@seams/wallet 0.8.0 → 0.9.0

package/dist/public/sdk/signEvmFamily-KUNWKVeh.js

@@ -0,0 +1 @@
+import{n as e}from"./chunk-dVx5-UGu.js";import{f as t}from"./normalize-kUDm5zfS.js";import{t as n}from"./chains-CiYQT1K4.js";import{n as r}from"./secureRandomId-BIekT8bE.js";import{y as i}from"./primitives-CAcl7ON7.js";import{r as a}from"./transactionReviewAdmission-C-a3ctCJ.js";import{a as o,t as s}from"./activeWalletSession-DiZcKjB_.js";import{c,o as l,s as u}from"./ecdsaChainTarget-C8ZtMZ8l.js";import{n as d}from"./signerDomain-vQmlnsbF.js";import{s as f}from"./normalization-DCvuCvh0.js";import{u as p}from"./walletAuthority-B5hXHWpK.js";import{Dt as m,Et as h,Mt as g,Nt as _,en as v,g as y,mt as b,ot as x,st as S,tn as ee,u as te}from"./emailOtpEcdsaDerivationIdentity-B8HzTh4T.js";import{t as C}from"./challengeDelivery-DxXAkOfS.js";import{I as ne,O as w,P as T,R as E,y as D}from"./ecdsaCapabilityManifest-BlzJAQF8.js";import{a as re,m as ie,o as O}from"./sdkSentEvents-D3q1h-Uo.js";import{c as k,i as ae,n as oe,r as se,s as ce}from"./types-D3GM-uHR.js";import{c as le,l as A,s as ue}from"./nonceLaneKeys-Fkvk2UPy.js";import{D as j,E as de,F as M,S as N,b as fe,g as P,v as pe,x as me}from"./nearEd25519YaoSigningPreparation-B0d1AG3u.js";import{r as he,t as ge}from"./lanes-DnBwWv4l.js";import{t as _e}from"./walletSessionAuthorizationStatus-o1VgsLhA.js";import{r as ve}from"./operationFingerprint-CTR9G1NT.js";import{c as ye,l as be,o as xe,s as Se,t as Ce,u as F}from"./trace-BvbCxdXF.js";import{a as we,i as Te,n as Ee,t as De}from"./authorizationAdmission-Ckx6q6tp.js";import{i as Oe}from"./walletSessionFailure-Bu4VPKTz.js";import{a as ke,n as Ae,o as je,r as Me,s as Ne}from"./signingQueue-BrGJXBqe.js";import{h as Pe,i as Fe,l as Ie,n as Le,s as I}from"./clientSessionPersistenceState-CImFWDj6.js";import{f as Re,l as ze,n as Be,u as Ve}from"./signingFlow-vrXxrhlG.js";import{t as He}from"./display-ClqZq-Xt.js";import{i as Ue,r as We,t as L}from"./types-BNUuaUtl.js";import{E as Ge,u as Ke}from"./requireStepUpAuth-DCVqmeee.js";import{o as qe,r as Je}from"./transactionState-DVinJk4K.js";function Ye(e){let t=x(e.routerAbState);return{kind:`router_ab_ecdsa_derivation_signing_material_ref_v1`,activeStateId:S(t),ecdsaThresholdKeyId:ne(t.scope.ecdsa_threshold_key_id),clientVerifier33B64u:E(t.scope.public_identity.derivation_client_share_public_key33_b64u),serverVerifier33B64u:t.scope.public_identity.server_public_key33_b64u,thresholdVerifier33B64u:t.scope.public_identity.threshold_public_key33_b64u}}function Xe(e){return e.session.capabilitySubjects.filter(n=>n.kind===`sign`&&n.keyFamily===`ecdsa_secp256k1`&&t(n.materialActivation,e.materialActivation)).length===1}function Ze(e){return e.capability.manifest.signer.scope.targetMemberships.some(t=>u(t,e.chainTarget))}function Qe(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function $e(e){let{selectedAuthority:t,selectedAuthMethod:n}=e;return n.walletId===e.walletId&&n.status===`active`&&n.walletAuthorityId===t.authorityId&&t.walletId===e.walletId&&t.state===`active`}function et(e){let t=e.capability.authority,n=e.runtime.authBinding;switch(n.kind){case`email_otp`:return h(t)&&g(t,n.emailOtpAuthority);case`passkey`:return m(t)&&t.verifier.rpId===n.rpId&&t.factor.credentialIdB64u===n.credentialIdB64u;default:return n}}function tt(e){switch(e.runtime.authBinding.kind){case`email_otp`:return e.selectedAuthMethod.kind===`email_otp`&&e.selectedAuthMethod.emailHashHex===e.runtime.authBinding.emailHashHex;case`passkey`:return e.selectedAuthMethod.kind===`passkey`&&String(e.selectedAuthMethod.rpId)===String(e.runtime.authBinding.rpId)&&e.selectedAuthMethod.credentialIdB64u===e.runtime.authBinding.credentialIdB64u;default:return e.runtime.authBinding}}function R(e){if(!Number.isSafeInteger(e.nowMs)||e.nowMs<0)return!1;let{capability:n,authorization:r}=e,i=r.session,a=r.operationCredential,o=r.runtime,s=n.manifest.signer,c=r.selectedAuthority.signerActivations.ecdsa;if(!c||!$e({selectedAuthority:r.selectedAuthority,selectedAuthMethod:r.selectedAuthMethod,walletId:i.walletId})||i.walletId!==s.walletId||i.authorityId!==r.selectedAuthority.authorityId||i.authMethodId!==r.selectedAuthMethod.walletAuthMethodId||i.authorityDigestB64u!==r.selectedAuthority.authorityDigestB64u||i.authorityRevocationEpoch!==r.selectedAuthority.revocationEpoch||s.authority.walletId!==r.selectedAuthority.walletId||s.authority.walletAuthMethodId!==r.selectedAuthMethod.walletAuthMethodId||i.authorizationId.trim().length===0||i.quotaId.trim().length===0||a.walletSessionId.trim().length===0||a.token.trim().length===0||o.walletId!==i.walletId||!tt({selectedAuthMethod:r.selectedAuthMethod,runtime:o})||!t(o.materialActivation,n.manifest.activation.materialActivation)||!t(o.roleLocalMaterialRef.materialActivation,o.materialActivation)||!Ze({capability:n,chainTarget:o.chainTarget})||!et({capability:n,runtime:o})||!Xe({session:i,materialActivation:n.manifest.activation.materialActivation})||!t(c.materialActivation,n.manifest.activation.materialActivation)||c.signer.walletId!==i.walletId||o.expiresAtMs<=0||!Number.isSafeInteger(o.remainingUses)||o.remainingUses<0)return!1;switch(o.kind){case`exact_ecdsa_direct_capability_runtime_v1`:break;case`exact_ecdsa_sealed_runtime_v1`:if(o.sealedRecord.authMethod!==r.selectedAuthMethod.kind||o.sealedRecord.storeKey.trim().length===0||o.sealedRecord.thresholdSessionId.trim().length===0)return!1;break;default:return o}return!(i.expiresAtMs<=e.nowMs||o.expiresAtMs<=e.nowMs||o.keyHandle!==String(n.material.publicFacts.keyHandle)||o.ecdsaThresholdKeyId!==String(n.material.publicFacts.ecdsaThresholdKeyId)||o.thresholdEcdsaPublicKeyB64u!==String(n.material.publicFacts.groupPublicKey33B64u)||!Qe(o.participantIds,n.material.publicFacts.participantIds))}function nt(e){return e.authBinding.kind===`passkey`}function rt(e){return e.authBinding.kind===`email_otp`}function it(e){if(nt(e.runtime)&&e.selected.authMethod.kind===`passkey`||rt(e.runtime)&&e.selected.authMethod.kind===`email_otp`)return{kind:`ecdsa_preprocessing_session`,selectedAuthority:e.selected.authority,selectedAuthMethod:e.selected.authMethod,session:e.session,operationCredential:e.operationCredential,runtime:e.runtime};throw Error(`ECDSA preprocessing session auth method is inconsistent`)}function at(e){return m(e)?{kind:`passkey`,rpId:String(e.verifier.rpId),credentialIdB64u:String(e.factor.credentialIdB64u)}:h(e)?{kind:`email_otp`,providerSubjectId:String(e.factor.providerUserId),emailHashHex:String(e.verifier.emailHashHex),emailOtpAuthority:e}:e}function ot(e){if(!Number.isSafeInteger(e.status.expiresAtMs)||e.status.expiresAtMs<=0||!Number.isSafeInteger(e.status.remainingUses)||e.status.remainingUses<0)throw Error(`Exact ECDSA direct capability requires valid session facts`);return{kind:`exact_ecdsa_direct_capability_runtime_v1`,walletId:e.runtime.walletId,chainTarget:e.runtime.chainTarget,materialActivation:e.runtime.materialActivation,normalSigning:e.runtime.normalSigning,relayerUrl:e.runtime.relayerUrl,relayerKeyId:e.runtime.relayerKeyId,clientVerifyingPublicKey33B64u:e.runtime.clientVerifyingPublicKey33B64u,participantIds:e.runtime.participantIds,ecdsaThresholdKeyId:e.runtime.ecdsaThresholdKeyId,thresholdEcdsaPublicKeyB64u:e.runtime.thresholdEcdsaPublicKeyB64u,keyHandle:e.runtime.keyHandle,runtimePolicyScope:e.runtime.runtimePolicyScope,roleLocalMaterialRef:e.runtime.roleLocalMaterialRef,authBinding:at(e.authority),expiresAtMs:e.status.expiresAtMs,remainingUses:e.status.remainingUses}}function st(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`email_otp`:return t.kind===`email_otp`&&e.providerSubjectId===t.providerSubjectId&&e.emailHashHex===t.emailHashHex&&g(e.emailOtpAuthority,t.emailOtpAuthority);case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId&&e.credentialIdB64u===t.credentialIdB64u;default:return e}}function ct(e,n){if(e.kind!==n.kind||e.walletId!==n.walletId||!u(e.chainTarget,n.chainTarget)||!t(e.materialActivation,n.materialActivation)||e.keyHandle!==n.keyHandle||e.ecdsaThresholdKeyId!==n.ecdsaThresholdKeyId||!st(e.authBinding,n.authBinding))return!1;switch(e.kind){case`exact_ecdsa_direct_capability_runtime_v1`:return n.kind===`exact_ecdsa_direct_capability_runtime_v1`;case`exact_ecdsa_sealed_runtime_v1`:return n.kind===`exact_ecdsa_sealed_runtime_v1`&&e.sealedRecord.authMethod===n.sealedRecord.authMethod&&e.sealedRecord.storeKey===n.sealedRecord.storeKey&&e.sealedRecord.thresholdSessionId===n.sealedRecord.thresholdSessionId;default:return e}}function lt(e){let t=e.session.walletId;if(!Number.isSafeInteger(e.nowMs)||e.nowMs<0)throw Error(`Exact EVM-family Wallet Session authorization requires a valid timestamp`);if(!$e({selectedAuthority:e.selected.authority,selectedAuthMethod:e.selected.authMethod,walletId:t})||e.selected.selection.walletId!==t||e.selected.selection.walletAuthMethodId!==e.selected.authMethod.walletAuthMethodId||e.selected.selection.lockState!==`unlocked`)throw Error(`Exact EVM-family Wallet Session authorization selected authority is invalid`);let n=it(e);if(!R({capability:e.capability,authorization:n,nowMs:e.nowMs}))throw Error(`Exact EVM-family Wallet Session authorization identity is inconsistent`);return n}function ut(e){let t=ft(dt(e),e.nowMs);if(!t)throw Error(`Exact ECDSA signing authorization requires remaining signing uses`);return t}function dt(e){return{kind:`authorized_ecdsa_preprocessing_capability`,capability:e.capability,authorization:lt(e)}}function ft(e,t){let n=e.authorization,r=n.runtime;return r.remainingUses<=0||!R({capability:e.capability,authorization:n,nowMs:t})?null:nt(r)&&n.selectedAuthMethod.kind===`passkey`||rt(r)&&n.selectedAuthMethod.kind===`email_otp`?{kind:`exact_evm_family_wallet_session_authorization_v1`,selectedAuthority:n.selectedAuthority,selectedAuthMethod:n.selectedAuthMethod,session:n.session,operationCredential:n.operationCredential,runtime:r}:null}function pt(e){if(e.authorization.runtime.remainingUses<=0||!R({capability:e.capability,authorization:e.authorization,nowMs:e.nowMs}))throw Error(`Exact Wallet Session authorization does not bind the ECDSA signing capability`);return{kind:`authorized_evm_family_ecdsa_signing_capability`,capability:e.capability,authorization:e.authorization}}async function mt(e){let n=e.manifest.signer,r=n.registeredPublicFacts,i=e.material.publicFacts,a=await _({authority:e.authority});if(a.authorityDigest!==n.authority.authorityDigest||a.walletId!==n.walletId||e.material.authority.walletId!==n.walletId||e.material.authority.authorityDigest!==n.authority.authorityDigest||!t(e.material.materialActivation,e.manifest.activation.materialActivation)||i.walletId!==n.walletId||i.keyHandle!==r.keyHandle||String(i.groupPublicKey33B64u)!==String(r.publicKeyB64u)||i.ethereumAddress!==r.thresholdOwnerAddress||i.participantIds.length!==r.participantIds.length||i.participantIds.some((e,t)=>e!==r.participantIds[t]))throw Error(`Canonical EVM-family ECDSA signing capability identity is inconsistent`);return{kind:`canonical_evm_family_ecdsa_signing_capability`,authority:e.authority,manifest:e.manifest,material:e.material}}function z(e){let t=e&&typeof e==`object`&&`code`in e?String(e.code||``).trim():``;if(t===`sealed_refresh_parity_fetch_failed`||t===`sealed_refresh_parity_http_error`||t===`sealed_refresh_parity_aborted`)return!0;let n=String(e instanceof Error?e.message:e||``);return n.includes(`Failed to fetch relayer well-known capabilities`)||/Well-known endpoint returned HTTP 5\d\d/.test(n)}function B(e){return e instanceof Error?e.message:String(e||`unknown error`)}async function ht(e,t){try{await e()}catch(e){if(t.kind===`key_enrollment_bootstrap_parity`){console.warn(`[threshold-ecdsa] key enrollment bootstrap skipped sealed-refresh startup parity enforcement`,{walletId:String(t.walletId||``).trim(),chainTarget:l(t.chainTarget),error:B(e)});return}if(t.kind===`transaction_bootstrap_parity`&&z(e)){console.warn(`[threshold-ecdsa] transaction bootstrap skipped retryable sealed-refresh capability fetch failure`,{walletId:String(t.walletId||``).trim(),chainTarget:l(t.chainTarget),error:B(e)});return}if(t.kind===`email_otp_bootstrap_parity`&&t.authMethod===d.emailOtp&&z(e)){console.warn(`[threshold-ecdsa] Email OTP bootstrap skipped retryable sealed-refresh capability fetch failure`,{walletId:String(t.walletId||``).trim(),chainTarget:l(t.chainTarget),error:B(e)});return}if(t.kind===`default_bootstrap_parity`&&z(e)){console.warn(`[threshold-ecdsa] default bootstrap skipped retryable sealed-refresh capability fetch failure`,{walletId:String(t.walletId||``).trim(),chainTarget:l(t.chainTarget),error:B(e)});return}throw e}}async function gt(e,t){try{await e()}catch(e){if(!z(e))throw e;console.warn(`[threshold-ecdsa] transaction signing skipped retryable sealed-refresh capability fetch failure`,{walletId:String(t.walletId||``).trim(),chainTarget:l(t.chainTarget),error:B(e)})}}function _t(e){if(e.kind===`tempoTransaction`)return`tempo`;if(e.kind===`eip1559`)return`evm_compatible`;let t=String(e.chain||``).trim();if(t===`tempo`||t===`evm`)return t;throw Error(`[SigningEngine][ecdsa] transaction request requires a concrete chain family`)}function vt(e){let t=Number(e.request.tx.chainId);if(!Number.isSafeInteger(t)||t<=0)throw Error(`[SigningEngine][ecdsa] transaction request requires a concrete chainId`);if(t!