRoot:this.ports.ed25519ExportRoot,transport:i,identity:{linkSessionId:r.linkSessionId,walletId:r.walletId,walletKeyId:a.walletKeyId,enrollmentId:r.enrollmentId,deviceId:n,applicationBindingDigestB64u:a.applicationBindingDigestB64u,registeredPublicKeyB64u:a.registeredPublicKeyB64u,targetFactor:r.targetFactor,revocationEpoch:a.revocationEpoch},registeredAtMs:Date.now()});o.catch(()=>void 0);let s=null,c=null;try{if(s=await this.ports.targetCredential.createTargetCredentialV1({preparation:r,keyMaterial:this.keyMaterialHandle}),s.walletAuthMethodId!==r.walletAuthMethodId)throw Error(`linked-device target credential returned a different auth method`);if(vV({flowId:this.flowId,linkSessionId:r.linkSessionId,stage:`target_passkey_created`}),this.emit({phase:ls.STEP_02_QR_SCAN_STARTED,status:`running`,message:`Finishing linked-device setup`,data:{role:`display`},interaction:{kind:`qr_display`,overlay:`show`}}),c=await o,c&&vV({flowId:this.flowId,linkSessionId:r.linkSessionId,stage:`export_root_recipient_published`}),this.assertCurrentRun(t),a!==null){if(!c)throw Error(`linked-device Ed25519 export-root recipient is unavailable`);let e=VV(),n=ei({rpId:zV(r),credentialIdB64u:s.webauthnRegistration.credentialIdB64u}),i=await this.acceptTargetExportRootV1({preparation:r,exportRoot:a,recipient:c,envelopeId:e,factor:n,replacementFactorSecret:s.factorSecret,runEpoch:t});vV({flowId:this.flowId,linkSessionId:r.linkSessionId,stage:`export_root_accepted`}),this.resealedExportRoot=i,c=null}this.assertCurrentRun(t);let e=await ya(r),n=Pa({linkSessionId:r.linkSessionId,walletId:r.walletId,enrollmentId:r.enrollmentId,deviceId:r.deviceId,walletAuthMethodId:s.walletAuthMethodId,targetFactor:{kind:`passkey_prf`},targetPreparationDigestB64u:e,webauthnRegistration:s.webauthnRegistration,ordinarySignerMaterialRecipientRequests:this.requireOrdinarySignerMaterialRecipientPreparationV1().recipientRequests,registeredAtMs:Date.now()}),l=await i.registerTargetCredentialV1({registration:n});return this.assertCurrentRun(t),this.targetCredentialRegistrationResult=l,await this.ports.keyMaterial.prepareOrdinarySignerMaterialV1({keyMaterial:this.requireKeyMaterialHandleV1(),targetFactor:l.targetFactor,preparations:l.ordinarySignerMaterialPreparations,recipientRequests:l.ordinarySignerMaterialRecipientRequests,recipientInputs:this.requireOrdinarySignerMaterialRecipientPreparationV1().recipientInputs,factorSecret:s.factorSecret.slice().buffer}),this.assertCurrentRun(t),vV({flowId:this.flowId,linkSessionId:r.linkSessionId,stage:`ordinary_signer_material_prepared`}),s.factorSecret}catch(e){if(s&&LV(s.factorSecret),!c)try{c=await o}catch{}throw c&&await TB(this.ports.ed25519ExportRoot,c),e}}async acceptTargetExportRootV1(e){let{preparation:t,exportRoot:n}=e,r=ai({linkSessionId:t.linkSessionId,walletKeyId:n.walletKeyId,targetFactor:t.targetFactor,applicationBindingDigestB64u:n.applicationBindingDigestB64u,registeredPublicKeyB64u:n.registeredPublicKeyB64u,enrollmentId:t.enrollmentId,deviceId:t.deviceId,revocationEpoch:n.revocationEpoch});return await wB({ed25519ExportRoot:this.ports.ed25519ExportRoot,transport:this.requireAuthenticatedTransport(),recipient:e.recipient,replacementEnvelope:OB({walletId:t.walletId,ownership:oi(t.walletAuthMethodId),envelopeId:e.envelopeId,factor:e.factor,binding:r,createdAtMs:Date.now()}),replacementFactorSecret:e.replacementFactorSecret,expiresAtMs:Math.min(t.expiresAtMs,this.requireSessionV1().qrData.expiresAtMs),assertCurrentRun:()=>this.assertCurrentRun(e.runEpoch),waitForPollV1:xV})}assertTargetPreparationMatchesSession(e){let t=this.requireSessionTargetFactorV1(),n=this.requireSessionV1().qrData;if(e.preparation.linkSessionId!==e.linkSessionId||String(e.preparation.deviceId)!==String(e.state.deviceId)||e.preparation.targetFactor.kind!==t.kind||e.preparation.deliveryRecipientPublicKey65B64u!==this.requireDeliveryRecipientPublicKey65B64u()||e.preparation.expiresAtMs<=Date.now())throw Error(`linked-device target preparation does not match the claimed session`);if(t.kind===`email_otp`&&n.targetFactor.kind===`email_otp`&&e.preparation.targetFactor.kind===`email_otp`&&e.preparation.targetEmail!==n.targetEmail)throw Error(`linked-device target preparation email does not match the QR session`)}async activateAuthorityForStateV1(e,t){this.assertCurrentRun(t),await this.waitForTargetCredentialActivation(),this.assertCurrentRun(t);let n=this.targetCredentialRegistrationResult;if(!n)throw Error(`linked-device target credential registration is unavailable`);let r=this.requireKeyMaterialHandleV1(),i=this.requireAuthenticatedTransport(),a=await this.ports.readExpectedLockGenerationV1(n.walletId);this.assertCurrentRun(t);let o=this.committedAuthorityPackages||await i.receiveCommittedAuthorityPackagesV1({linkSessionId:this.requireSessionV1().linkSessionId});this.committedAuthorityPackages=o,await this.ports.authorityInstallation.persistCommittedDeliveryResumeV1({linkSessionId:this.requireSessionV1().linkSessionId,committed:o,targetFactor:n.targetFactor,committedAtMs:Date.now()}),this.assertCurrentRun(t);let s=this.requireSessionV1().qrData.expiresAtMs,c=0;for(;Date.now()<s;){let s=await iV({transport:i,committed:o,installation:this.ports.authorityInstallation,sessionState:e,linkSessionId:this.requireSessionV1().linkSessionId,targetFactor:n.targetFactor,keyMaterialPort:this.ports.keyMaterial,keyMaterial:r,deliveryRecipientPublicKey65B64u:this.requireDeliveryRecipientPublicKey65B64u(),resealedExportRoot:this.resealedExportRoot,expectedLockGeneration:a,nowMs:()=>Date.now()});if(s.kind!==`pending_local_install`)return s;await xV(c),this.assertCurrentRun(t),c+=1}throw new J(`Linked-device authority activation did not complete before the link session expired`,Y.REGISTRATION_FAILED,`registration`)}async finishActiveAuthorityV1(e,t,n,r){this.assertCurrentRun(r);let i=this.requireSessionV1(),a=this.targetCredentialRegistrationResult;if(!a||a.walletId!==t.walletId)throw Error(`linked-device activation identity is unavailable`);this.handledStates.add(`provisioning`),this.handledStates.add(`authority_pending_local_install`),this.handledStates.add(`active`);let o=this.getAuthenticationContext?.();if(!o)throw Error(`linked-device authentication context is unavailable`);let s=FV({targetFactor:a.targetFactor,walletAuthMethodId:a.walletAuthMethodId,targetCredentialActivationState:this.targetCredentialActivationState,emailOtpTargetActivationState:this.emailOtpTargetActivationState,walletId:t.walletId,runEpoch:r});await QI({context:o,factor:s.factor,walletSession:t,operationCredential:n,factorSecret32:s.factorSecret32});let c=this.committedAuthorityPackages;if(!c)throw Error(`linked-device committed authority packages are unavailable for acknowledgement`);let l=await this.ports.authorityInstallation.readLocalAuthorityInstallationReceiptV1({authorityId:t.authorityId});if(!l)throw Error(`linked-device installation receipt is unavailable for acknowledgement`);let u={kind:`local_authority_activation_final_ack_v1`,linkSessionId:i.qrData.linkSessionId,authorityId:t.authorityId,packageSetDigestB64u:c.packageSetDigestB64u,authorizationId:t.authorizationId,walletSessionId:n.walletSessionId,credentialDigestB64u:await ra(n),installationReceiptDigestB64u:await Qi(l),acknowledgedAtMs:Date.now()};await this.ports.authorityInstallation.persistPendingActivationAcknowledgementV1({acknowledgement:u});let d={walletSession:t,deviceId:e.deviceId,runEpoch:r};this.pendingActivationCompletion=d,await this.sendActivationAcknowledgementV1(u),await this.completeAcknowledgedActivationV1(d)}async completeAcknowledgedActivationV1(e){this.assertCurrentRun(e.runEpoch);let{walletSession:t}=e,n=this.requireSessionV1(),r=this.targetCredentialRegistrationResult,i=this.getAuthenticationContext?.();if(!r||!i)throw Error(`linked-device activation completion is unavailable`);this.session={linkSessionId:n.linkSessionId,qrData:n.qrData,state:{state:`active`,deviceId:e.deviceId,authorityId:t.authorityId,activatedAtMs:t.issuedAtMs}},i.signingEngine.setWalletAuthenticated(mV(t,r)),await this.cleanupCompletedLocalResources(),vV({flowId:this.flowId,linkSessionId:n.qrData.linkSessionId,stage:`post_link_runtime_ready`}),this.emit({phase:ls.STEP_02_QR_SCAN_STARTED,status:`succeeded`,message:`Device link active`,walletId:String(t.walletId),data:{role:`display`,enrollmentId:String(r.enrollmentId)},interaction:{kind:`qr_display`,overlay:`hide`}})}requireAuthenticatedTransport(){if(!this.authenticatedTransport)throw new J(`Authenticated link-session transport is unavailable`,Y.UNSUPPORTED,`registration`);return this.authenticatedTransport}requireSessionTargetFactorV1(){if(!this.session)throw Error(`device-link session is unavailable`);return this.session.qrData.targetFactor}requireSessionV1(){if(!this.session)throw Error(`device-link session is unavailable`);return this.session}requireKeyMaterialHandleV1(){if(!this.keyMaterialHandle)throw Error(`device-link key material is unavailable`);return this.keyMaterialHandle}requireDeliveryRecipientPublicKey65B64u(){if(!this.deliveryRecipientPublicKey65B64u)throw Error(`device-link delivery recipient is unavailable`);return this.deliveryRecipientPublicKey65B64u}requireOrdinarySignerMaterialRecipientPreparationV1(){let e=this.ordinarySignerMaterialRecipientPreparation;if(!e)throw Error(`ordinary signer material recipient preparation is unavailable`);return e}startRun(){return this.clearRunActivationStateV1(),this.committedAuthorityPackages=null,this.deliveryRecoveryReason=null,this.runEpoch+=1,this.generationInProgress=!0,this.cancelled=!1,this.error=void 0,this.handledStates.clear(),this.runEpoch}isCurrentRun(e){return!this.cancelled&&this.runEpoch===e}assertCurrentRun(e){if(!this.isCurrentRun(e))throw new EV}handleSessionTransportEvent(e){this.sessionEventQueue=this.sessionEventQueue.then(this.handleSessionEvent.bind(this,e)).catch(this.handleSessionTransportFailure.bind(this,e))}async handleSessionTransportFailure(e,t){if(t instanceof EV)return;if(this.hasCommittedDeliveryState()){await this.handleCommittedDeliveryFailureV1(e,t);return}yV({flowId:this.flowId,linkSessionId:e.linkSessionId,state:e.state.state,error:t}),this.handledStates.delete(e.state.state);let n=CV(t,`registration`);this.error=n,this.emitFailure(n,`registration`),_V(this.options.options?.onError,n),await this.cancelFailedPrecommitSession(e).catch(()=>void 0),this.runEpoch+=1;try{await this.cleanupLocalResources()}catch{}}async handleCommittedDeliveryFailureV1(e,t){let n=wV(t);if(n){await this.requireExactMethodUnlockForCommittedDeliveryV1(e,n);return}vV({flowId:this.flowId,linkSessionId:e.linkSessionId,stage:`committed_delivery_retry_started`,details:{state:e.state.state,error:P(t)}}),this.handledStates.delete(e.state.state);try{await this.retryCommittedDeliveryV1(e)}catch(t){let n=wV(t);if(n){await this.requireExactMethodUnlockForCommittedDeliveryV1(e,n);return}yV({flowId:this.flowId,linkSessionId:e.linkSessionId,state:e.state.state,error:t})}}async requireExactMethodUnlockForCommittedDeliveryV1(e,t){this.deliveryRecoveryReason=t,this.handledStates.clear(),this.runEpoch+=1;let n=new J(TV(t),Y.DELIVERY_RECOVERY_REQUIRED,`registration`);this.error=n;try{await this.cleanupCompletedLocalResources()}catch(t){yV({flowId:this.flowId,linkSessionId:e.linkSessionId,state:e.state.state,error:t})}this.clearRunActivationStateV1(),this.committedAuthorityPackages=null,this.keyMaterialHandle=null,this.deliveryRecipientPublicKey65B64u=null,this.authenticatedTransport=null,this.subscription=null,this.emitFailure(n,`registration`),_V(this.options.options?.onError,n)}async retryCommittedDeliveryV1(e){if(!await this.replayPendingActivationAcknowledgementV1())switch(e.state.state){case`provisioning`:case`authority_pending_local_install`:case`active`:await this.replayCommittedAuthorityV1(e.state,this.runEpoch);return;default:throw Error(`committed link delivery cannot resume from ${e.state.state}`)}}async replayCommittedAuthorityV1(e,t){let n=await this.activateAuthorityForStateV1(e,t);if(n.kind!==`pending_local_install`){if(n.kind===`integrity_error`)throw new J(`Linked-device authority replay failed: ${n.reason}`,Y.REGISTRATION_FAILED,`registration`);if(n.kind===`failed_before_commit`||n.kind===`relink_required`)throw new J(`Linked-device authority replay cannot continue`,Y.REGISTRATION_FAILED,`registration`);await this.finishActiveAuthorityV1(e,n.session,n.operationCredential,t)}}async replayPendingActivationAcknowledgementV1(){let e=this.committedAuthorityPackages;if(!e)return!1;let t=await this.ports.authorityInstallation.readPendingActivationAcknowledgementV1({authorityId:e.authority.authorityId});if(!t)return!1;let n=this.requireSessionV1();if(t.linkSessionId!==n.qrData.linkSessionId||t.authorityId!==e.authority.authorityId||t.packageSetDigestB64u!==e.packageSetDigestB64u)throw Error(`pending linked-device acknowledgement identity is inconsistent`);let r=this.pendingActivationCompletion;if(!r||r.walletSession.authorizationId!==t.authorizationId)throw Error(`pending linked-device activation completion is unavailable`);return await this.sendActivationAcknowledgementV1(t),await this.completeAcknowledgedActivationV1(r),!0}async sendActivationAcknowledgementV1(e){await this.closeSessionSubscriptionV1();let t=this.requireAuthenticatedTransport();for(let n=1;n<=3;n+=1)try{await t.acknowledgeLocalAuthorityActivationV1({acknowledgement:e});break}catch(e){if(wV(e)||n===3)throw e}await this.ports.authorityInstallation.clearPendingActivationAcknowledgementV1({authorityId:e.authorityId}),await this.ports.authorityInstallation.clearCommittedDeliveryResumeV1({authorityId:e.authorityId})}async cancelFailedPrecommitSession(e){let t=this.authenticatedTransport;if(t)switch(e.state.state){case`claimed`:case`awaiting_target_factor`:case`awaiting_source_contribution`:case`provisioning`:{let n=Date.now();await this.cancelClaimedSessionV1(t,e.linkSessionId,n),this.session?.linkSessionId===e.linkSessionId&&(this.session={...this.session,state:{state:`cancelled`,cancelledAtMs:n}});return}case`displaying_qr`:case`authority_pending_local_install`:case`active`:case`expired`:case`cancelled`:case`failed_before_commit`:return;default:To(e.state)}}async cleanupLocalResources(e=!1){if(!e&&this.hasCommittedDeliveryState())return;let t=e&&this.hasCommittedDeliveryState();t||this.clearRunActivationStateV1();let n,r=this.subscription;if(r)try{await r.close(),this.subscription===r&&(this.subscription=null)}catch(e){n=e}if(!n)try{await this.discardKeyMaterial()}catch(e){n=e}if(n)throw n;t&&(this.clearRunActivationStateV1(),this.committedAuthorityPackages=null)}clearRunActivationStateV1(){this.pendingActivationCompletion=null,this.clearTargetCredentialActivationState(),this.clearEmailOtpTargetActivationState(),this.resealedExportRoot=null,this.targetCredentialRegistrationResult=null,this.ordinarySignerMaterialRecipientPreparation=null}async closeSessionSubscriptionV1(){let e=this.subscription;e&&(await e.close(),this.subscription===e&&(this.subscription=null))}async cleanupCompletedLocalResources(){await this.cleanupLocalResources(!0)}clearEmailOtpTargetActivationState(){let e=this.emailOtpTargetActivationState;e.kind===`completed`&&MV(e).factorSecret.fill(0),this.emailOtpTargetActivationState={kind:`idle`}}hasCommittedDeliveryState(){return this.committedAuthorityPackages!==null||this.keyMaterialHandle!==null&&(this.session?.state.state===`authority_pending_local_install`||this.session?.state.state===`active`)}async discardKeyMaterial(){let e=this.keyMaterialHandle;if(!e)return;if(this.discardInProgress)return await this.discardInProgress;let t=this.ports.keyMaterial.discardKeyMaterialV1({handle:e});this.discardInProgress=t;try{await t,this.keyMaterialHandle===e&&(this.keyMaterialHandle=null,this.deliveryRecipientPublicKey65B64u=null,this.authenticatedTransport=null)}finally{this.discardInProgress===t&&(this.discardInProgress=null)}}emitFailure(e,t){this.emit({phase:t===`generation`?ls.STEP_01_QR_PREPARE_STARTED:ls.FAILED,status:`failed`,message:e.message,data:{role:`display`},interaction:{kind:`qr_display`,overlay:`hide`},error:{code:e.code,message:e.message,retryable:e.code!==Y.UNSUPPORTED&&e.code!==Y.DELIVERY_RECOVERY_REQUIRED}})}emit(e){this.options.options?.onEvent?.(ts({flowId:this.flowId,...e}))}};function KV(e){let t=e.getState();if(t.cancelled||t.error||!t.session)return!0;switch(t.session.state.state){case`active`:case`expired`:case`cancelled`:case`failed_before_commit`:return!0;case`displaying_qr`:case`claimed`:case`awaiting_target_factor`:case`awaiting_source_contribution`:case`provisioning`:case`authority_pending_local_install`:return!1;default:return To(t.session.state)}}var qV=class{constructor(e){this.activeDeviceLinkFlow=null,this.activeOwnerLinkCancellation=null,this.deps=e}async startDevice2LinkingFlow(e){if(this.deps.kind===`direct`&&!this.deps.walletIframe.shouldUseWalletIframe()){if(this.activeDeviceLinkFlow&&KV(this.activeDeviceLinkFlow)&&(this.activeDeviceLinkFlow=null),this.activeDeviceLinkFlow)throw Error(`Device-link QR flow is already running`);let t=new GV(e,this.deps.ports,this.deps.getContext);this.activeDeviceLinkFlow=t;try{return await t.generateQR()}catch(e){throw this.activeDeviceLinkFlow===t&&(this.activeDeviceLinkFlow=null),e}}return await(await this.deps.walletIframe.requireRouter()).startDevice2LinkingFlow(e)}async cancelDeviceLinking(){if(this.deps.kind===`direct`&&!this.deps.walletIframe.shouldUseWalletIframe()){if(this.activeDeviceLinkFlow&&KV(this.activeDeviceLinkFlow)&&(this.activeDeviceLinkFlow=null),this.activeDeviceLinkFlow){await this.activeDeviceLinkFlow.cancel(),this.activeDeviceLinkFlow=null;return}let e=this.activeOwnerLinkCancellation;e&&(await this.deps.ports.transport.cancelClaimedSessionV1(e),this.activeOwnerLinkCancellation===e&&(this.activeOwnerLinkCancellation=null));return}await(await this.deps.walletIframe.requireRouter()).cancelDeviceLinking()}async scanAndLinkDevice(e,t){return this.deps.kind===`direct`&&!this.deps.walletIframe.shouldUseWalletIframe()?await oB(this.deps.getContext(),e,t,this.deps.ports,this.registerOwnerLinkCancellationV1.bind(this)):await(await this.deps.walletIframe.requireRouter()).scanAndLinkDevice({qrData:e,options:t})}registerOwnerLinkCancellationV1(e){this.activeOwnerLinkCancellation=e}};function JV(e){return{listLinkedDevices:async({walletId:t,limit:n,cursor:r})=>await(await e.walletIframe.requireRouter(t)).listLinkedDevices({walletId:String(t),limit:n,cursor:r}),revokeLinkedDevice:async({walletId:t,walletAuthMethodId:n,requestedAtMs:r,sourceProof:i})=>await(await e.walletIframe.requireRouter(t)).revokeLinkedDevice({walletId:String(t),walletAuthMethodId:String(n),requestedAtMs:r,sourceProof:i})}}function YV(e){let t=e.domain.kind===`direct`?new qV({kind:`direct`,getContext:e.getContext,walletIframe:e.walletIframe,ports:e.domain.deviceLinkingPorts}):new qV({kind:`iframe`,getContext:e.getContext,walletIframe:e.walletIframe});return{startDevice2LinkingFlow:async e=>await t.startDevice2LinkingFlow(e),cancelDeviceLinking:async()=>await t.cancelDeviceLinking(),scanAndLinkDevice:async(e,n)=>await t.scanAndLinkDevice(e,n),listLinkedDevices:async t=>{let n=Ui({kind:`linked_device_list_request_v1`,walletId:XV(t.walletId),limit:t.limit,cursor:t.cursor}),r={walletId:n.walletId,limit:n.limit,cursor:n.cursor};return La(await e.domain.linkedDeviceManagement.listLinkedDevices(r))},revokeLinkedDevice:async t=>{let n=ho({kind:`linked_device_revoke_request_v1`,walletId:XV(t.walletId),walletAuthMethodId:ZV(t.walletAuthMethodId),requestedAtMs:t.requestedAtMs});return to(await e.domain.linkedDeviceManagement.revokeLinkedDevice({walletId:n.walletId,walletAuthMethodId:n.walletAuthMethodId,requestedAtMs:n.requestedAtMs,sourceProof:t.sourceProof}))}}}function XV(e){let t=o(e);if(!t.ok)throw Error(t.error.message);return t.value}function ZV(e){let t=c(e);if(!t.ok)throw Error(t.error.message);return t.value}function QV(e){return typeof e==`object`&&!!e&&`kind`in e}function $V(e,t){return typeof t==`string`?e.networkSlug===t:`chainId`in t?e.chainId===t.chainId:e.kind===t.family}function eH(e){return typeof e==`string`?e:QV(e)?z(e):`chainId`in e?`chainId ${e.chainId}`:`family ${e.family}`}function tH(e,t){if(QV(t))return Rr(t);let n=Hr(e),r=n.filter(e=>$V(e,t)),i=r[0];if(r.length===1&&i)return i;if(r.length>1)throw Error(`[threshold-ecdsa] ambiguous chain selector "${eH(t)}": matched ${r.map(z).join(`, `)}. Name one exact network slug instead.`);let a=n.map(e=>e.networkSlug).join(`, `);throw Error(`[threshold-ecdsa] no configured ECDSA chain matches "${eH(t)}". Configured chains: ${a||`(none)`}.`)}function nH(e,t){let n=tH(e,t);if(n.kind!==`tempo`)throw Error(`[threshold-ecdsa] expected a Tempo chain target, resolved ${z(n)}`);return n}function rH(e,t){let n=tH(e,t);if(n.kind!==`evm`)throw Error(`[threshold-ecdsa] expected an EVM chain target, resolved ${z(n)}`);return n}function iH(e){if(!e.chainTargets.length)throw Error(`[SeamsWeb][evm] registerEvmWallet requires at least one chain target`);if(!e.participantIds.length)throw Error(`[SeamsWeb][evm] registerEvmWallet requires participant ids`);if(!e.authMethod)throw Error(`[SeamsWeb][evm] registerEvmWallet requires an explicit authMethod`);return{wallet:{kind:`server_allocated`},authMethod:e.authMethod,signerSelection:{kind:`signer_set`,signers:[{kind:`evm_family_ecdsa`,chainTargets:[...e.chainTargets],participantIds:[...e.participantIds]}]},options:e.options||{}}}function aH(e,t){let n=e.registration.mode===`managed`?e.registration:null,r=t.runtimeScopeBootstrap||(n?{projectEnvironmentId:n.projectEnvironmentId,publishableKey:n.publishableKey}:void 0);if(t.chainTarget.kind!==`evm`)throw Error(`[SeamsWeb][evm] bootstrapEcdsaSession requires an EVM chainTarget`);return{...t,...r?{runtimeScopeBootstrap:r}:{}}}var oH=class extends Error{constructor(e){super(`Browser capability ${e.operation.capabilityKind} is unavailable for ${e.operation.operationKind}: ${e.reason}`),this.code=`browser_capability_unavailable`,this.name=`BrowserCapabilityUnavailableError`,this.selection=e}};function sH(e){return{kind:`selected`,operation:e}}function cH(e,t){return{kind:`disabled`,operation:e,reason:t}}function lH(e,t){switch(t.operationKind){case Er.signTransaction:case Er.signDelegateAction:case Er.signNep413Message:{let n=_r(t.operationKind);return e.signing.routerAb.normalSigning.mode===`enabled`?sH(n):cH(n,`router_ab_normal_signing_disabled`)}case Er.exportKey:return sH(_r(t.operationKind))}}function uH(e,t){let n=Hr(e.network.chains).some(e=>Vr(e,t.chainTarget));switch(t.operationKind){case wr.signTransaction:case wr.exportKey:{let e=xr(t.operationKind);return n?sH(e):cH(e,`ecdsa_target_not_configured`)}}}function dH(e,t){switch(t.capabilityKind){case Dr.vaultAccess:return cH(Tr(t.operationKind),`capability_not_deployed`);case Dr.nearEd25519MpcSigning:return lH(e,t);case Dr.evmEcdsaMpcSigning:return uH(e,t)}}function fH(e,t){let n=dH(e,t);switch(n.kind){case`selected`:return n.operation;case`disabled`:throw new oH(n)}}function pH(e){if(e.chain!==`evm`||e.kind!==`eip1559`)throw Error(`[EVM capability] expected EVM result, received ${e.chain}`);return e}function mH(e){return{kind:`reuse_warm_ecdsa_bootstrap`,walletId:R(e.walletSession.walletId),chainTarget:e.chainTarget,source:e.source,relayerUrl:e.relayerUrl,runtimeScopeBootstrap:e.runtimeScopeBootstrap,ttlMs:e.ttlMs,remainingUses:e.remainingUses}}function hH(e,t={kind:`ordinary`}){return{executeTransaction:async t=>await e.evmFamily.executeEvmFamilyTransaction(t),advanced:{reportBroadcastAccepted:async t=>await e.evmFamily.reportBroadcastAccepted(t),reportBroadcastRejected:async t=>await e.evmFamily.reportBroadcastRejected(t),reportFinalized:async t=>await e.evmFamily.reportFinalized(t),reportDroppedOrReplaced:async t=>await e.evmFamily.reportDroppedOrReplaced(t),reconcileNonceLane:async t=>await e.evmFamily.reconcileNonceLane(t),bootstrapEcdsaSession:async t=>await e.evmFamily.bootstrapEcdsaSession(t)},signTransaction:async n=>{let r=rH(e.configs.network.chains,n.chainTarget),i=await e.currentWallet.walletSession(n.walletSession);fH(e.configs,{capabilityKind:Dr.evmEcdsaMpcSigning,operationKind:wr.signTransaction,chainTarget:r});let a=e.getWalletIframe();if(!a.shouldUseWalletIframe())return pH(await e.signingEngine.signEvmFamily({walletSession:i,request:n.request,chainTarget:r,confirmationConfigOverride:n.options?.confirmationConfig,shouldAbort:n.options?.shouldAbort,onEvent:n.options?.onEvent}));try{return pH(await(await a.requireRouter(R(i.walletId))).signTempo({walletSession:i,request:n.request,chainTarget:r,options:{confirmationConfig:n.options?.confirmationConfig,onEvent:n.options?.onEvent}},t))}catch(e){throw N(e)}},registerEvmWallet:async t=>{let n=e.getWalletIframe(),r=iH(t);if(!n.shouldUseWalletIframe())return await _t({context:{signingEngine:e.signingEngine,nearClient:e.nearClient,configs:e.configs,theme:e.getTheme()},...r,authenticatorOptions:lr(e.configs.webauthn.authenticatorOptions)});try{let e=await(await n.requireRouter()).registerWallet(r);return await t.options?.afterCall?.(!0,e),e}catch(e){let n=N(e);throw await t.options?.onError?.(n),await t.options?.afterCall?.(!1,void 0,n),n}},bootstrapEcdsaSession:async t=>{let n=e.getWalletIframe(),r=aH(e.configs,t);return n.shouldUseWalletIframe()?await(await n.requireRouter(R(t.walletSession.walletId))).bootstrapEcdsaSession(r):await e.signingEngine.bootstrapEcdsaSession(mH(r))}}}function gH(e,t,n){try{e?.(ss({...n,flowId:`signing:near:${String(t)}:${n.phase}`,accountId:String(t)}))}catch{}}function _H(e){let t=Br(Hi(e.nearAccountId));return{walletSession:Ur(e.walletSession),nearAccount:t}}function vH(e){let t=e.transaction,n=String(t.signerId||``).trim();if(!n)throw Error(`Signed transaction is missing signerId`);return n}function yH(e){let t=vH(e.signedTransaction);if(t!==String(e.nearAccountId))throw Error(`Signed transaction signerId ${t} does not match NEAR account ${String(e.nearAccountId)}`)}function bH(e){if(!(e.serverDispatch||e.nonceLease))throw Error(`near.sendTransaction requires an SDK-produced signed transaction with nonce readiness`)}function xH(e){let t=String(e||``).trim();if(!t)throw Error(`NEAR broadcast response is missing transaction hash`);return t}function SH(e){return!e.signedTransaction.serverDispatch&&!e.signedTransaction.nonceLease&&e.signingResult.nonceLease&&(e.signedTransaction.nonceLease=e.signingResult.nonceLease),e.signedTransaction}async function CH(){if(typeof window<`u`&&typeof window.requestAnimationFrame==`function`){await new Promise(e=>{window.requestAnimationFrame(()=>e())});return}await Promise.resolve()}async function wH(e){try{return OH({context:e.context,nearAccountId:e.nearAccountId,walletSession:e.walletSession,receiverId:e.receiverId,actionArgs:e.actionArgs,options:e.options,confirmationConfigOverride:e.options.confirmationConfig})}catch(e){throw N(e)}}async function TH(e){return kH({context:e.context,nearAccountId:e.nearAccountId,walletSession:e.walletSession,transactionInput:e.transactionInput,options:e.options,confirmationConfigOverride:e.options.confirmationConfig})}async function EH(e){try{return AH({context:e.context,nearAccountId:e.nearAccountId,walletSession:e.walletSession,transactionInput:e.transactionInput,options:e.options,confirmationConfigOverride:e.options.confirmationConfig})}catch(e){throw N(e)}}async function DH({context:e,nearAccountId:t,walletSession:n,signedTransaction:r,options:i}){let a=_H({nearAccountId:t,walletSession:n}).nearAccount.accountId;yH({signedTransaction:r,nearAccountId:a}),bH(r);let o=r.nonceLease;gH(i?.onEvent,a,{phase:U.STEP_12_BROADCAST_STARTED,status:`running`,interaction:{kind:`none`,overlay:`none`}});let s,c;try{if(r.serverDispatch)return s=r.serverDispatch.rpcResult,c=xH(r.serverDispatch.transactionHash),o&&(await e.signingEngine.getNonceCoordinator().markBroadcastAccepted({leaseId:o.leaseId,operationId:o.operationId,operationFingerprint:o.operationFingerprint,txHash:c}),await e.signingEngine.getNonceCoordinator().markFinalized({leaseId:o.leaseId,operationId:o.operationId,operationFingerprint:o.operationFingerprint,txHash:c})),gH(i?.onEvent,a,{phase:U.STEP_12_BROADCAST_ACCEPTED,status:`succeeded`,message:`Transaction ${c} sent successfully`,interaction:{kind:`none`,overlay:`none`},data:{txId:c}}),gH(i?.onEvent,a,{phase:U.STEP_15_COMPLETED,status:`succeeded`,message:`Transaction ${c} completed`,interaction:{kind:`none`,overlay:`none`},data:{txId:c}}),{success:!0,transactionId:c,result:s};s=await e.nearClient.sendTransaction(r,i?.waitUntil),c=xH(s.transaction.hash),o&&(await e.signingEngine.getNonceCoordinator().markBroadcastAccepted({leaseId:o.leaseId,operationId:o.operationId,operationFingerprint:o.operationFingerprint,txHash:c}),await e.signingEngine.getNonceCoordinator().markFinalized({leaseId:o.leaseId,operationId:o.operationId,operationFingerprint:o.operationFingerprint,...c?