@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/sdk/{walletIframeIdentity-C0b0XMQF.js → walletIframeIdentity-DJ0KOBHg.js}

@@ -1 +1 @@
-function e(e,t){if(typeof e!=`string`||!e.trim())throw Error(`${t} must be a non-empty string`);return e.trim()}function t(t){return e(t,`surfaceId`)}function n(t){return e(t,`requestId`)}export{t as n,n as t};
+function e(e,t){if(typeof e!=`string`||!e.trim())throw Error(`${t} must be a non-empty string`);return e.trim()}function t(t){return e(t,`requestId`)}export{t};

package/dist/esm/sdk/walletOwnershipGeneration-DoXVMDWe.js

@@ -0,0 +1 @@
+import{O as e,T as t,f as n,p as r}from"./normalize-kUDm5zfS.js";import{E as i,c as a,k as o,l as s}from"./chains-CiYQT1K4.js";import{i as c,r as l}from"./base64-CsEj-_bC.js";import{y as u}from"./primitives-CAcl7ON7.js";import{i as d,n as f,r as p}from"./canonicalPrimitives-CKPGgpxg.js";import{a as m}from"./ecdsaChainTarget-C8ZtMZ8l.js";import{a as h,i as g,t as _}from"./singletons-8UH3gOnZ.js";import{Bt as v,C as ee,G as te,Gt as ne,Ht as y,It as b,Jt as re,Lt as x,Pt as ie,Rt as S,Ut as ae,Wt as C,Yt as oe,Zt as se,gt as ce,ht as le,jt as w,ot as ue,p as de,tn as fe,tt as pe,ut as me,vt as he,w as ge,zt as T}from"./emailOtpEcdsaDerivationIdentity-B8HzTh4T.js";import{A as E,B as _e,C as ve,I as ye,M as be,P as xe,_ as Se,a as D,b as O,c as Ce,d as we,f as Te,g as Ee,h as De,i as Oe,j as k,l as ke,m as A,n as Ae,o as je,p as j,r as Me,s as Ne,t as Pe,u as Fe,v as Ie,z as Le}from"./ecdsaCapabilityManifest-BlzJAQF8.js";import"./presignatures-DB2IPD-A.js";const M=`seams/router-ab-ecdsa-presign/fixed-2of2/v1`;function N(e,t){if(typeof e!=`string`||!e)throw Error(`${t} is required`);if(e.trim()!==e)throw Error(`${t} must be canonical`);return e}function P(e){if(typeof e!=`object`||!e)throw Error(`poolIdentity is required`);let t=e;if(!Number.isSafeInteger(t.ownershipGeneration)||Number(t.ownershipGeneration)<1)throw Error(`poolIdentity.ownershipGeneration must be a positive safe integer`);if(t.pairRole!==`client`)throw Error(`poolIdentity.pairRole must be client`);if(t.protocolId!==`seams/router-ab-ecdsa-presign/fixed-2of2/v1`)throw Error(`poolIdentity.protocolId is unsupported`);let n=N(t.relayerUrl,`poolIdentity.relayerUrl`);if(n.replace(/\/+$/g,``)!==n)throw Error(`poolIdentity.relayerUrl must be canonical`);return{ownershipGeneration:Number(t.ownershipGeneration),relayerUrl:n,materialActivationB64u:N(t.materialActivationB64u,`poolIdentity.materialActivationB64u`),materialActivationId:N(t.materialActivationId,`poolIdentity.materialActivationId`),capability:N(t.capability,`poolIdentity.capability`),keyBinding:N(t.keyBinding,`poolIdentity.keyBinding`),walletId:N(t.walletId,`poolIdentity.walletId`),signingScopeB64u:N(t.signingScopeB64u,`poolIdentity.signingScopeB64u`),pairRole:`client`,keyEpoch:N(t.keyEpoch,`poolIdentity.keyEpoch`),activationEpoch:Re(t.activationEpoch),protocolId:M}}function Re(t){let n=e(t);if(!n.ok)throw Error(`poolIdentity.activationEpoch is invalid`);return n.value}function ze(e,t){return e.ownershipGeneration===t.ownershipGeneration&&e.relayerUrl===t.relayerUrl&&e.materialActivationB64u===t.materialActivationB64u&&e.materialActivationId===t.materialActivationId&&e.capability===t.capability&&e.keyBinding===t.keyBinding&&e.walletId===t.walletId&&e.signingScopeB64u===t.signingScopeB64u&&e.pairRole===t.pairRole&&e.keyEpoch===t.keyEpoch&&e.activationEpoch===t.activationEpoch&&e.protocolId===t.protocolId}function F(e){return[e.protocolId,e.relayerUrl,e.signingScopeB64u,e.materialActivationB64u,e.ownershipGeneration].join(`|`)}function Be(e){let t=te(e.scope),n=e.materialActivation,r=String(e.relayerUrl||``).trim().replace(/\/+$/g,``);return{ownershipGeneration:e.ownershipGeneration,relayerUrl:r,materialActivationB64u:c(se(n)),materialActivationId:n.activation_id,capability:n.capability,keyBinding:n.key_binding,walletId:t.wallet_id,signingScopeB64u:c(me(t)),pairRole:`client`,keyEpoch:t.signing_worker.key_epoch,activationEpoch:t.activation_epoch,protocolId:M}}const Ve=`ecdsa_capability_manifest_v3`,He=`ecdsa_current_capability_manifest_v2`,Ue=`ecdsa_role_local_material_v2`,We=`ecdsa_activation_commit_journal_v1`,Ge=`ecdsa_material_sealing_key_v1`,Ke=h.ecdsaCapabilityManifests,qe=h.ecdsaCurrentCapabilityManifests,Je=h.ecdsaRoleLocalMaterial,Ye=h.ecdsaActivationCommitJournals,Xe=h.ecdsaMaterialSealingKeys,I=h.ecdsaClientPresignatures;function L(e,t,n){let r=Object.keys(e).sort(),i=[...n].sort();if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`${t} has unexpected fields`)}function Ze(e){let t=w(e.authority);if(!t)throw Error(`ECDSA capability selector authority is invalid`);return{capability:O(r(e.capability)),authority:t}}function R(e){return{capability:e.capability,authority:e.authority}}function z(e){return R(e.candidate.activationBinding.signer)}function B(e){return R(e.signer)}function V(e){return[String(e.capability),String(e.authority.walletId),String(e.authority.authorityDigest)]}function H(e){return{capability_ref:e.capability,wallet_id:e.authority.walletId,authority_digest:e.authority.authorityDigest,wallet_auth_method_id:e.authority.walletAuthMethodId}}function Qe(e){return w({kind:`wallet_auth_authority_ref`,walletId:e.wallet_id,authorityDigest:e.authority_digest,walletAuthMethodId:e.wallet_auth_method_id})}function $e(e,t){return e.kind===t.kind&&e.walletId===t.walletId&&e.authorityDigest===t.authorityDigest&&e.walletAuthMethodId===t.walletAuthMethodId}function et(e,t){let n=V(e),r=V(t);return n[0]===r[0]&&n[1]===r[1]&&n[2]===r[2]}function U(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function tt(e,t){return e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}function W(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`evm`:return t.kind===`evm`&&e.namespace===t.namespace&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;case`tempo`:return t.kind===`tempo`&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;default:return Y(e)}}function nt(e,t){return e.kind===t.kind&&e.targetMemberships.length===t.targetMemberships.length&&e.targetMemberships.every((e,n)=>W(e,t.targetMemberships[n]))}function G(e,t){return e.kind===t.kind&&e.keyHandle===t.keyHandle&&e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId&&e.clientVerifyingPublicKey33B64u===t.clientVerifyingPublicKey33B64u&&U(e.participantIds,t.participantIds)&&e.relayerKeyId===t.relayerKeyId}function rt(e,t){return e.walletId===t.walletId&&W(e.chainTarget,t.chainTarget)&&e.keyHandle===t.keyHandle&&e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId&&e.signingRootId===t.signingRootId&&e.signingRootVersion===t.signingRootVersion&&e.applicationBindingDigestB64u===t.applicationBindingDigestB64u&&e.clientParticipantId===t.clientParticipantId&&e.relayerParticipantId===t.relayerParticipantId&&U(e.participantIds,t.participantIds)&&e.contextBinding32B64u===t.contextBinding32B64u&&e.derivationClientSharePublicKey33B64u===t.derivationClientSharePublicKey33B64u&&e.relayerPublicKey33B64u===t.relayerPublicKey33B64u&&e.groupPublicKey33B64u===t.groupPublicKey33B64u&&e.ethereumAddress===t.ethereumAddress&&ce(e.publicCapability,t.publicCapability)}function it(e,t){return e.kind===t.kind&&e.keyHandle===t.keyHandle&&e.publicKeyB64u===t.publicKeyB64u&&U(e.participantIds,t.participantIds)&&e.thresholdOwnerAddress===t.thresholdOwnerAddress}function at(e,t){return e.manifestId===t.manifestId&&e.manifestRevision===t.manifestRevision}function ot(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`no_current_manifest`:return!0;case`exact_manifest`:return t.kind===`exact_manifest`&&e.manifestId===t.manifestId&&e.manifestRevision===t.manifestRevision;default:return Y(e)}}function st(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`no_current_generation`:return!0;case`exact_generation`:return t.kind===`exact_generation`&&e.serverGeneration===t.serverGeneration;default:return Y(e)}}function ct(e,t){return e.kind===t.kind&&e.capability===t.capability&&e.signerId===t.signerId&&e.walletId===t.walletId&&$e(e.authority,t.authority)&&nt(e.scope,t.scope)&&e.materialOwner===t.materialOwner&&e.signingRootId===t.signingRootId&&e.signingRootVersion===t.signingRootVersion}function lt(e,t){return ct(e,t)&&it(e.registeredPublicFacts,t.registeredPublicFacts)}function ut(e,t){return e.kind===t.kind&&e.sealingKeyId===t.sealingKeyId&&e.iv12B64u===t.iv12B64u&&e.ciphertextB64u===t.ciphertextB64u&&e.ciphertextDigest===t.ciphertextDigest}function dt(e,t){return e.kind===t.kind&&at(e.targetManifest,t.targetManifest)&&ct(e.signer,t.signer)&&G(e.roleLocalBinding,t.roleLocalBinding)&&e.bindingDigest===t.bindingDigest&&e.durableMaterialRef===t.durableMaterialRef}function K(e,t){return e.kind===t.kind&&e.correlationId===t.correlationId&&e.activationRequestDigest===t.activationRequestDigest&&e.serverGeneration===t.serverGeneration&&ft(e.serverActivationReceipt,t.serverActivationReceipt)}function ft(e,t){return e.kind===t.kind&&e.lifecycleId===t.lifecycleId&&e.activationDigest===t.activationDigest&&e.activatedAt===t.activatedAt&&he(e.protocolReceipt,t.protocolReceipt)}function pt(e,t){return e.kind===t.kind&&e.correlationId===t.correlationId&&st(e.expectedGeneration,t.expectedGeneration)&&e.requestDigest===t.requestDigest&&e.canonicalRequest===t.canonicalRequest}function mt(e,t){return e.kind===t.kind&&dt(e.activationBinding,t.activationBinding)&&ut(e.encryptedPending,t.encryptedPending)}function ht(e,t){if(e.kind!==t.kind||!