==e.chainTarget.chainId)throw Error(`[SigningEngine][ecdsa] transaction request chainId does not match chainTarget`);let n=_t(e.request);if(n!==`evm_compatible`&&n!==e.chainTarget.kind)throw Error(`[SigningEngine][ecdsa] transaction request chain does not match chainTarget`);return e.chainTarget}function yt(){let e=Error(`Request cancelled`);return e.code=`cancelled`,e}function bt(e){if(typeof e==`function`&&e())throw yt()}function xt(e){return String(e||``).trim().toLowerCase().replace(/[\s-]+/g,`_`)}function V(e){return!e||typeof e!=`object`||!(`code`in e)?``:xt(e.code)}function St(e){return e?typeof e==`string`?e.trim():e instanceof Error||typeof e==`object`&&`message`in e?String(e.message||``).trim():String(e).trim():``}function Ct(e){let t=`${e.code} ${e.message}`.toLowerCase();return t.trim()?t.includes(`nonce_too_low`)||t.includes(`nonce too low`)?`nonce_too_low`:t.includes(`nonce_too_high`)||t.includes(`nonce too high`)?`nonce_too_high`:t.includes(`already_known`)||t.includes(`already known`)?`already_known`:t.includes(`replacement_transaction_underpriced`)||t.includes(`replacement transaction underpriced`)?`replacement_underpriced`:t.includes(`nonce_conflict`)||t.includes(`nonce`)&&t.includes(`conflict`)||t.includes(`invalid nonce`)||t.includes(`nonce has already been used`)?`nonce_conflict`:null:null}function wt(e){let t=e.chain===`tempo`?`Tempo`:`EVM`,n=Error(`[SigningEngine] ${t} nonce conflict (${e.reason}) on ${e.networkKey}. Refresh nonce context and retry.`);if(n.code=`nonce_conflict_retryable`,n.retryable=!0,n.details={chain:e.chain,reason:e.reason,networkKey:e.networkKey,chainId:e.chainId},e.cause!==void 0)try{n.cause=e.cause}catch{}return n}function Tt(e){let t=e.chain===`tempo`?`Tempo`:`EVM`,n=Error(`[SigningEngine] ${t} nonce lane blocked on ${e.networkKey} (nonce=${e.blockedNonce}). Reconcile lane and retry.`);if(n.code=`nonce_lane_blocked`,n.retryable=!0,n.details={chain:e.chain,networkKey:e.networkKey,chainId:e.chainId,blockedNonce:e.blockedNonce,...typeof e.ageMs==`number`?{ageMs:e.ageMs}:{}},e.cause!==void 0)try{n.cause=e.cause}catch{}return n}function Et(e){if(!e.error||typeof e.error!=`object`)return e.error;let t=V(e.error);if(t===`nonce_conflict_retryable`)return e.error;let n=Ct({code:t,message:St(e.error)});return n?wt({chain:e.chain,networkKey:e.networkKey,chainId:e.chainId,reason:n,cause:e.error}):e.error}function Dt(e){if(!e.error||typeof e.error!=`object`)return e.error;if(V(e.error)===`nonce_lane_blocked`){let t=typeof e.error.details==`object`&&e.error.details||{},n=String(t?.blockedNonce||``).trim(),r=Number(t?.ageMs);return Tt({chain:e.chain,networkKey:e.networkKey,chainId:e.chainId,blockedNonce:n||`unknown`,...Number.isFinite(r)?{ageMs:r}:{},cause:e.error})}let t=St(e.error).toLowerCase();return t.includes(`nonce lane blocked`)||t.includes(`nonce`)&&t.includes(`blocked`)?Tt({chain:e.chain,networkKey:e.networkKey,chainId:e.chainId,blockedNonce:`unknown`,cause:e.error}):e.error}function H(e){let t=Et(e);return Dt({...e,error:t})}function Ot(e){return!e||typeof e!=`object`?!1:V(e)===`nonce_conflict_retryable`}function kt(e){return!e||typeof e!=`object`?!1:V(e)===`nonce_lane_blocked`}function U(e){if(!e)return{present:!1};let t=M(e.identity,`ECDSA lane summary`);return{present:!0,walletId:t.walletId,authMethod:k(e.auth),curve:e.curve,chain:e.chain,chainFamily:`chainFamily`in e?e.chainFamily:e.chain,keyKind:`keyKind`in e?e.keyKind:`threshold_ecdsa_secp256k1`,sessionOrigin:`sessionOrigin`in e?e.sessionOrigin:void 0,storageSource:`storageSource`in e?e.storageSource:void 0,retention:`retention`in e?e.retention:void 0,walletSessionId:e.authorization.operationCredential.walletSessionId,materialActivationId:e.materialActivation.activationId,chainTarget:t.chainTarget,evmFamilyKeyPresent:!!t.key}}function W(e,t){try{console.warn(`[SigningEngine][ecdsa] ${e}`,JSON.stringify(t,null,2))}catch{}}function At(e){let t=e.lane;if(!t)throw W(`missing selected signing lane`,{context:e.context,chain:e.chain,...e.diagnostics}),Error(`[SigningEngine][ecdsa] missing selected signing lane for ${e.context}`);if(t.curve!==`ecdsa`||t.keyKind!==`threshold_ecdsa_secp256k1`)throw W(`selected signing lane is not ECDSA`,{context:e.context,expectedChain:e.chain,lane:U(t),...e.diagnostics}),Error(`[SigningEngine][ecdsa] ${e.context} requires an ECDSA signing lane`);let n=t.identity,r=M(n,`${e.context} resolved ECDSA lane`),i=r.chainTarget;if(i.kind!==e.chain)throw W(`selected signing lane chain mismatch`,{context:e.context,expectedChain:e.chain,lane:U(t),...e.diagnostics}),Error(`[SigningEngine][ecdsa] ${e.context} chain does not match selected lane`);let a=r.key;if(!a?.ecdsaThresholdKeyId||!a.signingRootId||!a.signingRootVersion)throw W(`selected signing lane missing full ECDSA identity`,{context:e.context,expectedChain:e.chain,lane:U(t),...e.diagnostics}),Error(`[SigningEngine][ecdsa] incomplete ECDSA lane identity for ${e.context}`);if(!a||String(a.walletId)!==String(r.walletId)||String(r.keyHandle||``).trim()===``)throw W(`selected signing lane missing matching shared key identity`,{context:e.context,expectedChain:e.chain,lane:U(t),...e.diagnostics}),Error(`[SigningEngine][ecdsa] missing shared key identity for ${e.context}`);let o=pe({key:a,materialActivation:r.materialActivation,keyHandle:r.keyHandle,walletId:r.walletId,auth:n.auth,authorization:t.authorization,chainTarget:i});return{...t,...o,key:a,keyHandle:r.keyHandle,chainTarget:i,keyKind:`threshold_ecdsa_secp256k1`,chainFamily:r.chainTarget.kind}}function jt(e){let t=e.authMethod;return{primaryAuthMethod:t,linkedAuthMethods:[t],...e.email?{email:e.email}:{},...e.passkeyCredentialIds?.length?{passkeyCredentialIds:e.passkeyCredentialIds}:{}}}async function Mt(e){if(e.senderSignatureAlgorithm===`webauthnP256`)return jt({authMethod:d.passkey});if(e.signerAuthMethod!==void 0)return jt({authMethod:e.signerAuthMethod});throw Error(`[SigningEngine][ecdsa] signer auth method is unavailable`)}function G(e,t){try{e?.(ie({...t,flowId:t.flowId??Nt(t)}))}catch{}}function Nt(e){let t=e.data||{};return[`signing`,String(t.chain||`evm_family`),String(t.networkKey||`unknown_network`),String(t.nonce||``)||String(e.phase)].join(`:`)}function K(e,t){G(e,t)}function Pt(e){if(Ft())try{console.debug(`[SigningOperationMachine][evm-family]`,e)}catch{}}function Ft(){try{return globalThis.localStorage?.getItem(`seams:debug:signing-operation`)===`1`}catch{return!1}}function It(e){let n=e.capability.authority;if(!h(n))throw Error(`[SigningEngine] Email OTP operation step-up requires an Email OTP capability authority`);if(e.claimedAuthority&&!g(n,e.claimedAuthority))throw Error(`[SigningEngine] Email OTP step-up authority does not match the selected capability`);if(!t(e.capability.manifest.activation.materialActivation,e.materialActivation))throw Error(`[SigningEngine] Email OTP step-up material activation does not match the selected capability`);let r=String(e.operationFingerprint||``).trim();if(!r)throw Error(`[SigningEngine] Email OTP operation step-up requires an operation fingerprint`);return{kind:`capability_step_up`,capabilityAuthority:n,materialActivation:e.materialActivation,operationFingerprint:r}}function Lt(e){switch(e.kind){case`live_session`:if(e.committedLane.authority.factor.kind!==`email_otp`)throw Error(`[SigningEngine][ecdsa] Email OTP challenge requires Email OTP authority`);return{kind:`live_session`,authLane:e.committedLane.authLane};case`capability_step_up`:return{kind:`capability_step_up`,capabilityAuthority:e.capabilityAuthority,materialActivation:e.materialActivation,operationFingerprint:e.operationFingerprint}}}function Rt(e){let t=null;return{challenge:async()=>{if(typeof e.requestEmailOtpTransactionSigningChallenge!=`function`)throw Error(`[SigningEngine] Email OTP ECDSA signing step-up is not configured`);if(e.authority.kind===`capability_step_up`){if(t!==null&&t!==e.authority.operationFingerprint)throw Error(`[SigningEngine] Email OTP step-up challenge is bound to a different operation`);t=e.authority.operationFingerprint}K(e.onEvent,{phase:O.STEP_06_AUTH_EMAIL_OTP_CHALLENGE_STARTED,status:`running`,walletId:e.walletId,interaction:{kind:`none`,overlay:`none`}}),xe(`evm-family`,Ce({event:`auth_side_effect_started`,lane:e.selectedLane,sideEffect:`email_otp_challenge`,phase:`confirmed`}));let n=await e.requestEmailOtpTransactionSigningChallenge({walletSession:e.walletSession,chain:e.chain,authority:Lt(e.authority),operationFingerprintDigest:e.operationFingerprintDigest}),r=String(n.challengeId||``).trim();if(!r)throw Error(`[SigningEngine] Email OTP challenge response did not include challengeId`);return K(e.onEvent,{phase:O.STEP_06_AUTH_EMAIL_OTP_INPUT_REQUIRED,status:`waiting_for_user`,walletId:e.walletId,interaction:{kind:`otp_input`,overlay:`show`},data:{emailHint:n.emailHint,demoOtpCode:C(n.delivery)}}),{challengeId:r,email:String(n.emailHint||``).trim()}}}}function zt(e){return h(e.authority)}function Bt(e){let t=e.selection.committedLane;if(!zt(t))throw Error(`[SigningEngine][ecdsa] Email OTP step-up requires Email OTP authority`);return t.authLane?{kind:`live_session`,committedLane:t}:{kind:`capability_step_up`,capabilityAuthority:t.authority,materialActivation:t.authorization.runtime.materialActivation,operationFingerprint:`sha256:${String(e.operationFingerprintDigest)}`}}function Vt(e){if(e.selection)return h(e.selection.committedLane.authority)?Bt({selection:e.selection,operationFingerprintDigest:e.operationFingerprintDigest}):void 0}async function Ht(e){let t=c(e.walletSession.walletId),n=e.senderSignatureAlgorithm===`secp256k1`&&e.ecdsaAuthorization===`reusable_wallet_session`?e.preparedOperation:null,r=n?n.metadata:null,i=n?.lane,a=r?.selection,o=e.confirmedDeps,s=(e.ecdsaAuthorization===`operation_step_up`&&h(e.capability.authority)?It({capability:e.capability,materialActivation:e.materialActivation,operationFingerprint:e.operationFingerprint}):void 0)??(i&&k(i.auth)===d.emailOtp?Vt({selection:a,operationFingerprintDigest:e.operationFingerprintDigest}):void 0),l=s?Rt({walletId:t,walletSession:e.walletSession,chain:e.chain,...i?{selectedLane:i}:{},authority:s,operationFingerprintDigest:e.operationFingerprintDigest,onEvent:e.onEvent,requestEmailOtpTransactionSigningChallenge:o.requestEmailOtpTransactionSigningChallenge}):null,u=oe.TransactionSign,f=null,p;if(n){let e=n,r=e.signingSessionPlan;if(p=r,r.kind===ae.NotReady)throw Error(`[SigningEngine] ECDSA signing session is not ready: ${r.reason}`);f=Ke({plan:r,accountId:String(t),intent:u,curve:`ecdsa`,expiresAtMs:e.expiresAtMs,remainingUses:e.remainingUses})}let g=f?null:await b(),_=f||g.signingAuthPlan,v=g?.emailOtpAuthBridge||l;if(_.kind!==L.EmailOtpReauth||!v)return{signingAuthPlan:_,...p?{signingSessionPlan:p}:{}};let y=async()=>{let e=await v.challenge();return{challengeId:e.challengeId,...e.email?{emailHint:e.email}:{}}};return{signingAuthPlan:_,...p?{signingSessionPlan:p}:{},emailOtpSigning:{prepare:y,resend:async()=>await y()}};async function b(){if(e.ecdsaAuthorization===`operation_step_up`){if(m(e.capability.authority))return{signingAuthPlan:{kind:L.PasskeyReauth,method:`passkey`}};if(h(e.capability.authority)){if(!l)throw Error(`[SigningEngine] Email OTP step-up authority is unavailable for the selected capability`);return{signingAuthPlan:{kind:L.EmailOtpReauth,method:`email_otp`},emailOtpAuthBridge:l}}e.capability.authority}if(!(Array.isArray(e.accountAuth.linkedAuthMethods)?e.accountAuth.linkedAuthMethods:[]).includes(e.accountAuth.primaryAuthMethod))throw Error(`[SigningEngine] primary auth method is not linked: ${String(e.accountAuth.primaryAuthMethod||``)}`);if(e.accountAuth.primaryAuthMethod===d.passkey)return{signingAuthPlan:{kind:L.PasskeyReauth,method:`passkey`}};if(e.accountAuth.primaryAuthMethod===d.emailOtp){if(!l)throw Error(`[SigningEngine] Email OTP transaction signing requires ECDSA lane state`);return{signingAuthPlan:{kind:L.EmailOtpReauth,method:`email_otp`},emailOtpAuthBridge:l}}throw Error(`[SigningEngine] unsupported primary auth method: ${String(e.accountAuth.primaryAuthMethod||``)}`)}}function Ut(e){if(e.selectedAuthMethod.kind!