@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/sdk/wallet-recovery-CcDZ1hMH.js

@@ -1 +0,0 @@
-import{A as e,D as t,M as n,O as r,T as i,j as a,n as o,s}from"./domainIds-GDzjOs6i.js";import{_ as c,y as l}from"./validation-dC1-_uyG.js";import{i as u,r as d}from"./base64-ojm5DKcF.js";import{C as f,I as p,S as m,b as h}from"./sessionPolicy-CNVK7nJ6.js";import{l as ee}from"./capabilityKinds-XaXXiD2B.js";import{f as g,m as _,p as v}from"./chains-yAls2d9X.js";import{a as y,n as b,r as x}from"./canonicalPrimitives-MPGET2cl.js";import{m as te,o as S,u as C,w}from"./walletAuthority-CoWSeqvQ.js";const T=`0123456789ABCDEFGHJKMNPQRSTVWXYZ`,E=Object.freeze(Array.from(T).reduce((e,t,n)=>(e[t]=n,e),{}));function D(e){if(!e)return!1;for(let t=0;t<e.length;t++){let n=e.charCodeAt(t);if(n<48||n>57)return!1}return!0}function O(e){if(e.byteLength!==20)throw Error(`Email OTP recovery key bytes must be exactly 20 bytes`);let t=0,n=0,r=``;for(let i=0;i<e.byteLength;i++)for(t=t<<8|e[i],n+=8;n>=5;)n-=5,r+=T[t>>n&31],t&=(1<<n)-1;return r}function k(e){let t=A(e),n=[],r=0;for(let e=0;e<8;e++)n.push(t.slice(r,r+4)),r+=4;return n.join(`-`)}function ne(e){if(e.length!==10)throw Error(`Email OTP recovery code set must contain 10 keys`);return[k(e[0]),k(e[1]),k(e[2]),k(e[3]),k(e[4]),k(e[5]),k(e[6]),k(e[7]),k(e[8]),k(e[9])]}function A(e){let t=String(e||``).replace(/[\s-]/g,``).toUpperCase();if(t.length!==32)throw Error(`Email OTP recovery key must be 32 Crockford Base32 characters`);if(D(t))throw Error(`Email OTP recovery key must not be decimal-only`);for(let e=0;e<t.length;e++)if(E[t[e]]===void 0)throw Error(`Email OTP recovery key contains unsupported characters`);return t}function re(e){let t=A(e),n=new Uint8Array(20),r=0,i=0,a=0;for(let e=0;e<t.length;e++)r=r<<5|E[t[e]],i+=5,i>=8&&(i-=8,n[a]=r>>i&255,r&=(1<<i)-1,a+=1);return n}async function ie(e){let t=String(e.keySetId||``).trim();if(!/^(near_ed25519|evm_family_ecdsa):\S+$/.test(t))throw Error(`wallet recovery key-set id is invalid`);return b(`wallet-recovery-key-v1:${u(await _(g({domain:`seams/wallet-recovery/key-lifecycle/v1`,reservationId:e.reservationId,keySetId:t})))}`)}function ae(e){if(typeof e!=`string`||e.length===0||e.length>512||e.trim()!==e||o(e))throw Error(`recovery code reservation id must be a compact opaque identifier`);return e}function oe(e){return e.kind===`passkey`?se(e):ce(e)}function se(e){let t={version:`wallet_recovery_committed_projection_v1`,storeVersion:l(e.storeVersion,`storeVersion`,`is invalid`),walletId:e.walletId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,authority:e.authority,kind:`passkey`,authMethod:e.authMethod,target:{kind:`passkey`,rpId:e.authMethod.rpId,credentialIdB64u:e.authMethod.credentialIdB64u}};return P(t),t}function ce(e){let t={version:`wallet_recovery_committed_projection_v1`,storeVersion:l(e.storeVersion,`storeVersion`,`is invalid`),walletId:e.walletId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,authority:e.authority,kind:`google_email_otp`,authMethod:e.authMethod,target:{kind:`google_email_otp`,provider:`google`,providerSubject:e.providerSubject,emailHashHex:H(e.emailHashHex),registrationAuthorityId:l(e.registrationAuthorityId,`registrationAuthorityId`,`is invalid`),enrollment:M(e.enrollment)}};return P(t),t}async function le(n,a){let o=F(n);if(o.version!==`wallet_recovery_committed_projection_v1`)throw Error(`wallet recovery committed projection version is invalid`);if(o.kind!==a.kind)throw Error(`wallet recovery committed projection target changed`);let s=V(r(o.walletId),`walletId`),c=V(e(o.recoveryOperationId),`recoveryOperationId`),u=V(ee(o.targetDeviceId),`targetDeviceId`),d=V(t(o.targetAuthorityId),`targetAuthorityId`),f=V(i(o.targetWalletAuthMethodId),`targetWalletAuthMethodId`),p=C(o.authority);if(!p.ok)throw Error(`wallet recovery authority projection is invalid`);let m=p.value;if(m.state!==`active`||!S(m)||!await te(m))throw Error(`wallet recovery authority projection digest or lifecycle is invalid`);let h=w(o.authMethod);if(!h||h.status!==`active`)throw Error(`wallet recovery auth method projection is invalid`);let g={version:`wallet_recovery_committed_projection_v1`,storeVersion:l(o.storeVersion,`storeVersion`,`is invalid`),walletId:s,recoveryOperationId:c,targetDeviceId:u,targetAuthorityId:d,targetWalletAuthMethodId:f,authority:m};if(a.kind===`passkey`){if(h.kind!==`passkey`)throw Error(`wallet recovery target method family changed`);let e=ue(o.target),t={...g,kind:`passkey`,authMethod:h,target:e};return N(t,a),P(t),t}if(h.kind!==`email_otp`)throw Error(`wallet recovery target method family changed`);let _=j(o.target),v={...g,kind:`google_email_otp`,authMethod:h,target:_};return N(v,a),P(v),v}function ue(e){let t=I(e);if(t.kind!==`passkey`)throw Error(`wallet recovery passkey target is invalid`);return{kind:`passkey`,rpId:V(n(t.rpId),`target.rpId`),credentialIdB64u:V(a(t.credentialIdB64u),`target.credentialIdB64u`)}}function j(e){let t=L(e);if(t.kind!==`google_email_otp`||t.provider!==`google`)throw Error(`wallet recovery Google Email OTP target is invalid`);return{kind:`google_email_otp`,provider:`google`,providerSubject:V(s(t.providerSubject),`target.providerSubject`),emailHashHex:H(t.emailHashHex),registrationAuthorityId:l(t.registrationAuthorityId,`target.registrationAuthorityId`,`is invalid`),enrollment:M(t.enrollment)}}function M(e){let t=R(e);if(t.kind!==`email_otp_enrollment_reference_v1`)throw Error(`wallet recovery Email OTP enrollment is invalid`);return{kind:`email_otp_enrollment_reference_v1`,enrollmentId:l(t.enrollmentId,`enrollment.enrollmentId`,`is invalid`),enrollmentSealKeyVersion:l(t.enrollmentSealKeyVersion,`enrollment.enrollmentSealKeyVersion`,`is invalid`)}}function N(e,t){if(e.kind!==t.kind||e.walletId!==t.walletId||e.recoveryOperationId!==t.recoveryOperationId||e.targetDeviceId!==t.targetDeviceId||e.targetAuthorityId!==t.targetAuthorityId||e.targetWalletAuthMethodId!==t.targetWalletAuthMethodId)throw Error(`wallet recovery committed projection identity changed`);if(e.kind===`passkey`&&t.kind===`passkey`){if(e.target.rpId!==t.rpId||e.target.credentialIdB64u!==t.credentialIdB64u)throw Error(`wallet recovery passkey target changed`);return}if(e.kind!==`google_email_otp`||t.kind!==`google_email_otp`)throw Error(`wallet recovery target identity changed`);if(e.target.providerSubject!==t.providerSubject||e.target.emailHashHex!==t.emailHashHex||e.target.registrationAuthorityId!==t.registrationAuthorityId||e.target.enrollment.enrollmentId!==t.enrollment.enrollmentId||e.target.enrollment.enrollmentSealKeyVersion!