(e.journalId===t.journalId&&ot(e.expectedManifest,t.expectedManifest)&&pt(e.activationCommand,t.activationCommand)&&mt(e.candidate,t.candidate)&&e.createdAt===t.createdAt))return!1;switch(e.kind){case`activation_prepared`:return!0;case`server_activation_committed`:return t.kind===`server_activation_committed`&&K(e.serverActivation,t.serverActivation);default:return Y(e)}}function gt(e,t){return e.kind===t.kind&&n(e.materialActivation,t.materialActivation)&&le(e.routerAbEcdsaDerivationNormalSigning,t.routerAbEcdsaDerivationNormalSigning)&&rt(e.roleLocalPublicFacts,t.roleLocalPublicFacts)&&G(e.roleLocalBinding,t.roleLocalBinding)&&e.durableMaterialRef===t.durableMaterialRef&&e.bindingDigest===t.bindingDigest&&e.lifecycleId===t.lifecycleId&&e.ciphertextDigest===t.ciphertextDigest&&e.activationDigest===t.activationDigest&&e.activatedAt===t.activatedAt&&tt(e.runtimePolicyScope,t.runtimePolicyScope)}function _t(e,t){return e.kind===t.kind&&n(e.materialActivation,t.materialActivation)&&K(e.serverActivation,t.serverActivation)&&e.retention===t.retention}function vt(e,t){return e.kind===t.kind&&at(e.identity,t.identity)&&lt(e.signer,t.signer)&&_t(e.activation,t.activation)&&gt(e.durableMaterial,t.durableMaterial)&&e.committedAt===t.committedAt}function yt(e,t){try{let n=o(t.serverActivationReceipt,`ECDSA server activation receipt`);return t.kind===e.kind&&f(t.correlationId)===e.correlationId&&p(t.activationRequestDigest)===e.activationRequestDigest&&C(t.serverGeneration)===e.serverGeneration&&n.kind===e.serverActivationReceipt.kind&&n.lifecycleId===String(e.serverActivationReceipt.lifecycleId)&&n.activationDigest===String(e.serverActivationReceipt.activationDigest)&&d(n.activatedAt)===e.serverActivationReceipt.activatedAt&&he(pe(n.protocolReceipt),e.serverActivationReceipt.protocolReceipt)}catch{return!1}}function bt(e){let t=j({activationBinding:e.preparation.activationBinding,encryptedPending:e.encryptedPending});return xt({...e.preparation,candidate:t})}function xt(e){let t={journalId:e.journalId,candidate:e.candidate,requestDigest:e.requestDigest,canonicalRequest:e.canonicalRequest,createdAt:e.createdAt};switch(e.expectedManifest.kind){case`no_current_manifest`:if(e.expectedGeneration.kind!==`no_current_generation`)throw Error(`Initial ECDSA activation cannot expect a server generation`);return A({...t,expectedManifest:e.expectedManifest,expectedGeneration:e.expectedGeneration});case`exact_manifest`:if(e.expectedGeneration.kind!==`exact_generation`)throw Error(`Replacement ECDSA activation requires an exact server generation`);return A({...t,expectedManifest:e.expectedManifest,expectedGeneration:e.expectedGeneration});default:return Y(e.expectedManifest)}}function St(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be non-empty unpadded base64url`);let n=l(e);if(n.length===0||c(n)!==e)throw n.fill(0),Error(`${t} must be canonical base64url`);return n}function q(e){return new TextEncoder().encode(a(e))}async function Ct(){return await crypto.subtle.generateKey({name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}async function wt(e){let t=St(e.stateBlobB64u,`ECDSA state blob`),n=crypto.getRandomValues(new Uint8Array(12)),r=q(e.aadProjection);try{let i=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n,additionalData:r},e.key,t));try{return{iv12B64u:v(c(n)),ciphertextB64u:S(c(i)),digestB64u:c(await s(i))}}finally{i.fill(0)}}finally{t.fill(0),r.fill(0)}}async function Tt(e){let t=l(e);try{return c(await s(t))}finally{t.fill(0)}}async function Et(e){let t=l(e.iv12B64u),n=l(e.ciphertextB64u),r=q(e.aadProjection),i=null;try{if(i=new Uint8Array(await crypto.subtle.decrypt({name:`AES-GCM`,iv:t,additionalData:r},e.key,n)),i.length===0)throw Error(`decrypted ECDSA state blob must not be empty`);return c(i)}finally{t.fill(0),n.fill(0),r.fill(0),i?.fill(0)}}function Dt(e){let t=o(e,`ECDSA manifest identity`);return L(t,`ECDSA manifest identity`,[`manifestId`,`manifestRevision`]),D({manifestId:b(t.manifestId),manifestRevision:x(t.manifestRevision)})}function Ot(e){let t=o(e,`ECDSA manifest expectation`);switch(t.kind){case`no_current_manifest`:return L(t,`ECDSA no-current manifest expectation`,[`kind`]),we();case`exact_manifest`:return L(t,`ECDSA exact manifest expectation`,[`kind`,`manifestId`,`manifestRevision`]),ke(D({manifestId:b(t.manifestId),manifestRevision:x(t.manifestRevision)}));default:throw Error(`ECDSA manifest expectation kind is invalid`)}}function kt(e){let t=o(e,`ECDSA capability target`);switch(t.kind){case`evm`:return L(t,`ECDSA EVM capability target`,[`kind`,`namespace`,`chainId`,`networkSlug`]),m({kind:t.kind,namespace:t.namespace,chainId:t.chainId,networkSlug:t.networkSlug});case`tempo`:return L(t,`ECDSA Tempo capability target`,[`kind`,`chainId`,`networkSlug`]),m({kind:t.kind,chainId:t.chainId,networkSlug:t.networkSlug});default:throw Error(`ECDSA capability target kind is invalid`)}}function At(e){let t=o(e,`ECDSA capability scope`);if(L(t,`ECDSA capability scope`,[`kind`,`targetMemberships`]),t.kind!==`evm_family`)throw Error(`ECDSA capability scope kind is invalid`);let n=i(t.targetMemberships,`ECDSA capability target memberships`),r=[];for(let e of n)r.push(kt(e));let[a,...s]=r;if(!a)throw Error(`ECDSA capability scope requires at least one target`);return Oe({targetMemberships:[a,...s]})}function jt(e){let t=o(e,`ECDSA role-local material binding`);if(L(t,`ECDSA role-local material binding`,[`kind`,`keyHandle`,`ecdsaThresholdKeyId`,`clientVerifyingPublicKey33B64u`,`participantIds`,`relayerKeyId`]),t.kind!==`ecdsa_role_local_material_binding`)throw Error(`ECDSA role-local material binding kind is invalid`);let n=i(t.participantIds,`ECDSA role-local participant ids`),r=[];for(let e of n)r.push(ge(e));let[a,...s]=r;if(!a)throw Error(`ECDSA role-local material requires at least one participant`);return je({keyHandle:Le(t.keyHandle),ecdsaThresholdKeyId:ye(t.ecdsaThresholdKeyId),clientVerifyingPublicKey33B64u:E(t.clientVerifyingPublicKey33B64u),participantIds:[a,...s],relayerKeyId:_e(t.relayerKeyId)})}function Mt(e){let n=o(e,`prepared ECDSA signer`);if(L(n,`prepared ECDSA signer`,[`kind`,`capability`,`signerId`,`walletId`,`authority`,`scope`,`materialOwner`,`signingRootId`,`signingRootVersion`]),n.kind!==`prepared_evm_family_signer`)throw Error(`prepared ECDSA signer kind is invalid`);let i=w(n.authority);if(!i)throw Error(`prepared ECDSA signer authority is invalid`);if(String(n.walletId)!==String(i.walletId))throw Error(`prepared ECDSA signer wallet does not match its authority`);return De({capability:O(r(n.capability)),signerId:ne(n.signerId),authority:i,scope:At(n.scope),materialOwner:O(t(n.materialOwner)),signingRootId:re(n.signingRootId),signingRootVersion:oe(n.signingRootVersion)})}function Nt(e){let t=o(e,`encrypted ECDSA pending candidate`);if(L(t,`encrypted ECDSA pending candidate`,[`kind`,`sealingKeyId`,`iv12B64u`,`ciphertextB64u`,`ciphertextDigest`]),t.kind!==`encrypted_ecdsa_pending_candidate`)throw Error(`encrypted ECDSA pending candidate kind is invalid`);return Ce({sealingKeyId:y(t.sealingKeyId),iv12B64u:v(t.iv12B64u),ciphertextB64u:S(t.ciphertextB64u),ciphertextDigest:ae(t.ciphertextDigest)})}function Pt(e){let t=o(e,`ECDSA activation binding`);if(L(t,`ECDSA activation binding`,[`kind`,`targetManifest`,`signer`,`roleLocalBinding`,`bindingDigest`,`durableMaterialRef`]),t.kind!==`ecdsa_activation_binding`)throw Error(`ECDSA activation binding kind is invalid`);return Me({targetManifest:Dt(t.targetManifest),signer:Mt(t.signer),roleLocalBinding:jt(t.roleLocalBinding),bindingDigest:k(t.bindingDigest),durableMaterialRef:be(t.durableMaterialRef)})}function Ft(e){let t=o(e,`prepared ECDSA activation candidate`);if(L(t,`prepared ECDSA activation candidate`,[`kind`,`activationBinding`,`encryptedPending`]),t.kind!==`prepared_ecdsa_activation_candidate`)throw Error(`prepared ECDSA activation candidate kind is invalid`);return j({activationBinding:Pt(t.activationBinding),encryptedPending:Nt(t.encryptedPending)})}function It(e){let t=o(e,`ECDSA server generation expectation`);switch(t.kind){case`no_current_generation`:return L(t,`ECDSA no-current server generation expectation`,[`kind`]),Te();case`exact_generation`:return L(t,`ECDSA exact server generation expectation`,[`kind`,`serverGeneration`]),Fe(C(t.serverGeneration));default:throw Error(`ECDSA server generation expectation kind is invalid`)}}function Lt(e){let t=o(e,`prepared ECDSA activation journal`);if(L(t,`prepared ECDSA activation journal`,[`kind`,`journalId`,`expectedManifest`,`activationCommand`,`candidate`,`createdAt`]),t.kind!==`activation_prepared`)throw Error(`prepared ECDSA activation journal kind is invalid`);let n=o(t.activationCommand,`ECDSA activation command`);if(L(n,`ECDSA activation command`,[`kind`,`correlationId`,`expectedGeneration`,`requestDigest`,`canonicalRequest`]),n.kind!==`ecdsa_server_activation_command`)throw Error(`ECDSA activation command kind is invalid`);let r=f(t.journalId);if(f(n.correlationId)!==r)throw Error(`ECDSA activation command correlation does not match its journal`);let i=Ot(t.expectedManifest),a=It(n.expectedGeneration),s={journalId:r,candidate:Ft(t.candidate),requestDigest:p(n.requestDigest),canonicalRequest:ie(n.canonicalRequest),createdAt:d(t.createdAt)};switch(i.kind){case`no_current_manifest`:if(a.kind!==`no_current_generation`)throw Error(`initial ECDSA journal has an exact server generation`);return A({...s,expectedManifest:i,expectedGeneration:a});case`exact_manifest`:if(a.kind!==`exact_generation`)throw Error(`replacement ECDSA journal is missing its exact server generation`);return A({...s,expectedManifest:i,expectedGeneration:a})}return Y(i)}function Rt(e){return{kind:`activation_prepared`,journalId:e.journalId,expectedManifest:e.expectedManifest,activationCommand:e.activationCommand,candidate:e.candidate,createdAt:e.createdAt}}function zt(e){return e.kind===`activation_prepared`?e:xt({journalId:e.journalId,expectedManifest:e.expectedManifest,expectedGeneration:e.activationCommand.expectedGeneration,candidate:e.candidate,requestDigest:e.activationCommand.requestDigest,canonicalRequest:e.activationCommand.canonicalRequest,createdAt:e.createdAt})}function Bt(e){let t=o(e,`server-committed ECDSA activation journal`);if(L(t,`server-committed ECDSA activation journal`,[`kind`,`journalId`,`expectedManifest`,`activationCommand`,`candidate`,`createdAt`,`serverActivation`]),t.kind!