==`email_otp`||e.runtime.kind!==`exact_ecdsa_sealed_runtime_v1`||e.runtime.authBinding.kind!==`email_otp`||e.operationCredential.token.trim().length===0||e.runtime.sealedRecord.thresholdSessionId.trim().length===0)throw Error(`Exact Email OTP ECDSA signing-session authorization is incomplete`);return{kind:`signing_session`,operationCredential:e.operationCredential,thresholdSessionId:e.runtime.sealedRecord.thresholdSessionId,curve:`ecdsa`,chainTarget:e.runtime.chainTarget}}function Wt(e){switch(P(e)){case d.emailOtp:return d.emailOtp;case d.passkey:return d.passkey}throw Error(`[SigningEngine][ecdsa] unsupported ECDSA lane auth method`)}function Gt(e,t){return{...e,primaryAuthMethod:t,linkedAuthMethods:Array.from(new Set([...e.linkedAuthMethods,t]))}}function Kt(e){let t=e.chainTarget.kind===`tempo`?he:ge,n={key:e.key,materialActivation:e.materialActivation,keyHandle:e.keyHandle,walletId:e.walletId,chainTarget:e.chainTarget,authorization:e.authorization};return At({lane:t(e.auth.kind===`email_otp`?{...n,auth:e.auth,retention:`session`,sessionOrigin:`per_operation`}:{...n,auth:e.auth,storageSource:`manual-bootstrap`}),chain:e.chain,context:`build exact ECDSA candidate signing lane`})}function qt(e){return{authMethod:Wt(e),chain:e.chain,chainTarget:e.chainTarget,state:e.state,walletSessionId:e.authorization.operationCredential.walletSessionId,materialActivationId:e.materialActivation.activationId,remainingUses:e.authorization.runtime.remainingUses,expiresAtMs:e.authorization.runtime.expiresAtMs}}function q(e){return{...qt(e),source:`canonical_capability`}}function Jt(e){return e.selectedAuthMethod.kind===`email_otp`&&e.runtime.authBinding.kind===`email_otp`}function Yt(e){return e.runtime.kind===`exact_ecdsa_direct_capability_runtime_v1`}function Xt(e){return e.runtime.kind===`exact_ecdsa_sealed_runtime_v1`}function Zt(e){if(e.auth.kind!==`passkey`)throw Error(`[SigningEngine][ecdsa] passkey committed lane requires passkey candidate`);return{...e,auth:e.auth}}function Qt(e){let t=String(e.authority.walletId);if(!(String(e.lane.key.walletId)===t&&String(e.candidate.walletId)===t))throw Error(`[SigningEngine][ecdsa] ${e.context} committed lane authority wallet mismatch`)}function $t(e){return{selectedLaneCandidate:q(e.candidate)}}async function en(e){let t=Zt(e.candidate),n=(await e.deps.resolveCanonicalEcdsaSigningCapability({walletId:t.walletId,chainTarget:t.chainTarget,materialActivation:t.materialActivation})).authority;if(!m(n)||String(n.verifier.rpId)!==String(t.auth.rpId)||n.factor.credentialIdB64u!==t.auth.credentialIdB64u)throw Error(`[SigningEngine][ecdsa] exact Passkey capability authority changed`);return Qt({authority:n,lane:e.lane,candidate:t,context:`Passkey`}),{lane:e.lane,authority:n,authorization:e.lane.authorization}}async function tn(e){let t=N(e.lane),n=await e.deps.resolveDurableEmailOtpEcdsaSigningSessionAuthority({lane:t,chain:e.lane.chainTarget.kind});return n?Jt(n)?{kind:`durable_authority_backed`,authorization:n}:null:(W(`Email OTP exact ECDSA authority not found`,{lane:U(e.lane),candidate:q(e.candidate)}),null)}function nn(e){if(e.authority)return e.authority;throw W(`Email OTP exact ECDSA signing-session authority missing`,{lane:U(e.lane),candidate:q(e.candidate)}),Error(`Email OTP ECDSA committed lane is missing wallet-session authority; unlock wallet again`)}function rn(e){let t=Ut(e.authority.authorization);if(t.kind===`signing_session`&&t.curve===`ecdsa`&&u(t.chainTarget,e.lane.chainTarget))return t;throw W(`Email OTP ECDSA committed lane rejected for authority shape`,{authorityKind:t.kind,authorityCurve:t.kind===`signing_session`?t.curve:null,lane:U(e.lane),candidate:q(e.candidate)}),Error(`Email OTP ECDSA committed lane authority is not an ECDSA signing session; unlock wallet again`)}function an(e){if(e.committedLane&&e.committedLane.authority.factor.kind===e.expectedFactor)return e.committedLane;throw W(`ECDSA committed lane missing for ready signing`,{expectedFactor:e.expectedFactor,lane:U(e.lane),candidate:q(e.candidate)}),Error(`[SigningEngine][ecdsa] committed lane is unavailable for ready signing`)}function on(e){let t=e.authority.authorization;if(t.runtime.authBinding.kind!==`email_otp`)throw Error(`[SigningEngine][ecdsa] Email OTP authority runtime binding is invalid`);let n=t.runtime.authBinding.emailOtpAuthority;if(Qt({authority:n,lane:e.lane,candidate:e.candidate,context:`Email OTP`}),Yt(t))return{lane:e.lane,authority:n,authorization:t};if(Xt(t))return{lane:e.lane,authority:n,authorization:t,authLane:rn({authority:e.authority,lane:e.lane,candidate:e.candidate})};throw Error(`[SigningEngine][ecdsa] Email OTP authorization runtime is unsupported`)}async function sn(e){let t=Kt(e.laneCandidate),n=t,r=Wt(e.laneCandidate),i=r===d.emailOtp?await tn({deps:e.deps,lane:n,candidate:e.laneCandidate}):null,a=r===d.emailOtp?nn({authority:i,lane:n,candidate:e.laneCandidate}):null,o=r===d.emailOtp&&a?on({authority:a,lane:n,candidate:e.laneCandidate}):null,s=r===d.passkey?await en({deps:e.deps,lane:t,candidate:e.laneCandidate}):null,c=o??s,l=c?.authority.factor.kind,u=Gt(await Mt({senderSignatureAlgorithm:e.senderSignatureAlgorithm,signerAuthMethod:l??r}),r),f=$t({candidate:e.laneCandidate});return{kind:`ready`,accountAuth:u,lane:t,committedLane:an({committedLane:c,expectedFactor:r,lane:t,candidate:e.laneCandidate}),diagnostics:f}}function cn(e){let t={walletId:e.walletId,curve:`ecdsa`,authSelectionPolicy:e.authSelectionPolicy,operationUsesNeeded:e.operationUsesNeeded,...e.operationId?{operationId:e.operationId}:{}};return e.signingTarget.kind===`tempo`?{...t,chain:`tempo`,chainTarget:e.signingTarget}:{...t,chain:`evm`,chainTarget:e.signingTarget}}function ln(e){return{kind:`account_class`,authMethod:e.candidateAuthMethod}}function un(e){let t=new Set;for(let n of Ie(e.availableLanes,e.signingTarget))Pe(n)&&u(n.chainTarget,e.signingTarget)&&t.add(I(n));if(t.size!==1)throw Error(`[SigningEngine][ecdsa] exact capability authority is unavailable or ambiguous`);return Array.from(t)[0]}function dn(e){if(!e)return{present:!1};if(!Pe(e))return{present:!0,curve:e.curve,chain:e.chainTarget.kind,chainTarget:e.chainTarget,state:e.state};let t=y({walletId:e.key.walletId,publicFacts:e.publicFacts});return{present:!0,authMethod:I(e),curve:e.curve,chain:e.chainTarget?.kind,chainTarget:e.chainTarget,...t?{evmFamilyKeyFingerprint:t}:{},state:e.state,source:e.source,walletSessionId:e.authorization?.operationCredential.walletSessionId,materialActivationId:e.materialActivation.activationId,remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs}}function fn(e){return Object.fromEntries(Object.entries(e.ecdsa.candidatesByTarget).map(([e,t])=>[e,t.map(e=>dn(e))]))}function pn(e,t){try{console.warn(e,JSON.stringify(t,null,2))}catch{try{console.warn(e,t)}catch{}}}function mn(e){return Object.fromEntries(Object.entries(e.ecdsa.lanesByTarget).map(([e,t])=>[e,dn(t)]))}function hn(e){return e?{present:!0,authMethod:P(e),curve:e.curve,chain:e.chainTarget.kind,chainTarget:e.chainTarget,state:e.state,source:e.source,materialActivationId:e.materialActivation.activationId,authorizationState:e.authorizationState,...e.authorizationState===`authorized`?{walletSessionId:e.authorization.operationCredential.walletSessionId,remainingUses:e.authorization.runtime.remainingUses,expiresAtMs:e.authorization.runtime.expiresAtMs}:{}}:{present:!1}}function gn(e,t){let n=e.session,r=t.session;return e.selectedAuthority.authorityId===t.selectedAuthority.authorityId&&e.selectedAuthMethod.kind===t.selectedAuthMethod.kind&&e.selectedAuthMethod.walletAuthMethodId===t.selectedAuthMethod.walletAuthMethodId&&n.walletId===r.walletId&&n.authorityId===r.authorityId&&n.authMethodId===r.authMethodId&&n.authorizationId===r.authorizationId&&n.quotaId===r.quotaId&&n.authorityDigestB64u===r.authorityDigestB64u&&n.authorityRevocationEpoch===r.authorityRevocationEpoch&&e.operationCredential.walletSessionId===t.operationCredential.walletSessionId&&e.operationCredential.token===t.operationCredential.token&&ct(e.runtime,t.runtime)}function _n(e){let t=e.candidate,n=P(t),r=e.selection.committedLane.authority.factor.kind;if(n!==r)throw Error(`[SigningEngine][ecdsa] prepared auth method ${n} did not match committed lane auth method ${r}`);let i=k(e.selection.lane.auth);if(i!==r)throw Error(`[SigningEngine][ecdsa] selected lane auth method ${i} did not match committed lane auth method ${r}`);if(!gn(t.authorization,e.selection.lane.authorization))throw Error(`[SigningEngine][ecdsa] prepared authorization did not match lane`);if(j(N(e.selection.committedLane.lane))!==j(N(e.selection.lane)))throw Error(`[SigningEngine][ecdsa] committed lane did not match selected lane`)}function vn(e){let t=e.diagnostics.selectedLaneCandidate.state,{expiresAtMs:n,remainingUses:r}=e.lane.authorization.runtime;return t===`expired`?{readiness:{status:`expired`,curve:`ecdsa`,materialActivation:e.lane.materialActivation,authorization:e.lane.authorization,expiresAtMs:n},expiresAtMs:n,remainingUses:r}:t===`exhausted`?{readiness:{status:`exhausted`,curve:`ecdsa`,materialActivation:e.lane.materialActivation,authorization:e.lane.authorization,expiresAtMs:n,remainingUses:r},expiresAtMs:n,remainingUses:r}:{readiness:{status:`ready`,curve:`ecdsa`,materialActivation:e.lane.materialActivation,authorization:e.lane.authorization,expiresAtMs:n,remainingUses:r},expiresAtMs:n,remainingUses:r}}function yn(e){let t=e.preparedOperation.operation;if(!t)throw Error(`[SigningEngine][ecdsa] prepared material requires an operation identity`);if(e.metadata.materialBinding.operationId!==t.operationId)throw Error(`[SigningEngine][ecdsa] prepared material operation identity mismatch`);if(e.metadata.materialBinding.operationFingerprint&&t.operationFingerprint&&e.metadata.materialBinding.operationFingerprint!==t.operationFingerprint)throw Error(`[SigningEngine][ecdsa] prepared material fingerprint mismatch`);let n=j(de(e.preparedOperation.lane));if(e.metadata.materialBinding.laneIdentityKey!==n)throw Error(`[SigningEngine][ecdsa] prepared material lane identity mismatch`)}async function bn(e){let t=e.signingTarget,n=t.kind,r=c(e.walletSession.walletId),i=await e.deps.resolveOwnerLaneScope(r),a=await e.deps.readAvailableSigningLanesForSigning({walletId:r,curve:`ecdsa`,ecdsaChainTargets:[t],ownerScope:i}),o={walletId:r,chain:n,chainTarget:t,targetKey:l(t),candidateCount:Ie(a,t).length,selectedLanesByTarget:mn(a),candidatesByTarget:fn(a)};o.candidateCount===0&&pn(`[ECDSA_LANE_READ_DIAGNOSTIC][no-candidates]`,o),F(`evm-family`,{stage:`ecdsa_prepare.available_lanes_read`,...o});let s=un({availableLanes:a,signingTarget:e.signingTarget}),u=cn({walletId:r,authSelectionPolicy:ln({candidateAuthMethod:s}),operationUsesNeeded:1,signingTarget:e.signingTarget,...e.signingOperation.operationId?{operationId:e.signingOperation.operationId}:{}}),d=qe({intent:u,availableLanes:a});if(F(`evm-family`,{stage:`ecdsa_prepare.material_candidate_selected`,walletId:r,chain:n,chainTarget:t,primaryAuthMethod:d.ok?P(d.candidate):s,selectionOk:d.ok,...d.ok?{authorizationState:d.kind,selectedAvailableLane:dn(d.availableLane),selectedLaneCandidate:hn(d.candidate),...d.kind===`authorized`?