@seams/wallet 0.8.0 → 0.9.0

package/dist/public/sdk/nearEd25519YaoSigningPreparation-B0d1AG3u.js

@@ -0,0 +1 @@
+import{f as e,w as t}from"./normalize-kUDm5zfS.js";import{c as n}from"./chains-CiYQT1K4.js";import{t as r}from"./activeWalletSession-DiZcKjB_.js";import{l as i,o as a}from"./accountIds-BzZs7YoX.js";import{a as o,c as s,o as c}from"./ecdsaChainTarget-C8ZtMZ8l.js";import{C as l,Ct as u,Nt as d,T as ee,Tt as te,o as ne,wt as f,xt as p}from"./emailOtpEcdsaDerivationIdentity-B8HzTh4T.js";import{a as m,i as h,l as g,o as _,u as v}from"./challengeDelivery-DxXAkOfS.js";import{t as y}from"./signerSlot-Dto7dObP.js";import{c as b,r as x}from"./types-D3GM-uHR.js";function S(e){throw Error(`[SigningSession] unsupported exact signing lane branch: ${String(e)}`)}function C(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`[SigningSession] ${t} must be an object`);return e}function w(e,t){let n=String(e??``).trim();if(!n)throw Error(`[SigningSession] ${t} is required`);return n}function T(e,t,n){for(let r of t)if(e[r]!==void 0)throw Error(`[SigningSession] ${n} exact lane cannot include ${r}`)}function E(e){let t=C(e,`exact lane auth`);switch(t.kind){case`passkey`:return{kind:`passkey`,rpId:ee(t.rpId),credentialIdB64u:w(t.credentialIdB64u,`credentialIdB64u`)};case`email_otp`:return{kind:`email_otp`,providerSubjectId:w(t.providerSubjectId,`providerSubjectId`)};default:throw Error(`[SigningSession] exact lane auth kind is unsupported`)}}function D(e){let t=C(e,`ECDSA exact lane chainTarget`),n=o({kind:t.kind,namespace:t.namespace,chainId:t.chainId,networkSlug:t.networkSlug});if(t.key!=null&&String(t.key)!==c(n))throw Error(`[SigningSession] exact ECDSA lane chain target key mismatch`);return n}function O(e){let t=C(e,`ECDSA exact lane key identity`);if(t.keyScope!==`evm-family`)throw Error(`[SigningSession] exact ECDSA lane keyScope must be evm-family`);return ne({walletId:t.walletId,ecdsaThresholdKeyId:t.ecdsaThresholdKeyId,signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion,participantIds:t.participantIds,thresholdOwnerAddress:t.thresholdOwnerAddress})}function k(e){let n=t(e);if(!n.ok)throw Error(n.error.message);return n.value}function A(e){let t=i(e.nearAccountId);if(!t.ok)throw Error(`[SigningSession] invalid exact Ed25519 NEAR account: ${t.message}`);let n=g({walletId:s(e.walletId)});return a(t.value)?h({wallet:n,nearAccountId:t.value}):m({wallet:n,nearAccountId:t.value})}function j(e){let t=Number(e.signerSlot);if(!Number.isSafeInteger(t)||t<1)throw Error(`[SigningSession] exact Ed25519 signer requires signerSlot >= 1`);return _({account:A({walletId:e.walletId,nearAccountId:e.nearAccountId}),nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:t})}function M(e){if(String(e.key.walletId)!==String(e.walletId))throw Error(`[SigningSession] exact ECDSA lane identity wallet mismatch`);let t=k(e.materialActivation);if(String(t.materialOwner)!==String(e.walletId))throw Error(`[SigningSession] exact ECDSA lane material owner mismatch`);return{kind:`evm_family_ecdsa_signer`,walletId:s(e.walletId),chainTarget:e.chainTarget,keyHandle:e.keyHandle,key:e.key,materialActivation:t}}function N(e){let t=C(e,`ECDSA exact lane signer`);if(t.kind!==`evm_family_ecdsa_signer`)throw Error(`[SigningSession] expected EVM-family ECDSA signer`);let n=D(t.chainTarget),r=O(t.key);return M({walletId:s(t.walletId),chainTarget:n,keyHandle:l(t.keyHandle),key:r,materialActivation:k(t.materialActivation)})}function P(e){return e.kind===`evm`?{key:c(e),kind:`evm`,namespace:`eip155`,chainId:e.chainId}:{key:c(e),kind:`tempo`,chainId:e.chainId}}function F(e){return{walletId:String(e.walletId),keyScope:e.keyScope,ecdsaThresholdKeyId:String(e.ecdsaThresholdKeyId),signingRootId:String(e.signingRootId),signingRootVersion:String(e.signingRootVersion),participantIds:[...e.participantIds].map(e=>Number(e)),thresholdOwnerAddress:String(e.thresholdOwnerAddress).toLowerCase()}}function I(e){switch(e.kind){case`passkey`:return{kind:`passkey`,rpId:String(e.rpId),credentialIdB64u:String(e.credentialIdB64u)};case`email_otp`:return{kind:`email_otp`,providerSubjectId:String(e.providerSubjectId)};default:return S(e)}}function L(e){return{kind:`evm_family_ecdsa_signer`,walletId:String(e.walletId),keyHandle:String(e.keyHandle),chainTarget:P(e.chainTarget),key:F(e.key),materialActivation:{kind:e.materialActivation.kind,activationId:String(e.materialActivation.activationId),capability:String(e.materialActivation.capability),materialOwner:String(e.materialActivation.materialOwner),keyBinding:String(e.materialActivation.keyBinding),lifecycleBinding:String(e.materialActivation.lifecycleBinding),signingWorker:String(e.materialActivation.signingWorker)}}}function R(e){return Y(e)?{kind:`exact_signing_lane`,signer:L(e.signer),auth:I(e.auth)}:{kind:`exact_signing_lane`,signer:{kind:`near_ed25519_signer`,account:{kind:e.signer.account.kind,walletId:String(e.signer.account.wallet.walletId),nearAccountId:String(e.signer.account.nearAccountId)},nearEd25519SigningKeyId:String(e.signer.nearEd25519SigningKeyId),signerSlot:Number(e.signer.signerSlot)},auth:I(e.auth),walletSessionId:String(e.walletSessionId),quotaId:String(e.quotaId),thresholdSessionId:String(e.thresholdSessionId)}}function z(e){return n(R(e))}function B(e){return{kind:`exact_signing_lane`,signer:e.signer,auth:e.auth,walletSessionId:x.walletSession(e.walletSessionId),quotaId:x.walletSessionQuota(e.quotaId),thresholdSessionId:x.thresholdEd25519Session(e.thresholdSessionId)}}function V(e){return{kind:`exact_ed25519_export_material`,signer:e.signer,auth:e.auth,thresholdSessionId:x.thresholdEd25519Session(e.thresholdSessionId)}}function H(e){return{kind:`exact_signing_lane`,signer:e.signer,auth:e.auth}}function U(e){return e.identity}function W(e){return e.identity}function G(e){return e.identity}function K(e){let t=C(e,`exact Ed25519 export material identity`);if(t.kind!==`exact_ed25519_export_material`)throw Error(`[SigningSession] expected exact Ed25519 export material identity`);T(t,[`walletSessionId`,`quotaId`,`walletId`,`nearAccountId`,`nearEd25519SigningKeyId`,`chainTarget`,`keyHandle`,`key`,`curve`,`chainFamily`,`accountId`,`subjectId`,`authMethod`,`authorization`],`nested`);let n=v(C(t.signer,`exact Ed25519 export material signer`));if(!n.ok)throw Error(n.error.message);return V({signer:n.value,auth:E(t.auth),thresholdSessionId:t.thresholdSessionId})}function q(e){let t=J(e);if(Y(t))return t;throw Error(`[SigningSession] expected exact ECDSA lane identity`)}function J(e){let t=C(e,`exact signing lane identity`);if(t.kind!==`exact_signing_lane`)throw Error(`[SigningSession] expected exact signing lane identity`);T(t,[`walletId`,`nearAccountId`,`nearEd25519SigningKeyId`,`chainTarget`,`keyHandle`,`key`,`curve`,`chainFamily`,`accountId`,`subjectId`,`authMethod`,`authorization`],`nested`);let n=C(t.signer,`exact lane signer`),r=E(t.auth);switch(n.kind){case`near_ed25519_signer`:{let e=v(n);if(!e.ok)throw Error(e.error.message);return B({signer:e.value,auth:r,walletSessionId:t.walletSessionId,quotaId:t.quotaId,thresholdSessionId:t.thresholdSessionId})}case`evm_family_ecdsa_signer`:return H({signer:N(n),auth:r});default:throw Error(`[SigningSession] exact signing lane signer kind is unsupported`)}}function Y(e){return e.signer.kind===`evm_family_ecdsa_signer`}function X(e){switch(e.signer.kind){case`near_ed25519_signer`:return e.signer.account.wallet.walletId;case`evm_family_ecdsa_signer`:return e.signer.walletId;default:return S(e.signer)}}function Z(e,t){if(e.signer.kind!==`evm_family_ecdsa_signer`)throw Error(`[SigningSession] ${t} requires an EVM-family ECDSA signer`);return e.signer}function re(e,t){if(e.signer.kind!==`near_ed25519_signer`)throw Error(`[SigningSession] ${t} requires a NEAR Ed25519 signer`);return e.signer}function ie(e,t=`NEAR protocol projection`){let n=re(e,t);return{walletId:n.account.wallet.walletId,nearAccountId:n.account.nearAccountId,nearEd25519SigningKeyId:n.nearEd25519SigningKeyId,signerSlot:n.signerSlot}}function ae(e,t){return z(e)===z(t)}function oe(e){return String(te(e.authority))}function se(e){return f(e.authority)}function ce(e){return u(e.authority)}function le(e){switch(e.use.kind){case`session`:return`session`;case`single_use_pending`:case`single_use_consumed`:return`single_use`}throw e.use,Error(`[SigningSession] unsupported Email OTP auth use`)}function ue(e){return e.use.kind===`single_use_consumed`?e.use.consumedAtMs:null}function de(e){return e.use.kind===`session`}function fe(e){return e.use.kind===`single_use_pending`}function Q(e){if(e.policy===`per_operation`&&e.retention!==`single_use`)throw Error(`Invalid Email OTP auth context: per-operation sessions must be single-use`);if(e.retention===`single_use`&&Object.prototype.hasOwnProperty.call(e,`reason`))throw Error(`Invalid Email OTP auth context: single-use sessions must not carry reason`);let t=Math.floor(Number(e.consumedAtMs)||0),n=e.retention===`session`?{kind:`session`,reason:e.reason}:t>0?{kind:`single_use_consumed`,consumedAtMs:t}:{kind:`single_use_pending`};return{policy:e.policy,authMethod:`email_otp`,authority:e.authority,use:n}}function pe(e){let t=e.authority;if(e.retention===`session`)return Q({policy:e.policy,reason:e.reason,retention:`session`,authority:t});if(Object.prototype.hasOwnProperty.call(e,`reason`))throw Error(`Invalid Email OTP auth context: single-use sessions must not carry reason`);let n=Math.floor(Number(e.consumedAtMs)||0);return Q(n>0?{policy:e.policy,retention:`single_use`,authority:t,consumedAtMs:n}:{policy:e.policy,retention:`single_use`,authority:t})}function me(e){let t=p({walletId:e.walletId,provider:e.provider,providerUserId:e.providerUserId,emailHashHex:e.emailHashHex});if(e.retention===`session`)return Q({policy:e.policy,reason:e.reason,retention:`session`,authority:t});if(Object.prototype.hasOwnProperty.call(e,`reason`))throw Error(`Invalid Email OTP auth context: single-use sessions must not carry reason`);let n=Math.floor(Number(e.consumedAtMs)||0);return Q(n>0?{policy:e.policy,retention:`single_use`,authority:t,consumedAtMs:n}:{policy:e.policy,retention:`single_use`,authority:t})}function he(e){let t=y(e.signerSlot);if(t==null)throw Error(`[SigningSession] selected Ed25519 lane requires signerSlot >= 1`);let n=x.walletSession(e.walletSessionId),r=x.walletSessionQuota(e.quotaId),i=x.thresholdEd25519Session(e.thresholdSessionId);return{kind:`selected_lane`,identity:B({signer:j({walletId:e.walletId,nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:t}),auth:e.auth,walletSessionId:n,quotaId:r,thresholdSessionId:i}),auth:e.auth,curve:`ed25519`,chain:`near`,walletSessionId:n,quotaId:r,thresholdSessionId:i}}function ge(e){if(!e.key)throw Error(`[SigningSession] selected ECDSA lane requires shared key identity`);let t=l(e.keyHandle);if(String(e.key.walletId)!==String(e.walletId))throw Error(`[SigningSession] selected ECDSA lane wallet mismatch`);return{kind:`selected_lane`,identity:H({signer:M({walletId:e.walletId,chainTarget:e.chainTarget,keyHandle:t,key:e.key,materialActivation:e.materialActivation}),auth:e.auth}),auth:e.auth,curve:`ecdsa`,chain:e.chainTarget.kind,materialActivation:e.materialActivation,authorization:e.authorization}}function _e(e){let t=Math.floor(Number(e.nowMs)||Date.now());return e.expiresAtMs<=t?`expired`:e.remainingUses<=0?`exhausted`:`ready`}function ve(e){return b(e.auth)}function ye(e){switch(e.kind){case`found`:return{kind:`authorized`,authorization:e.authorization};case`expired`:case`exhausted`:return{kind:`operation_step_up`,reason:e.kind};case`persistence_unavailable`:return{kind:`temporarily_unavailable`,reason:e.kind};case`missing`:case`corrupt`:case`upgrade_required`:case`superseded`:case`authority_unavailable`:case`method_unavailable`:case`capability_unavailable`:case`unavailable`:return{kind:`full_login_required`,reason:e.kind};default:throw Error(`[SigningEngine][near] unsupported Wallet Session authorization state`)}}function be(e){switch(e.kind){case`use_live_runtime`:case`rehydrate_material_activation`:case`reauthorize_public_anchor`:return e.authority;case`blocked`:return null;default:throw Error(`[SigningEngine][near] unsupported MPC hydration plan`)}}function $(e){let{selectedAuthority:t,selectedAuthMethod:n,selectedFactorAuthority:r}=e;return t.state!==`active`||t.walletId!==n.walletId||t.authorityId!==n.walletAuthorityId||t.signerActivations.ed25519===void 0||r.walletId!==n.walletId||r.bindingId!==n.walletAuthMethodId?!1:n.kind===`passkey`?r.factor.kind===`passkey`&&r.factor.credentialIdB64u===n.credentialIdB64u&&r.verifier.kind===`webauthn`&&r.verifier.rpId===n.rpId:r.factor.kind===`email_otp`&&r.verifier.kind===`email_otp_wallet_auth_method`&&r.verifier.emailHashHex===n.emailHashHex&&r.factor.providerUserId.trim().length>0}function xe(e){let{authorization:t,nowMs:n}=e,{selectedAuthority:i,selectedAuthMethod:a,session:o,operationCredential:s,status:c}=t;return!(!$({selectedAuthority:i,selectedAuthMethod:a,selectedFactorAuthority:t.selectedFactorAuthority})||o.kind!==`active_wallet_session_v1`||o.walletId!==i.walletId||o.authorityId!==i.authorityId||o.authMethodId!==a.walletAuthMethodId||o.authorityDigestB64u!==i.authorityDigestB64u||o.authorityRevocationEpoch!==i.revocationEpoch||s.kind!==`opaque_wallet_session_operation_credential_v1`||s.token.trim().length===0||s.walletSessionId.trim().length===0||o.authorizationId.trim().length===0||o.quotaId.trim().length===0||o.expiresAtMs<=n||c.status!==`active`||c.walletSessionId!==s.walletSessionId||c.quotaId!==o.quotaId||c.remainingUses<=0||c.expiresAtMs<=n||c.quotaLifecycle!==`active`||c.authorization.expiresAtMs!==o.expiresAtMs||!r(c.authorization,o))}function Se(t){let n=0;for(let r of t.session.capabilitySubjects)r.kind===`sign`&&r.keyFamily===`ed25519`&&e(r.materialActivation,t.materialActivation)&&(n+=1);return n===1}async function Ce(e){let t=be(e.hydration);if(!t)return;let n=await d({authority:e.authorization.selectedFactorAuthority});if(t.walletId!==n.walletId||t.walletAuthMethodId!==n.walletAuthMethodId||t.authorityDigest!==n.authorityDigest)throw Error(`[SigningEngine][near] Wallet Session authorization does not match material authority`)}function we(e){let{requirement:t,authorization:n}=e;if(t.kind!==n.selectedAuthMethod.kind)throw Error(`[SigningEngine][near] Wallet Session authorization does not match material factor`);if(t.kind===`passkey`){if(n.selectedAuthMethod.kind!==`passkey`||String(t.rpId)!==String(n.selectedAuthMethod.rpId)||t.credentialIdB64u!==n.selectedAuthMethod.credentialIdB64u)throw Error(`[SigningEngine][near] Wallet Session authorization does not match Passkey factor`);return}if(n.selectedAuthMethod.kind!==`email_otp`||n.selectedFactorAuthority.factor.kind!==`email_otp`||t.providerSubjectId!==n.selectedFactorAuthority.factor.providerUserId)throw Error(`[SigningEngine][near] Wallet Session authorization does not match Email OTP factor`)}function Te(e){if(!Number.isSafeInteger(e.nowMs)||e.nowMs<0)throw Error(`[SigningEngine][near] Wallet Session authorization requires a valid timestamp`);let t={kind:`exact_near_ed25519_wallet_session_authorization_v1`,selectedAuthority:e.selectedAuthority,selectedAuthMethod:e.selectedAuthMethod,selectedFactorAuthority:e.selectedFactorAuthority,session:e.session,operationCredential:e.operationCredential,status:e.status};if(!xe({authorization:t,nowMs:e.nowMs}))throw Error(`[SigningEngine][near] Exact Wallet Session authorization identity is invalid`);return t}async function Ee(e){return we(e),await Ce(e),{kind:`near_ed25519_yao_signing_preparation`,hydration:e.hydration,authorization:{kind:`authorized`,authorization:e.authorization}}}function De(e){return{kind:`near_ed25519_yao_signing_preparation`,hydration:e.hydration,authorization:{kind:`authorization_required`,requirement:e.requirement}}}export{Y as A,V as C,z as D,U as E,Z as F,ie as M,q as N,ae as O,K as P,G as S,W as T,_e as _,Se as a,M as b,pe as c,se as d,oe as f,ve as g,de as h,ye as i,j,X as k,ue as l,fe as m,De as n,Q as o,le as p,Ee as r,me as s,Te as t,ce as u,ge as v,B as w,H as x,he as y};