==`server_activation_committed`)throw Error(`server-committed ECDSA activation journal kind is invalid`);let n=Lt(Rt(t)),r=Vt(t.serverActivation),i=Se({preparedJournal:n,serverCommit:r.serverCommit});if(!yt(i.serverActivation,r.record))throw Error(`ECDSA server activation commit fields are inconsistent`);return i}function Vt(e){let t=o(e,`ECDSA server activation commit`);if(L(t,`ECDSA server activation commit`,[`kind`,`correlationId`,`activationRequestDigest`,`serverGeneration`,`serverActivationReceipt`]),t.kind!==`ecdsa_server_activation_commit`)throw Error(`ECDSA server activation commit kind is invalid`);let n=o(t.serverActivationReceipt,`ECDSA server activation receipt`);if(L(n,`ECDSA server activation receipt`,[`kind`,`lifecycleId`,`activationDigest`,`activatedAt`,`protocolReceipt`]),n.kind!==`ecdsa_server_activation_receipt`)throw Error(`ECDSA server activation receipt kind is invalid`);return{record:t,serverCommit:{correlationId:f(t.correlationId),activationRequestDigest:p(t.activationRequestDigest),serverGeneration:C(t.serverGeneration),protocolReceipt:n.protocolReceipt}}}function Ht(e){let t=o(e,`ECDSA activation journal`);switch(t.kind){case`activation_prepared`:return Lt(t);case`server_activation_committed`:return Bt(t);default:throw Error(`ECDSA activation journal kind is invalid`)}}function Ut(e){let t=o(e,`registered ECDSA public facts`);if(L(t,`registered ECDSA public facts`,[`kind`,`keyHandle`,`publicKeyB64u`,`participantIds`,`thresholdOwnerAddress`]),t.kind!==`verified_ecdsa_public_facts`)throw Error(`registered ECDSA public facts kind is invalid`);return de({keyHandle:ee(t.keyHandle),publicKeyB64u:t.publicKeyB64u,participantIds:i(t.participantIds,`registered ECDSA participant ids`),thresholdOwnerAddress:t.thresholdOwnerAddress})}function J(e){let t=o(e,`active ECDSA manifest proof`);L(t,`active ECDSA manifest proof`,[`activation_binding`,`server_activation`,`registered_public_facts`,`role_local_public_facts`,`router_ab_ecdsa_derivation_normal_signing`,`runtime_policy_scope`,`ciphertext_digest`,`committed_at`]);let n=Pt(t.activation_binding),r=Vt(t.server_activation),i=Ne({activationBinding:n,serverCommit:r.serverCommit});if(!yt(i,r.record))throw Error(`ECDSA server activation commit fields are inconsistent`);let a=Ae({activationBinding:n,serverActivation:i,routerAbEcdsaDerivationNormalSigning:ue(t.router_ab_ecdsa_derivation_normal_signing),roleLocalPublicFacts:ve(t.role_local_public_facts),ciphertextDigest:T(t.ciphertext_digest),runtimePolicyScope:u(t.runtime_policy_scope)}),s=d(t.committed_at);return{activationBinding:n,serverActivation:i,durableMaterial:a,activeManifest:Pe({activationBinding:n,serverActivation:i,registeredPublicFacts:Ut(t.registered_public_facts),durableMaterial:a,committedAt:s}),committedAt:s}}function Wt(e){let t=o(e,`ECDSA capability manifest row`),n=[`record_version`,`manifest_id`,`manifest_revision`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`manifest_state`,`active_proof`];switch(t.manifest_state){case`active`:{L(t,`active ECDSA capability manifest row`,n);let e=J(t.active_proof),r=B(e.activeManifest);return Gt(t,e.activeManifest,r),{state:`active`,selector:r,manifest:e.activeManifest,activeProof:e}}case`replaced`:{L(t,`replaced ECDSA capability manifest row`,[...n,`replacement_proof`]);let e=J(t.active_proof),r=J(t.replacement_proof),i=Ee({activeManifest:e.activeManifest,replacementManifest:r.activeManifest}),a=B(e.activeManifest);return Gt(t,e.activeManifest,a),{state:`replaced`,selector:a,manifest:i,activeProof:e,replacementProof:r}}default:throw Error(`ECDSA capability manifest row state is invalid`)}}function Gt(e,t,n){if(e.record_version!==`ecdsa_capability_manifest_v3`||b(e.manifest_id)!==t.identity.manifestId||x(e.manifest_revision)!==t.identity.manifestRevision||String(e.capability_ref)!==String(n.capability)||String(e.wallet_id)!==String(n.authority.walletId)||String(e.authority_digest)!==String(n.authority.authorityDigest))throw Error(`ECDSA capability manifest row identity is inconsistent`)}function Kt(e){return{record_version:He,...H(B(e)),manifest_id:e.identity.manifestId,manifest_revision:e.identity.manifestRevision}}function qt(e){let t=o(e,`current ECDSA capability pointer`);if(L(t,`current ECDSA capability pointer`,[`record_version`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`manifest_id`,`manifest_revision`]),t.record_version!==He)throw Error(`current ECDSA capability pointer version is invalid`);let n=Qe(t);if(!n)throw Error(`current ECDSA capability pointer authority is invalid`);return{selector:{capability:O(r(t.capability_ref)),authority:n},manifestId:b(t.manifest_id),manifestRevision:x(t.manifest_revision)}}function Jt(e,t){return{record_version:Ue,durable_material_ref:e.binding.durableMaterialRef,binding_digest:e.binding.bindingDigest,...H(B(t)),sealing_key_id:e.sealingKeyId,iv:e.iv12B64u,ciphertext:e.ciphertextB64u}}function Yt(e){let t=o(e,`ECDSA role-local material row`);if(L(t,`ECDSA role-local material row`,[`record_version`,`durable_material_ref`,`binding_digest`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`sealing_key_id`,`iv`,`ciphertext`]),t.record_version!==Ue)throw Error(`ECDSA role-local material row version is invalid`);let n=Qe(t);if(!n)throw Error(`ECDSA role-local material authority is invalid`);return{durableMaterialRef:be(t.durable_material_ref),bindingDigest:k(t.binding_digest),selector:{capability:O(r(t.capability_ref)),authority:n}}}function Xt(e,t){let n=o(e,`ECDSA role-local material row`),r=Yt(n),i=Ie({binding:t.durableMaterial,sealingKeyId:y(n.sealing_key_id),iv12B64u:v(n.iv),ciphertextB64u:S(n.ciphertext)});if(r.durableMaterialRef!==i.binding.durableMaterialRef||r.bindingDigest!==i.binding.bindingDigest||!et(r.selector,B(t.activeManifest)))throw Error(`ECDSA role-local material row binding is inconsistent`);return i}function Zt(e,t){return e.binding.durableMaterialRef===t.durableMaterial.durableMaterialRef&&e.binding.bindingDigest===t.durableMaterial.bindingDigest&&e.binding.lifecycleId===t.durableMaterial.lifecycleId&&e.binding.ciphertextDigest===t.durableMaterial.ciphertextDigest&&e.binding.activationDigest===t.durableMaterial.activationDigest&&e.binding.activatedAt===t.durableMaterial.activatedAt&&n(e.binding.materialActivation,t.durableMaterial.materialActivation)&&G(e.binding.roleLocalBinding,t.durableMaterial.roleLocalBinding)}function Qt(e){return{record_version:We,journal_id:e.journalId,...H(z(e)),journal:e}}function $t(e){let t=o(e,`ECDSA activation commit journal row`);if(L(t,`ECDSA activation commit journal row`,[`record_version`,`journal_id`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`journal`]),t.record_version!==We)throw Error(`ECDSA activation commit journal row version is invalid`);let n=Ht(t.journal),r=z(n);if(f(t.journal_id)!==n.journalId||String(t.capability_ref)!==String(r.capability)||String(t.wallet_id)!==String(r.authority.walletId)||String(t.authority_digest)!==String(r.authority.authorityDigest))throw Error(`ECDSA activation commit journal row identity is inconsistent`);return{journal:n,selector:r}}function en(e){return typeof CryptoKey>`u`||!(e instanceof CryptoKey)||e.type!==`secret`||e.extractable||e.algorithm.name!==`AES-GCM`?!1:e.usages.includes(`encrypt`)&&e.usages.includes(`decrypt`)}function tn(e,t){return{record_version:Ge,key_id:e,key:t}}function nn(e){let t=o(e,`ECDSA material sealing key row`);if(L(t,`ECDSA material sealing key row`,[`record_version`,`key_id`,`key`]),t.record_version!==Ge)throw Error(`ECDSA material sealing key row version is invalid`);if(!en(t.key))throw Error(`ECDSA material sealing key must be a non-extractable AES-GCM key`);return{keyId:y(t.key_id),key:t.key}}function Y(e){throw Error(`Unexpected ECDSA persistence branch: ${String(e)}`)}const rn=5*6e4;function an(e,t,r){let i=e.binding.routerAbEcdsaDerivationNormalSigning.scope,a=fe(e.binding.materialActivation);return i.wallet_id===t.walletId&&c(me(i))===t.signingScopeB64u&&c(se(a))===t.materialActivationB64u&&i.signing_worker.key_epoch===t.keyEpoch&&i.activation_epoch===t.activationEpoch&&a.activation_id===t.materialActivationId&&a.capability===t.capability&&a.key_binding===t.keyBinding&&a.material_owner===t.walletId&&e.binding.durableMaterialRef===r.durableMaterialRef&&e.binding.bindingDigest===r.bindingDigest&&n(e.binding.materialActivation,r.materialActivation)}function on(e,t){return e.materialActivation.activationId===t.materialActivationId&&e.materialActivation.capability===t.capability&&e.materialActivation.keyBinding===t.keyBinding&&e.materialActivation.materialOwner===t.walletId}function sn(e){if(typeof e!=`string`||!/^ecdsa-client-presignature-[A-Za-z0-9_-]+$/.test(e))throw Error(`ECDSA durable presignature record id is invalid`);return e}function X(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} is invalid`);return e}function Z(e){if(!e||typeof e!=`object`||!(`record_id`in e))return null;let t=e.record_id;return typeof t==`string`?t:null}function cn(){return typeof IDBTransaction<`u`&&`durability`in IDBTransaction.prototype}async function ln(e,t=1/0){let n=0;for(;e&&n<t;)await e.delete(),n+=1,e=await e.continue();return n}async function un(e,t,n){return await ln(await e.store(I).index(g.walletExpiresAt).openCursor(IDBKeyRange.bound([t,0],[t,n])),32)}async function dn(e,t,n){await un(e,t.walletId,n);let r=e.store(I),i=await r.index(g.poolIdentityKey).getAll(F(t));t.ownershipGeneration===1&&i.push(...await r.index(g.poolIdentityKey).getAll(pn(t)));let a=[];for(let e of i)try{let t=Q(e);t.expires_at_ms<=n?await r.delete(t.record_id):(e.pool_identity_key!