==t.enrollment.enrollmentSealKeyVersion)throw Error(`wallet recovery Google Email OTP target changed`)}function P(e){if(e.authority.walletId!==e.walletId||e.authority.authorityId!==e.targetAuthorityId||e.authority.principal.deviceId!==e.targetDeviceId||e.authority.provenance.kind!==`wallet_recovery`||e.authority.provenance.recoveryOperationId!==e.recoveryOperationId||e.authority.provenance.continuityAuthorityId===e.targetAuthorityId||e.authMethod.walletId!==e.walletId||e.authMethod.walletAuthorityId!==e.targetAuthorityId||e.authMethod.walletAuthMethodId!==e.targetWalletAuthMethodId||e.authMethod.status!==`active`)throw Error(`wallet recovery committed projection relations are invalid`);if(e.kind===`passkey`){if(e.authMethod.kind!==`passkey`||e.target.rpId!==e.authMethod.rpId||e.target.credentialIdB64u!==e.authMethod.credentialIdB64u)throw Error(`wallet recovery passkey projection relations are invalid`);return}if(e.authMethod.kind!==`email_otp`||e.target.emailHashHex!==e.authMethod.emailHashHex||e.target.registrationAuthorityId!==e.authMethod.registrationAuthorityId)throw Error(`wallet recovery Google Email OTP projection relations are invalid`)}function F(e){let t=z(e);if(t===null)throw Error(`wallet recovery committed projection must be an object`);return B(t,[`version`,`kind`,`storeVersion`,`walletId`,`recoveryOperationId`,`targetDeviceId`,`targetAuthorityId`,`targetWalletAuthMethodId`,`authority`,`authMethod`,`target`],`wallet recovery committed projection`),{version:Reflect.get(t,`version`),kind:Reflect.get(t,`kind`),storeVersion:Reflect.get(t,`storeVersion`),walletId:Reflect.get(t,`walletId`),recoveryOperationId:Reflect.get(t,`recoveryOperationId`),targetDeviceId:Reflect.get(t,`targetDeviceId`),targetAuthorityId:Reflect.get(t,`targetAuthorityId`),targetWalletAuthMethodId:Reflect.get(t,`targetWalletAuthMethodId`),authority:Reflect.get(t,`authority`),authMethod:Reflect.get(t,`authMethod`),target:Reflect.get(t,`target`)}}function I(e){let t=z(e);if(t===null)throw Error(`wallet recovery passkey target must be an object`);return B(t,[`kind`,`rpId`,`credentialIdB64u`],`wallet recovery passkey target`),{kind:Reflect.get(t,`kind`),rpId:Reflect.get(t,`rpId`),credentialIdB64u:Reflect.get(t,`credentialIdB64u`)}}function L(e){let t=z(e);if(t===null)throw Error(`wallet recovery Google Email OTP target must be an object`);return B(t,[`kind`,`provider`,`providerSubject`,`emailHashHex`,`registrationAuthorityId`,`enrollment`],`wallet recovery Google Email OTP target`),{kind:Reflect.get(t,`kind`),provider:Reflect.get(t,`provider`),providerSubject:Reflect.get(t,`providerSubject`),emailHashHex:Reflect.get(t,`emailHashHex`),registrationAuthorityId:Reflect.get(t,`registrationAuthorityId`),enrollment:Reflect.get(t,`enrollment`)}}function R(e){let t=z(e);if(t===null)throw Error(`wallet recovery Email OTP enrollment must be an object`);return B(t,[`kind`,`enrollmentId`,`enrollmentSealKeyVersion`],`wallet recovery Email OTP enrollment`),{kind:Reflect.get(t,`kind`),enrollmentId:Reflect.get(t,`enrollmentId`),enrollmentSealKeyVersion:Reflect.get(t,`enrollmentSealKeyVersion`)}}function z(e){return typeof e==`object`&&e&&!Array.isArray(e)?e:null}function B(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==t.length||i.some(e=>!r.has(e)))throw Error(`${n} contains unexpected fields`)}function V(e,t){if(!e.ok)throw Error(`${t} is invalid`);return e.value}function H(e){let t=l(e,`emailHashHex`,`is invalid`);if(!/^[0-9a-f]{64}$/.test(t))throw Error(`emailHashHex is invalid`);return t}const U=/^wallet-rkid-v1-[A-Za-z0-9_-]{43}$/;function W(e,t=`recoveryKeyId`){if(typeof e!=`string`||!U.test(e))throw Error(`${t} must be a derived wallet recovery key id`);return e}function de(){let e=[],t=[];for(let n=0;n<10;n+=1){let n=pe();t.push(n),e.push(k(O(n)))}return{codes:e,codeBytes:t}}function fe(e){for(let t of e.codeBytes)t.fill(0)}function pe(){let e=globalThis.crypto;if(!e?.getRandomValues)throw Error(`a secure random source is required to issue wallet recovery codes`);return e.getRandomValues(new Uint8Array(20))}function me(e,t=`recoveryCodeLocator`){try{return x(e)}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`must be a canonical digest`}`)}}async function he(e){if(!(e instanceof Uint8Array)||e.length!==20)throw Error(`recovery code bytes must be exactly 20 bytes`);let t=null;try{let n=new TextEncoder().encode(`seams/wallet-recovery/code-locator/v1`);t=new Uint8Array(8+n.length+e.length);let r=new DataView(t.buffer);return r.setUint32(0,n.length,!1),t.set(n,4),r.setUint32(4+n.length,e.length,!1),t.set(e,8+n.length),me(u(await v(t)))}finally{t?.fill(0)}}function ge(e){return{custodySecretKind:`wallet_custody_seed_v1`,nonceB64u:e.nonceB64u,wrappedCustodySecretB64u:e.wrappedCustodySecretB64u,aadHashB64u:e.aadHashB64u}}function _e(e,t){let n=t.label||`walletRecoverySetRotation`,i=c(e,n);p(i,be,n);let a=r(i.walletId);if(!a.ok)throw Error(`${n}.walletId ${a.error.message}`);if(String(a.value)!==String(t.expectedWalletId))throw Error(`${n}.walletId is outside the authenticated wallet`);if(!Array.isArray(i.manifestKekWraps))throw Error(`${n}.manifestKekWraps must be an array`);if(i.manifestKekWraps.length!==10)throw Error(`${n}.manifestKekWraps must carry exactly 10 recovery-code wraps`);let o=i.manifestKekWraps.map((e,t)=>{let r=c(e,`${n}.manifestKekWraps[${t}]`);return p(r,ye,`${n}.manifestKekWraps[${t}]`),{recoveryKeyId:W(r.recoveryKeyId,`${n}.manifestKekWraps[${t}].recoveryKeyId`),nonceB64u:f(r.nonceB64u,`${n}.manifestKekWraps[${t}].nonceB64u`),ciphertextB64u:m(r.ciphertextB64u,`${n}.manifestKekWraps[${t}].ciphertextB64u`),aadHashB64u:h(r.aadHashB64u,`${n}.manifestKekWraps[${t}].aadHashB64u`)}}),s=new Set;for(let e of o){let t=String(e.recoveryKeyId);if(!s.add(t))throw Error(`${n} contains duplicate recovery key ids`)}if(!Array.isArray(i.entries)||i.entries.length!==1)throw Error(`${n}.entries must carry exactly one wallet custody seed entry`);let l=G(i.entries[0],`${n}.entries[0]`);return{walletId:a.value,manifestKekWraps:o,entry:l}}const ve=[`custodySecretKind`,`nonceB64u`,`wrappedCustodySecretB64u`,`aadHashB64u`],ye=[`recoveryKeyId`,`nonceB64u`,`ciphertextB64u`,`aadHashB64u`],be=[`walletId`,`manifestKekWraps`,`entries`];function G(e,t){let n=c(e,t);if(p(n,ve,t),n.custodySecretKind!