package/dist/public/sdk/nonceLaneKeys-Fkvk2UPy.js

@@ -0,0 +1 @@
+import{r as e}from"./secureRandomId-BIekT8bE.js";import{o as t}from"./ecdsaChainTarget-C8ZtMZ8l.js";const n={Reserved:`reserved`,Released:`released`,Expired:`expired`,Signed:`signed`,SignedLeaseExpired:`signed_lease_expired`,BroadcastAccepted:`broadcast_accepted`,BroadcastRejected:`broadcast_rejected`,Finalized:`finalized`,Dropped:`dropped`,Replaced:`replaced`,Reconciled:`reconciled`},r={Reserved:n.Reserved,Signed:n.Signed,BroadcastAccepted:n.BroadcastAccepted},i={LeaseReserved:`nonce_lease_reserved`,LeaseReleased:`nonce_lease_released`,LeaseExpired:`nonce_lease_expired`,LeaseSigned:`nonce_lease_signed`,LeaseBroadcastAccepted:`nonce_lease_broadcast_accepted`,LeaseBroadcastRejected:`nonce_lease_broadcast_rejected`,LeaseFinalized:`nonce_lease_finalized`,LeaseDropped:`nonce_lease_dropped`,LeaseReplaced:`nonce_lease_replaced`,Metrics:`nonce_coordinator_metrics`,LaneAlert:`nonce_lane_alert`,CoordinationDegraded:`nonce_coordination_degraded`,LanesCleared:`nonce_lanes_cleared`,LaneReconciled:`nonce_lane_reconciled`},a={Dropped:`dropped`,Replaced:`replaced`},o={WebLocksUnavailable:`web_locks_unavailable`,IndexedDBUnavailable:`indexeddb_unavailable`,DurableLockTimeout:`durable_lock_timeout`,DurableStoreError:`durable_store_error`,MalformedDurableRecord:`malformed_durable_record`},s={InRuntimeLock:`in_runtime_lock`,None:`none`},c={NonceAdvancedHashMissing:`near_nonce_advanced_hash_missing`,HashMissingNonceNotAdvanced:`near_hash_missing_nonce_not_advanced`},l=Object.values(n);function u(e){return{family:`evm`,chainTarget:e.chainTarget,subjectId:e.subjectId,sender:e.sender,...e.nonceKey==null?{}:{nonceKey:e.nonceKey}}}function d(e){return y(e),{...m(e.lane),nonce:e.nonce,leaseId:e.leaseId,operationId:String(e.operationId),operationFingerprint:String(e.operationFingerprint),reservedAtMs:e.reservedAtMs,expiresAtMs:e.expiresAtMs}}function f(e){return u(e)}function p(e){return{leaseId:e.leaseId,operationId:String(e.operationId),operationFingerprint:String(e.operationFingerprint),nonce:String(e.nonce),...e.batchId?{batchId:e.batchId}:{},...Number.isSafeInteger(e.txIndex)?{txIndex:e.txIndex}:{}}}function m(e){return{chainTarget:e.chainTarget,subjectId:e.subjectId,sender:e.sender,...e.nonceKey==null?{}:{nonceKey:e.nonceKey}}}function h(e){return e.family===`near`?e.networkKey:t(e.chainTarget)}function g(e){return e.family===`near`?e.walletId:e.subjectId}function _(e){return e.family===`near`?v(e):C([`evm`,t(e.chainTarget),e.subjectId,e.sender.toLowerCase(),e.nonceKey==null?``:String(e.nonceKey)])}function v(e){return C([`near`,e.networkKey,e.walletId,e.nearAccountId,e.publicKey])}function y(e){if(e.lane.family!==`evm`)throw Error(`[NonceCoordinator] expected an EVM-family nonce lease`)}function b(e,t,n){if(e.operationId!==t)throw Error(`[NonceCoordinator] nonce lease operation mismatch`);if(e.operationFingerprint!==n)throw Error(`[NonceCoordinator] nonce lease operation fingerprint mismatch`)}function x(t){let n=e(`nonce-lease`,32,`nonce lease IDs`);return`nonce-lease-v1:${C([t.chain,t.operationId,t.nonce,n])}`}function S(t){let n=e(`nonce-batch`,32,`nonce batch IDs`);return`nonce-batch-v1:${C([t.chain,t.operationId,t.firstNonce,t.count,n])}`}function C(e){return e.map(e=>{let t=String(e);return`${t.length}:${t}`}).join(`|`)}function w(){return e(`nonce-runtime`,32,`nonce runtime IDs`)}export{o as _,w as a,r as b,d as c,h as d,g as f,c as g,l as h,x as i,u as l,a as m,b as n,m as o,p,S as r,f as s,y as t,_ as u,s as v,n as x,i as y};

package/dist/public/sdk/normalization-CpLZcL2f.js

@@ -0,0 +1 @@
+const e=/^0x[0-9a-f]{8}$/;function t(e,t={}){let n=String(e||``).trim();if(!n)return`0x`;let r=/^0x/i.test(n)?`0x${n.slice(2)}`:`0x${n}`,i=r===`0x`?`0x`:r;return t.lowercase?i.toLowerCase():i}function n(n){let r=t(n,{lowercase:!0});if(e.test(r))return r}function r(e){let r=t(e,{lowercase:!0});if(!(!r.startsWith(`0x`)||r.length<10))return n(r.slice(0,10))}export{t as n,n as r,r as t};

package/dist/public/sdk/normalization-DCvuCvh0.js

@@ -0,0 +1 @@
+import{a as e,o as t}from"./normalize-kUDm5zfS.js";import{o as n}from"./ecdsaChainTarget-C8ZtMZ8l.js";function r(e){let n=t(e);return!n||n===`null`?null:n}function i(t){return e(t)}function a(t){return e(t)}function o(t){return e(t)}function s(e){return n(e)}function c(e){return typeof e==`string`&&e.length>0&&e.trim()===e?e:null}function l(e){return[e.chainIdKey,e.accountAddress].join(`\0`)}export{c as a,r as i,o as n,l as o,i as r,s,a as t};

package/dist/public/sdk/normalize-kUDm5zfS.js

@@ -0,0 +1 @@
+var e=class{retainProof(){return!0}constructor(e){this.retainProof(),this.kind=`mpc_material_activation_ref`,this.activationId=e.activationId,this.capability=e.capability,this.materialOwner=e.materialOwner,this.keyBinding=e.keyBinding,this.lifecycleBinding=e.lifecycleBinding,this.signingWorker=e.signingWorker}};function t(e,t){if(e==null)return{ok:!1,error:{code:`missing`,message:`${t} is required`}};if(typeof e!=`string`)return{ok:!1,error:{code:`invalid`,message:`${t} must be a string`}};let n=e.trim();return n?{ok:!0,value:n}:{ok:!1,error:{code:`missing`,message:`${t} is required`}}}function n(e){for(let t of e){let e=t.charCodeAt(0);if(e<=31||e===127)return!0}return!1}function r(e){for(let t of e)if(/\s/.test(t))return!0;return n(e)}function i(e){let n=t(e,`walletId`);return n.ok&&r(n.value)?{ok:!1,error:{code:`invalid`,message:`walletId must not contain whitespace or control characters`}}:n}function a(e){let n=t(e,`verifiedEmailAddress`);if(!n.ok)return n;let r=n.value.toLowerCase();return/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(r)?{ok:!0,value:r}:{ok:!1,error:{code:`invalid`,message:`verifiedEmailAddress must be an email address`}}}function o(e){return t(e,`emailOtpProviderUserId`)}function s(e){return t(e,`emailOtpChallengeId`)}function c(e){let n=t(e,`rpId`);return n.ok&&r(n.value)?{ok:!1,error:{code:`invalid`,message:`rpId contains whitespace or control characters`}}:n}function l(e){return t(e,`credentialIdB64u`)}function u(e){return t(e,`passkeyEnvelopeId`)}function d(e){return t(e,`walletAuthMethodId`)}function f(e){return t(e,`walletAuthorityId`)}function p(e){return t(e,`walletAuthorityBindingDigest`)}function m(e){return t(e,`capabilityInstanceRef`)}function h(e){return t(e,`mpcMaterialOwnerRef`)}function g(e){return t(e,`mpcCapabilityRuntimeRef`)}function _(e){return t(e,`mpcMaterialActivationId`)}function v(e){return t(e,`mpcSigningWorkerRef`)}function y(e){return t(e,`mpcKeyBindingRef`)}function b(e){return t(e,`mpcLifecycleBindingRef`)}function x(t){return new e(t)}function S(e,t){return e.activationId===t.activationId&&e.capability===t.capability&&e.materialOwner===t.materialOwner&&e.keyBinding===t.keyBinding&&e.lifecycleBinding===t.lifecycleBinding&&e.signingWorker===t.signingWorker}function C(e){switch(e){case`kind`:case`activationId`:case`capability`:case`materialOwner`:case`keyBinding`:case`lifecycleBinding`:case`signingWorker`:return!0;default:return!1}}function w(e){if(e==null)return{ok:!1,error:{code:`missing`,message:`mpcMaterialActivationRef is required`}};if(typeof e!=`object`||Array.isArray(e))return{ok:!1,error:{code:`invalid`,message:`mpcMaterialActivationRef must be an object`}};let t=e,n=Object.keys(t);if(n.length!==7)return{ok:!1,error:{code:`invalid`,message:`mpcMaterialActivationRef has invalid fields`}};for(let e of n)if(!C(e))return{ok:!1,error:{code:`invalid`,message:`mpcMaterialActivationRef has invalid fields`}};if(t.kind!==`mpc_material_activation_ref`)return{ok:!1,error:{code:`invalid`,message:`mpcMaterialActivationRef.kind is invalid`}};let r=_(t.activationId);if(!r.ok)return r;let i=m(t.capability);if(!i.ok)return i;let a=h(t.materialOwner);if(!a.ok)return a;let o=y(t.keyBinding);if(!o.ok)return o;let s=b(t.lifecycleBinding);if(!s.ok)return s;let c=v(t.signingWorker);return c.ok?{ok:!0,value:x({activationId:r.value,capability:i.value,materialOwner:a.value,keyBinding:o.value,lifecycleBinding:s.value,signingWorker:c.value})}:c}function T(e){return t(e,`thresholdEd25519SessionId`)}function E(e){return t(e,`thresholdEcdsaSessionId`)}function D(e){return t(e,`ecdsaActiveStateId`)}function O(e){return t(e,`thresholdSessionId`)}function k(e){return t(e,`rootShareEpoch`)}function A(e){return t(e,`walletKeyId`)}function j(e){return t(e,`signingLaneId`)}function M(e){return t(e,`laneShareEpoch`)}function N(e){return t(e,`linkedDeviceId`)}function P(e){return t(e,`linkedDeviceEnrollmentId`)}function F(e){return t(e,`walletRecoveryOperationId`)}function I(e){return t(e,`linkDeviceSessionId`)}function L(e){return typeof e==`string`?e:``}function R(e){return L(e).trim()}function z(e){return String(e??``).trim()}function B(e){return z(e).toLowerCase()}function V(e){return z(e)||void 0}function H(e){let t=typeof e==`number`?e:Number(e);return Number.isFinite(t)?t:null}function U(e){let t=H(e);return t==null?null:Math.trunc(t)}function W(e){let t=U(e);return t==null||t<=0?null:t}function G(e,t){let n=W(t.min)??1,r=W(t.fallback)??n,i=Math.max(n,r),a=W(t.max),o=U(e);return o==null||o<n?i:a==null?o:Math.min(o,a)}function K(e){return String(e??``).replace(/\/+$/,``)}function q(e){let t=z(e);return t?t.startsWith(`/`)?t:`/${t}`:``}function J(e,t){let n=K(z(e)),r=q(z(t));if(!n)throw Error(`Missing base URL`);return`${n}${r}`}export{E as A,l as B,_ as C,u as D,v as E,p as F,f as I,i as L,O as M,a as N,k as O,d as P,A as R,b as S,h as T,c as V,M as _,B as a,N as b,z as c,r as d,S as f,o as g,s as h,U as i,T as j,j as k,K as l,D as m,G as n,V as o,m as p,H as r,R as s,J as t,x as u,I as v,w,g as x,P as y,F as z};

package/dist/public/sdk/operationFingerprint-CTR9G1NT.js

@@ -0,0 +1 @@
+import{c as e,u as t}from"./chains-CiYQT1K4.js";import{i as n}from"./base64-CsEj-_bC.js";import{r}from"./canonicalPrimitives-CKPGgpxg.js";var i=class{retainProof(){return!0}constructor(e){this.retainProof(),this.tenantId=e.tenantId,this.principalId=e.principalId,this.capabilityId=e.capabilityId,this.operationId=e.operationId,this.operation=e.operation,this.digests=e.digests}};function a(e){return new i({tenantId:e.tenantId,principalId:e.principalId,capabilityId:e.capabilityId,operationId:e.operationId,operation:e.operation,digests:{laneDigest:e.digests.laneDigest,intentDigest:e.digests.intentDigest,displayDigest:e.digests.displayDigest}})}function o(t){return`seams:authorization:capability-operation-fingerprint:v1|${e({tenantId:t.tenantId,principalId:t.principalId,capabilityId:t.capabilityId,operationId:t.operationId,operation:t.operation,digests:t.digests})}`}async function s(e){return c(n(await t(o(e))))}function c(e){return r(e)}function l(e){if(typeof e!=`string`||!e.startsWith(`sha256:`))throw Error(`signing operation fingerprint must use the sha256: prefix`);return r(e.slice(7))}export{s as n,l as r,a as t};