==t.pool_identity_key&&await r.put(t),a.push(t))}catch{let t=Z(e);t&&await r.delete(t)}return a}function fn(e){let{ownershipGeneration:t,...n}=e.poolIdentity;return{domain:`seams/ecdsa-client-presignature/v1`,version:1,pool_identity:t===1?n:e.poolIdentity,durable_material_ref:e.durableMaterialRef,presignature_id:e.presignatureId,group_public_key33_b64u:e.groupPublicKey33B64u,big_r33_b64u:e.bigR33B64u,created_at_ms:e.createdAtMs,expires_at_ms:e.expiresAtMs,sealing_key_id:e.sealingKeyId}}function pn(e){return[e.protocolId,e.relayerUrl,e.signingScopeB64u,e.materialActivationB64u].join(`|`)}function Q(e){let t=o(e,`ECDSA durable presignature row`);if(L(t,`ECDSA durable presignature row`,[`kind`,`record_id`,`pool_identity`,`pool_identity_key`,`wallet_id`,`material_activation_id`,`durable_material_ref`,`presignature_id`,`group_public_key33_b64u`,`big_r33_b64u`,`created_at_ms`,`expires_at_ms`,`sealed`]),t.kind!==`sealed_available_client_presignature_v1`)throw Error(`ECDSA durable presignature row kind is invalid`);let n=o(t.pool_identity,`ECDSA durable presignature pool identity`),r=!Object.hasOwn(n,`ownershipGeneration`);L(n,`ECDSA durable presignature pool identity`,[...r?[]:[`ownershipGeneration`],`activationEpoch`,`capability`,`keyBinding`,`keyEpoch`,`materialActivationB64u`,`materialActivationId`,`pairRole`,`protocolId`,`relayerUrl`,`signingScopeB64u`,`walletId`]);let i=P(r?{...n,ownershipGeneration:1}:n),a=sn(t.record_id),s=String(t.pool_identity_key??``);if(s!==F(i)&&!(r&&s===pn(i)))throw Error(`ECDSA durable presignature pool identity index is inconsistent`);let c=String(t.wallet_id??``).trim(),l=String(t.material_activation_id??``).trim();if(!c||c!==i.walletId)throw Error(`ECDSA durable presignature wallet binding is inconsistent`);if(!l||l!==i.materialActivationId)throw Error(`ECDSA durable presignature activation binding is inconsistent`);let u=xe(t.durable_material_ref);if(!on(u,i))throw Error(`ECDSA durable presignature material binding is inconsistent`);let d=String(t.presignature_id??``).trim();if(!d)throw Error(`ECDSA durable presignature id is invalid`);let f=E(t.group_public_key33_b64u),p=E(t.big_r33_b64u),m=X(t.created_at_ms,`created_at_ms`),h=X(t.expires_at_ms,`expires_at_ms`);if(m>Date.now()+3e5)throw Error(`ECDSA durable presignature creation timestamp is in the future`);if(h<=m)throw Error(`ECDSA durable presignature expiry must follow creation`);if(h-m>7776e6)throw Error(`ECDSA durable presignature lifetime exceeds the maximum`);let g=o(t.sealed,`ECDSA durable presignature sealed payload`);if(L(g,`ECDSA durable presignature sealed payload`,[`kind`,`sealing_key_id`,`iv12_b64u`,`ciphertext_b64u`,`ciphertext_digest_b64u`]),g.kind!==`ecdsa_activation_aes_gcm_v1`)throw Error(`ECDSA durable presignature sealing kind is invalid`);return{kind:`sealed_available_client_presignature_v1`,record_id:a,pool_identity:i,pool_identity_key:F(i),wallet_id:c,material_activation_id:l,durable_material_ref:u,presignature_id:d,group_public_key33_b64u:f,big_r33_b64u:p,created_at_ms:m,expires_at_ms:h,sealed:{kind:`ecdsa_activation_aes_gcm_v1`,sealing_key_id:y(g.sealing_key_id),iv12_b64u:v(g.iv12_b64u),ciphertext_b64u:S(g.ciphertext_b64u),ciphertext_digest_b64u:T(g.ciphertext_digest_b64u)}}}function mn(e){return{kind:`sealed_available_client_presignature_v1`,recordId:e.record_id,poolIdentity:e.pool_identity,durableMaterialRef:e.durable_material_ref,presignatureId:e.presignature_id,groupPublicKey33B64u:e.group_public_key33_b64u,bigR33B64u:e.big_r33_b64u,createdAtMs:e.created_at_ms,expiresAtMs:e.expires_at_ms,sealingKeyId:e.sealed.sealing_key_id}}async function hn(e){let t=crypto.getRandomValues(new Uint8Array(12)),n=q(fn(e.metadata));try{let r=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:t,additionalData:n},e.key,e.plaintext97));try{let e=c(r);return{iv12B64u:v(c(t)),ciphertextB64u:S(e),ciphertextDigestB64u:T(c(await s(r)))}}finally{r.fill(0)}}finally{t.fill(0),n.fill(0),e.plaintext97.fill(0)}}async function gn(e){let t=l(e.sealed.iv12_b64u),n=l(e.sealed.ciphertext_b64u),r=q(fn(e.metadata)),i=null;try{if(c(await s(n))!==e.sealed.ciphertext_digest_b64u)throw Error(`ECDSA durable presignature ciphertext digest mismatch`);if(i=new Uint8Array(await crypto.subtle.decrypt({name:`AES-GCM`,iv:t,additionalData:r},e.key,n)),i.length!==97)throw Error(`ECDSA durable presignature plaintext length is invalid`);return i.slice()}finally{t.fill(0),n.fill(0),r.fill(0),i?.fill(0)}}async function _n(e,t,n){let r=e.store(I),i=await r.index(g.walletMaterialActivationId).getAll([t,n]);for(let e of i){let t=Z(e);t&&await r.delete(t)}}async function $(e,t){let n=await e.store(h.appState).get(`wallet_ownership_generation:${t}`);if(n===void 0)return 1;let r=o(n,`Wallet ownership generation`).value;if(typeof r!=`number`||!Number.isSafeInteger(r)||r<1)throw Error(`Stored wallet ownership generation is invalid`);return r}async function vn(e,t,n){if(await $(e,t)!==n)throw Error(`Wallet ownership generation requires fresh authentication`)}async function yn(e,t,n){let r=await $(e,t);if(n<r)throw Error(`Wallet session belongs to an obsolete ownership generation`);if(n===r)return;await e.store(h.appState).put({key:`wallet_ownership_generation:${t}`,value:n});let i=await e.store(h.ecdsaClientPresignatures).index(g.walletId).openCursor(t);for(;i;){let e=!0;try{e=Q(i.value).pool_identity.ownershipGeneration<n}catch{}e&&await i.delete(),i=await i.continue()}}async function bn(e,t){await _.runTransaction([h.appState],`readonly`,xn.bind(null,e,t))}function xn(e,t,n){return vn(n,e,t)}async function Sn(e,t){await _.runTransaction([h.appState,h.ecdsaClientPresignatures],`readwrite`,Cn.bind(null,e,t))}async function Cn(e,t,n){t<=await $(n,e)||await yn(n,e,t)}export{B as $,vt as A,Ze as B,I as C,Tt as D,bt as E,rt as F,Yt as G,Bt as H,K as I,nn as J,Xt as K,wt as L,gt as M,it as N,Et as O,G as P,z as Q,Ct as R,qe as S,Y as T,$t as U,J as V,Wt as W,tt as X,zt as Y,H as Z,cn as _,rn as a,Kt as at,Ke as b,hn as c,F as ct,sn as d,P as dt,R as et,X as f,_n as g,dn as h,Sn as i,Jt as it,nt as j,ht as k,on as l,ze as lt,Z as m,bn as n,et as nt,an as o,tn as ot,Q as p,qt as q,vn as r,Qt as rt,gn as s,$e as st,yn as t,V as tt,mn as u,Be as ut,Ye as v,Xe as w,Je as x,Ve as y,Zt as z};

package/dist/esm/sdk/walletRecoveryCommit-Cc9AqHr0.js

@@ -0,0 +1 @@
+import{B as e,I as t,L as n,P as r,V as i,g as a,h as o,j as s,z as c}from"./normalize-kUDm5zfS.js";import{E as l,c as u,d,k as f}from"./chains-CiYQT1K4.js";import{i as p,r as m}from"./base64-CsEj-_bC.js";import{_ as h,c as g,i as _,n as v,o as y,r as b,s as x,t as S,y as C}from"./primitives-CAcl7ON7.js";import{o as ee}from"./sessionPolicy-J-RrlPZQ.js";import{n as w,t as T}from"./signingSessionSeal-CDLUmAFY.js";import{E,O as D,k as te}from"./activeWalletSession-DiZcKjB_.js";import{l as ne}from"./capabilityKinds-CKQ4Uqnv.js";import{d as O,h as k,l as re}from"./digestEncoding-Dzc1rzWV.js";import{d as ie,t as A}from"./accountIds-BzZs7YoX.js";import{M as ae,h as oe,m as se}from"./accountLifecycle-CAMVowDl.js";import{m as ce}from"./walletAuthority-B5hXHWpK.js";import{Jt as le,Kt as ue,Nt as de,Qt as fe,Wt as pe,Xt as me,Yt as he,en as ge,q as _e,qt as ve,tn as ye,tt as be,xt as xe}from"./emailOtpEcdsaDerivationIdentity-B8HzTh4T.js";import{n as Se}from"./challengeDelivery-DxXAkOfS.js";import{i as Ce}from"./walletAuthMethodRecord-CXedSgpV.js";import{d as j}from"./passkey-custody-BQj44jEM.js";import{C as we}from"./ecdsaCapabilityManifest-BlzJAQF8.js";import{E as Te,_ as Ee,r as De,u as M}from"./walletCustodyEcdsaContinuity-abNZ_dvX.js";import{a as Oe,f as ke,l as Ae,n as N,t as je,u as P}from"./wallet-recovery-C1kesLCF.js";import{o as Me}from"./helpers-Ddy72ULN.js";function Ne(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`wallet recovery target must be an object`);let t=e,n=Object.keys(t);switch(t.kind){case`passkey`:{if(n.length!==2||!n.includes(`rpId`))throw Error(`Passkey recovery target fields are invalid`);let e=i(t.rpId);if(!e.ok)throw Error(`Passkey recovery target RP ID is invalid`);return{kind:`passkey`,rpId:e.value}}case`google_email_otp`:if(n.length!==2||!n.includes(`googleProvider`)||t.googleProvider!==`google`)throw Error(`Google Email OTP recovery target fields are invalid`);return{kind:`google_email_otp`,googleProvider:`google`};default:throw Error(`wallet recovery target kind is unsupported`)}}const Pe=[`ok`,`walletId`,`target`,`recoveryOperationId`,`targetDeviceId`,`targetAuthorityId`,`targetWalletAuthMethodId`,`wrap`,`entries`,`keyManifest`,`reservationId`,`reservationExpiresAtMs`,`storeVersion`],Fe=[...Pe,`registration`];function F(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be an object`);return e}function Ie(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==r.size||i.some(e=>!r.has(e)))throw Error(`${n} contains unexpected fields`)}function I(e,t,n){let r=F(e,n);return Ie(r,t,n),r}function L(e,t){return Object.prototype.hasOwnProperty.call(e,t)?Reflect.get(e,t):void 0}function Le(e){try{return F(e,`walletRecoveryPrepare response`)}catch{return null}}function Re(e){let t=n(e.walletId);if(!t.ok)throw Error(`wallet recovery ${t.error.message}`);return JSON.stringify({walletId:String(t.value),wrap:e.prepared.wrap,entry:e.prepared.entries[0]})}async function ze(e){let t=await Be(e);return t.ok?await Ve({response:t.response,target:e.target,reservationId:e.reservationId}):{kind:t.kind}}async function Be(e){let t=`${k(e.relayUrl)}/wallets/recovery/prepare`,n=e.fetchImpl||fetch;try{return{ok:!0,response:await n(t,O({body:{recoveryCodeB64u:e.recoveryCodeB64u,reservationId:e.reservationId,target:e.target}}))}}catch{return{ok:!1,kind:`transport_uncertain`}}}async function Ve(e){let i=e.response,a=Le(await i.json().catch(()=>({})));if(i.status===200&&a&&L(a,`ok`)===!0)try{let i=I(a,e.target.kind===`passkey`?Fe:Pe,`walletRecoveryPrepare`),o=qe()(L(i,`wrap`),`walletRecoveryPrepare.wrap`),s=Je(L(i,`entries`)),l=n(L(i,`walletId`));if(!l.ok)throw Error(`walletRecoveryPrepare.walletId is invalid`);let u=l.value,d=Ne(L(i,`target`));if(!Ge(d,e.target))throw Error(`wallet recovery preparation changed the recovery target`);let f=c(L(i,`recoveryOperationId`)),p=ne(L(i,`targetDeviceId`)),m=t(L(i,`targetAuthorityId`)),h=r(L(i,`targetWalletAuthMethodId`));if(!f.ok||!p.ok||!m.ok||!h.ok)throw Error(`wallet recovery preparation target identity is invalid`);let _=Ye(L(i,`keyManifest`),u),v=ke(L(i,`reservationId`)),y=g(L(i,`reservationExpiresAtMs`),`walletRecoveryPrepare.reservationExpiresAtMs`),b=R(L(i,`storeVersion`),`storeVersion`);if(v!