{transactionLane:d.lane}:{}}:{failure:d.failure}}),!d.ok){let e={stage:`ecdsa_prepare.exact_material_candidate_missing`,walletId:r,chain:n,chainTarget:t,targetKey:l(t),primaryAuthMethod:s,candidateCount:o.candidateCount,ecdsaTargets:a.ecdsa.targets,selectedLanesByTarget:o.selectedLanesByTarget,candidatesByTarget:o.candidatesByTarget,selectionFailure:d.failure};throw pn(`[ECDSA_NO_LANE_DIAGNOSTIC]`,e),be(`evm-family`,e),Error(`[SigningEngine][ecdsa] transaction signing requires exact ECDSA material for ${n}`)}if(d.kind===`authorization_required`){let t=d.candidate;return e.diagnostics.selection={kind:`authorization_required`,authMethod:I(d.availableLane),candidate:hn(t)},{kind:`authorization_required`,authMethod:I(d.availableLane),availableLanesGeneration:a.generation,identity:me({signer:fe({walletId:t.walletId,chainTarget:t.chainTarget,keyHandle:t.keyHandle,key:t.key,materialActivation:t.materialActivation}),auth:t.auth}),candidate:t,intent:u}}let f=d.candidate,p=d.lane,m=await Je({intent:u,coordinator:e.signingSessionCoordinator,operation:e.signingOperation,forceFreshAuth:e.forceFreshAuth===!0,onPlannerTrace:e=>ye(`evm-family`,e),lifecycleAdapter:{prepare:async()=>{let i=await sn({deps:e.deps,walletId:r,chainTarget:t,senderSignatureAlgorithm:`secp256k1`,laneCandidate:f});F(`evm-family`,{stage:`ecdsa_prepare.material_selected`,walletId:r,chain:n,chainTarget:t,selectionKind:i.kind,authMethod:i.committedLane.authority.factor.kind,lane:U(i.lane),diagnostics:i.diagnostics});let o=i.committedLane.authority.factor.kind;Se(`evm-family`,i.lane,{reason:`evm_family_ecdsa_selection`}),e.diagnostics.selection={kind:i.kind,authMethod:o,lane:U(i.lane),diagnostics:i.diagnostics};let s=At({lane:i.lane,chain:n,context:`EVM-family signing preparation`,diagnostics:e.diagnostics});_n({candidate:f,selection:i});let c=vn(i);return F(`evm-family`,{stage:`ecdsa_prepare.readiness`,walletId:r,chain:n,chainTarget:t,authMethod:o,lane:U(s),readinessStatus:c.readiness.status}),xe(`evm-family`,Ce({event:`pre_confirm_readiness_checked`,lane:s,readinessStatus:c.readiness.status,phase:`pre_confirm`})),{lane:s,transactionLane:p,transactionIntent:u,readiness:{readiness:c.readiness,expiresAtMs:c.expiresAtMs,remainingUses:c.remainingUses},availableLanesGeneration:a.generation,metadata:{accountAuth:i.accountAuth,authMethod:o,source:i.diagnostics.selectedLaneCandidate.source,selection:i,materialBinding:{operationId:e.signingOperation.operationId,...e.signingOperation.operationFingerprint?{operationFingerprint:e.signingOperation.operationFingerprint}:{},laneIdentityKey:j(de(s))},availableLanesGeneration:a.generation}}}}}),h=m.thresholdOperation,g=h.metadata;return yn({metadata:g,preparedOperation:h}),{kind:`authorized`,accountAuth:g.accountAuth,authMethod:g.authMethod,source:g.source,selection:g.selection,availableLanesGeneration:g.availableLanesGeneration,signingLane:h.lane,preparedOperation:h,transactionOperation:m.transactionOperation}}function J(e){let t=e.signedResult.managedNonce;if(!t||typeof t!=`object`)throw Error(`[SigningEngine][evm-family] managedNonce is required for nonce lifecycle`);try{let n=ze(t);return e.walletId,n}catch(e){throw Error(`[SigningEngine][evm-family] invalid managedNonce: ${e instanceof Error?e.message:String(e||`unknown error`)}`)}}async function xn(e,t){let n=Y(t);await e.nonceCoordinator.release({...n,reason:`signing_failed`})}function Sn(e){return{chainNextNonce:e.chainNextNonce.toString(),unresolvedInFlightNonces:e.unresolvedInFlightNonces.map(e=>e.toString()),blocked:e.blocked,...e.blockedNonce==null?{}:{blockedNonce:e.blockedNonce.toString()}}}async function Cn(e,t){let n=J({signedResult:t.signedResult,walletId:t.walletId});G(t.onEvent,{walletId:t.walletId,phase:O.STEP_12_BROADCAST_ACCEPTED,status:`running`,message:`Marking managed nonce lane as in-flight`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),nonce:n.nonce.toString()}});let r=wn(t.txHash||(t.signedResult.chain===`evm`?t.signedResult.txHashHex:void 0));await e.nonceCoordinator.markBroadcastAccepted({...Y(n),txHash:r}),G(t.onEvent,{walletId:t.walletId,phase:O.STEP_12_BROADCAST_ACCEPTED,status:`succeeded`,message:`Managed nonce lane marked in-flight`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),nonce:n.nonce.toString(),txHash:r}})}function wn(e){let t=String(e||``).trim().toLowerCase();if(!/^0x[0-9a-f]{64}$/.test(t))throw Error(`[SigningEngine][evm-family] broadcast acceptance requires txHash`);return t}async function Tn(e,t){let n=J({signedResult:t.signedResult,walletId:t.walletId});G(t.onEvent,{walletId:t.walletId,phase:O.STEP_12_BROADCAST_REJECTED,status:`running`,message:`Marking managed nonce reservation rejected`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),nonce:n.nonce.toString()}}),await e.nonceCoordinator.markBroadcastRejected({...Y(n),error:t.error});let r=H({error:t.error,chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId});if(G(t.onEvent,{walletId:t.walletId,phase:O.STEP_12_BROADCAST_REJECTED,status:`failed`,message:`Managed nonce reservation marked rejected`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),nonce:n.nonce.toString()}}),!Ot(r)&&!kt(r))return;G(t.onEvent,{walletId:t.walletId,phase:O.STEP_13_NONCE_RECONCILE_STARTED,status:`running`,message:`Reconciling managed nonce lane after broadcast error`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),nonce:n.nonce.toString(),errorCode:V(r)}});let i=await e.nonceCoordinator.reconcile({lane:ue(n)}).catch(()=>null);throw G(t.onEvent,{walletId:t.walletId,phase:O.STEP_13_NONCE_RECONCILE_SUCCEEDED,status:`succeeded`,message:`Managed nonce lane reconciled`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),...i?{laneStatus:Sn(i)}:{}}}),r}async function En(e,t){t.receiptStatus;let n=J({signedResult:t.signedResult,walletId:t.walletId}),r=t.txHash||(t.signedResult.chain===`evm`?t.signedResult.txHashHex:void 0);await e.nonceCoordinator.markFinalized({...Y(n),...r?{txHash:r}:{}})}async function Dn(e,t){let n=J({signedResult:t.signedResult,walletId:t.walletId});G(t.onEvent,{walletId:t.walletId,phase:t.reason===`replaced`?O.STEP_13_TRANSACTION_REPLACED:O.STEP_13_TRANSACTION_DROPPED,status:`running`,message:t.reason===`replaced`?`Marking managed nonce lane replaced`:`Marking managed nonce lane dropped`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),nonce:n.nonce.toString(),reason:t.reason,...t.txHash?{txHash:t.txHash}:{}}}),await e.nonceCoordinator.markDroppedOrReplaced({...Y(n),reason:t.reason,...t.txHash?{txHash:t.txHash}:{}}),G(t.onEvent,{walletId:t.walletId,phase:t.reason===`replaced`?O.STEP_13_TRANSACTION_REPLACED:O.STEP_13_TRANSACTION_DROPPED,status:t.reason===`replaced`?`succeeded`:`failed`,message:t.reason===`replaced`?`Managed nonce lane marked replaced`:`Managed nonce lane marked dropped`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),nonce:n.nonce.toString(),reason:t.reason,...t.txHash?{txHash:t.txHash}:{}}})}async function On(e,t){let n=J({signedResult:t.signedResult,walletId:t.walletId});G(t.onEvent,{walletId:t.walletId,phase:O.STEP_13_NONCE_RECONCILE_STARTED,status:`running`,message:`Reconciling managed nonce lane`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString()}});let r=await e.nonceCoordinator.reconcile({lane:ue(n)}),i=Sn(r);if(G(t.onEvent,{walletId:t.walletId,phase:O.STEP_13_NONCE_RECONCILE_SUCCEEDED,status:`succeeded`,message:`Managed nonce lane reconciled`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),laneStatus:i}}),r.blocked)throw Tt({chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId,blockedNonce:String(i.blockedNonce||`unknown`)});return i}function Y(e){let t=String(e.leaseId||``).trim(),n=String(e.operationId||``).trim(),r=String(e.operationFingerprint||``).trim();if(!t||!n||!r)throw Error(`[SigningEngine][evm-family] managedNonce lease metadata is required`);return{leaseId:t,operationId:n,operationFingerprint:r}}function kn(e){let t=String(e||``).trim().toLowerCase();if(/^0x[0-9a-f]{40}$/.test(t))return t}function An(e){if(`chainId`in e)return typeof e.chainId==`number`?e.chainId:void 0}function jn(e){return String(n(e.network))===`evm`}function Mn(e){return String(n(e.network))===`tempo`}function Nn(e){let t=Fn(e);if(t)return t;let n=e.request.tx.chainId;throw Error(`[SigningEngine] unable to resolve nonce network for ${e.request.chain} chainId=${String(n)} from configured chains`)}function Pn(e){return Fn(e)||`${e.request.chain}:${String(e.request.tx.chainId)}`}function Fn(e){let t=e.request.tx.chainId,n=e.configs.network.chains.filter(e=>{let n=An(e);return typeof n==`number`&&n===t});if(!n.length)return null;if(e.request.chain===`tempo`){let t=n.filter(e=>Mn(e));if(t.length===1)return t[0].network;if(t.length>1){let n=t.map(e=>e.network).join(`, `);throw Error(`[SigningEngine] ambiguous nonce network for tempo chainId=${String(e.request.tx.chainId)} across [${n}]`)}return null}let r=n.filter(e=>jn(e));if(r.length===1)return r[0].network;if(r.length>1){let t=r.map(e=>e.network).join(`, `);throw Error(`[SigningEngine] ambiguous nonce network for evm chainId=${String(e.request.tx.chainId)} across [${t}]`)}let i=n.filter(e=>Mn(e));if(i.length===1)return i[0].network;if(i.length>1){let t=i.map(e=>e.network).join(`, `);throw Error(`[SigningEngine] ambiguous nonce network for evm->tempo chainId=${String(e.request.tx.chainId)} across [${t}]`)}return null}function In(e){return{kind:`threshold_owner`,thresholdOwnerAddress:e}}function Ln(e){return{kind:`chain_account`,chainAccountAddress:e}}function Rn(e){switch(e.kind){case`threshold_owner`:return e.thresholdOwnerAddress;case`chain_account`:return e.chainAccountAddress;default:return e}}async function zn(e){let t=(await e.deps.walletSignerStore.getActiveWalletSignerForChainTarget({walletId:e.walletId,chainTarget:e.chainTarget}))?.metadata||{},n=kn(t.thresholdOwnerAddress);if(n)return In(n);let r=kn(t.accountAddress);if(r)return Ln(r);let i=f(e.chainTarget);throw Error(`[SigningEngine] unable to resolve managed nonce wallet signer for ${e.walletId} (${i})`)}async function Bn(e){return Rn(e.senderIdentity)}async function Vn(e){let t=await Bn({senderIdentity:e.senderIdentity});return Ve({chain:`evm`,networkKey:Nn({configs:e.deps.seamsWebConfigs,request:e.request}),chainId:e.request.tx.chainId,sender:t,walletId:e.walletId})}async function Hn(e){let t=e.reservationInput,n;try{n=le(await e.deps.nonceCoordinator.reserve({lane:A(t),operation:e.operation}))}catch(e){throw H({error:e,chain:`evm`,networkKey:t.chainTarget.networkSlug,chainId:t.chainTarget.chainId})}return{request:{...e.request,tx:{...e.request.tx,nonce:n.nonce}},reservation:n}}let Un=null,Wn=null,Gn=null,Kn=null;async function qn(){return Un||=import(`./secp256k1-DSLttQND.js`).then(e=>e.Secp256k1Engine),await Un}async function Jn(){return Wn||=import(`./webauthnP256-BEz4DEAs.js`).then(e=>e.WebAuthnP256Engine),await Wn}async function Yn(){return Gn||=import(`./signEvmWithUiConfirm-CqxL7UbT.js`).then(e=>e.signEvmWithUiConfirm),await Gn}async function Xn(){return Kn||=import(`./signEvmFamilyWithUiConfirmForTempo-Dc57bJ3V.js`).then(e=>e.signEvmFamilyWithUiConfirmForTempo),await Kn}async function Zn(e){let t=await Bn({senderIdentity:e.senderIdentity}),n=Ve({chain:`tempo`,networkKey:Nn({configs:e.deps.seamsWebConfigs,request:e.request}),chainId:e.request.tx.chainId,sender:t,nonceKey:e.request.tx.nonceKey,walletId:e.walletId}),r;try{r=le(await e.deps.nonceCoordinator.reserve({lane:A(n),operation:e.operation}))}catch(e){throw H({error:e,chain:`tempo`,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId})}return{request:{...e.request,tx:{...e.request.tx,nonce:r.nonce}},reservation:r}}function Qn(e){if(e.state.kind!==`not_required`)return In(e.state.thresholdOwnerAddress)}function $n(e){if(e.state.kind===`not_required`)throw Error(`[SigningEngine][evm-family] raw EIP-1559 signing requires prepared threshold ECDSA owner address for ${e.walletId}`);return In(e.state.thresholdOwnerAddress)}function er(e){return zn({deps:e.deps,walletId:e.walletId,chainTarget:e.chainTarget})}async function tr(e,t){let n=e.deps.nonceCoordinator.recoverDurableLeases({walletId:e.walletId});n.catch(()=>{});let r=await t.loadSigner();try{return await r({...e.flowArgs,authorization:e.flowArgs.authorization??{kind:`owner`},request:e.request,onConfirmationDisplayed:e.onConfirmationDisplayed,thresholdEcdsaStepUp:e.thresholdEcdsaStepUp,prepareRequestWithManagedNonce:async()=>(await n,await t.prepareRequestWithManagedNonce({deps:e.deps,walletId:e.walletId,request:e.request,nonceOperation:e.nonceOperation})),releaseNonceReservation:async t=>{await xn(e.deps,t)}})}catch(n){let r=await e.retryWithFreshEmailOtpAuth(n);if(r)return r;throw H({error:n,chain:t.targetKind,networkKey:Pn({configs:e.deps.seamsWebConfigs,request:e.request}),chainId:e.chainTarget.chainId})}}async function nr(e){if(e.chainTarget.kind===`evm`||e.request.kind===`eip1559`){let t=null,n=null,r=e.request.kind===`eip1559`?$n({state:e.thresholdEcdsaState,walletId:e.walletId}):void 0,i=Qn({state:e.thresholdEcdsaState}),a=t=>{let a=r||i;return a?Promise.resolve(a):(n||=er({deps:t.deps,walletId:t.walletId,chainTarget:e.chainTarget}),n)},o=e=>(t||=a(e).then(t=>Vn({deps:e.deps,walletId:e.walletId,request:e.request,senderIdentity:t})),t),s=e.chainTarget.kind;return await tr({...e,request:e.request},{targetKind:s,loadSigner:s===`tempo`?Xn:Yn,prepareRequestWithManagedNonce:async e=>{let t=await o(e);return await Hn({deps:e.deps,request:e.request,reservationInput:t,operation:e.nonceOperation})}})}let t=null,n=Qn({state:e.thresholdEcdsaState}),r=r=>n?Promise.resolve(n):(t||=er({deps:r.deps,walletId:r.walletId,chainTarget:e.chainTarget}),t);return await tr({...e,request:e.request},{targetKind:`tempo`,loadSigner:Xn,prepareRequestWithManagedNonce:async e=>{let t=await r(e);return await Zn({deps:e.deps,walletId:e.walletId,request:e.request,operation:e.nonceOperation,senderIdentity:t})}})}async function rr(e){return je({purpose:`transaction_signing`,source:ke(e.persistedMaterial),workerCtx:e.workerCtx})}function ir(e){let t=String(e.walletId||``).trim();if(!t)throw Error(`[multichain] Missing wallet id for ready secp256k1 signing material`);let n=e.signerSession;if(t!