package/dist/public/sdk/passkey-custody-BQj44jEM.js

@@ -0,0 +1 @@
+import{A as e,B as t,D as n,L as r,P as i,R as a,V as o,_ as s,b as c,k as l,v as u,y as ee}from"./normalize-kUDm5zfS.js";import{k as d}from"./chains-CiYQT1K4.js";import{_ as f,a as p,c as m,i as h,n as g,r as te,s as _,t as v}from"./primitives-CAcl7ON7.js";import{l as y}from"./digestEncoding-Dzc1rzWV.js";import{i as b}from"./registrationIds-CdPqm-Ya.js";const x=`wallet_seed_parallel_hkdf_sha256_v1`;function S(e){return e.kind===`wallet_custody_seed_v1`}function C(){return{kind:`wallet_custody_seed_v1`,derivationScheme:x}}function w(e){return{kind:`ed25519_yao_client_root_v1`,linkSessionId:e.linkSessionId,walletKeyId:e.walletKeyId,targetFactor:e.targetFactor,applicationBindingDigestB64u:e.applicationBindingDigestB64u,registeredPublicKeyB64u:e.registeredPublicKeyB64u,enrollmentId:e.enrollmentId,deviceId:e.deviceId,revocationEpoch:e.revocationEpoch}}function T(e){return{kind:`ed25519_lane_holder_share_v1`,walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,registeredPublicKeyB64u:e.registeredPublicKeyB64u,participantBindingDigestB64u:e.participantBindingDigestB64u}}function ne(e){return{kind:`ecdsa_lane_holder_share_v1`,walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,thresholdSessionId:e.thresholdSessionId,thresholdPublicKey33B64u:e.thresholdPublicKey33B64u}}const E=[`kind`,`walletKeyId`,`laneId`,`laneShareEpoch`],D={wallet_custody_seed_v1:[`kind`,`derivationScheme`],ed25519_yao_client_root_v1:[`kind`,`linkSessionId`,`walletKeyId`,`targetFactor`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`enrollmentId`,`deviceId`,`revocationEpoch`],ed25519_lane_holder_share_v1:[...E,`nearEd25519SigningKeyId`,`registeredPublicKeyB64u`,`participantBindingDigestB64u`],ecdsa_lane_holder_share_v1:[...E,`evmFamilySigningKeySlotId`,`thresholdSessionId`,`thresholdPublicKey33B64u`]},re=Array.from(new Set(Object.values(D).flat()));function ie(e,t){if(e===`wallet_custody_seed_v1`||e===`ed25519_yao_client_root_v1`||e===`ed25519_lane_holder_share_v1`||e===`ecdsa_lane_holder_share_v1`)return e;throw Error(`${t}.kind must be a known passkey custody secret kind`)}function O(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function k(e,t){let n=d(e,t);if(f(n,[`kind`],t),n.kind===`passkey_prf`||n.kind===`email_otp`)return{kind:n.kind};throw Error(`${t}.kind must be passkey_prf or email_otp`)}function A(e,t){let n=a(e.walletKeyId);if(!n.ok)throw Error(`${t}.walletKeyId ${n.error.message}`);let r=l(e.laneId);if(!r.ok)throw Error(`${t}.laneId ${r.error.message}`);let i=s(e.laneShareEpoch);if(!i.ok)throw Error(`${t}.laneShareEpoch ${i.error.message}`);return{walletKeyId:n.value,laneId:r.value,laneShareEpoch:i.value}}function j(t,n){let r=e(t);if(!r.ok)throw Error(`${n} ${r.error.message}`);return r.value}function M(e,t=`passkeyCustodySecretBinding`){let n=d(e,t),r=ie(n.kind,t);switch(f(n,D[r],t,re),r){case`wallet_custody_seed_v1`:if(n.derivationScheme!==x)throw Error(`${t}.derivationScheme must be ${x}`);return C();case`ed25519_yao_client_root_v1`:{let e=u(n.linkSessionId);if(!e.ok)throw Error(`${t}.linkSessionId ${e.error.message}`);let r=a(n.walletKeyId);if(!r.ok)throw Error(`${t}.walletKeyId ${r.error.message}`);let i=ee(n.enrollmentId);if(!i.ok)throw Error(`${t}.enrollmentId ${i.error.message}`);let o=c(n.deviceId);if(!o.ok)throw Error(`${t}.deviceId ${o.error.message}`);return w({linkSessionId:e.value,walletKeyId:r.value,targetFactor:k(n.targetFactor,`${t}.targetFactor`),applicationBindingDigestB64u:v(n.applicationBindingDigestB64u,`${t}.applicationBindingDigestB64u`),registeredPublicKeyB64u:g(n.registeredPublicKeyB64u,`${t}.registeredPublicKeyB64u`),enrollmentId:i.value,deviceId:o.value,revocationEpoch:O(n.revocationEpoch,`${t}.revocationEpoch`)})}case`ed25519_lane_holder_share_v1`:{let e=A(n,t);return T({walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,nearEd25519SigningKeyId:b(n.nearEd25519SigningKeyId),registeredPublicKeyB64u:g(n.registeredPublicKeyB64u,`${t}.registeredPublicKeyB64u`),participantBindingDigestB64u:v(n.participantBindingDigestB64u,`${t}.participantBindingDigestB64u`)})}case`ecdsa_lane_holder_share_v1`:{let e=A(n,t);return ne({walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,evmFamilySigningKeySlotId:y(n.evmFamilySigningKeySlotId,`${t}.evmFamilySigningKeySlotId`),thresholdSessionId:j(n.thresholdSessionId,`${t}.thresholdSessionId`),thresholdPublicKey33B64u:_(n.thresholdPublicKey33B64u,`${t}.thresholdPublicKey33B64u`)})}}}const N=`wallet_custody_envelope_v2`,P=`passkey_prf_kek_hkdf_sha256_v1`,F=`email_otp_factor_kek_hkdf_sha256_v1`,I=[`kind`,`walletAuthMethodId`];function L(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be an object`);let n=e;switch(f(n,I,t),n.kind){case`unbound`:if(n.walletAuthMethodId!==void 0)throw Error(`${t}.walletAuthMethodId belongs to the method_bound branch`);return{kind:`unbound`};case`method_bound`:{let e=i(n.walletAuthMethodId);if(!e.ok)throw Error(`${t}.walletAuthMethodId ${e.error.message}`);return{kind:`method_bound`,walletAuthMethodId:e.value}}default:throw Error(`${t}.kind must be unbound or method_bound`)}}function R(e){return JSON.stringify({walletId:e.walletId,envelopeId:e.envelopeId,factor:e.factor,envelopeRevision:e.envelopeRevision,binding:e.binding,ownership:B(e.ownership)})}function z(e,t){if(e===`unbound`)return{kind:`unbound`};if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be "unbound" or a methodBound object`);let n=e;f(n,[`methodBound`],t);let r=n.methodBound;if(typeof r!=`object`||!r||Array.isArray(r))throw Error(`${t}.methodBound must be an object`);let a=r;f(a,[`walletAuthMethodId`],`${t}.methodBound`);let o=i(a.walletAuthMethodId);if(!o.ok)throw Error(`${t}.methodBound.walletAuthMethodId ${o.error.message}`);return{kind:`method_bound`,walletAuthMethodId:o.value}}function B(e){switch(e.kind){case`unbound`:return`unbound`;case`method_bound`:return{methodBound:{walletAuthMethodId:String(e.walletAuthMethodId)}};default:throw Error(`Unhandled custody envelope ownership: ${String(e)}`)}}function V(e){return{kind:`method_bound`,walletAuthMethodId:e}}function H(e){return{kind:`passkey`,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,kekVersion:P}}function U(e){return{kind:`email_otp`,enrollmentId:e.enrollmentId,enrollmentSealKeyVersion:e.enrollmentSealKeyVersion,kekVersion:F}}function W(e){return{state:`active`,activatedAtMs:e.activatedAtMs}}function G(e){return{state:`retired`,activatedAtMs:e.activatedAtMs,retiredAtMs:e.retiredAtMs}}function K(e){return{state:`revoked`,activatedAtMs:e.activatedAtMs,revokedAtMs:e.revokedAtMs}}function q(e){return{kind:`wallet_custody_envelope_v2`,envelopeId:e.envelopeId,walletId:e.walletId,ownership:e.ownership,binding:e.binding,factor:e.factor,envelopeVersion:N,envelopeRevision:e.envelopeRevision,nonceB64u:e.nonceB64u,sealedCustodySecretB64u:e.sealedCustodySecretB64u,ciphertextDigestB64u:e.ciphertextDigestB64u,aadHashB64u:e.aadHashB64u,lifecycle:e.lifecycle,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs}}const J=[`state`,`activatedAtMs`,`retiredAtMs`,`revokedAtMs`];function ae(e,t=`lifecycle`){let n=d(e,t);f(n,J,t);let r=m(n.activatedAtMs,`${t}.activatedAtMs`);switch(n.state){case`active`:if(n.retiredAtMs!==void 0||n.revokedAtMs!==void 0)throw Error(`${t} cannot be active and carry a retired or revoked timestamp`);return W({activatedAtMs:r});case`retired`:{if(n.revokedAtMs!==void 0)throw Error(`${t} cannot be retired and carry a revoked timestamp`);let e=m(n.retiredAtMs,`${t}.retiredAtMs`);if(e<r)throw Error(`${t}.retiredAtMs cannot precede activation`);return G({activatedAtMs:r,retiredAtMs:e})}case`revoked`:{if(n.retiredAtMs!==void 0)throw Error(`${t} cannot be revoked and carry a retired timestamp`);let e=m(n.revokedAtMs,`${t}.revokedAtMs`);if(e<r)throw Error(`${t}.revokedAtMs cannot precede activation`);return K({activatedAtMs:r,revokedAtMs:e})}default:throw Error(`${t}.state must be active, retired, or revoked`)}}const Y=[`kind`,`rpId`,`credentialIdB64u`,`kekVersion`],X=[`kind`,`enrollmentId`,`enrollmentSealKeyVersion`,`kekVersion`],Z=Array.from(new Set([...Y,...X]));function Q(e,t){if(typeof e!=`string`||!e.trim())throw Error(`${t} is required`);return e}function oe(e,n=`factor`){let r=d(e,n);switch(r.kind){case`passkey`:{if(f(r,Y,n,Z),r.kekVersion!==P)throw Error(`${n}.kekVersion must be ${P}`);let e=o(r.rpId);if(!e.ok)throw Error(`${n}.rpId ${e.error.message}`);let i=t(r.credentialIdB64u);if(!i.ok)throw Error(`${n}.credentialIdB64u ${i.error.message}`);return H({rpId:e.value,credentialIdB64u:i.value})}case`email_otp`:if(f(r,X,n,Z),r.kekVersion!==F)throw Error(`${n}.kekVersion must be ${F}`);return U({enrollmentId:Q(r.enrollmentId,`${n}.enrollmentId`),enrollmentSealKeyVersion:Q(r.enrollmentSealKeyVersion,`${n}.enrollmentSealKeyVersion`)});default:throw Error(`${n}.kind must be passkey or email_otp`)}}const se=[`kind`,`envelopeId`,`walletId`,`ownership`,`binding`,`factor`,`envelopeVersion`,`envelopeRevision`,`nonceB64u`,`sealedCustodySecretB64u`,`ciphertextDigestB64u`,`aadHashB64u`,`lifecycle`,`createdAtMs`,`updatedAtMs`];function ce(e,t=`walletCustodyEnvelope`){let i=d(e,t);if(i.kind!==`wallet_custody_envelope_v2`)throw Error(`${t}.kind must be ${N}`);if(f(i,se,t),i.envelopeVersion!==`wallet_custody_envelope_v2`)throw Error(`${t}.envelopeVersion must be ${N}`);let a=n(i.envelopeId);if(!a.ok)throw Error(`${t}.envelopeId ${a.error.message}`);let o=r(i.walletId);if(!o.ok)throw Error(`${t}.walletId ${o.error.message}`);let s=L(i.ownership,`${t}.ownership`),c=m(i.createdAtMs,`${t}.createdAtMs`),l=m(i.updatedAtMs,`${t}.updatedAtMs`);if(l<c)throw Error(`${t}.updatedAtMs cannot precede createdAtMs`);return q({envelopeId:a.value,walletId:o.value,ownership:s,binding:M(i.binding,`${t}.binding`),factor:oe(i.factor,`${t}.factor`),envelopeRevision:p(i.envelopeRevision,`${t}.envelopeRevision`),nonceB64u:h(i.nonceB64u,`${t}.nonceB64u`),sealedCustodySecretB64u:te(i.sealedCustodySecretB64u,`${t}.sealedCustodySecretB64u`),ciphertextDigestB64u:v(i.ciphertextDigestB64u,`${t}.ciphertextDigestB64u`),aadHashB64u:v(i.aadHashB64u,`${t}.aadHashB64u`),lifecycle:ae(i.lifecycle,`${t}.lifecycle`),createdAtMs:c,updatedAtMs:l})}function le(e,t){return e.kind===t.kind?e.kind===`unbound`?!0:t.kind===`method_bound`&&String(e.walletAuthMethodId)===String(t.walletAuthMethodId):!1}function $(e){if(!e.establishedCustody)throw Error(`only a custody-establishing commit issues recovery codes`);return{...e,recoveryBackupAcknowledged:!0}}function ue(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} walletCustody must be an object`);let n=e;switch(n.status){case`not_requested`:case`committed`:case`custody_already_established`:return{status:n.status};case`joined`:{let e=n.keyManifestDigestB64u;if(typeof e!=`string`||!e)throw Error(`${t} joined custody carries no key manifest digest`);return{status:`joined`,keyManifestDigestB64u:e}}case`rejected`:{let e=n.reason;if(typeof e!=`string`||!e)throw Error(`${t} rejected custody carries no reason`);return{status:`rejected`,reason:e}}default:throw Error(`${t} walletCustody status is unrecognised`)}}export{U as a,H as c,ce as d,z as f,S as h,W as i,R as l,w as m,$ as n,V as o,le as p,N as r,q as s,ue as t,B as u};

package/dist/public/sdk/pendingWalletRecoveryCodeBackup-yJN8VAHn.js

@@ -0,0 +1 @@
+import{a as e,t}from"./singletons-8UH3gOnZ.js";import{p as n}from"./wallet-recovery-C1kesLCF.js";import{t as r}from"./surface-measurement-reporter-IlPOI3QK.js";const i=`Recovery-code backup was cancelled before acknowledgement`;async function a(e,t={kind:`disabled`},n={}){if(typeof document>`u`)throw Error(`Wallet recovery-code backup requires a browser or a backup handler`);let a=document.activeElement instanceof HTMLElement?document.activeElement:null;if(n.shouldCancel?.())throw Error(i);let o=await import(`./mountRecoveryCodeBackupSurface-B1qhFF6G.js`);if(n.shouldCancel?.())throw Error(i);let s=null,l=null,u=!1;return await new Promise((d,f)=>{let p=()=>{s?.disconnect(),s=null,l?.dispose(),l=null,a?.focus()},m=e=>{u||(u=!0,p(),e instanceof Error?f(e):d(e))},h=t=>{switch(t.kind){case`dismissed`:m(Error(i));return;case`recovery_codes`:if(t.acknowledged){m({kind:`wallet_recovery_codes_backed_up_v1`});return}if(e.kind===`direct_backup`&&e.request.continuation===`registration_may_defer`){m({kind:`wallet_recovery_code_backup_deferred_v1`});return}m(Error(i));return}};try{l=o.mountRecoveryCodeBackupSurface({parent:document.body,appearance:n.appearance,experience:e,surface:t.kind===`wallet_iframe`?`wallet-iframe`:`standalone`,onClose:h,onCancel:()=>m(Error(i)),onShown:e=>{u||t.kind!==`wallet_iframe`||(s=r({kind:`request_scroll_surface`,requestId:t.requestId,element:e,postMeasurement:c.bind(null,e,t.postMeasurement)}))}})}catch(e){m(e instanceof Error?e:Error(String(e)))}})}async function o(e,t={kind:`disabled`}){return await a({kind:`direct_backup`,request:e},t)}async function s(e,t={kind:`disabled`},n={}){return await a({kind:`account_menu`,...e},t,n)}function c(e,t,n){if(n.kind!==`measured_v1`)throw Error(`Recovery codes require a request surface measurement`);t({kind:`measured_v1`,requestId:n.requestId,sequence:n.sequence,widthCssPx:e.dataset.seamsRecoveryStage===`recovery_codes`?688:480,heightCssPx:n.heightCssPx})}const l=`wallet_recovery_codes_v1`,u=[`record_version`,`wallet_id`,`enrollment_id`,`recovery_codes_issued_at_ms`,`status`,`key`,`iv`,`ciphertext`];function d(e){return typeof CryptoKey<`u`&&e instanceof CryptoKey&&e.type===`secret`&&!e.extractable&&e.algorithm.name===`AES-GCM`&&e.usages.includes(`encrypt`)&&e.usages.includes(`decrypt`)}function f(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=new Map(Object.entries(e)),n=new Set(u);return t.size!==n.size||[...t.keys()].some(e=>!n.has(e))?null:{record_version:t.get(`record_version`),wallet_id:t.get(`wallet_id`),enrollment_id:t.get(`enrollment_id`),recovery_codes_issued_at_ms:t.get(`recovery_codes_issued_at_ms`),status:t.get(`status`),key:t.get(`key`),iv:t.get(`iv`),ciphertext:t.get(`ciphertext`)}}function p(e,t){let n=f(e);if(!n)return null;let r=Number(n.recovery_codes_issued_at_ms);return n.record_version!==1||n.wallet_id!==t||n.enrollment_id!==l||n.status!==`pending`||!Number.isSafeInteger(r)||r<=0||!d(n.key)||!(n.iv instanceof Uint8Array)||n.iv.byteLength!==12||!(n.ciphertext instanceof Uint8Array)||n.ciphertext.byteLength===0?null:{record_version:1,wallet_id:t,enrollment_id:l,recovery_codes_issued_at_ms:r,status:`pending`,key:n.key,iv:n.iv,ciphertext:n.ciphertext}}function m(e,t){return new TextEncoder().encode(JSON.stringify({kind:l,walletId:e,issuedAtMs:t}))}function h(e){return[e,l]}const g=new class{async write(r){let i=r.walletId.trim();if(!i)throw Error(`Pending recovery-code backup requires a wallet`);let a=n(r.recoveryCodes.map(String)),o=r.issuedAtMs??Date.now();if(!Number.isSafeInteger(o)||o<=0)throw Error(`Pending recovery-code backup issue time is invalid`);let s=await crypto.subtle.generateKey({name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`]),c=crypto.getRandomValues(new Uint8Array(12)),u=m(i,o),d=new TextEncoder().encode(JSON.stringify(a)),f=null;try{f=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:c,additionalData:u},s,d)),await t.runTransaction([e.pendingWalletRecoveryCodeBackups],`readwrite`,async t=>{await t.store(e.pendingWalletRecoveryCodeBackups).put({record_version:1,wallet_id:i,enrollment_id:l,recovery_codes_issued_at_ms:o,status:`pending`,key:s,iv:c,ciphertext:f})})}finally{u.fill(0),d.fill(0),f?.fill(0)}}async read(r){let i=r.trim();if(!i)return null;let a=p(await(await t.getDB()).get(e.pendingWalletRecoveryCodeBackups,h(i)),i);if(!a)return null;let o=m(i,a.recovery_codes_issued_at_ms),s=null;try{s=new Uint8Array(await crypto.subtle.decrypt({name:`AES-GCM`,iv:a.iv,additionalData:o},a.key,a.ciphertext));let e=JSON.parse(new TextDecoder().decode(s));if(!Array.isArray(e))throw Error(`Pending recovery-code backup is invalid`);return{walletId:i,recoveryCodes:n(e.map(String))}}finally{o.fill(0),s?.fill(0)}}async has(n){let r=n.trim();return r?p(await(await t.getDB()).get(e.pendingWalletRecoveryCodeBackups,h(r)),r)!==null:!1}async delete(n){let r=n.trim();r&&await t.runTransaction([e.pendingWalletRecoveryCodeBackups],`readwrite`,async t=>{await t.store(e.pendingWalletRecoveryCodeBackups).delete(h(r))})}};export{o as n,s as r,g as t};