==e.reservationId)throw Error(`wallet recovery preparation changed the reservation identity`);let x={kind:`prepared`,walletId:u,recoveryOperationId:f.value,targetDeviceId:p.value,targetAuthorityId:m.value,targetWalletAuthMethodId:h.value,wrap:o,entries:s,keyManifest:_,reservationId:v,reservationExpiresAtMs:y,storeVersion:b};switch(d.kind){case`passkey`:{let e=He(String(u),d.rpId)(L(i,`registration`),`registration`);if(e.walletAuthMethodId!==h.value)throw Error(`wallet recovery registration changed the target auth method`);return{...x,target:d,registration:e}}case`google_email_otp`:if(Object.prototype.hasOwnProperty.call(i,`registration`))throw Error(`Google Email OTP recovery cannot carry passkey registration`);return{...x,target:d};default:return Ke(d)}}catch{return{kind:`transport_uncertain`}}return i.status===409?{kind:`retryable_conflict`}:i.status===401&&a&&L(a,`code`)===`recovery_code_used`?{kind:`consumed`}:i.status===401||i.status===400?{kind:`refused`}:{kind:`transport_uncertain`}}function He(t,n){let a=p(new TextEncoder().encode(t)),o=D({type:E(`public-key`),id:(t,n)=>{let r=te(e)(t,n);return st(r,n),r}});return D({kind:E(`webauthn_recovery_registration_v1`),challengeId:R,challengeB64u:(e,t)=>ot(e,32,t),replacementId:R,walletAuthMethodId:te(r),rpId:te(i),user:D({idB64u:st,name:R,displayName:R},(e,n)=>{if(e.idB64u!==a||e.name!==t||e.displayName!==t)throw Error(`${n} is bound to another wallet`)}),pubKeyCredParams:(e,t)=>{if(!Array.isArray(e)||e.length!==2)throw Error(`${t} is invalid`);return[Ue(-7)(e[0],`${t}[0]`),Ue(-257)(e[1],`${t}[1]`)]},authenticatorSelection:D({residentKey:E(`required`),userVerification:E(`preferred`)}),timeoutMs:(e,t)=>{let n=Number(e);if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} is invalid`);return n},attestation:E(`none`),extensions:D({prf:D({eval:D({firstB64u:We(T),secondB64u:We(w)})})}),excludeCredentials:(e,t)=>l(e,t).map((e,n)=>o(e,`${t}[${n}]`))},(e,t)=>{if(e.rpId!==n)throw Error(`${t} changed the relying party`)})}function Ue(e){return D({type:E(`public-key`),alg:(t,n)=>{if(t!==e)throw Error(`${n} is invalid`);return e}})}function We(e){return(t,n)=>{let r=ot(t,e.length,n);if(r!==p(e))throw Error(`${n} is unsupported`);return r}}function Ge(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId;case`google_email_otp`:return t.kind===`google_email_otp`&&e.googleProvider===t.googleProvider;default:return Ke(e)}}function Ke(e){throw Error(`unsupported wallet recovery target: ${String(e)}`)}function qe(){return D({nonceB64u:_,wrappedManifestKekB64u:b,aadHashB64u:S})}function Je(e){if(!Array.isArray(e)||e.length!==1)throw Error(`walletRecoveryPrepare.entries must contain exactly one custody seed`);return[Oe(e[0],`walletRecoveryPrepare.entries[0]`)]}function R(e,t){if(typeof e!=`string`||!e.trim())throw Error(`walletRecoveryPrepare.${t} must be a non-empty string`);return e.trim()}function Ye(e,t){let n=I(e,[`version`,`walletId`,`entries`],`walletRecoveryPrepare.keyManifest`);if(L(n,`version`)!==`wallet_recovery_preparation_key_manifest_v1`)throw Error(`walletRecoveryPrepare.keyManifest version is invalid`);let r=R(L(n,`walletId`),`keyManifest.walletId`);if(r!==t)throw Error(`walletRecoveryPrepare.keyManifest changed the wallet identity`);let i=L(n,`entries`);if(!Array.isArray(i)||i.length===0)throw Error(`walletRecoveryPrepare.keyManifest must contain a key set`);let a=i.map(e=>Xe(e,r));if(new Set(a.map(e=>e.keySetId)).size!==a.length)throw Error(`walletRecoveryPrepare.keyManifest contains duplicate key sets`);return{version:`wallet_recovery_preparation_key_manifest_v1`,walletId:r,entries:a}}function Xe(e,t){switch(L(F(e,`walletRecoveryPrepare.keyManifest.entries[]`),`kind`)){case`near_ed25519`:{let n=I(e,[`kind`,`keySetId`,`signerId`,`nearAccountId`,`recordedKeyManifestDigestB64u`,`recoveryBasis`],`walletRecoveryPrepare.keyManifest.entries[].near_ed25519`),r=R(L(n,`signerId`),`keyManifest.entries[].signerId`),i=R(L(n,`keySetId`),`keyManifest.entries[].keySetId`),a=`near_ed25519:${r}`;if(i!==a)throw Error(`walletRecoveryPrepare NEAR key-set identity is inconsistent`);let o=R(L(n,`nearAccountId`),`keyManifest.entries[].nearAccountId`),s=Ze(L(n,`recoveryBasis`),t);return{kind:`near_ed25519`,keySetId:a,signerId:r,nearAccountId:o,recordedKeyManifestDigestB64u:S(L(n,`recordedKeyManifestDigestB64u`),`walletRecoveryPrepare.keyManifest.entries[].recordedKeyManifestDigestB64u`),recoveryBasis:s}}case`evm_family_ecdsa`:{let n=I(e,[`kind`,`keySetId`,`keyHandle`,`evmFamilySigningKeySlotId`,`recordedKeyManifestDigestB64u`,`recoveryBasis`],`walletRecoveryPrepare.keyManifest.entries[].evm_family_ecdsa`),r=R(L(n,`keyHandle`),`keyManifest.entries[].keyHandle`),i=R(L(n,`keySetId`),`keyManifest.entries[].keySetId`),a=`evm_family_ecdsa:${r}`;if(i!==a)throw Error(`walletRecoveryPrepare ECDSA key-set identity is inconsistent`);let o=Qe(L(n,`recoveryBasis`),t);return{kind:`evm_family_ecdsa`,keySetId:a,keyHandle:r,evmFamilySigningKeySlotId:re(L(n,`evmFamilySigningKeySlotId`)),recordedKeyManifestDigestB64u:S(L(n,`recordedKeyManifestDigestB64u`),`walletRecoveryPrepare.keyManifest.entries[].recordedKeyManifestDigestB64u`),recoveryBasis:o}}default:throw Error(`walletRecoveryPrepare key-manifest entry kind is invalid`)}}function Ze(e,t){let n=I(e,[`capabilityKind`,`activeCapabilityBinding`,`scope`,`applicationBinding`,`participantIds`,`registeredPublicKey`,`runtimePolicyScope`,`activationTranscript`,`activationStateEpoch`,`signingWorkerVerifyingShare`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis`),r=L(n,`capabilityKind`);if(r!==`registration`&&r!==`recovery`)throw Error(`walletRecoveryPrepare NEAR recovery capability kind is invalid`);let i=z(L(n,`activeCapabilityBinding`),32,`NEAR recovery active capability binding`),a=nt(L(n,`scope`)),o=rt(L(n,`applicationBinding`)),s=at(L(n,`participantIds`),`NEAR recovery participant IDs`),c=z(L(n,`registeredPublicKey`),32,`NEAR recovery registered public key`),l=it(L(n,`runtimePolicyScope`)),u=z(L(n,`activationTranscript`),32,`NEAR recovery activation transcript`),d=Number(L(n,`activationStateEpoch`));if(!Number.isSafeInteger(d)||d<=0)throw Error(`walletRecoveryPrepare NEAR recovery activation state epoch is invalid`);let f=z(L(n,`signingWorkerVerifyingShare`),32,`NEAR recovery signing-worker verifying share`);if(o.wallet_id!==t||a.account_id!==t||a.root_share_epoch!==l.signingRootVersion)throw Error(`walletRecoveryPrepare NEAR recovery basis changed its wallet scope`);return{capabilityKind:r,activeCapabilityBinding:i,scope:a,applicationBinding:o,participantIds:s,registeredPublicKey:c,runtimePolicyScope:l,activationTranscript:u,activationStateEpoch:d,signingWorkerVerifyingShare:f}}function Qe(e,t){let n=I(e,[`publicCapability`,`activationReceipt`,`serverGeneration`,`clientRootPublicKey33B64u`,`chainTargets`,`ecdsaThresholdKeyId`,`signingRootId`,`signingRootVersion`,`runtimePolicyScope`,`participantIds`,`possessionChallenge`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis`),r=_e(L(n,`publicCapability`)),i=be(L(n,`activationReceipt`));if(r.client_id!==t)throw Error(`walletRecoveryPrepare ECDSA recovery capability changed the wallet scope`);let a=le(L(n,`signingRootId`)),o=he(L(n,`signingRootVersion`)),s=it(L(n,`runtimePolicyScope`));if(s.signingRootVersion!==o)throw Error(`walletRecoveryPrepare ECDSA recovery scope changed the signing root`);let c=pe(L(n,`serverGeneration`));if(String(i.server_generation)!==String(c))throw Error(`walletRecoveryPrepare ECDSA activation receipt changed server generation`);let l=je(L(n,`possessionChallenge`));if(l.walletId!==t||l.expectedServerGeneration!==String(c)||l.derivationClientSharePublicKey33B64u!==r.public_identity.derivation_client_share_public_key33_b64u)throw Error(`walletRecoveryPrepare ECDSA possession challenge changed its capability`);return{publicCapability:r,activationReceipt:i,serverGeneration:c,clientRootPublicKey33B64u:ve(R(L(n,`clientRootPublicKey33B64u`),`keyManifest.entries[].recoveryBasis.clientRootPublicKey33B64u`)),chainTargets:$e(L(n,`chainTargets`)),ecdsaThresholdKeyId:me(L(n,`ecdsaThresholdKeyId`)),signingRootId:a,signingRootVersion:o,runtimePolicyScope:s,participantIds:tt(L(n,`participantIds`)),possessionChallenge:l}}function $e(e){if(!Array.isArray(e)||e.length===0)throw Error(`walletRecoveryPrepare ECDSA recovery chain targets are invalid`);let t=e.map((e,t)=>et(e,t));if(new Set(t.map(Te)).size!==t.length)throw Error(`walletRecoveryPrepare ECDSA recovery chain targets are duplicated`);let n=t[0];if(!n)throw Error(`walletRecoveryPrepare ECDSA recovery chain targets are invalid`);return[n,...t.slice(1)]}function et(e,t){let n=`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.chainTargets[${t}]`,r=F(e,n),i=L(r,`kind`);Ie(r,i===`evm`?