{txHash:c}:{}})),gH(i?.onEvent,a,{phase:U.STEP_12_BROADCAST_ACCEPTED,status:`succeeded`,message:`Transaction ${c} sent successfully`,interaction:{kind:`none`,overlay:`none`},...c?{data:{txId:c}}:{}}),gH(i?.onEvent,a,{phase:U.STEP_15_COMPLETED,status:`succeeded`,message:`Transaction ${c} completed`,interaction:{kind:`none`,overlay:`none`},...c?{data:{txId:c}}:{}})}catch(t){let n=N(t);console.error(`[sendTransaction] failed:`,n);let r=n.details;r&&console.error(`[sendTransaction] RPC error details:`,r);try{o&&await e.signingEngine.getNonceCoordinator().markBroadcastRejected({leaseId:o.leaseId,operationId:o.operationId,operationFingerprint:o.operationFingerprint,error:n})}catch(e){console.warn(`[sendTransaction]: Failed to release nonce after failure:`,e)}throw gH(i?.onEvent,a,{phase:U.FAILED,status:`failed`,interaction:{kind:`none`,overlay:`hide`},error:{message:n.message}}),n}return{success:!0,transactionId:c,result:s}}async function OH({context:e,nearAccountId:t,walletSession:n,receiverId:r,actionArgs:i,options:a,confirmationConfigOverride:o}){let{onEvent:s,onError:c,afterCall:l,waitUntil:u}=a||{},d=a?.confirmerText,f=Array.isArray(i)?i:[i];try{let i=await AH({context:e,nearAccountId:t,walletSession:n,transactionInput:{receiverId:r,actions:f},options:{onEvent:s,onError:c,waitUntil:u,confirmerText:d},confirmationConfigOverride:o}),a=await DH({context:e,nearAccountId:t,walletSession:n,signedTransaction:SH({signedTransaction:i.signedTransaction,signingResult:i}),options:{onEvent:s,onError:c,waitUntil:u}});return l?.(!0,a),a}catch(e){console.error(`[executeAction] Error during execution:`,e);let n=N(e),r=n.details,i=n.short||Li(n);c?.(n),gH(s,t,{phase:U.FAILED,status:`failed`,message:`Action failed: ${i||n.message}`,interaction:{kind:`none`,overlay:`hide`},error:{message:i||n.message}});let a={success:!1,error:n.message,errorDetails:r};return l?.(!1,void 0,n),a}}async function kH({context:e,nearAccountId:t,walletSession:n,transactionInput:r,options:i,confirmationConfigOverride:a}){try{let o=await AH({context:e,nearAccountId:t,walletSession:n,transactionInput:r,options:i,confirmationConfigOverride:a});return await DH({context:e,nearAccountId:t,walletSession:n,signedTransaction:SH({signedTransaction:o.signedTransaction,signingResult:o}),options:{onEvent:i?.onEvent,waitUntil:i?.waitUntil}})}catch(e){let n=N(e),r=n.short||Li(n)||n.message;throw gH(i?.onEvent,t,{phase:U.FAILED,status:`failed`,message:`Action failed: ${r}`,interaction:{kind:`none`,overlay:`hide`},error:{message:r}}),i?.onError?.(n),n}}async function AH({context:e,nearAccountId:t,walletSession:n,transactionInput:r,options:i,confirmationConfigOverride:a}){let{onEvent:o,onError:s,waitUntil:c,confirmerText:l,signerSlot:u}=i||{};try{gH(o,t,{phase:U.STEP_01_STARTED,status:`started`,message:`Starting ${r.actions[0].type} action`,interaction:{kind:`none`,overlay:`none`}}),await jH(t,[r],{onEvent:o,onError:s,waitUntil:c}),await CH();let i={receiverId:r.receiverId,actions:r.actions.map(e=>Sl(e))},d=await e.signingEngine.signNear({chain:`near`,kind:`transactionWithActions`,args:{commandSubject:_H({nearAccountId:t,walletSession:n}),transaction:i,rpcCall:{nearRpcUrl:Or(e.configs.network.chains),nearAccountId:t},signerSlot:u,confirmationConfigOverride:a,title:l?.title,body:l?.body,onEvent:o}});if(!d?.signedTransaction)throw Error(`NEAR signing returned no signed transaction`);return d}catch(e){console.error(`[signTransactionWithActions] Error during execution:`,e);let n=N(e),r=n.short||Li(n)||n.message;throw s?.(n),gH(o,t,{phase:U.FAILED,status:`failed`,message:`Action failed: ${r}`,interaction:{kind:`none`,overlay:`hide`},error:{message:r}}),n}}async function jH(e,t,n){let{onEvent:r}=n||{};if(!e)throw Error(`User not logged in or NEAR account ID not set for direct action.`);if(gH(r,e,{phase:U.STEP_02_REQUEST_PREPARED,status:`running`,message:`Validating inputs`,interaction:{kind:`none`,overlay:`none`}}),t.length===0)throw Error(`No payloads provided for signing`);if(t.length!==1)throw Error(`NEAR signing supports exactly one transaction per operation; received ${t.length}`);for(let e of t){if(!e.receiverId)throw Error(`Missing required parameter: receiverId`);for(let t of e.actions){if(t.type===Cl.FunctionCall&&(!t.methodName||t.args===void 0))throw Error(`Missing required parameters for function call: methodName or args`);if(t.type===Cl.Transfer&&!t.amount)throw Error(`Missing required parameter for transfer: amount`)}}}async function MH(){if(typeof window<`u`&&typeof window.requestAnimationFrame==`function`){await new Promise(e=>{window.requestAnimationFrame(()=>e())});return}await Promise.resolve()}function NH(e){let t={"content-type":`application/json`},n=String(e?.publishableKey??``).trim();n&&(t.Authorization=`Bearer ${n}`);let r=String(e?.environmentId??``).trim();return r&&(t[`X-Seams-Environment-Id`]=r),t}function PH(e,t){if(!j(e))return{ok:!1,error:`Relayer HTTP ${t}`};let n=typeof e.code==`string`?e.code.trim():``,r=(typeof e.message==`string`?e.message.trim():typeof e.error==`string`?e.error.trim():``)||`Relayer HTTP ${t}`;return{ok:!1,error:n?`${r} (${n})`:r}}function FH(e){let t=e?.registration;if(!t||typeof t!=`object`||t.mode!==`managed`)return{};let n=String(t.publishableKey??``).trim(),r=String(t.projectEnvironmentId??``).trim();return{...n?{publishableKey:n}:{},...r?{environmentId:r}:{}}}async function IH(e){let{context:t,delegate:n,options:r}=e,i=Hi(String(e.nearAccountId)),a=r?.confirmerText?.title,o=r?.confirmerText?.body,s={...n,senderId:n.senderId||String(i)};gH(r?.onEvent,i,{phase:U.STEP_01_STARTED,status:`started`,message:`Preparing delegate action inputs`,interaction:{kind:`none`,overlay:`none`}}),await MH();try{let n=await t.signingEngine.signNear({chain:`near`,kind:`delegateAction`,args:{commandSubject:_H({nearAccountId:i,walletSession:e.walletSession}),delegate:s,rpcCall:{nearRpcUrl:Or(t.configs.network.chains),nearAccountId:String(i)},signerSlot:r?.signerSlot,confirmationConfigOverride:r?.confirmationConfig,title:a,body:o,onEvent:r?.onEvent}}),c={hash:n.hash,signedDelegate:n.signedDelegate,nearAccountId:String(i),logs:n.logs};return gH(r?.onEvent,i,{phase:U.STEP_15_COMPLETED,status:`succeeded`,message:`Delegate action signed`,interaction:{kind:`none`,overlay:`none`},data:{hash:c.hash}}),await r?.afterCall?.(!0,c),c}catch(e){let t=N(e);throw r?.onError?.(t),await r?.afterCall?.(!1),gH(r?.onEvent,i,{phase:U.FAILED,status:`failed`,message:t.message,interaction:{kind:`none`,overlay:`hide`},error:{message:t.message}}),t}}const LH=e=>Array.isArray(e)?e:Array.from(e),RH=e=>{let t=e.delegateAction,n=e.signature;return{delegateAction:{...t,publicKey:{...t.publicKey,keyData:LH(t.publicKey.keyData)}},signature:{...n,signatureData:LH(n.signatureData)}}};async function zH(e){let{url:t,payload:n,auth:r,signal:i,options:a}=e,o={...n,signedDelegate:RH(n.signedDelegate)},s=e=>{gH(a?.onEvent,`delegate`,{phase:U.FAILED,status:`failed`,message:e,interaction:{kind:`none`,overlay:`hide`},error:{message:e}})};gH(a?.onEvent,`delegate`,{phase:U.STEP_12_BROADCAST_STARTED,status:`running`,message:`Submitting delegate to relayer`,interaction:{kind:`none`,overlay:`none`}});let c;try{c=await fetch(t,{method:`POST`,headers:NH(r),body:JSON.stringify(o),signal:i||AbortSignal.timeout(3e4)})}catch(e){let t=e instanceof DOMException&&e.name===`TimeoutError`?Error(`Relayer request timed out after 30 seconds`):e instanceof Error?e:Error(String(e));throw a?.onError?.(t),s(t.message),await a?.afterCall?.(!1),t}if(!c.ok){let e=null;try{e=await c.json()}catch{}let t=PH(e,c.status);return a?.onError?.(Error(t.error)),s(t.error),await a?.afterCall?.(!1),t}let l;try{let e=await c.json();l=j(e)?e:{}}catch(e){let t={ok:!1,error:`Relayer returned non-JSON response`},n=e instanceof Error?e:Error(String(e));return a?.onError?.(n),s(t.error),await a?.afterCall?.(!1),t}let u={ok:!!(l.ok??!0),relayerTxHash:typeof l.relayerTxHash==`string`?l.relayerTxHash:typeof l.transactionId==`string`?l.transactionId:typeof l.txHash==`string`?l.txHash:void 0,status:typeof l.status==`string`?l.status:void 0,outcome:l.outcome,error:typeof l.error==`string`?l.error:void 0};if(u.ok!==!1)gH(a?.onEvent,`delegate`,{phase:U.STEP_15_COMPLETED,status:`succeeded`,message:`Delegate relayed successfully`,interaction:{kind:`none`,overlay:`none`}}),await a?.afterCall?.(!0,u);else{let e=u.error||`Relayer execution failed`;a?.onError?.(Error(e)),s(e),await a?.afterCall?.(!1)}return u}async function BH(e){let{context:t,nearAccountId:n,params:r,options:i}=e,a=i?.confirmerText,o=i?.confirmationConfig,{signingEngine:s}=t,c=i?.signerSlot,l=typeof c==`number`&&Number.isSafeInteger(c)&&c>=1;try{if(gH(i?.onEvent,n,{phase:U.STEP_01_STARTED,status:`started`,message:`Preparing NEP-413 message signing`,interaction:{kind:`none`,overlay:`none`}}),c!==void 0&&!l)throw Error(`Invalid signerSlot for NEP-413 signing: ${c}`);let u=l?await s.getUserBySignerSlot(n,c):await s.getLastUser();if(!u||!u.operationalPublicKey)throw Error(`Operational NEAR key data not found for ${n}`);let d=new Uint8Array(32);if(typeof crypto>`u`||typeof crypto.getRandomValues!=`function`)throw Error(`Secure random not available to generate NEP-413 nonce`);crypto.getRandomValues(d);let f=de(d);gH(i?.onEvent,n,{phase:U.STEP_10_COMMIT_STARTED,status:`running`,message:`Signing NEP-413 message`,interaction:{kind:`none`,overlay:`none`}});let p=await t.signingEngine.signNear({chain:`near`,kind:`nep413`,args:{commandSubject:_H({nearAccountId:n,walletSession:e.walletSession}),onEvent:i?.onEvent,message:r.message,recipient:r.recipient,nonce:f,state:r.state||null,signerSlot:l?c:void 0,title:a?.title,body:a?.body,confirmationConfigOverride:o}});if(p.success)return gH(i?.onEvent,n,{phase:U.STEP_15_COMPLETED,status:`succeeded`,message:`NEP-413 message signed successfully`,interaction:{kind:`none`,overlay:`none`}}),{success:!0,accountId:p.accountId,publicKey:p.publicKey,signature:p.signature,nonce:f,...p.state?{state:p.state}:{}};throw Error(`NEP-413 signing failed: ${p.error||`Unknown error`}`)}catch(e){let t=e instanceof Error?e.message:`Unknown error`;return gH(i?.onEvent,n,{phase:U.FAILED,status:`failed`,message:`NEP-413 signing failed: ${t}`,interaction:{kind:`none`,overlay:`hide`},error:{message:t}}),i?.onError?.(e instanceof Error?e:Error(t)),{success:!1,error:t}}}const VH=[1,2];function HH(e){let t={kind:`near_ed25519`,accountProvisioning:e.accountProvisioning??Ks(),signerSlot:1,participantIds:[...kn],derivationVersion:1},n=e.ecdsaChainTargets??ge({signerOptions:e.options.signerOptions??e.configs.signing.thresholdEcdsa.provisioningDefaults,chains:e.configs.network.chains}).map(e=>e.chainTarget);return n.length?{kind:`signer_set`,signers:[t,{kind:`evm_family_ecdsa`,chainTargets:[...n],participantIds:[...VH]}]}:{kind:`signer_set`,signers:[t]}}function UH(e){let t=Ri(e);if(!t.ok)throw Error(t.message);return Gs(t.value)}function WH(e){let t=String(e.walletId||``).trim(),n=String(e.relayerAccountId||``).trim();if(!t)throw Error(`Relayer named NEAR registration requires walletId`);if(!n)throw Error(`Relayer named NEAR registration requires relayer accountId`);return UH(`${t}.${n}`)}function GH(e){let t=e.preference??e.configs.registration.nearAccountProvisioning;switch(t.kind){case`implicit_account`:return Ks();case`relayer_named_subaccount`:if(e.wallet.kind!==`provided`)throw Error(`Relayer named NEAR registration requires a provided walletId`);return WH({walletId:e.wallet.walletId,relayerAccountId:e.configs.network.relayer.accountId});default:return t}}function KH(e){return!e.accountProvisioning||e.accountProvisioning.kind===`implicit_account`?e.accountProvisioning||Ks():e.accountProvisioning}function qH(e,t){if(!t.authMethod)throw Error(`[SeamsWeb][near] registerNearWallet requires an explicit authMethod`);let n=KH(t),r;switch(n.kind){case`implicit_account`:r=t.wallet||{kind:`server_allocated`};break;case`sponsored_named_account`:if(!t.wallet)throw Error(`[SeamsWeb][near] sponsored NEAR registration requires a provided walletId`);r=t.wallet;break;default:throw Error(`[SeamsWeb][near] unsupported NEAR account provisioning branch`)}return{wallet:r,authMethod:t.authMethod,signerSelection:HH({configs:e.configs,accountProvisioning:n,options:t.options||{}}),options:t.options||{}}}function JH(e){let t=String(e.network.relayer?.url||``).trim();if(!t)throw Error(`Relayer URL is not configured`);return t}function YH(e){let t=String(e||``).trim();if(!t)throw Error(`NEAR public key is required`);return t}function XH(e,t){fH(e,{capabilityKind:Dr.nearEd25519MpcSigning,operationKind:t})}function ZH(e){for(let t of e)if(t.kind===`sign`&&t.keyFamily===`ed25519`)return!0;return!1}async function QH(e){let t=await K.resolveSelectedWalletAuthority(String(e.walletId));if(t.kind!==`resolved`)throw Error(`Current Ed25519 wallet session is required for implicit NEAR funding`);let{selection:n,authMethod:r,authority:i}=t;if(n.lockState!==`unlocked`||n.walletId!==e.walletId||n.walletAuthMethodId!==r.walletAuthMethodId||r.walletId!==e.walletId||r.walletAuthorityId!==i.authorityId||r.status!==`active`||i.walletId!==e.walletId||i.state!==`active`)throw Error(`Current Ed25519 wallet session is required for implicit NEAR funding`);let a=await G.readExactWithOperationCredential({walletId:e.walletId,authorityId:i.authorityId,authMethodId:r.walletAuthMethodId});if(a.kind!==`found`||a.record.authorityDigestB64u!==i.authorityDigestB64u||a.record.authorityRevocationEpoch!==i.revocationEpoch||a.record.expiresAtMs<=Date.now()||!ZH(a.record.capabilitySubjects))throw Error(`Current Ed25519 wallet session is required for implicit NEAR funding`);return a.operationCredential.token}async function $H(e){return await Cc({relayerUrl:JH(e.configs),walletId:e.walletSession.walletId,nearAccountId:e.nearAccount.accountId,nearPublicKeyStr:YH(e.nearPublicKey),walletSessionToken:await QH(e.walletSession)})}function eU(e,t={kind:`ordinary`}){let n=()=>({signingEngine:e.signingEngine,nearClient:e.nearClient,configs:e.configs,theme:e.getTheme()}),r={registerNearWallet:async t=>{let r=e.getWalletIframe(),i=qH(n(),t);if(!r.shouldUseWalletIframe())return await _t({context:{signingEngine:e.signingEngine,nearClient:e.nearClient,configs:e.configs,theme:e.getTheme()},...i,authenticatorOptions:lr(e.configs.webauthn.authenticatorOptions)});try{let e=i.wallet.kind===`provided`?String(i.wallet.walletId):void 0,n=await(await r.requireRouter(e)).registerWallet(i);return await t.options?.afterCall?.(!0,n),n}catch(e){let n=N(e);throw await t.options?.onError?.(n),await t.options?.afterCall?.(!1,void 0,n),n}},fundImplicitNearAccountForTesting:async t=>{let n=e.getWalletIframe(),r=_H({nearAccountId:t.nearAccount.accountId,walletSession:t.walletSession});return n.shouldUseWalletIframe()?await(await n.requireRouter(r.walletSession.walletId)).fundImplicitNearAccountForTesting({walletId:r.walletSession.walletId,nearAccountId:t.nearAccount.accountId,nearPublicKey:t.nearPublicKey}):await $H({configs:e.configs,walletSession:r.walletSession,nearAccount:t.nearAccount,nearPublicKey:t.nearPublicKey})},executeAction:async r=>{let i={...r,...await e.currentWallet.nearSubject(r),options:r.options??{}};XH(e.configs,Er.signTransaction);let a=e.getWalletIframe(),o=i.nearAccount.accountId,s=_H({nearAccountId:o,walletSession:i.walletSession});if(!a.shouldUseWalletIframe())return await wH({context:n(),nearAccountId:o,walletSession:s.walletSession,receiverId:Hi(i.receiverId),actionArgs:i.actionArgs,options:i.options});try{let e=await(await a.requireRouter(s.walletSession.walletId)).executeAction({walletId:s.walletSession.walletId,nearAccountId:o,receiverId:i.receiverId,actionArgs:i.actionArgs,options:i.options},t);return await i.options?.afterCall?.(!0,e),e}catch(e){let t=N(e);throw await i.options?.onError?.(t),await i.options?.afterCall?.(!1,void 0,t),t}},signAndSendTransaction:async r=>{let i={...r,...await e.currentWallet.nearSubject(r),options:r.options??{}};XH(e.configs,Er.signTransaction);let a=e.getWalletIframe(),o=i.nearAccount.accountId,s=_H({nearAccountId:o,walletSession:i.walletSession}),c={receiverId:i.receiverId,actions:i.actions};if(!a.shouldUseWalletIframe())try{return await TH({context:n(),nearAccountId:o,walletSession:s.walletSession,transactionInput:c,options:i.options})}catch(e){let t=N(e);throw await i.options?.afterCall?.(!1,void 0,t),t}try{let e=await(await a.requireRouter(s.walletSession.walletId)).signAndSendTransaction({walletId:s.walletSession.walletId,nearAccountId:o,transaction:c,options:i.options},t);return await i.options?.afterCall?.(!0,e),e}catch(e){let t=N(e);throw await i.options?.onError?.(t),await i.options?.afterCall?.(!1,void 0,t),t}},signTransactionWithActions:async t=>{let r={...t,...await e.currentWallet.nearSubject(t),options:t.options??{}};XH(e.configs,Er.signTransaction);let i=e.getWalletIframe(),a=r.nearAccount.accountId,o=_H({nearAccountId:a,walletSession:r.walletSession}),{transaction:s,options:c}=r;if(!i.shouldUseWalletIframe())try{return await EH({context:n(),nearAccountId:a,walletSession:o.walletSession,transactionInput:s,options:c})}catch(e){let t=N(e);throw await c?.afterCall?.(!1,void 0,t),t}try{let e=await(await i.requireRouter(o.walletSession.walletId)).signTransactionWithActions({walletId:o.walletSession.walletId,nearAccountId:a,transaction:{receiverId:s.receiverId,actions:s.actions},options:{signerSlot:c.signerSlot,onEvent:c.onEvent,confirmationConfig:c.confirmationConfig,confirmerText:c.confirmerText}});return await c?.afterCall?.(!0,e),e}catch(e){let t=N(e);throw await c?.onError?.(t),await c?.afterCall?.(!1,void 0,t),t}},sendTransaction:async t=>{let r={...t,...await e.currentWallet.nearSubject(t)},i=e.getWalletIframe(),a=r.nearAccount.accountId,o=_H({nearAccountId:a,walletSession:r.walletSession});if(!i.shouldUseWalletIframe())return await DH({context:n(),nearAccountId:a,walletSession:o.walletSession,signedTransaction:r.signedTransaction,options:r.options});try{let e=await(await i.requireRouter(o.walletSession.walletId)).sendTransaction({walletId:o.walletSession.walletId,nearAccountId:a,signedTransaction:r.signedTransaction,options:{onEvent:r.options?.onEvent,...r.options&&`waitUntil`in r.options?{waitUntil:r.options.waitUntil}:{}}});return await r.options?.afterCall?.(!0,e),e}catch(e){let t=N(e);throw await r.options?.onError?.(t),await r.options?.afterCall?.(!1,void 0,t),t}},signDelegateAction:async t=>{let r={...t,...await e.currentWallet.nearSubject(t),options:t.options??{}};XH(e.configs,Er.signDelegateAction);let i=e.getWalletIframe(),a=r.nearAccount.accountId,o=_H({nearAccountId:a,walletSession:r.walletSession}),{delegate:s,options:c}=r;if(!i.shouldUseWalletIframe())return await IH({context:n(),nearAccountId:a,walletSession:o.walletSession,delegate:s,options:c});try{let e=await(await i.requireRouter(o.walletSession.walletId)).signDelegateAction({walletId:o.walletSession.walletId,nearAccountId:a,delegate:s,options:{signerSlot:c.signerSlot,onEvent:c.onEvent,confirmationConfig:c.confirmationConfig,confirmerText:c.confirmerText}});return await c?.afterCall?.(!0,e),e}catch(e){let t=N(e);throw await c?.onError?.(t),await c?.afterCall?.(!1,void 0,t),t}},sendDelegateActionViaRelayer:async t=>await zH({url:`${t.relayerUrl.replace(/\/+$/,``)}${(e.configs.network.relayer?.routes?.delegateAction||`/signed-delegate`).replace(/^\/?/,`/`)}`,payload:{hash:t.hash,signedDelegate:t.signedDelegate},auth:FH(e.configs),signal:t.signal,options:t.options}),signAndSendDelegateAction:async t=>{let n={...t,...await e.currentWallet.nearSubject(t),options:t.options??{}},i={signerSlot:n.options.signerSlot,onEvent:n.options.onEvent,onError:n.options.onError,waitUntil:n.options.waitUntil,confirmationConfig:n.options.confirmationConfig,confirmerText:n.options.confirmerText,afterCall:()=>{}},a;try{a=await r.signDelegateAction({walletSession:n.walletSession,nearAccount:n.nearAccount,delegate:n.delegate,options:i})}catch(e){let t=N(e);throw await n.options?.afterCall?.(!1,void 0,t),t}let o={onEvent:n.options.onEvent,onError:n.options.onError},s;try{s=await r.sendDelegateActionViaRelayer({relayerUrl:n.relayerUrl,hash:a.hash,signedDelegate:a.signedDelegate,signal:n.signal,options:o})}catch(e){let t=N(e);throw await n.options?.afterCall?.(!1,void 0,t),t}let c={signResult:a,relayResult:s};if(s.ok!==!1)await n.options?.afterCall?.(!0,c);else{let e=N(s.error||`Delegate relay failed`);await n.options?.afterCall?.(!1,void 0,e)}return c},signNEP413Message:async t=>{let r={...t,...await e.currentWallet.nearSubject(t),options:t.options??{}};XH(e.configs,Er.signNep413Message);let i=e.getWalletIframe(),a=r.nearAccount.accountId,o=_H({nearAccountId:a,walletSession:r.walletSession});if(!i.shouldUseWalletIframe()){let e=await BH({context:n(),nearAccountId:a,walletSession:o.walletSession,params:r.params,options:r.options});if(e?.success)await r.options?.afterCall?.(!0,e);else{let t=N(e?.error||`NEP-413 signing failed`);await r.options?.afterCall?.(!1,void 0,t)}return e}try{let e=await(await i.requireRouter(o.walletSession.walletId)).signNep413Message({walletId:o.walletSession.walletId,nearAccountId:a,message:r.params.message,recipient:r.params.recipient,state:r.params.state,options:{signerSlot:r.options.signerSlot,onEvent:r.options.onEvent,confirmerText:r.options.confirmerText,confirmationConfig:r.options.confirmationConfig}});return await r.options?.afterCall?.(!0,e),e}catch(e){let t=N(e);throw await r.options?.onError?.(t),await r.options?.afterCall?.(!1,void 0,t),t}}};return r}function tU(e,t){e.applyWalletHostConfirmationConfig({walletId:e.getCurrentWalletId(),confirmationConfig:{...e.getConfirmationConfig(),...t}})}function nU(){}async function rU(e){await(await e.walletIframe.requireRouter(e.walletId??void 0)).setConfirmBehavior(e.behavior,e.walletId)}async function iU(e){await(await e.walletIframe.requireRouter(e.walletId??void 0)).setConfirmationConfig(e.config,e.walletId)}function aU(e){let t=Promise.resolve();return{setCurrentWallet:t=>{e.userPreferences.setCurrentWallet(t)},getCurrentWalletId:()=>e.userPreferences.getCurrentWalletId(),onConfirmationConfigChange:t=>e.userPreferences.onConfirmationConfigChange(t),onCurrentWalletChange:t=>e.userPreferences.onCurrentWalletChange(t),setConfirmBehavior:n=>{let r=e.getWalletIframe();if(r.shouldUseWalletIframe()){let i=e.userPreferences.getCurrentWalletId();tU(e.userPreferences,{behavior:n}),t=t.catch(nU).then(rU.bind(null,{walletIframe:r,walletId:i,behavior:n}));return}e.userPreferences.setConfirmBehavior(n)},setConfirmationConfig:n=>{let r=e.getWalletIframe();if(r.shouldUseWalletIframe()){let i=e.userPreferences.getCurrentWalletId();tU(e.userPreferences,n),t=t.catch(nU).then(iU.bind(null,{walletIframe:r,walletId:i,config:{...n}}));return}e.userPreferences.setConfirmationConfig(n)},getConfirmationConfig:()=>e.userPreferences.getConfirmationConfig()}}function oU(e,t,n){let r=String(e[t]||``).trim();if(!r)throw Error(`${n} returned missing ${t}`);return r}function sU(e,t){let n=typeof e==`number`?e:Number(e);if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} returned invalid signerSlot`);return Math.floor(n)}function cU(e,t){if(!j(e))throw Error(`${t} returned missing walletBinding`);let n=Uo(oU(e,`walletId`,t)),r=Hi(oU(e,`nearAccountId`,t)),i=Ho(oU(e,`nearEd25519SigningKeyId`,t)),a=oU(e,`rpId`,t),o=m(oU(e,`credentialIdB64u`,t));if(!o.ok)throw Error(`${t} returned invalid credentialIdB64u`);let s=sU(e.signerSlot,t);return{walletId:n,nearAccountId:r,nearEd25519SigningKeyId:i,rpId:a,credentialIdB64u:o.value,signerSlot:s}}function lU(e,t){return cU(j(e.walletBinding)?e.walletBinding:e,t)}function uU(e,t,n){if(String(e.walletId)!==String(t.walletId)||String(e.nearAccountId)!==String(t.nearAccountId)||String(e.nearEd25519SigningKeyId)!==String(t.nearEd25519SigningKeyId)||e.rpId!==t.rpId||e.signerSlot!==t.signerSlot)throw Error(`${n} returned mismatched wallet binding`)}function dU(e){return{success:!1,error:e}}function fU(e,t){return globalThis.fetch(e,t)}function pU(e){try{e.onEvent?.(os({flowId:e.flowId,...e.event}))}catch{}}function mU(e){let t=String(e.configs.network.relayer?.url||``).trim();if(!t)throw Error(`missing_relayer_url`);return t}function hU(e){let t=i(e.signingEngine.getRpId());if(!t.ok)throw Error(`missing_rp_id`);return t.value}function gU(e){if(!Array.isArray(e))return[];let t=[];for(let n of e){let e=typeof n==`string`?n.trim():``;e&&t.push(e)}return t}function _U(e,t){let n=String(e[t]||``).trim();if(!n)throw Error(`sync-account ${t} is required`);return n}function vU(e){if(!D(e))throw Error(`sync-account ECDSA chain target is invalid`);let t=Number(e.chainId);if(!Number.isSafeInteger(t)||t<=0)throw Error(`sync-account ECDSA chain id is invalid`);if(e.kind===`evm`&&e.namespace===`eip155`)return{kind:`evm`,namespace:`eip155`,chainId:t,networkSlug:String(e.networkSlug||``).trim()||`evm-${t}`};if(e.kind===`tempo`)return{kind:`tempo`,chainId:t,networkSlug:String(e.networkSlug||``).trim()||`tempo-${t}`};throw Error(`sync-account ECDSA chain family is invalid`)}function yU(e){if(!Array.isArray(e)||e.length!==2||e[0]!==1||e[1]!==2)throw Error(`sync-account ECDSA participant ids are invalid`);return[1,2]}function bU(e){return e.kind===`sign`&&e.keyFamily===`ecdsa_secp256k1`}function xU(e){for(let t of e)if(bU(t))return t;return null}function SU(e,t){let n=D(e)?e:{},r=n.ecdsaCustody;if(!D(r)||r.kind!==`wallet_custody_ecdsa_sync_continuity_v1`)throw Error(`sync-account ECDSA custody continuity is invalid`);if(!Array.isArray(r.signers))throw Error(`sync-account ECDSA custody signer list is invalid`);let i=[];for(let e of r.signers){if(!D(e)||!D(e.walletKey))throw Error(`sync-account ECDSA custody signer is invalid`);let n=e.walletKey,r=_U(n,`walletId`);if(r!==String(t.walletId))throw Error(`sync-account ECDSA custody signer changed the wallet identity`);i.push({chainTarget:vU(e.chainTarget),walletKey:{walletId:r,keyHandle:_U(n,`keyHandle`),ecdsaThresholdKeyId:_U(n,`ecdsaThresholdKeyId`),signingRootId:_U(n,`signingRootId`),signingRootVersion:_U(n,`signingRootVersion`),relayerKeyId:_U(n,`relayerKeyId`),contextBinding32B64u:_U(n,`contextBinding32B64u`),derivationClientSharePublicKey33B64u:_U(n,`derivationClientSharePublicKey33B64u`),participantIds:yU(n.participantIds),publicCapability:fr(n.publicCapability)},activationReceipt:Hn(e.activationReceipt),runtimePolicyScope:Tn(e.runtimePolicyScope)})}let a=i[0];if(!a){if(n.ecdsaSession!==void 0||n.ecdsaActivationReceipt!==void 0)throw Error(`sync-account returned an ECDSA session without custody continuity`);return{kind:`wallet_custody_ecdsa_sync_continuity_v1`,state:`absent`,signers:[]}}let o=sr(n.ecdsaSession),s=Hn(n.ecdsaActivationReceipt),c=xU(t.walletSession.capabilitySubjects);if(!c||o.session.authorization_id!