package/dist/public/sdk/presignaturePool-DwlTReFO.js

@@ -0,0 +1 @@
+import{c as e,l as t}from"./normalize-kUDm5zfS.js";import{i as n,r}from"./base64-CsEj-_bC.js";import{r as i}from"./secureRandomId-BIekT8bE.js";import{m as a,p as o}from"./digestEncoding-Dzc1rzWV.js";import{B as s,F as c,G as l,I as u,R as d,dt as ee,z as f}from"./emailOtpEcdsaDerivationIdentity-B8HzTh4T.js";import{I as p,L as m,R as h}from"./ecdsaCapabilityManifest-BlzJAQF8.js";import{ct as g,n as _,ut as v}from"./walletOwnershipGeneration-DoXVMDWe.js";import{t as y}from"./presignatures-DB2IPD-A.js";import{i as b,n as x,r as te,u as S}from"./trace-BvbCxdXF.js";import{A as ne,C,D as re,E as ie,O as ae,S as w,T,k as E,w as oe,x as D,y as se}from"./ecdsaDerivationClientWasm-CVeNEou2.js";import{t as O}from"./authorizationAdmission-Ckx6q6tp.js";import{t as k}from"./walletSessionFailure-Bu4VPKTz.js";import{c as ce,f as A,o as le,t as j}from"./routerAbNormalSigning-BG75eyI2.js";import{o as M,s as ue,t as de}from"./evmCryptoWasm-BXsIyRon.js";async function fe(e){let t=e.clientShare.material;if(t.kind===`worker_loaded`)return;let n=await se({materialHandle:e.clientShare.handle.materialHandle,bindingDigest:e.clientShare.handle.bindingDigest,stateBlob:t.stateBlob,workerCtx:e.workerCtx});if(n.materialHandle!==e.clientShare.handle.materialHandle||n.bindingDigest!==e.clientShare.handle.bindingDigest)throw Error(`[multichain] ECDSA role-local worker material handle mismatch`)}async function pe(e){let t=e.signerSession,n=t.clientShare;if(n.kind===`linked_holder_worker_share`){let e=n.holderHandleId;return{signerSession:t,clientSigningMaterial:me(e),cleanupAfterSign:async()=>void 0}}let r=n;return{signerSession:t,clientSigningMaterial:{kind:`router_ab_ecdsa_derivation_client_signing_material_source_v1`,initClientPresignSession:async t=>(await fe({workerCtx:e.workerCtx,clientShare:r}),await ae({materialHandle:r.handle.materialHandle,material:r.material.kind===`worker_loaded`?{kind:`persisted`,materialRef:r.material.materialRef}:{kind:`runtime_loaded`,expectedBindingDigest:r.handle.bindingDigest},...t})),stepClientPresignSession:E,abortClientPresignSession:re,admitClientPresignature:C,destroyClientPresignature:ie,reserveClientPresignature:ne,commitClientPresignature:oe,listAvailableClientPresignatures:w.bind(void 0,`role_local_derivation_handle`),computeSignatureShareFromPresignatureHandle:T},cleanupAfterSign:async()=>void 0}}async function N(e,t){return await D({holderHandleId:e,...t})}function me(e){return{kind:`router_ab_ecdsa_derivation_client_signing_material_source_v1`,initClientPresignSession:N.bind(void 0,e),stepClientPresignSession:E,abortClientPresignSession:re,admitClientPresignature:C,destroyClientPresignature:ie,reserveClientPresignature:ne,commitClientPresignature:oe,listAvailableClientPresignatures:w.bind(void 0,`linked_holder_signing_material`),computeSignatureShareFromPresignatureHandle:T}}function P(e,t,n,r){let i=Math.floor(Number(e));return Number.isFinite(i)?i<n?n:i>r?r:i:t}function he(e,t){return P(e,t,1,5)}function ge(e,t,n){return P(e,t,0,n)}function _e(e){let t=e||A,n=he(t.targetDepth,A.targetDepth),r=ge(t.lowWatermark,A.lowWatermark,n);return{enabled:typeof t.enabled==`boolean`?t.enabled:A.enabled,targetDepth:n,lowWatermark:r,maxRefillInFlight:P(t.maxRefillInFlight,A.maxRefillInFlight,1,8),refillAttemptTimeoutMs:P(t.refillAttemptTimeoutMs,A.refillAttemptTimeoutMs,5e3,12e4)}}function ve(e){let t=Math.floor(Number(e));return Number.isFinite(t)&&t>0?t:2e4}function ye(e){return String(e&&typeof e==`object`&&`message`in e?e.message:e||``)}function be(e){return Error(`[router-ab-ecdsa-derivation] ${e.operation} request timed out after ${e.timeoutMs}ms`)}async function xe(e){let t=ve(e.timeoutMs),n=typeof AbortController==`function`?new AbortController:null,r={...e.init},i=null,o=null,s=!1;try{let c;if(n){let l=e.init.signal;if(l){if(l.aborted)n.abort();else if(typeof l.addEventListener==`function`){let e=()=>n.abort();l.addEventListener(`abort`,e,{once:!0}),o=()=>l.removeEventListener(`abort`,e)}}i=setTimeout(()=>{s=!0,n.abort()},t),c=await a(new Request(e.url,{...r,signal:n.signal}))}else c=await Promise.race([a(new Request(e.url,r)),new Promise((n,r)=>{i=setTimeout(()=>{s=!0,r(be({operation:e.operation,timeoutMs:t}))},t)})]);let l=await c.json().catch(()=>({}));if(s)throw be({operation:e.operation,timeoutMs:t});return{response:c,data:l}}catch(n){if(s)throw be({operation:e.operation,timeoutMs:t});let r=ye(n);throw Error(r||`[router-ab-ecdsa-derivation] ${e.operation} request failed`)}finally{i&&clearTimeout(i),o?.()}}const Se=5e3;function Ce(e,t){let n=Math.min(e-Date.now(),t??Se,Se);return Number.isFinite(n)&&n>0?n:null}function we(n){return t(e(n))||null}function Te(e){let t={"Content-Type":`application/json`};switch(e.credential.kind){case`operation_step_up`:return{ok:!0,headers:t,credentials:`omit`};case`wallet_session_opaque`:{let n=String(e.credential.walletSessionToken||``).trim();return n?(Object.assign(t,o({token:n,home:e.credential.home})),{ok:!0,headers:t,credentials:`omit`}):{ok:!1,code:`invalid_args`,message:`Missing opaque Wallet Session token for Router A/B ECDSA derivation presign pool fill`}}}}function Ee(e){switch(e.authorization.kind){case`reusable_wallet_session`:return{authorization:e.authorization};case`operation_step_up`:{let t=e.operation;if(!t)throw Error(`Operation step-up pool fill requires exact operation preparation`);return{authorization:e.authorization,operation:t}}}}function De(e){let t=String(e.keyHandle||``).trim();return t?{ok:!0,value:{keyHandle:t}}:{ok:!1,code:`invalid_args`,message:`Missing keyHandle for Router A/B ECDSA derivation pool-fill init`}}async function Oe(e){let t=we(e.relayerUrl);if(!t)return{ok:!1,code:`invalid_args`,message:`Missing relayerUrl for Router A/B ECDSA derivation pool-fill init`};if(typeof fetch!=`function`)return{ok:!1,code:`unsupported`,message:`fetch is not available for Router A/B ECDSA derivation pool-fill init`};let n=De(e);if(!n.ok)return n;let r=String(e.requestTag||``).trim(),i=Te(e);if(!i.ok)return i;let a=Ce(e.poolFill.ceremonyExpiresAtMs,e.requestTimeoutMs);if(a===null)return{ok:!1,code:`presign_timeout`,message:`Presign ceremony deadline has elapsed`};try{let{response:o,data:s}=await xe({url:`${t}${e.path}`,operation:`presign/init`,timeoutMs:a,init:{method:`POST`,headers:i.headers,credentials:i.credentials,body:JSON.stringify({...n.value,count:Number.isFinite(e.count)?Math.max(1,Math.floor(Number(e.count))):1,...r?{requestTag:r}:{},poolFill:e.poolFill,presignSessionId:e.presignSessionId,firstMessageB64u:e.firstMessageB64u,...Ee(e)})}});return typeof s.presignSessionId==`string`&&x(s.presignSessionId,`init`,o.headers.get(`Server-Timing`)),o.ok?{ok:s.ok===!0,presignSessionId:s.presignSessionId,...Number.isSafeInteger(s.ceremonyExpiresAtMs)?{ceremonyExpiresAtMs:s.ceremonyExpiresAtMs}:{},...Number.isSafeInteger(s.materialExpiresAtMs)?{materialExpiresAtMs:s.materialExpiresAtMs}:{},stage:s.stage,outgoingMessagesB64u:Array.isArray(s.outgoingMessagesB64u)?s.outgoingMessagesB64u:[],...s.code?{code:s.code}:{},...s.message?{message:s.message}:{}}:{ok:!1,code:s.code||`http_error`,message:s.message||`HTTP ${o.status}`}}catch(e){return{ok:!1,code:`network_error`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||`Failed Router A/B ECDSA derivation pool-fill init`)}}}async function ke(e){return Oe({...e,path:c})}async function Ae(e){let t=we(e.relayerUrl);if(!t)return{ok:!1,code:`invalid_args`,message:`Missing relayerUrl for Router A/B ECDSA derivation pool-fill step`};if(typeof fetch!=`function`)return{ok:!1,code:`unsupported`,message:`fetch is not available for Router A/B ECDSA derivation pool-fill step`};let n=String(e.presignSessionId||``).trim();if(!n)return{ok:!1,code:`invalid_args`,message:`Missing presignSessionId for Router A/B ECDSA derivation pool-fill step`};let r=String(e.requestTag||``).trim(),i=Te(e);if(!i.ok)return i;let a=Ce(e.ceremonyExpiresAtMs,e.requestTimeoutMs);if(a===null)return{ok:!1,code:`presign_timeout`,message:`Presign ceremony deadline has elapsed`};try{let{response:o,data:s}=await xe({url:`${t}${e.path}`,operation:`presign/step`,timeoutMs:a,init:{method:`POST`,headers:i.headers,credentials:i.credentials,body:JSON.stringify({presignSessionId:n,ceremonyExpiresAtMs:e.ceremonyExpiresAtMs,materialExpiresAtMs:e.materialExpiresAtMs,stage:e.stage,outgoingMessagesB64u:Array.isArray(e.outgoingMessagesB64u)?e.outgoingMessagesB64u:[],...r?{requestTag:r}:{},...Ee(e)})}});return x(n,`step`,o.headers.get(`Server-Timing`)),o.ok?{ok:s.ok===!0,stage:s.stage,event:s.event,outgoingMessagesB64u:Array.isArray(s.outgoingMessagesB64u)?s.outgoingMessagesB64u:[],...s.presignatureId?{presignatureId:s.presignatureId}:{},...s.bigRB64u?{bigRB64u:s.bigRB64u}:{},...s.code?{code:s.code}:{},...s.message?{message:s.message}:{}}:{ok:!1,code:s.code||`http_error`,message:s.message||`HTTP ${o.status}`}}catch(e){return{ok:!1,code:`network_error`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||`Failed Router A/B ECDSA derivation pool-fill step`)}}}async function je(e){return Ae({...e,path:u})}var Me=class{constructor(){this.state={kind:`refilling`,revision:0},this.waiters=new Map}snapshot(){return this.state}hasForegroundWaiters(){for(let e of this.waiters.values())if(e===`foreground`)return!0;return!1}publishAvailable(){this.state.kind!==`settled`&&(this.state={kind:`refilling`,revision:this.state.revision+1},this.flushWaiters())}settle(){this.state.kind!==`settled`&&(this.state={kind:`settled`,revision:this.state.revision},this.flushWaiters())}waitForChange(e,t){return this.state.kind===`settled`||this.state.revision!==e.revision?Promise.resolve(this.state):new Promise(n=>{this.waiters.set(n,t),(this.state.kind===`settled`||this.state.revision!==e.revision)&&(this.waiters.delete(n),n(this.state))})}flushWaiters(){let e=this.state,t=[...this.waiters.keys()];this.waiters.clear();for(let n of t)n(e)}};function Ne(){let e=globalThis.crypto;if(!e||typeof e.getRandomValues!=`function`)throw Error(`WebCrypto getRandomValues is required for ECDSA rerandomization`);return e.getRandomValues(new Uint8Array(32))}function F(e){switch(e.authorization.kind){case`reusable_wallet_session`:return{authorization:e.authorization};case`operation_step_up`:{let t=e.operation;if(!t)throw Error(`Operation step-up pool fill requires exact operation preparation`);return{authorization:e.authorization,operation:t}}}}function Pe(e){return String(e&&typeof e==`object`&&`message`in e?e.message:e||`signature recovery failed`)}function I(e){e instanceof Uint8Array&&e.fill(0)}function Fe(e){if(e?.kind!==`router_ab_ecdsa_derivation_client_signing_material_source_v1`)throw Error(`Router A/B ECDSA derivation client signing material source is required`)}const Ie=6e4,L=new Map,R=new Map,z=new Map,B=new Map,V=new Map,H=new Map;function Le(e){return e===`triples_done`||e===`presign`||e===`done`}function Re(e){return Le(e.clientStage)&&Le(e.serverStage)?`presign`:`triples`}function ze(e){let t=L.get(e);if(!t?.length)return null;let n=t.shift()??null;return t.length?L.set(e,t):L.delete(e),n}async function U(e){return await Ue(e),ze(e.poolKey)}function Be(e,t,n){if(!K(n))return`invalid`;let r=L.get(e)||[];for(let e of r)if(e.materialHandle===n.materialHandle)return`duplicate`;return r.filter(e=>K(e)).length>=5?`capacity_full`:(r.push(n),L.set(e,r),R.set(e,t),`stored`)}function Ve(e,t=Date.now()){let n=L.get(e);if(!n?.length)return[];let r=[],i=[];for(let e of n)K(e,t)?r.push(e):i.push(e);return r.length>0?L.set(e,r):L.delete(e),i}async function He(e){for(let t of e.refs)await e.clientSigningMaterial.destroyClientPresignature({materialHandle:t.materialHandle,poolIdentity:e.poolIdentity,workerCtx:e.workerCtx}).catch(()=>{})}async function Ue(e){await He({refs:Ve(e.poolKey),poolIdentity:e.poolIdentity,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx})}async function W(e,t,n){try{await _(e.walletId,e.ownershipGeneration)}catch(r){throw await qe({poolIdentity:e,poolKey:g(e),clientSigningMaterial:t,workerCtx:n}),r}}async function We(e){await W(e.poolIdentity,e.clientSigningMaterial,e.workerCtx);let t=V.get(e.poolKey);if(t){await t;return}let n=Ge(e);V.set(e.poolKey,n);try{await n}finally{V.get(e.poolKey)===n&&V.delete(e.poolKey)}}async function Ge(e){await Ue(e);let t;t=await e.clientSigningMaterial.listAvailableClientPresignatures({poolIdentity:e.poolIdentity,workerCtx:e.workerCtx});try{await W(e.poolIdentity,e.clientSigningMaterial,e.workerCtx)}catch{}if(q(e.poolKey)!==e.generation){for(let n of t)I(n.bigR33),await e.clientSigningMaterial.destroyClientPresignature({materialHandle:n.materialHandle,poolIdentity:e.poolIdentity,workerCtx:e.workerCtx}).catch(()=>{});return}for(let r of t){let t=Be(e.poolKey,e.poolIdentity,{presignatureId:r.presignatureId,materialHandle:r.materialHandle,bigRB64u:n(r.bigR33),createdAtMs:r.createdAtMs,expiresAtMs:r.expiresAtMs});I(r.bigR33),(t===`invalid`||t===`capacity_full`)&&await e.clientSigningMaterial.destroyClientPresignature({materialHandle:r.materialHandle,poolIdentity:e.poolIdentity,workerCtx:e.workerCtx}).catch(()=>{})}}function G(e){let t=L.get(e);return t?t.reduce((e,t)=>e+(K(t)?1:0),0):0}function K(e,t=Date.now()){let n=Math.floor(Number(e.expiresAtMs));return!!(e.presignatureId&&e.bigRB64u&&e.materialHandle)&&Number.isSafeInteger(n)&&n>t+2e3}function q(e){let t=H.get(e);return t===void 0?(H.set(e,0),0):t}function Ke(e){Z(e);let t=q(e)+1;return H.set(e,t),t}async function qe(e){let t=L.get(e.poolKey)??[];$e(e.poolKey),await He({...e,refs:t})}function J(e){return B.get(e)||0}function Je(e){let t=J(e);B.set(e,t+1)}function Ye(e){let t=J(e);if(t<=1){B.delete(e),Q(e,0);return}B.set(e,t-1)}async function Xe(e,t){let n=z.get(e);if(!n)return;let r=n.snapshot();for(;G(e)===0&&r.kind===`refilling`;)r=await n.waitForChange(r,t)}async function Ze(e){let t=g(v({ownershipGeneration:e.ownershipGeneration,relayerUrl:e.relayerUrl,scope:e.scope,materialActivation:e.materialActivation}));return G(t)>0?!0:(await Xe(t,`background`),G(t)>0)}function Y(e,t,n){return{scheduled:!1,reason:e,depth:t,targetDepth:n}}function Qe(){let e=new Set([...X.keys(),...L.keys(),...z.keys(),...B.keys(),...H.keys()]);for(let t of e)Ke(t);L.clear(),R.clear();for(let e of z.values())e.settle();z.clear(),B.clear()}function $e(e){L.delete(e),R.delete(e),Ke(e),z.get(e)?.settle(),z.delete(e)}function et(e){let t=String(e).trim();if(!t)throw Error(`ECDSA presignature wallet id is required`);for(let[e,n]of[...R])n.walletId===t&&$e(e)}const X=new Map;function Z(e){let t=X.get(e);t&&t.timer!==null&&clearTimeout(t.timer),X.delete(e),X.size===0&&typeof window<`u`&&(window.removeEventListener(`online`,$),document.removeEventListener(`visibilitychange`,$))}function Q(e,t){let n=X.get(e);if(!n)return;n.timer!==null&&clearTimeout(n.timer);let r=n.input.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs-Date.now();if(r<=0||q(e)!==n.generation){Z(e);return}n.timer=setTimeout(tt,Math.min(t,r),e)}function $(){if(!(typeof document<`u`&&document.visibilityState===`hidden`))for(let e of X.keys())Q(e,0)}function tt(e){let t=X.get(e);if(!t)return;if(t.timer=null,Date.now()>=t.input.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs){Z(e);return}if(typeof navigator<`u`&&navigator.onLine===!1){Q(e,3e4);return}let n=at(t.input);n.scheduled||Q(e,n.depth>=n.targetDepth?3e4:5e3)}function nt(e,t){t.authorization.kind===`reusable_wallet_session`&&X.get(e)?.input!==t&&(Z(e),X.size===0&&typeof window<`u`&&(window.addEventListener(`online`,$),document.addEventListener(`visibilitychange`,$)),X.set(e,{input:t,generation:q(e),failures:0,timer:null}),Q(e,3e4))}function rt(e,t,n){let r=X.get(e);if(!(!r||r!==t)){switch(n){case`network_error`:case`internal`:case`presign_timeout`:case`temporarily_unavailable`:case`service_unavailable`:case`wallet_session_unavailable`:if(r.failures+=1,r.failures<=3)return}Z(e)}}async function it(e){let{args:t,refillInput:n,poolKey:r,poolIdentity:i,scheduledGeneration:a,targetDepth:o,refillAttemptTimeoutMs:s,progress:c}=e,l=X.get(r)??null;try{for(await We({poolKey:r,poolIdentity:i,clientSigningMaterial:t.clientSigningMaterial,workerCtx:t.workerCtx,generation:a}),G(r)>0&&c.publishAvailable();Date.now()<t.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs;){if(q(r)!==a||(X.get(r)??null)!==l||G(r)>=o||J(r)>0||typeof navigator<`u`&&navigator.onLine===!1)return;let e=Math.min(Date.now()+s,t.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs),i=await _t({...n,routerAbEcdsaDerivationPoolFill:{kind:`router_ab_ecdsa_derivation_signing_worker_pool`,scope:n.routerAbEcdsaDerivationPoolFill.scope,ceremonyExpiresAtMs:e,materialExpiresAtMs:n.routerAbEcdsaDerivationPoolFill.materialExpiresAtMs},trafficClass:`background`});if(S(`evm-family`,{event:`ecdsa_background_refill_result`,authorization:t.authorization.kind,outcome:i.ok?`available`:`failed`,code:i.ok?null:i.code,depth:G(r),targetDepth:o}),!i.ok){rt(r,l,i.code);return}let u=X.get(r);u&&u===l&&(u.failures=0),c.publishAvailable()}}catch{rt(r,l,`internal`)}finally{c.settle(),z.get(r)===c&&z.delete(r);let e=X.get(r);if(e){let t=e.failures>0?2e3*2**e.failures:1e3;G(r)>=o&&(t=3e4),e!==l&&(t=0),Q(r,t)}}}function at(e){try{let t=_e(e.poolPolicy),n=v({ownershipGeneration:e.credential.ownershipGeneration,relayerUrl:e.relayerUrl,scope:e.routerAbEcdsaDerivationPoolFill.scope,materialActivation:e.materialActivation}),r=g(n);R.set(r,n);let i=he(e.targetDepth,t.targetDepth),a=ge(e.triggerIfDepthAtOrBelow,t.lowWatermark,i),o=G(r),s=q(r);if(!t.enabled)return Y(`disabled`,o,i);if(e.