[`kind`,`namespace`,`chainId`,`networkSlug`]:[`kind`,`chainId`,`networkSlug`],n);let a=L(r,`namespace`),o=Number(L(r,`chainId`));if(!Number.isSafeInteger(o)||o<=0)throw Error(`walletRecoveryPrepare ECDSA recovery chain id is invalid`);let s=L(r,`networkSlug`),c=typeof s==`string`&&s.trim()?s.trim():null;if(i===`evm`){if(a!==`eip155`)throw Error(`walletRecoveryPrepare ECDSA recovery EVM namespace is invalid`);return{kind:`evm`,namespace:`eip155`,chainId:o,networkSlug:c??`evm-${o}`}}if(i===`tempo`)return{kind:`tempo`,chainId:o,networkSlug:c??`tempo-${o}`};throw Error(`walletRecoveryPrepare ECDSA recovery chain family is invalid`)}function tt(e){if(!Array.isArray(e)||e.length!==2||e[0]!==1||e[1]!==2)throw Error(`walletRecoveryPrepare ECDSA recovery participant IDs are invalid`);return[1,2]}function nt(e){let t=I(e,[`lifecycle_id`,`root_share_epoch`,`account_id`,`threshold_session_id`,`signer_set_id`,`signing_worker_id`,`material_activation`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.scope`);return{lifecycle_id:R(L(t,`lifecycle_id`),`keyManifest.entries[].recoveryBasis.scope.lifecycle_id`),root_share_epoch:R(L(t,`root_share_epoch`),`keyManifest.entries[].recoveryBasis.scope.root_share_epoch`),account_id:R(L(t,`account_id`),`keyManifest.entries[].recoveryBasis.scope.account_id`),threshold_session_id:R(L(t,`threshold_session_id`),`keyManifest.entries[].recoveryBasis.scope.threshold_session_id`),signer_set_id:R(L(t,`signer_set_id`),`keyManifest.entries[].recoveryBasis.scope.signer_set_id`),signing_worker_id:R(L(t,`signing_worker_id`),`keyManifest.entries[].recoveryBasis.scope.signing_worker_id`),material_activation:fe(L(t,`material_activation`))}}function rt(e){let t=I(e,[`wallet_id`,`near_ed25519_signing_key_id`,`signing_root_id`,`key_creation_signer_slot`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.applicationBinding`),n=Number(L(t,`key_creation_signer_slot`));if(!Number.isSafeInteger(n)||n<=0)throw Error(`walletRecoveryPrepare NEAR recovery key-creation signer slot is invalid`);return{wallet_id:R(L(t,`wallet_id`),`keyManifest.entries[].recoveryBasis.applicationBinding.wallet_id`),near_ed25519_signing_key_id:R(L(t,`near_ed25519_signing_key_id`),`keyManifest.entries[].recoveryBasis.applicationBinding.near_ed25519_signing_key_id`),signing_root_id:R(L(t,`signing_root_id`),`keyManifest.entries[].recoveryBasis.applicationBinding.signing_root_id`),key_creation_signer_slot:n}}function it(e){let t=I(e,[`orgId`,`projectId`,`envId`,`signingRootVersion`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.runtimePolicyScope`);try{return C(t)}catch{throw Error(`walletRecoveryPrepare NEAR recovery runtime policy scope is invalid`)}}function at(e,t){if(!Array.isArray(e)||e.length!==2||!Number.isSafeInteger(e[0])||!Number.isSafeInteger(e[1])||Number(e[0])<=0||Number(e[1])<=0||Number(e[0])===Number(e[1]))throw Error(`walletRecoveryPrepare ${t} is invalid`);return[Number(e[0]),Number(e[1])]}function ot(e,t,n){let r=R(e,n),i=m(r);if(i.length!==t||p(i)!==r)throw Error(`walletRecoveryPrepare ${n} is invalid`);return r}function st(e,t){let n=R(e,t),r=m(n);if(r.length===0||p(r)!==n)throw Error(`walletRecoveryPrepare ${t} is invalid`);return n}function z(e,t,n){if(!Array.isArray(e)||e.length!==t||e.some(e=>!Number.isInteger(e)||e<0||e>255))throw Error(`walletRecoveryPrepare ${n} is invalid`);return e.map(Number)}const ct=`/wallets/recovery/finalize`;async function lt(e){let t=`${k(e.relayUrl)}${ct}`,n=e.fetchImpl||fetch,r;try{r=Me(e.webauthnRegistration)}catch{return{kind:`refused`}}let i;try{let t=new Set;i=e.ecdsaMaterialPossessionProofs.map(e=>{if(typeof e.keySetId!=`string`||!e.keySetId.startsWith(`evm_family_ecdsa:`)||e.keySetId.length<=17)throw Error(`ECDSA possession proof key-set id is invalid`);if(t.has(e.keySetId))throw Error(`ECDSA possession proof key-set ids are duplicated`);return t.add(e.keySetId),{keySetId:e.keySetId,proof:N(e.proof)}})}catch{return{kind:`refused`}}let a;try{if(a=j(e.replacementEnvelope,`walletRecoveryFinalize.replacementEnvelope`),String(a.walletId)!==String(e.walletId))throw Error(`replacement envelope changed the wallet identity`);if(String(a.envelopeId)!==String(e.replacementId))throw Error(`replacement envelope changed the replacement identity`);if(a.factor.kind!==`passkey`)throw Error(`replacement envelope is not bound to a passkey`)}catch{return{kind:`refused`}}let o;try{o=await n(t,O({body:{kind:`finalize`,walletId:e.walletId,reservationId:e.reservationId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,challengeId:e.challengeId,replacementId:e.replacementId,webauthnRegistration:r,replacementEnvelope:a,ecdsaMaterialPossessionProofs:i}}))}catch{return{kind:`transport_uncertain`}}let s=dt(await o.json().catch(()=>({})));if(o.status===200&&s.kind===`success`)try{let t=await P(s.projection,ft(e,a));if(t.kind!==`passkey`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:t.storeVersion,authority:t.authority,authMethod:t.authMethod}}catch{return{kind:`transport_uncertain`}}return o.status===409?{kind:`retryable_conflict`}:o.status===400||o.status===401?{kind:`refused`}:{kind:`transport_uncertain`}}async function ut(e){let t;try{if(t=j(e.replacementEnvelope,`walletRecoveryReplay.replacementEnvelope`),String(t.walletId)!==String(e.walletId)||String(t.envelopeId)!==String(e.replacementId)||t.factor.kind!==`passkey`)throw Error(`recovery replay envelope identity is invalid`)}catch{return{kind:`refused`}}let n;try{n=await(e.fetchImpl??fetch)(`${k(e.relayUrl)}${ct}`,O({body:{kind:`replay`,walletId:e.walletId,reservationId:e.reservationId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,replacementId:e.replacementId,replacementEnvelope:t}}))}catch{return{kind:`transport_uncertain`}}let r=dt(await n.json().catch(()=>({})));if(n.status===200&&r.kind===`success`)try{let n=await P(r.projection,ft(e,t));if(n.kind!==`passkey`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:n.storeVersion,authority:n.authority,authMethod:n.authMethod}}catch{return{kind:`transport_uncertain`}}return n.status===409?{kind:`retryable_conflict`}:n.status===400||n.status===401?{kind:`refused`}:{kind:`transport_uncertain`}}function dt(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===2&&n.includes(`ok`)&&n.includes(`projection`)&&t.get(`ok`)===!0)return{kind:`success`,projection:t.get(`projection`)};let r=t.get(`code`),i=t.get(`message`);return t.size===3&&n.includes(`ok`)&&n.includes(`code`)&&n.includes(`message`)&&t.get(`ok`)===!1&&typeof r==`string`&&typeof i==`string`?{kind:`failure`,code:r,message:i}:{kind:`invalid`}}function ft(e,i){if(i.factor.kind!==`passkey`)throw Error(`replacement envelope is not a passkey envelope`);return{kind:`passkey`,walletId:B(n(e.walletId)),recoveryOperationId:B(c(e.recoveryOperationId)),targetDeviceId:B(ne(e.targetDeviceId)),targetAuthorityId:B(t(e.targetAuthorityId)),targetWalletAuthMethodId:B(r(e.targetWalletAuthMethodId)),rpId:i.factor.rpId,credentialIdB64u:i.factor.credentialIdB64u}}function B(e){if(!e.ok)throw Error(`invalid recovery identity`);return e.value}function V(e){return e.target.kind===`passkey`}function pt(e){return{kind:`email_otp_enrollment_reference_v1`,enrollmentId:e.enrollment.enrollmentId,enrollmentSealKeyVersion:e.enrollment.kind===`existing`?e.enrollment.enrollmentSealKeyVersion:e.enrollment.material.enrollmentSealKeyVersion}}const mt=[`kind`,`keySetId`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`participantIds`,`stateEpoch`,`signingWorkerVerifyingShareB64u`,`materialActivation`,`sealed`],ht=[`kind`,`keySetId`,`possessionProof`,`readyStateBlobB64u`,`publicFacts`],gt=[`contextBinding32B64u`,`derivationClientSharePublicKey33B64u`,`clientVerifyingShare33B64u`,`relayerPublicKey33B64u`,`groupPublicKey33B64u`,`ethereumAddress`,`clientShareRetryCounter`,`relayerShareRetryCounter`],_t=[`kind`,`version`,`recoveryOperationId`,`walletId`,`reservationId`,`targetDeviceId`,`targetAuthorityId`,`targetWalletAuthMethodId`,`replacementEnvelope`,`keyManifest`,`nearKeySets`,`ecdsaKeySets`,`target`];function H(e,t,n){if(h(e,t,n),Object.keys(e).length!==t.length)throw Error(n+` fields are invalid`)}function U(e,t){if(typeof e!=`string`||!e||e.trim()!==e)throw Error(t+` must be a non-empty canonical string`);return e}function W(e,t,n){let r=U(e,t),i=m(r);if(n!==void 0&&i.byteLength!==n)throw Error(t+` must decode to `+n+` bytes`);return r}function vt(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(t+` must be a non-negative safe integer`);return e}function yt(e,t){if(!Array.isArray(e)||e.length!==2||e.some(bt))throw Error(t+` must contain two positive participant IDs`);return[e[0],e[1]]}function bt(e){return typeof e!=`number`||!Number.isSafeInteger(e)||e<1}function xt(e,t){let n=U(f(t,`recovery durable NEAR key set`).keySetId,`recovery durable NEAR keySetId`),r=e.entries.find(e=>e.keySetId===n);if(!r||r.kind!==`near_ed25519`)throw Error(`recovery durable NEAR key-set manifest entry is invalid`);return r}function St(e,t){let n=U(f(t,`recovery durable ECDSA key set`).keySetId,`recovery durable ECDSA keySetId`),r=e.entries.find(e=>e.keySetId===n);if(!r||r.kind!==`evm_family_ecdsa`)throw Error(`recovery durable ECDSA key-set manifest entry is invalid`);return r}function Ct(e){let t=ee(e);if(!t)throw Error(`recovery runtime policy scope is invalid`);return t}function wt(e,t){let n=f(e,`recovery durable NEAR key set`);if(H(n,mt,`recovery durable NEAR key set`),n.kind!==`near_ed25519`||n.keySetId!