==t.walletSession.authorizationId||!Qn(o.public_capability,a.walletKey.publicCapability)||!Zn(s,a.activationReceipt)||!b(c.materialActivation,Xn(o.public_capability.material_activation))||o.session.wallet_session_id!==t.session.walletSessionId||o.session.quota_id!==t.session.quotaId||o.session.expires_at_ms!==t.session.expiresAtMs||o.session.remaining_uses!==t.session.remainingUses)throw Error(`sync-account ECDSA session changed the Wallet Session or custody identity`);return{kind:`wallet_custody_ecdsa_sync_continuity_v1`,state:`activated`,signers:[a,...i.slice(1)],sessionActivation:o}}async function CU(e){try{return await e.json()}catch{return null}}async function wU(e){let t=await e.fetch(`${e.relayerUrl}/sync-account/options`,{method:`POST`,headers:{"content-type":`application/json`},body:JSON.stringify({rp_id:e.rpId,...e.walletId?{account_id:e.walletId}:{}})}),n=await CU(t);if(!t.ok||!D(n)||n.ok!==!0){let e=D(n)?String(n.message||n.code||``):``;throw Error(e||`sync-account/options failed (HTTP ${t.status})`)}let r=String(n.challengeId||``).trim(),i=String(n.challengeB64u||``).trim();if(!r||!i)throw Error(`sync-account/options returned an invalid challenge`);let a=D(n.walletBinding)?lU(n,`sync-account/options`):null,o=gU(n.credentialIds);if(e.walletId&&(!a||o.length===0))throw Error(`No passkey recovery capability found for wallet ${e.walletId}`);return{challengeId:r,challengeB64u:i,credentialIds:o,walletBinding:a}}async function TU(e,t){let n=t?Uo(String(t)):null,r=mU(e),i=hU(e),a=await wU({relayerUrl:r,rpId:i,walletId:n?String(n):null,fetch:fU});return Object.freeze({walletId:n?String(n):null,relayerUrl:r,rpId:i,syncOptions:a})}function EU(e){let t=String(e.id||``).trim(),n=String(e.rawId||``).trim();if(!t||!n||t!==n)throw Error(`selected passkey credential identity is invalid`);let r=m(n);if(!r.ok)throw Error(`selected passkey credential identity is invalid`);return r.value}function DU(e,t){if(t===null)return e.credentialIds;if(!e.credentialIds.includes(t))throw Error(`replacement account-sync challenge changed the selected passkey`);return[t]}function OU(e,t){if(typeof e!=`string`||e.trim()!==e||!e)return null;let n=t(e);return n.ok?n.value:null}function kU(e){if(e.response.status!==409||!D(e.raw))return null;let t=e.raw;if(t.ok!==!1||t.code!==`already_committed`||t.kind!==`already_committed`||t.next!==`unlock_exact_method`||[`walletId`,`authorityId`,`walletAuthMethodId`,`mintId`,`authorizationId`,`walletSessionId`,`quotaId`].some(e=>{let n=t[e];return typeof n!=`string`||!n.trim()})||`walletSessionToken`in t||`walletSessionJwt`in t||`sessionKind`in t||`walletSession`in t||`operationCredential`in t||`credential`in t)return null;let n=OU(t.walletId,o),i=OU(t.authorityId,r),a=OU(t.walletAuthMethodId,c),s=OU(t.mintId,yr),l=OU(t.authorizationId,Cr),u=OU(t.walletSessionId,br),d=OU(t.quotaId,vr);return!n||!i||!a||!s||!l||!u||!d||e.expectedWalletId!==null&&n!==e.expectedWalletId?null:{walletId:n,walletAuthMethodId:a}}async function AU(e){let t=await e.fetch(`${e.relayerUrl}/sync-account/verify`,{method:`POST`,headers:{"content-type":`application/json`},body:JSON.stringify({challengeId:e.challengeId,webauthn_authentication:hc(e.credential)})}),n=await CU(t);if(!t.ok||!D(n)||n.ok!==!0||n.verified!==!0){let r=kU({response:t,raw:n,expectedWalletId:e.expectedWalletId});if(r)return{kind:`already_committed`,walletId:r.walletId,walletAuthMethodId:r.walletAuthMethodId,credentialIdB64u:e.selectedCredentialId};let i=D(n)?String(n.message||n.code||``):``;throw Error(i||`sync-account/verify failed (HTTP ${t.status})`)}let r=lU(n,`sync-account/verify`);e.onRelayVerifySucceeded?.(r);let i=pt(n);return{kind:`verified`,response:{verifiedBinding:r,parsedYaoResponse:i,ecdsaContinuity:SU(n,i)}}}function jU(e){throw Error(`Unexpected recovered capability ownership: ${String(e)}`)}async function MU(e){let t=e.ownership;switch(t.kind){case`caller_owned`:t.recovery.activeClient.dispose(),await e.context.signingEngine.clearVolatileWarmSigningMaterial(t.recovery.parsed.walletId);return;case`registry_owned`:await e.context.signingEngine.clearVolatileWarmSigningMaterial(t.recovery.parsed.walletId);return;case`empty`:case`committed`:return;default:return jU(t)}}function NU(e){e.optionsBinding&&uU(e.optionsBinding,e.verifiedBinding,`sync-account/verify`);let t=e.parsed;if(e.verifiedBinding.rpId!==e.rpId||e.requestedWalletId!==null&&e.requestedWalletId!==e.verifiedBinding.walletId||String(t.walletId)!==String(e.verifiedBinding.walletId)||String(t.nearAccountId)!==String(e.verifiedBinding.nearAccountId)||t.nearEd25519SigningKeyId!==String(e.verifiedBinding.nearEd25519SigningKeyId)||t.credentialIdB64u!==e.verifiedBinding.credentialIdB64u||t.credentialIdB64u!==e.selectedCredentialId||e.expectedWalletAuthMethodId!==null&&String(t.walletAuthMethodId)!==e.expectedWalletAuthMethodId||t.signerSlot!==e.verifiedBinding.signerSlot)throw Error(`recovered Yao capability does not match the verified wallet binding`)}function PU(e){let t=e.capability.registrationContinuity;return{materialActivation:e.capability.materialActivation,lifecycleId:e.capability.lifecycle.lifecycleId,signingRootVersion:e.capability.lifecycle.rootShareEpoch,signingRootId:e.capability.applicationBinding.signing_root_id,signerSetId:e.capability.lifecycle.signerSetId,thresholdSessionId:e.capability.lifecycle.thresholdSessionId,activationTranscriptB64u:F(Uint8Array.from(t.activationTranscript)),activationCapabilityBindingB64u:F(Uint8Array.from(e.capability.activeCapabilityBinding))}}async function FU(e){return await e.load({nearAccountId:String(e.parsed.nearAccountId),signerSlot:e.parsed.signerSlot,expectedRegisteredPublicKeyB64u:F(Uint8Array.from(e.parsed.capability.registeredPublicKey))})}function IU(e){return{kind:gi,applicationBindingDigestB64u:e.applicationBindingDigestB64u,registeredPublicKeyB64u:F(e.metadata.registeredPublicKey),participantIds:e.metadata.participantIds,stateEpoch:String(e.metadata.stateEpoch),walletId:String(e.parsed.walletId),nearAccountId:String(e.parsed.nearAccountId),nearEd25519SigningKeyId:e.parsed.nearEd25519SigningKeyId,signerSlot:e.parsed.signerSlot,signingWorkerId:e.parsed.relayerKeyId,signingWorkerVerifyingShareB64u:F(e.metadata.signingWorkerVerifyingShare)}}function LU(e){return`sealLocalMaterial`in e&&typeof e.sealLocalMaterial==`function`}async function RU(e){let t=Vt(e.parsed.walletCustody.envelope);if(!t.ok)throw Error(t.reason);let n=e.ownedFactorSecret.slice(),r=null,i=null,a=null;try{let o=qt(e.parsed.walletCustody.envelope),c=PU(e.parsed),l=await ct({loadCachedMaterial:FU.bind(void 0,{load:e.loadWalletCustodyEd25519Material,parsed:e.parsed}),activation:c,envelope:o,ownedFactorSecret:n});if(l.kind===`opened`)a=l.activeClient;else{r=e.ownedFactorSecret.slice(),i=e.ownedFactorSecret.slice();let n=await e.rejoinWalletCustodyNearEd25519KeySet({walletId:String(e.parsed.walletId),custodyJson:t.custodyJson,factorSecret:r.buffer,nearEd25519SigningKeyId:e.parsed.nearEd25519SigningKeyId,recoveryBasis:e.parsed.capability,routerOrigin:new URL(e.relayerUrl).origin,walletSessionToken:e.parsed.operationCredential.token}),s=IU({parsed:e.parsed,applicationBindingDigestB64u:n.localMaterial.applicationBindingDigestB64u,metadata:n.metadata});await e.persistWalletCustodyEd25519Material({binding:s,sealed:{ciphertextB64u:n.localMaterial.b64u,nonceB64u:n.localMaterial.nonceB64u}}),a=await Ae({material:{binding:s,sealed:{ciphertextB64u:n.localMaterial.b64u,nonceB64u:n.localMaterial.nonceB64u}},activation:Re(n.metadata),envelope:o,ownedFactorSecret:i})}if(!a)throw Error(`Wallet custody recovery produced no active Ed25519 client`);if(!LU(a))throw Error(`Wallet custody recovery produced an unsealable Ed25519 client`);let u=s(a.metadata().scope.threshold_session_id);if(!u.ok)throw Error(`Wallet custody recovery returned an invalid threshold session identity`);let d=e.parsed.walletCustody.envelope.factor;if(d.kind!==`passkey`)throw Error(`Wallet custody recovery returned a different factor authority`);await xe({store:K,activeClient:a,identity:{walletId:String(e.parsed.walletId),nearAccountId:String(e.parsed.nearAccountId),nearEd25519SigningKeyId:String(e.parsed.nearEd25519SigningKeyId),thresholdSessionId:u.value,signerSlot:e.parsed.signerSlot,rpId:d.rpId,credentialIdB64u:d.credentialIdB64u,signingRootId:e.parsed.capability.applicationBinding.signing_root_id,signingRootVersion:e.parsed.capability.lifecycle.rootShareEpoch,signingWorkerId:e.parsed.relayerKeyId},stableServerScope:{relayerKeyId:e.parsed.relayerKeyId,participantIds:e.parsed.session.participantIds,runtimePolicyScope:e.parsed.capability.runtimePolicyScope,routerAbNormalSigning:e.parsed.session.routerAbNormalSigning},passkeyPrfFirstB64u:F(e.ownedFactorSecret)});let f=lt({parsed:e.parsed,relayerUrl:e.relayerUrl,rpId:e.rpId,thresholdSessionId:u.value}),p={activeClient:a,walletSessionState:f,parsed:e.parsed},m=Mc(p.activeClient.metadata());await it({persistence:e.sessionPersistence,session:p.walletSessionState,prfFirstB64u:F(e.ownedFactorSecret),ed25519Restore:Me({rpId:d.rpId,nearAccountId:String(e.parsed.nearAccountId),nearEd25519SigningKeyId:String(e.parsed.nearEd25519SigningKeyId),relayerKeyId:e.parsed.relayerKeyId,participantIds:e.parsed.session.participantIds,runtimePolicyScope:e.parsed.session.runtimePolicyScope,signerSlot:e.parsed.signerSlot,routerAbNormalSigning:e.parsed.session.routerAbNormalSigning,credentialIdB64u:d.credentialIdB64u,materialActivation:m}),materialActivation:m});let h=await e.activateCapability({activeClient:p.activeClient,facts:{thresholdSessionId:p.walletSessionState.thresholdSessionId,signer:p.walletSessionState.signingLane.identity.signer,signingRootId:p.walletSessionState.signingRootId,signingRootVersion:p.walletSessionState.signingRootVersion,routerAbNormalSigning:p.walletSessionState.routerAbNormalSigning,runtimePolicyScope:p.walletSessionState.runtimePolicyScope,relayerUrl:p.walletSessionState.relayerUrl}});if(!b(h.materialActivation,m))throw Error(`Passkey Ed25519 registry activation changed during recovery commit`);let g=await Fo({authority:e.parsed.foundingAuthority,materialActivation:h.materialActivation,updatedAtMs:Date.now()});return await K.persistFoundingWalletAuthority({authority:g,authMethod:e.parsed.foundingAuthMethod}),await e.sessionPersistence.upsertEd25519YaoPublicCapabilityLaneReference(Ye({walletSessionState:p.walletSessionState,materialActivation:h.materialActivation})),p}catch(e){throw a?.dispose(),e}finally{n.fill(0),r?.fill(0),i?.fill(0)}}function zU(e){let t=I(e);if(t.length!==20)throw Error(`ECDSA custody address must contain 20 bytes`);let n=`0x`;for(let e of t)n+=e.toString(16).padStart(2,`0`);return n}function BU(e){if(e.state===`absent`)return null;let t=e.signers[0],n=new Set;for(let n of e.signers.slice(1))if(n.walletKey.keyHandle!==t.walletKey.keyHandle||!Qn(n.walletKey.publicCapability,t.walletKey.publicCapability)||!Zn(n.activationReceipt,t.activationReceipt)||!Gt(n.runtimePolicyScope,t.runtimePolicyScope))throw Error(`sync-account returned conflicting ECDSA custody identities`);for(let t of e.signers){let e=z(t.chainTarget);if(n.has(e))throw Error(`sync-account returned duplicate ECDSA custody chain targets`);n.add(e)}return t}async function VU(e){let t=BU(e.continuity);if(!t)return;let n=Vt(e.parsed.walletCustody.envelope);if(!n.ok)throw Error(n.reason);let r=t.walletKey,i=t.activationReceipt.ecdsa_activation.public_identity,a=e.ownedFactorSecret.slice(),[o,...s]=e.continuity.signers.map(e=>e.chainTarget);if(o)try{let c=await e.signingSurface.rejoinWalletCustodyEvmFamilyKeySet({walletId:r.walletId,custodyJson:n.custodyJson,factorSecret:a.buffer,evmFamilySigningKeySlotId:Fn({walletId:r.walletId,signingRootId:r.signingRootId,signingRootVersion:r.signingRootVersion}),applicationBindingDigestB64u:r.publicCapability.context.application_binding_digest_b64u,registeredClientRootPublicKey33B64u:r.derivationClientSharePublicKey33B64u,relayerPublicIdentityJson:JSON.stringify({relayerKeyId:r.relayerKeyId,relayerPublicKey33B64u:i.server_public_key33_b64u,groupPublicKey33B64u:i.threshold_public_key33_b64u,ethereumAddress:zU(i.ethereum_address20_b64u),relayerShareRetryCounter:i.server_share_retry_counter})});await e.signingSurface.restoreWalletCustodyEcdsaContinuity({authority:e.parsed.authority,chainTargets:[o,...s],walletId:r.walletId,keyHandle:r.keyHandle,ecdsaThresholdKeyId:r.ecdsaThresholdKeyId,signingRootId:r.signingRootId,signingRootVersion:r.signingRootVersion,relayerKeyId:r.relayerKeyId,participantIds:r.participantIds,publicCapability:r.publicCapability,activationReceipt:t.activationReceipt,runtimePolicyScope:t.runtimePolicyScope,readyStateBlobB64u:c.readyStateBlobB64u,publicFacts:c.publicFacts})}finally{a.fill(0)}}async function HU(e){let t=e.walletId===null?null:String(e.walletId).trim();if(e.walletId!==null&&!t)throw Error(`passkey Yao unlock recovery requires a valid walletId`);let n=t?Uo(t):null,r=e.prepared??await wU({relayerUrl:e.relayerUrl,rpId:e.rpId,walletId:n?String(n):null,fetch:e.fetch});if(e.prepared&&!e.credential)throw Error(`prepared account-sync challenge requires a CTA credential`);let i=DU(r,e.expectedCredentialIdB64u);e.onPromptStarted?.();let a=e.credential?e.credential:await e.collectCredential({challengeB64u:r.challengeB64u,credentialIds:i});e.onPromptSucceeded?.();let o=EU(a);if(e.expectedCredentialIdB64u!==null&&o!==e.expectedCredentialIdB64u)throw Error(`replacement account-sync assertion changed the selected passkey`);let s=uc(a);if(!s)throw Error(`selected passkey did not return PRF.first`);e.onRelayVerifyStarted?.();let c=await AU({relayerUrl:e.relayerUrl,challengeId:r.challengeId,expectedWalletId:n,selectedCredentialId:o,credential:a,fetch:e.fetch,onRelayVerifySucceeded:e.onRelayVerifySucceeded});if(c.kind===`already_committed`)return c;let{verifiedBinding:l,parsedYaoResponse:u,ecdsaContinuity:d}=c.response,f=I(s);try{NU({requestedWalletId:n,expectedWalletAuthMethodId:e.expectedWalletAuthMethodId,rpId:e.rpId,optionsBinding:r.walletBinding,verifiedBinding:l,parsed:u,selectedCredentialId:o}),await e.prepareLocalProfile(u,a);let t=await e.withExactEd25519MaterialOwner({materialActivation:u.capability.materialActivation,nearAccountId:u.nearAccountId,task:RU.bind(void 0,{parsed:u,ownedFactorSecret:f,relayerUrl:e.relayerUrl,rpId:e.rpId,sessionPersistence:e.sessionPersistence,activateCapability:e.activateCapability,rejoinWalletCustodyNearEd25519KeySet:e.rejoinWalletCustodyNearEd25519KeySet,loadWalletCustodyEd25519Material:e.loadWalletCustodyEd25519Material,persistWalletCustodyEd25519Material:e.persistWalletCustodyEd25519Material})});return await Ue({walletId:String(u.walletId),credentialIdB64u:u.credentialIdB64u,envelope:u.walletCustody.envelope}),await VU({signingSurface:{rejoinWalletCustodyEvmFamilyKeySet:e.rejoinWalletCustodyEvmFamilyKeySet,restoreWalletCustodyEcdsaContinuity:e.restoreWalletCustodyEcdsaContinuity},parsed:u,continuity:d,ownedFactorSecret:f}),{kind:`recovered`,recovery:t,verifiedBinding:l}}finally{f.fill(0)}}async function UU(e){let t=e.parsed,n=I(t.credentialPublicKeyB64u);await e.context.signingEngine.storeUserData({walletId:String(t.walletId),nearAccountId:t.nearAccountId,signerSlot:t.signerSlot,operationalPublicKey:t.operationalPublicKey,nearEd25519SigningKeyId:t.nearEd25519SigningKeyId,lastUpdated:Date.now(),passkeyCredential:{id:String(e.credential.id||``),rawId:String(e.credential.rawId||``)},version:2}),await e.context.signingEngine.setWalletNearProvisioningState({walletId:t.walletId,status:`near_ready`,nearAccountId:t.nearAccountId});let r=(await K.listWalletPasskeyAuthenticators(String(t.walletId))).find(e=>e.credentialId===t.credentialIdB64u);if(r){if(r.signerSlot!==t.signerSlot||F(r.credentialPublicKey)!==t.credentialPublicKeyB64u)throw Error(`Stored linked passkey authenticator does not match account sync`)}else await e.context.signingEngine.storeAuthenticator({nearAccountId:t.nearAccountId,credentialId:t.credentialIdB64u,credentialPublicKey:n,transports:[],name:`Passkey for ${String(t.walletId)}`,registered:new Date().toISOString(),syncedAt:new Date().toISOString(),signerSlot:t.signerSlot});await K.persistFoundingWalletAuthority({authority:t.foundingAuthority,authMethod:t.foundingAuthMethod})}async function WU(e,t){await e.storeNearThresholdKeyMaterial({nearAccountId:t.nearAccountId,signerSlot:t.signerSlot,publicKey:t.operationalPublicKey,relayerKeyId:t.relayerKeyId,keyVersion:t.keyVersion,participants:Pn({clientParticipantId:t.session.participantIds[0],relayerParticipantId:t.session.participantIds[1],relayerKeyId:t.relayerKeyId,clientShareDerivation:`prf_first_v1`}),signerId:t.operationalPublicKey})}async function GU(e){await G.writeExactWithOperationCredential({record:e.walletSession,operationCredential:e.operationCredential})}async function KU(e,t,n){await UU({context:e,parsed:t,credential:n})}function qU(e){return{id:e,type:`public-key`,transports:[]}}async function JU(e,t){return await e.signingSurface.getAuthenticationCredentialsSerialized({subjectId:e.requestedWalletId||`account-sync`,challengeB64u:t.challengeB64u,allowCredentials:t.credentialIds.map(qU),includeSecondPrfOutput:!1})}function YU(e){pU({onEvent:e.onEvent,flowId:e.flowId,event:{phase:us.STEP_02_PASSKEY_PROMPT_STARTED,status:`waiting_for_user`,...e.requestedWalletId?{accountId:e.requestedWalletId}:{},interaction:{kind:`passkey_assert`,overlay:`show`}}})}function XU(e){pU({onEvent:e.onEvent,flowId:e.flowId,event:{phase:us.STEP_02_PASSKEY_PROMPT_SUCCEEDED,status:`succeeded`,...e.requestedWalletId?{accountId:e.requestedWalletId}:{},interaction:{kind:`passkey_assert`,overlay:`hide`}}})}function ZU(e){pU({onEvent:e.onEvent,flowId:e.flowId,event:{phase:us.STEP_03_RELAY_VERIFY_STARTED,status:`started`,...e.requestedWalletId?{accountId:e.requestedWalletId}:{}}})}function QU(e,t){pU({onEvent:e.onEvent,flowId:e.flowId,event:{phase:us.STEP_03_RELAY_VERIFY_SUCCEEDED,status:`succeeded`,accountId:String(t.walletId)}})}async function $U(e,t,n,r,i,a){let o=t?Uo(String(t)):null;if(n.kind===`replacement_after_committed`&&o!==n.walletId)throw Error(`replacement account-sync attempt changed the committed wallet`);if(i&&i.walletId!==(o?String(o):null))throw Error(`prepared account-sync challenge wallet binding changed`);let s=`account-sync:${String(o||`discovery`)}`,c={kind:`empty`};try{let t=i?.relayerUrl??mU(e),l=i?.rpId??hU(e);if(i&&(mU(e)!==t||hU(e)!==l))throw Error(`prepared account-sync challenge runtime binding changed`);pU({onEvent:r?.onEvent,flowId:s,event:{phase:us.STEP_01_STARTED,status:`started`,...o?{accountId:String(o)}:{}}});let u={signingSurface:e.signingEngine,requestedWalletId:o?String(o):null,onEvent:r?.onEvent,flowId:s},d=await HU({walletId:o?String(o):null,relayerUrl:t,rpId:l,fetch:fU,expectedCredentialIdB64u:n.kind===`replacement_after_committed`?n.credentialIdB64u:null,expectedWalletAuthMethodId:n.kind===`replacement_after_committed`?n.walletAuthMethodId:null,...i?{prepared:i.syncOptions,credential:a}:{},collectCredential:JU.bind(void 0,u),activateCapability:e.signingEngine.activateVerifiedNearEd25519YaoMaterial.bind(e.signingEngine),withExactEd25519MaterialOwner:e.signingEngine.withExactEd25519MaterialOwner.bind(e.signingEngine),sessionPersistence:e.signingEngine,rejoinWalletCustodyNearEd25519KeySet:e.signingEngine.rejoinWalletCustodyNearEd25519KeySet.bind(e.signingEngine),rejoinWalletCustodyEvmFamilyKeySet:e.signingEngine.rejoinWalletCustodyEvmFamilyKeySet.bind(e.signingEngine),restoreWalletCustodyEcdsaContinuity:e.signingEngine.restoreWalletCustodyEcdsaContinuity.bind(e.signingEngine),loadWalletCustodyEd25519Material:e.signingEngine.loadWalletCustodyEd25519Material.bind(e.signingEngine),persistWalletCustodyEd25519Material:e.signingEngine.persistWalletCustodyEd25519Material.bind(e.signingEngine),prepareLocalProfile:KU.bind(void 0,e),onPromptStarted:YU.bind(void 0,u),onPromptSucceeded:XU.bind(void 0,u),onRelayVerifyStarted:ZU.bind(void 0,u),onRelayVerifySucceeded:QU.bind(void 0,u)});if(d.kind===`already_committed`){if(n.kind===`initial`)return await $U(e,d.walletId,{kind:`replacement_after_committed`,walletId:d.walletId,walletAuthMethodId:d.walletAuthMethodId,credentialIdB64u:d.credentialIdB64u},r);throw Error(`sync-account/verify remained already committed after one replacement attempt`)}let{recovery:f,verifiedBinding:p}=d;return c={kind:`registry_owned`,recovery:f},await GU(f.parsed),await WU(e.signingEngine,f.parsed),pU({onEvent:r?.onEvent,flowId:s,event:{phase:us.STEP_04_AUTHENTICATOR_SAVED,status:`succeeded`,accountId:String(p.walletId)}}),pU({onEvent:r?.onEvent,flowId:s,event:{phase:us.STEP_05_THRESHOLD_SESSION_READY,status:`succeeded`,accountId:String(p.walletId)}}),await e.signingEngine.activateAuthenticatedWalletState({walletId:p.walletId,nearAccountId:p.nearAccountId,signerSlot:p.signerSlot,nearClient:e.nearClient}),c={kind:`committed`},pU({onEvent:r?.onEvent,flowId:s,event:{phase:us.STEP_06_COMPLETED,status:`succeeded`,accountId:String(p.walletId)}}),{success:!0,accountId:String(p.walletId),walletId:String(p.walletId),nearAccountId:String(p.nearAccountId),nearEd25519SigningKeyId:String(p.nearEd25519SigningKeyId),publicKey:f.parsed.operationalPublicKey,message:`Account synced successfully`,loginState:{isLoggedIn:!0}}}catch(t){let n=P(t)||`syncAccount failed`;try{await MU({context:e,ownership:c})}catch(e){let t=P(e)||`recovered capability cleanup failed`;n=`${n}; ${t}`}return pU({onEvent:r?.onEvent,flowId:s,event:{phase:us.FAILED,status:`failed`,...o?{accountId:String(o)}:{},error:{message:n}}}),dU(n)}}async function eW(e,t,n){return await $U(e,t,{kind:`initial`},n)}async function tW(e,t,n,r){return await $U(e,t.walletId,{kind:`initial`},r,t,n)}var nW=class{constructor(e){this.getContext=e.getContext,this.walletIframe=e.walletIframe}async syncAccount(e){let t=e.walletId?Uo(e.walletId):null;return this.walletIframe.shouldUseWalletIframe()?await(await this.walletIframe.requireRouter(e.walletId)).syncAccount({...t?{walletId:String(t)}:{},onEvent:e.options?.onEvent}):await eW(this.getContext(),t?String(t):null,e.options)}};function rW(e){let t=new nW({getContext:e.getContext,walletIframe:e.walletIframe});return{syncAccount:async e=>await t.syncAccount(e),getWalletRecoveryCodeStatus:e.domain.getWalletRecoveryCodeStatus,acknowledgeWalletRecoveryCodeBackup:e.domain.acknowledgeWalletRecoveryCodeBackup,requestWalletCustodyEmailOtpChallenge:e.domain.requestWalletCustodyEmailOtpChallenge,rotateWalletRecoveryCodes:e.domain.rotateWalletRecoveryCodes}}function iW(e,t){let n=e.tx.chainId;if(n!==void 0&&Number(n)!==t.chainId)throw Error(`[evm-family] request tx.chainId ${n} does not match chain target ${z(t)}`);return{...e,tx:{...e.tx,chainId:t.chainId}}}const aW=5e3;function oW(e,t,n){try{e?.(ss({...n,flowId:`signing:evm_family:${t}:${n.phase}`,accountId:t}))}catch{}}function sW(){let e=Error(`Request cancelled`);return e.code=`cancelled`,e}function cW(e){let t=Error(e);return t.code=`timeout`,t}async function lW(e){let t=Math.max(1,Math.floor(Number(e.timeoutMs)||0)),n=null,r=!1;try{return await new Promise((i,a)=>{n=setTimeout(()=>{if(!r){r=!0;try{e.onTimeout?.()}catch{}a(cW(e.message))}},t),e.promise.then(e=>{r||(r=!0,n&&clearTimeout(n),i(e))},e=>{r||(r=!0,n&&clearTimeout(n),a(e))})})}finally{n&&clearTimeout(n)}}function uW(e){let t=Math.floor(Number(e));return!Number.isFinite(t)||t<=0?aW:Math.min(aW,Math.max(250,t))}function dW(e){if(typeof e==`function`&&e())throw sW()}function fW(e){return String(e||``).trim().toLowerCase().replace(/[\s-]+/g,`_`)}function pW(e,t){return!e||typeof e!=`object`?!1:fW(e.code)===fW(t)}function mW(e){if(e instanceof Error){let t=String(e.code||``).trim(),n=`details`in e?e.details:void 0;return{...t?{code:t}:{},message:e.message,...n===void 0?{}:{details:n}}}if(e&&typeof e==`object`){let t=e,n=String(t.code||``).trim(),r=String(t.message||``).trim();return{...n?{code:n}:{},message:r||String(e),...t.details===void 0?{}:{details:t.details}}}return{message:String(e||`unknown error`)}}function hW(e){let t=fW(e instanceof Error||e&&typeof e==`object`&&`message`in e?e.message:e);return t.includes(`nonce_lane_blocked`)||t.includes(`nonce lane blocked`)}function gW(e){return!e||typeof e!=`object`||!pW(e,`tx_dropped_or_replaced`)?null:fW(e.reason)===`replaced`?`replaced`:`dropped`}function _W(e){let t=String(e||``).trim().toLowerCase();return/^0x[0-9a-f]*$/.test(t)?t:null}function vW(e){return String(e??``).trim()||null}function yW(e){let t=vW(e);return t?t.toLowerCase():null}function bW(e){throw Error(`[Tempo capability] unhandled finalized payload branch: ${String(e)}`)}function xW(e,t){let n=_W(e);if(!n)throw Error(`[Tempo capability] invalid ${t} payload input`);return n}function SW(e){return{kind:`evm_eip1559`,to:e.tx.to??null,input:xW(e.tx.data||`0x`,`EVM`)}}function CW(e){return{to:e.to,input:xW(e.input||`0x`,`Tempo call`)}}function wW(e){let[t,...n]=e.tx.calls;if(!t)throw Error(`[Tempo capability] Tempo transaction has no calls`);return{kind:`tempo_eip2718_calls`,calls:[CW(t),...n.map(CW)]}}function TW(e){switch(e.chain){case`evm`:return SW(e);case`tempo`:return wW(e);default:return bW(e)}}function EW(e){return e.input??e.data??null}function DW(e){return Array.isArray(e.calls)?{kind:`tempo_eip2718_calls`,calls:e.calls.map(e=>({to:e?.to??null,input:e?EW(e):null,data:e?.data??null}))}:{kind:`evm_eip1559`,to:e.to??null,input:e.input??null}}function OW(e){return yW(e.observed.to)===yW(e.expected.to)&&_W(e.observed.input)===_W(e.expected.input)}function kW(e){return yW(e.observed.to)===yW(e.expected.to)&&_W(EW(e.observed))===_W(e.expected.input)}function AW(e){return e.observed.calls.length===e.expected.calls.length?e.expected.calls.every((t,n)=>{let r=e.observed.calls[n];return r?kW({expected:t,observed:r}):!1}):!1}function jW(e){switch(e.expected.kind){case`evm_eip1559`:return e.observed.kind===`evm_eip1559`?OW({expected:e.expected,observed:e.observed}):!1;case`tempo_eip2718_calls`:return e.observed.kind===`tempo_eip2718_calls`?AW({expected:e.expected,observed:e.observed}):!1;default:return bW(e.expected)}}function MW(e){let t=z(e.chainTarget),n=e.chains.filter(e=>{let n=Nr(e.network);return n!==`evm`&&n!==`tempo`?!1:z(zr(e))===t});if(n.length===1){let e=String(n[0].rpcUrl||``).trim();if(!e)throw Error(`[Tempo capability] missing rpcUrl for ${n[0].network} ${t}`);return e}if(n.length>1){let e=n.map(e=>e.network).join(`, `);throw Error(`[Tempo capability] ambiguous RPC routing for ${t} across [${e}]`)}throw Error(`[Tempo capability] unable to resolve RPC URL for ${t}`)}function NW(e){let t=String(e?.managedNonce?.sender||``).trim(),n=/^0x[0-9a-fA-F]{40}$/.test(t)?t:void 0,r;try{let t=String(e?.managedNonce?.nonce||``).trim();if(t){let e=BigInt(t);e>=0n&&(r=e)}}catch{}return{...n?{managedNonceSenderAddress:n}:{},...typeof r==`bigint`?{nonceHint:r}:{}}}async function PW(e){let t=await vu({rpcUrl:e.rpcUrl}).getTransactionByHash({txHash:e.txHash}).catch(()=>null);if(!t)return{kind:`tx_unavailable`,expected:e.expected};let n=DW(t);return jW({expected:e.expected,observed:n})?{kind:`matched`,expected:e.expected,observed:n}:{kind:`mismatch`,expected:e.expected,observed:n}}async function FW(e){if(!e.broadcastAccepted){await e.lifecycle.reportBroadcastRejected({walletSession:e.walletSession,signedResult:e.signedResult,error:e.error,options:{onEvent:e.onEvent}});return}let t=gW(e.error);if(t){await e.lifecycle.reportDroppedOrReplaced({walletSession:e.walletSession,signedResult:e.signedResult,reason:t,...e.txHash?{txHash:e.txHash}:{},options:{onEvent:e.onEvent}});return}try{await e.lifecycle.reconcileNonceLane({walletSession:e.walletSession,signedResult:e.signedResult,options:{onEvent:e.onEvent}})}catch(t){if(pW(t,`nonce_lane_blocked`)||hW(t)){await e.lifecycle.reportDroppedOrReplaced({walletSession:e.walletSession,signedResult:e.signedResult,reason:`dropped`,...e.txHash?