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs<=Date.now())return Z(r),Y(`invalid_args`,o,i);if(nt(r,e),o>a)return Y(`depth_above_trigger`,o,i);if(o>=i)return Y(`depth_at_or_above_target`,o,i);if(z.has(r)||J(r)>0)return Y(`in_flight_for_pool_key`,o,i);if(z.size>=t.maxRefillInFlight)return Y(`global_in_flight_limit`,o,i);let c={relayerUrl:e.relayerUrl,keyHandle:e.keyHandle,ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,clientVerifyingShareB64u:e.clientVerifyingShareB64u,clientSigningMaterial:e.clientSigningMaterial,thresholdEcdsaPublicKeyB64u:e.thresholdEcdsaPublicKeyB64u,relayerVerifyingShareB64u:e.relayerVerifyingShareB64u,credential:e.credential,materialActivation:e.materialActivation,routerAbEcdsaDerivationPoolFill:e.routerAbEcdsaDerivationPoolFill,workerCtx:e.workerCtx,...F(e)},l=new Me;return z.set(r,l),it({args:e,refillInput:c,poolKey:r,poolIdentity:n,scheduledGeneration:s,targetDepth:i,refillAttemptTimeoutMs:t.refillAttemptTimeoutMs,progress:l}),{scheduled:!0,reason:`scheduled`,depth:o,targetDepth:i}}catch{return Y(`invalid_args`,0,0)}}function ot(e){return e.map(e=>n(e))}function st(e){return Array.isArray(e)?e.map(e=>String(e||``).trim()).filter(e=>!!e).map(e=>r(e)):[]}async function ct(e){let t=String(e.thresholdEcdsaPublicKeyB64u||``).trim();if(t){let n=r(t);if(n.length!==33)throw Error(`thresholdEcdsaPublicKeyB64u must decode to 33 bytes`);return await M({publicKey33:n,workerCtx:e.workerCtx})}let n=String(e.clientVerifyingShareB64u||``).trim(),i=String(e.relayerVerifyingShareB64u||``).trim();if(!n||!i)throw Error(`Missing thresholdEcdsaPublicKeyB64u (or relayerVerifyingShareB64u fallback) for Router A/B ECDSA derivation signing`);let a=r(n),o=r(i);if(a.length!==33)throw Error(`clientVerifyingShareB64u must decode to 33 bytes`);if(o.length!==33)throw Error(`relayerVerifyingShareB64u must decode to 33 bytes`);return await de({left33:await M({publicKey33:a,workerCtx:e.workerCtx}),right33:await M({publicKey33:o,workerCtx:e.workerCtx}),workerCtx:e.workerCtx})}function lt(e){return e.trafficClass===`foreground`||z.get(e.poolKey)?.hasForegroundWaiters()?`foreground_presign_pool_refill`:`background_presign_pool_refill`}async function ut(e){for(let t=0;t<2;t+=1){let n=await dt(e);if(n.ok||!ft(n)||t===1)return n}return{ok:!1,code:`stale_session_state`,message:`Router A/B ECDSA derivation pool-fill session stayed stale after retry`}}async function dt(e){Fe(e.clientSigningMaterial);let t=performance.now(),r=e.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs,i=e.routerAbEcdsaDerivationPoolFill.materialExpiresAtMs,a=`ecdsa-presign-v2:${r}:${n(crypto.getRandomValues(new Uint8Array(32)))}`,o=a,s=v({ownershipGeneration:e.credential.ownershipGeneration,relayerUrl:e.relayerUrl,scope:e.routerAbEcdsaDerivationPoolFill.scope,materialActivation:e.materialActivation}),c=null,l=null,u=null,d=null,ee=!1,f=`triples`,p=[],m=!0,h=!1;try{let t=await e.clientSigningMaterial.initClientPresignSession({sessionId:o,groupPublicKey33:e.groupPublicKey33,ceremonyExpiresAtMs:r,materialExpiresAtMs:i,poolIdentity:s,workerCtx:e.workerCtx});if(t.stage!==`triples`||t.outgoingMessages.length!==1)return{ok:!1,code:`presign_init_failed`,message:`Client presign init must emit exactly one first message`};f=t.stage;let g=await ke({relayerUrl:e.relayerUrl,...e.poolFillInitKeySelector,count:1,presignSessionId:a,firstMessageB64u:n(t.outgoingMessages[0]),credential:e.credential,requestTag:lt(e),poolFill:e.routerAbEcdsaDerivationPoolFill,...F(e)});if(!g.ok)return{ok:!1,code:g.code||`presign_init_failed`,message:g.message||`Presign initialization failed`};if(g.presignSessionId!==a||g.ceremonyExpiresAtMs!==r||g.materialExpiresAtMs!==i||r<=Date.now())return{ok:!1,code:`invalid_pool_fill_expiry`,message:`Presign initialization changed the bound identity or deadlines`};let _=g.stage||`triples`,v=st(g.outgoingMessagesB64u);for(let t=0;t<64;t++){if(v.length>0&&!c){let t=await e.clientSigningMaterial.stepClientPresignSession({sessionId:o,stage:Re({clientStage:f,serverStage:_}),incomingMessages:v,workerCtx:e.workerCtx});f=t.stage,v=[],p.push(...t.outgoingMessages),t.presignatureHandle&&t.presignatureBigR33&&(c=t.presignatureHandle,l=t.presignatureBigR33)}if(!ee){let n=performance.now(),o=lt(e),s={relayerUrl:e.relayerUrl,presignSessionId:a,ceremonyExpiresAtMs:r,materialExpiresAtMs:i,stage:Re({clientStage:f,serverStage:_}),outgoingMessagesB64u:ot(p),credential:e.credential,requestTag:o,...F(e)},c=await je(s);if(S(`evm-family`,{event:`ecdsa_presignature_round`,requestTag:o,presignSessionId:a,authorization:e.authorization.kind,round:t,stage:s.stage,durationMs:performance.now()-n,outcome:c.ok?`succeeded`:`failed`}),p=[],!c.ok)return{ok:!1,code:c.code||`presign_step_failed`,message:c.message||`Router A/B ECDSA derivation pool-fill step failed`};v=st(c.outgoingMessagesB64u),_=c.stage||_,c.event===`presign_done`&&(u=String(c.presignatureId||``).trim()||null,d=String(c.bigRB64u||``).trim()||null,ee=!0)}if(c&&l&&u&&d)break}if(!c||!l)return{ok:!1,code:`presign_timeout`,message:`Client presign session did not reach done state`};if(!u||!d)return{ok:!1,code:`presign_timeout`,message:`Server presign session did not reach done state`};if(l.length!==33)return{ok:!1,code:`internal`,message:`Invalid local presignature bigR bytes (expected 33, got ${l.length})`};try{let t=Date.now(),r=n(l);if(r!==d)return{ok:!1,code:`presign_mismatch`,message:`Client/server presignature mismatch (bigR mismatch)`};let a=await e.clientSigningMaterial.admitClientPresignature({materialHandle:c,expectedPresignatureId:u,poolIdentity:s,admissionMode:e.authorization.kind===`operation_step_up`?`resident`:`durable`,workerCtx:e.workerCtx});return a.kind===`discarded_capacity`?{ok:!1,code:`pool_full`,message:`Router A/B ECDSA derivation client presignature pool is full`}:a.kind===`discarded_ambiguous`?{ok:!1,code:`presign_failed`,message:`Router A/B ECDSA derivation client presignature admission was ambiguous`}:(h=!0,m=!1,{ok:!0,kind:`available`,presignature:{presignatureId:u,bigRB64u:r,materialHandle:c,createdAtMs:t,expiresAtMs:i}})}finally{I(l)}}catch(e){return{ok:!1,code:`presign_failed`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||`Router A/B ECDSA derivation pool-fill handshake failed`)}}finally{S(`evm-family`,{event:`ecdsa_presignature_generation`,requestTag:lt(e),presignSessionId:a,authorization:e.authorization.kind,durationMs:performance.now()-t,outcome:h?`available`:`failed`}),I(l),!h&&c&&await e.clientSigningMaterial.destroyClientPresignature({materialHandle:c,poolIdentity:s,workerCtx:e.workerCtx}).catch(()=>{}),m&&await e.clientSigningMaterial.abortClientPresignSession({sessionId:o,workerCtx:e.workerCtx}).catch(()=>{})}}function ft(e){return e.code===`stale_session_state`||e.code===`stale_pool_fill_session`}function pt(e){let t=l(e);return{ecdsaThresholdKeyId:p(t.ecdsa_threshold_key_id),clientVerifyingShareB64u:h(t.public_identity.derivation_client_share_public_key33_b64u),thresholdEcdsaPublicKeyB64u:t.public_identity.threshold_public_key33_b64u}}function mt(e){let t=Math.floor(Number(e.materialExpiresAtMs)),n=Number.isSafeInteger(e.authorizationExpiresAtMs)?Math.floor(Number(e.authorizationExpiresAtMs)):e.nowMs+Ie,r=Math.min(t,n,e.nowMs+Ie);return Number.isSafeInteger(r)&&r>e.nowMs?r:null}async function ht(e,t,a){let o=null,c=null,l=null,u=null,d=null,p={kind:`unclaimed`},m=null,h={kind:`before_prepare`};try{let _=String(e.relayerUrl||``).trim().replace(/\/+$/g,``);if(!_)return{ok:!1,code:`invalid_args`,message:`Missing relayerUrl for Router A/B ECDSA derivation signing`};let y=pt(e.scope);if(!y.ecdsaThresholdKeyId)return{ok:!1,code:`invalid_args`,message:`Missing ecdsaThresholdKeyId for Router A/B ECDSA derivation signing`};let x=y.clientVerifyingShareB64u;if(!x)return{ok:!1,code:`invalid_args`,message:`Missing clientVerifyingShareB64u for Router A/B ECDSA derivation signing`};if(!(e.signingDigest32 instanceof Uint8Array)||e.signingDigest32.length!==32)return{ok:!1,code:`invalid_args`,message:`signingDigest32 must be 32 bytes for Router A/B ECDSA derivation signing`};let ne=performance.now(),C=await ct({clientVerifyingShareB64u:x,thresholdEcdsaPublicKeyB64u:y.thresholdEcdsaPublicKeyB64u,workerCtx:e.workerCtx});b(e.operationId,`public_key_validation`,ne),c=v({ownershipGeneration:e.credential.ownershipGeneration,relayerUrl:_,scope:e.scope,materialActivation:e.materialActivation}),await W(c,e.clientSigningMaterial,e.workerCtx),o=g(c),R.set(o,c),m=q(o);let re=performance.now();if(l=await U({poolKey:o,poolIdentity:c,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx}),b(e.operationId,`pool_lookup`,re),!l){let t=performance.now();await We({poolKey:o,poolIdentity:c,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx,generation:m}),b(e.operationId,`pool_restore`,t),m=q(o),l=await U({poolKey:o,poolIdentity:c,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx})}if(!l){let t=performance.now();await Xe(o,`foreground`),b(e.operationId,`refill_wait`,t),m=q(o),l=await U({poolKey:o,poolIdentity:c,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx})}if(!l&&a.kind===`on_demand`){let t=performance.now();Je(o);try{let t=await _t({...a.refill,trafficClass:`foreground`});if(!t.ok&&t.code===`invalidated`&&(t=await _t({...a.refill,trafficClass:`foreground`})),!t.ok&&t.code!==`pool_full`)return t;!t.ok&&t.code===`pool_full`&&await We({poolKey:o,poolIdentity:c,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx,generation:q(o)})}finally{Ye(o)}m=q(o),l=await U({poolKey:o,poolIdentity:c,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx}),b(e.operationId,`foreground_refill`,t)}if(S(`evm-family`,{event:`ecdsa_presignature_selection`,operationId:e.operationId,authorization:e.authorization.kind,outcome:l?`available`:`empty`,remainingDepth:G(o),attempt:t}),!l)return{ok:!1,code:`pool_empty`,message:`Router A/B ECDSA derivation client presignature pool is empty`};let ie=Date.now(),ae=mt({authorizationExpiresAtMs:e.expiresAtMs,materialExpiresAtMs:l.expiresAtMs,nowMs:ie});if(!ae)return{ok:!1,code:`pool_entry_expired`,message:`Router A/B ECDSA derivation client presignature is expired`};if(await W(c,e.clientSigningMaterial,e.workerCtx),m!==q(o))return{ok:!1,code:`pool_entry_unavailable`,message:`Router A/B ECDSA derivation client presignature pool was invalidated before prepare`};d=Ne();let w=await ee(d),T=s({scope:e.scope,requestId:i(`router-ab-ecdsa-sign`,32,`Router A/B ECDSA derivation sign request`),operationId:e.operationId,operationDigests:e.operationDigests,authorization:e.authorization,materialActivation:e.materialActivation,clientPresignatureId:l.presignatureId,expiresAtMs:ae,signingDigest32:e.signingDigest32,clientRerandomizationCommitment32:w});I(w);let E=i(`router-ab-ecdsa-reservation`,32,`Router A/B ECDSA Client presignature reservation`);p={kind:`destroy`};let oe=performance.now(),D=await e.clientSigningMaterial.reserveClientPresignature({materialHandle:l.materialHandle,expectedPresignatureId:l.presignatureId,poolIdentity:c,requestBinding:T.request_id,reservationId:E,leaseExpiresAtMs:T.expires_at_ms,workerCtx:e.workerCtx});if(b(e.operationId,`presignature_reserve`,oe),D.kind===`unavailable`)return D.reason===`claimed_elsewhere`&&(p={kind:`owned_elsewhere`}),t<4?await ht(e,t+1,a):{ok:!1,code:D.reason===`expired`?`pool_entry_expired`:`pool_entry_unavailable`,message:`Router A/B ECDSA derivation client presignature is unavailable: ${D.reason}`};if(await W(c,e.clientSigningMaterial,e.workerCtx),m!==q(o))return{ok:!1,code:`pool_entry_unavailable`,message:`Router A/B ECDSA derivation client presignature pool was invalidated before prepare`};Q(o,0),h={kind:`prepare_submitted`};let se=performance.now(),O=await ce({relayServerUrl:_,credential:e.credential,request:T,onServerTiming:te.bind(void 0,e.operationId,`prepare`)});if(b(e.operationId,`prepare`,se),O.kind===`reusable_wallet_session`){if(!e.reconcileSession)throw Error(`Wallet Session reconciliation is required`);await e.reconcileSession(O.sessionStatus)}let k=O.signing;if(k.server_big_r33_b64u!==l.bigRB64u)return{ok:!1,code:`presign_mismatch`,message:`Router A/B ECDSA derivation SigningWorker returned a different presignature bigR`};let A=performance.now();await e.clientSigningMaterial.commitClientPresignature({materialHandle:l.materialHandle,poolIdentity:c,requestBinding:T.request_id,reservationId:E,workerCtx:e.workerCtx}),b(e.operationId,`presignature_commit`,A);let j=r(l.bigRB64u),M=r(k.signing_worker_rerandomization_contribution32_b64u);try{if(j.length!==33)return{ok:!1,code:`internal`,message:`Router A/B ECDSA derivation presign bigR must decode to 33 bytes`};if(M.length!==32)return{ok:!1,code:`internal`,message:`Router A/B ECDSA derivation SigningWorker rerandomization contribution must decode to 32 bytes`};let t=performance.now();u=await e.clientSigningMaterial.computeSignatureShareFromPresignatureHandle({materialHandle:l.materialHandle,poolIdentity:c,requestBinding:T.request_id,reservationId:E,groupPublicKey33:C,expectedPresignBigR33:j,digest32:e.signingDigest32,clientRerandomizationContribution32:d,signingWorkerRerandomizationContribution32:M,workerCtx:e.workerCtx}),b(e.operationId,`client_share`,t),p={kind:`consumed`}}finally{I(j),I(M)}if(u.length!==32)return{ok:!1,code:`internal`,message:`Invalid Router A/B ECDSA derivation client signature share length (expected 32, got ${u.length})`};let de=f({scope:e.scope,requestId:T.request_id,operationId:T.operation_id,operationDigests:T.operation_digests,authorization:e.authorization,materialActivation:e.materialActivation,expiresAtMs:T.expires_at_ms,signingDigest32:e.signingDigest32,serverPresignatureId:k.server_presignature_id,clientSignatureShare32:u,clientRerandomizationContribution32:d}),fe=performance.now(),pe=await le({relayServerUrl:_,credential:e.credential,request:de,onServerTiming:te.bind(void 0,e.operationId,`finalize`)});b(e.operationId,`finalize`,fe);let N=r(pe.signature65_b64u);if(N.length!==65)return{ok:!1,code:`internal`,message:`Router A/B ECDSA derivation returned invalid signature length (expected 65, got ${N.length})`};try{let t=performance.now();await ue({digest32:e.signingDigest32,signature65:N,publicKey33:C,workerCtx:e.workerCtx}),b(e.operationId,`signature_verify`,t)}catch(e){return{ok:!1,code:`internal`,message:`Router A/B ECDSA derivation returned a signature that does not recover to the threshold group public key: ${Pe(e)}`}}return{ok:!0,signature65:N,signature65B64u:pe.signature65_b64u,rB64u:n(N.slice(0,32)),sB64u:n(N.slice(32,64)),recId:N[64]}}catch(t){if(t instanceof O||t instanceof k)throw t;let n=String(t&&typeof t==`object`&&`message`in t?t.message:t||`Router A/B ECDSA derivation signing failed`);return t instanceof j&&t.code===`expired_local_request`?{ok:!1,code:`pool_entry_expired`,message:n}:o&&c&&m!==null&&h.kind===`before_prepare`&&q(o)!==m?(await qe({poolKey:o,poolIdentity:c,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx}),{ok:!1,code:`pool_entry_unavailable`,message:`Router A/B ECDSA derivation client presignature pool was invalidated before prepare`}):{ok:!1,code:`router_ab_sign_failed`,message:n}}finally{if(I(u),I(d),l&&c&&p.kind!==`consumed`&&p.kind!==`owned_elsewhere`){let t=!1;if(p.kind===`unclaimed`&&o&&m!==null&&m===q(o)){let e=Be(o,c,l);t=e===`stored`||e===`duplicate`}t||await e.clientSigningMaterial.destroyClientPresignature({materialHandle:l.materialHandle,poolIdentity:c,workerCtx:e.workerCtx}).catch(()=>{})}o&&Q(o,0)}}async function gt(e){let t=pt(e.scope),n=Math.floor(Number(e.expiresAtMs));if(!Number.isSafeInteger(n)||n<=Date.now())return{ok:!1,code:`invalid_pool_fill_expiry`,message:`Router A/B ECDSA derivation pool fill expiry is unavailable or expired`};let r={kind:`on_demand`,refill:{relayerUrl:e.relayerUrl,keyHandle:e.keyHandle,ecdsaThresholdKeyId:t.ecdsaThresholdKeyId,clientVerifyingShareB64u:t.clientVerifyingShareB64u,clientSigningMaterial:e.clientSigningMaterial,thresholdEcdsaPublicKeyB64u:t.thresholdEcdsaPublicKeyB64u,credential:e.credential,materialActivation:e.materialActivation,routerAbEcdsaDerivationPoolFill:{kind:`router_ab_ecdsa_derivation_signing_worker_pool`,scope:e.scope,ceremonyExpiresAtMs:Math.min(n,Date.now()+d-3e4),materialExpiresAtMs:e.authorization.kind===`operation_step_up`?n:Date.now()+y},workerCtx:e.workerCtx,...F(e)}},i=await ht(e,0,r);return!i.ok&&(i.code===`pool_entry_expired`||i.code===`pool_entry_unavailable`)?await ht(e,0,r):i}async function _t(e){try{let t=v({ownershipGeneration:e.credential.ownershipGeneration,relayerUrl:e.relayerUrl,scope:e.routerAbEcdsaDerivationPoolFill.scope,materialActivation:e.materialActivation});await W(t,e.clientSigningMaterial,e.workerCtx);let n=g(t);await Ue({poolKey:n,poolIdentity:t,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx});let r=q(n),i=await ct({clientVerifyingShareB64u:e.clientVerifyingShareB64u,thresholdEcdsaPublicKeyB64u:e.thresholdEcdsaPublicKeyB64u,relayerVerifyingShareB64u:e.relayerVerifyingShareB64u,workerCtx:e.workerCtx}),a=await ut({relayerUrl:e.relayerUrl,poolFillInitKeySelector:{keyHandle:m(e.keyHandle)},clientSigningMaterial:e.clientSigningMaterial,groupPublicKey33:i,materialActivation:e.materialActivation,credential:e.credential,poolKey:n,trafficClass:e.trafficClass,routerAbEcdsaDerivationPoolFill:e.routerAbEcdsaDerivationPoolFill,workerCtx:e.workerCtx,...F(e)});if(!a.ok)return a;try{await W(t,e.clientSigningMaterial,e.workerCtx)}catch{}if(q(n)!==r)return await e.clientSigningMaterial.destroyClientPresignature({materialHandle:a.presignature.materialHandle,poolIdentity:t,workerCtx:e.workerCtx}).catch(()=>{}),{ok:!1,code:`invalidated`,message:`Router A/B ECDSA derivation presignature pool invalidated`};let o=Be(n,t,a.presignature);return(o===`capacity_full`||o===`invalid`)&&await e.clientSigningMaterial.destroyClientPresignature({materialHandle:a.presignature.materialHandle,poolIdentity:t,workerCtx:e.workerCtx}).catch(()=>{}),{ok:!0,presignatureId:a.presignature.presignatureId}}catch(e){return{ok:!1,code:`internal`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||`Router A/B ECDSA derivation presignature refill failed`)}}}export{Ze as a,pe as c,gt as i,et as n,_e as o,at as r,me as s,Qe as t};