==t.keySetId)throw Error(`recovery durable NEAR key-set identity is invalid`);let r=t.recoveryBasis,i=r.scope.threshold_session_id;if(!s(i).ok)throw Error(`recovery durable NEAR thresholdSessionId is invalid`);let a={kind:ae,applicationBindingDigestB64u:S(n.applicationBindingDigestB64u,`recovery durable NEAR application binding digest`),registeredPublicKeyB64u:v(n.registeredPublicKeyB64u,`recovery durable NEAR registered public key`),participantIds:yt(n.participantIds,`recovery durable NEAR participantIds`),stateEpoch:U(n.stateEpoch,`recovery durable NEAR stateEpoch`),walletId:r.applicationBinding.wallet_id,nearAccountId:t.nearAccountId,nearEd25519SigningKeyId:r.applicationBinding.near_ed25519_signing_key_id,signerSlot:y(r.applicationBinding.key_creation_signer_slot,`recovery durable NEAR signerSlot`),signingWorkerId:r.scope.signing_worker_id,signingWorkerVerifyingShareB64u:v(n.signingWorkerVerifyingShareB64u,`recovery durable NEAR signing-worker verifying share`)},o=f(n.sealed,`recovery durable NEAR sealed material`);return H(o,[`ciphertextB64u`,`nonceB64u`],`recovery durable NEAR sealed material`),{kind:`near_ed25519`,keySetId:t.keySetId,binding:a,thresholdSessionId:i,runtimePolicyScope:Ct(r.runtimePolicyScope),materialActivation:fe(n.materialActivation),sealed:{ciphertextB64u:b(o.ciphertextB64u,`recovery durable NEAR ciphertext`),nonceB64u:_(o.nonceB64u,`recovery durable NEAR nonce`)}}}function Tt(e){let t=f(e,`recovery durable ECDSA public facts`);H(t,gt,`recovery durable ECDSA public facts`);let n=U(t.ethereumAddress,`recovery durable ECDSA ethereumAddress`).toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(n))throw Error(`recovery durable ECDSA ethereumAddress is invalid`);return{contextBinding32B64u:S(t.contextBinding32B64u,`recovery durable ECDSA context binding`),derivationClientSharePublicKey33B64u:x(t.derivationClientSharePublicKey33B64u,`recovery durable ECDSA client share`),clientVerifyingShare33B64u:x(t.clientVerifyingShare33B64u,`recovery durable ECDSA client verifying share`),relayerPublicKey33B64u:x(t.relayerPublicKey33B64u,`recovery durable ECDSA relayer public key`),groupPublicKey33B64u:x(t.groupPublicKey33B64u,`recovery durable ECDSA group public key`),ethereumAddress:n,clientShareRetryCounter:vt(t.clientShareRetryCounter,`recovery durable ECDSA client-share retry counter`),relayerShareRetryCounter:vt(t.relayerShareRetryCounter,`recovery durable ECDSA relayer-share retry counter`)}}function Et(e,t){let n=f(e,`recovery durable ECDSA key set`);if(H(n,ht,`recovery durable ECDSA key set`),n.kind!==`evm_family_ecdsa`||n.keySetId!==t.keySetId)throw Error(`recovery durable ECDSA key-set identity is invalid`);return{kind:`evm_family_ecdsa`,entry:t,possessionProof:N(n.possessionProof),readyStateBlobB64u:W(n.readyStateBlobB64u,`recovery durable ECDSA ready-state blob`),publicFacts:Tt(n.publicFacts)}}function Dt(e){let t=f(e,`recovery durable registration`);if(H(t,[`kind`,`id`,`rawId`,`type`,`authenticatorAttachment`,`response`],`recovery durable registration`),t.kind!==`wallet_recovery_redacted_registration_v1`)throw Error(`recovery durable registration kind is invalid`);if(t.authenticatorAttachment!==null&&typeof t.authenticatorAttachment!=`string`)throw Error(`recovery durable registration authenticatorAttachment is invalid`);let n=f(t.response,`recovery durable registration response`);if(H(n,[`clientDataJSON`,`attestationObject`,`transports`],`recovery durable registration response`),!Array.isArray(n.transports))throw Error(`recovery durable registration transports are invalid`);return{kind:`wallet_recovery_redacted_registration_v1`,id:U(t.id,`recovery durable registration id`),rawId:W(t.rawId,`recovery durable registration rawId`),type:U(t.type,`recovery durable registration type`),authenticatorAttachment:t.authenticatorAttachment,response:{clientDataJSON:W(n.clientDataJSON,`recovery durable registration clientDataJSON`),attestationObject:W(n.attestationObject,`recovery durable registration attestationObject`),transports:n.transports.map((e,t)=>U(e,`recovery durable registration transports[`+t+`]`))}}}function Ot(e){let t=f(e,`recovery durable Email OTP enrollment`);if(t.kind===`existing`)return H(t,[`kind`,`enrollmentId`,`enrollmentSealKeyVersion`],`recovery durable existing Email OTP enrollment`),{kind:`existing`,enrollmentId:U(t.enrollmentId,`recovery enrollmentId`),enrollmentSealKeyVersion:U(t.enrollmentSealKeyVersion,`recovery enrollment seal-key version`)};if(t.kind!==`create`)throw Error(`recovery durable Email OTP enrollment kind is invalid`);H(t,[`kind`,`enrollmentId`,`providerSubject`,`verifiedEmail`,`material`],`recovery durable create Email OTP enrollment`);let n=f(t.material,`recovery durable enrollment material`);return H(n,[`enrollmentSealKeyVersion`,`clientUnlockPublicKeyB64u`,`unlockKeyVersion`,`serverSealedFactorCiphertextB64u`],`recovery durable enrollment material`),{kind:`create`,enrollmentId:U(t.enrollmentId,`recovery enrollmentId`),providerSubject:U(t.providerSubject,`recovery enrollment providerSubject`),verifiedEmail:U(t.verifiedEmail,`recovery enrollment verifiedEmail`),material:{enrollmentSealKeyVersion:U(n.enrollmentSealKeyVersion,`recovery enrollment material seal-key version`),clientUnlockPublicKeyB64u:W(n.clientUnlockPublicKeyB64u,`recovery enrollment client unlock public key`),unlockKeyVersion:U(n.unlockKeyVersion,`recovery enrollment unlock-key version`),serverSealedFactorCiphertextB64u:W(n.serverSealedFactorCiphertextB64u,`recovery enrollment sealed factor ciphertext`)}}}function G(e){let o=f(e,`wallet recovery durable payload`);if(o.kind!==`wallet_recovery_durable_payload_v1`||o.version!==1)throw Error(`wallet recovery durable payload version is invalid`);H(o,[..._t,...f(o.target,`wallet recovery durable target`).kind===`passkey`?[`replacementId`,`challengeId`,`registration`]:[`providerSubject`,`verifiedEmail`,`emailHashHex`,`registrationAuthorityId`,`replacementId`,`enrollment`]],`wallet recovery durable payload`);let s=c(o.recoveryOperationId),l=n(o.walletId),u;try{u=ke(o.reservationId)}catch(e){throw Error(`wallet recovery durable reservationId is invalid`,{cause:e})}let d=ne(o.targetDeviceId),p=t(o.targetAuthorityId),m=r(o.targetWalletAuthMethodId);if(!s.ok||!l.ok||!d.ok||!p.ok||!m.ok)throw Error(`wallet recovery durable payload identity is invalid`);if(!Array.isArray(o.nearKeySets)||!Array.isArray(o.ecdsaKeySets))throw Error(`wallet recovery durable key-set arrays are invalid`);let h=Ye(o.keyManifest,String(l.value)),g=o.nearKeySets.map(e=>wt(e,xt(h,e))),_=o.ecdsaKeySets.map(e=>Et(e,St(h,e))),v=[...g.map(e=>e.keySetId),..._.map(e=>e.entry.keySetId)];if(new Set(v).size!==v.length)throw Error(`wallet recovery durable key-set ids are duplicated`);if(h.entries.length!==v.length||h.entries.some(e=>!v.includes(e.keySetId)))throw Error(`wallet recovery durable key-set manifest coverage is invalid`);let y={kind:`wallet_recovery_durable_payload_v1`,version:1,recoveryOperationId:s.value,walletId:l.value,reservationId:u,targetDeviceId:d.value,targetAuthorityId:p.value,targetWalletAuthMethodId:m.value,replacementEnvelope:j(o.replacementEnvelope,`wallet recovery durable replacementEnvelope`),keyManifest:h,nearKeySets:g,ecdsaKeySets:_};if(String(y.replacementEnvelope.walletId)!==String(l.value))throw Error(`wallet recovery durable replacement envelope wallet changed`);if(y.replacementEnvelope.ownership.kind!==`method_bound`||y.replacementEnvelope.ownership.walletAuthMethodId!==m.value)throw Error(`wallet recovery durable replacement envelope method changed`);for(let e of g)if(e.binding.walletId!==String(l.value))throw Error(`wallet recovery durable NEAR binding wallet changed`);let b=f(o.target,`wallet recovery durable target`);if(b.kind===`passkey`){H(b,[`kind`,`rpId`],`wallet recovery durable passkey target`);let e=i(b.rpId);if(!e.ok)throw Error(`wallet recovery durable passkey RP ID is invalid`);let t=Dt(o.registration);if(t.rawId!==y.replacementEnvelope.factor.credentialIdB64u)throw Error(`wallet recovery durable passkey registration identity changed`);if(y.replacementEnvelope.factor.kind!==`passkey`)throw Error(`wallet recovery durable passkey envelope factor is invalid`);if(y.replacementEnvelope.factor.rpId!==e.value||y.replacementEnvelope.factor.credentialIdB64u!==t.rawId)throw Error(`wallet recovery durable passkey envelope identity changed`);let n=U(o.replacementId,`wallet recovery durable replacementId`);if(String(y.replacementEnvelope.envelopeId)!==n)throw Error(`wallet recovery durable passkey envelope id changed`);return{...y,target:{kind:`passkey`,rpId:e.value},replacementId:n,challengeId:U(o.challengeId,`wallet recovery durable challengeId`),registration:t}}if(b.kind!==`google_email_otp`)throw Error(`wallet recovery durable target kind is invalid`);H(b,[`kind`],`wallet recovery durable Email OTP target`);let x=U(o.providerSubject,`wallet recovery providerSubject`);if(!a(x).ok)throw Error(`wallet recovery durable providerSubject is invalid`);let S=U(o.verifiedEmail,`wallet recovery durable verifiedEmail`),C=U(o.emailHashHex,`wallet recovery durable emailHashHex`);if(!/^[0-9a-f]{64}$/.test(C))throw Error(`wallet recovery durable emailHashHex is invalid`);let ee=U(o.registrationAuthorityId,`wallet recovery durable registrationAuthorityId`),w=Ot(o.enrollment);if(y.replacementEnvelope.factor.kind!==`email_otp`)throw Error(`wallet recovery durable Email OTP envelope factor is invalid`);let T=w.kind===`existing`?{enrollmentId:w.enrollmentId,enrollmentSealKeyVersion:w.enrollmentSealKeyVersion}:{enrollmentId:w.enrollmentId,enrollmentSealKeyVersion:w.material.enrollmentSealKeyVersion};if(y.replacementEnvelope.factor.enrollmentId!==T.enrollmentId||y.replacementEnvelope.factor.enrollmentSealKeyVersion!==T.enrollmentSealKeyVersion)throw Error(`wallet recovery durable Email OTP envelope identity changed`);if(w.kind===`create`&&(w.providerSubject!==x||w.verifiedEmail!==S))throw Error(`wallet recovery durable Email OTP enrollment identity changed`);let E=U(o.replacementId,`wallet recovery durable replacementId`);if(String(y.replacementEnvelope.envelopeId)!