==String(n.walletId))throw Error(`[multichain] ready secp256k1 material wallet identity mismatch`);let r=Math.floor(Number(e.expiresAtMs));if(!Number.isSafeInteger(r)||r<=Date.now())throw Error(`[multichain] ready secp256k1 authorization expiry is invalid`);let i={kind:`ready_secp256k1_signing_material`,walletId:t,signerSession:n,expiresAtMs:r,singleUseEmailOtpSession:e.singleUseEmailOtpSession};switch(e.authorization.kind){case`reusable_wallet_session`:if(e.credential.kind!==`reusable_wallet_session`)throw Error(`[multichain] exact Wallet Session authorization requires its operation credential`);return{...i,authorization:e.authorization,credential:e.credential};case`operation_step_up`:if(!e.operationStepUpPreparation)throw Error(`[multichain] operation step-up preparation is required`);return{...i,authorization:e.authorization,credential:e.credential,operationStepUpPreparation:e.operationStepUpPreparation}}}async function ar(e){let n=e.capability,r=n.manifest,i=n.material,a=e.runtime,o=i.publicFacts;if(!t(e.materialActivation,r.activation.materialActivation))return{kind:`unavailable`,reason:`material_activation_mismatch`};if(!t(a.materialActivation,r.activation.materialActivation))return{kind:`unavailable`,reason:`runtime_correlation_mismatch`};let s=r.signer.scope.targetMemberships.some(e=>u(e,o.chainTarget)),c=r.signer.scope.targetMemberships.find(t=>u(t,e.chainTarget));if(!s||!c||!u(a.chainTarget,c))return{kind:`unavailable`,reason:`chain_mismatch`};let l=w({publicFacts:o,chainTarget:c});if(!a.runtimePolicyScope)return{kind:`unavailable`,reason:`runtime_policy_scope_missing`};let d=await rr({persistedMaterial:i,workerCtx:e.workerCtx}),f;switch(d.kind){case`rehydrated`:f=d;break;case`device_link_required`:return{kind:`unavailable`,reason:`device_link_required`};case`corrupt`:return{kind:`unavailable`,reason:`material_corrupt`};default:return d}let p=a.normalSigning,m=Ye({routerAbState:p});return{kind:`ready`,material:te({walletId:r.signer.walletId,materialActivation:r.activation.materialActivation,publicFacts:r.signer.registeredPublicFacts,transport:{kind:`threshold_ecdsa_signer_transport`,relayerUrl:a.relayerUrl,relayerKeyId:r.durableMaterial.roleLocalBinding.relayerKeyId,signingMaterial:m,relayerVerifyingShareB64u:l.relayerPublicKey33B64u},clientShare:{kind:`role_local_worker_share`,handle:f.liveHandle,material:{kind:`worker_loaded`,materialRef:f.materialRef}},routerAbEcdsaDerivationNormalSigning:{kind:`router_ab_ecdsa_derivation_normal_signing_hydrated_v1`,state:p,activeStateId:S(p)}})}}function or(e){let n=pt({capability:e.capability,authorization:e.authorization,nowMs:e.nowMs}),r=n.authorization.session,i=n.authorization.operationCredential;if(r.walletId!==e.material.walletId||!t(e.material.materialActivation,e.capability.manifest.activation.materialActivation))throw Error(`Exact Wallet Session authorization wallet does not match hydrated material`);if(i.token.trim().length===0)throw Error(`Exact Wallet Session authorization is unavailable`);return ir({walletId:e.material.walletId,signerSession:e.material,authorization:{kind:`reusable_wallet_session`,wallet_session_id:i.walletSessionId},credential:{kind:`reusable_wallet_session`,walletSessionToken:i.token,home:i.home,ownershipGeneration:i.ownershipGeneration},expiresAtMs:r.expiresAtMs,singleUseEmailOtpSession:!1})}function sr(e){return e.session.capabilitySubjects.some(n=>n.kind===`sign`&&n.keyFamily===`ecdsa_secp256k1`&&t(n.materialActivation,e.materialActivation))}function cr(e){let n=e.authorityRuntime,r=n.holderRuntime,i=n.session,a=n.operationCredential,o=r.activationReceipt.normalSigning,s=o.scope;if(i.walletId!==r.walletId||i.authorityId!==r.authorityId||i.authMethodId!==r.walletAuthMethodId||a.walletSessionId!==n.walletSessionId||i.expiresAtMs<=Date.now()||!sr({session:i,materialActivation:r.materialActivation})||s.wallet_id!==r.walletId||s.ecdsa_threshold_key_id!==r.ecdsaThresholdKeyId||!t(v(s.material_activation),r.materialActivation))throw Error(`[SigningEngine] active Wallet Authority session does not bind the ECDSA holder runtime`);let l=String(e.relayerUrl||``).trim();if(!l)throw Error(`[SigningEngine] active Wallet Authority ECDSA signing requires relayerUrl`);let u=te({walletId:c(r.walletId),materialActivation:r.materialActivation,publicFacts:n.publicFacts,transport:{kind:`threshold_ecdsa_signer_transport`,relayerUrl:l,relayerKeyId:n.relayerKeyId,signingMaterial:Ye({routerAbState:o}),relayerVerifyingShareB64u:s.public_identity.server_public_key33_b64u},clientShare:{kind:`linked_holder_worker_share`,holderHandleId:r.holderHandleId},routerAbEcdsaDerivationNormalSigning:{kind:`router_ab_ecdsa_derivation_normal_signing_hydrated_v1`,state:o,activeStateId:S(o)}});return ir({walletId:r.walletId,signerSession:u,authorization:{kind:`reusable_wallet_session`,wallet_session_id:a.walletSessionId},credential:{kind:`reusable_wallet_session`,walletSessionToken:a.token,home:a.home,ownershipGeneration:a.ownershipGeneration},expiresAtMs:i.expiresAtMs,singleUseEmailOtpSession:!1})}function X(e){return{kind:`blocked`,reason:e}}function lr(e){switch(e){case`email_otp`:return`email_otp`;case`login`:case`registration`:case`manual-bootstrap`:return`passkey`;default:throw Error(`[SigningEngine] unsupported sealed ECDSA source`)}}function Z(e){return String(e??``).trim()}function ur(e){let n=e.record.ecdsaRestore,r=e.manifest.durableMaterial;return Z(e.record.walletId)!==String(e.walletId)||!u(n.chainTarget,e.chainTarget)||!t(n.roleLocalMaterialRef.materialActivation,r.materialActivation)||!t(r.materialActivation,e.manifest.activation.materialActivation)?!1:Z(n.roleLocalMaterialRef.durableMaterialRef)===Z(r.durableMaterialRef)}function dr(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function fr(e,t){return e.kind===t.kind&&String(e.walletId)===String(t.walletId)&&String(e.authorityDigest)===String(t.authorityDigest)}function pr(e){return e.manifest.signer.scope.targetMemberships.some(t=>u(t,e.chainTarget))}function mr(e){let t=e.record.ecdsaRestore,n=e.manifest.durableMaterial,r=n.roleLocalBinding,i=n.roleLocalPublicFacts,a=t.routerAbEcdsaDerivationNormalSigning.scope,o=lr(t.source),s=Z(t.ecdsaThresholdKeyId)||Z(a.ecdsa_threshold_key_id),c=`recordKind`in e.record?Z(r.clientVerifyingPublicKey33B64u):Z(t.clientVerifyingShareB64u)||Z(a.public_identity.derivation_client_share_public_key33_b64u),l=Z(t.thresholdEcdsaPublicKeyB64u)||Z(a.public_identity.threshold_public_key33_b64u);return String(e.manifest.signer.walletId)===String(e.walletId)&&String(i.walletId)===String(e.walletId)&&pr(e)&&e.record.authMethod===o&&fr(t.authority,e.manifest.signer.authority)&&Z(t.roleLocalMaterialRef.bindingDigest)===Z(n.bindingDigest)&&Z(t.keyHandle)===Z(r.keyHandle)&&Z(t.keyHandle)===Z(i.keyHandle)&&s===Z(r.ecdsaThresholdKeyId)&&s===Z(i.ecdsaThresholdKeyId)&&c===Z(r.clientVerifyingPublicKey33B64u)&&c===Z(i.derivationClientSharePublicKey33B64u)&&l===Z(i.groupPublicKey33B64u)&&Z(t.relayerKeyId)===Z(r.relayerKeyId)&&dr(t.participantIds,r.participantIds)&&dr(t.participantIds,i.participantIds)&&Z(t.signingRootId)===Z(e.manifest.signer.signingRootId)&&Z(t.signingRootId)===Z(i.signingRootId)&&Z(t.signingRootVersion)===Z(e.manifest.signer.signingRootVersion)&&Z(t.signingRootVersion)===Z(i.signingRootVersion)&&Z(t.ethereumAddress).toLowerCase()===Z(i.ethereumAddress).toLowerCase()&&D(t.publicCapability,i.publicCapability)&&b(a,{wallet_id:String(e.walletId),ecdsa_threshold_key_id:String(i.ecdsaThresholdKeyId),signing_root_id:String(i.signingRootId),signing_root_version:String(i.signingRootVersion),context:i.publicCapability.context,public_identity:i.publicCapability.public_identity,signing_worker:i.publicCapability.signer_set.selected_server,activation_epoch:i.publicCapability.activation_epoch,material_activation:ee(n.materialActivation)})}function hr(e){let t=e.restore;if(t.source===`email_otp`){let n=Z(t.providerSubjectId),r=Z(t.emailHashHex),i=t.emailOtpAuthority,a=e.manifest.signer.authority;return!n||!r||!i||String(i.walletId)!==String(a.walletId)||String(i.factor.providerUserId)!==n||String(i.verifier.emailHashHex)!==r?null:{kind:`email_otp`,providerSubjectId:n,emailHashHex:r,emailOtpAuthority:{walletId:i.walletId,factor:i.factor,verifier:i.verifier,bindingId:a.walletAuthMethodId}}}let n=Z(t.rpId),r=Z(t.credentialIdB64u);return n&&r?{kind:`passkey`,rpId:n,credentialIdB64u:r}:null}function gr(e){if(e.length!==2)return null;let t=e[0],n=e[1];return!Number.isSafeInteger(t)||!Number.isSafeInteger(n)||t<=0||n<=0||t===n?null:[t,n]}function _r(e){let t=e.record.ecdsaRestore,n=hr({manifest:e.manifest,restore:t}),r=Z(e.record.relayerUrl).replace(/\/+$/g,``),a=Z(t.relayerKeyId),o=e.manifest.durableMaterial.roleLocalBinding.clientVerifyingPublicKey33B64u,s=Z(t.ecdsaThresholdKeyId)||Z(t.routerAbEcdsaDerivationNormalSigning.scope.ecdsa_threshold_key_id),c=Z(t.thresholdEcdsaPublicKeyB64u)||Z(t.routerAbEcdsaDerivationNormalSigning.scope.public_identity.threshold_public_key33_b64u),l=Z(t.keyHandle),u=Array.isArray(t.participantIds)?gr(t.participantIds):null,d;try{d=T(t.roleLocalMaterialRef)}catch{return null}let f=null;try{f=i(t.runtimePolicyScope)}catch{f=null}return!n||!r||!a||!o||!s||!c||!l||!u?null:{walletId:e.walletId,chainTarget:e.chainTarget,materialActivation:t.roleLocalMaterialRef.materialActivation,normalSigning:t.routerAbEcdsaDerivationNormalSigning,relayerUrl:r,relayerKeyId:a,clientVerifyingPublicKey33B64u:o,participantIds:u,ecdsaThresholdKeyId:s,thresholdEcdsaPublicKeyB64u:c,keyHandle:l,runtimePolicyScope:f,roleLocalMaterialRef:d,authBinding:n}}function vr(e){let t=_r(e),n=Number(e.record.expiresAtMs),r=Number(e.record.remainingUses),i=Z(e.record.thresholdSessionIds.ecdsa),a=Z(e.record.storeKey);return!t||!a||!i||!Number.isSafeInteger(n)||n<=0||!Number.isSafeInteger(r)||r<0?null:{...t,kind:`exact_ecdsa_sealed_runtime_v1`,expiresAtMs:n,remainingUses:r,sealedRecord:{storeKey:a,thresholdSessionId:i,authMethod:e.record.authMethod}}}function yr(e){let t=e.sealedRecords.filter(t=>ur({manifest:e.manifest,walletId:e.walletId,chainTarget:e.chainTarget,record:t}));if(t.length===0)return X(`missing_material`);if(t.length>1)return X(`exact_record_conflict`);let n=vr({manifest:e.manifest,walletId:e.walletId,chainTarget:e.chainTarget,record:t[0]});return n?mr({manifest:e.manifest,walletId:e.walletId,chainTarget:e.chainTarget,record:t[0]})?{kind:`resolved`,runtime:n}:X(`binding_mismatch`):X(`corrupt`)}function br(e){return e.manifest.signer.scope.targetMemberships.some(t=>u(t,e.chainTarget))}async function xr(e){return(await e.ports.listActiveEcdsaCapabilityManifestsForWallet(e.walletId)).filter(t=>br({manifest:t,chainTarget:e.chainTarget}))}async function Sr(e){let t=[],n=e.authMethod?[e.authMethod]:[`passkey`,`email_otp`];for(let r of n){let n=await e.ports.listExactSealedSessionsForWallet({walletId:String(e.walletId),filter:{authMethod:r,curve:`ecdsa`,chainTarget:e.chainTarget}}).catch(()=>[]);for(let e of n)e.curve===`ecdsa`&&t.push(e)}return t}async function Cr(e){if(!br({manifest:e.manifest,chainTarget:e.chainTarget}))return{kind:`blocked`,reason:`chain_mismatch`};let t=e.manifest.durableMaterial,n=t.roleLocalPublicFacts,r=wr(n.participantIds),i=String(e.relayerUrl).trim().replace(/\/+$/g,``);return!r||!i?{kind:`blocked`,reason:`corrupt`}:{kind:`resolved`,manifest:e.manifest,runtime:{kind:`exact_ecdsa_capability_runtime_v1`,walletId:e.manifest.signer.walletId,chainTarget:e.chainTarget,materialActivation:t.materialActivation,normalSigning:t.routerAbEcdsaDerivationNormalSigning,relayerUrl:i,relayerKeyId:String(t.roleLocalBinding.relayerKeyId),clientVerifyingPublicKey33B64u:t.roleLocalBinding.clientVerifyingPublicKey33B64u,participantIds:r,ecdsaThresholdKeyId:String(n.ecdsaThresholdKeyId),thresholdEcdsaPublicKeyB64u:n.groupPublicKey33B64u,keyHandle:String(n.keyHandle),runtimePolicyScope:t.runtimePolicyScope,roleLocalMaterialRef:{kind:`ecdsa_role_local_persisted_material_ref_v1`,durableMaterialRef:t.durableMaterialRef,bindingDigest:t.bindingDigest,materialActivation:t.materialActivation}}}}function wr(e){if(e.length!