==`wallet_custody_seed_v1`)throw Error(`${t}.custodySecretKind must be wallet_custody_seed_v1; lane holder shares are reprovisioned, not recovered`);return ge({nonceB64u:f(n.nonceB64u,`${t}.nonceB64u`),wrappedCustodySecretB64u:m(n.wrappedCustodySecretB64u,`${t}.wrappedCustodySecretB64u`),aadHashB64u:h(n.aadHashB64u,`${t}.aadHashB64u`)})}function K(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`${t} must be an object`);return e}function q(e,t){let n=typeof e==`string`?e.trim():``;if(!n)throw Error(`${t} is required`);return n}function xe(e){let t=K(e,`rotation worker result`);if(!Array.isArray(t.recoveryManifestKekWraps)||t.recoveryManifestKekWraps.length!==10)throw Error(`rotation worker result must contain exactly 10 recovery wraps`);return{walletId:q(t.walletId,`rotation worker walletId`),recoveryManifestKekWraps:t.recoveryManifestKekWraps.map((e,t)=>{let n=K(e,`rotation worker wrap ${t}`);return{recoveryKeyId:q(n.recoveryKeyId,`rotation worker wrap ${t} recoveryKeyId`),nonceB64u:q(n.nonceB64u,`rotation worker wrap ${t} nonceB64u`),ciphertextB64u:q(n.ciphertextB64u,`rotation worker wrap ${t} ciphertextB64u`),aadHashB64u:q(n.aadHashB64u,`rotation worker wrap ${t} aadHashB64u`)}}),recoveryEntryNonceB64u:q(t.recoveryEntryNonceB64u,`rotation worker recoveryEntryNonceB64u`),recoveryEntryCiphertextB64u:q(t.recoveryEntryCiphertextB64u,`rotation worker recoveryEntryCiphertextB64u`),recoveryEntryAadHashB64u:q(t.recoveryEntryAadHashB64u,`rotation worker recoveryEntryAadHashB64u`)}}function Se(e){let t=xe(e),n=r(t.walletId);if(!n.ok)throw Error(`rotation worker wallet id is invalid: ${n.error.message}`);let i={custodySecretKind:`wallet_custody_seed_v1`,nonceB64u:f(t.recoveryEntryNonceB64u,`rotation.entry.nonceB64u`),wrappedCustodySecretB64u:m(t.recoveryEntryCiphertextB64u,`rotation.entry.wrappedCustodySecretB64u`),aadHashB64u:h(t.recoveryEntryAadHashB64u,`rotation.entry.aadHashB64u`)};return _e({walletId:n.value,manifestKekWraps:t.recoveryManifestKekWraps.map(e=>({recoveryKeyId:W(e.recoveryKeyId,`rotation.recoveryKeyId`),nonceB64u:f(e.nonceB64u,`rotation.wrap.nonceB64u`),ciphertextB64u:m(e.ciphertextB64u,`rotation.wrap.ciphertextB64u`),aadHashB64u:h(e.aadHashB64u,`rotation.wrap.aadHashB64u`)})),entries:[i]},{expectedWalletId:n.value,label:`rotation.workerResult`})}const J=`secp256k1_bip340_sha256_v1`;function Y(e,t,n){let r=new Set(n);for(let n of Object.keys(e))if(!r.has(n))throw Error(`${t}.${n} is not a supported field`);for(let r of n)if(!Object.hasOwn(e,r))throw Error(`${t}.${r} is required`)}function X(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} must be a non-empty canonical identifier`);for(let n=0;n<e.length;n+=1){let r=e.charCodeAt(n);if(r<33||r>126)throw Error(`${t} must contain visible ASCII bytes`)}return e}function Z(e){return e.startsWith(`evm_family_ecdsa:`)&&e.length>17}function Ce(e,t){let n=X(e,t);if(!Z(n))throw Error(`${t} must identify an ECDSA key set`);return n}function Q(e,t){try{return x(e)}catch{throw Error(`${t} must be canonical base64url for 32 bytes`)}}function we(e,t){if(typeof e!=`string`||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical base64url`);let n;try{n=d(e)}catch{throw Error(`${t} must be valid base64url`)}if(n.length!==33||n[0]!==2&&n[0]!==3||u(n)!==e)throw Error(`${t} must be canonical compressed secp256k1 public key bytes`);return e}function Te(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive safe integer`);return e}function Ee(e,t){if(typeof e!=`string`||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical base64url`);let n;try{n=d(e)}catch{throw Error(`${t} must be valid base64url`)}if(n.length!==64||u(n)!==e)throw Error(`${t} must be canonical base64url for 64 bytes`);return e}function $(e){let t=c(e,`walletRecoveryEcdsaPossessionChallenge`);if(Y(t,`walletRecoveryEcdsaPossessionChallenge`,[`kind`,`walletId`,`reservationId`,`replacementId`,`keySetId`,`keyHandle`,`recordedKeyManifestDigestB64u`,`publicCapabilityDigestB64u`,`authorityRefDigestB64u`,`derivationClientSharePublicKey33B64u`,`expectedServerGeneration`,`expiresAtMs`,`serverNonceB64u`]),t.kind!==`wallet_recovery_ecdsa_possession_challenge_v1`)throw Error(`walletRecoveryEcdsaPossessionChallenge.kind is invalid`);let n=Ce(t.keySetId,`walletRecoveryEcdsaPossessionChallenge.keySetId`);return{kind:`wallet_recovery_ecdsa_possession_challenge_v1`,walletId:X(t.walletId,`walletRecoveryEcdsaPossessionChallenge.walletId`),reservationId:X(t.reservationId,`walletRecoveryEcdsaPossessionChallenge.reservationId`),replacementId:X(t.replacementId,`walletRecoveryEcdsaPossessionChallenge.replacementId`),keySetId:n,keyHandle:X(t.keyHandle,`walletRecoveryEcdsaPossessionChallenge.keyHandle`),recordedKeyManifestDigestB64u:Q(t.recordedKeyManifestDigestB64u,`walletRecoveryEcdsaPossessionChallenge.recordedKeyManifestDigestB64u`),publicCapabilityDigestB64u:Q(t.publicCapabilityDigestB64u,`walletRecoveryEcdsaPossessionChallenge.publicCapabilityDigestB64u`),authorityRefDigestB64u:Q(t.authorityRefDigestB64u,`walletRecoveryEcdsaPossessionChallenge.authorityRefDigestB64u`),derivationClientSharePublicKey33B64u:we(t.derivationClientSharePublicKey33B64u,`walletRecoveryEcdsaPossessionChallenge.derivationClientSharePublicKey33B64u`),expectedServerGeneration:X(t.expectedServerGeneration,`walletRecoveryEcdsaPossessionChallenge.expectedServerGeneration`),expiresAtMs:Te(t.expiresAtMs,`walletRecoveryEcdsaPossessionChallenge.expiresAtMs`),serverNonceB64u:Q(t.serverNonceB64u,`walletRecoveryEcdsaPossessionChallenge.serverNonceB64u`)}}function De(e){let t=c(e,`walletRecoveryEcdsaPossessionProof`);if(Y(t,`walletRecoveryEcdsaPossessionProof`,[`kind`,`scheme`,`signature64B64u`]),t.kind!==`wallet_recovery_ecdsa_possession_proof_v1`)throw Error(`walletRecoveryEcdsaPossessionProof.kind is invalid`);if(t.scheme!==J)throw Error(`walletRecoveryEcdsaPossessionProof.scheme is invalid`);return{kind:`wallet_recovery_ecdsa_possession_proof_v1`,scheme:J,signature64B64u:Ee(t.signature64B64u,`walletRecoveryEcdsaPossessionProof.signature64B64u`)}}function Oe(e){let t=$(e),n=[`seams/wallet-recovery/ecdsa-existing-material-possession/v1`,J,t.walletId,t.reservationId,t.replacementId,t.keySetId,t.keyHandle,d(t.recordedKeyManifestDigestB64u),d(t.publicCapabilityDigestB64u),d(t.authorityRefDigestB64u),d(t.derivationClientSharePublicKey33B64u),t.expectedServerGeneration,d(t.serverNonceB64u),ke(t.expiresAtMs)],r=[];for(let e of n){let t=typeof e==`string`?new TextEncoder().encode(e):e,n=t.length;if(n>4294967295)throw Error(`wallet recovery possession field is too large`);r.push(n>>>24&255,n>>>16&255,n>>>8&255,n&255,...t)}return Uint8Array.from(r)}function ke(e){let t=BigInt(e),n=new Uint8Array(8);for(let e=n.length-1;e>=0;--e)n[e]=Number(t&255n),t>>=8n;return n}async function Ae(e){return y(Oe(e))}export{G as a,fe as c,ie as d,ae as f,Se as i,oe as l,re as m,De as n,he as o,ne as p,Ae as r,de as s,$ as t,le as u};