{txHash:e.txHash}:{},options:{onEvent:e.onEvent}});return}throw t}}function IW(e){let t=String(e||``).trim();if(!/^0x[0-9a-fA-F]{64}$/.test(t))throw Error(`[Tempo capability] invalid transaction hash from broadcast: ${t||`empty`}`);return t}function LW(e){let t=String(e||``).trim();if(!/^0x[0-9a-fA-F]+$/.test(t))throw Error(`[Tempo capability] signed rawTxHex is missing or invalid`);return t}function RW(e){return e.payloadExpectation??TW(e.request)}async function zW(e){let t=e.input.options?.onEvent,n=R(e.input.walletSession.walletId);dW(e.input.options?.shouldAbort);let r=null,i,a=!1,o=!1,s=e=>oW(t,n,e),c=e=>{if(e.phase!==U.STEP_15_COMPLETED)try{t?.(e)}catch{}};try{let n=e.input.request,l=MW({chains:e.chains,chainTarget:e.input.chainTarget}),u=vu({rpcUrl:l});r=await e.lifecycle.signEvmFamily({walletSession:e.input.walletSession,request:n,chainTarget:e.input.chainTarget,options:e.input.options?{...e.input.options.confirmationConfig?{confirmationConfig:e.input.options.confirmationConfig}:{},...e.input.options.shouldAbort?{shouldAbort:e.input.options.shouldAbort}:{},...t?{onEvent:c}:{}}:void 0}),dW(e.input.options?.shouldAbort),s({phase:U.STEP_12_BROADCAST_STARTED,status:`running`,interaction:{kind:`none`,overlay:`none`}});let d=LW(r.rawTxHex);e.lifecycle.onBroadcastStarted({walletSession:e.input.walletSession,signedResult:r}),i=IW(await u.request({method:`eth_sendRawTransaction`,params:[d]})),await e.lifecycle.reportBroadcastAccepted({walletSession:e.input.walletSession,signedResult:r,txHash:i,options:{...t?{onEvent:t}:{}}}),a=!0,s({phase:U.STEP_13_NONCE_RECONCILE_STARTED,status:`running`,message:`Waiting for transaction finalization`,interaction:{kind:`none`,overlay:`none`},data:{txHash:i}});let f=new AbortController,p=null;typeof e.input.options?.shouldAbort==`function`&&(p=setInterval(()=>{e.input.options?.shouldAbort?.()&&f.abort(sW())},100));let m=Math.max(1,Math.floor(Number(e.input.finalization?.timeoutMs??9e4)||0)),h=Math.max(1,Math.floor(Number(e.input.finalization?.pollIntervalMs??1250)||0)),g=Math.max(1,Math.floor(Number(e.input.finalization?.confirmations??1)||0)),_=NW(r),v=await lW({promise:u.waitForTransactionReceipt({txHash:i,timeoutMs:m,pollIntervalMs:h,confirmations:g,maxFeePerGasHint:n.tx.maxFeePerGas,signal:f.signal,..._.managedNonceSenderAddress?{transactionSenderAddress:_.managedNonceSenderAddress}:{},...typeof _.nonceHint==`bigint`?{nonceHint:_.nonceHint}:{}}).finally(()=>{p&&=(clearInterval(p),null),f.abort(Error(`finalization wait settled`))}),timeoutMs:m+2e3,message:`Timed out waiting for transaction finalization after ${m.toString()}ms`,onTimeout:()=>{f.abort(cW(`Transaction finalization watchdog timed out`))}}),y=fW(v.status);if(y&&y!==`0x1`&&y!==`0x01`){await e.lifecycle.reportFinalized({walletSession:e.input.walletSession,signedResult:r,txHash:i,receiptStatus:`reverted`,options:{...t?{onEvent:t}:{}}}),o=!0;let n=Error(`Transaction reverted with receipt status ${String(v.status||`unknown`)}`);throw n.code=`tx_reverted`,n.txHash=i,n}let b=RW(e.input),x=await PW({rpcUrl:l,txHash:i,expected:b});if(x.kind===`mismatch`){let e=Error(`Finalized transaction payload mismatch for ${i}.`);throw e.code=`tx_payload_mismatch`,e.details=x,e}if(await e.lifecycle.reportFinalized({walletSession:e.input.walletSession,signedResult:r,txHash:i,receiptStatus:`success`,options:{...t?{onEvent:t}:{}}}),o=!0,s({phase:U.STEP_13_RECEIPT_FINALIZED,status:`succeeded`,interaction:{kind:`none`,overlay:`none`},data:{txHash:i}}),typeof e.input.postFinalizationCheck==`function`){s({phase:U.STEP_14_APP_STATE_SYNC_STARTED,status:`running`,interaction:{kind:`none`,overlay:`none`},data:{txHash:i}});try{await e.input.postFinalizationCheck()}catch(e){let t=e instanceof Error?e.message:String(e||``),n=Error(`Post-finalization state verification failed for ${i}: ${t||`unknown error`}`);throw n.code=`post_finalization_state_mismatch`,n.txHash=i,n.details={...e instanceof Error&&e.message?{message:e.message}:{},originalError:e},n}s({phase:U.STEP_14_APP_STATE_SYNC_SUCCEEDED,status:`succeeded`,interaction:{kind:`none`,overlay:`none`},data:{txHash:i}})}return s({phase:U.STEP_15_COMPLETED,status:`succeeded`,interaction:{kind:`none`,overlay:`none`},data:{operation:`execute`,txHash:i}}),{txHash:i,signedResult:r,payloadVerification:x}}catch(s){try{let t=r?a?o?`post_finalization`:`finalization`:`broadcast`:`sign`;console.warn(`[EvmFamilyLifecycle][failure]`,{stage:t,walletId:n,requestChain:e.input.request.chain,requestKind:e.input.request.kind,requestChainId:e.input.request.tx.chainId,chainTarget:e.input.chainTarget,signed:!!r,...r?.managedNonce?{managedNonce:{chain:r.managedNonce.chainTarget.kind,networkKey:r.managedNonce.chainTarget.networkSlug,chainId:r.managedNonce.chainTarget.chainId,sender:r.managedNonce.sender,nonce:r.managedNonce.nonce.toString(),...r.managedNonce.nonceKey==null?{}:{nonceKey:r.managedNonce.nonceKey.toString()}}}:{},broadcastAccepted:a,finalizedReported:o,...i?{txHash:i}:{},error:mW(s)})}catch{}throw!o&&r&&await lW({promise:FW({lifecycle:e.lifecycle,walletSession:e.input.walletSession,signedResult:r,error:s,broadcastAccepted:a,...i?{txHash:i}:{},...t?{onEvent:t}:{}}),timeoutMs:uW(e.input.finalization?.timeoutMs),message:`Timed out during best-effort nonce cleanup after EVM-family signing failure`}).catch(()=>null),s}}function BW(e){if(e!=null){if(typeof e==`string`)return{message:e};if(e instanceof Error){let t=`code`in e?String(e.code||``).trim():``;return{...t?{code:t}:{},message:String(e.message||``)}}if(typeof e==`object`){let t=e,n=String(t.code||``).trim(),r=String(t.message||``).trim();return{...n?{code:n}:{},...r?{message:r}:{},...t.details===void 0?{}:{details:t.details}}}return{message:String(e)}}}function VW(e,t){let n=e.registration.mode===`managed`?e.registration:null,r=t.runtimeScopeBootstrap||(n?{projectEnvironmentId:n.projectEnvironmentId,publishableKey:n.publishableKey}:void 0);if(t.chainTarget.kind!==`tempo`)throw Error(`[SeamsWeb][tempo] bootstrapEcdsaSession requires a Tempo chainTarget`);return{...t,...r?{runtimeScopeBootstrap:r}:{}}}function HW(e,t){return MW({chains:e,chainTarget:t})}async function UW(e,t){return await Eu({rpcUrl:HW(e,t.chainTarget),account:xu(`account address`,t.account),...t.timeoutMs===void 0?{}:{timeoutMs:t.timeoutMs}})}async function WW(e,t){return await yu({rpcUrl:HW(e,t.chainTarget),feeToken:xu(`fee token address`,t.feeToken),...t.timeoutMs===void 0?{}:{timeoutMs:t.timeoutMs}})}async function GW(e){let t=await Eu(e);if(t?.toLowerCase()!==e.feeToken.toLowerCase())throw Error(`[Tempo capability] fee-token preference mismatch: expected ${e.feeToken}, received ${t??`unset`}`)}async function KW(e,t){let n=HW(e.chains,t.chainTarget),r=xu(`account address`,t.account),i=xu(`fee token address`,t.feeToken),a=await yu({rpcUrl:n,feeToken:i});if(a.kind===`invalid`)throw Error(`[Tempo capability] invalid fee token: ${a.reason}`);let o=Du({chainId:t.chainTarget.chainId,feeToken:i,maxPriorityFeePerGas:t.feeCaps.maxPriorityFeePerGas,maxFeePerGas:t.feeCaps.maxFeePerGas,gasLimit:t.gasLimit??1000000n});return await e.execute({walletSession:t.walletSession,chainTarget:t.chainTarget,request:o,payloadExpectation:{kind:`evm_eip1559`,to:o.tx.to??null,input:o.tx.data??`0x`},...t.finalization?{finalization:t.finalization}:{},...t.options?{options:t.options}:{},postFinalizationCheck:GW.bind(null,{rpcUrl:n,account:r,feeToken:i})})}function qW(e){if(e.chain!==`tempo`||e.kind!==`tempoTransaction`)throw Error(`[Tempo capability] expected Tempo result, received ${e.chain}`);return e}function JW(e){return{kind:`reuse_warm_ecdsa_bootstrap`,walletId:R(e.walletSession.walletId),chainTarget:e.chainTarget,source:e.source,relayerUrl:e.relayerUrl,runtimeScopeBootstrap:e.runtimeScopeBootstrap,ttlMs:e.ttlMs,remainingUses:e.remainingUses}}function YW(e,t){fH(e,{capabilityKind:Dr.evmEcdsaMpcSigning,operationKind:wr.signTransaction,chainTarget:t})}function XW(e,t={kind:`ordinary`}){let n=async n=>{let r=tH(e.configs.network.chains,n.chainTarget),i=await e.currentWallet.walletSession(n.walletSession);YW(e.configs,r);let a=e.getWalletIframe(),o=R(i.walletId);if(!a.shouldUseWalletIframe())return await e.signingEngine.signEvmFamily({walletSession:i,request:n.request,chainTarget:r,confirmationConfigOverride:n.options?.confirmationConfig,shouldAbort:n.options?.shouldAbort,onEvent:n.options?.onEvent});try{return await(await a.requireRouter(o)).signTempo({walletSession:i,request:n.request,chainTarget:r,options:{confirmationConfig:n.options?.confirmationConfig,onEvent:n.options?.onEvent}},t)}catch(e){throw N(e)}},r=async t=>qW(await n({...t,chainTarget:nH(e.configs.network.chains,t.chainTarget)})),i=t=>{let n=e.getWalletIframe();n.shouldUseWalletIframe()&&n.requireRouter(R(t.walletSession.walletId)).then(e=>e.notifyTransactionBroadcastStarted(t.signedResult)).catch(()=>{})},a=async t=>{let n=e.getWalletIframe(),r=R(t.walletSession.walletId);if(!n.shouldUseWalletIframe()){await e.signingEngine.reportTempoBroadcastAccepted({walletId:r,signedResult:t.signedResult,txHash:t.txHash,onEvent:t.options?.onEvent});return}try{await(await n.requireRouter(r)).reportTempoBroadcastAccepted({walletSession:t.walletSession,signedResult:t.signedResult,txHash:t.txHash,options:{onEvent:t.options?.onEvent}})}catch(e){throw N(e)}},o=async t=>{let n=e.getWalletIframe(),r=R(t.walletSession.walletId);if(!n.shouldUseWalletIframe()){await e.signingEngine.reportTempoBroadcastRejected({walletId:r,signedResult:t.signedResult,...t.error===void 0?{}:{error:t.error},onEvent:t.options?.onEvent});return}try{await(await n.requireRouter(r)).reportTempoBroadcastRejected({walletSession:t.walletSession,signedResult:t.signedResult,...t.error==null?{}:{error:BW(t.error)},options:{onEvent:t.options?.onEvent}})}catch(e){throw N(e)}},s=async t=>{let n=e.getWalletIframe(),r=R(t.walletSession.walletId);if(!n.shouldUseWalletIframe()){await e.signingEngine.reportTempoFinalized({walletId:r,signedResult:t.signedResult,...t.txHash?{txHash:t.txHash}:{},...t.receiptStatus?{receiptStatus:t.receiptStatus}:{},onEvent:t.options?.onEvent});return}try{await(await n.requireRouter(r)).reportTempoFinalized({walletSession:t.walletSession,signedResult:t.signedResult,...t.txHash?{txHash:t.txHash}:{},...t.receiptStatus?{receiptStatus:t.receiptStatus}:{},options:{onEvent:t.options?.onEvent}})}catch(e){throw N(e)}},c=async t=>{let n=e.getWalletIframe(),r=R(t.walletSession.walletId);if(!n.shouldUseWalletIframe()){await e.signingEngine.reportTempoDroppedOrReplaced({walletId:r,signedResult:t.signedResult,reason:t.reason,...t.txHash?{txHash:t.txHash}:{},onEvent:t.options?.onEvent});return}try{await(await n.requireRouter(r)).reportTempoDroppedOrReplaced({walletSession:t.walletSession,signedResult:t.signedResult,reason:t.reason,...t.txHash?{txHash:t.txHash}:{},options:{onEvent:t.options?.onEvent}})}catch(e){throw N(e)}},l=async t=>{let n=e.getWalletIframe(),r=R(t.walletSession.walletId);if(!n.shouldUseWalletIframe())return await e.signingEngine.reconcileTempoNonceLane({walletId:r,signedResult:t.signedResult,onEvent:t.options?.onEvent});try{return await(await n.requireRouter(r)).reconcileTempoNonceLane({walletSession:t.walletSession,signedResult:t.signedResult,options:{onEvent:t.options?.onEvent}})}catch(e){throw N(e)}},u={onBroadcastStarted:i,signEvmFamily:n,reportBroadcastAccepted:a,reportBroadcastRejected:o,reportFinalized:s,reportDroppedOrReplaced:c,reconcileNonceLane:l},d=async t=>{let n=tH(e.configs.network.chains,t.chainTarget),r=await e.currentWallet.walletSession(t.walletSession);return await zW({lifecycle:u,chains:e.configs.network.chains,input:{...t,chainTarget:n,walletSession:r,request:iW(t.request,n)}})},f=async t=>{let n=e.getWalletIframe(),r=VW(e.configs,t);return n.shouldUseWalletIframe()?await(await n.requireRouter(R(t.walletSession.walletId))).bootstrapEcdsaSession(r):await e.signingEngine.bootstrapEcdsaSession(JW(r))};return{signTransaction:r,executeTransaction:d,advanced:{reportBroadcastAccepted:a,reportBroadcastRejected:o,reportFinalized:s,reportDroppedOrReplaced:c,reconcileNonceLane:l,bootstrapEcdsaSession:f},signTempo:r,getFeeTokenPreference:async t=>await UW(e.configs.network.chains,t),validateFeeToken:async t=>await WW(e.configs.network.chains,t),setFeeTokenPreference:async t=>await KW({chains:e.configs.network.chains,execute:d},t),executeEvmFamilyTransaction:d,reportBroadcastAccepted:a,reportBroadcastRejected:o,reportFinalized:s,reportDroppedOrReplaced:c,reconcileNonceLane:l,bootstrapEcdsaSession:f}}function ZW(e){return typeof e==`string`?Ur({walletId:e}):e}function QW(e){return typeof e==`string`?Br(e):e}function $W(e){let t=async()=>{let t=await e.getWalletSession();if(t.authentication.kind!==`authenticated`)throw Error("[seams] no authenticated wallet: unlock a wallet first, or pass an explicit `walletSession`.");return t};return{walletSession:async e=>e?ZW(e):Ur({walletId:(await t()).authentication.walletId}),nearSubject:async e=>{if(e.walletSession&&e.nearAccount)return{walletSession:ZW(e.walletSession),nearAccount:QW(e.nearAccount)};let n=await t(),r=n.authentication.walletId,i=e.walletSession?ZW(e.walletSession):Ur({walletId:r});if(e.nearAccount)return{walletSession:i,nearAccount:QW(e.nearAccount)};let a=n.appIdentity;if(a.kind!==`resolved`||String(a.walletId)!==String(r))throw Error("[seams] the authenticated wallet has no resolved NEAR account: pass an explicit `nearAccount`.");if(!a.nearAccountId)throw Error("[seams] this wallet has no NEAR account yet (NEAR provisioning may still be pending): pass an explicit `nearAccount`, or await `seams.registration.awaitNearReady`.");return{walletSession:i,nearAccount:Br(a.nearAccountId)}}}}function eG(e){return e?e.status===`near_ready`?{kind:`near_ready`,nearAccountId:e.nearAccountId}:e.status===`near_failed_retryable`?{kind:`near_failed_retryable`,reason:e.error}:null:null}async function tG(e,t){let n=String(t.walletId||``).trim();if(!n)throw Error(`[seams] awaitNearReady requires a walletId`);let r=Math.max(1,Math.floor(Number(t.timeoutMs)||0))||12e4,i=null,a=null,o=null;try{return await new Promise((s,c)=>{let l=!1,u=e=>{l||(l=!0,s(e))};if(t.signal?.aborted){c(t.signal.reason??Error(`[seams] awaitNearReady aborted`));return}t.signal&&(o=()=>{l||(l=!0,c(t.signal?.reason??Error(`[seams] awaitNearReady aborted`)))},t.signal.addEventListener(`abort`,o,{once:!0})),i=e.onNearProvisioningStateChanged(e=>{if(String(e.walletId)!==n)return;let t=eG(e.state);t&&u(t)}),a=setTimeout(()=>u({kind:`timed_out`}),r),e.getNearProvisioningState({walletId:n}).then(e=>{let t=eG(e);t&&u(t)}).catch(()=>{})})}finally{a&&clearTimeout(a),o&&t.signal&&t.signal.removeEventListener(`abort`,o);try{i?.()}catch{}}}function nG(e,t){switch(t.kind){case`ed25519`:fH(e,{capabilityKind:Dr.nearEd25519MpcSigning,operationKind:Er.exportKey});return;case`ecdsa`:fH(e,{capabilityKind:Dr.evmEcdsaMpcSigning,operationKind:wr.exportKey,chainTarget:t.chainTarget});return}}function rG(e){return{resolveExactKeyExportLane:async t=>(nG(e.configs,t),await e.domain.resolveExactKeyExportLane(t)),exportKeypairWithUI:async t=>{nG(e.configs,t),await e.domain.exportKeypairWithUI({...t,options:t.options??{}})},exportKeypair:async t=>{let n=t.options??{};if(t.kind===`ed25519`){let r={kind:`ed25519`,...await e.currentWallet.nearSubject(t)};nG(e.configs,r);let i=await e.domain.resolveExactKeyExportLane(r);if(i.kind===`relink_required`)return i;if(i.kind!==`ed25519`)throw Error(`[key-export] expected an Ed25519 lane, received ${i.kind}`);return await e.domain.exportKeypairWithUI({...r,laneIdentity:i.laneIdentity,materialActivation:i.materialActivation,options:n}),{kind:`exported`}}let r={kind:`ecdsa`,walletSession:await e.currentWallet.walletSession(t.walletSession),chainTarget:tH(e.configs.network.chains,t.chainTarget)};nG(e.configs,r);let i=await e.domain.resolveExactKeyExportLane(r);if(i.kind===`relink_required`)return i;if(i.kind!==`ecdsa`)throw Error(`[key-export] expected an ECDSA lane, received ${i.kind}`);return await e.domain.exportKeypairWithUI({...r,laneIdentity:i.laneIdentity,options:n}),{kind:`exported`}}}}function iG(e){return{shouldUseWalletIframe:()=>e().shouldUseWalletIframe(),requireRouter:async t=>await e().requireRouter(t)}}function aG(e){let t=()=>({signingEngine:e.signingEngine,nearClient:e.nearClient,configs:e.configs,theme:e.getTheme()}),n=()=>({signingEngine:e.signingEngine,nearClient:e.nearClient,configs:e.configs,theme:e.getTheme()}),r=iG(e.getWalletIframe),i=yz({getWalletAuthDeps:e.getWalletAuthDeps,domain:e.auth}),a=YV({getContext:n,walletIframe:r,domain:e.devices}),o=$W({getWalletSession:i.getWalletSession}),s={signingEngine:e.signingEngine,nearClient:e.nearClient,configs:e.configs,getTheme:e.getTheme,getWalletIframe:e.getWalletIframe,currentWallet:o},c=eU(s),l=XW(s);return vz(c,{getWalletIframe:e.getWalletIframe,createCapabilities:oG.bind(null,s)}),{walletIframeControls:{initWalletIframe:async t=>await e.getWalletIframe().init(t),isWalletIframeReady:()=>e.getWalletIframe().isReady(),onWalletIframeReady:t=>e.getWalletIframe().onReady(t),onWalletIframeLoginStatusChanged:t=>e.getWalletIframe().onLoginStatusChanged(t),onWalletIframePreferencesChanged:t=>e.getWalletIframe().onPreferencesChanged(t)},preferences:aU({userPreferences:e.userPreferences,getWalletIframe:e.getWalletIframe}),auth:i,registration:{resumePendingEcdsaRegistration:e.registration.resumePendingEcdsaRegistration,getNearProvisioningState:e.registration.getNearProvisioningState,onNearProvisioningStateChanged:e.registration.onNearProvisioningStateChanged,awaitNearReady:async t=>await tG({getNearProvisioningState:e.registration.getNearProvisioningState,onNearProvisioningStateChanged:e.registration.onNearProvisioningStateChanged},{...t,walletId:String(t.walletId)}),addWalletSigner:e.registration.addWalletSigner,addPasskey:e.registration.addPasskey,addEmailOtp:e.registration.addEmailOtp,revokeAuthMethod:e.registration.revokeAuthMethod,registerWallet:e.registration.registerWallet,registerWithEmailOtp:e.registration.registerWallet,registerPasskey:e.registration.registerPasskey,requestEmailOtpEnrollmentChallenge:e.registration.requestEmailOtpEnrollmentChallenge,enrollEmailOtp:e.registration.enrollEmailOtp},recovery:rW({getContext:t,walletIframe:r,domain:e.recovery}),devices:a,keys:rG({configs:e.configs,currentWallet:o,domain:e.keys}),near:c,tempo:l,evm:hH({signingEngine:e.signingEngine,nearClient:e.nearClient,configs:e.configs,getTheme:e.getTheme,getWalletIframe:e.getWalletIframe,currentWallet:o,evmFamily:l})}}function oG(e,t){let n={kind:`reviewed`,reservation:t},r=XW(e,n);return{near:eU(e,n),tempo:r,evm:hH({...e,evmFamily:r},n)}}function sG(e){let t=c(e.authMethod.walletAuthMethodId);if(!t.ok)throw Error(t.error.message);let n=Lr(e.verificationDigestB64u);return e.kind===`verified_passkey_target_v1`?{kind:`passkey`,walletAuthMethodId:t.value,verificationDigestB64u:n,rpId:e.authMethod.rpId,credentialIdB64u:e.authMethod.credentialIdB64u}:{kind:`email_otp`,walletAuthMethodId:t.value,verificationDigestB64u:n,emailHashHex:e.authMethod.emailHashHex,registrationAuthorityId:e.authMethod.registrationAuthorityId}}function cG(e){return{async prepareOrdinarySignerMaterialV1(t){if(!(t.factorSecret instanceof ArrayBuffer)||t.factorSecret.byteLength!==32)throw Error(`ordinary signer material factorSecret must be 32 bytes`);let n=dG(t.preparations),r=pG(t.recipientRequests),i=hG(t.recipientInputs);vG(i,r);let a=[t.factorSecret,..._G(i)];return uG(await e({kind:`device_linking_ordinary_signer_material_prepare_private_v1`,handleId:O(t.keyMaterial.handleId,`keyMaterial.handleId`,`is required`),targetFactor:sG(t.targetFactor),preparations:n,recipientRequests:r,recipientInputs:i,factorSecret:t.factorSecret},a))},async createOrdinarySignerMaterialRecipientRequestsV1(t){return mG(await e({kind:`device_linking_ordinary_signer_material_recipient_prepare_v1`,handleId:O(t.keyMaterial.handleId,`keyMaterial.handleId`,`is required`),requirements:fG(t.requirements)}))},async sealCommittedAuthorityPackagesV1(t){let n=qa(t.committed);return wG(await e({kind:`device_linking_ordinary_signer_material_seal_v1`,handleId:O(t.keyMaterial.handleId,`keyMaterial.handleId`,`is required`),committed:n,targetFactor:sG(t.targetFactor),resealedExportRoot:lG(t.resealedExportRoot)}))}}}function lG(e){if(e===null)return null;if(!Dc(e,[`envelope`]))throw Error(`ordinary material resealed export root has unsupported fields`);return{envelope:ti(e.envelope)}}function uG(e){if(!Dc(e,[`kind`,`targetFactor`,`preparations`]))throw Error(`ordinary material preparation result has invalid fields`);if(e.kind!==`device_linking_ordinary_signer_material_preparation_v1`)throw Error(`ordinary material preparation result kind is invalid`);return{kind:`device_linking_ordinary_signer_material_preparation_v1`,targetFactor:SG(e.targetFactor),preparations:dG(e.preparations)}}function dG(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`ordinary signer material preparations must contain one or two entries`);let t=e.map(xG),n=t.map(e=>`kind`in e?`ed25519`:`ecdsa_secp256k1`);if(new Set(n).size!==t.length)throw Error(`ordinary signer material preparations repeat a key family`);let r=t.map(e=>`kind`in e?e.targetMaterialActivation:e.target.activation);if(r.length===2&&r[0].activationId===r[1].activationId)throw Error(`ordinary signer material preparations repeat an activation reference`);let i=t[0];if(!i)throw Error(`ordinary signer material preparations are empty`);return[i,...t.slice(1)]}function fG(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`ordinary signer material recipient requirements must contain one or two entries`);let t=e.map((e,t)=>{if(!Dc(e,[`kind`,`keyFamily`,`walletKeyId`]))throw Error(`ordinary recipient requirement ${t} has invalid fields`);if(e.kind!==`ordinary_signer_material_recipient_requirement_v1`)throw Error(`ordinary recipient requirement kind is invalid`);if(e.keyFamily!==`ed25519`&&e.keyFamily!==`ecdsa_secp256k1`)throw Error(`ordinary recipient requirement key family is invalid`);let n=bG(e.walletKeyId);return{kind:e.kind,keyFamily:e.keyFamily,walletKeyId:n}});yG(t);let n=t[0];if(!n)throw Error(`ordinary recipient requirements are empty`);return[n,...t.slice(1)]}function pG(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`ordinary signer material recipient requests must contain one or two entries`);let t=e.map(e=>{if(Dc(e,[`kind`,`keyFamily`,`walletKeyId`,`recipientPublicKeyB64u`])){if(e.kind!==`ordinary_ed25519_signer_material_recipient_request_v1`||e.keyFamily!==`ed25519`)throw Error(`ordinary Ed25519 recipient request kind is invalid`);return{kind:`ordinary_ed25519_signer_material_recipient_request_v1`,keyFamily:`ed25519`,walletKeyId:bG(e.walletKeyId),recipientPublicKeyB64u:TG(e.recipientPublicKeyB64u,`Ed25519 recipient public key`)}}if(Dc(e,[`kind`,`keyFamily`,`walletKeyId`,`clientEphemeralPublicKey`])){if(e.kind!==`ordinary_ecdsa_signer_material_recipient_request_v1`||e.keyFamily!==`ecdsa_secp256k1`)throw Error(`ordinary ECDSA recipient request kind is invalid`);return{kind:`ordinary_ecdsa_signer_material_recipient_request_v1`,keyFamily:`ecdsa_secp256k1`,walletKeyId:bG(e.walletKeyId),clientEphemeralPublicKey:O(e.clientEphemeralPublicKey,`ECDSA client ephemeral public key`,`is required`)}}throw Error(`ordinary recipient request key family is invalid`)});yG(t);let n=t[0];if(!n)throw Error(`ordinary recipient requests are empty`);return[n,...t.slice(1)]}function mG(e){if(!Dc(e,[`kind`,`recipientRequests`,`recipientInputs`]))throw Error(`ordinary recipient preparation result has invalid fields`);if(e.kind!==`device_linking_ordinary_signer_material_recipient_preparation_v1`)throw Error(`ordinary recipient preparation result kind is invalid`);let t=pG(e.recipientRequests),n=hG(e.recipientInputs);return vG(n,t),{recipientRequests:t,recipientInputs:n}}function hG(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`ordinary signer material recipient inputs must contain one or two entries`);let t=e.map(e=>{if(Dc(e,[`kind`,`keyFamily`,`walletKeyId`,`recipientPrivateKey`])){if(e.kind!==`ordinary_ed25519_signer_material_recipient_input_v1`||e.keyFamily!==`ed25519`)throw Error(`ordinary Ed25519 recipient input kind is invalid`);return{kind:`ordinary_ed25519_signer_material_recipient_input_v1`,keyFamily:`ed25519`,walletKeyId:bG(e.walletKeyId),recipientPrivateKey:gG(e.recipientPrivateKey,`Ed25519 recipient private key`)}}if(Dc(e,[`kind`,`keyFamily`,`walletKeyId`,`clientEphemeralPrivateKey`])){if(e.kind!==`ordinary_ecdsa_signer_material_recipient_input_v1`||e.keyFamily!==`ecdsa_secp256k1`)throw Error(`ordinary ECDSA recipient input kind is invalid`);return{kind:`ordinary_ecdsa_signer_material_recipient_input_v1`,keyFamily:`ecdsa_secp256k1`,walletKeyId:bG(e.walletKeyId),clientEphemeralPrivateKey:gG(e.clientEphemeralPrivateKey,`ECDSA client ephemeral private key`)}}throw Error(`ordinary recipient input key family is invalid`)});yG(t);let n=t[0];if(!n)throw Error(`ordinary recipient inputs are empty`);return[n,...t.slice(1)]}function gG(e,t){if(!(e instanceof ArrayBuffer)||e.byteLength!==32)throw Error(`${t} must be a 32-byte ArrayBuffer`);return e}function _G(e){return e.map(e=>e.kind===`ordinary_ed25519_signer_material_recipient_input_v1`?e.recipientPrivateKey:e.clientEphemeralPrivateKey)}function vG(e,t){if(e.length!==t.length)throw Error(`ordinary recipient inputs and requests have different lengths`);for(let n of t)if(e.filter(e=>e.walletKeyId===n.walletKeyId&&e.keyFamily===n.keyFamily).length!==1)throw Error(`ordinary recipient input for ${String(n.walletKeyId)} is missing or duplicated`)}function yG(e){let t=new Set,n=new Set;for(let r of e){if(t.has(r.keyFamily))throw Error(`ordinary recipient family repeats`);if(n.has(String(r.walletKeyId)))throw Error(`ordinary recipient wallet key repeats`);t.add(r.keyFamily),n.add(String(r.walletKeyId))}let r=e[0];if(e.length===2&&r?.keyFamily!==`ed25519`)throw Error(`ordinary recipient requests must be ordered Ed25519 then ECDSA`)}function bG(e){let t=h(e);if(!t.ok)throw Error(t.error.message);return t.value}function xG(e){return Zi(e)}function SG(e){if(Dc(e,[`kind`,`walletAuthMethodId`,`verificationDigestB64u`,`rpId`,`credentialIdB64u`])){if(e.kind!==`passkey`)throw Error(`ordinary material target factor kind is unsupported`);let t=c(e.walletAuthMethodId);if(!t.ok)throw Error(t.error.message);let n=Lr(e.verificationDigestB64u);return{kind:`passkey`,walletAuthMethodId:t.value,verificationDigestB64u:n,rpId:O(e.rpId,`ordinary target factor rpId`,`is required`),credentialIdB64u:TG(e.credentialIdB64u,`ordinary target factor credentialIdB64u`)}}if(Dc(e,[`kind`,`walletAuthMethodId`,`verificationDigestB64u`,`emailHashHex`,`registrationAuthorityId`])){if(e.kind!==`email_otp`)throw Error(`ordinary material target factor kind is unsupported`);let t=c(e.walletAuthMethodId);if(!t.ok)throw Error(t.error.message);let n=Lr(e.verificationDigestB64u),r=O(e.emailHashHex,`ordinary target factor emailHashHex`,`is required`);if(!/^[0-9a-f]{64}$/.test(r))throw Error(`ordinary target factor emailHashHex is invalid`);return{kind:`email_otp`,walletAuthMethodId:t.value,verificationDigestB64u:n,emailHashHex:r,registrationAuthorityId:O(e.registrationAuthorityId,`ordinary target factor registrationAuthorityId`,`is required`)}}throw Error(`ordinary material target factor kind is unsupported`)}function CG(e){if(!Dc(e,[`kind`,`authorityId`,`walletAuthMethodId`,`walletKeyId`,`envelope`]))throw Error(`ordinary material export-root record has invalid fields`);if(e.kind!