==2)return null;let t=e[0],n=e[1];return!Number.isSafeInteger(t)||!Number.isSafeInteger(n)||t<=0||n<=0||t===n?null:[t,n]}async function Tr(e,t,n){let r=await e.resolveSelectedWalletAuthority(String(t));if(r.kind!==`resolved`)return n;let i=String(r.authMethod.walletAuthMethodId),a=n.filter(e=>String(e.signer.authority.walletAuthMethodId)===i);return a.length>0?a:n}async function Er(e,t){let n=await xr({ports:e,...t});if(n.length===0)return{kind:`blocked`,reason:`missing_capability`};let r=n.length>1?await Tr(e,t.walletId,n):n;if(r.length!==1)return{kind:`blocked`,reason:`exact_record_conflict`};let i=r[0],a=await Sr({ports:e,...t}),o=yr({manifest:i,walletId:t.walletId,chainTarget:t.chainTarget,sealedRecords:a});return o.kind===`resolved`?{kind:`resolved`,manifest:i,runtime:o.runtime}:{kind:`blocked`,reason:o.reason}}function Dr(e){return Er.bind(null,e)}async function Or(e,t){let n=await e.listActiveEcdsaCapabilityManifestsForWallet(t.walletId),r=[];for(let e of n)for(let n of e.signer.scope.targetMemberships)n.kind===t.chain&&r.push({manifest:e,chainTarget:n});if(r.length===0)return{kind:`blocked`,reason:`missing_capability`};if(r.length>1)return{kind:`blocked`,reason:`exact_record_conflict`};let i=r[0],a=await Sr({ports:e,walletId:t.walletId,chainTarget:i.chainTarget}),o=yr({manifest:i.manifest,walletId:t.walletId,chainTarget:i.chainTarget,sealedRecords:a});return o.kind===`resolved`?{kind:`resolved`,manifest:i.manifest,runtime:o.runtime}:{kind:`blocked`,reason:o.reason}}function kr(e){return Or.bind(null,e)}async function Ar(e){let t=e.material,n=t.publicFacts.participantIds;if(n.length!==2)throw Error(`[chains] ECDSA operation step-up requires exactly two participants`);let r=String(e.operation.intent.operationId||``).trim(),i=Math.min(Date.now()+5*6e4,e.sessionExpiresAtMs);return await Me({walletId:t.walletId,operationKind:`evm.sign_transaction`,operationId:r,operationDigests:e.operationDigests,materialActivation:t.materialActivation,normalSigningScope:t.routerAbEcdsaDerivationNormalSigning.state.scope,keyHandle:t.publicFacts.keyHandle,relayerKeyId:t.transport.relayerKeyId,participantIds:[Number(n[0]),Number(n[1])],expiresAtMs:i})}async function jr(e){let t=Mr({authority:e.authority,authorization:e.authorization}),n=await Ae({relayerUrl:e.relayerUrl,transport:{kind:`wallet_session`,credential:e.operationCredential},request:{kind:`router_ab_ecdsa_operation_step_up_v1`,operation:e.prepared.operation,proof:t}}),r={kind:`operation_step_up`,walletSessionToken:e.operationCredential.token,home:e.operationCredential.home,ownershipGeneration:e.operationCredential.ownershipGeneration};return ir({walletId:e.material.walletId,signerSession:e.material,authorization:{kind:`operation_step_up`},credential:r,expiresAtMs:n.expires_at_ms,singleUseEmailOtpSession:!1,operationStepUpPreparation:e.prepared.operation})}function Mr(e){switch(e.authorization.kind){case`passkey`:{if(!m(e.authority))throw Error(`[chains] passkey step-up requires the exact passkey authority`);let t=e.authorization.credential;return{kind:`passkey`,authority:e.authority,webauthn_authentication:{id:t.id,rawId:t.rawId,type:t.type,authenticatorAttachment:t.authenticatorAttachment??null,response:{clientDataJSON:t.response.clientDataJSON,authenticatorData:t.response.authenticatorData,signature:t.response.signature,userHandle:t.response.userHandle??null},clientExtensionResults:t.clientExtensionResults??null}}}case`email_otp`:if(!h(e.authority))throw Error(`[chains] Email OTP step-up requires the exact Email OTP authority`);return{kind:`email_otp`,authority:e.authority,challenge_id:e.authorization.challengeId,otp_code:e.authorization.otpCode}}}function Nr(e){return{kind:`active_wallet_authority`,method:e.auth.kind,accountId:String(e.walletId),intent:`transaction_sign`,curve:`ecdsa`,walletSessionId:e.operationCredential.walletSessionId,authorityId:e.authorityId,authMethodId:e.walletAuthMethodId,expiresAtMs:e.session.expiresAtMs}}function Pr(e){switch(e.factor.kind){case`passkey`:return`passkey`;case`email_otp`:return`email_otp`;default:throw e.factor,Error(`[SigningEngine] unsupported wallet authorization factor`)}}function Fr(e){let n=e.capability.manifest;return n.signer.walletId===e.scope.walletId&&t(n.activation.materialActivation,e.scope.materialActivation)&&n.signer.scope.targetMemberships.some(t=>u(t,e.scope.chainTarget))}function Ir(e){let n=e.capability.manifest.activation.materialActivation;return e.session.capabilitySubjects.filter(e=>e.kind===`sign`&&e.keyFamily===`ecdsa_secp256k1`&&t(e.materialActivation,n)).length===1}async function Lr(e){if(!Fr(e))throw Error(`[SigningEngine] exact ECDSA Wallet Session material changed`);let n=e.ports,r=await n.resolveSelectedWalletAuthority(String(e.scope.walletId)),i=zr(r,e.scope.walletId);if(i||r.kind!==`resolved`)throw Rr(i??`selected_authority_invalid`);let a=await _({authority:e.capability.authority}),o=e.capability.manifest.signer.authority,s=r.authority.signerActivations.ecdsa;if(a.walletId!==o.walletId||a.walletAuthMethodId!==o.walletAuthMethodId||a.authorityDigest!==o.authorityDigest||o.walletId!==r.authority.walletId||o.walletAuthMethodId!==r.authMethod.walletAuthMethodId||!s||!t(s.materialActivation,e.scope.materialActivation))throw Error(`[SigningEngine] exact ECDSA Wallet Session material changed`);let c=await n.readExactWithOperationCredential({walletId:e.scope.walletId,authorityId:r.authority.authorityId,authMethodId:r.authMethod.walletAuthMethodId});if(c.kind!==`found`)throw Rr(c.kind===`missing`?`wallet_session_missing`:`wallet_session_upgrade_required`);let l=c.record,u=Br({session:l,operationCredential:c.operationCredential,walletId:e.scope.walletId,authority:r.authority,authMethod:r.authMethod,capability:e.capability});if(u)throw Rr(u);return{credential:c.operationCredential,expiresAtMs:l.expiresAtMs}}function Rr(e){return Error(`[SigningEngine] exact ECDSA Wallet Session is unavailable: ${e}`)}function zr(e,t){return e.kind===`resolved`?e.selection.walletId!==t||e.authMethod.walletId!==t||e.authority.walletId!==t||e.selection.walletAuthMethodId!==e.authMethod.walletAuthMethodId||e.authMethod.walletAuthorityId!==e.authority.authorityId?`authority_identity_mismatch`:e.selection.lockState===`unlocked`?e.authMethod.status===`active`?e.authority.state===`active`?null:`authority_inactive`:`auth_method_inactive`:`wallet_locked`:e.kind===`missing_selection`?`selected_authority_missing`:`selected_authority_invalid`}function Br(e){let{session:t}=e;return t.walletId!==e.walletId||t.authorityId!==e.authority.authorityId||t.authMethodId!==e.authMethod.walletAuthMethodId?`wallet_session_identity_mismatch (authority or method)`:t.authorityDigestB64u===e.authority.authorityDigestB64u?t.authorityRevocationEpoch===e.authority.revocationEpoch?e.operationCredential.token.trim()?t.expiresAtMs<=Date.now()?`wallet_session_expired`:Ir({session:t,capability:e.capability})?null:`wallet_session_capability_mismatch`:`wallet_session_identity_mismatch (operation credential)`:`wallet_session_identity_mismatch (authority revocation epoch)`:`wallet_session_identity_mismatch (authority digest)`}async function Vr(e,t){let n=await Lr(e);return await Ar({operation:t.operation,operationDigests:t.operationDigests,material:t.material,sessionExpiresAtMs:n.expiresAtMs})}async function Hr(e,t){return await e.deps.withThresholdEcdsaSigningQueue({queueKey:Fe({materialActivation:e.materialActivation}),walletId:e.walletId,enabled:!0,...e.shouldAbort?{shouldAbort:e.shouldAbort}:{},task:t})}function Ur(e){let t=String(e.seamsWebConfigs.network.relayer?.url||``).trim();if(!t)throw Error(`[SigningEngine] EVM-family signing requires relayerUrl`);return t}async function Wr(e){let t=await Ne({ports:e.deps.activeWalletAuthorityEcdsaRuntimeReadPorts,input:{walletId:e.signer.walletId,chainTarget:e.signer.chainTarget,requiredCapability:`sign`,materialActivation:e.signer.materialActivation,nowMs:Date.now()}});if(t.kind!==`resolved`)throw Error(`[SigningEngine] active Wallet Authority ECDSA runtime is ${t.reason}`);let n=t.runtime;if(n.authorityId!==e.prepared.authorityId||n.walletAuthMethodId!==e.prepared.walletAuthMethodId||n.authorityDigestB64u!==e.prepared.authorityDigestB64u||n.authorityRevocationEpoch!==e.prepared.authorityRevocationEpoch||n.walletSessionId!==e.prepared.walletSessionId||n.publicFacts.keyHandle!==e.signer.keyHandle)throw Error(`[SigningEngine] active Wallet Authority ECDSA runtime was replaced`);return n}function Gr(e){return t(e.currentMaterialActivation,e.preparedMaterialActivation)?null:{kind:`superseded`,supersessionKind:`material_activation_replaced`,preparedMaterialActivation:e.preparedMaterialActivation,currentMaterialActivation:e.currentMaterialActivation}}function Kr(e){let t=e.preparedCapability.manifest,n=t.activation.materialActivation,r=e.currentManifest.activation.materialActivation,i=Gr({preparedMaterialActivation:n,currentMaterialActivation:r});if(i)return i;let a=t.signer,o=e.currentManifest.signer;return String(t.identity.manifestId)===String(e.currentManifest.identity.manifestId)&&Number(t.identity.manifestRevision)===Number(e.currentManifest.identity.manifestRevision)&&String(a.capability)===String(o.capability)&&String(a.authority.walletId)===String(o.authority.walletId)&&String(a.authority.authorityDigest)===String(o.authority.authorityDigest)?null:{kind:`superseded`,supersessionKind:`capability_authority_replaced`,preparedMaterialActivation:n,currentMaterialActivation:r}}function qr(e){let n=e.preparedAuthorization,r=e.currentAuthorization;return r&&n.selectedAuthority.authorityId===r.selectedAuthority.authorityId&&n.selectedAuthMethod.kind===r.selectedAuthMethod.kind&&n.selectedAuthMethod.walletAuthMethodId===r.selectedAuthMethod.walletAuthMethodId&&n.session.walletId===r.session.walletId&&n.session.authorityId===r.session.authorityId&&n.session.authMethodId===r.session.authMethodId&&n.session.authorizationId===r.session.authorizationId&&n.session.quotaId===r.session.quotaId&&(n.session.authorityDigestB64u===r.session.authorityDigestB64u||p(n.selectedAuthority,r.selectedAuthority)&&o(n.session,r.session))&&n.session.issuedAtMs===r.session.issuedAtMs&&n.session.expiresAtMs===r.session.expiresAtMs&&n.session.authorityRevocationEpoch===r.session.authorityRevocationEpoch&&n.operationCredential.walletSessionId===r.operationCredential.walletSessionId&&n.operationCredential.token===r.operationCredential.token&&ct(n.runtime,r.runtime)&&t(r.runtime.materialActivation,e.materialActivation)?null:{kind:`superseded`,supersessionKind:`reusable_authorization_replaced`,preparedMaterialActivation:e.materialActivation,currentMaterialActivation:e.materialActivation}}async function Jr(e){let t=await Cr({manifest:e.capability.manifest,chainTarget:e.chainTarget,relayerUrl:e.relayerUrl});if(t.kind!==`resolved`)return{kind:`failed`,failure:{kind:`unavailable`,reason:`runtime_correlation_mismatch`}};let n=Kr({preparedCapability:e.capability,currentManifest:t.manifest});if(n)return{kind:`superseded`,replacement:n};let r=await ar({capability:e.capability,runtime:t.runtime,chainTarget:e.chainTarget,materialActivation:e.materialActivation,workerCtx:e.workerCtx});return r.kind===`unavailable`?{kind:`failed`,failure:r}:e.candidateAuthorization?{kind:`ready`,value:{kind:`material_from_canonical_capability`,material:or({material:r.material,capability:e.capability,authorization:e.candidateAuthorization,nowMs:Date.now()})}}:{kind:`authorization_required`,requirement:{kind:`material_for_step_up`,material:r.material}}}async function Yr(e,t){let n=await e.resolve(e.scope,_e.fromPrepare({relayerUrl:e.relayerUrl,operationCredential:e.prepared.operationCredential},t));if(qr({preparedAuthorization:e.prepared,currentAuthorization:n,materialActivation:e.scope.materialActivation}))throw Error(`Wallet Session authority changed before client signing`)}async function Xr(e,t){let n=await Wr(e);if(t.walletSessionId!==n.operationCredential.walletSessionId||t.quotaId!==n.session.quotaId||t.quotaLifecycle!==`active`||t.remainingUses<=0||t.expiresAtMs<=Date.now()||t.expiresAtMs!