package/dist/esm/sdk/walletAuthority-CoWSeqvQ.js

@@ -1 +0,0 @@
-import{A as e,D as t,M as n,O as r,T as i,h as a,j as o,k as s,l as c,u as ee}from"./domainIds-GDzjOs6i.js";import{_ as l}from"./validation-dC1-_uyG.js";import{i as u,r as d}from"./base64-ojm5DKcF.js";import{E as te,I as f,N as ne,O as p,x as re}from"./sessionPolicy-CNVK7nJ6.js";import{l as ie}from"./capabilityKinds-XaXXiD2B.js";import{f as ae,p as oe}from"./chains-yAls2d9X.js";import{o as se,r as m}from"./canonicalPrimitives-MPGET2cl.js";import{s as ce,u as h}from"./registrationIds-BIel5S0i.js";const le=[`kind`,`keyFamilies`,`signers`],ue=[`kind`,`keyFamily`,`walletId`,`walletKeyId`,`registeredPublicKeyB64u`],de=[`kind`,`keyFamily`,`walletId`,`walletKeyId`,`thresholdPublicKey33B64u`,`evmAddress`];function g(e){if(e.length===0)throw Error(`exact administered signer manifest must contain at least one active family`);let t,n,r,i=new Set;for(let a of e){if(t!==void 0&&t!==a.walletId)throw Error(`exact administered signer manifest must use one wallet identity`);if(t=a.walletId,i.has(a.walletKeyId))throw Error(`exact administered signer manifest repeats wallet key ${a.walletKeyId}`);switch(i.add(a.walletKeyId),a.keyFamily){case`ed25519`:if(n!==void 0)throw Error(`exact administered signer manifest repeats the ed25519 family`);if(a.kind!==`exact_administered_ed25519_signer_v1`)throw Error(`exact administered signer manifest has an invalid Ed25519 signer`);n=a;break;case`ecdsa_secp256k1`:if(r!==void 0)throw Error(`exact administered signer manifest repeats the ecdsa family`);if(a.kind!==`exact_administered_ecdsa_signer_v1`)throw Error(`exact administered signer manifest has an invalid ECDSA signer`);r=a;break}}if(n!==void 0&&r!==void 0)return{kind:`exact_administered_signer_manifest_v1`,keyFamilies:[`ed25519`,`ecdsa_secp256k1`],signers:[n,r]};if(n!==void 0)return{kind:`exact_administered_signer_manifest_v1`,keyFamilies:[`ed25519`],signers:[n]};if(r!==void 0)return{kind:`exact_administered_signer_manifest_v1`,keyFamilies:[`ecdsa_secp256k1`],signers:[r]};throw Error(`exact administered signer manifest must contain a supported family`)}function _(e){let t=ge(e,le,`ExactAdministeredSignerManifestV1`);if(t.kind!==`exact_administered_signer_manifest_v1`)throw Error(`ExactAdministeredSignerManifestV1.kind is invalid`);let n=pe(t.keyFamilies);if(!Array.isArray(t.signers))throw Error(`ExactAdministeredSignerManifestV1.signers must be an array`);let r=[];for(let e=0;e<t.signers.length;e+=1)r.push(fe(t.signers[e],`signers[${e}]`));let i=g(r);if(!me(n,i.keyFamilies))throw Error(`ExactAdministeredSignerManifestV1.keyFamilies do not match signers`);return i}function fe(e,t){let n=l(e,t);switch(n.keyFamily){case`ed25519`:if(f(n,ue,t),n.kind!==`exact_administered_ed25519_signer_v1`)throw Error(`${t}.kind is invalid for Ed25519`);return{kind:`exact_administered_ed25519_signer_v1`,keyFamily:`ed25519`,walletId:p(r(n.walletId),`${t}.walletId`),walletKeyId:p(s(n.walletKeyId),`${t}.walletKeyId`),registeredPublicKeyB64u:re(n.registeredPublicKeyB64u,`${t}.registeredPublicKeyB64u`)};case`ecdsa_secp256k1`:if(f(n,de,t),n.kind!==`exact_administered_ecdsa_signer_v1`)throw Error(`${t}.kind is invalid for ECDSA`);return{kind:`exact_administered_ecdsa_signer_v1`,keyFamily:`ecdsa_secp256k1`,walletId:p(r(n.walletId),`${t}.walletId`),walletKeyId:p(s(n.walletKeyId),`${t}.walletKeyId`),thresholdPublicKey33B64u:te(n.thresholdPublicKey33B64u,`${t}.thresholdPublicKey33B64u`),evmAddress:he(n.evmAddress,`${t}.evmAddress`)};default:throw Error(`${t}.keyFamily is unsupported`)}}function pe(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`ExactAdministeredSignerManifestV1.keyFamilies must be non-empty`);if(e.length===1&&e[0]===`ed25519`)return[`ed25519`];if(e.length===1&&e[0]===`ecdsa_secp256k1`)return[`ecdsa_secp256k1`];if(e.length===2&&e[0]===`ed25519`&&e[1]===`ecdsa_secp256k1`)return[`ed25519`,`ecdsa_secp256k1`];throw Error(`ExactAdministeredSignerManifestV1.keyFamilies must be canonical and duplicate-free`)}function me(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function he(e,t){if(typeof e!=`string`||!/^0x[0-9a-fA-F]{40}$/.test(e))throw Error(`${t} must be a 20-byte hexadecimal EVM address`);return e}function ge(e,t,n){let r=l(e,n);f(r,t,n);for(let e of t)if(!(e in r))throw Error(`${n}.${e} is required`);return r}async function _e(e){return se(ae({version:`wallet_auth_method_revoke_operation_v1`,walletId:String(e.walletId),targetWalletAuthMethodId:String(e.targetWalletAuthMethodId),requestedAtMs:e.requestedAtMs}))}function ve(e,t){if(e.version!==t.version||e.walletAuthMethodId!==t.walletAuthMethodId||e.walletId!==t.walletId||e.walletAuthorityId!==t.walletAuthorityId||e.status!==t.status||e.createdAtMs!==t.createdAtMs||e.updatedAtMs!==t.updatedAtMs)return!1;switch(e.kind){case`passkey`:if(t.kind!==`passkey`)return!1;if(e.rpId===t.rpId&&e.credentialIdB64u===t.credentialIdB64u&&e.credentialPublicKeyB64u===t.credentialPublicKeyB64u&&e.counter===t.counter)break;return!1;case`email_otp`:if(t.kind!==`email_otp`)return!1;if(e.emailHashHex===t.emailHashHex&&e.registrationAuthorityId===t.registrationAuthorityId)break;return!1;default:return v(e,`wallet auth method kind`)}switch(e.status){case`pending_local_install`:return t.status===`pending_local_install`;case`active`:return t.status===`active`&&e.activatedAtMs===t.activatedAtMs;case`revoked`:return t.status===`revoked`&&e.activatedAtMs===t.activatedAtMs&&e.revokedAtMs===t.revokedAtMs;default:return v(e,`wallet auth method lifecycle`)}}function v(e,t){throw Error(`${t} branch is unsupported: ${String(e)}`)}function