==`wallet_authority_export_root_v1`)throw Error(`ordinary material export-root record kind is invalid`);let t=r(e.authorityId);if(!t.ok)throw Error(t.error.message);let n=c(e.walletAuthMethodId);if(!n.ok)throw Error(n.error.message);let i=h(e.walletKeyId);if(!i.ok)throw Error(i.error.message);return{kind:`wallet_authority_export_root_v1`,authorityId:t.value,walletAuthMethodId:n.value,walletKeyId:i.value,envelope:ti(e.envelope)}}function wG(e){if(!Dc(e,[`signerMaterials`,`exportRoot`,`installedRecordSetDigestB64u`])||!Array.isArray(e.signerMaterials)||e.signerMaterials.length===0)throw Error(`ordinary material worker returned an invalid sealed record set`);let t=e.signerMaterials.map(e=>fs(e)),n=t[0];if(!n)throw Error(`ordinary material worker returned an invalid sealed record set`);return{signerMaterials:[n,...t.slice(1)],exportRoot:e.exportRoot===null?null:CG(e.exportRoot),installedRecordSetDigestB64u:Lr(e.installedRecordSetDigestB64u)}}function TG(e,t){let n=O(e,t,`is required`),r;try{r=I(n)}catch{throw Error(`${t} is invalid base64url`)}if(r.length===0||F(r)!==n)throw r.fill(0),Error(`${t} must be canonical non-empty base64url`);return r.fill(0),n}function EG(e,t){if(typeof e!=`string`||e.trim()!==e||e.length===0)throw Error(`${t} is required`);return e}function DG(e,t){try{return Lr(e)}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is invalid`}`)}}function OG(e,t,n){let r=EG(e,n);if(!/^[A-Za-z0-9_-]+$/.test(r))throw Error(`${n} is invalid`);let i;try{i=I(r)}catch{throw Error(`${n} is invalid`)}if(i.length!==t||F(i)!==r)throw Error(`${n} must be canonical base64url`);return i.fill(0),r}function kG(e){if(!Dc(e,[`kind`,`handleId`]))throw Error(`device-linking key handle has invalid fields`);let t=e;if(t.kind!==`device_linking_key_material_handle_v1`)throw Error(`device-linking key handle kind is invalid`);return{kind:`device_linking_key_material_handle_v1`,handleId:EG(t.handleId,`device-linking key handle.handleId`)}}function AG(e){if(!Dc(e,[`handleId`,`linkPublicKeyB64u`,`devicePublicKeyB64u`,`deliveryRecipientPublicKey65B64u`]))throw Error(`device-linking key create response has invalid fields`);let t=e;return{handle:{kind:`device_linking_key_material_handle_v1`,handleId:EG(t.handleId,`device-linking key create handleId`)},linkPublicKeyB64u:vo(t.linkPublicKeyB64u),devicePublicKeyB64u:vo(t.devicePublicKeyB64u),deliveryRecipientPublicKey65B64u:OG(t.deliveryRecipientPublicKey65B64u,65,`deliveryRecipientPublicKey65B64u`)}}function jG(e){if(!Dc(e,[`kind`,`verificationGrant`,`factorSecret`]))throw Error(`device-linking Email OTP factor release response has invalid fields`);let t=e;if(t.kind!==`device_linking_email_otp_factor_release_result_v1`)throw Error(`device-linking Email OTP factor release response kind is invalid`);if(!(t.factorSecret instanceof ArrayBuffer)||t.factorSecret.byteLength!==32)throw Error(`device-linking Email OTP factor release secret is invalid`);return{kind:`device_linking_email_otp_factor_release_result_v1`,verificationGrant:Eo(t.verificationGrant),factorSecret:t.factorSecret}}function MG(e){return ir(e)}function NG(e){if(!Dc(e,[`signatureB64u`]))throw Error(`device-linking request signature response has invalid fields`);return{signatureB64u:OG(e.signatureB64u,64,`signatureB64u`)}}function PG(e){if(Dc(e,[`id`,`ok`,`result`])&&e.ok===!0){let t=e.id;return typeof t!=`string`||t.trim()!==t||t.length===0?null:{id:t,ok:!0,result:e.result}}if(Dc(e,[`id`,`ok`,`error`])&&e.ok===!1){let t=e.id;return typeof t!=`string`||t.trim()!==t||t.length===0||typeof e.error!=`string`||!e.error.trim()?null:{id:t,ok:!1,error:e.error}}return null}function FG(){if(!globalThis.crypto||typeof globalThis.crypto.getRandomValues!=`function`)throw Error(`secure randomness is unavailable for device-linking worker`);let e=globalThis.crypto.getRandomValues(new Uint8Array(16)),t=`device-linking-${F(e)}`;return e.fill(0),t}function IG(e){return e!==void 0&&Number.isSafeInteger(e)&&e>0?e:6e4}function LG(e){return e instanceof Error?e:typeof e==`string`&&e.trim()?Error(e):Error(`device-linking worker failed`)}function RG(){if(typeof Worker>`u`)throw Error(`device-linking worker is unavailable; provide an authenticated worker endpoint`);let e=ip(void 0,{worker:`deviceLinking`});return new Worker(e,{type:`module`})}function zG(e){if(!e.startsWith(`/`)||e.includes(`?`)||e.includes(`#`)||e.trim()!==e)throw Error(`canonicalPath is invalid`);return e}function BG(e,t){if(!Number.isSafeInteger(e)||e<=0)throw Error(`${t} is invalid`);return e}function VG(e){let t=g(e.linkSessionId);if(!t.ok)throw Error(t.error.message);if(e.method!==`GET`&&e.method!==`POST`)throw Error(`method is invalid`);let n=BG(e.expiresAtMs,`expiresAtMs`),r=BG(e.issuedAtMs,`issuedAtMs`);if(n<=r)throw Error(`expiresAtMs must be after issuedAtMs`);return{kind:`device_linking_request_sign_v1`,handleId:EG(e.handle.handleId,`handle.handleId`),linkSessionId:t.value,method:e.method,canonicalPath:zG(e.canonicalPath),bodyDigestB64u:DG(e.bodyDigestB64u,`bodyDigestB64u`),devicePublicKeyDigestB64u:DG(e.devicePublicKeyDigestB64u,`devicePublicKeyDigestB64u`),challengeB64u:OG(e.challengeB64u,32,`challengeB64u`),issuedAtMs:r,expiresAtMs:n}}function HG(e={}){let t=IG(e.timeoutMs),n=new Map,i=e.endpoint??null,a=!1,s=e=>{let t=PG(e.data);if(!t)return;let r=n.get(t.id);r&&(clearTimeout(r.timeoutId),n.delete(t.id),t.ok?r.resolve(t.result):r.reject(Error(t.error)))},l=e=>{let t=LG(e.message);for(let[e,r]of n)clearTimeout(r.timeoutId),n.delete(e),r.reject(t)},u=e=>{e.addEventListener(`message`,s),e.addEventListener(`error`,l)};e.endpoint&&(u(e.endpoint),i=e.endpoint);let d=()=>{if(i)return i;let e=RG();try{return u(e),i=e,e}catch(t){throw e.terminate(),t}},p=()=>{if(a)return;a=!0;let e=i;e?.removeEventListener(`message`,s),e?.removeEventListener(`error`,l);let t=Error(`device-linking worker transport is closed`);for(let[e,r]of n)clearTimeout(r.timeoutId),n.delete(e),r.reject(t);e?.terminate(),i=null},m=(e,r)=>{if(a)return Promise.reject(Error(`device-linking worker transport is closed`));let i;try{i=d()}catch(e){return Promise.reject(LG(e))}let o=FG();return new Promise((a,s)=>{let c=setTimeout(()=>{n.delete(o),s(Error(`device-linking worker request timed out after ${t}ms`))},t);n.set(o,{resolve:a,reject:s,timeoutId:c});try{i.postMessage({id:o,request:e},r)}catch(e){clearTimeout(c),n.delete(o),s(LG(e))}})};return{...cG(m),close:p,async createBootstrapKeyMaterialV1(){return AG(await m({kind:`device_linking_key_material_create_v1`}))},async discardKeyMaterialV1(e){await m({kind:`device_linking_key_material_discard_v1`,handleId:kG(e.handle).handleId})},async openEmailOtpFactorReleaseV1(e){let t=kG(e.keyMaterial),n=o(e.walletId);if(!n.ok)throw Error(n.error.message);let r=g(e.linkSessionId);if(!r.ok)throw Error(r.error.message);let i=S(e.enrollmentId);if(!i.ok)throw Error(i.error.message);let a=f(e.deviceId);if(!a.ok)throw Error(a.error.message);let s=c(e.walletAuthMethodId);if(!s.ok)throw Error(s.error.message);let l=c(e.baseWalletAuthMethodId);if(!l.ok)throw Error(l.error.message);let u=DG(e.targetPreparationDigestB64u,`targetPreparationDigestB64u`),d=EG(e.expectedChallengeId,`expectedChallengeId`),p=Eo(e.verificationGrant),h=ja(e.factorRelease);return jG(await m({kind:`device_linking_email_otp_factor_release_open_v1`,handleId:t.handleId,walletId:n.value,linkSessionId:r.value,enrollmentId:i.value,deviceId:a.value,walletAuthMethodId:s.value,baseWalletAuthMethodId:l.value,targetPreparationDigestB64u:u,expectedChallengeId:d,verificationGrant:p,factorRelease:h}))},async openWalletSessionCredentialDeliveryV1(e){let t=kG(e.keyMaterial),n=ua(e.delivery),i=e.expected,a=o(i.walletId);if(!a.ok)throw Error(a.error.message);let s=r(i.authorityId);if(!s.ok)throw Error(s.error.message);let l=g(i.linkSessionId);if(!l.ok)throw Error(l.error.message);let u=c(i.walletAuthMethodId);if(!u.ok)throw Error(u.error.message);return MG(await m({kind:`device_linking_wallet_session_credential_delivery_open_v1`,handleId:t.handleId,delivery:n,expected:{...i,linkSessionId:l.value,walletId:a.value,authorityId:s.value,walletAuthMethodId:u.value,deliveryBinding:Ca(i.deliveryBinding)}}))},async signDeviceSessionRequestV1(e){return NG(await m(VG(e)))}}}function UG(e){return{claimSessionV1:async t=>WG(await e.request.requestOwnerV1({method:`POST`,canonicalPath:`${XG(t.request.payload.linkSessionId)}/claim`,body:t.request,authentication:t.authentication}),ha),resolveEmailOtpBaseFactorV1:async t=>WG(await e.request.requestOwnerV1({method:`POST`,canonicalPath:`${XG(t.linkSessionId)}/email-otp-base-factor`,body:t.request,authentication:t.authentication}),Ua),cancelClaimedSessionV1:async t=>WG(await e.request.requestOwnerV1({method:`POST`,canonicalPath:`${XG(t.linkSessionId)}/owner-cancel`,body:{expectedRevision:t.expectedRevision},authentication:t.authentication}),qG),recordOwnerApprovalV1:async t=>WG(await e.request.requestOwnerV1({method:`POST`,canonicalPath:`${XG(t.approval.linkSessionId)}/approval`,body:t.approval,authentication:t.authentication}),Qa),getSourceContributionPreparationV1:async t=>{let n=await e.request.requestOwnerV1({method:`GET`,canonicalPath:`${XG(t.linkSessionId)}/source-contribution-preparation`,authentication:t.authentication});return n.status===204?null:WG(n,la)},recordSourceContributionV1:async t=>WG(await e.request.requestOwnerV1({method:`POST`,canonicalPath:`${XG(t.approval.linkSessionId)}/source-contribution`,body:t.approval,authentication:t.authentication}),KG),getApprovalV1:e.approvalUpdates.getApprovalV1,getEd25519ExportRootRecipientV1:async t=>{let n=await e.request.requestOwnerV1({method:`GET`,canonicalPath:`${XG(t.linkSessionId)}/ed25519-export-root-recipient`,authentication:t.authentication});return n.status===204?null:WG(n,Oo)},submitEd25519ExportRootPackageV1:async t=>{WG(await e.request.requestOwnerV1({method:`POST`,canonicalPath:`${XG(ZG(t.submission.linkSessionId))}/ed25519-export-root`,body:t.submission,authentication:t.authentication}),e=>e)},subscribeApprovalV1:e.approvalUpdates.subscribeApprovalV1}}function WG(e,t){if(e.status<200||e.status>=300)throw Object.assign(Error(GG(e)),{status:e.status});return t(e.body)}function GG(e){let t=YG(e.body);return t?`linked-device owner request failed: ${t.message}`:`linked-device owner request failed with HTTP ${e.status}`}function KG(e){let t=JG(e);if(!t)throw Error(`linked-device source contribution response is invalid`);return Ia(t.session)}function qG(e){let t=JG(e);if(!t)throw Error(`linked-device session response is invalid`);return Ia(t.session)}function JG(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return null;let t=new Map(Object.entries(e)),n=[...t.keys()],r=new Set([`ok`,`outcome`,`session`]);return n.length!==r.size||!n.every(e=>r.has(e))||t.get(`ok`)!==!0||t.get(`outcome`)!==`applied`&&t.get(`outcome`)!==`replayed`?null:{session:t.get(`session`)}}function YG(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return null;let t=new Map(Object.entries(e)),n=[...t.keys()];if(n.length===0||n.length>2||!n.every(e=>e===`code`||e===`message`))return null;let r=t.get(`message`);return typeof r==`string`?{message:r}:null}function XG(e){return`${bz}/${String(e)}`}function ZG(e){let t=g(e);if(!t.ok)throw Error(t.error.message);return t.value}function QG(e){let t=m(e);if(t.ok)return t.value;throw Error(t.error.message)}function $G(e){switch(e){case`ble`:case`cable`:case`hybrid`:case`internal`:case`nfc`:case`smart-card`:case`usb`:return e;default:throw Error(`linked-device WebAuthn transport ${e} is unsupported`)}}function eK(e){e.byteLength>0&&e.fill(0)}function tK(e){let t=e.credential.authenticatorAttachment;if(t!==void 0&&t!==`platform`&&t!==`cross-platform`)throw Error(`linked-device WebAuthn authenticator attachment is invalid`);return{kind:`linked_device_webauthn_registration_v1`,credentialIdB64u:QG(e.credentialIdB64u),authenticatorAttachment:t??null,clientDataJsonB64u:e.credential.response.clientDataJSON,attestationObjectB64u:e.credential.response.attestationObject,transports:e.credential.response.transports.map($G)}}function nK(e){return{async createTargetCredentialV1(t){let n=t.preparation.passkeyCreationOptions;if(n.walletAuthMethodId!==t.preparation.walletAuthMethodId)throw Error(`linked-device passkey options are bound to a different auth method`);let r=await e.authenticator.run({kind:`create_passkey`,registrationOptions:n,requirePrfFirst:!0});if(!r.ok)throw Error(`linked-device passkey creation failed: ${r.message}`);if(r.operation!==`create_passkey`||!r.requirePrfFirst)throw Error(`linked-device passkey creation returned the wrong operation result`);let i=tK(r),a=I(r.prf.prfFirstB64u);if(a.byteLength!==32)throw eK(a),Error(`linked-device passkey PRF output must be 32 bytes`);return{walletAuthMethodId:n.walletAuthMethodId,webauthnRegistration:i,factorSecret:a}}}}function rK(e,t){return t.authorityId===e.authorityId&&t.linkSessionId===e.linkSessionId&&t.packageSetDigestB64u===e.packageSetDigestB64u}async function iK(e){let[t,n]=await Promise.all([e.installation.listCommittedDeliveryResumesV1(),e.installation.listPendingActivationAcknowledgementsV1()]);for(let r of n){let n=t.find(rK.bind(null,r));if(!n)throw Error(`durable linked-device acknowledgement has no matching resume`);let i=await e.readExactSession({walletId:n.walletId,authorityId:n.authorityId,authMethodId:n.authMethodId});i.kind!==`missing`&&await JB({installation:e.installation,transport:e.transport,walletId:n.walletId,authorityId:n.authorityId,authMethodId:n.authMethodId,operationCredential:i.operationCredential})}}async function aK(e){let t=await G.readExactWithOperationCredential(e);switch(t.kind){case`found`:return{kind:`found`,operationCredential:t.operationCredential};case`missing`:return{kind:`missing`};case`upgrade_required`:throw Error(`Linked-device acknowledgement requires a newer client`)}}function oK(e){let t=HG({...e.workerEndpoint?{endpoint:e.workerEndpoint}:{},...e.workerTimeoutMs===void 0?{}:{timeoutMs:e.workerTimeoutMs}}),n=Fz({owner:UG({request:e.ownerRequest,approvalUpdates:e.ownerApprovalUpdates}),http:e.http,relayerUrl:e.relayerUrl,publishableKey:e.publishableKey,projectEnvironmentId:e.projectEnvironmentId,keyMaterial:t,nowMs:e.nowMs,pollIntervalMs:e.pollIntervalMs}),r=Nz({http:e.http,relayerUrl:e.relayerUrl,projectEnvironmentId:e.projectEnvironmentId}),i=nK({authenticator:e.authenticator}),a=$B({indexedDB:K,sealing:t,nowMs:e.nowMs}),o=kB(e.custodyCeremonyTransport);return{transport:n,ownerAuthorization:e.ownerAuthorization,sourceContribution:e.sourceContribution,keyMaterial:t,targetCredential:i,authorityInstallation:a,readExpectedLockGenerationV1:async e=>{let t=await K.resolveSelectedWalletAuthority(String(e));if(t.kind===`missing_selection`)return 0;if(t.kind!==`resolved`)throw Error(`selected wallet authority is unavailable: ${t.kind}`);return t.selection.lockGeneration},ed25519ExportRoot:o,resumePendingAcknowledgementsV1:iK.bind(null,{installation:a,transport:r,readExactSession:aK}),dispose:t.close}}var sK=class extends Error{constructor(e,t){super(`Owner Router request failed: ${t}`),this.code=e,this.name=`WalletHostOwnerRequestTransportError`}};function cK(e){let t=lK(e);return{ownerAuthorization:{authenticateOwnerForLinkingV1:async e=>await dK(t,e)},ownerRequest:{requestOwnerV1:async e=>await fK(t,e)},managementRequest:{request:async e=>await pK(t,e)}}}function lK(e){let t=String(e.relayerUrl||``).trim().replace(/\/+$/,``);if(!t)throw Error(`Wallet-host device linking requires a Router URL`);return{...e,baseUrl:t}}function uK(){return new J(`wallet_unlock_required`,Y.WALLET_UNLOCK_REQUIRED,`authorization`)}async function dK(e,t){let n=e.readWalletAuthenticationState();if(n.kind!==`authenticated`)throw uK();await Ze(n.walletId);let r=await mK(e,n.walletId),i=await hK(e,r,{method:`POST`,canonicalPath:`/wallet/device-linking/v1/owner-authorization`,body:Gi({payload:t.payload,requestedAtMs:t.requestedAtMs})});if(i.status<200||i.status>=300)throw Error(wK(i));let a=_K(i.body,r),o=Dn(t.payload.requestedPermission,`export_keys`)&&a.sourceSignerManifest.keyFamilies.some(e=>e===`ed25519`),s=o?e.readUnlockedEd25519ExportRootCapabilityV1(n.walletId):void 0;if(o&&(!s||s.walletId!==String(n.walletId)||s.walletSessionId!==String(r.operationCredential.walletSessionId)||s.expiresAtMs<=Date.now()))throw uK();if(o){if(!s)throw uK();return{...a,exportRootRequirement:`required`,ed25519ExportRootCapability:s}}return{...a,exportRootRequirement:`not_required`}}async function fK(e,t){if(t.authentication.source.kind!==`wallet_session`)throw Error(`Wallet-host device linking requires a reusable owner Wallet Session`);let n=e.readWalletAuthenticationState();if(n.kind!==`authenticated`)throw uK();let r=await mK(e,n.walletId);if(t.authentication.source.walletSessionId!==r.operationCredential.walletSessionId||t.authentication.source.authorizationId!==r.record.authorizationId)throw Error(`Owner Wallet Session identity changed after authorization`);return await hK(e,r,t)}async function pK(e,t){return await hK(e,await mK(e,t.walletId),t)}async function mK(e,t){let n=await e.resolveSelectedWalletAuthority(t);if(n.kind!==`resolved`)throw uK();let{selection:r,authMethod:i,authority:a}=n;if(r.lockState!==`unlocked`||r.walletId!==t||r.walletAuthMethodId!==i.walletAuthMethodId||i.walletId!==t||i.walletAuthorityId!==a.authorityId||i.status!==`active`||a.walletId!==t||a.state!==`active`)throw uK();let o=await e.walletSessions.readExactWithOperationCredential({walletId:t,authorityId:a.authorityId,authMethodId:i.walletAuthMethodId});switch(o.kind){case`found`:break;case`missing`:throw uK();case`upgrade_required`:throw new Os(`Stored owner Wallet Session requires a newer client`);default:throw Error(`Unsupported owner Wallet Session read result`)}if(o.record.authorityDigestB64u!==a.authorityDigestB64u||o.record.authorityRevocationEpoch!==a.revocationEpoch||o.record.expiresAtMs<=Date.now())throw uK();return o}async function hK(e,t,n){return await gK(e,t.operationCredential.token,n)}async function gK(e,t,n){let r=await e.http.request({method:n.method,url:`${e.baseUrl}${n.canonicalPath}`,headers:{authorization:`Bearer ${t}`},...n.body===void 0?{}:{body:n.body}});if(!r.ok)throw new sK(r.code,r.message);return r.value}function _K(e,t){let n=bK(e),r=SK(n.authentication);if(r.kind!==`link_session_authenticated_request_v1`)throw Error(`Owner authorization authentication kind is invalid`);let i=Co(r.source),a=Co(n.ownerAuthorization);vK(i,t),yK(i,a);let s={kind:`link_session_authenticated_request_v1`,source:i,proofDigestB64u:Lr(r.proofDigestB64u)},c=o(n.walletId);if(!c.ok||c.value!==t.record.walletId)throw Error(`Owner authorization wallet identity changed`);return{authentication:s,walletId:c.value,ownerAuthorization:a,sourceSignerManifest:jo(n.sourceSignerManifest),expiresAtMs:DK(n.expiresAtMs,`expiresAtMs`)}}function vK(e,t){if(e.kind!==`wallet_session`)throw Error(`Owner authorization did not return a Wallet Session source`);if(e.walletSessionId!==t.operationCredential.walletSessionId)throw Error(`Owner authorization Wallet Session id changed`);if(e.authorizationId!==t.record.authorizationId)throw Error(`Owner authorization id changed`)}function yK(e,t){if(e.kind!==`wallet_session`||t.kind!==`wallet_session`||e.walletSessionId!==t.walletSessionId||e.authorizationId!==t.authorizationId)throw Error(`Owner authorization source changed`)}function bK(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`Owner authorization response must be an object`);if(!xK(e))throw Error(`Owner authorization response has unexpected fields`);return e}function xK(e){return Object.keys(e).sort().join(`|`)===`authentication|expiresAtMs|ownerAuthorization|sourceSignerManifest|walletId`}function SK(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`Owner authorization response must be an object`);if(!CK(e))throw Error(`Owner authorization response has unexpected fields`);return e}function CK(e){return Object.keys(e).sort().join(`|`)===`kind|proofDigestB64u|source`}function wK(e){let t=TK(e.body);return t?`Owner authorization failed: ${t}`:`Owner authorization failed with HTTP ${e.status}`}function TK(e){return typeof e!=`object`||!e||Array.isArray(e)||!EK(e)||e.ok!==!1||typeof e.code!=`string`?null:typeof e.message==`string`&&e.message.trim()?e.message:null}function EK(e){return Object.keys(e).sort().join(`|`)===`code|message|ok`}function DK(e,t){if(!Number.isSafeInteger(e)||Number(e)<=0)throw Error(`${t} must be a positive safe integer`);return Number(e)}const OK=`/wallet/device-linking/v1/devices`;var kK=class extends Error{constructor(){super(`The owner Wallet Session must be renewed`),this.code=`owner_wallet_session_reauth_required`,this.name=`OwnerWalletSessionReauthRequiredError`}};function AK(e){let t=oK(e);return{linkedDeviceManagement:jK({request:e.managementRequest}),deviceLinkingPorts:t,dispose:t.dispose}}function jK(e){return{listLinkedDevices:async({walletId:t,limit:n,cursor:r})=>{let i=Ui({kind:`linked_device_list_request_v1`,walletId:t,limit:n,cursor:r}),a=`${OK}?walletId=${encodeURIComponent(String(i.walletId))}&limit=${encodeURIComponent(String(i.limit))}&cursor=${encodeURIComponent(i.cursor??``)}`,o=await e.request.request({method:`GET`,canonicalPath:a,walletId:i.walletId});return NK(o,`list linked devices`),FK(o.body)},revokeLinkedDevice:async({walletId:t,walletAuthMethodId:n,requestedAtMs:r,sourceProof:i})=>{let a=ho({kind:`linked_device_revoke_request_v1`,walletId:t,walletAuthMethodId:n,requestedAtMs:r}),o=async()=>await e.request.request({method:`POST`,canonicalPath:`${OK}/${encodeURIComponent(String(n))}/revoke`,body:{...a,sourceProof:i},walletId:t}),s;try{s=await o()}catch(e){if(!(e instanceof sK)||e.code!==`network_error`)throw e;s=await o()}return MK(s)}}}function MK(e){return e.status===404?to({kind:`not_found`}):e.status===409?to({kind:`conflict`}):e.status===401||e.status===403?to({kind:`unauthorized`}):(NK(e,`revoke linked device`),LK(e.body))}function NK(e,t){if(e.status<200||e.status>=300){if(e.status===401&&BK(e.body))throw new kK;let n=PK(e.body);throw Error(n?`linked-device ${t} failed with HTTP ${e.status}: ${n}`:`linked-device ${t} failed with HTTP ${e.status}`)}}function PK(e){return typeof e!=`object`||!e||Array.isArray(e)?null:zK(e)||BK(e)?e.message:null}function FK(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`linked-device list response must be an object`);if(!IK(e))throw Error(`linked-device list response has unexpected fields`);if(e.ok!==!0)throw Error(`linked-device list response is not successful`);return La({devices:e.devices,ownerDevices:e.ownerDevices,nextCursor:e.nextCursor})}function IK(e){return Object.keys(e).sort().join(`|`)===`devices|nextCursor|ok|ownerDevices`}function LK(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`linked-device revoke response must be an object`);if(!RK(e))throw Error(`linked-device revoke response has unexpected fields`);if(e.ok!==!0)throw Error(`linked-device revoke response is not successful`);return to({kind:e.kind,walletAuthMethodId:e.walletAuthMethodId,authorityId:e.authorityId,revocationEpoch:e.revocationEpoch})}function RK(e){return Object.keys(e).sort().join(`|`)===`authorityId|kind|ok|revocationEpoch|walletAuthMethodId`}function zK(e){return Object.keys(e).sort().join(`|`)!==`kind|message|ok`||!(`ok`in e)||!(`kind`in e)||!(`message`in e)?!1:e.ok===!1&&(e.kind===`invalid_input`||e.kind===`internal`)&&typeof e.message==`string`&&e.message.trim().length>0}function BK(e){return typeof e!=`object`||!e||Array.isArray(e)||Object.keys(e).sort().join(`|`)!==`code|kind|message|ok`||!(`ok`in e)||!(`kind`in e)||!(`code`in e)||!(`message`in e)?!1:e.ok===!1&&e.kind===`unauthorized`&&typeof e.code==`string`&&typeof e.message==`string`&&e.message.trim().length>0}function VK(e){if(typeof e!=`string`||!e.trim())throw Error(`Yao lane request JSON is required`);return e}async function HK(e){let t=await zu({ctx:e.workerCtx,kind:`walletCustodyCeremony`,request:{type:`openEd25519YaoLaneSource`,payload:{kind:`unlocked_ed25519_export_root_capability`,capability:e.capability,applicationBindingDigestB64u:e.applicationBindingDigestB64u,walletKeyId:e.walletKeyId,enrollmentId:e.enrollmentId,revocationEpoch:e.revocationEpoch,registeredPublicKeyB64u:e.registeredPublicKeyB64u}}});return new UK(e.workerCtx,t.sourceHandle)}var UK=class{#e=!1;constructor(e,t){this.workerCtx=e,this.sourceHandle=t}async discard(){this.#e||(this.#e=!0,await zu({ctx:this.workerCtx,kind:`walletCustodyCeremony`,request:{type:`discardEd25519YaoLaneSource`,payload:{sourceHandle:this.sourceHandle}}}))}async prepareSourcePreservingRegistration(e){if(this.#e)throw Error(`Ed25519 Yao lane source is already consumed`);return this.#e=!0,{requestJson:VK((await zu({ctx:this.workerCtx,kind:`walletCustodyCeremony`,request:{type:`prepareEd25519YaoSourcePreservingRegistration`,payload:{sourceHandle:this.sourceHandle,targetAdmission:e.targetAdmission,applicationBinding:e.applicationBinding,participantIds:e.participantIds,expectedRegisteredPublicKeyB64u:e.expectedRegisteredPublicKeyB64u,targetClientRecipientPublicKeyB64u:e.targetClientRecipientPublicKeyB64u}}})).requestJson)}}};function WK(e){return async({preparation:t})=>{let n=t.source.activation,r=e.readLinkedEcdsaHolderV1({materialActivation:n});if(r)return GK(r,n);let i=await e.readActiveEcdsaCapabilityManifestV1({materialActivation:n});return KK({sourceActivation:n,manifest:i}),{walletKeyId:qK(i),sourceDerivation:{applicationBindingDigestB64u:Lr(i.durableMaterial.routerAbEcdsaDerivationNormalSigning.scope.context.application_binding_digest_b64u),clientShareRetryCounter:i.durableMaterial.routerAbEcdsaDerivationNormalSigning.scope.public_identity.client_share_retry_counter,ecdsaThresholdKeyId:Qo(i.durableMaterial.roleLocalBinding.ecdsaThresholdKeyId),sourceNormalSigning:i.durableMaterial.routerAbEcdsaDerivationNormalSigning}}}}function GK(e,t){if(!b(e.materialActivation,t))throw Error(`linked ECDSA holder activation does not match preparation`);let n=e.activationReceipt.normalSigning,r=n.scope,i=Fn({walletId:e.walletId,signingRootId:r.signing_root_id,signingRootVersion:r.signing_root_version}),a=h(`wallet-key:ecdsa:${e.walletId}:${i}`);if(!a.ok)throw Error(`linked ECDSA source wallet key identity: ${a.error.message}`);return{walletKeyId:a.value,sourceDerivation:{applicationBindingDigestB64u:Lr(r.context.application_binding_digest_b64u),clientShareRetryCounter:r.public_identity.client_share_retry_counter,ecdsaThresholdKeyId:Qo(e.ecdsaThresholdKeyId),sourceNormalSigning:n},linkedHolderHandleId:e.holderHandleId}}function KK(e){if(!b(e.manifest.activation.materialActivation,e.sourceActivation))throw Error(`ECDSA capability manifest activation does not match preparation`)}function qK(e){let t=Fn({walletId:e.signer.walletId,signingRootId:e.signer.signingRootId,signingRootVersion:e.signer.signingRootVersion}),n=h(`wallet-key:ecdsa:${e.signer.walletId}:${t}`);if(!n.ok)throw Error(`ECDSA source wallet key identity: ${n.error.message}`);return n.value}function JK(e){return{produceSourceContributionV1:async({preparation:t,capability:n,authentication:r})=>{let i=await HK({workerCtx:e.workerContext,capability:n,applicationBindingDigestB64u:await ZK(t.applicationBinding),walletKeyId:String(t.walletKeyId),enrollmentId:String(t.enrollmentId),revocationEpoch:t.sourceRevocationEpoch,registeredPublicKeyB64u:t.sourceRegisteredPublicKeyB64u});try{let n=await i.prepareSourcePreservingRegistration({targetAdmission:t.targetAdmission,applicationBinding:t.applicationBinding,participantIds:t.participantIds,expectedRegisteredPublicKeyB64u:t.sourceRegisteredPublicKeyB64u,targetClientRecipientPublicKeyB64u:t.targetClientRecipientPublicKeyB64u}),a=oa(await e.executeSourcePreservingV1({linkSessionId:t.linkSessionId,sourceBinding:t.sourceBinding,targetRequestJson:n.requestJson,participantIds:t.participantIds,authentication:r}));return{kind:`linked_device_ed25519_source_contribution_v1`,keyFamily:`ed25519`,linkSessionId:t.linkSessionId,enrollmentId:t.enrollmentId,sourceAuthorityId:t.sourceAuthorityId,walletKeyId:t.walletKeyId,targetDeviceId:t.targetDeviceId,targetFactorVerificationDigestB64u:t.targetFactorVerificationDigestB64u,targetMaterialActivation:t.targetMaterialActivation,targetClientRecipientPublicKeyB64u:t.targetClientRecipientPublicKeyB64u,targetSigningWorkerRecipientPublicKeyB64u:t.targetSigningWorkerRecipientPublicKeyB64u,sourceRegisteredPublicKeyB64u:t.sourceRegisteredPublicKeyB64u,sourceBinding:t.sourceBinding,reservationId:a.reservationId,targetBinding:t.targetAdmission.binding,activationReceipt:a.activationReceipt,participantIds:a.participantIds,deriver_a_client_package:a.deriver_a_client_package,deriver_b_client_package:a.deriver_b_client_package}}finally{await i.discard()}}}}function YK(e){return{ed25519:e.ed25519,ecdsa:{produceSourceContributionV1:async({preparation:t})=>await XK({workerContext:e.workerContext,readMetadataV1:e.readEcdsaMetadataV1,preparation:t})}}}async function XK(e){let t=await e.readMetadataV1({preparation:e.preparation}),n=await wd({preparation:e.preparation,workerCtx:e.workerContext,...t.linkedHolderHandleId===void 0?