package/dist/public/sdk/presignatures-DB2IPD-A.js

@@ -0,0 +1 @@
+const e=2160*60*6e4;export{e as t};

package/dist/public/sdk/prfCache-BMpqZZ-v.js

@@ -0,0 +1 @@
+import{r as e}from"./secureRandomId-BIekT8bE.js";function t(e){if(!(typeof e!=`number`||!Number.isFinite(e)||e<0))return Math.floor(e)}function n(t){return e(t,32,`passkey PRF cache session IDs`)}function r(e){let n=String(e.thresholdSessionId||``).trim(),r=String(e.prfFirstB64u||``).trim(),i=Number(e.expiresAtMs),a=t(e.remainingUses);if(!n||!r)throw Error(`Missing thresholdSessionId or prfFirstB64u for signing session hydration`);if(!Number.isFinite(i)||i<=0)throw Error(`Invalid expiresAtMs for signing session hydration`);if(a==null)throw Error(`Invalid remainingUses for signing session hydration`);let o={thresholdSessionId:n,prfFirstB64u:r,expiresAtMs:Math.floor(i),remainingUses:a,...e.diagnostics?{diagnostics:e.diagnostics}:{}};return e.preparedServerSeal?{...o,transport:e.transport,preparedServerSeal:e.preparedServerSeal}:{...o,...e.transport?{transport:e.transport}:{}}}async function i(e,t){let n=r(t),i={thresholdSessionId:n.thresholdSessionId,prfFirstB64u:n.prfFirstB64u,expiresAtMs:n.expiresAtMs,remainingUses:n.remainingUses,...n.diagnostics?{diagnostics:n.diagnostics}:{}};if(n.preparedServerSeal){await e.putWarmSessionMaterial({...i,transport:n.transport,preparedServerSeal:n.preparedServerSeal});return}await e.putWarmSessionMaterial({...i,...n.transport?{transport:n.transport}:{}})}export{n,i as t};