ye(e){if(Se(e),e.kind===`passkey`)switch(e.status){case`pending_local_install`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.walletAuthMethodId,walletId:e.walletId,walletAuthorityId:e.walletAuthorityId,kind:`passkey`,status:`pending_local_install`,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,credentialPublicKeyB64u:e.credentialPublicKeyB64u,counter:e.counter,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs};case`active`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.walletAuthMethodId,walletId:e.walletId,walletAuthorityId:e.walletAuthorityId,kind:`passkey`,status:`active`,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,credentialPublicKeyB64u:e.credentialPublicKeyB64u,counter:e.counter,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs,activatedAtMs:e.activatedAtMs};case`revoked`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.walletAuthMethodId,walletId:e.walletId,walletAuthorityId:e.walletAuthorityId,kind:`passkey`,status:`revoked`,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,credentialPublicKeyB64u:e.credentialPublicKeyB64u,counter:e.counter,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs,activatedAtMs:e.activatedAtMs,revokedAtMs:e.revokedAtMs}}switch(e.status){case`pending_local_install`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.walletAuthMethodId,walletId:e.walletId,walletAuthorityId:e.walletAuthorityId,kind:`email_otp`,status:`pending_local_install`,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs};case`active`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.walletAuthMethodId,walletId:e.walletId,walletAuthorityId:e.walletAuthorityId,kind:`email_otp`,status:`active`,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs,activatedAtMs:e.activatedAtMs};case`revoked`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.walletAuthMethodId,walletId:e.walletId,walletAuthorityId:e.walletAuthorityId,kind:`email_otp`,status:`revoked`,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs,activatedAtMs:e.activatedAtMs,revokedAtMs:e.revokedAtMs}}}function be(e){let t=ce(e);if(!t||!(`version`in t)||!(`kind`in t)||!(`status`in t))return null;let r=h(t.version),i=h(t.kind),a=h(t.status);if(r!==`wallet_auth_method_v2`||i!==`passkey`&&i!==`email_otp`)return null;try{let e=xe(t);if(i===`passkey`){if(!(`rpId`in t)||!(`credentialIdB64u`in t)||!(`credentialPublicKeyB64u`in t)||!(`counter`in t))return null;we(t,`passkey`,a);let r=n(t.rpId),i=o(t.credentialIdB64u);return!r.ok||!i.ok||typeof t.credentialPublicKeyB64u!=`string`||!t.credentialPublicKeyB64u.trim()||Object.prototype.hasOwnProperty.call(t,`emailHashHex`)||Object.prototype.hasOwnProperty.call(t,`registrationAuthorityId`)?null:Te({common:e,lifecycle:Ce(t),rpId:r.value,credentialIdB64u:i.value,credentialPublicKeyB64u:t.credentialPublicKeyB64u,counter:y(t.counter)})}if(!(`emailHashHex`in t)||!(`registrationAuthorityId`in t))return null;we(t,`email_otp`,a);let r=h(t.emailHashHex),s=h(t.registrationAuthorityId);return!r||!s||Object.prototype.hasOwnProperty.call(t,`rpId`)||Object.prototype.hasOwnProperty.call(t,`credentialIdB64u`)||Object.prototype.hasOwnProperty.call(t,`credentialPublicKeyB64u`)||Object.prototype.hasOwnProperty.call(t,`counter`)?null:Ee({common:e,lifecycle:Ce(t),emailHashHex:r,registrationAuthorityId:s})}catch{return null}}function xe(e){if(!(`walletAuthMethodId`in e)||!(`walletId`in e)||!(`walletAuthorityId`in e)||!(`createdAtMs`in e)||!(`updatedAtMs`in e))throw Error(`wallet auth method common fields are required`);return{version:`wallet_auth_method_v2`,walletAuthMethodId:De(e.walletAuthMethodId),walletId:Oe(e.walletId),walletAuthorityId:ke(e.walletAuthorityId),createdAtMs:y(e.createdAtMs),updatedAtMs:y(e.updatedAtMs)}}function Se(e){if(e.version!==`wallet_auth_method_v2`)throw Error(`wallet auth method record version is unsupported`);if(!e.walletAuthMethodId||!e.walletId||!e.walletAuthorityId)throw Error(`wallet auth method record identities are required`);if(!Number.isSafeInteger(e.createdAtMs)||e.createdAtMs<0)throw Error(`wallet auth method createdAtMs must be a non-negative safe integer`);if(!Number.isSafeInteger(e.updatedAtMs)||e.updatedAtMs<e.createdAtMs)throw Error(`wallet auth method updatedAtMs must follow createdAtMs`);if(e.kind===`passkey`){if(!e.rpId||!e.credentialIdB64u||!e.credentialPublicKeyB64u.trim())throw Error(`passkey wallet auth method fields are required`);if(!Number.isSafeInteger(e.counter)||e.counter<0)throw Error(`passkey authenticator counter must be non-negative`)}else if(!e.emailHashHex.trim()||!e.registrationAuthorityId.trim())throw Error(`email OTP wallet auth method fields are required`);switch(e.status){case`pending_local_install`:return;case`active`:b(e.activatedAtMs,`activatedAtMs`);return;case`revoked`:if(b(e.activatedAtMs,`activatedAtMs`),b(e.revokedAtMs,`revokedAtMs`),e.revokedAtMs<e.activatedAtMs)throw Error(`revokedAtMs cannot precede activatedAtMs`);return}}function Ce(e){if(!(`status`in e))throw Error(`wallet auth method status is required`);switch(e.status){case`pending_local_install`:return{status:`pending_local_install`};case`active`:if(!(`activatedAtMs`in e))throw Error(`wallet auth method activatedAtMs is required`);return{status:`active`,activatedAtMs:y(e.activatedAtMs)};case`revoked`:if(!(`activatedAtMs`in e)||!(`revokedAtMs`in e))throw Error(`wallet auth method revocation timestamps are required`);return{status:`revoked`,activatedAtMs:y(e.activatedAtMs),revokedAtMs:y(e.revokedAtMs)};default:throw Error(`wallet auth method status is unsupported`)}}function we(e,t,n){let r=[`version`,`walletAuthMethodId`,`walletId`,`walletAuthorityId`,`kind`,`status`,`createdAtMs`,`updatedAtMs`];if(t===`passkey`?r.push(`rpId`,`credentialIdB64u`,`credentialPublicKeyB64u`,`counter`):r.push(`emailHashHex`,`registrationAuthorityId`),n===`active`&&r.push(`activatedAtMs`),n===`revoked`&&r.push(`activatedAtMs`,`revokedAtMs`),n!==`pending_local_install`&&n!==`active`&&n!==`revoked`)throw Error(`wallet auth method status is unsupported`);let i=new Set(r),a=Object.keys(e);if(a.length!==r.length)throw Error(`wallet auth method record has invalid fields`);for(let e of a)if(!i.has(e))throw Error(`wallet auth method field ${e} is invalid`)}function Te(e){switch(e.lifecycle.status){case`pending_local_install`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.common.walletAuthMethodId,walletId:e.common.walletId,walletAuthorityId:e.common.walletAuthorityId,kind:`passkey`,status:`pending_local_install`,createdAtMs:e.common.createdAtMs,updatedAtMs:e.common.updatedAtMs,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,credentialPublicKeyB64u:e.credentialPublicKeyB64u,counter:e.counter};case`active`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.common.walletAuthMethodId,walletId:e.common.walletId,walletAuthorityId:e.common.walletAuthorityId,kind:`passkey`,status:`active`,createdAtMs:e.common.createdAtMs,updatedAtMs:e.common.updatedAtMs,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,credentialPublicKeyB64u:e.credentialPublicKeyB64u,counter:e.counter,activatedAtMs:e.lifecycle.activatedAtMs};case`revoked`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.common.walletAuthMethodId,walletId:e.common.walletId,walletAuthorityId:e.common.walletAuthorityId,kind:`passkey`,status:`revoked`,createdAtMs:e.common.createdAtMs,updatedAtMs:e.common.updatedAtMs,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,credentialPublicKeyB64u:e.credentialPublicKeyB64u,counter:e.counter,activatedAtMs:e.lifecycle.activatedAtMs,revokedAtMs:e.lifecycle.revokedAtMs}}}function