{}:{linkedHolderHandleId:t.linkedHolderHandleId}});return{kind:`linked_device_ecdsa_source_contribution_v1`,keyFamily:`ecdsa_secp256k1`,linkSessionId:e.preparation.linkSessionId,enrollmentId:e.preparation.enrollmentId,sourceAuthorityId:e.preparation.sourceAuthorityId,walletKeyId:t.walletKeyId,targetDeviceId:e.preparation.target.targetDeviceId,targetFactorVerificationDigestB64u:e.preparation.target.targetFactorVerificationDigestB64u,sourceSigner:e.preparation.source,sourceDerivation:t.sourceDerivation,target:e.preparation.target,package:n.package}}async function ZK(e){return F(Uint8Array.from(await io(e)))}const QK=[`delivery`,`challengeId`,`otpCode`,`resend`,`webauthn`,`webauthnRegistration`,`webauthn_registration`,`authenticatorOptions`,`publicKey`,`passkey`,`passkeyPrfFirstB64u`],$K=[`recoveryKeys`,`recoveryCodes`,`bootstrap`,`bootstrapMaterial`,`clientSecret32`];function eq(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive integer timestamp`);return e}function tq(e,t,n){let r=t.find(t=>Object.prototype.hasOwnProperty.call(e,t));if(r)throw Error(`${n} must not include ${r}`)}function nq(e){return M(e,`offerId`)}function rq(e,t=`candidateId`){return M(e,t)}function iq(e){let t=E(e,`registration candidate`);return tq(t,QK,`registration candidate`),tq(t,$K,`registration candidate`),{candidateId:rq(t.candidateId),walletId:Uo(M(t.walletId,`candidate.walletId`))}}function aq(e){let t=E(e,`Google Email OTP registration offer`);if(tq(t,QK,`Google Email OTP registration offer`),tq(t,$K,`Google Email OTP registration offer`),t.kind!==`google_email_otp_registration_offer_v1`)throw Error(`registration offer kind must be google_email_otp_registration_offer_v1`);if(!Array.isArray(t.candidates)||t.candidates.length<1)throw Error(`registration offer must include at least one candidate`);let n=t.candidates.map(iq),r=rq(t.selectedCandidateId,`selectedCandidateId`);if(!n.some(e=>e.candidateId===r))throw Error(`selectedCandidateId must refer to an offered candidate`);let[i,...a]=n;return{kind:`google_email_otp_registration_offer_v1`,offerId:nq(t.offerId),expiresAtMs:eq(t.expiresAtMs,`expiresAtMs`),emailHint:M(t.emailHint,`emailHint`),candidates:[i,...a],selectedCandidateId:r}}function oq(e){return{ok:!0,value:e}}function sq(e,t){let n=t instanceof Error&&t.message?t.message:String(t||e),r=t&&typeof t==`object`&&`retryAfterMs`in t?Number(t.retryAfterMs):NaN;return{ok:!1,error:{code:e,message:n,...Number.isFinite(r)&&r>=0?{retryAfterMs:Math.floor(r)}:{}}}}function cq(e,t,n){let r=sq(e,n);return r.ok?r:{ok:!1,error:{...r.error,message:t}}}function lq(e){let t=e&&typeof e==`object`&&`code`in e?String(e.code||``):``;if(t.includes(`rate`))return`email_otp_rate_limited`;if(t.includes(`expired`))return`email_otp_expired`;if(t.includes(`invalid`)||t.includes(`otp`))return`email_otp_invalid_code`;let n=e instanceof Error?e.message.toLowerCase():``;return n.includes(`backup`)?`recovery_code_backup_incomplete`:n.includes(`expired`)?`email_otp_expired`:n.includes(`invalid`)||n.includes(`code`)?`email_otp_invalid_code`:`unlock_failed`}function uq(e){if((e&&typeof e==`object`&&`code`in e?String(e.code||``):``)===`already_finalized_restore_required`)return`registration_restore_required`;let t=e instanceof Error?e.message.toLowerCase():``;return t.includes(`already finalized`)||t.includes(`restore or unlock`)?`registration_restore_required`:t.includes(`backup`)?`recovery_code_backup_incomplete`:t.includes(`expired`)?`flow_expired`:`registration_failed`}function dq(e){let t=String(e.walletId||``).trim();if(!t)throw Error(`Google verification did not return a wallet id`);return Uo(t)}function fq(e){let t=String(e.providerSubject||``).trim();if(!t)throw Error(`Google verification did not return a provider subject`);return t}function pq(e){let t=String(e.email||``).trim();if(!t)throw Error(`Google verification did not return an email address`);return t}function mq(e){let t=typeof e==`number`?e:typeof e==`string`?Date.parse(e):NaN;return Number.isFinite(t)&&t>Date.now()?t:Date.now()+6e5}function hq(e){let t=typeof e==`number`?e:typeof e==`string`?Date.parse(e):NaN;if(!Number.isFinite(t)||t<=Date.now())throw Error(`Google Email OTP registration offer is expired or missing expiry`);return Math.floor(t)}function gq(e){return e.mode===`register`?{title:`Create your Email OTP wallet`,description:`Google verified ${e.emailHint}.`,submitLabel:`Create wallet`,helperText:``}:{title:`Check your email to unlock your wallet`,description:`Enter the 6-digit code we sent to ${e.emailHint}.`,submitLabel:`Unlock wallet`,helperText:``}}function _q(e){return e===`register_started`?`register`:`login`}function vq(e){if(!e||typeof e!=`object`||!(`code`in e))return!1;let t=String(e.code||``).trim(),n=e instanceof Error?e.message:String(e.message||``).trim();return t===`not_found`&&/Email OTP enrollment not found/i.test(n)}function yq(){return`Account doesn't exist. Create your account to continue.`}function bq(e){return!e||typeof e!=`object`||!(`code`in e)?`google_verification_failed`:Reflect.get(e,`code`)===`stale_identity_mapping`?`google_account_registration_required`:`google_verification_failed`}function xq(e,t){if(e.replaceExistingWallet===!0&&t!==`register`)throw Error(`replaceExistingWallet is only valid with register mode`);return{idToken:e.idToken,accountMode:t,relayUrl:e.relayUrl,restartRegistrationOffer:t===`register`&&e.replaceExistingWallet===!0,...e.mode===`login`&&e.loginTarget.kind===`wallet`?{loginWalletId:String(e.loginTarget.walletId)}:{}}}function Sq(e){return e.providerSubject.toLowerCase()===e.verifiedEmail.toLowerCase()?`email`:`google`}async function Cq(e){return await e.deps.resolveGoogleEmailOtpProvider(xq(e.input,e.input.mode))}function wq(e){let t=e.authInput.mode===`login`&&e.authInput.loginTarget.kind===`wallet`?Uo(String(e.authInput.loginTarget.walletId)):dq(e.resolution),n=pq(e.resolution),r=e.resolution,i=_q(r.mode),a=r.mode===`register_started`?aq({kind:`google_email_otp_registration_offer_v1`,offerId:r?.offer?.offerId,expiresAtMs:hq(r.expiresAtMs),emailHint:n,candidates:r?.offer?.candidates,selectedCandidateId:r?.offer?.selectedCandidateId}):void 0;return{walletId:a?Dq(a).walletId:t,...a?{offer:a}:{},providerSubject:fq(e.resolution),emailHint:n,requestedMode:e.authInput.mode,mode:i,expiresAtMs:r.mode===`register_started`?hq(r.expiresAtMs):mq(void 0),...r.mode===`register_started`?{registrationAttemptId:r.registrationAttemptId}:{}}}async function Tq(e){if(e.state.mode!==`login`||!e.deps.resolveLinkedEmailOtpWalletAuth)return e.state;let t=await e.deps.resolveLinkedEmailOtpWalletAuth({walletId:String(e.state.walletId),email:e.state.emailHint,provider:Sq({providerSubject:e.state.providerSubject,verifiedEmail:e.state.emailHint}),providerSubjectId:e.state.providerSubject});switch(t.kind){case`none`:return e.state;case`selected`:return{...e.state,linkedEmailOtpSelection:t};case`rejected`:throw Error(t.message);default:throw Error(`Google Email OTP linked auth selection is invalid`)}}function Eq(e){let t=e.offer.candidates.findIndex(t=>t.walletId===e.currentWalletId);return t<0||e.offer.candidates.length<2?null:e.offer.candidates[(t+1)%e.offer.candidates.length]||null}function Dq(e){let t=e.candidates.find(t=>t.candidateId===e.selectedCandidateId);if(!t)throw Error(`Google Email OTP registration offer selected candidate is missing`);return t}async function Oq(e){let t=await e.deps.requestEmailOtpChallenge({walletId:e.state.walletId,...e.state.linkedEmailOtpSelection?{walletAuthMethodId:e.state.linkedEmailOtpSelection.walletAuthMethodId}:{},...e.relayUrl?{relayUrl:e.relayUrl}:{},...e.onEvent?{onEvent:e.onEvent}:{}});return{challengeId:t.challengeId,emailHint:t.delivery.emailHint,delivery:t.delivery,walletAuthMethodId:t.walletAuthMethodId,signerSelection:t.signerSelection}}function kq(e){switch(e.delivery.kind){case`provider`:return;case`demo_code_response`:case`provider_and_demo_code`:e.onDemoOtp?.(e.delivery);return}}function Aq(e){let t=e.policy||{kind:`configured`};return t.kind===`none`?[]:t.kind===`explicit`?t.targets:ge({signerOptions:e.configs.signing.thresholdEcdsa.provisioningDefaults,chains:e.configs.network.chains}).map(e=>e.chainTarget)}function jq(e){let t=e.policy||{kind:`configured`};return t.kind===`none`?[]:t.kind===`explicit`?t.targets:Xe(e.configs.network.chains).map(e=>e.chainTarget)}function Mq(e){return{...e.onEvent?{onEvent:e.onEvent}:{},...e.recoveryCodeBackup?{recoveryCodeBackup:e.recoveryCodeBackup}:{}}}function Nq(e){let t=Math.floor(Number(e.signing.sessionDefaults?.remainingUses)||0);return t<=0?Mn:Math.min(t,Mn)}async function Pq(e){let t=Ur({walletId:e.state.walletId}),n={kind:`wallet_auth_method`,walletAuthMethodId:e.challenge.walletAuthMethodId},[r]=e.targets;if(!r){if(e.challenge.signerSelection.kind!==`ed25519_only`)throw Error(`Selected Email OTP authority requires an ECDSA chain target`);await e.deps.loginWithEmailOtpEd25519YaoCapability({walletSession:t,authoritySelector:n,providerSubjectId:e.state.providerSubject,emailOtpAuthorityEmail:e.state.emailHint,challengeId:e.challenge.challengeId,otpCode:e.otpCode,remainingUses:Nq(e.deps.configs),ed25519Selection:e.challenge.signerSelection});return}let i={walletSession:t,walletAuthMethodId:n.walletAuthMethodId,providerIdentity:{provider:Sq({providerSubject:e.state.providerSubject,verifiedEmail:e.state.emailHint}),providerSubjectId:e.state.providerSubject},challengeId:e.challenge.challengeId,emailOtpAuthorityEmail:e.state.emailHint,otpCode:e.otpCode,...e.input.relayUrl?{relayUrl:e.input.relayUrl}:{},...e.input.emailOtpAuthPolicy?{emailOtpAuthPolicy:e.input.emailOtpAuthPolicy}:{},...e.input.onEvent?{onEvent:e.input.onEvent}:{}};if(e.challenge.signerSelection.kind!==`ecdsa`)throw Error(`Selected Email OTP authority has no ECDSA signer`);await e.deps.loginWithEmailOtpEcdsaCapability({...i,chainTarget:r,publicationChainTargets:e.targets,keyHandle:e.challenge.signerSelection.keyHandle,ed25519Selection:e.challenge.signerSelection.ed25519})}function Fq(e){return{...e.options,signerOptions:{tempo:{enabled:!1,signingSession:{kind:`jwt`,ttlMs:0,remainingUses:0}},evm:{enabled:!1,signingSession:{kind:`jwt`,ttlMs:0,remainingUses:0}}}}}async function Iq(e,t){let n=await e.getWalletSession(t);if(n.appIdentity.kind!==`resolved`||String(n.appIdentity.walletId)!==String(t)||n.authentication.kind!==`authenticated`||String(n.authentication.walletId)!==String(t))throw Error(`Wallet auth completed, but the local signing session is not ready yet.`);return n}async function Lq(e,t){let n=await e.getWalletSession(t);if(n.appIdentity.kind!==`resolved`||String(n.appIdentity.walletId)!==String(t))throw Error(`Wallet registration completed, but the local wallet identity is not ready.`);return n}function Rq(e){return{kind:`started`,completion:e.prewarmEmailOtpYao().catch(()=>void 0)}}async function zq(e,t){let n;try{n=wq({authInput:t,resolution:await Cq({deps:e,input:t})}),n=await Tq({deps:e,state:n})}catch(e){return sq(bq(e),e)}if(n.mode===`register`)return oq(Hq(e,{state:n,input:t,prewarm:{kind:`not_started`}}));try{let r=await Oq({deps:e,state:n,...t.relayUrl?{relayUrl:t.relayUrl}:{},...t.onEvent?{onEvent:t.onEvent}:{}});return oq(Uq(e,{state:n,challenge:r,input:t}))}catch(e){return vq(e)?cq(`google_account_registration_required`,yq(),e):sq(`email_otp_challenge_failed`,e)}}function Bq(e){let t=!0;return{ensureActive(){if(!t)throw Error(`Google Email OTP wallet auth flow is no longer active`);if(Date.now()>e.state.expiresAtMs)throw t=!1,Error(`Google Email OTP wallet auth flow expired`)},burn(){t=!1}}}function Vq(e){return String(e.input.relayUrl||e.deps.configs.network.relayer?.url||``).trim()}function Hq(e,t){let n=String(t.state.registrationAttemptId||``).trim();if(!n)throw Error(`Google Email OTP registration requires a registration attempt id`);if(!t.state.offer)throw Error(`Google Email OTP registration requires an offer`);let r=t.state.offer,i=Aq({configs:e.configs,policy:t.input.ecdsaTargets}),a=Mq({onEvent:t.input.onEvent,recoveryCodeBackup:t.input.recoveryCodeBackup}),o=i.length?a:Fq({options:a}),s=Dq(r).walletId,c={kind:`email_otp`,proofKind:`google_sso_registration`,email:t.state.emailHint,providerSubject:t.state.providerSubject,googleEmailOtpRegistrationAttemptId:n,googleEmailOtpRegistrationOfferId:r.offerId,googleEmailOtpRegistrationCandidateId:r.selectedCandidateId},l={wallet:{kind:`provided`,walletId:s},authMethod:c,signerSelection:t.input.signerSelection??HH({configs:e.configs,options:o,ecdsaChainTargets:i}),options:o},u=t.prewarm.kind===`not_started`?Rq(e):t.prewarm,d=Bq({state:t.state});return{kind:`google_email_otp_wallet_auth_flow_v1`,state:`registration_ready`,flowId:`google-email-otp-registration:${s}:${n}`,requestedMode:t.state.requestedMode,mode:`register`,walletId:s,emailHint:t.state.emailHint,prompt:gq({mode:`register`,emailHint:t.state.emailHint}),expiresAtMs:t.state.expiresAtMs,completeRegistration:async()=>{try{d.ensureActive();let t=await e.registerWallet(l);if(!t.success){let e=Object.assign(Error(t.error||`Wallet registration failed`),{code:t.errorCode});return sq(uq(e),e)}return d.burn(),oq({walletId:s,mode:`register`,session:await Lq(e,s),registration:t})}catch(e){return sq(uq(e),e)}},rerollWalletId:async()=>{try{if(d.ensureActive(),!t.state.offer)return sq(`google_verification_failed`,Error(`Google Email OTP registration offer is missing wallet candidates`));let n=Eq({offer:t.state.offer,currentWalletId:s});return n?(d.burn(),oq(Hq(e,{state:{...t.state,walletId:n.walletId,offer:{...t.state.offer,selectedCandidateId:n.candidateId}},input:t.input,prewarm:u}))):sq(`google_verification_failed`,Error(`Google Email OTP registration offer has no alternate wallet candidate`))}catch(e){return sq(`google_verification_failed`,e)}},cancel:async()=>{d.burn()}}}function Uq(e,t){let n=Bq({state:t.state}),r=`google-email-otp-login:${t.state.walletId}:${t.challenge.challengeId}`;return kq({delivery:t.challenge.delivery,onDemoOtp:t.input.onDemoOtp}),{kind:`google_email_otp_wallet_auth_flow_v1`,state:`challenge_sent`,flowId:r,requestedMode:t.state.requestedMode,mode:`login`,walletId:t.state.walletId,emailHint:t.challenge.emailHint,prompt:gq({mode:`login`,emailHint:t.challenge.emailHint}),delivery:t.challenge.delivery,expiresAtMs:t.state.expiresAtMs,resend:async()=>{try{n.ensureActive();let r=await Oq({deps:e,state:t.state,...t.input.relayUrl?{relayUrl:t.input.relayUrl}:{},...t.input.onEvent?{onEvent:t.input.onEvent}:{}});return n.burn(),oq(Uq(e,{state:t.state,challenge:r,input:t.input}))}catch(e){return sq(`email_otp_challenge_failed`,e)}},submit:async r=>{try{n.ensureActive();let i=String(r.otpCode||``).trim();if(!/^\d{6}$/.test(i))return sq(`email_otp_invalid_code`,Error(`Enter the 6-digit code from your email.`));let a=jq({configs:e.configs,policy:t.input.ecdsaTargets}),o=t.challenge.signerSelection.kind===`ed25519_only`?[]:a;if(t.state.linkedEmailOtpSelection?.execution===`authority`){if(!e.loginWithLinkedEmailOtpWallet)throw Error(`Exact linked Email OTP wallet unlock is unavailable`);await e.loginWithLinkedEmailOtpWallet({walletId:String(t.state.walletId),walletAuthMethodId:t.state.linkedEmailOtpSelection.walletAuthMethodId,email:t.state.emailHint,providerSubjectId:t.state.providerSubject,challengeId:t.challenge.challengeId,otpCode:i,relayUrl:Vq({deps:e,input:t.input})})}else await Pq({deps:e,state:t.state,input:t.input,challenge:t.challenge,otpCode:i,targets:o});n.burn();let s=await Iq(e,t.state.walletId);return oq({walletId:t.state.walletId,mode:`login`,session:s})}catch(e){return sq(lq(e),e)}},cancel:async()=>{n.burn()}}}async function Wq(e){let t=Hs(),n=new Uint8Array(e.factorSecret.slice(0));try{return await Kq(e,t,t=>{let r=Vt(e.custodyEnvelope);if(!r.ok)throw Error(r.reason);return e.worker.rotateRecoverySet({custodyJson:r.custodyJson,factorSecret:n.buffer.slice(0),recoveryCodesJson:qq(t)})})}finally{n.fill(0),t&&Is(t),t=null}}async function Gq(e){let t=Hs();try{return await Kq(e,t,t=>e.worker.rotateRecoverySet({recoveryCodesJson:qq(t)}))}finally{t&&Is(t),t=null}}async function Kq(e,t,n){let r=await ep({relayUrl:e.relayUrl,walletId:e.walletId,...e.fetchImpl?{fetchImpl:e.fetchImpl}:{}});if(r.kind!==`ready`)return r.kind===`unauthorized`?{kind:`transport_failed`,message:r.message}:r;let i=zs(await n(t.codeBytes));if(i.walletId!==e.walletId)throw Error(`Recovery rotation worker returned a different wallet`);let a=await Jq(t.codeBytes,i.manifestKekWraps),o=await $f({relayUrl:e.relayUrl,walletId:e.walletId,factorProof:await e.factorProof({operation:`recovery_rotate`,payload:{walletId:e.walletId,expectedStoreVersion:r.storeVersion,manifestKekWraps:i.manifestKekWraps,entries:[i.entry],recoveryCodeLocators:a}}),expectedStoreVersion:r.storeVersion,replacement:i,recoveryCodeLocators:a,...e.fetchImpl?{fetchImpl:e.fetchImpl}:{}});return o.kind===`rotated`?{kind:`rotated`,walletId:e.walletId,recoveryCodes:t.codes,issuedAtMs:o.issuedAtMs,storeVersion:o.storeVersion}:o}function qq(e){return JSON.stringify(e.map(e=>({codeBytesB64u:F(e)})))}async function Jq(e,t){if(e.length!==t.length)throw Error(`Recovery code locators do not match the replacement wraps`);let n=await Promise.all(e.map(async(e,n)=>{let r=t[n];if(!r)throw Error(`Recovery code locators do not match the replacement wraps`);return{locatorB64u:await Bs(e),recoveryKeyId:r.recoveryKeyId}}));if(new Set(n.map(e=>e.locatorB64u)).size!==n.length)throw Error(`Recovery code locators must be unique`);return n}function Yq(e){return Array.isArray(e)?e.filter(e=>{switch(e){case`ble`:case`hybrid`:case`internal`:case`nfc`:case`smart-card`:case`usb`:return!0;default:return!1}}):[]}function Xq(e){let t=e.flatMap(e=>{let t=String(e.credentialId||``).trim();return t?[{id:t,type:`public-key`,transports:Yq(e.transports)}]:[]});if(t.length===0)throw Error(`Wallet recovery-code rotation requires an active passkey`);return t}async function Zq(e){let t=await fetch(a(e.relayUrl,`/wallet/unlock/challenge`),{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({unlockBackend:`passkey`,userId:e.walletId,rpId:e.rpId})}),n=await t.json().catch(()=>({})),r=n&&typeof n==`object`&&!Array.isArray(n)?n:{};if(!t.ok||r.ok!==!0)throw Error(typeof r.message==`string`?r.message:`passkey envelope challenge failed`);let i=typeof r.challengeId==`string`?r.challengeId.trim():``,o=typeof r.challengeB64u==`string`?r.challengeB64u.trim():``;if(!i||!o)throw Error(`passkey envelope challenge is invalid`);return{challengeId:i,challengeB64u:o}}async function Qq(e){let t=String(e.context.signingEngine.getRpId()||``).trim();if(!t)throw Error(`Wallet recovery-code rotation requires an RP ID`);let n=typeof window>`u`?``:window.location.origin;if(!n)throw Error(`Wallet recovery-code rotation requires a browser Origin`);let r=Xq(await K.listProfileAuthenticators(e.walletId)),i=await Zq({relayUrl:e.relayUrl,walletId:e.walletId,rpId:t}),a=await e.context.signingEngine.getAuthenticationCredentialsSerialized({subjectId:e.walletId,challengeB64u:i.challengeB64u,allowCredentials:r,includeSecondPrfOutput:!0}),o=st(a);if(!o)throw Error(`Wallet recovery-code rotation did not receive a passkey credential`);let s=await Zj({relayUrl:e.relayUrl,locator:{walletId:e.walletId,factor:{kind:`passkey`,rpId:t,credentialIdB64u:o}},challengeId:i.challengeId,expectedOrigin:n,webauthnAuthentication:hc(a)});if(s.kind!==`active`)throw Error(s.message);let c=s.envelope,l=I(Le(a,`Wallet recovery-code rotation`));try{let i=e.context.signingEngine.getSignerWorkerContext();return await Wq({relayUrl:e.relayUrl,walletId:e.walletId,factorProof:async({operation:i,payload:a})=>{let s=await Nc({walletId:e.walletId,operation:i,payload:a,requestOrigin:n}),c=await e.context.signingEngine.getAuthenticationCredentialsSerialized({subjectId:e.walletId,challengeB64u:s,allowCredentials:r,includeSecondPrfOutput:!1}),l=st(c);if(!l||l!==o)throw Error(`Wallet recovery-code rotation selected an unrelated passkey`);return{kind:`passkey`,walletId:e.walletId,rpId:t,credentialIdB64u:o,challenge_digest:s,webauthn_authentication:c}},custodyEnvelope:c,factorSecret:l.buffer,worker:{rotateRecoverySet:async e=>await i.requestWorkerOperation({kind:`walletCustodyCeremony`,request:{type:`rotateWalletRecoverySet`,timeoutMs:3e4,payload:e,transfer:[e.factorSecret]}})}})}finally{l.fill(0)}}async function $q(e){let t=e.context.signingEngine.getSignerWorkerContext(),n=ml({routeFamily:`login`,operation:Jr});return await Gq({relayUrl:e.relayUrl,walletId:e.walletId,factorProof:async({operation:t,payload:n})=>{let r=typeof window>`u`?``:window.location.origin,i=await tp({relayUrl:e.relayUrl,walletId:e.walletId,providerSubjectId:e.authorization.providerSubjectId,operation:t,payload:n,...r?{requestOrigin:r}:{}});if(i.kind!==`ready`)throw Error(i.message);let a=await Nc({walletId:e.walletId,operation:t,payload:n,requestOrigin:r});if(i.challengeId!==e.authorization.challengeId||i.challenge_digest!==e.authorization.challenge_digest||a!==e.authorization.challenge_digest)throw Error(`Wallet recovery Email OTP challenge is bound to a different operation`);return{kind:`email_otp`,provider_subject_id:e.authorization.providerSubjectId,challenge_id:e.authorization.challengeId,otp_code:e.authorization.otpCode,challenge_digest:a}},worker:{rotateRecoverySet:async({recoveryCodesJson:r})=>await t.requestWorkerOperation({kind:`emailOtp`,request:{type:`rotateEmailOtpWalletRecoverySet`,timeoutMs:6e4,payload:{relayUrl:e.relayUrl,walletId:e.walletId,userId:e.walletId,groupId:Ns,routePlan:n,verification:{kind:`otp`,challengeId:e.authorization.challengeId,otpCode:e.authorization.otpCode},recoveryCodesJson:r}}})}})}async function eJ(e){switch(e.authorization.kind){case`existing_passkey`:return await Qq(e);case`email_otp`:return await $q({...e,authorization:e.authorization})}}async function tJ(e,t){if(e.kind===`device_link`)return`authority`;let n=await K.listPendingWalletRegistrationCommits();for(let e of n)if(e.operation===`near_provisioning`&&e.signerPlanKind===`near_ed25519_and_evm_family_ecdsa`&&e.walletAuthMethodId===t)return`authority`;return`ordinary`}function nJ(e){let t=c(e);if(!t.ok)throw Error(`Email OTP unlock returned an invalid wallet auth method id`);return t.value}function rJ(e){let t=e.recovery.verifiedAuthorityProjection.authority,n=or({kind:`wallet_auth_authority_ref`,walletId:t.walletId,walletAuthMethodId:e.authorization.record.authMethodId,authorityDigest:t.authorityDigestB64u});if(!n)throw Error(`Email OTP unlock returned an invalid authority reference`);return n}function iJ(){return typeof performance<`u`&&typeof performance.now==`function`?performance.now():Date.now()}function aJ(){return{emailOtpProofVerificationMs:0,walletUnlockExchangeMs:0,ecdsaMaterialRestoreMs:0,signingSessionSealApplyMs:0,warmCapabilityPersistenceMs:0,activeRuntimeConstructionMs:0,emailHashLookupMs:0,workerUnlockAndSessionBootstrapMs:0,walletStateActivationMs:0,runtimePostconditionMs:0,walletIframeRoundTripMs:0}}function oJ(e,t,n){cJ(e,t,iJ()-n)}function sJ(e,t,n){cJ(e,t,n)}function cJ(e,t,n){let r=Math.max(0,Math.round(n));e[t]+=r,lJ()&&console.info(`[EmailOtpUnlock] timing`,{bucket:t,deltaMs:r,accumulatedMs:e[t]})}function lJ(){return Reflect.get(globalThis,`__SEAMS_EMAIL_OTP_UNLOCK_DIAGNOSTICS`)===!0}function uJ(e){if(!lJ())return;let t=Object.entries(e.timings).filter(([,e])=>e>0).sort((e,t)=>t[1]-e[1]).slice(0,5).map(([e,t])=>({bucket:e,durationMs:t})),n=e.error instanceof Error?e.error.message:e.error?String(e.error):``,r={kind:`email_otp_unlock_timing_summary_v1`,status:e.status,mode:e.mode,walletId:e.walletId,prewarm:e.prewarm,...e.chainTarget?{chainTarget:e.chainTarget}:{},totalElapsedMs:Math.max(0,Math.round(iJ()-e.startedAtMs)),timings:e.timings,topBuckets:t,...n?{errorMessage:n}:{}};console.info(`[EmailOtpUnlock] timing summary`,r)}function dJ(e){return e?{kind:`near_account_bound`,walletId:String(e.wallet.walletId),nearAccountId:String(e.nearAccountId)}:{kind:`global`}}function fJ(e){return e?.iframe?{kind:`iframe_and_local_resources`}:e?.workers?{kind:`local_worker_resources`}:null}function pJ(e){if(e.record.kind===`none`)return{kind:`not_prewarmed`};let t=e.record.scope;return{kind:`prewarm_attempted`,status:e.record.status,completedAtMs:e.record.completedAtMs,ageMs:Math.max(0,Math.round(e.nowMs-e.record.completedAtMs)),request:e.record.request,scope:t,walletMatches:t.kind===`global`||t.walletId===e.walletId}}function mJ(e){return{kind:`email_otp_unlock_active_runtime_state_v1`,inventory:e}}function hJ(e){if(e.result.authorization.record.walletId!==e.walletSession.walletId)throw Error(`Email OTP unlock authorization does not match the wallet session`);return{kind:`email_otp_unlock_activation_plan_v1`,mode:`evm_family_ecdsa`,activeAuthorization:e.result.authorization,authorizations:e.result.authorizations,runtimeState:mJ(e.runtimeInventory)}}function gJ(e){lJ()&&console.info(`[EmailOtpUnlock] activation plan constructed`,{kind:e.kind,mode:e.mode,walletId:e.activeAuthorization.record.walletId,authorityDigest:e.activeAuthorization.record.authorityDigestB64u,walletSessionIds:e.authorizations.map(e=>e.operationCredential.walletSessionId),runtimeTargetCount:e.runtimeState.inventory.ecdsaByTarget.size})}function _J(e){return e.length===64&&/^[0-9a-f]+$/i.test(e)?`implicit_near_account`:`named_near_account`}function vJ(e){let t=String(e.walletId||``).trim(),n=String(e.nearAccountId||``).trim();if(!t||!n)throw Error(`[SeamsWeb] ${e.operation} requires walletId and nearAccountId`);let r=ta({kind:_J(n),wallet:{walletId:t},nearAccountId:n});if(!r.ok)throw Error(`[SeamsWeb] ${e.operation} requires a valid NEAR account binding`);return r.value}function yJ(e){let t=String(e?.walletId||``).trim(),n=String(e?.nearAccountId||``).trim();if(!(!t&&!n))return vJ({walletId:t,nearAccountId:n,operation:`prewarm`})}function bJ(e,t){if(!j(e))throw Error(`[SeamsWeb] ${t} requires a concrete ECDSA chainTarget`);return Rr(e)}function xJ(e){switch(e.kind){case`ecdsa`:return{kind:`ecdsa`,walletSession:Ur(e.walletSession),chainTarget:Rr(e.chainTarget)};case`ed25519`:return{kind:`ed25519`,walletSession:Ur(e.walletSession),nearAccount:Br(e.nearAccount.accountId)}}}function SJ(e){switch(e.kind){case`relink_required`:return{kind:`relink_required`,reason:e.reason};case`ecdsa`:return{kind:`ecdsa`,laneIdentity:Wc(e.laneIdentity)};case`ed25519`:{let t=p(e.materialActivation);if(!t.ok)throw Error(t.error.message);return{kind:`ed25519`,laneIdentity:Vc(e.laneIdentity),materialActivation:t.value}}}}function CJ(e,t){let n={...e.options,theme:e.options.theme??t};switch(e.kind){case`ecdsa`:{let t=Wc(e.laneIdentity);if(String(t.signer.walletId)!