==n.session.expiresAtMs||!s(t.authorization,n.session))throw Error(`Linked Wallet Session authority changed before client signing`)}async function Zr(){throw Error(`Operation step-up cannot reconcile a reusable Wallet Session`)}async function Qr(e){let[t,n]=await Promise.all([qn(),Jn()]),r=e.deps.getSignerWorkerContext(),i=e.deps.touchConfirm.getContext(),a=c(e.walletSession.walletId),o=Ur(e.deps),s=e.senderSignatureAlgorithm===`secp256k1`?M(e.preparedSession.kind===`authorized`?e.preparedSession.signingLane.identity:e.preparedSession.identity,`ECDSA signing material hydration`):void 0;if(e.activeWalletAuthority&&!s)throw Error(`[SigningEngine] active Wallet Authority runtime requires a threshold ECDSA signer`);let l=s&&!e.activeWalletAuthority?await e.deps.resolveCanonicalEcdsaSigningCapability({walletId:s.walletId,chainTarget:s.chainTarget,materialActivation:s.materialActivation}):void 0,u=e.preparedSession?.kind===`authorized`?e.preparedSession.selection.lane.authorization:null,d=l&&u&&u.runtime.remainingUses>0&&R({capability:l,authorization:u,nowMs:Date.now()})?u:null,f=s&&l&&!e.activeWalletAuthority?{walletId:s.walletId,chainTarget:s.chainTarget,materialActivation:s.materialActivation}:void 0,p=!e.activeWalletAuthority&&l&&f?{...e.emailOtpSigningForFlow?{emailOtpSigning:e.emailOtpSigningForFlow}:{},reusableAuthorization:d?{kind:`active`}:{kind:`absent`,requiredFactor:Pr(l.authority)},operationStepUp:{prepare:Vr.bind(void 0,{ports:e.deps.activeWalletAuthorityEcdsaRuntimeReadPorts,scope:f,capability:l}),authorize:async({authorization:t,prepared:n,material:r})=>{e.onAuthSideEffectStarted?.(t.kind===`passkey`?`passkey_reauth`:`email_otp_challenge`);let i=await Lr({ports:e.deps.activeWalletAuthorityEcdsaRuntimeReadPorts,scope:f,capability:l});return await jr({relayerUrl:o,authority:l.authority,authorization:t,prepared:n,material:r,operationCredential:i.credential})}},...e.onAuthSideEffectStarted?{onAuthSideEffectStarted:e.onAuthSideEffectStarted}:{}}:void 0,m=Zr;e.activeWalletAuthority&&s?m=Xr.bind(null,{deps:e.deps,prepared:e.activeWalletAuthority.runtime,signer:s}):d&&f&&(m=Yr.bind(null,{resolve:e.deps.resolveActiveEcdsaWalletSessionAuthorization,scope:f,prepared:d,relayerUrl:o}));let h=new t({reconcileSession:m,beforeSigning:e.deps.beforeSigning,getRpId:()=>i.touchIdPrompt.getRpId(),workerCtx:r,shouldAbort:e.shouldAbort}),g=e.activeWalletAuthority,_=g&&s?{kind:`active_wallet_authority`,confirmationAuthPlan:g.confirmationAuthPlan,sign:async t=>{if(String(g.intent.operationId)!==t.operationId)throw Error(`[SigningEngine] active Wallet Authority signing operation identity changed`);return await Hr({deps:e.deps,walletId:s.walletId,materialActivation:s.materialActivation,...e.shouldAbort?{shouldAbort:e.shouldAbort}:{}},async()=>{let n=cr({authorityRuntime:await Wr({deps:e.deps,prepared:g.runtime,signer:s}),chainTarget:s.chainTarget,relayerUrl:o});return await h.signReady({kind:`digest`,algorithm:`secp256k1`,digest32:t.signingDigest32},n,{intent:g.intent,authPlan:g.confirmationAuthPlan},t.operationDigests)})}}:void 0;return{flowArgs:{ctx:i,touchConfirm:e.deps.touchConfirm,workerCtx:r,walletId:a,onEvent:e.onEvent,engines:{secp256k1:h,webauthnP256:new n(r,e.deps.beforeSigning)},...s&&l?{runEcdsaMaterialUse:Hr.bind(null,{deps:e.deps,walletId:s.walletId,materialActivation:s.materialActivation,...e.shouldAbort?{shouldAbort:e.shouldAbort}:{}}),resolveEcdsaSigningMaterialPlan:async()=>await Jr({capability:l,candidateAuthorization:d,walletId:s.walletId,chainTarget:s.chainTarget,materialActivation:s.materialActivation,relayerUrl:o,workerCtx:r})}:{},..._?{authorization:_}:{},...e.signingSessionPlan?{signingSessionPlan:e.signingSessionPlan}:{},...e.signingOperation?{signingOperation:e.signingOperation}:{},onSigningOperationTransition:e.onSigningOperationTransition||Pt,...p?{thresholdEcdsaStepUpRuntime:p}:{},confirmationConfigOverride:e.confirmationConfigOverride}}}function $r(e){return e instanceof De?e.authorizationDecision:void 0}async function ei(e){switch(e.decision.retryMode){case`await_admission_owner_completion`:return await e.signingSessionCoordinator.runWalletSessionQuotaAdmissionRetry({queueKey:e.queueKey,refresh:e.rereadAuthoritativeReadiness,retryAfterRefresh:e.rereadAuthoritativeReadiness});case`email_otp_single_operation_step_up`:case`fresh_auth`:return await e.signingSessionCoordinator.runWalletSessionQuotaAdmissionRetry({queueKey:e.queueKey,refresh:e.performFreshAuth,retryAfterRefresh:e.rereadAuthoritativeReadiness});default:return ti(e.decision)}}function ti(e){throw Error(`[SigningEngine][ecdsa] unsupported fresh-auth retry mode: ${String(e)}`)}function ni(e){return{kind:`do_not_retry`,trigger:e.trigger,sideEffectState:e.sideEffectState,blockedReason:e.blockedReason}}function Q(e,t){return ni({trigger:e.trigger,sideEffectState:e.sideEffectState,blockedReason:t})}function ri(e){if(e.current===`threshold_reconnect_started`)return e.current;switch(e.sideEffect){case`auth_prompt_shown`:case`email_otp_challenge`:case`passkey_reauth`:return e.current===`no_auth_side_effect_started`?`auth_prompt_shown`:e.current;case`auth_confirmed`:return`auth_confirmed`;case`threshold_reconnect`:return`threshold_reconnect_started`}}function ii(e){if(e.alreadyRetryingFreshAuth)return Q(e,`already_retrying`);if(e.senderSignatureAlgorithm!==`secp256k1`)return Q(e,`non_secp256k1_sender`);let t=$r(e.error),n=Te(e.error),r=e.trigger===`wallet_signing_budget_exhausted`?t?.kind===`step_up_required`?we(n??{kind:`exhausted`,source:`server_prepare`,detail:`Server requires owner operation step-up`}):n?.kind===`in_flight`?we(n):null:null,i=r?.kind===`request_fresh_step_up`||r?.kind===`wait_and_retry_admission`;if(e.sideEffectState!==`no_auth_side_effect_started`&&!i)return Q(e,`auth_side_effect_started`);if(e.trigger===`wallet_session_reauthorization_required`){if(e.hasEmailOtpSigningPlan||e.hasStepUpAuthPlan)return Q(e,`signing_auth_plan_already_selected`);if(t?.kind!==`step_up_required`)return Q(e,`error_not_retryable`);if(e.accountAuth.primaryAuthMethod!==d.emailOtp&&e.accountAuth.primaryAuthMethod!==d.passkey)return Q(e,`unsupported_primary_auth`)}else{if(!r)return Q(e,`error_not_retryable`);if(e.hasStepUpAuthPlan&&r.kind!==`request_fresh_step_up`&&r.kind!==`wait_and_retry_admission`)return Q(e,`step_up_auth_plan_already_selected`);if(r.kind===`wait_and_retry_admission`)return e.admissionRetryState.kind===`authoritative_readiness_reread`?Q(e,`authoritative_readiness_still_in_flight`):{kind:`retry`,trigger:e.trigger,sideEffectState:e.sideEffectState,retryMode:`await_admission_owner_completion`,admissionDecision:r};if(e.activeSigningAuthMethod===d.emailOtp)return{kind:`retry`,trigger:e.trigger,sideEffectState:e.sideEffectState,retryMode:`email_otp_single_operation_step_up`,admissionDecision:r}}return{kind:`retry`,trigger:e.trigger,sideEffectState:e.sideEffectState,retryMode:`fresh_auth`}}function ai(e){return Oe(e.error)?.kind===`expired`?e.candidate.kind===`unavailable`?{kind:`expired_without_exact_lane`}:{kind:`authoritative_expiry`,state:Le({source:{kind:`ecdsa`,laneIdentity:e.candidate.identity,authorization:e.candidate.authorization},expiresAtMs:e.candidate.expiresAtMs,detectedAtMs:e.detectedAtMs})}:{kind:`not_expired`}}async function oi(e){switch(e.context.kind){case`not_expired`:case`expired_without_exact_lane`:return;case`authoritative_expiry`:if((await e.coordinator.invalidateExpiredWalletSession({state:e.context.state,source:re.serverRejection})).kind===`unavailable`)throw Error(`[SigningEngine][ecdsa] expired Wallet Session cleanup failed`);return;default:return si(e.context)}}function si(e){throw Error(`[SigningEngine][ecdsa] unsupported Wallet Session expiry context: ${String(e)}`)}async function ci(e){let t=ii({trigger:`wallet_session_reauthorization_required`,error:e.error,senderSignatureAlgorithm:e.senderSignatureAlgorithm,accountAuth:e.accountAuth,alreadyRetryingFreshAuth:e.alreadyRetryingFreshEmailOtpAuth,hasEmailOtpSigningPlan:e.hasEmailOtpSigningPlan,sideEffectState:e.sideEffectState});if(e.onDecision?.(t),t.kind!==`retry`)return null;await oi({context:e.expiryContext,coordinator:e.signingSessionCoordinator});let n=e.accountAuth.primaryAuthMethod===d.emailOtp;return K(e.onEvent,{phase:n?O.STEP_06_AUTH_EMAIL_OTP_CHALLENGE_STARTED:O.STEP_09_THRESHOLD_SESSION_RECONNECT_STARTED,status:`running`,walletId:e.walletId,message:n?`Signing session expired; requesting Email OTP reauthorization`:`Signing session expired; requesting passkey reauthorization`,interaction:{kind:`none`,overlay:`none`},data:{chain:e.chain,reason:`threshold_session_expired`}}),await e.retry()}function li(){let e=r(32,`EVM family signing operation IDs`);return se.signingOperation(`evm-family-sign:${e}`)}function ui(e){return e?{planningOperationId:e,confirmationOperationId:e,callerProvided:!0}:{planningOperationId:li(),callerProvided:!1}}function di(e){return e.confirmationOperationId=e.confirmationOperationId||li(),e.confirmationOperationId}function fi(e,t,n){e.callerProvided&&n.bindCallerProvidedOperationIdToFingerprint({operationId:e.planningOperationId,operationFingerprint:t})}function pi(e){switch(e.publicIdentityContinuity.kind){case`lane_identity_only`:return e.laneThresholdOwnerAddress;case`verified_material_identity`:if(e.publicIdentityContinuity.verifiedMaterialThresholdOwnerAddress!==e.laneThresholdOwnerAddress)throw Error(`[SigningEngine][ecdsa] prepared material owner address does not match the exact signing lane`);return e.laneThresholdOwnerAddress;default:throw e.publicIdentityContinuity,Error(`[SigningEngine][ecdsa] unsupported prepared public identity state`)}}function mi(e){return{kind:`prepared`,thresholdOwnerAddress:pi(e)}}var hi=e({reconcileEvmFamilyNonceLane:()=>On,reconcileTempoNonceLane:()=>Di,reportEvmFamilyBroadcastAccepted:()=>Cn,reportEvmFamilyBroadcastRejected:()=>Tn,reportEvmFamilyDroppedOrReplaced:()=>Dn,reportEvmFamilyFinalized:()=>En,reportTempoBroadcastAccepted:()=>Ci,reportTempoBroadcastRejected:()=>wi,reportTempoDroppedOrReplaced:()=>Ei,reportTempoFinalized:()=>Ti,signEvmFamily:()=>Si});function gi(e){return!e.prepared||e.prepared.kind!==`authorized`?{kind:`unavailable`}:{kind:`exact_ecdsa_lane`,identity:N(e.prepared.signingLane),authorization:e.prepared.signingLane.authorization,expiresAtMs:e.prepared.signingLane.authorization.session.expiresAtMs}}function _i(e){let t=e.prepared.signingLane.authorization.session.authorizationId;return Ee({walletId:e.walletId,materialActivationId:e.prepared.signingLane.materialActivation.activationId,authorizationId:t,authorityKey:ce(e.prepared.signingLane.auth),targetKey:l(e.prepared.signingLane.chainTarget)})}function vi(e){if(e.kind!==`authorization_required`||e.candidate.source!==`active_wallet_authority`)return null;let t=Nr(e.candidate.runtime);return{runtime:e.candidate.runtime,intent:e.intent,confirmationAuthPlan:t}}function yi(e){let t=e.chainTarget.kind===`tempo`?`Sign Tempo Transaction`:`Sign EVM Transaction`,n={request:e.request,signerAccount:String(e.walletSession.walletId),title:t,subtitle:``};return e.request.kind===`eip1559`?Re({...n,request:e.request}):He({...n,request:e.request})}async function bi(e){let t=$.bind(null,e.deps,e.signingArgs,{admissionRetryState:{kind:`authoritative_readiness_reread`},forceFreshAuth:!1,operationIds:e.operationIds,retryingFreshAuth:e.retryingFreshAuth,signingSessionCoordinator:e.signingSessionCoordinator}),n=$.bind(null,e.deps,e.signingArgs,{admissionRetryState:{kind:`initial_admission`},forceFreshAuth:!0,operationIds:e.operationIds,retryingFreshAuth:!0,signingSessionCoordinator:e.signingSessionCoordinator});return await ei({decision:e.decision,queueKey:e.queueKey,signingSessionCoordinator:e.signingSessionCoordinator,rereadAuthoritativeReadiness:t,performFreshAuth:n})}function xi(e){let t=e.accountAuth.primaryAuthMethod===d.emailOtp;K(e.onEvent,{phase:t?O.STEP_06_AUTH_EMAIL_OTP_CHALLENGE_STARTED:O.STEP_09_THRESHOLD_SESSION_RECONNECT_STARTED,status:`running`,walletId:e.walletId,message:t?`Signing session needs reauthorization; requesting Email OTP`:`Signing session needs reauthorization; requesting passkey`,interaction:{kind:`none`,overlay:`none`},data:{chain:e.chain,reason:`wallet_signing_budget_reserved`}})}async function Si(e,t){let n=a(e.touchConfirm.getContext().surfaceMeasurementBinding);n&&(n.assertPending(),e={...e,beforeSigning:n.beforeSigning});let r={admissionRetryState:{kind:`initial_admission`},operationIds:ui(t.signingOperationId)};await e.touchConfirm.openTransactionPreparationModal({chain:`evm_family`,walletLabel:String(t.walletSession.walletId),model:yi(t),confirmationConfigOverride:t.confirmationConfigOverride});try{return await $(e,t,r)}finally{e.touchConfirm.closeTransactionPreparationModal()}}async function $(e,t,n){bt(t.shouldAbort);let r=c(t.walletSession.walletId),i=vt({request:t.request,chainTarget:t.chainTarget});await gt(e.ensureSealedRefreshStartupParity,{walletId:r,chainTarget:i});let a=i.kind,o=i,s,l,u,d,f,p={walletId:r,chain:a,chainTarget:o,senderSignatureAlgorithm:t.request.senderSignatureAlgorithm},m=n.signingSessionCoordinator||e.signingSessionCoordinator;if(!m)throw Error(`[SigningEngine][ecdsa] production signing session coordinator is required`);let h=n.operationIds||ui(t.signingOperationId),g=await Ge({kind:`evm-family:${a}`,payload:{walletId:r,chainTarget:o,request:t.request}}),_=ve(g);fi(h,g,m);let v=()=>di(h),y=()=>({operationId:v(),operationFingerprint:g,intent:oe.TransactionSign}),b=e=>void 0,x=`no_auth_side_effect_started`,S=e=>{x=ri({current:x,sideEffect:e})},ee=(e,t)=>{let n=t instanceof Error?t.message:String(t||`unknown error`);p.freshAuthRetry={decision:e,sideEffectState:x,errorMessage:n},F(`evm-family`,{stage:`fresh_auth_retry.decision`,walletId:r,chain:a,chainTarget:o,decision:e,sideEffectState:x,errorMessage:n})},te=()=>(S(`auth_prompt_shown`),v());t.request.senderSignatureAlgorithm===`secp256k1`?