Ee(e){switch(e.lifecycle.status){case`pending_local_install`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.common.walletAuthMethodId,walletId:e.common.walletId,walletAuthorityId:e.common.walletAuthorityId,kind:`email_otp`,status:`pending_local_install`,createdAtMs:e.common.createdAtMs,updatedAtMs:e.common.updatedAtMs,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId};case`active`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.common.walletAuthMethodId,walletId:e.common.walletId,walletAuthorityId:e.common.walletAuthorityId,kind:`email_otp`,status:`active`,createdAtMs:e.common.createdAtMs,updatedAtMs:e.common.updatedAtMs,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,activatedAtMs:e.lifecycle.activatedAtMs};case`revoked`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.common.walletAuthMethodId,walletId:e.common.walletId,walletAuthorityId:e.common.walletAuthorityId,kind:`email_otp`,status:`revoked`,createdAtMs:e.common.createdAtMs,updatedAtMs:e.common.updatedAtMs,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,activatedAtMs:e.lifecycle.activatedAtMs,revokedAtMs:e.lifecycle.revokedAtMs}}}function De(e){let t=i(e);if(!t.ok)throw Error(t.error.message);return t.value}function Oe(e){let t=r(e);if(!t.ok)throw Error(t.error.message);return t.value}function ke(e){let n=t(e);if(!n.ok)throw Error(n.error.message);return n.value}function y(e){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`value must be a non-negative safe integer`);return e}function b(e,t){if(!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`)}const Ae=new TextEncoder;function x(e){let t=0;for(let n of e)t+=n.length;let n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function S(e,t){if(!Number.isSafeInteger(e)||e<0||e>4294967295)throw Error(`${t} must be a non-negative u32`);return Uint8Array.from([e>>>24&255,e>>>16&255,e>>>8&255,e&255])}function je(e,t){if(!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);let n=BigInt(e),r=new Uint8Array(8);for(let e=7;e>=0;--e)r[e]=Number(n&255n),n>>=8n;return r}function C(e,t){return x([S(e.length,`${t}.length`),e])}function w(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);return C(Ae.encode(e),t)}function Me(e,t){try{let t=d(m(e));if(t.length!==32)throw Error(`must decode to 32 bytes`);return t}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is invalid`}`)}}function T(e,t){try{let t=d(e);if(t.length===0||u(t)!==e)throw Error(`must be canonical base64url`);return t}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is invalid`}`)}}function E(e){return q(e)}function Ne(e){return K(e.signerActivations)}function Pe(e){return G(e.signerActivations)}function Fe(e){return e.provenance.kind===`wallet_recovery`}function D(e){return{kind:`wallet_ed25519_signer_activation_v1`,signer:e.signer,materialActivation:e.materialActivation}}function O(e){return{kind:`wallet_ecdsa_signer_activation_v1`,signer:e.signer,materialActivation:e.materialActivation}}function k(e){let t=_(e.manifest),n=lt(e.materialActivations);if(!rt(t.keyFamilies,n.keyFamilies))throw Error(`wallet signer activation materials must match the signer manifest families`);if(it(t)){if(!W(n))throw Error(`Ed25519 signer activation requires one Ed25519 material activation`);return{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ed25519`],ed25519:D({signer:t.signers[0],materialActivation:n.ed25519})}}if(at(t)){if(!st(n))throw Error(`ECDSA signer activation requires one ECDSA material activation`);return{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ecdsa_secp256k1`],ecdsa:O({signer:t.signers[0],materialActivation:n.ecdsa})}}if(!ot(t)||!ct(n))throw Error(`wallet signer activation set has unsupported families`);if(n.ed25519.activationId===n.ecdsa.activationId)throw Error(`wallet signer activation references must be distinct`);return{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:D({signer:t.signers[0],materialActivation:n.ed25519}),ecdsa:O({signer:t.signers[1],materialActivation:n.ecdsa})}}function Ie(e){try{let t=l(e,`WalletSignerActivationSetV1`);if(t.kind!==`wallet_signer_activation_set_v1`)return Q(`wallet signer activation set kind is unsupported`);if(!Object.prototype.hasOwnProperty.call(t,`keyFamilies`))return Q(`WalletSignerActivationSetV1.keyFamilies is required`);let n=nt(t.keyFamilies,`WalletSignerActivationSetV1.keyFamilies`);if(n.length===1&&n[0]===`ed25519`)return U(t,[`kind`,`keyFamilies`,`ed25519`],`WalletSignerActivationSetV1`),{ok:!0,value:{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ed25519`],ed25519:Xe(t.ed25519,`ed25519`)}};if(n.length===1&&n[0]===`ecdsa_secp256k1`)return U(t,[`kind`,`keyFamilies`,`ecdsa`],`WalletSignerActivationSetV1`),{ok:!0,value:{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ecdsa_secp256k1`],ecdsa:Ze(t.ecdsa,`ecdsa`)}};U(t,[`kind`,`keyFamilies`,`ed25519`,`ecdsa`],`WalletSignerActivationSetV1`);let r=Xe(t.ed25519,`ed25519`),i=Ze(t.ecdsa,`ecdsa`);return r.materialActivation.activationId===i.materialActivation.activationId?Q(`wallet signer activation references must be distinct`):{ok:!0,value:{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:r,ecdsa:i}}}catch(e){return Q($(e,`wallet signer activation set is invalid`))}}function Le(e){let t=[w(`seams/wallet-signer-activation-set/v1`,`domain`),w(e.kind,`kind`),S(e.keyFamilies.length,`keyFamilies`)];for(let n of e.keyFamilies)t.push(w(n,`keyFamilies.item`));return(G(e)||q(e))&&t.push(C(L(e.ed25519),`ed25519`)),(K(e)||q(e))&&t.push(C(R(e.ecdsa),`ecdsa`)),x(t)}async function A(e){return m(u(await oe(Le(e))))}function j(e){return{kind:`wallet_authority_v1`,authorityId:e.authorityId,walletId:e.walletId,principal:e.principal,provenance:e.provenance,permissions:e.permissions,signerActivations:e.signerActivations,signerActivationSetDigestB64u:e.signerActivationSetDigestB64u,authorityDigestB64u:e.authorityDigestB64u,revocationEpoch:e.revocationEpoch,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs}}function Re(e){return F(e),{...j(e),state:`pending_local_install`,localInstallPackageSetDigestB64u:e.localInstallPackageSetDigestB64u}}function ze(e){return F(e),{...j(e),state:`active`,activatedAtMs:e.activatedAtMs}}async function Be(e){let t=e.authority.signerActivations;if(!t.ed25519)throw Error(`active Wallet Authority has no Ed25519 material activation to replace`);let n=t.ecdsa?k({manifest:g([t.ed25519.signer,t.ecdsa.signer]),materialActivations:{keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:e.materialActivation,ecdsa:t.ecdsa.materialActivation}}):k({manifest:g([t.ed25519.signer]),materialActivations:{keyFamilies:[`ed25519`],ed25519:e.materialActivation}}),r=await