==String(e.walletSession.walletId))throw Error(`[SeamsWeb] key export lane wallet does not match wallet session`);if(!Vr(t.signer.chainTarget,e.chainTarget))throw Error(`[SeamsWeb] key export lane chain target does not match request target`);return{kind:`ecdsa`,chainTarget:e.chainTarget,walletSession:e.walletSession,laneIdentity:t,options:n}}case`ed25519`:{let t=Vc(e.laneIdentity),r=p(e.materialActivation);if(!r.ok)throw Error(r.error.message);if(String(t.signer.account.wallet.walletId)!==String(e.walletSession.walletId))throw Error(`[SeamsWeb] Ed25519 export lane wallet does not match wallet session`);if(String(t.signer.account.nearAccountId)!==String(e.nearAccount.accountId))throw Error(`[SeamsWeb] Ed25519 export lane does not match the NEAR account`);return{kind:`ed25519`,nearAccount:Br(e.nearAccount.accountId),walletSession:e.walletSession,laneIdentity:t,materialActivation:r.value,options:n}}}}function wJ(e,t){let n=t;return{theme:Ou({value:n.theme,fallback:e.theme,legacyTokens:n.tokens}),palette:ku({value:n.palette,fallback:e.palette})}}function TJ(e){return e?.kind===`wallet_host`?`wallet_host`:`application`}function EJ(e){switch(e.mode){case`wallet_host`:return{kind:`signing_engine`,source:e.signingEngine};case`application`:return{kind:`wallet_iframe`,source:e.walletIframe}}}function DJ(e,t){switch(e.kind){case`signing_engine`:case`wallet_iframe`:return e.source.onSdkLifecycleEvent(t)}}function OJ(e,t){t.event===`registration.near_provisioning_changed`&&e(t)}function kJ(e){switch(e.kind){case`completed`:return;case`pending`:console.warn(`[SeamsWeb] pending wallet recovery replay remains pending:`,e.recoveryOperationId,e.failure);return;case`discarded`:console.warn(`[SeamsWeb] pending wallet recovery was refused and discarded:`,e.recoveryOperationId);return;case`corrupt`:console.warn(`[SeamsWeb] pending wallet recovery replay record is corrupt:`,e.recoveryOperationId);return}}const AJ=new gs;function jJ(e){switch(e.mode){case`application`:return{domain:{kind:`iframe`,linkedDeviceManagement:JV({walletIframe:e.walletIframe})},resumePendingAcknowledgementsV1:NJ,dispose:MJ};case`wallet_host`:{let t=AK({authenticator:e.platform.authenticator,http:e.platform.http,relayerUrl:String(e.configs.network.relayer?.url||``).trim(),publishableKey:e.configs.registration.publishableKey,projectEnvironmentId:e.configs.registration.projectEnvironmentId,ownerRequest:e.ownerAuthorities.ownerRequest,ownerApprovalUpdates:IJ({request:e.ownerAuthorities.ownerRequest,pollIntervalMs:1e3}),ownerAuthorization:e.ownerAuthorities.ownerAuthorization,sourceContribution:e.sourceContribution,custodyCeremonyTransport:en(e.signingEngine.getSignerWorkerContext()),managementRequest:e.ownerAuthorities.managementRequest,nowMs:Date.now,pollIntervalMs:1e3});return{domain:{kind:`direct`,linkedDeviceManagement:t.linkedDeviceManagement,deviceLinkingPorts:t.deviceLinkingPorts},resumePendingAcknowledgementsV1:t.deviceLinkingPorts.resumePendingAcknowledgementsV1,dispose:t.dispose}}}}function MJ(){}async function NJ(){}function PJ(e){e().catch(FJ)}function FJ(e){console.warn(`[SeamsWeb] pending linked-device acknowledgement replay failed:`,e instanceof Error?e.message:String(e||`unknown error`))}function IJ(e){return{getApprovalV1:async t=>await BJ(e.request,t),subscribeApprovalV1:async t=>VJ({...e,input:t})}}function LJ(e){return WK({readActiveEcdsaCapabilityManifestV1:async({materialActivation:t})=>{let n=e.signingEngine.readWalletAuthenticationState();if(n.kind!==`authenticated`)throw Error(`ECDSA source metadata requires an authenticated wallet`);let r=await AJ.lookupByMaterialActivation({walletId:n.walletId,materialActivation:t});if(r.kind===`ambiguous_authority`&&(r=await Sk({walletId:n.walletId,materialActivation:t,authorities:r.authorities})),r.kind!==`active`)throw Error(`ECDSA source metadata manifest is ${r.kind}`);return r.manifest},readLinkedEcdsaHolderV1:({materialActivation:t})=>{let n=e.signingEngine.readWalletAuthenticationState();return n.kind===`authenticated`?Ud({walletId:n.walletId,materialActivation:t}):null}})}function RJ(e){let t=String(e.configs.network.relayer?.url||``).trim(),n=TP(e.signingEngine.getSignerWorkerContext()),r=cK({http:n.http,relayerUrl:t,walletSessions:G,resolveSelectedWalletAuthority:K.resolveSelectedWalletAuthority.bind(K),readWalletAuthenticationState:e.signingEngine.readWalletAuthenticationState.bind(e.signingEngine),readUnlockedEd25519ExportRootCapabilityV1:jt});return{platform:n,ownerAuthorities:r,sourceContribution:zJ({signingEngine:e.signingEngine,ownerRequest:r.ownerRequest,readEcdsaMetadataV1:LJ({signingEngine:e.signingEngine})})}}function zJ(e){let t=e.signingEngine.getSignerWorkerContext();return YK({workerContext:t,ed25519:JK({workerContext:t,executeSourcePreservingV1:async({linkSessionId:t,targetRequestJson:n,authentication:r})=>{let i=await e.ownerRequest.requestOwnerV1({method:`POST`,canonicalPath:`${bz}/${String(t)}/source-contribution/execute`,body:JSON.parse(n),authentication:r});if(i.status<200||i.status>=300)throw Error(`Wallet-host Ed25519 source-preserving request failed with HTTP ${i.status}`);return i.body}}),readEcdsaMetadataV1:e.readEcdsaMetadataV1})}async function BJ(e,t){let n=await e.requestOwnerV1({method:`GET`,canonicalPath:`${bz}/${String(t.linkSessionId)}/approval`,authentication:t.authentication});if(n.status<200||n.status>=300)throw Error(`Wallet-host approval request failed with HTTP ${n.status}`);return Qa(n.body)}function VJ(e){let t=!1,n=null,r=async()=>{if(!t){try{let n=await BJ(e.request,e.input);t||e.input.onResult(n)}catch{}t||(n=setTimeout(()=>void r(),e.pollIntervalMs))}};return r(),{close:()=>{t=!0,n&&clearTimeout(n),n=null}}}var HJ=class{constructor(e,t,n){this.emailOtpUnlockPrewarmRecord={kind:`none`},this.configs=Mu(e,{...n?.kind===`wallet_host`?{allowDirectWalletMode:`wallet_host`}:{}}),bP(this.configs),this.nearClient=t||new _u(Or(this.configs.network.chains));let r=OP(K),i=new EN(this.configs,this.nearClient,{managerStores:r.managerStores,signingEngineStores:r.signingEngineStores,sealedSigningSessionStore:r.sealedSigningSessionStore,ed25519YaoPublicCapabilityReferences:r.ed25519YaoPublicCapabilityReferences,createRuntime:EP,initializeRuntime:AP,workerWarmupPolicy:yP(this.configs)});this.signingEngine=i,this.appearance=this.configs.ui.appearance,this.theme=this.appearance.theme.mode;try{this.signingEngine.setAppearance(this.appearance)}catch{}let a=this.signingEngine.getUserPreferences();this.walletIframe=new pP({configs:this.configs,signingEngine:this.signingEngine,userPreferences:a,getAppearance:()=>this.appearance});let o=TJ(n),s=jJ(o===`wallet_host`?{mode:o,configs:this.configs,signingEngine:i,walletIframe:this.walletIframe,...RJ({configs:this.configs,signingEngine:i})}:{mode:o,configs:this.configs,signingEngine:i,walletIframe:this.walletIframe});this.deviceLinkingDispose=s.dispose,this.resumePendingAcknowledgementsV1=s.resumePendingAcknowledgementsV1,this.lifecycleEventSource=EJ({mode:TJ(n),signingEngine:this.signingEngine,walletIframe:this.walletIframe});let c=aG({signingEngine:this.signingEngine,nearClient:this.nearClient,configs:this.configs,getTheme:()=>this.theme,userPreferences:a,getWalletIframe:()=>this.walletIframe,getWalletAuthDeps:()=>this.getWalletAuthDeps(),auth:{requestEmailOtpChallenge:async e=>await this.requestEmailOtpChallengeDomain(e),requestEmailOtpSigningSessionChallenge:async e=>await this.requestEmailOtpSigningSessionChallengeDomain(e),refreshEmailOtpSigningSession:async e=>await this.refreshEmailOtpSigningSessionDomain(e),loginWithEmailOtpEcdsaCapability:async e=>await this.loginWithEmailOtpEcdsaCapabilityDomain(e),unlockAddedEmailOtpWallet:async e=>await this.loginWithLinkedEmailOtpWalletDomain(e),beginGoogleEmailOtpWalletAuth:async e=>await this.beginGoogleEmailOtpWalletAuthDomain(e)},registration:{resumePendingEcdsaRegistration:async e=>await this.resumePendingEcdsaRegistrationDomain(e),getNearProvisioningState:async e=>await this.getNearProvisioningStateDomain(e),onNearProvisioningStateChanged:e=>DJ(this.lifecycleEventSource,OJ.bind(null,e)),addWalletSigner:async e=>await this.registerWalletSignerDomain(e),addPasskey:async e=>await this.addPasskeyDomain(e),addEmailOtp:async e=>await this.addEmailOtpDomain(e),revokeAuthMethod:async e=>await this.revokeAuthMethodDomain(e),registerWallet:async e=>await this.registerWalletDomain(e),registerPasskey:async e=>await this.registerPasskeyDomain(e),requestEmailOtpEnrollmentChallenge:async e=>await this.requestEmailOtpEnrollmentChallengeDomain(e),enrollEmailOtp:async e=>await this.enrollEmailOtpDomain(e)},recovery:{getWalletRecoveryCodeStatus:async e=>await this.getWalletRecoveryCodeStatusDomain(e),acknowledgeWalletRecoveryCodeBackup:async e=>await this.acknowledgeWalletRecoveryCodeBackupDomain(e),requestWalletCustodyEmailOtpChallenge:async e=>await this.requestWalletCustodyEmailOtpChallengeDomain(e),rotateWalletRecoveryCodes:async e=>await this.rotateWalletRecoveryCodesDomain(e)},devices:{...s.domain},keys:{resolveExactKeyExportLane:async e=>await this.resolveExactKeyExportLaneDomain(e),exportKeypairWithUI:async e=>await this.exportKeypairWithUIDomain(e)}});this.walletIframeControls=c.walletIframeControls,this.preferences=c.preferences,this.auth=c.auth,this.registration=c.registration,this.recovery=c.recovery,this.devices=c.devices,this.keys=c.keys,this.near=c.near,this.tempo=c.tempo,this.evm=c.evm,this.resumePendingRegistrationOnStartup(),PJ(s.resumePendingAcknowledgementsV1)}async initWalletIframe(e){return await this.walletIframe.init(e)}async getWalletIframeExactSessionState(){return await this.walletIframe.getExactSessionState()}async prefillRestoredWalletSession(e){await DP({state:e,chainTargets:this.configuredChainTargets(),prefill:gz.bind(null,this.getWalletAuthDeps())})}async openHostedAuthMenu(e,t){return await this.walletIframe.openHostedAuthMenu(e,t)}async cancelHostedAuthMenu(e){await this.walletIframe.cancelHostedAuthMenu(e)}onHostedAuthMenuExternalAuthRequest(e){return this.walletIframe.onHostedAuthMenuExternalAuthRequest(e)}onHostedAuthMenuDemoEmailOtpDelivery(e){return this.walletIframe.onHostedAuthMenuDemoEmailOtpDelivery(e)}async resolveHostedAuthMenuExternalAuth(e){await this.walletIframe.resolveHostedAuthMenuExternalAuth(e)}async lockWalletIframeExactSession(e){let t=Tu(e);return await this.walletIframe.lockExactSession(t)}isWalletIframeReady(){return this.walletIframeControls.isWalletIframeReady()}onWalletIframeReady(e){return this.walletIframeControls.onWalletIframeReady(e)}onWalletIframeLoginStatusChanged(e){return this.walletIframeControls.onWalletIframeLoginStatusChanged(e)}onSdkLifecycleEvent(e){return DJ(this.lifecycleEventSource,e)}onWalletIframePreferencesChanged(e){return this.walletIframeControls.onWalletIframePreferencesChanged(e)}getContext(){return{signingEngine:this.signingEngine,nearClient:this.nearClient,configs:this.configs,theme:this.theme,resumePendingAcknowledgementsV1:this.resumePendingAcknowledgementsAfterExactUnlockV1.bind(this)}}resumePendingAcknowledgementsAfterExactUnlockV1(){PJ(this.resumePendingAcknowledgementsV1)}async resumePendingRegistrationOnStartup(){if(K.isDisabled())return;let e=String(this.configs.network.relayer?.url||``).trim();if(e){try{let t=await rt({relayerUrl:e});for(let e of t)e.kind===`failed`&&console.warn(`[SeamsWeb] pending registration replay remains pending:`,e.registrationCeremonyId,e.error)}catch(e){console.warn(`[SeamsWeb] pending registration startup replay failed:`,e instanceof Error?e.message:String(e||`unknown error`))}try{let t=await Pu({relayUrl:e});for(let e of t)kJ(e)}catch(e){console.warn(`[SeamsWeb] pending wallet recovery startup replay failed:`,e instanceof Error?e.message:String(e||`unknown error`))}}}dispose(){this.deviceLinkingDispose(),this.walletIframe.dispose(),this.signingEngine.dispose()}getWalletAuthDeps(){return{getContext:()=>this.getContext(),walletIframe:this.walletIframe,signingEngine:this.signingEngine,nearClient:this.nearClient,initWalletIframe:async e=>await this.initWalletIframe(e)}}setTheme(e){e!==`light`&&e!==`dark`||this.setAppearance({theme:{...this.appearance.theme,mode:e}})}chainTarget(e){return tH(this.configs.network.chains,e)}configuredChainTargets(){return Hr(this.configs.network.chains)}setAppearance(e){let t=wJ(this.appearance,e);this.appearance=t,this.theme=t.theme.mode;try{this.signingEngine.setAppearance(t)}catch{}if(Xl())try{document.documentElement.setAttribute(`data-seams-theme`,this.theme)}catch{}this.walletIframe.shouldUseWalletIframe()&&(async()=>{try{await(await this.walletIframe.requireRouter()).setAppearance(t)}catch{}})()}setWalletIframeSurfaceMeasurementBinding(e){this.signingEngine.setWalletIframeSurfaceMeasurementBinding(e)}async prewarm(e){let t=!!e?.iframe,n=!!e?.workers,r=yJ(e),i=fJ(e),a=dJ(r),o=[];if(t)o.push(this.initWalletIframe(r?.wallet.walletId));else if(n&&!this.walletIframe.shouldUseWalletIframe()){let e=r?{kind:`near_account_bound`,account:r}:{kind:`none`};o.push(this.signingEngine.warmCriticalResources(e)),o.push(this.signingEngine.prewarmEcdsaRegistrationCrypto())}if(o.length===0)return;let s=`succeeded`;try{await Promise.all(o)}catch{s=`failed`}i&&(this.emailOtpUnlockPrewarmRecord={kind:`attempted`,status:s,completedAtMs:Date.now(),request:i,scope:a})}emitWalletIframeTransportTimingSummary(e){if(!Tt())return;let t=this.walletIframe.getTransportDiagnosticsSnapshot();if(!t)return;let{kind:n,...r}=t;console.info(ot,{kind:`wallet_iframe_registration_transport_timing_v1`,operation:e.operation,walletId:e.walletId,transportKind:n,...r})}async registerWalletDomain(e){if(this.walletIframe.shouldUseWalletIframe())try{let t=e.wallet.kind===`provided`?String(e.wallet.walletId):void 0,n=await this.walletIframe.requireRouter(t);this.emitWalletIframeTransportTimingSummary({operation:`registerWallet`,walletId:t??null});let r=await n.registerWallet(e),i=r.success?String(r.walletId||``).trim():``;return i&&(async()=>{try{await this.initWalletIframe(i)}catch{}})(),await e.options?.afterCall?.(!0,r),r}catch(t){let n=N(t);throw await e.options?.onError?.(n),await e.options?.afterCall?.(!1),n}return await _t({context:this.getContext(),authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,options:e.options||{},authenticatorOptions:lr(this.configs.webauthn.authenticatorOptions)})}async getNearProvisioningStateDomain(e){let t=R(e.walletId);return this.walletIframe.shouldUseWalletIframe()?await(await this.walletIframe.requireRouter(String(t))).getNearProvisioningState({walletId:t}):ln(t)||await this.getContext().signingEngine.getWalletNearProvisioningState(t)}async resumePendingEcdsaRegistrationDomain(e){if(this.walletIframe.shouldUseWalletIframe())return await(await this.walletIframe.requireRouter(String(e.walletId))).resumePendingEcdsaRegistration(e);let t=String(this.configs.network.relayer?.url||``).trim();if(!t)throw Error(`pending ECDSA registration recovery requires a relayer URL`);return await je({relayerUrl:t,request:e,signingSurface:this.signingEngine})}async registerWalletSignerDomain(e){if(this.walletIframe.shouldUseWalletIframe())try{let t=await(await this.walletIframe.requireRouter(String(e.walletId||``))).addWalletSigner(e);return await e.options?.afterCall?.(!0,t),t}catch(t){let n=N(t);throw await e.options?.onError?.(n),await e.options?.afterCall?.(!1),n}return await Xt({context:this.getContext(),walletId:e.walletId,rpId:e.rpId,signerSelection:e.signerSelection,options:e.options||{}})}async addPasskeyDomain(e){if(this.walletIframe.shouldUseWalletIframe())try{let t=await(await this.walletIframe.requireRouter(String(e.walletId||``))).addPasskey(e);return await e.options?.afterCall?.(!0,t),t}catch(t){let n=N(t);throw await e.options?.onError?.(n),await e.options?.afterCall?.(!1),n}return await GN({context:this.getContext(),walletId:e.walletId,rpId:e.rpId,options:e.options})}async revokeAuthMethodDomain(e){return this.walletIframe.shouldUseWalletIframe()?await(await this.walletIframe.requireRouter(String(e.walletId||``))).revokeAuthMethod(e):await QN({context:this.getContext(),walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId})}async addEmailOtpDomain(e){if(this.walletIframe.shouldUseWalletIframe())try{let t=await(await this.walletIframe.requireRouter(String(e.walletId||``))).addEmailOtp(e);return await e.options?.afterCall?.(!0,t),t}catch(t){let n=N(t);throw await e.options?.onError?.(n),await e.options?.afterCall?.(!1),n}return await oP({context:this.getContext(),walletId:e.walletId,emailAddress:e.emailAddress,options:e.options})}async registerPasskeyDomain(e={}){if(typeof e==`string`)throw Error(`[SeamsWeb] registration.registerPasskey no longer accepts a NEAR account id; call registration.registerPasskey(options) for implicit NEAR registration or registerWallet(...) with explicit sponsored accountProvisioning.`);let{wallet:t,nearAccountProvisioning:n,...r}=e||{},i=this.walletIframe.resolveRegistrationRpId(this.signingEngine.getRpId()),a=n??this.configs.registration.nearAccountProvisioning,o=t||(a.kind===`relayer_named_subaccount`?{kind:`provided`,walletId:Wo()}:{kind:`server_allocated`}),s=GH({configs:this.configs,wallet:o,preference:a});return await this.registerWalletDomain({wallet:o,authMethod:{kind:`passkey`,rpId:i},signerSelection:HH({configs:this.configs,accountProvisioning:s,options:r}),options:r})}emailOtpRegistrationFlowId(e,t){return`email-otp-registration:${String(e||`unknown-wallet`).trim()||`unknown-wallet`}:${String(t||`active`).trim()||`active`}`}emailOtpUnlockFlowId(e,t){return`email-otp-unlock:${String(e||`unknown-wallet`).trim()||`unknown-wallet`}:${String(t||`active`).trim()||`active`}`}emitEmailOtpRegistrationEvent(e,t){try{e?.(cs(t))}catch{}}emitEmailOtpUnlockEvent(e,t){try{e?.(rs(t))}catch{}}emitEmailOtpRegistrationFailure(e,t){this.emitEmailOtpRegistrationEvent(e,{...t,phase:as.FAILED,status:`failed`,error:{message:t.error.message}})}emitEmailOtpUnlockWorkerProgress(e,t){let n=t.chainTarget.kind===`tempo`?`Tempo`:`EVM`,r={flowId:t.flowId,walletId:t.walletId,authMethod:`email_otp`,...t.challengeId?{requestId:t.challengeId}:{}};switch(t.progress.code){case`otp.verify.succeeded`:return this.emitEmailOtpUnlockEvent(e,{...r,phase:W.STEP_03_EMAIL_OTP_VERIFY_SUCCEEDED,status:`succeeded`,interaction:{kind:`otp_input`,overlay:`hide`}}),W.STEP_03_EMAIL_OTP_VERIFY_SUCCEEDED;case`signer.ecdsa.bootstrap.started`:return this.emitEmailOtpUnlockEvent(e,{...r,phase:W.STEP_05_SIGNING_SESSION_WARMUP_STARTED,status:`running`,message:`Preparing ${n} signing session`,data:{chainTarget:t.chainTarget}}),W.STEP_05_SIGNING_SESSION_WARMUP_STARTED;case`signer.ecdsa.bootstrap.prepared`:return this.emitEmailOtpUnlockEvent(e,{...r,phase:W.STEP_05_SIGNING_SESSION_WARMUP_STARTED,status:`running`,message:`Coordinating ${n} signing session`,data:{chainTarget:t.chainTarget}}),W.STEP_05_SIGNING_SESSION_WARMUP_STARTED;case`signer.ecdsa.bootstrap.responded`:return this.emitEmailOtpUnlockEvent(e,{...r,phase:W.STEP_05_SIGNING_SESSION_WARMUP_STARTED,status:`running`,message:`Finalizing ${n} signing session`,data:{chainTarget:t.chainTarget}}),W.STEP_05_SIGNING_SESSION_WARMUP_STARTED;case`signer.ecdsa.bootstrap.succeeded`:return this.emitEmailOtpUnlockEvent(e,{...r,phase:W.STEP_05_SIGNING_SESSION_WARMUP_STARTED,status:`running`,message:`Saving ${n} signing session`,data:{chainTarget:t.chainTarget}}),W.STEP_05_SIGNING_SESSION_WARMUP_STARTED;default:return null}}emitEmailOtpUnlockFailure(e,t){let n=le(t.error);this.emitEmailOtpUnlockEvent(e,{...t,phase:n?W.CANCELLED:W.FAILED,status:n?`cancelled`:`failed`,interaction:t.interaction??{kind:n?`otp_input`:`none`,overlay:`hide`},error:{message:t.error.message}})}async requestEmailOtpChallengeDomain(e){let t=this.emailOtpUnlockFlowId(e.walletId);this.emitEmailOtpUnlockEvent(e.onEvent,{flowId:t,walletId:e.walletId,authMethod:`email_otp`,phase:W.STEP_03_EMAIL_OTP_CHALLENGE_STARTED,status:`running`});try{if(this.walletIframe.shouldUseWalletIframe()){let t=await(await this.walletIframe.requireRouter(e.walletId)).requestEmailOtpChallenge(e);return this.emitEmailOtpUnlockEvent(e.onEvent,{flowId:this.emailOtpUnlockFlowId(e.walletId,t.challengeId),walletId:e.walletId,authMethod:`email_otp`,phase:W.STEP_03_EMAIL_OTP_CHALLENGE_SENT,status:`succeeded`,data:{challengeId:t.challengeId,otpChannel:t.otpChannel}}),t}let t=e.walletAuthMethodId;if(!t){let n=await K.resolveSelectedWalletAuthority(String(e.walletId||``).trim());n.kind===`resolved`&&n.authMethod.kind===`email_otp`&&n.authMethod.status===`active`&&String(n.authMethod.walletId)===String(e.walletId||``).trim()&&(t=String(n.authMethod.walletAuthMethodId))}if(!t)throw Error(`Email OTP challenge requires an exact walletAuthMethodId`);let n=await Ge({relayUrl:String(e.relayUrl||this.configs.network.relayer.url||``).trim(),walletId:String(e.walletId||``).trim(),walletAuthMethodId:t,...e.operation?{operation:e.operation}:{},...e.operationFingerprintDigest?{operationFingerprintDigest:e.operationFingerprintDigest}:{}});return this.emitEmailOtpUnlockEvent(e.onEvent,{flowId:this.emailOtpUnlockFlowId(e.walletId,n.challengeId),walletId:e.walletId,authMethod:`email_otp`,phase:W.STEP_03_EMAIL_OTP_CHALLENGE_SENT,status:`succeeded`,data:{challengeId:n.challengeId,otpChannel:n.otpChannel}}),n}catch(n){let r=N(n);throw this.emitEmailOtpUnlockFailure(e.onEvent,{flowId:t,walletId:e.walletId,authMethod:`email_otp`,error:r}),r}}async requestEmailOtpEnrollmentChallengeDomain(e){let t=this.emailOtpRegistrationFlowId(e.walletId);this.emitEmailOtpRegistrationEvent(e.onEvent,{flowId:t,walletId:e.walletId,authMethod:`email_otp`,phase:as.STEP_04_OTP_CHALLENGE_STARTED,status:`running`});try{if(this.walletIframe.shouldUseWalletIframe()){let t=await(await this.walletIframe.requireRouter(e.walletId)).requestEmailOtpEnrollmentChallenge(e);return this.emitEmailOtpRegistrationEvent(e.onEvent,{flowId:this.emailOtpRegistrationFlowId(e.walletId,t.challengeId),walletId:e.walletId,authMethod:`email_otp`,phase:as.STEP_04_OTP_CHALLENGE_SENT,status:`succeeded`,data:{challengeId:t.challengeId,otpChannel:t.otpChannel}}),t}let t=await It({relayUrl:String(e.relayUrl||this.configs.network.relayer.url||``).trim(),walletId:String(e.walletId||``).trim()});return this.emitEmailOtpRegistrationEvent(e.onEvent,{flowId:this.emailOtpRegistrationFlowId(e.walletId,t.challengeId),walletId:e.walletId,authMethod:`email_otp`,phase:as.STEP_04_OTP_CHALLENGE_SENT,status:`succeeded`,data:{challengeId:t.challengeId,otpChannel:t.otpChannel}}),t}catch(n){let r=N(n);throw this.emitEmailOtpRegistrationFailure(e.onEvent,{flowId:t,walletId:e.walletId,authMethod:`email_otp`,error:r}),r}}async requestEmailOtpSigningSessionChallengeDomain(e){let t=e.walletSession.walletId,n=this.emailOtpUnlockFlowId(t);this.emitEmailOtpUnlockEvent(e.onEvent,{flowId:n,walletId:t,authMethod:`email_otp`,phase:W.STEP_03_EMAIL_OTP_CHALLENGE_STARTED,status:`running`});try{if(this.walletIframe.shouldUseWalletIframe()){let n=await(await this.walletIframe.requireRouter(t)).requestEmailOtpSigningSessionChallenge({walletSession:e.walletSession,chainTarget:e.chainTarget});return this.emitEmailOtpUnlockEvent(e.onEvent,{flowId:this.emailOtpUnlockFlowId(t,n.challengeId),walletId:t,authMethod:`email_otp`,phase:W.STEP_03_EMAIL_OTP_CHALLENGE_SENT,status:`succeeded`,data:{challengeId:n.challengeId,otpChannel:`email_otp`}}),n}let n=await this.signingEngine.requestEmailOtpSigningSessionChallenge({walletSession:e.walletSession,chainTarget:e.chainTarget});return this.emitEmailOtpUnlockEvent(e.onEvent,{flowId:this.emailOtpUnlockFlowId(t,n.challengeId),walletId:t,authMethod:`email_otp`,phase:W.STEP_03_EMAIL_OTP_CHALLENGE_SENT,status:`succeeded`,data:{challengeId:n.challengeId,otpChannel:`email_otp`}}),n}catch(r){let i=N(r);throw this.emitEmailOtpUnlockFailure(e.onEvent,{flowId:n,walletId:t,authMethod:`email_otp`,error:i}),i}}async enrollEmailOtpDomain(e){let t=this.emailOtpRegistrationFlowId(e.walletId,e.challengeId);this.emitEmailOtpRegistrationEvent(e.onEvent,{flowId:t,walletId:e.walletId,authMethod:`email_otp`,phase:as.STEP_04_OTP_VERIFY_STARTED,status:`running`,interaction:{kind:`otp_input`,overlay:`none`},...e.challengeId?{requestId:e.challengeId}:{}});try{if(this.walletIframe.shouldUseWalletIframe()){if(e.clientSecret32)throw Error(`[SeamsWeb] Wallet iframe Email OTP enrollment owns client secret generation; clientSecret32 is not accepted from the app origin.`);let n=await this.walletIframe.requireRouter(e.walletId),r={...e};delete r.clientSecret32,delete r.onEvent;let i=await n.enrollEmailOtp(r);return this.emitEmailOtpRegistrationEvent(e.onEvent,{flowId:t,walletId:e.walletId,authMethod:`email_otp`,phase:as.STEP_04_OTP_VERIFY_SUCCEEDED,status:`succeeded`,interaction:{kind:`otp_input`,overlay:`hide`},...e.challengeId?{requestId:e.challengeId}:{},data:{otpChannel:i.otpChannel,enrollmentSealKeyVersion:i.enrollmentSealKeyVersion}}),this.emitEmailOtpRegistrationEvent(e.onEvent,{flowId:t,walletId:e.walletId,authMethod:`email_otp`,phase:as.STEP_09_EMAIL_OTP_SIGNER_ENROLL_STARTED,status:`running`,...e.challengeId?{requestId:e.challengeId}:{}}),this.emitEmailOtpRegistrationEvent(e.onEvent,{flowId:t,walletId:e.walletId,authMethod:`email_otp`,phase:as.STEP_09_EMAIL_OTP_SIGNER_ENROLL_SUCCEEDED,status:`succeeded`,...e.challengeId?{requestId:e.challengeId}:{},data:{unlockKeyVersion:i.unlockKeyVersion}}),i}let n=await this.signingEngine.enrollEmailOtpInternal({walletId:R(e.walletId),otpCode:e.otpCode,...e.relayUrl?{relayUrl:e.relayUrl}:{},challengeId:e.challengeId,...e.groupId?{groupId:e.groupId}:{},...e.clientSecret32?{clientSecret32:e.clientSecret32}:{}});return this.emitEmailOtpRegistrationEvent(e.onEvent,{flowId:t,walletId:e.walletId,authMethod:`email_otp`,phase:as.STEP_04_OTP_VERIFY_SUCCEEDED,status:`succeeded`,interaction:{kind:`otp_input`,overlay:`hide`},...e.challengeId?{requestId:e.challengeId}:{},data:{otpChannel:n.otpChannel,enrollmentSealKeyVersion:n.enrollmentSealKeyVersion}}),this.emitEmailOtpRegistrationEvent(e.onEvent,{flowId:t,walletId:e.walletId,authMethod:`email_otp`,phase:as.STEP_09_EMAIL_OTP_SIGNER_ENROLL_STARTED,status:`running`,...e.challengeId?{requestId:e.challengeId}:{}}),this.emitEmailOtpRegistrationEvent(e.onEvent,{flowId:t,walletId:e.walletId,authMethod:`email_otp`,phase:as.STEP_09_EMAIL_OTP_SIGNER_ENROLL_SUCCEEDED,status:`succeeded`,...e.challengeId?{requestId:e.challengeId}:{},data:{unlockKeyVersion:n.unlockKeyVersion}}),n}catch(n){let r=N(n);throw this.emitEmailOtpRegistrationFailure(e.onEvent,{flowId:t,walletId:e.walletId,authMethod:`email_otp`,...e.challengeId?{requestId:e.challengeId}:{},error:r}),r}}async getWalletRecoveryCodeStatusDomain(e){let t=String(this.configs.network.relayer.url||``).trim();if(this.walletIframe.shouldUseWalletIframe())return await(await this.walletIframe.requireRouter(e.walletId)).getWalletRecoveryCodeStatus({walletId:e.walletId});let n=await ep({relayUrl:t,walletId:e.walletId});return n.kind===`ready`?{...n,pendingLocalBackup:await gu.has(e.walletId)}:n}async beginGoogleEmailOtpWalletAuthDomain(e){return this.walletIframe.shouldUseWalletIframe()?await(await this.walletIframe.requireRouter()).beginGoogleEmailOtpWalletAuth(e):await zq({configs:this.configs,resolveGoogleEmailOtpProvider:this.resolveGoogleEmailOtpProviderDomain.bind(this),requestEmailOtpChallenge:this.requestEmailOtpChallengeDomain.bind(this),prewarmEmailOtpYao:this.prewarmEmailOtpYaoDomain.bind(this),registerWallet:this.registerWalletDomain.bind(this),loginWithEmailOtpEcdsaCapability:this.loginWithEmailOtpEcdsaCapabilityDomain.bind(this),loginWithEmailOtpEd25519YaoCapability:this.loginWithEmailOtpEd25519YaoCapabilityDomain.bind(this),resolveLinkedEmailOtpWalletAuth:this.resolveLinkedEmailOtpWalletAuthDomain.bind(this),loginWithLinkedEmailOtpWallet:this.loginWithLinkedEmailOtpWalletDomain.bind(this),getWalletSession:this.getGoogleEmailOtpWalletSessionDomain.bind(this)},e)}async resolveGoogleEmailOtpProviderDomain(e){return await _e({relayUrl:String(e.relayUrl||this.configs.network.relayer.url||``).trim(),idToken:e.idToken,accountMode:e.accountMode,...e.loginWalletId?