package/dist/public/sdk/primitives-CAcl7ON7.js

@@ -0,0 +1 @@
+import{s as e}from"./normalize-kUDm5zfS.js";import{k as t}from"./chains-CiYQT1K4.js";import{i as n,r}from"./base64-CsEj-_bC.js";import{r as i}from"./canonicalPrimitives-CKPGgpxg.js";const a=[1,2];function o(e){let t=Number(e);return!Number.isSafeInteger(t)||t<1||t>65535?null:t}function s(e){if(!Array.isArray(e)||e.length===0)return null;let t=[],n=new Set;for(let r of e){let e=o(r);if(!e)return null;n.has(e)||(n.add(e),t.push(e))}return t.sort((e,t)=>e-t),t.length?t:null}function c(t){if(!Array.isArray(t)||t.length===0)return null;let n=[];for(let r of t){if(!r||typeof r!=`object`||Array.isArray(r))return null;let t=r,i=o(t.id),a=e(t.role);if(!i||a!==`client`&&a!==`relayer`)return null;let s={id:i,role:a},c=e(t.relayerUrl);c&&(s.relayerUrl=c);let l=e(t.relayerKeyId);l&&(s.relayerKeyId=l);let u=e(t.shareDerivation);(u===`prf_first_v1`||u===`derived_master_secret_v1`||u===`kv_random_v1`||u===`unknown`)&&(s.shareDerivation=u),n.push(s)}return n.length?n:null}function l(t){let n=e(t.relayerKeyId),r=e(t.relayerUrl),i=o(t.clientParticipantId)??1,a=o(t.relayerParticipantId)??2;return[{id:i,role:`client`,shareDerivation:t.clientShareDerivation||`prf_first_v1`},{id:a,role:`relayer`,...r?{relayerUrl:r}:{},...n?{relayerKeyId:n}:{},...t.relayerShareDerivation?{shareDerivation:t.relayerShareDerivation}:{}}]}function u(t,n){let r=e(n);if(!r)throw Error(`${t} is required`);return r}function d(e){return`${u(`projectId`,e.projectId)}:${u(`envId`,e.envId)}`}function f(e){let t=p(e);return{...t,signingRootVersion:u(`signingRootVersion`,t.signingRootVersion)}}function p(t){if(!t||typeof t!=`object`||Array.isArray(t))throw Error(`runtimePolicyScope must be an object`);let n=t;if(Object.prototype.hasOwnProperty.call(n,`environmentId`))throw Error(`runtimePolicyScope.environmentId is stale; use envId`);if(Object.prototype.hasOwnProperty.call(n,`runtimeSnapshotScope`))throw Error(`runtimePolicyScope.runtimeSnapshotScope is stale; use runtimePolicyScope`);return{orgId:u(`orgId`,n.orgId),projectId:u(`projectId`,n.projectId),envId:u(`envId`,n.envId),...e(n.signingRootVersion)?{signingRootVersion:e(n.signingRootVersion)}:{}}}function m(e,t){return e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}function h(e){return{signingRootId:d(e),signingRootVersion:u(`signingRootVersion`,e.signingRootVersion)}}const g=[`prf`,`kek`,`seed`,`scalar`,`secretkey`,`privatekey`,`plaintext`,`recoverycode`,`clientroot`,`holdershare`];function _(e,t,n,r=[]){let i=new Set(t),a=new Set(r);for(let t of Object.keys(e)){if(i.has(t))continue;if(a.has(t))throw Error(`${n}.${t} is not part of ${n}`);let e=t.toLowerCase().replace(/_/g,``);throw!e.includes(`publickey`)&&g.some(t=>e.includes(t))?Error(`${n}.${t} must never carry plaintext custody material`):Error(`${n}.${t} is not part of ${n}`)}}function v(e,n,r){let i=t(e,r);_(i,n,r);for(let e of n)if(!Object.prototype.hasOwnProperty.call(i,e)||i[e]===void 0)throw Error(`${r}.${e} is required`);return i}const y=Object.freeze([`export_keys`,`link_devices`,`revoke_devices`,`sign`]);Object.freeze([`sign`]);const b=new Set([`export_keys`,`link_devices`,`revoke_devices`,`sign`]),x=Symbol(`canonicalPermissionSetBrand`);var S=class e extends Array{constructor(e){super(...e),this[x]=!0,Object.freeze(this)}static create(t){return new e(t)}static get[Symbol.species](){return Array}};function C(e){return typeof e==`string`&&b.has(e)}function w(e){if(!Array.isArray(e))return I(e==null?`delegated wallet permissions are required`:`delegated wallet permissions must be an array`);if(e.length===0)return I(`delegated wallet permissions must be non-empty`);let t=[],n=new Set;for(let r of e){if(!C(r))return I(`delegated wallet permission is unsupported`);if(n.has(r))return I(`delegated wallet permission ${r} is duplicated`);n.add(r),t.push(r)}return t.sort(N),{ok:!0,value:S.create(P(t))}}function T(e){return{kind:`delegated_wallet_authority_v1`,permissions:e.permissions}}function E(e){if(!F(e))return L(`delegated wallet authority must contain exactly kind and permissions`);if(e.kind!==`delegated_wallet_authority_v1`)return L(`delegated wallet authority kind is unsupported`);let t=w(e.permissions);return t.ok?{ok:!0,value:T({permissions:t.value})}:t}function D(){return M(y)}function O(){return T({permissions:D()})}function k(e,t){return e.permissions.includes(t)}function A(e){return Object.freeze([...e.permissions])}function j(e,t){if(e.kind!==t.kind||e.permissions.length!==t.permissions.length)return!1;for(let n=0;n<e.permissions.length;n+=1)if(e.permissions[n]!==t.permissions[n])return!1;return!0}function M(e){let t=w(e);if(!t.ok)throw Error(t.error.message);return t.value}function N(e,t){return e<t?-1:e>t?1:0}function P(e){let[t,...n]=e;if(!t)throw Error(`delegated wallet permissions must be non-empty`);return[t,...n]}function F(e){if(typeof e!=`object`||!e||Array.isArray(e))return!1;let t=Object.keys(e);return t.length===2&&t.includes(`kind`)&&t.includes(`permissions`)}function I(e){return{ok:!1,error:{code:`invalid`,message:e}}}function L(e){return{ok:!1,error:{code:`invalid`,message:e}}}const R=/^[A-Za-z0-9_-]+$/;function z(e,t){if(typeof e!=`string`||!R.test(e))throw Error(`${t} must be unpadded base64url`);let i;try{i=r(e)}catch{throw Error(`${t} must be valid base64url`)}if(n(i)!==e)throw Error(`${t} must be canonical base64url`);return i}function B(e,t){if(e.ok)return e.value;throw Error(`${t} ${e.error.message}`)}function V(e,t){try{return i(e)}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is not a digest`}`)}}function H(e,t=`nonceB64u`){if(z(e,t).length!==12)throw Error(`${t} must decode to a 12-byte ChaCha20Poly1305 nonce`);return e}function U(e,t=`ciphertextB64u`){if(z(e,t).length<17)throw Error(`${t} must decode to sealed ciphertext with an authentication tag`);return e}function W(e,t=`registeredPublicKeyB64u`){if(z(e,t).length!==32)throw Error(`${t} must decode to a 32-byte Ed25519 public key`);return e}function G(e,t=`publicKey33B64u`){let n=z(e,t);if(n.length!==33)throw Error(`${t} must decode to a 33-byte compressed secp256k1 point`);if(n[0]!==2&&n[0]!==3)throw Error(`${t} must be a compressed secp256k1 public key`);return e}function K(e,t=`keyCreationSignerSlot`){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0||e>4294967295)throw Error(`${t} must be a positive u32`);return e}function q(e,t=`envelopeRevision`){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive integer revision`);return e}function J(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive unix-millisecond timestamp`);return e}export{l as C,a as S,c as T,_,q as a,m as b,J as c,A as d,k as f,v as g,j as h,H as i,B as l,w as m,W as n,K as o,E as p,U as r,G as s,V as t,O as u,d as v,s as w,h as x,f as y};

package/dist/public/sdk/promptText-D2f5Rg0h.js

@@ -0,0 +1 @@
+function e(e){return`Enter the 6-digit code sent to ${String(e||``).trim()||`your email`}`}export{e as t};

package/dist/public/sdk/recovery-entrypoint-Bl5GgbW9.js

@@ -0,0 +1 @@
+import{V as e,h as t}from"./normalize-kUDm5zfS.js";import{d as n,l as r}from"./chains-CiYQT1K4.js";import{i}from"./base64-CsEj-_bC.js";import{r as a}from"./secureRandomId-BIekT8bE.js";import"./primitives-CAcl7ON7.js";import"./sessionPolicy-J-RrlPZQ.js";import"./signingSessionSeal-CDLUmAFY.js";import"./activeWalletSession-DiZcKjB_.js";import"./capabilityKinds-CKQ4Uqnv.js";import"./errors-BZO3LF6G.js";import"./digestEncoding-Dzc1rzWV.js";import"./accountIds-BzZs7YoX.js";import"./registrationSignerPlan-B9GCvpTV.js";import"./signerDomain-vQmlnsbF.js";import"./registrationIntent-DOkZcKSP.js";import"./singletons-8UH3gOnZ.js";import"./walletAuthority-B5hXHWpK.js";import"./emailOtpEcdsaDerivationIdentity-B8HzTh4T.js";import"./challengeDelivery-DxXAkOfS.js";import"./registrationIds-CdPqm-Ya.js";import{a as o,c as s}from"./passkey-custody-BQj44jEM.js";import{u as c}from"./walletCustodyEcdsaContinuity-abNZ_dvX.js";import"./keccak-B02Fekdh.js";import{f as l,m as u}from"./wallet-recovery-C1kesLCF.js";import{a as d,c as f,d as p,l as m,n as h,o as g,r as _,s as v,t as y,u as b}from"./walletRecoveryCommit-Cc9AqHr0.js";function x(e){throw Error(`Unhandled wallet recovery branch: ${String(e)}`)}function S(e){return e.target.kind===`google_email_otp`}function C(e,t){if(!e||e.stage===`prepared`||e.stage===`google_verified`||e.walletId!==t.walletId||e.target.kind!==t.target.kind)return null;switch(e.target.kind){case`passkey`:return t.kind===`credential_created`&&t.target.kind===`passkey`&&e.target.rpId===t.target.rpId?e:null;case`google_email_otp`:return t.kind===`email_otp_verified`&&t.target.kind===`google_email_otp`&&e.target.googleProvider===t.target.googleProvider?e:null}}function w(){return l(a(`wallet-recovery-reservation`,32,`wallet recovery operation reservations`))}function T(e){return e}const E=`seams:recovery:consumed-code-digests`;function D(){try{let e=JSON.parse(sessionStorage.getItem(E)??`[]`);return Array.isArray(e)?new Set(e.filter(e=>typeof e==`string`)):new Set}catch{return new Set}}function O(e,t){e.add(t);try{sessionStorage.setItem(E,JSON.stringify([...e].slice(-32)))}catch{}}function k(e){e&&e.byteLength>0&&new Uint8Array(e).fill(0)}function A(e){switch(e.recoveryCodeBytes.fill(0),e.stage){case`prepared`:case`google_verified`:return;case`credential_created`:k(e.replacement.factorSecret);return;case`email_otp_verified`:case`manifest_recovered`:k(e.replacement.kind===`passkey`?e.replacement.factorSecret:e.replacement.factor.factorSecret);return}}function j(){return{kind:`refused`}}function M(e){if(typeof e!=`object`||!e)return!1;let t=Reflect.get(e,`name`);return t===`NotAllowedError`||t===`AbortError`}function N(e,t){if(e.target.kind!==`passkey`||!e.prepared.registration)throw Error(`passkey recovery registration is unavailable`);return{stage:`credential_created`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,relayUrl:e.relayUrl,target:e.target,prepared:e.prepared,custodyJson:e.custodyJson,recoveryCodeBytes:e.recoveryCodeBytes,replacement:{kind:`passkey`,registration:t.registration,credentialIdB64u:t.credentialIdB64u,factorSecret:t.factorSecret}}}function P(e,t){return{stage:`email_otp_verified`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,relayUrl:e.relayUrl,target:e.target,prepared:e.prepared,custodyJson:e.custodyJson,recoveryCodeBytes:e.recoveryCodeBytes,replacement:t}}function F(e){let t=e.prepared.registration;if(!t)throw Error(`passkey recovery registration is unavailable`);return{replacementId:t.replacementId,walletAuthMethodId:t.walletAuthMethodId,factor:s({rpId:t.rpId,credentialIdB64u:e.replacement.credentialIdB64u}),factorSecret:e.replacement.factorSecret}}function I(e){let t=e.prepared.registration;if(!t)throw Error(`passkey recovery registration is unavailable`);return t.challengeId}function L(e,t){return{stage:`manifest_recovered`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,relayUrl:e.relayUrl,target:e.target,prepared:e.prepared,custodyJson:e.custodyJson,recoveryCodeBytes:e.recoveryCodeBytes,replacement:e.replacement,recovered:t}}function R(e,t){return{stage:`manifest_recovered`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,relayUrl:e.relayUrl,target:e.target,prepared:e.prepared,custodyJson:e.custodyJson,recoveryCodeBytes:e.recoveryCodeBytes,replacement:e.replacement,recovered:t}}function z(e,t){switch(e.stage){case`credential_created`:return L(e,t);case`email_otp_verified`:return R(e,t);default:return x(e)}}function B(e){return e.authMethod.kind===`passkey`}function V(e){return e.target.kind===`passkey`&&e.replacement.kind===`passkey`}function H(e){return e.target.kind===`google_email_otp`&&e.replacement.kind===`email_otp`}async function U(e){return await e.context.signingEngine.getSignerWorkerContext().requestWorkerOperation({kind:`emailOtp`,request:{type:`releaseWalletRecoveryEmailOtpFactor`,payload:{relayUrl:e.relayUrl,walletId:String(e.walletId),recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId}}})}async function W(e){let t=e.prepared.registration;if(!t)throw Error(`passkey recovery registration is unavailable`);return await m({relayUrl:e.relayUrl,walletId:e.walletId,reservationId:e.prepared.reservationId,recoveryOperationId:e.prepared.recoveryOperationId,targetDeviceId:e.prepared.targetDeviceId,targetAuthorityId:e.prepared.targetAuthorityId,targetWalletAuthMethodId:e.prepared.targetWalletAuthMethodId,challengeId:t.challengeId,replacementId:t.replacementId,webauthnRegistration:e.replacement.registration,replacementEnvelope:e.recovered.replacementEnvelope,ecdsaMaterialPossessionProofs:e.recovered.ecdsaKeySets.map(e=>({keySetId:e.entry.keySetId,proof:e.activation.possessionProof}))})}var G=class{constructor(e=null){this.rpc=e}#e=new Map;#t=new Map;#n=new Map;#r=new Map;#i=new Map;#a=D();async prepareWithCode(t){if(this.#c(),t.signal.aborted)return j();if(t.target.kind===`passkey`){let n=e(t.context.signingEngine.getRpId());if(!n.ok||n.value!==t.target.rpId)return j()}let n=null;try{n=u(t.recoveryCode);let e=i(await r(n));if(this.#a.has(e))return{kind:`consumed`};let o=T(e),s=this.#r.get(o),c=s?.expiresAtMs&&s.expiresAtMs>Date.now()?s.reservationId:w(),l=await p({relayUrl:t.relayUrl,target:t.target,recoveryCodeB64u:i(n),reservationId:c});if(l.kind!==`prepared`)return l.kind===`retryable_conflict`||l.kind===`transport_uncertain`?this.#r.set(o,{reservationId:c,expiresAtMs:Date.now()+3e5}):this.#r.delete(o),l;if(this.#r.delete(o),t.signal.aborted)return this.#r.set(o,{reservationId:l.reservationId,expiresAtMs:l.reservationExpiresAtMs}),j();let d=a(`wallet-recovery-operation`,24,`wallet recovery client operation handles`);return this.#e.set(d,{stage:`prepared`,recoveryOperationId:d,walletId:l.walletId,relayUrl:t.relayUrl,target:t.target,prepared:l,custodyJson:b({walletId:l.walletId,prepared:l}),recoveryCodeBytes:n}),this.#i.set(d,o),n=null,{kind:`prepared`,recoveryOperationId:d,walletId:l.walletId,target:t.target}}catch{return j()}finally{n?.fill(0)}}createPasskey(e){this.#c();let t=this.#e.get(e.operation.recoveryOperationId);if(!t||t.stage!==`prepared`||t.walletId!==e.operation.walletId||t.target.kind!==`passkey`||e.operation.target.kind!==`passkey`||t.target.rpId!==e.operation.target.rpId||this.#n.has(t.recoveryOperationId)||!t.prepared.registration)return Promise.resolve({kind:`refused`});let n=new AbortController;this.#n.set(t.recoveryOperationId,n);let r;try{r=e.context.signingEngine.createWalletRecoveryReplacementCredential({walletId:t.walletId,registration:t.prepared.registration,cancellation:{kind:`abort_signal`,signal:n.signal}})}catch{return this.cancel(t.recoveryOperationId),Promise.resolve({kind:`refused`})}return this.#s({current:t,credentialPromise:r,promptController:n})}async verifyGoogle(e){this.#c();let t=this.#e.get(e.operation.recoveryOperationId);if(!this.rpc||!t||t.stage!==`prepared`||t.target.kind!==`google_email_otp`||e.operation.target.kind!==`google_email_otp`||t.walletId!==e.operation.walletId||t.target.googleProvider!==e.operation.target.googleProvider||t.relayUrl!==e.relayUrl)return j();let n=t.prepared;if(!S(n))return j();try{let r=await this.rpc.verifyGoogle({relayUrl:t.relayUrl,recoveryOperationId:n.recoveryOperationId,reservationId:n.reservationId,idToken:e.idToken});if(r.kind!==`verified`)return r;if(r.recoveryOperationId!==n.recoveryOperationId)return{kind:`transport_uncertain`};let i={kind:`google_verified`,recoveryOperationId:t.recoveryOperationId,walletId:t.walletId,target:t.target,challengeId:r.challengeId,delivery:r.delivery,expiresAtMs:r.expiresAtMs},a={stage:`google_verified`,recoveryOperationId:t.recoveryOperationId,walletId:t.walletId,relayUrl:t.relayUrl,target:t.target,prepared:n,custodyJson:t.custodyJson,recoveryCodeBytes:t.recoveryCodeBytes,verification:i};return this.#e.set(a.recoveryOperationId,a),i}catch{return{kind:`transport_uncertain`}}}async verifyEmailOtp(e){this.#c();let n=this.#e.get(e.operation.recoveryOperationId);if(!this.rpc||!n||n.stage!==`google_verified`||n.walletId!==e.operation.walletId||n.target.kind!==`google_email_otp`||e.operation.target.kind!==`google_email_otp`||n.verification.challengeId!==e.operation.challengeId||e.challengeId!==e.operation.challengeId)return j();let r=t(e.challengeId);if(!r.ok)return j();try{let t=await this.rpc.verifyEmailOtp({relayUrl:n.relayUrl,recoveryOperationId:n.prepared.recoveryOperationId,reservationId:n.prepared.reservationId,challengeId:r.value,otpCode:e.otpCode});if(t.kind!==`verified`)return t;if(t.recoveryOperationId!==n.prepared.recoveryOperationId||t.challengeId!==e.challengeId)return{kind:`transport_uncertain`};let i=await U({context:e.context,relayUrl:n.relayUrl,walletId:n.walletId,recoveryOperationId:n.prepared.recoveryOperationId,reservationId:String(n.prepared.reservationId)});if(i.kind===`existing`){if(i.recoveryOperationId!==String(n.prepared.recoveryOperationId)||i.reservationId!==String(n.prepared.reservationId)||i.factorSecret32.byteLength!==32)return k(i.factorSecret32),{kind:`transport_uncertain`};let t=P(n,{kind:`email_otp`,factor:{replacementId:String(n.prepared.recoveryOperationId),walletAuthMethodId:n.prepared.targetWalletAuthMethodId,factor:o({enrollmentId:i.enrollmentId,enrollmentSealKeyVersion:i.enrollmentSealKeyVersion}),factorSecret:i.factorSecret32},enrollment:{kind:`existing`,enrollmentId:i.enrollmentId,enrollmentSealKeyVersion:i.enrollmentSealKeyVersion},providerSubject:i.providerSubject,verifiedEmail:i.verifiedEmail,registrationAuthorityId:e.challengeId});return this.#e.set(t.recoveryOperationId,t),{kind:`email_otp_verified`,recoveryOperationId:t.recoveryOperationId,walletId:t.walletId,target:t.target,challengeId:e.challengeId}}if(i.kind!==`create`)return i;if(i.recoveryOperationId!==String(n.prepared.recoveryOperationId)||i.reservationId!==String(n.prepared.reservationId))return{kind:`transport_uncertain`};let a=crypto.getRandomValues(new Uint8Array(32)),s=null;try{let t=await e.context.signingEngine.prepareEmailOtpRegistrationEnrollmentMaterialInternal({relayUrl:n.relayUrl,walletId:n.walletId,userId:i.providerSubject,clientSecret32:a});s=a.slice().buffer;let r=P(n,{kind:`email_otp`,factor:{replacementId:String(n.prepared.recoveryOperationId),walletAuthMethodId:n.prepared.targetWalletAuthMethodId,factor:o({enrollmentId:t.enrollmentId,enrollmentSealKeyVersion:t.enrollmentSealKeyVersion}),factorSecret:s},enrollment:{kind:`create`,enrollmentId:t.enrollmentId,providerSubject:i.providerSubject,verifiedEmail:i.verifiedEmail,material:t.emailOtpEnrollment},providerSubject:i.providerSubject,verifiedEmail:i.verifiedEmail,registrationAuthorityId:e.challengeId});return this.#e.set(r.recoveryOperationId,r),s=null,{kind:`email_otp_verified`,recoveryOperationId:r.recoveryOperationId,walletId:r.walletId,target:r.target,challengeId:e.challengeId}}finally{a.fill(0),s&&k(s)}}catch{return{kind:`refused`}}}async finalize(e){let t=String(e.operation.recoveryOperationId),n=this.#t.get(t);if(n)return n;let r=this.#o(e).finally(()=>{this.#t.delete(t)});return this.#t.set(t,r),r}async#o(e){this.#c();let t=C(this.#e.get(e.operation.recoveryOperationId),e.operation);if(!t)return j();try{if(t.stage===`credential_created`||t.stage===`email_otp_verified`){let n=t.stage===`credential_created`?F(t):t.replacement.factor,r=await e.context.signingEngine.recoverWalletCustodyManifest({walletId:t.walletId,prepared:t.prepared,custodyJson:t.custodyJson,recoveryCodeBytes:t.recoveryCodeBytes,replacementFactor:n,recoveryChallengeId:t.stage===`credential_created`?I(t):String(t.prepared.recoveryOperationId),relayUrl:t.relayUrl});if(this.#e.get(t.recoveryOperationId)!==t)return A(t),j();if(t.prepared.reservationExpiresAtMs<=Date.now())return this.cancel(t.recoveryOperationId),j();t.recoveryCodeBytes.fill(0),k(t.stage===`credential_created`?t.replacement.factorSecret:t.replacement.factor.factorSecret),t=z(t,r),this.#e.set(t.recoveryOperationId,t)}if(t.stage===`manifest_recovered`){if(!V(t)&&!H(t))return{kind:`transport_uncertain`};if(t.target.kind===`google_email_otp`&&!this.rpc)return{kind:`refused`};let e=await y({operation:t});if(this.#e.get(t.recoveryOperationId)!==t)return{kind:`transport_uncertain`};await c.putPendingWalletRecoveryCommit(e.pending);let r=V(t)?await W(t):this.rpc?await this.rpc.finalizeEmailOtp({relayUrl:t.relayUrl,walletId:t.walletId,recoveryOperationId:t.prepared.recoveryOperationId,reservationId:t.prepared.reservationId,targetDeviceId:t.prepared.targetDeviceId,targetAuthorityId:t.prepared.targetAuthorityId,targetWalletAuthMethodId:t.prepared.targetWalletAuthMethodId,expectedProviderSubject:t.replacement.providerSubject,expectedEmailHashHex:await n(t.replacement.verifiedEmail),expectedRegistrationAuthorityId:t.replacement.registrationAuthorityId,replacementEnvelope:t.recovered.replacementEnvelope,ecdsaMaterialPossessionProofs:t.recovered.ecdsaKeySets.map(e=>({keySetId:e.entry.keySetId,proof:e.activation.possessionProof})),emailOtpEnrollment:t.replacement.enrollment.kind===`create`?{kind:`create`,material:t.replacement.enrollment.material}:null}):{kind:`refused`};if(r.kind===`refused`)return await c.deletePendingWalletRecoveryCommit(t.prepared.recoveryOperationId),this.#e.get(t.recoveryOperationId)===t&&this.cancel(t.recoveryOperationId),r;if(this.#e.get(t.recoveryOperationId)!==t)return r.kind===`promoted`?{kind:`transport_uncertain`}:r;if(r.kind!==`promoted`)return r;if(t.replacement.kind===`passkey`&&r.authMethod.credentialIdB64u!==t.replacement.credentialIdB64u)return{kind:`transport_uncertain`};let i;if(f(e.payload)){if(!B(r))return{kind:`transport_uncertain`};i={kind:`passkey`,payload:e.payload,promotion:r}}else{if(B(r))return{kind:`transport_uncertain`};i={kind:`google_email_otp`,payload:e.payload,promotion:r}}await _({pending:await h({awaiting:e.pending,promotion:i}),payload:i.payload})}let r=this.#i.get(t.recoveryOperationId);return r&&O(this.#a,r),this.#e.delete(t.recoveryOperationId),this.#i.delete(t.recoveryOperationId),A(t),{kind:`ready_for_sign_in`,walletId:t.walletId}}catch{return{kind:`transport_uncertain`}}}async#s(e){try{let t=await e.credentialPromise;if(this.#e.get(e.current.recoveryOperationId)!==e.current||e.promptController.signal.aborted)return k(t.factorSecret),{kind:`dismissed`};if(e.current.prepared.reservationExpiresAtMs<=Date.now())return k(t.factorSecret),this.cancel(e.current.recoveryOperationId),{kind:`refused`};let n=N(e.current,t);return this.#e.set(n.recoveryOperationId,n),{kind:`credential_created`,recoveryOperationId:n.recoveryOperationId,walletId:n.walletId,target:n.target}}catch(t){return e.promptController.signal.aborted||M(t)?{kind:`dismissed`}:{kind:`transport_uncertain`}}finally{this.#n.get(e.current.recoveryOperationId)===e.promptController&&this.#n.delete(e.current.recoveryOperationId)}}cancel(e){this.#n.get(e)?.abort(),this.#n.delete(e);let t=this.#e.get(e);if(!t)return;let n=this.#i.get(e);this.#i.delete(e),n&&t.prepared.reservationExpiresAtMs>Date.now()&&this.#r.set(n,{reservationId:t.prepared.reservationId,expiresAtMs:t.prepared.reservationExpiresAtMs}),this.#e.delete(e),A(t)}#c(){let e=Date.now();for(let[t,n]of this.#r)n.expiresAtMs<=e&&this.#r.delete(t);for(let[t,n]of this.#e)n.prepared.reservationExpiresAtMs>e||(this.#n.get(t)?.abort(),this.#n.delete(t),this.#e.delete(t),this.#i.delete(t),A(n))}},K=class{#e=new G({verifyGoogle:v,verifyEmailOtp:g,finalizeEmailOtp:d});constructor(t,n){this.context=t,this.relayUrl=n;let r=e(t.signingEngine.getRpId());if(!r.ok)throw Error(`wallet recovery RP ID ${r.error.message}`);this.#t=r.value}#t;targetFor(e){switch(e){case`passkey`:return{kind:e,rpId:this.#t};case`google_email_otp`:return{kind:e,googleProvider:`google`}}}async prepare(e){let t=await this.#e.prepareWithCode({context:this.context,relayUrl:this.relayUrl,recoveryCode:e.recoveryCode,target:e.target,signal:e.signal});return t.kind===`prepared`?(t.target.kind,{kind:`hosted_recovery_prepared`,recoveryOperationId:t.recoveryOperationId,walletId:t.walletId,target:t.target}):t}createPasskey(e){return this.#n({kind:`prepared`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target})}async verifyGoogle(e,t){let n=await this.#e.verifyGoogle({relayUrl:this.relayUrl,operation:{kind:`prepared`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target},idToken:t});return n.kind===`google_verified`?{kind:`hosted_recovery_google_verified`,recoveryOperationId:n.recoveryOperationId,walletId:n.walletId,target:n.target,challengeId:n.challengeId,delivery:n.delivery,expiresAtMs:n.expiresAtMs}:n}async verifyEmailOtp(e,t){let n=await this.#e.verifyEmailOtp({context:this.context,operation:{kind:`google_verified`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target,challengeId:e.challengeId,delivery:e.delivery,expiresAtMs:e.expiresAtMs},challengeId:t.challengeId,otpCode:t.otpCode});return n.kind===`email_otp_verified`?{kind:`hosted_recovery_email_otp_verified`,recoveryOperationId:n.recoveryOperationId,walletId:n.walletId,target:n.target,challengeId:n.challengeId}:n}async finalize(e){return e.kind===`hosted_recovery_credential_created`?await this.#e.finalize({context:this.context,operation:{kind:`credential_created`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target}}):await this.#e.finalize({context:this.context,operation:{kind:`email_otp_verified`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target,challengeId:e.challengeId}})}async cancel(e){this.#e.cancel(e.recoveryOperationId)}async#n(e){let t=await this.#e.createPasskey({context:this.context,operation:e});return t.kind===`credential_created`?this.#r(t):t}#r(e){return{kind:`hosted_recovery_credential_created`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target}}};function q(e){return new K(e.context,e.relayUrl)}export{q as createHostedRecoveryPort};