A(n),i={kind:e.authority.kind,authorityId:e.authority.authorityId,walletId:e.authority.walletId,principal:e.authority.principal,provenance:e.authority.provenance,permissions:e.authority.permissions,signerActivations:n,signerActivationSetDigestB64u:r,authorityDigestB64u:e.authority.authorityDigestB64u,revocationEpoch:e.authority.revocationEpoch,createdAtMs:e.authority.createdAtMs,updatedAtMs:Math.max(e.authority.updatedAtMs,e.updatedAtMs),state:`active`,activatedAtMs:e.authority.activatedAtMs};return ze({...i,authorityDigestB64u:await N(i)})}function Ve(e){return F(e),{...j(e),state:`active`,activatedAtMs:e.activatedAtMs}}function He(e){return F(e),{...j(e),state:`revoked`,activatedAtMs:e.activatedAtMs,revokedAtMs:e.revokedAtMs}}const M=[`kind`,`authorityId`,`walletId`,`principal`,`provenance`,`permissions`,`signerActivations`,`signerActivationSetDigestB64u`,`authorityDigestB64u`,`revocationEpoch`,`createdAtMs`,`updatedAtMs`,`state`];function Ue(e){try{let t=l(e,`WalletAuthorityV1`),n=Ke(t);switch(t.state){case`pending_local_install`:return U(t,[...M,`localInstallPackageSetDigestB64u`],`WalletAuthorityV1`),{ok:!0,value:Re({kind:`wallet_authority_v1`,...n,state:`pending_local_install`,localInstallPackageSetDigestB64u:J(t.localInstallPackageSetDigestB64u,`localInstallPackageSetDigestB64u`)})};case`active`:return U(t,[...M,`activatedAtMs`],`WalletAuthorityV1`),{ok:!0,value:ze({kind:`wallet_authority_v1`,...n,state:`active`,activatedAtMs:Y(t.activatedAtMs,`activatedAtMs`)})};case`revoked`:return U(t,[...M,`activatedAtMs`,`revokedAtMs`],`WalletAuthorityV1`),{ok:!0,value:He({kind:`wallet_authority_v1`,...n,state:`revoked`,activatedAtMs:Y(t.activatedAtMs,`activatedAtMs`),revokedAtMs:Y(t.revokedAtMs,`revokedAtMs`)})};default:return Q(`WalletAuthorityV1.state is unsupported`)}}catch(e){return Q($(e,`wallet authority is invalid`))}}function We(e){return x([w(`seams/wallet-authority/v1`,`domain`),w(e.kind,`kind`),w(e.authorityId,`authorityId`),w(e.walletId,`walletId`),C(z(e.principal),`principal`),C(B(e.provenance),`provenance`),C(V(e.permissions),`permissions`),Me(e.signerActivationSetDigestB64u,`signerActivationSetDigestB64u`),w(e.state,`state`),je(e.revocationEpoch,`revocationEpoch`)])}async function N(e){return m(u(await oe(We(e))))}async function P(e){return await A(e.signerActivations)===e.signerActivationSetDigestB64u?await N(e)===e.authorityDigestB64u:!1}async function Ge(e,t){let[n,r]=await Promise.all([P(e),P(t)]);return n&&r&&e.authorityDigestB64u===t.authorityDigestB64u&&e.signerActivationSetDigestB64u===t.signerActivationSetDigestB64u&&e.createdAtMs===t.createdAtMs&&e.updatedAtMs===t.updatedAtMs&&e.activatedAtMs===t.activatedAtMs}function Ke(e){if(e.kind!==`wallet_authority_v1`)throw Error(`WalletAuthorityV1.kind is unsupported`);let n=Z(t(e.authorityId),`authorityId`),i=Z(r(e.walletId),`walletId`),a=qe(e.principal),o=Je(e.provenance),s=Z(ne(e.permissions),`permissions`),c=Z(Ie(e.signerActivations),`signerActivations`),ee=J(e.signerActivationSetDigestB64u,`signerActivationSetDigestB64u`),l=J(e.authorityDigestB64u,`authorityDigestB64u`),u=Y(e.revocationEpoch,`revocationEpoch`),d=Y(e.createdAtMs,`createdAtMs`),te=Y(e.updatedAtMs,`updatedAtMs`);return I(c,i),{authorityId:n,walletId:i,principal:a,provenance:o,permissions:s,signerActivations:c,signerActivationSetDigestB64u:ee,authorityDigestB64u:l,revocationEpoch:u,createdAtMs:d,updatedAtMs:te}}function F(e){if(e.kind!==`wallet_authority_v1`)throw Error(`wallet authority kind is unsupported`);if(!Number.isSafeInteger(e.revocationEpoch)||e.revocationEpoch<0)throw Error(`wallet authority revocationEpoch must be a non-negative safe integer`);if(X(e.createdAtMs,`createdAtMs`),X(e.updatedAtMs,`updatedAtMs`),e.updatedAtMs<e.createdAtMs)throw Error(`wallet authority updatedAtMs cannot precede createdAtMs`);switch(J(e.signerActivationSetDigestB64u,`signerActivationSetDigestB64u`),J(e.authorityDigestB64u,`authorityDigestB64u`),I(e.signerActivations,e.walletId),Ye(e.provenance),e.state){case`pending_local_install`:J(e.localInstallPackageSetDigestB64u,`localInstallPackageSetDigestB64u`);break;case`active`:X(e.activatedAtMs,`activatedAtMs`);break;case`revoked`:if(X(e.activatedAtMs,`activatedAtMs`),X(e.revokedAtMs,`revokedAtMs`),e.revokedAtMs<e.activatedAtMs)throw Error(`revokedAtMs cannot precede activatedAtMs`);break}}function qe(e){let t=H(e,[`kind`,`deviceId`],`WalletAuthorityPrincipalV1`);if(t.kind!==`owner_device`)throw Error(`wallet authority principal kind is unsupported`);return{kind:`owner_device`,deviceId:Z(ie(t.deviceId),`deviceId`)}}function Je(n){let r=l(n,`WalletAuthorityProvenanceV1`);switch(r.kind){case`wallet_registration`:return U(r,[`kind`],`WalletAuthorityProvenanceV1`),{kind:`wallet_registration`};case`device_link`:return U(r,[`kind`,`enrollmentId`,`sourceAuthorityId`,`linkSessionId`],`WalletAuthorityProvenanceV1`),{kind:`device_link`,enrollmentId:Z(ee(r.enrollmentId),`enrollmentId`),sourceAuthorityId:Z(t(r.sourceAuthorityId),`sourceAuthorityId`),linkSessionId:Z(c(r.linkSessionId),`linkSessionId`)};case`wallet_recovery`:return U(r,[`kind`,`recoveryOperationId`,`continuityAuthorityId`],`WalletAuthorityProvenanceV1`),{kind:`wallet_recovery`,recoveryOperationId:Z(e(r.recoveryOperationId),`recoveryOperationId`),continuityAuthorityId:Z(t(r.continuityAuthorityId),`continuityAuthorityId`)};default:throw Error(`wallet authority provenance kind is unsupported`)}}function Ye(e){switch(e.kind){case`wallet_registration`:return;case`device_link`:if(!e.enrollmentId||!e.sourceAuthorityId||!e.linkSessionId)throw Error(`device-link provenance requires every audit identity`);return;case`wallet_recovery`:if(!e.recoveryOperationId||!e.continuityAuthorityId)throw Error(`wallet-recovery provenance requires every audit identity`);return}ut(e,`wallet authority provenance`)}function I(e,t){if(G(e)){if(e.ed25519.signer.walletId!==t)throw Error(`Ed25519 signer activation uses a different wallet id`);return}if(K(e)){if(e.ecdsa.signer.walletId!==t)throw Error(`ECDSA signer activation uses a different wallet id`);return}if(q(e)){if(e.ed25519.signer.walletId!==t||e.ecdsa.signer.walletId!==t)throw Error(`signer activations must use the authority wallet id`);return}throw Error(`wallet signer activation families are unsupported`)}function Xe(e,t){let n=H(e,[`kind`,`signer`,`materialActivation`],t);if(n.kind!==`wallet_ed25519_signer_activation_v1`)throw Error(`${t}.kind is invalid`);let r=Qe(n.signer,`ed25519`,`${t}.signer`);if(!it(r))throw Error(`${t}.signer is not Ed25519`);return D({signer:r.signers[0],materialActivation:Z(a(n.materialActivation),`${t}.materialActivation`)})}function Ze(e,t){let n=H(e,[`kind`,`signer`,`materialActivation`],t);if(n.kind!