{loginWalletId:e.loginWalletId}:{},projectEnvironmentId:this.configs.registration.projectEnvironmentId,publishableKey:this.configs.registration.publishableKey,...e.restartRegistrationOffer===!0?{restartRegistrationOffer:!0}:{}})}async resolveLinkedEmailOtpWalletAuthDomain(e){let t=await this.emailOtpEmailHashHex(e.email),n=await JF({walletIdInput:e.walletId,emailHashHex:t,provider:e.provider,providerSubjectId:e.providerSubjectId});switch(n.kind){case`none`:{let n=(await K.listWalletAuthMethodsV2ForWallet(e.walletId)).filter(e=>e.kind===`email_otp`&&e.status===`active`&&e.emailHashHex.toLowerCase()===t),r=n[0];if(n.length===0||!r){let n=(await K.listWalletAuthMethodsForWallet(e.walletId)).filter(n=>n.kind===`email_otp`&&n.status===`active`&&n.emailHashHex.toLowerCase()===t&&$n(n.authority)&&n.authority.factor.provider===`google`&&n.authority.factor.providerUserId===e.providerSubjectId),r=n[0];if(n.length===0||!r)return{kind:`none`};if(n.length!==1)return{kind:`rejected`,message:`Multiple active local Email OTP factors match the verified email`};let i=r.authority;return!i||!$n(i)?{kind:`none`}:{kind:`selected`,walletAuthMethodId:String(i.bindingId),execution:`ordinary`}}if(n.length!==1)return{kind:`rejected`,message:`Multiple active local Email OTP authorities match the verified email`};let i=await K.getWalletAuthority(String(r.walletAuthorityId));return!i||i.state!==`active`||i.walletId!==r.walletId||i.authorityId!==r.walletAuthorityId||i.provenance.kind!==`wallet_registration`&&i.provenance.kind!==`wallet_recovery`?{kind:`none`}:(await HF({authMethod:r,provider:`google`,providerSubjectId:e.providerSubjectId}),{kind:`selected`,walletAuthMethodId:String(r.walletAuthMethodId),execution:await tJ(i.provenance,r.walletAuthMethodId),keyFamilies:i.signerActivations.keyFamilies})}case`selected`:return{kind:`selected`,walletAuthMethodId:String(n.selection.authMethod.walletAuthMethodId),execution:await tJ(n.selection.authority.provenance,n.selection.authMethod.walletAuthMethodId),keyFamilies:n.selection.authority.signerActivations.keyFamilies};case`rejected`:return{kind:`rejected`,message:n.message};default:throw Error(`Linked Email OTP authority resolution is invalid`)}}async loginWithLinkedEmailOtpWalletDomain(e){if(this.walletIframe.shouldUseWalletIframe()){await(await this.walletIframe.requireRouter(String(e.walletId||``))).unlockAddedEmailOtpWallet({walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId,email:e.email,providerSubjectId:e.providerSubjectId,challengeId:e.challengeId,otpCode:e.otpCode,relayUrl:e.relayUrl}),this.resumePendingAcknowledgementsAfterExactUnlockV1();return}let t=await this.emailOtpEmailHashHex(e.email);await dL({context:this.getContext(),walletIdInput:e.walletId,emailHashHex:t,walletAuthMethodId:e.walletAuthMethodId,providerSubjectId:e.providerSubjectId,challengeId:e.challengeId,otpCode:e.otpCode,relayUrl:e.relayUrl}),this.resumePendingAcknowledgementsAfterExactUnlockV1()}async prewarmEmailOtpYaoDomain(){await this.signingEngine.prewarmEmailOtpYao()}async getGoogleEmailOtpWalletSessionDomain(e){return await pz(this.getWalletAuthDeps(),e)}async acknowledgeWalletRecoveryCodeBackupDomain(e){let t=String(this.configs.network.relayer.url||``).trim();if(this.walletIframe.shouldUseWalletIframe())return await(await this.walletIframe.requireTransportRouter()).acknowledgeWalletRecoveryCodeBackup({walletId:e.walletId});if((await hu({walletId:e.walletId,loadStatus:this.getWalletRecoveryCodeStatusDomain.bind(this,e),loadPendingBackup:this.loadPendingWalletRecoveryCodeBackupRequest.bind(this,e.walletId)},this.signingEngine.getWalletIframeSurfaceMeasurementBinding(),{appearance:this.appearance})).kind!==`wallet_recovery_codes_backed_up_v1`)throw Error(`Pending wallet recovery-code backup was not completed`);let n=await np({relayUrl:t,walletId:e.walletId});return n.kind===`acknowledged`&&await gu.delete(e.walletId),n}async loadPendingWalletRecoveryCodeBackupRequest(e){let t=await gu.read(e);return t?{kind:`wallet_recovery_code_backup_request_v1`,walletId:t.walletId,recoveryCodes:t.recoveryCodes,continuation:`pending_backup_must_finish`}:null}async requestWalletCustodyEmailOtpChallengeDomain(e){return await tp({relayUrl:String(this.configs.network.relayer.url||``).trim(),...e})}async rotateWalletRecoveryCodesDomain(e){let t=String(this.configs.network.relayer.url||``).trim();return this.walletIframe.shouldUseWalletIframe()?await(await this.walletIframe.requireRouter(e.walletId)).rotateWalletRecoveryCodes(e):await eJ({context:this.getContext(),relayUrl:t,walletId:e.walletId,authorization:e.authorization})}async loginWithEmailOtpEd25519YaoCapabilityDomain(e){if(e.authoritySelector.kind!==`wallet_auth_method`)throw Error(`Email OTP Ed25519 unlock requires an exact wallet auth method`);let t=await this.emailOtpEmailHashHex(e.emailOtpAuthorityEmail),n=await this.signingEngine.loginWithEmailOtpWalletCustodyEd25519Internal({...e,emailHashHex:t});await bh({signingEngine:this.signingEngine,nearClient:this.nearClient},{kind:`near_ed25519_wallet`,signer:n,walletAuthMethodId:nJ(e.authoritySelector.walletAuthMethodId)})}async emailOtpEmailHashHex(e){let t=String(e||``).trim().toLowerCase();if(!t)throw Error(`[SeamsWeb][email-otp] verified email is required for auth-method hash`);return Ar(t)}async loginWithEmailOtpEcdsaCapabilityDomain(e){let t=e.walletSession.walletId,n=this.emailOtpUnlockFlowId(t,e.challengeId),r=bJ(e.chainTarget,`Email OTP ECDSA unlock`),i={startedAtMs:iJ(),timings:aJ()},a=pJ({record:this.emailOtpUnlockPrewarmRecord,walletId:t,nowMs:Date.now()});this.emitEmailOtpUnlockEvent(e.onEvent,{flowId:n,walletId:t,authMethod:`email_otp`,phase:W.STEP_03_EMAIL_OTP_VERIFY_STARTED,status:`running`,interaction:{kind:`otp_input`,overlay:`none`},...e.challengeId?{requestId:e.challengeId}:{}});try{if(this.walletIframe.shouldUseWalletIframe()){let o=await this.walletIframe.requireRouter(t),s={...e,chainTarget:r};delete s.onEvent;let c=iJ(),l=await o.loginWithEmailOtpEcdsaCapability(s),u=iJ()-c;return sJ(i.timings,`walletIframeRoundTripMs`,u),uJ({status:`succeeded`,mode:`evm_family_ecdsa`,walletId:t,prewarm:a,chainTarget:r,startedAtMs:i.startedAtMs,timings:i.timings}),this.emitEmailOtpUnlockEvent(e.onEvent,{flowId:n,walletId:t,authMethod:`email_otp`,phase:W.STEP_03_EMAIL_OTP_VERIFY_SUCCEEDED,status:`succeeded`,interaction:{kind:`otp_input`,overlay:`hide`},...e.challengeId?{requestId:e.challengeId}:{}}),this.emitEmailOtpUnlockEvent(e.onEvent,{flowId:n,walletId:t,authMethod:`email_otp`,phase:W.STEP_05_ECDSA_SIGNING_SESSION_READY,status:`succeeded`,...e.challengeId?{requestId:e.challengeId}:{},data:{chainTarget:r}}),this.emitEmailOtpUnlockEvent(e.onEvent,{flowId:n,walletId:t,authMethod:`email_otp`,phase:W.STEP_07_COMPLETED,status:`succeeded`,...e.challengeId?{requestId:e.challengeId}:{}}),l}let o=new Set,s=i=>{let a=this.emitEmailOtpUnlockWorkerProgress(e.onEvent,{flowId:n,walletId:t,challengeId:e.challengeId,chainTarget:r,progress:i});a&&o.add(a)},c=t=>{o.has(t.phase)||this.emitEmailOtpUnlockEvent(e.onEvent,t)},l=iJ(),u=await this.emailOtpEmailHashHex(e.emailOtpAuthorityEmail||``);oJ(i.timings,`emailHashLookupMs`,l),l=iJ();let d=e.ed25519Selection.kind===`present`?e.ed25519Selection:null,f=await this.signingEngine.loginWithEmailOtpEcdsaCapabilityInternal({...e,authoritySelector:{kind:`wallet_auth_method`,walletAuthMethodId:e.walletAuthMethodId},chainTarget:r,emailHashHex:u,...d?{ed25519YaoRecovery:{kind:`requested`,providerSubject:e.providerIdentity.providerSubjectId,signerSlot:d.signerSlot,nearAccountId:d.nearAccountId,expectedOperationalPublicKey:d.operationalPublicKey,expectedThresholdSessionId:d.thresholdSessionId}}:{ed25519YaoRecovery:{kind:`not_requested`}},ecdsaBootstrapAuthorization:{kind:`route_plan_auth`},providerIdentity:{kind:`explicit_provider_user`,provider:e.providerIdentity.provider,providerUserId:e.providerIdentity.providerSubjectId},onProgress:s});await _h({walletId:String(t),walletAuthMethodId:String(e.walletAuthMethodId),projection:f.recovery.verifiedAuthorityProjection});let p;if(d){let t;switch(f.ed25519YaoRecovery.kind){case`capability`:t=await this.signingEngine.activateEmailOtpEd25519CustodyCapabilityInternal({walletSession:e.walletSession,providerSubject:e.providerIdentity.providerSubjectId,emailHashHex:u,signerSlot:d.signerSlot,expectedOperationalPublicKey:d.operationalPublicKey,expectedThresholdSessionId:d.thresholdSessionId,bootstrap:f.ed25519YaoRecovery.bootstrap,activeClientHandle:f.ed25519YaoRecovery.activeClientHandle,metadata:f.ed25519YaoRecovery.metadata,authority:rJ(f)});break;case`cache_absent`:throw Error(`Email OTP wallet custody material is unavailable; recover with a recovery code`);case`not_requested`:throw Error(`Email OTP capability unlock omitted Ed25519 Yao session material`);default:throw Error(`Email OTP capability unlock returned an invalid Ed25519 Yao state`)}p={kind:`near_ed25519_wallet`,signer:t,walletAuthMethodId:nJ(e.walletAuthMethodId)}}else{if(f.ed25519YaoRecovery.kind!==`not_requested`)throw Error(`EVM-family ECDSA Email OTP unlock returned unexpected Ed25519 Yao material`);p={kind:`evm_family_ecdsa_wallet`,walletId:t,walletAuthMethodId:nJ(e.walletAuthMethodId)}}let m=iJ()-l;sJ(i.timings,`workerUnlockAndSessionBootstrapMs`,m),sJ(i.timings,`emailOtpProofVerificationMs`,f.timings.emailOtpProofVerificationMs),sJ(i.timings,`ecdsaMaterialRestoreMs`,f.timings.ecdsaMaterialRestoreMs),sJ(i.timings,`signingSessionSealApplyMs`,f.timings.signingSessionSealApplyMs),sJ(i.timings,`warmCapabilityPersistenceMs`,f.timings.warmCapabilityPersistenceMs),l=iJ(),await bh({signingEngine:this.signingEngine,nearClient:this.nearClient},p),oJ(i.timings,`walletStateActivationMs`,l),l=iJ();let h=await vh({walletId:String(t),walletAuthMethodId:String(e.walletAuthMethodId),providerSubject:e.providerIdentity.providerSubjectId,emailHashHex:u,projection:f.recovery.verifiedAuthorityProjection}),g=await UP({source:`wallet_unlock`,walletId:t,ownerScope:{auth:{kind:`email_otp`,providerSubjectId:e.providerIdentity.providerSubjectId},ownerAuthority:{walletAuthMethodId:h.walletAuthMethodId,authorityDigest:h.authorityDigest}},requiredTargets:[...d?[{curve:`ed25519`}]:[],...(e.publicationChainTargets??[r]).map(e=>({curve:`ecdsa`,chainTarget:e}))],readOwnerScopedSigningLanes:async e=>await this.signingEngine.readOwnerScopedSigningLanes(e,new wt)});gJ(hJ({walletSession:e.walletSession,result:f,runtimeInventory:g}));let _=iJ()-l;return sJ(i.timings,`runtimePostconditionMs`,_),sJ(i.timings,`activeRuntimeConstructionMs`,_),uJ({status:`succeeded`,mode:`evm_family_ecdsa`,walletId:t,prewarm:a,chainTarget:r,startedAtMs:i.startedAtMs,timings:i.timings}),c({flowId:n,walletId:t,authMethod:`email_otp`,phase:W.STEP_03_EMAIL_OTP_VERIFY_SUCCEEDED,status:`succeeded`,interaction:{kind:`otp_input`,overlay:`hide`},...e.challengeId?{requestId:e.challengeId}:{}}),c({flowId:n,walletId:t,authMethod:`email_otp`,phase:W.STEP_05_ECDSA_SIGNING_SESSION_READY,status:`succeeded`,...e.challengeId?{requestId:e.challengeId}:{},data:{chainTarget:r}}),c({flowId:n,walletId:t,authMethod:`email_otp`,phase:W.STEP_07_COMPLETED,status:`succeeded`,...e.challengeId?{requestId:e.challengeId}:{}}),f}catch(o){let s=N(o);throw uJ({status:`failed`,mode:`evm_family_ecdsa`,walletId:t,prewarm:a,chainTarget:r,startedAtMs:i.startedAtMs,timings:i.timings,error:s}),this.emitEmailOtpUnlockFailure(e.onEvent,{flowId:n,walletId:t,authMethod:`email_otp`,...e.challengeId?{requestId:e.challengeId}:{},error:s}),s}}async refreshEmailOtpSigningSessionDomain(e){let t=e.walletSession.walletId,n=this.emailOtpUnlockFlowId(t,e.challengeId),r=bJ(e.chainTarget,`Email OTP signing-session refresh`);this.emitEmailOtpUnlockEvent(e.onEvent,{flowId:n,walletId:t,authMethod:`email_otp`,phase:W.STEP_03_EMAIL_OTP_VERIFY_STARTED,status:`running`,interaction:{kind:`otp_input`,overlay:`none`},requestId:e.challengeId});try{let i=this.walletIframe.shouldUseWalletIframe()?await(await this.walletIframe.requireRouter(t)).refreshEmailOtpSigningSession({walletSession:e.walletSession,chainTarget:r,challengeId:e.challengeId,otpCode:e.otpCode,...typeof e.ttlMs==`number`?{ttlMs:e.ttlMs}:{},...typeof e.remainingUses==`number`?{remainingUses:e.remainingUses}:{}}):await this.signingEngine.refreshEmailOtpSigningSession({walletSession:e.walletSession,chainTarget:r,challengeId:e.challengeId,otpCode:e.otpCode,...typeof e.ttlMs==`number`?{ttlMs:e.ttlMs}:{},...typeof e.remainingUses==`number`?{remainingUses:e.remainingUses}:{}});return this.emitEmailOtpUnlockEvent(e.onEvent,{flowId:n,walletId:t,authMethod:`email_otp`,phase:W.STEP_03_EMAIL_OTP_VERIFY_SUCCEEDED,status:`succeeded`,interaction:{kind:`otp_input`,overlay:`hide`},requestId:e.challengeId}),this.emitEmailOtpUnlockEvent(e.onEvent,{flowId:n,walletId:t,authMethod:`email_otp`,phase:W.STEP_05_ECDSA_SIGNING_SESSION_READY,status:`succeeded`,requestId:e.challengeId,data:{chainTarget:r}}),this.emitEmailOtpUnlockEvent(e.onEvent,{flowId:n,walletId:t,authMethod:`email_otp`,phase:W.STEP_07_COMPLETED,status:`succeeded`,requestId:e.challengeId}),i}catch(r){let i=N(r);throw this.emitEmailOtpUnlockFailure(e.onEvent,{flowId:n,walletId:t,authMethod:`email_otp`,requestId:e.challengeId,error:i}),i}}async prefetchBlockheight(){if(this.walletIframe.shouldUseWalletIframe()){await(await this.walletIframe.requireRouter()).prefetchBlockheight();return}try{await this.signingEngine.getNonceCoordinator().prefetchNearContext({kind:`initialized_state`,nearClient:this.nearClient})}catch{}}async signTempoFeeTokenPreferenceInternal(e){if(!Xl())throw Error(`[SeamsWeb][tempo] fee-token preference signing requires wallet-host mode`);let t=bu(e),n=await this.signingEngine.signEvmFamily({...e,request:t});if(n.chain!==`evm`||n.kind!==`eip1559`)throw Error(`[SeamsWeb][tempo] expected EVM FeeManager result, received ${n.chain}`);return n}async resolveExactKeyExportLaneDomain(e){let t=xJ(e),n=String(t.walletSession.walletId||``).trim();if(!n)throw Error(`[SeamsWeb] key export lane resolution requires wallet session context`);return this.walletIframe.shouldUseWalletIframe()?SJ(await(await this.walletIframe.requireRouter(n)).resolveExactKeyExportLane(t)):SJ(await this.signingEngine.resolveExactKeyExportLane(t))}async exportKeypairWithUIDomain(e){let t=CJ(e,this.theme),n=String(t.walletSession.walletId||``).trim();if(!n)throw Error(`[SeamsWeb] key export requires wallet session user context`);if(this.walletIframe.shouldUseWalletIframe()){await(await this.walletIframe.requireRouter(n)).exportKeypairWithUI(t);return}await this.signingEngine.exportKeypairWithUI(t)}};function UJ(e){let t=e.iframeWallet||{},n=t.walletOrigin,r=t.walletServicePath;return n&&console.warn(`[WalletIframeHost] Ignoring iframeWallet.walletOrigin inside wallet host (nested iframe clients are not supported).`,n),r&&console.warn(`[WalletIframeHost] Ignoring iframeWallet.walletServicePath inside wallet host (nested iframe clients are not supported).`,r),{...e,iframeWallet:{...t,walletOrigin:``,walletServicePath:``}}}function WJ(e){let t=e.iframeWallet?.walletOrigin;if(t)throw Error(`[WalletIframeHost] Invariant violated: iframeWallet.walletOrigin must be empty in wallet host mode (got "${t}").`)}const GJ=`seams-theme-overrides`,KJ=[`.seams-wallet-ui`,`.seams-auth-menu-surface`,`.seams-host-themed-dialog`],qJ=KJ.join(`,
-`),JJ=KJ.map(e=>`${e}[theme="light"],\n:root[data-seams-theme="light"] ${e}:not([theme="dark"])`).join(`,
-`);let YJ=null;function XJ(){return YJ||=ju({doc:document,baseCss:``,dynamicStyleDataAttr:`data-seams-theme-overrides`,nonce:()=>Au()}),YJ}function ZJ(e){if(!e||typeof e!=`object`)return{};let t={};for(let[n,r]of Object.entries(e))typeof r==`string`&&(t[n]=r);return t}function QJ(e){return e===`light`||e===`dark`?e:void 0}function $J(e){return!e||typeof e!=`object`||Array.isArray(e)?null:e}function eY(e){if(Array.isArray(e))return e.map(e=>eY(e));if(e&&typeof e==`object`){let t=e,n={};for(let e of Object.keys(t).sort())n[e]=eY(t[e]);return n}return e}function tY(e){try{return JSON.stringify(eY(e))}catch{return``}}function nY(e){return tY({chains:e?.chains,relayerAccount:e?.relayerAccount,relayer:e?.relayer,registration:e?.registration,signingSessionDefaults:e?.signingSessionDefaults,signingSessionPersistenceMode:e?.signingSessionPersistenceMode,routerAb:e?.routerAb,routerAbEcdsaDerivationPresignaturePool:e?.routerAbEcdsaDerivationPresignaturePool,provisioningDefaults:e?.provisioningDefaults,authenticatorOptions:e?.authenticatorOptions,iframeWallet:e?.iframeWallet})}function rY(e){let t=e.trim();return t&&/^[A-Za-z][A-Za-z0-9_-]*$/.test(t)?t:null}function iY(e){let t=e.trim();return!t||t.length>1024||/[{};\n\r]/.test(t)?null:t}function aY(e,t){let n=[];for(let[r,i]of Object.entries(e)){let e=rY(r);if(!e)continue;let a=iY(i);a&&n.push(`  --seams-${t}-${e}: ${a} !important;`)}return n}function oY(e){let t=$J(e);if(!t)return;let n=t.theme;return QJ(n)||QJ($J(n)?.mode)}function sY(e,t){let n=$J($J(e)?.theme);return(typeof n?.id==`string`?n.id.trim():``)||t}function cY(e,t){return ZJ($J($J($J($J(e)?.tokens)?.[t])?.colors))}function lY(e,t){let n=$J($J(e)?.theme);return QJ(n?.mode)===t?ZJ(n?.colors):{}}function uY(e,t){return{...cY(e,t),...lY(e,t)}}function dY(e){return ZJ($J($J(e)?.theme)?.shape)}function fY(e){if(e.incoming===void 0)return e.previous;let t=oY(e.incoming)??oY(e.previous);if(!t)return e.previous;let n=sY(e.previous,`default`),r=sY(e.incoming,n),i=r!==n,a={...i?{}:uY(e.previous,t),...uY(e.incoming,t)},o={...i?{}:dY(e.previous),...dY(e.incoming)};return{theme:{id:r,mode:t,colors:a,...Object.keys(o).length>0?{shape:o}:{}},palette:`default`}}function pY(e){let t=oY(e),n=[...aY(t?uY(e,t):{},`colors`),...aY(dY(e),`shape`)],r=[];if(t&&n.length>0){let e=t===`light`?JJ:qJ;r.push(`${e} {\n${n.join(`
-`)}\n}`)}let i=r.join(`
-
-`).trim();if(!i){XJ().deleteDynamicRule(GJ);return}XJ().setDynamicRule(GJ,i)}function mY(){return{parentOrigin:null,port:null,walletConfigs:null,nearClient:null,seamsWeb:null,prefsUnsubscribe:null,lifecycleSource:null,lifecycleUnsubscribe:null,lifecycleListener:null,expiredSessionsByWallet:new Map,surfaceMeasurementBinding:{kind:`disabled`}}}function hY(){return{kind:`wallet_host`}}function gY(e){let{walletConfigs:t}=e;if(!t)throw Error(`Wallet service not configured. Call PM_SET_CONFIG first.`);let n=hY(),r=Or(t.chains||[]);if(e.nearClient||=new _u(r),!e.seamsWeb){let r=UJ(t);WJ(r),$l(!0),e.seamsWeb=new HJ(r,e.nearClient,n),e.seamsWeb.prewarm({workers:!0}).catch(()=>{}),_Y(e)}return e.seamsWeb}function _Y(e){try{let t=e.seamsWeb;if(!t)return;let n=t.theme;(n===`light`||n===`dark`)&&document.documentElement.setAttribute(`data-seams-theme`,n)}catch{}}function vY(e,t){let n=e.walletConfigs||{},r=nY(e.walletConfigs),i=t?.signingSessionPersistenceMode??n.signingSessionPersistenceMode,a=Array.isArray(t?.chains)?t.chains.map(Mr):Array.isArray(n.chains)?n.chains.map(Mr):[],o=fY({previous:n.appearance,incoming:t?.appearance}),s=oY(o);e.walletConfigs=UJ({chains:a,relayerAccount:t?.relayerAccount??n.relayerAccount??``,signingSessionDefaults:t?.signingSessionDefaults??n.signingSessionDefaults,signingSessionPersistenceMode:i,routerAb:t?.routerAb??n.routerAb,routerAbEcdsaDerivationPresignaturePool:t?.routerAbEcdsaDerivationPresignaturePool??n.routerAbEcdsaDerivationPresignaturePool,provisioningDefaults:t?.provisioningDefaults??n.provisioningDefaults,relayer:t?.relayer||n.relayer?{...n.relayer||{},...t?.relayer||{}}:void 0,registration:t?.registration===void 0?n.registration:t.registration,authenticatorOptions:t?.authenticatorOptions??n.authenticatorOptions,iframeWallet:{...n.iframeWallet||{},...t?.iframeWallet||{}},appearance:o});let c=nY(e.walletConfigs);try{s&&document.documentElement.setAttribute(`data-seams-theme`,s),pY(o)}catch{}if(e.seamsWeb&&o&&c===r)try{e.seamsWeb.setAppearance(o)}catch{}try{let e=t?.assetsBaseUrl,n=window.location.origin||window.location.href,r=(()=>{try{let e=new URL(`/sdk/`,n).toString();return e.endsWith(`/`)?e:e+`/`}catch{return`/sdk/`}})(),i=A(e)?e:void 0;if(i!==void 0)try{let e=new URL(i,n);e.origin===n&&(r=e.toString().endsWith(`/`)?e.toString():e.toString()+`/`)}catch{}re(r)}catch{}c!==r&&(e.seamsWeb?.dispose(),e.prefsUnsubscribe?.(),e.lifecycleUnsubscribe?.(),e.prefsUnsubscribe=null,e.lifecycleSource=null,e.lifecycleUnsubscribe=null,e.nearClient=null,e.seamsWeb=null)}function yY(e,t){e.lifecycleSource!==t&&(e.lifecycleUnsubscribe?.(),e.lifecycleSource=t,e.lifecycleUnsubscribe=t.onSdkLifecycleEvent(SY.bind(null,e)))}function bY(e,t){e.lifecycleListener=t,e.seamsWeb&&yY(e,e.seamsWeb)}function xY(e){throw Error(`Unhandled SDK lifecycle event: ${String(e)}`)}function SY(e,t){switch(t.event){case`signing_session.expired`:{let n=e.expiredSessionsByWallet.get(t.walletId);if(n?.has(t.walletSessionId))return;n?n.add(t.walletSessionId):e.expiredSessionsByWallet.set(t.walletId,new Set([t.walletSessionId])),e.lifecycleListener?.(t);return}case`registration.near_provisioning_changed`:e.lifecycleListener?.(t);return;default:return xY(t)}}let CY=null,wY=null;function TY(e){return e&&typeof e==`object`&&!Array.isArray(e)?e:{}}function EY(e,t){let n=e[t];if(typeof n!=`string`||n.length===0||n.trim()!==n)throw Error(`${t} must be a non-empty canonical string`);return n}function DY(e,t,n){if(Object.keys(e).length!==t.size)throw Error(`${n} fields are invalid`);for(let r of t)if(!Object.hasOwn(e,r))throw Error(`Missing ${n} field: ${r}`)}function OY(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} must be a canonical HTTP origin`);let n;try{n=new URL(e)}catch{throw Error(`${t} must be a canonical HTTP origin`)}if(n.protocol!==`https:`&&n.protocol!==`http:`||n.origin!==e||n.pathname!==`/`||n.search!==``||n.hash!==``)throw Error(`${t} must be a canonical HTTP origin`);return n.origin}function kY(e){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`relayUrl must be a non-empty canonical string`);return l(e)}function AY(e){if(!Number.isSafeInteger(e)||Number(e)<=Date.now())throw Error(`hosted-wallet Wallet Session is expired or invalid`);return Number(e)}function jY(e,t){let n=TY(e);if(DY(n,new Set([`ok`,`code`,`message`]),`hosted-wallet exchange failure`),n.ok!==!1)throw Error(`hosted-wallet exchange failure is invalid`);let r=EY(n,`code`),i=EY(n,`message`),a=Error(i);return a.code=r,a.status=t,a}function MY(e){if(typeof e!=`string`||!/^wsh_[A-Za-z0-9_-]{43}$/.test(e))throw Error(`hosted-wallet operationCredential.token is invalid`);return e}function NY(e){let t=br(e);if(!t.ok)throw Error(`walletSessionId is invalid: ${t.error.message}`);return t.value}function PY(e){let t=TY(e);if(DY(t,new Set([`kind`,`token`,`walletSessionId`]),`hosted-wallet operationCredential`),t.kind!==`opaque_hosted_wallet_session_operation_credential_v1`)throw Error(`hosted-wallet operationCredential.kind is invalid`);return{kind:t.kind,token:MY(t.token),walletSessionId:NY(t.walletSessionId)}}function FY(e){let t=TY(e);if(t.ok!==!0)throw jY(t,400);DY(t,new Set([`ok`,`walletSessionId`,`operationCredential`,`expiresAtMs`]),`hosted-wallet session redemption response`);let n=NY(t.walletSessionId),r=PY(t.operationCredential);if(r.walletSessionId!==n)throw Error(`hosted-wallet operationCredential does not identify its parent Wallet Session`);return{operationCredential:r,expiresAtMs:AY(t.expiresAtMs)}}async function IY(e){try{return await e.json()}catch{return null}}function LY(e){wY=OY(e,`adopted parent origin`)}function RY(e){let t=CY;if(t){if(t.expiresAtMs<=Date.now()||t.appOrigin!==wY||t.walletOrigin!==window.location.origin||e!==void 0&&t.relayUrl!==kY(e)){CY=null;return}return t.operationCredential}}function zY(){CY=null,wY=null}function BY(e){return JSON.stringify({exchangeCode:e.exchangeCode,nonce:e.nonce,appOrigin:e.appOrigin,walletOrigin:e.walletOrigin})}async function VY(e,t){let n=ce(e),r=kY(t);if(kY(n.relayUrl)!==r)throw Error(`Hosted-wallet redemption relayUrl does not match its request boundary`);if(n.walletOrigin!==window.location.origin)throw Error(`Hosted-wallet redemption walletOrigin does not match the wallet host`);if(wY===null||n.appOrigin!==wY)throw Error(`Hosted-wallet redemption appOrigin does not match the adopted iframe parent`);let i=await fetch(a(r,`/wallet/session/exchange/redeem`),{method:`POST`,headers:{"Content-Type":`application/json`},body:BY(n)}),o=await IY(i);if(!i.ok)throw jY(o,i.status);let s=FY(o),c={kind:`active_hosted_wallet_seams_session`,operationCredential:s.operationCredential,expiresAtMs:s.expiresAtMs,relayUrl:r,appOrigin:n.appOrigin,walletOrigin:n.walletOrigin};return CY=c,c}let HY=null;const UY=new Map,WY=new Set([`PM_REGISTER_WALLET`,`PM_ADD_WALLET_SIGNER`,`PM_ADD_PASSKEY`,`PM_ADD_EMAIL_OTP`,`PM_REVOKE_AUTH_METHOD`,`PM_UNLOCK_ADDED_EMAIL_OTP_WALLET`,`PM_SIGN_TX_WITH_ACTIONS`,`PM_SIGN_AND_SEND_TX`,`PM_EXECUTE_ACTION`,`PM_SIGN_DELEGATE_ACTION`,`PM_SIGN_NEP413`,`PM_UNLOCK`,`PM_SIGN_TEMPO`,`PM_ENROLL_EMAIL_OTP`,`PM_LOGIN_EMAIL_OTP_ECDSA_CAPABILITY`,`PM_ROTATE_WALLET_RECOVERY_CODES`,`PM_ACKNOWLEDGE_WALLET_RECOVERY_CODE_BACKUP`,`PM_SYNC_ACCOUNT_FLOW`,`PM_EXPORT_KEYPAIR_UI`,`PM_SCAN_AND_LINK_DEVICE`,`PM_START_DEVICE2_LINKING_FLOW`]);function GY(e,t){e.post({type:`SURFACE_MEASUREMENT`,payload:t})}function KY(e){if(e.type!==`PM_EXPORT_KEYPAIR_UI`)return;let t=e.payload?.options?.variant;return t===`modal`||t===`drawer`?t:`drawer`}function qY(e){let t;try{t=se(e.req.requestId)}catch{return null}let n=KY(e.req);return{requestId:t,binding:{kind:`wallet_iframe`,...e.transactionReview?{transactionReview:e.transactionReview}:{},requestId:t,postMeasurement:GY.bind(null,e),...n?{hostSurfaceVariant:n}:{}}}}function JY(e){return WY.has(e.req.type)}function YY(e,t){let n=e.surfaceMeasurementBinding;n.kind!==`wallet_iframe`||n.requestId!==t||(e.surfaceMeasurementBinding={kind:`disabled`},e.seamsWeb?.setWalletIframeSurfaceMeasurementBinding({kind:`disabled`}))}function XY(e,t){e.surfaceMeasurementBinding=t,gY(e).setWalletIframeSurfaceMeasurementBinding(t)}function ZY(e){return HY||=mY(),HY.parentOrigin=e.parentOrigin,HY.port=e.port,e.parentOrigin!==null&&LY(e.parentOrigin),bY(HY,nX.bind(null,HY)),e.walletConfigs&&=(vY(HY,e.walletConfigs),HY.walletConfigs),HY}function QY(e){!HY||!e.walletConfigs||ZY(e)}function $Y(e,t){let n=e.seamsWeb,r=gY(e);if(yY(e,r),n===r)return r;let i=r.preferences;e.prefsUnsubscribe?.();let a=()=>{let e=String(i.getCurrentWalletId?.()||``).trim();t.post({type:`PREFERENCES_CHANGED`,payload:{walletId:e||null,confirmationConfig:i.getConfirmationConfig(),updatedAt:Date.now()}})},o=i.onConfirmationConfigChange?.(a)||null,s=i.onCurrentWalletChange?.(a)||null;return e.prefsUnsubscribe=()=>{try{o?.()}catch{}try{s?.()}catch{}},Promise.resolve().then(a).catch(()=>{}),r}function eX(e,t){return{getSeamsWeb:$Y.bind(null,e,t),post:tX.bind(null,t),postProgress:(e,n)=>{e&&tX(t,{type:`PROGRESS`,requestId:e,payload:n})},isCancelled:t.isCancelled,respondIfCancelled:t.respondIfCancelled}}function tX(e,t){Xf(t),e.post(t)}function nX(e,t){e.port?.postMessage({type:`SDK_LIFECYCLE_EVENT`,payload:t})}async function rX(e,t){if(e.respondIfCancelled(e.req.requestId))return;let n=ZY(e.state);Zf(e.req,e.post);let r=JY(e)?qY(e):null;r&&XY(n,r.binding);try{let r=UY.get(t);r||(r=t(eX(n,e)),UY.set(t,r));let i=r[e.req.type];if(!i)throw Error(`Unsupported wallet iframe request type: ${e.req.type}`);await i(e.req),Jf(e.req)}catch(t){throw Yf(e.req.requestId,t),t}finally{r&&YY(n,r.requestId)}}export{tW as a,rz as c,fL as d,BI as f,cp as g,lp as h,rX as handleWalletHostRuntimeRequestWithHandlers,TU as i,qF as l,Y as m,zY as n,HH as o,wF as p,VY as r,GH as s,QY as syncActiveWalletHostRuntimeConfig,RY as t,UI as u};