package/dist/public/sdk/registration-C4sALQZO.js

@@ -0,0 +1 @@
+import{n as e}from"./chunk-dVx5-UGu.js";import{o as t}from"./errors-BZO3LF6G.js";import{c as n,r}from"./helpers-Ddy72ULN.js";import{t as i}from"./webauthnPromptCoordinator-BEudHQBr.js";import{a}from"./intentDigest-CE-tLw87.js";import{T as o,b as s,f as c,n as l,t as u,u as d,y as f}from"./adapters-DdDOQzl4.js";var p=e({handleRegistrationFlow:()=>_});function m(e){return Math.max(0,Math.round(performance.now()-e))}function h(e){return{kind:`passkey_registration_confirm_display_v1`,intendedUserName:e.walletId,accountId:e.walletId,rpId:e.rpId,signerSlot:e.signerSlot}}function g(e){let t={walletId:e.walletId,intendedUserName:e.walletId,prompt:e.prompt};return e.recoveryRegistration?{...t,kind:`wallet_recovery`,recoveryRegistration:e.recoveryRegistration}:e.addAuthMethodRegistration?{...t,kind:`wallet_add_auth_method`,registration:e.addAuthMethodRegistration}:{...t,kind:`wallet_registration`,challengeB64u:e.challengeB64u,signerSlot:e.signerSlot}}async function _(e,p,_,v){let{confirmationConfig:y,transactionSummary:b,theme:x,surface:S}=v,C=performance.now(),w=0,T=0,E=0,D=0,O=0,k=0,A=0,j=0,M=0,N=0,P=0,F=0,I=null,L=()=>({kind:`registration_confirmation_diagnostics_v1`,workerReadyMs:0,workerRequestRoundTripMs:0,workerResponseValidationMs:0,requestSetupMs:w,promptUserMs:T,promptElementDefineMs:E,promptMountMs:D,promptHostFirstUpdateMs:O,promptHostInteractiveMs:k,promptConfirmEventMs:A,promptDecisionWaitMs:j,credentialCreateStartMs:M,credentialCreateMs:N,credentialSerializeMs:P,duplicateRetryCount:F,mainThreadTotalMs:m(C)}),R=l(e),z=u({adapters:R,worker:_,request:p,confirmationConfig:y,transactionSummary:b,theme:x,surface:S}),B=o(p),V=s(p);try{let e=performance.now(),o=p.payload.walletRecoveryRegistration,s=p.payload.walletAddAuthMethodRegistration,c=p.payload.webauthnChallenge,l=o?o.challengeB64u:s?s.challengeB64u:c?.kind===`intent_digest`?String(c.challengeB64u||``).trim():``,u=async()=>{if(l)return l;let e=f(p);if(!e)throw Error(`Missing intentDigest for registration flow`);return a(e)},d=o?.rpId??s?.rpId??R.security.getRpId();if(!d)throw Error(`Missing rpId for registration challenge`);let _=p.payload?.signerSlot??1,v=await u(),y={rpId:d,passkeyRegistration:h({walletId:B,nearAccountId:V,rpId:d,signerSlot:_})};w=m(e);let b={kind:`registration_modal`,requestId:p.requestId};I=await i.reserveRegistrationPrompt({owner:b,expiresAtMs:Date.now()+300*1e3,cancellation:{kind:`none`}});let x=performance.now(),{confirmed:S,error:H,diagnostics:U}=await z.promptUser({securityContext:y});if(T=m(x),E=U.elementDefineMs,D=U.mountMs,O=U.hostFirstUpdateMs,k=U.hostInteractiveMs,A=U.confirmEventMs,j=U.decisionWaitMs,!S)return z.confirmAndCloseModal({requestId:p.requestId,intentDigest:f(p),confirmed:!1,registrationDiagnostics:L(),error:H});let W,G=p.payload?.signerSlot??1;M=m(C);let K=performance.now();try{try{let e={kind:`reserved`,reservation:I,owner:b,cancellation:{kind:`none`}};W=await R.webauthn.createRegistrationCredential(g(o?{walletId:B,recoveryRegistration:o,prompt:e}:s?{walletId:B,addAuthMethodRegistration:s,prompt:e}:{walletId:B,challengeB64u:v,signerSlot:G,prompt:e}))}catch(e){let n=t(e),r=String(n?.name||``),i=String(n?.message||``);if(r===`InvalidStateError`||/excluded|already\s*registered/i.test(i)){if(F+=1,l)throw Error(`Registration credential already exists for this wallet registration intent; create a fresh intent before retrying`);if(p.payload.walletRecoveryRegistration||s)throw Error(`Server-issued registration requires a fresh ceremony`);let e=G!==void 0&&Number.isFinite(G)?G+1:2;G=e,p.payload.signerSlot=e,p.intentDigest=p.type===`registerAccount`?`register:${B}:${e}`:`device2-register:${B}:${e}`,v=await u(),W=await R.webauthn.createRegistrationCredential(g({walletId:B,challengeB64u:v,signerSlot:e,prompt:{kind:`immediate`,requestId:p.requestId,cancellation:{kind:`none`}}}))}else throw console.error(`[RegistrationFlow] credentials.create failed (non-duplicate)`,{name:r,msg:i}),n}}finally{N=m(K)}let q=performance.now(),J=r(W)?W:n({credential:W,firstPrfOutput:!0,secondPrfOutput:!0});P=m(q),z.confirmAndCloseModal({requestId:p.requestId,intentDigest:f(p),confirmed:!0,credential:J,registrationDiagnostics:L()})}catch(e){let n=c(e),r=String(t(e)?.message||e||``);n&&window.parent?.postMessage({type:`WALLET_UI_CLOSED`},`*`);let i=/WebAuthn PRF output is missing from navigator\.credentials\.create\(\)/i.test(r)||/does not fully support the WebAuthn PRF extension during registration/i.test(r)||/roaming hardware authenticators .* not supported in this flow/i.test(r);return z.confirmAndCloseModal({requestId:p.requestId,intentDigest:f(p),confirmed:!1,registrationDiagnostics:L(),error:n?d.cancelled:i?r:r||d.collectCredentialsFailed})}finally{I&&i.releaseReservation(I)}}export{p as n,_ as t};