==`wallet_ecdsa_signer_activation_v1`)throw Error(`${t}.kind is invalid`);let r=Qe(n.signer,`ecdsa_secp256k1`,`${t}.signer`);if(!at(r))throw Error(`${t}.signer is not ECDSA`);return O({signer:r.signers[0],materialActivation:Z(a(n.materialActivation),`${t}.materialActivation`)})}function Qe(e,t,n){return _({kind:`exact_administered_signer_manifest_v1`,keyFamilies:[t],signers:[e]})}function L(e){return x([w(e.kind,`ed25519.kind`),C($e(e.signer),`ed25519.signer`),C(tt(e.materialActivation),`ed25519.materialActivation`)])}function R(e){return x([w(e.kind,`ecdsa.kind`),C(et(e.signer),`ecdsa.signer`),C(tt(e.materialActivation),`ecdsa.materialActivation`)])}function $e(e){return x([w(e.kind,`ed25519.signer.kind`),w(e.keyFamily,`ed25519.signer.keyFamily`),w(e.walletId,`ed25519.signer.walletId`),w(e.walletKeyId,`ed25519.signer.walletKeyId`),C(T(e.registeredPublicKeyB64u,`ed25519.signer.registeredPublicKeyB64u`),`ed25519.signer.registeredPublicKeyB64u`)])}function et(e){return x([w(e.kind,`ecdsa.signer.kind`),w(e.keyFamily,`ecdsa.signer.keyFamily`),w(e.walletId,`ecdsa.signer.walletId`),w(e.walletKeyId,`ecdsa.signer.walletKeyId`),C(T(e.thresholdPublicKey33B64u,`ecdsa.signer.thresholdPublicKey33B64u`),`ecdsa.signer.thresholdPublicKey33B64u`),w(e.evmAddress,`ecdsa.signer.evmAddress`)])}function tt(e){return x([w(e.kind,`materialActivation.kind`),w(e.activationId,`materialActivation.activationId`),w(e.capability,`materialActivation.capability`),w(e.materialOwner,`materialActivation.materialOwner`),w(e.keyBinding,`materialActivation.keyBinding`),w(e.lifecycleBinding,`materialActivation.lifecycleBinding`),w(e.signingWorker,`materialActivation.signingWorker`)])}function z(e){return x([w(e.kind,`principal.kind`),w(e.deviceId,`principal.deviceId`)])}function B(e){switch(e.kind){case`wallet_registration`:return w(e.kind,`provenance.kind`);case`device_link`:return x([w(e.kind,`provenance.kind`),w(e.enrollmentId,`provenance.enrollmentId`),w(e.sourceAuthorityId,`provenance.sourceAuthorityId`),w(e.linkSessionId,`provenance.linkSessionId`)]);case`wallet_recovery`:return x([w(e.kind,`provenance.kind`),w(e.recoveryOperationId,`provenance.recoveryOperationId`),w(e.continuityAuthorityId,`provenance.continuityAuthorityId`)])}return ut(e,`wallet authority provenance`)}function V(e){let t=[S(e.length,`permissions`)];for(let n of e)t.push(C(w(n,`permissions.item`),`permissions.item`));return x(t)}function H(e,t,n){let r=l(e,n);return U(r,t,n),r}function U(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==t.length)throw Error(`${n} contains unexpected fields`);for(let e of i)if(!r.has(e))throw Error(`${n}.${e} is not allowed`);for(let r of t)if(!Object.prototype.hasOwnProperty.call(e,r))throw Error(`${n}.${r} is required`)}function nt(e,t){if(!Array.isArray(e))throw Error(`${t} must be an array`);if(e.length===1&&e[0]===`ed25519`)return[`ed25519`];if(e.length===1&&e[0]===`ecdsa_secp256k1`)return[`ecdsa_secp256k1`];if(e.length===2&&e[0]===`ed25519`&&e[1]===`ecdsa_secp256k1`)return[`ed25519`,`ecdsa_secp256k1`];throw Error(`${t} must use canonical family order`)}function rt(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function it(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`}function at(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`}function ot(e){return e.keyFamilies.length===2}function W(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`}function st(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`}function ct(e){return e.keyFamilies.length===2}function lt(e){if(W(e))return{keyFamilies:[`ed25519`],ed25519:Z(a(e.ed25519),`materialActivations.ed25519`)};if(st(e))return{keyFamilies:[`ecdsa_secp256k1`],ecdsa:Z(a(e.ecdsa),`materialActivations.ecdsa`)};if(ct(e))return{keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:Z(a(e.ed25519),`materialActivations.ed25519`),ecdsa:Z(a(e.ecdsa),`materialActivations.ecdsa`)};throw Error(`wallet signer activation materials are unsupported`)}function G(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`}function K(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`}function q(e){return e.keyFamilies.length===2}function J(e,t){try{return m(e)}catch(e){throw Error(`${t} ${$(e,`is invalid`)}`)}}function Y(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function X(e,t){if(!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`)}function Z(e,t){if(e.ok)return e.value;throw Error(`${t} ${e.error.message}`)}function Q(e){return{ok:!1,error:{code:`invalid`,message:e}}}function $(e,t){return e instanceof Error?e.message:t}function ut(e,t){throw Error(`${t} branch is unsupported: ${String(e)}`)}async function dt(e,t,n){let r=await A(t),i={kind:`wallet_authority_v1`,authorityId:e.authorityId,walletId:e.walletId,principal:e.principal,provenance:e.provenance,permissions:e.permissions,signerActivations:t,signerActivationSetDigestB64u:r,authorityDigestB64u:e.authorityDigestB64u,revocationEpoch:e.revocationEpoch,createdAtMs:e.createdAtMs,updatedAtMs:Math.max(e.updatedAtMs,n),state:`active`,activatedAtMs:e.activatedAtMs};return Ve({...i,authorityDigestB64u:await N(i)})}async function ft(e){if(e.ed25519.signer.walletId!==e.authority.walletId)throw Error(`NEAR signer belongs to a different wallet authority`);let t=e.authority.signerActivations.ecdsa,n=e.ed25519.signer,r=k({manifest:g([n,t.signer]),materialActivations:{keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:e.ed25519.materialActivation,ecdsa:t.materialActivation}});if(!E(r))throw Error(`Deferred Ed25519 activation did not produce a combined signer activation set`);return dt(e.authority,r,e.now)}function pt(e,t){return e.authorityId===t.authorityId&&e.walletId===t.walletId&&e.revocationEpoch===t.revocationEpoch&&e.createdAtMs===t.createdAtMs&&e.activatedAtMs===t.activatedAtMs&&u(z(e.principal))===u(z(t.principal))&&u(B(e.provenance))===u(B(t.provenance))&&u(V(e.permissions))===u(V(t.permissions))}function mt(e,t){return Pe(e)&&E(t.signerActivations)&&pt(e,t)&&u(L(e.signerActivations.ed25519))===u(L(t.signerActivations.ed25519))}function ht(e,t){return Ne(e)&&E(t.signerActivations)&&e.provenance.kind===`wallet_registration`&&pt(e,t)&&u(R(e.signerActivations.ecdsa))===u(R(t.signerActivations.ecdsa))}export{_e as C,_ as E,ye as S,ve as T,Me as _,Ne as a,S as b,mt as c,Ie as d,Be as f,C as g,x as h,ft as i,ht as l,P as m,A as n,Fe as o,Ge as p,Le as r,E as s,N as t,Ue as u,T as v,be as w,je as x,w as y};