(d=await bn({deps:e,walletSession:t.walletSession,signingTarget:i,signingOperation:y(),diagnostics:p,signingSessionCoordinator:m,forceFreshAuth:n.forceFreshAuth===!0}),f=vi(d)??void 0,l=d.kind===`authorized`?d.signingLane:void 0,u=d.authMethod,s=d.kind===`authorized`?d.accountAuth:await Mt({senderSignatureAlgorithm:`secp256k1`,signerAuthMethod:d.authMethod}),F(`evm-family`,{stage:`ecdsa_attempt.prepared`,walletId:r,chain:a,chainTarget:o,...b(d)?{evmFamilyKeyFingerprint:b(d)}:{},authorizationState:d.kind,authMethod:u,lane:U(l)})):s=await Mt({senderSignatureAlgorithm:t.request.senderSignatureAlgorithm});let C=s;bt(t.shouldAbort);let ne=e.requestEmailOtpTransactionSigningChallenge,w={confirmedDeps:{...e,requestEmailOtpTransactionSigningChallenge:ne},walletSession:t.walletSession,chain:a,accountAuth:C,operationFingerprintDigest:_,onEvent:t.onEvent},T=()=>{if(d)return d;throw Error(`[SigningEngine][ecdsa] prepared signing session is required`)},E=()=>t.request.senderSignatureAlgorithm===`secp256k1`?T():void 0,D=async i=>!Be(i)||n.reResolvedAfterSupersession?null:(F(`evm-family`,{stage:`ecdsa_attempt.material_superseded`,walletId:r,chain:a,chainTarget:o,supersessionKind:i.superseded.supersessionKind,preparedMaterialActivationId:String(i.superseded.preparedMaterialActivation.activationId),currentMaterialActivationId:String(i.superseded.currentMaterialActivation.activationId)}),await $(e,t,{admissionRetryState:{kind:`initial_admission`},operationIds:h,signingSessionCoordinator:m,reResolvedAfterSupersession:!0,...n.retryingFreshAuth?{retryingFreshAuth:!0}:{}})),re=async()=>t.request.senderSignatureAlgorithm===`secp256k1`?await(async()=>{let t=T();return f?{signingAuthPlan:f.confirmationAuthPlan}:t.kind===`authorized`?await Ht({...w,chainTarget:i,senderSignatureAlgorithm:`secp256k1`,ecdsaAuthorization:`reusable_wallet_session`,preparedOperation:t.preparedOperation}):await(async()=>{let n=M(t.identity,`auth-neutral ECDSA step-up planning`),r=await e.resolveCanonicalEcdsaSigningCapability({walletId:n.walletId,chainTarget:n.chainTarget,materialActivation:n.materialActivation});return await Ht({...w,chainTarget:i,senderSignatureAlgorithm:`secp256k1`,ecdsaAuthorization:`operation_step_up`,capability:r,materialActivation:n.materialActivation,operationFingerprint:g})})()})():await Ht({...w,chainTarget:i,senderSignatureAlgorithm:t.request.senderSignatureAlgorithm}),ie=async()=>{let{signingAuthPlan:n,signingSessionPlan:r,emailOtpSigning:i}=await re(),a=i?{prepare:i.prepare,...i.resend?{resend:i.resend}:{}}:void 0,{flowArgs:s}=await Qr({deps:e,walletSession:t.walletSession,request:t.request,chainTarget:o,...t.request.senderSignatureAlgorithm===`secp256k1`?{senderSignatureAlgorithm:t.request.senderSignatureAlgorithm,preparedSession:T(),...f?{activeWalletAuthority:f}:{}}:{senderSignatureAlgorithm:t.request.senderSignatureAlgorithm},...r?{signingSessionPlan:r}:{},signingOperation:y(),onSigningOperationTransition:Pt,...a?{emailOtpSigningForFlow:a}:{},confirmationConfigOverride:t.confirmationConfigOverride,shouldAbort:t.shouldAbort,onEvent:t.onEvent,onAuthSideEffectStarted:S});return{signingAuthPlan:n,signingSessionPlan:r,emailOtpSigning:i,flowArgs:s}},O;try{O=await ie()}catch(e){let t=await D(e);if(t)return t;throw e}let{signingAuthPlan:k,emailOtpSigning:ae,flowArgs:se}=O,ce=async i=>await ci({error:i,walletId:r,chain:t.request.chain,senderSignatureAlgorithm:t.request.senderSignatureAlgorithm,accountAuth:C,alreadyRetryingFreshEmailOtpAuth:n.retryingFreshAuth,hasEmailOtpSigningPlan:!!ae,sideEffectState:x,signingSessionCoordinator:m,expiryContext:ai({error:i,candidate:gi({prepared:d}),detectedAtMs:Date.now()}),onDecision:e=>ee(e,i),onEvent:t.onEvent,retry:async()=>await $(e,t,{admissionRetryState:{kind:`initial_admission`},forceFreshAuth:!0,operationIds:h,retryingFreshAuth:!0,signingSessionCoordinator:m})}),le=async i=>{if(Be(i))return await D(i)||null;let a=await ce(i);if(a)return a;let o=ii({trigger:`wallet_signing_budget_exhausted`,error:i,senderSignatureAlgorithm:t.request.senderSignatureAlgorithm,accountAuth:C,activeSigningAuthMethod:T().authMethod,admissionRetryState:n.admissionRetryState,alreadyRetryingFreshAuth:n.retryingFreshAuth,hasStepUpAuthPlan:We(k)||Ue(k),sideEffectState:x});if(ee(o,i),o.kind!==`retry`)return null;let s=T();return s.kind===`authorized`?(o.retryMode!==`await_admission_owner_completion`&&xi({walletId:r,chain:t.request.chain,accountAuth:C,onEvent:t.onEvent}),await bi({deps:e,signingArgs:t,decision:o,queueKey:_i({walletId:r,prepared:s}),operationIds:h,retryingFreshAuth:n.retryingFreshAuth===!0,signingSessionCoordinator:m})):null},A=E(),ue={...y(),accountId:String(r)};if(A){let e=b(A);F(`evm-family`,{stage:`ecdsa_attempt.nonce_operation_prepared`,walletId:r,chain:a,chainTarget:o,...e?{evmFamilyKeyFingerprint:e}:{},...A.kind===`authorized`?{walletSessionId:A.signingLane.authorization.operationCredential.walletSessionId}:{},materialActivationId:A.kind===`authorized`?A.signingLane.materialActivation.activationId:A.candidate.materialActivation.activationId})}let j=E(),de=j&&!f?{kind:`required`,authPlan:{kind:`planned`,signingAuthPlan:k},operation:{intent:j.kind===`authorized`?j.transactionOperation.intent:j.intent,authPlan:k},runtime:(()=>{let e=se.thresholdEcdsaStepUpRuntime;if(!e)throw Error(`[SigningEngine][ecdsa] prepared executor requires threshold step-up runtime`);return e})()}:{kind:`not_required`},N;return N=j?mi({laneThresholdOwnerAddress:j.kind===`authorized`?j.signingLane.key.thresholdOwnerAddress:j.candidate.key.thresholdOwnerAddress,publicIdentityContinuity:{kind:`lane_identity_only`}}):{kind:`not_required`},await nr({deps:e,walletId:r,request:t.request,chainTarget:o,flowArgs:se,nonceOperation:ue,thresholdEcdsaState:N,onConfirmationDisplayed:te,thresholdEcdsaStepUp:de,retryWithFreshEmailOtpAuth:le})}async function Ci(e,t){await Cn(e,t)}async function wi(e,t){await Tn(e,t)}async function Ti(e,t){await En(e,t)}async function Ei(e,t){await Dn(e,t)}async function Di(e,t){return await On(e,t)}export{ot as _,Ti as a,Ye as b,kr as c,yr as d,ht as f,dt as g,mt as h,Ei as i,Dr as l,pt as m,Ci as n,Si as o,z as p,wi as r,hi as s,Di as t,Cr as u,ut as v,ft as y};

package/dist/public/sdk/signEvmFamilyWithUiConfirmForTempo-Dc57bJ3V.js

@@ -0,0 +1 @@
+import{r as e}from"./base64-CsEj-_bC.js";import"./signingSessionSeal-CDLUmAFY.js";import"./capabilityKinds-CKQ4Uqnv.js";import"./errors-BZO3LF6G.js";import{c as t}from"./ecdsaChainTarget-C8ZtMZ8l.js";import"./signerDomain-vQmlnsbF.js";import{t as n}from"./executeWorkerOperation-BInr8RYN.js";import{i as r}from"./evmCryptoWasm-BXsIyRon.js";import{t as i}from"./bytes-BBYkulRB.js";import{f as a,r as o}from"./signingFlow-vrXxrhlG.js";import{t as s}from"./display-ClqZq-Xt.js";import{n as c,t as l}from"./signatureUses-CjJ233KX.js";function u(e){if(e<0n)throw Error(`[tempoSignerWasm] negative bigint not supported`);return e.toString(10)}function d(e){if(typeof e==`bigint`){if(e<0n)throw Error(`[tempoSignerWasm] chainId must be a non-negative integer`);let t=Number(e);if(!Number.isSafeInteger(t))throw Error(`[tempoSignerWasm] chainId must be a non-negative safe integer`);return t}if(!Number.isSafeInteger(e)||e<0)throw Error(`[tempoSignerWasm] chainId must be a non-negative safe integer`);return e}function f(e){if(e===null)return null;if(e!==void 0)return u(e)}function p(e){if(typeof e==`bigint`)return e;throw Error(`[tempoSignerWasm] missing tx nonce`)}function m(e){if(e!==void 0)return e instanceof Uint8Array?Array.from(e):e.map(e=>m(e))}function h(e){return{chainId:d(e.chainId),maxPriorityFeePerGas:u(e.maxPriorityFeePerGas),maxFeePerGas:u(e.maxFeePerGas),gasLimit:u(e.gasLimit),calls:e.calls.map(e=>({to:e.to,value:u(e.value),input:e.input??`0x`})),accessList:(e.accessList??[]).map(e=>({address:e.address,storageKeys:e.storageKeys})),nonceKey:u(e.nonceKey),nonce:u(p(e.nonce)),validBefore:f(e.validBefore),validAfter:f(e.validAfter),feeToken:e.feeToken??null,feePayerSignature:e.feePayerSignature??{kind:`none`},aaAuthorizationList:m(e.aaAuthorizationList),keyAuthorization:m(e.keyAuthorization)}}const g=`tempoSigner`,_=2e4;async function v(e,t){let r=await n({ctx:t,kind:g,request:{type:`computeTempoSenderHash`,payload:{tx:h(e)},timeoutMs:_}});return new Uint8Array(r)}async function y(e){let t=e.senderSignature.slice().buffer,r=await n({ctx:e.workerCtx,kind:g,request:{type:`encodeTempoSignedTx`,payload:{tx:h(e.tx),senderSignature:t},timeoutMs:_,transfer:[t]}});return new Uint8Array(r)}var b=class{constructor(e){this.chain=`tempo`,this.workerCtx=e}async buildIntent(e){if(e.chain!==`tempo`)throw Error(`[TempoAdapter] invalid chain`);if(e.kind!==`tempoTransaction`)throw Error(`[TempoAdapter] unsupported request kind`);let t=await v(e.tx,this.workerCtx),n=i(t);return{chain:`tempo`,uiModel:{kind:`tempoTransaction`,tx:e.tx},signRequests:[e.senderSignatureAlgorithm===`webauthnP256`?{kind:`webauthn`,algorithm:`webauthnP256`,challenge32:t,label:`tempo:0x76:sender`}:{kind:`digest`,algorithm:`secp256k1`,digest32:t,label:`tempo:0x76:sender`}],finalize:async t=>({chain:`tempo`,kind:`tempoTransaction`,senderHashHex:n,rawTxHex:i(await y({tx:e.tx,senderSignature:t[0],workerCtx:this.workerCtx}))})}}};async function x(n){let i=t(n.walletId),a=await n.passkeyAuthenticatorStore.listWalletPasskeyAuthenticators(i);if(!a.length)throw Error(`[multichain] no passkeys found for wallet ${i}`);let{authenticatorsForPrompt:o}=await n.passkeyAuthenticatorStore.selectProfileAuthenticatorsForPrompt({profileId:i,authenticators:a,accountLabel:i}),s=o[0];if(!s)throw Error(`[multichain] missing authenticator for wallet ${i}`);let{pubKeyX32:c,pubKeyY32:l}=await r({cosePublicKey:s.credentialPublicKey,workerCtx:n.workerCtx}),u=e(s.credentialId);if(u.length===0)throw Error(`[multichain] invalid credentialId for authenticator`);return{type:`webauthnP256`,credentialId:u,pubKeyX:c,pubKeyY:l,rpId:n.rpId}}async function S(e){return e.request.kind===`eip1559`?await o({config:{targetKind:`tempo`,flowName:`tempo`,explicitAuthErrorLabel:`Tempo`,nonceErrorLabel:`Tempo`,title:`Sign Tempo Transaction`,body:``,buildIntent:async({workerCtx:e,request:t})=>await new c(e).buildIntent(t),buildDisplayModel:a,requiredSignatureUsesForRequest:l,webauthn:{kind:`not_supported`}},input:e}):await o({config:{targetKind:`tempo`,flowName:`tempo`,explicitAuthErrorLabel:`Tempo`,nonceErrorLabel:`Tempo`,title:`Sign Tempo Transaction`,body:``,buildIntent:async({workerCtx:e,request:t})=>await new b(e).buildIntent(t),buildDisplayModel:s,requiredSignatureUsesForRequest:l,webauthn:{kind:`supported`,requestNeedsWebAuthn:e=>e.senderSignatureAlgorithm===`webauthnP256`,validateIntent:e=>{if(e.signRequests.filter(e=>e.kind===`webauthn`).length>1)throw Error(`[chains] multiple WebAuthn sign requests are not supported yet`)},resolveKeyRef:async({ctx:e,walletId:t,workerCtx:n,signReq:r,credential:i})=>{let a=await x({passkeyAuthenticatorStore:e.passkeyAuthenticatorStore,walletId:t,workerCtx:n,rpId:r.rpId});return{signReq:{...r,credential:i},keyRef:a}}}},input:e})}export{S as signEvmFamilyWithUiConfirmForTempo};

package/dist/public/sdk/signEvmWithUiConfirm-CqxL7UbT.js

@@ -0,0 +1 @@
+import"./signingSessionSeal-CDLUmAFY.js";import"./capabilityKinds-CKQ4Uqnv.js";import"./errors-BZO3LF6G.js";import"./signerDomain-vQmlnsbF.js";import{f as e,r as t}from"./signingFlow-vrXxrhlG.js";import{n,t as r}from"./signatureUses-CjJ233KX.js";async function i(i){return await t({config:{targetKind:`evm`,flowName:`evm`,explicitAuthErrorLabel:`EVM`,nonceErrorLabel:`EVM`,title:`Sign EVM Transaction`,body:``,buildIntent:async({workerCtx:e,request:t})=>await new n(e).buildIntent(t),buildDisplayModel:e,requiredSignatureUsesForRequest:r,webauthn:{kind:`not_supported`}},input:i})}export{i as signEvmWithUiConfirm};