==E)throw Error(`wallet recovery durable Email OTP envelope id changed`);return{...y,target:{kind:`google_email_otp`},providerSubject:x,verifiedEmail:S,emailHashHex:C,registrationAuthorityId:ee,replacementId:E,enrollment:w}}function kt(e){let t=e.nearKeySets.map(e=>({kind:e.kind,keySetId:e.keySetId,applicationBindingDigestB64u:e.binding.applicationBindingDigestB64u,registeredPublicKeyB64u:e.binding.registeredPublicKeyB64u,participantIds:e.binding.participantIds,stateEpoch:e.binding.stateEpoch,signingWorkerVerifyingShareB64u:e.binding.signingWorkerVerifyingShareB64u,materialActivation:e.materialActivation,sealed:e.sealed})),n=e.ecdsaKeySets.map(e=>({kind:e.kind,keySetId:e.entry.keySetId,possessionProof:e.possessionProof,readyStateBlobB64u:e.readyStateBlobB64u,publicFacts:e.publicFacts})),r={kind:e.kind,version:e.version,recoveryOperationId:String(e.recoveryOperationId),walletId:String(e.walletId),reservationId:String(e.reservationId),targetDeviceId:String(e.targetDeviceId),targetAuthorityId:String(e.targetAuthorityId),targetWalletAuthMethodId:String(e.targetWalletAuthMethodId),replacementEnvelope:e.replacementEnvelope,keyManifest:e.keyManifest,nearKeySets:t,ecdsaKeySets:n},i=V(e)?{...r,target:e.target,replacementId:e.replacementId,challengeId:e.challengeId,registration:e.registration}:{...r,target:e.target,providerSubject:e.providerSubject,verifiedEmail:e.verifiedEmail,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,replacementId:e.replacementId,enrollment:e.enrollment};return G(i),i}async function K(e){if(V(e))return;let t=await d(e.verifiedEmail);if(e.emailHashHex!==t)throw Error(`wallet recovery durable email hash does not match verified email`);if(e.enrollment.kind===`create`&&(e.enrollment.providerSubject!==e.providerSubject||e.enrollment.verifiedEmail!==e.verifiedEmail))throw Error(`wallet recovery durable enrollment does not match Email OTP identity`)}function q(t){if(V(t)){let n=e(t.registration.rawId);if(!n.ok)throw Error(`wallet recovery durable passkey credential id is invalid`);return{kind:`passkey`,rpId:t.target.rpId,credentialIdB64u:n.value}}let n=a(t.providerSubject);if(!n.ok)throw Error(`wallet recovery durable providerSubject is invalid`);return{kind:`google_email_otp`,providerSubject:n.value,emailHashHex:t.emailHashHex,registrationAuthorityId:t.registrationAuthorityId,enrollment:pt(t)}}function At(e){return{kind:`near_ed25519`,keySetId:e.entry.keySetId,applicationBindingDigestB64u:e.localMaterial.applicationBindingDigestB64u,registeredPublicKeyB64u:p(e.metadata.registeredPublicKey),participantIds:e.metadata.participantIds,stateEpoch:String(e.metadata.stateEpoch),signingWorkerVerifyingShareB64u:p(e.metadata.signingWorkerVerifyingShare),materialActivation:ye(e.metadata.materialActivation),sealed:{ciphertextB64u:e.localMaterial.b64u,nonceB64u:e.localMaterial.nonceB64u}}}function jt(e){return{kind:`evm_family_ecdsa`,keySetId:e.entry.keySetId,possessionProof:N(e.activation.possessionProof),readyStateBlobB64u:e.readyStateBlobB64u,publicFacts:e.publicFacts}}function Mt(e){return{kind:`wallet_recovery_redacted_registration_v1`,id:e.id,rawId:e.rawId,type:e.type,authenticatorAttachment:e.authenticatorAttachment??null,response:{clientDataJSON:e.response.clientDataJSON,attestationObject:e.response.attestationObject,transports:[...e.response.transports]}}}async function Nt(e){let t={kind:`wallet_recovery_durable_payload_v1`,version:1,recoveryOperationId:String(e.prepared.recoveryOperationId),walletId:e.walletId,reservationId:e.prepared.reservationId,targetDeviceId:e.prepared.targetDeviceId,targetAuthorityId:e.prepared.targetAuthorityId,targetWalletAuthMethodId:e.prepared.targetWalletAuthMethodId,replacementEnvelope:j(e.recovered.replacementEnvelope,`wallet recovery durable replacement envelope`),keyManifest:{version:`wallet_recovery_preparation_key_manifest_v1`,walletId:String(e.walletId),entries:[...e.recovered.nearKeySets.map(e=>e.entry),...e.recovered.ecdsaKeySets.map(e=>e.entry)]},nearKeySets:e.recovered.nearKeySets.map(At),ecdsaKeySets:e.recovered.ecdsaKeySets.map(jt)};if(e.replacement.kind===`passkey`){if(e.target.kind!==`passkey`)throw Error(`wallet recovery durable payload branch is invalid`);let n=e.prepared.registration;if(!n)throw Error(`wallet recovery registration options are unavailable`);let r=Mt(e.replacement.registration);if(r.rawId!==e.replacement.credentialIdB64u)throw Error(`wallet recovery passkey registration rawId changed its credential identity`);let i=G({...t,target:{kind:`passkey`,rpId:e.target.rpId},replacementId:n.replacementId,challengeId:n.challengeId,registration:r});return await K(i),i}if(e.target.kind!==`google_email_otp`)throw Error(`wallet recovery durable payload branch is invalid`);let n=e.replacement.enrollment;if(e.replacement.factor.walletAuthMethodId!==t.targetWalletAuthMethodId)throw Error(`wallet recovery Email OTP factor method changed its target identity`);let r=await d(e.replacement.verifiedEmail),i=G({...t,target:{kind:`google_email_otp`},enrollment:n,providerSubject:e.replacement.providerSubject,verifiedEmail:e.replacement.verifiedEmail,emailHashHex:r,registrationAuthorityId:e.replacement.registrationAuthorityId,replacementId:e.replacement.factor.replacementId});return await K(i),i}function Pt(e){return new TextEncoder().encode(u({kind:`pending_wallet_recovery_commit_v1`,version:1,...e}))}function Ft(e){return Pt({recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,reservationId:e.reservationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,target:q(e)})}async function It(e){let t=await crypto.subtle.generateKey({name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`]);if(!(t instanceof CryptoKey))throw Error(`wallet recovery durable key generation failed`);let n=crypto.getRandomValues(new Uint8Array(12)),r=new TextEncoder().encode(JSON.stringify(kt(e)));return{kind:`wallet_recovery_encrypted_material_v1`,key:t,iv:n,ciphertext:new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n,additionalData:Ft(e)},t,r))}}async function Lt(e){let t=await crypto.subtle.decrypt({name:`AES-GCM`,iv:e.localMaterial.iv,additionalData:Rt(e)},e.localMaterial.key,e.localMaterial.ciphertext),n=G(JSON.parse(new TextDecoder().decode(t)));if(await K(n),!zt(e,n))throw Error(`wallet recovery durable payload identity does not match its journal`);return n}function Rt(e){return Pt({recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,reservationId:e.reservationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,target:e.target})}function J(e){let t=c(e);if(!t.ok)throw Error(`wallet recovery operation id is invalid`);return t.value}function zt(e,t){let n={kind:`pending_wallet_recovery_commit_v1`,version:1,recoveryOperationId:J(t.recoveryOperationId),walletId:t.walletId,reservationId:t.reservationId,targetDeviceId:t.targetDeviceId,targetAuthorityId:t.targetAuthorityId,targetWalletAuthMethodId:t.targetWalletAuthMethodId,localMaterial:e.localMaterial,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs},r=q(t);if(e.stage===`awaiting_server_promotion`)return Ee(e,{...n,stage:`awaiting_server_promotion`,target:r});switch(r.kind){case`passkey`:return e.projection.kind===`passkey`?Ee(e,{...n,stage:`server_promoted`,target:r,projection:e.projection}):!1;case`google_email_otp`:return e.projection.kind===`google_email_otp`?Ee(e,{...n,stage:`server_promoted`,target:r,projection:e.projection}):!1}}function Bt(e,t,n,r){return{kind:`pending_wallet_recovery_commit_v1`,version:1,recoveryOperationId:J(e.recoveryOperationId),walletId:e.walletId,reservationId:e.reservationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,target:q(e),localMaterial:t,createdAtMs:n,updatedAtMs:r}}function Vt(e,t,n=Date.now()){return{...Bt(e,t,n,n),stage:`awaiting_server_promotion`}}function Ht(e,t,n,r=Date.now()){let i=Bt(t,e.localMaterial,e.createdAtMs,Math.max(r,e.createdAtMs+1));if(V(t)){if(n.kind!==`passkey`)throw Error(`wallet recovery promotion projection branch changed`);return{...i,stage:`server_promoted`,target:q(t),projection:n}}if(n.kind!==`google_email_otp`)throw Error(`wallet recovery promotion projection branch changed`);return{...i,stage:`server_promoted`,target:q(t),projection:n}}const Ut=`/wallets/recovery/google-email-otp/finalize`;async function Wt(e){let t=await Y(e,`/wallets/recovery/google/verify`,{recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,idToken:e.idToken});if(!t.ok)return t.failure;try{let n=Yt(t.body),r=Jt(n,e),i=Q(o(n.challengeId)),a=Number(n.expiresAtMs);if(!Number.isSafeInteger(a)||a<=0)throw Error(`invalid expiry`);return{kind:`verified`,...r,challengeId:i,delivery:Se(n.delivery,`walletRecoveryGoogleVerify.delivery`),expiresAtMs:a}}catch{return{kind:`transport_uncertain`}}}async function Gt(e){let t=await Y(e,`/wallets/recovery/email-otp/verify`,{recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,challengeId:e.challengeId,otpCode:e.otpCode});if(!t.ok)return t.failure;try{let n=Xt(t.body),r=Jt(n,e),i=Q(o(n.challengeId));if(i!==e.challengeId)throw Error(`challenge changed`);return{kind:`verified`,...r,challengeId:i}}catch{return{kind:`transport_uncertain`}}}async function Kt(e){let t,n;try{if(t=j(e.replacementEnvelope,`walletRecoveryGoogleEmailOtpFinalize.replacementEnvelope`),t.factor.kind!==`email_otp`)throw Error(`wrong factor`);n=e.ecdsaMaterialPossessionProofs.map(e=>({keySetId:e.keySetId,proof:N(e.proof)}))}catch{return{kind:`refused`}}let r=await Y(e,Ut,{kind:`finalize`,recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,replacementEnvelope:t,ecdsaMaterialPossessionProofs:n,...e.emailOtpEnrollment?{emailOtpEnrollment:e.emailOtpEnrollment}:{}});if(!r.ok)return r.failure;try{let n=await P(Zt(r.body,`walletRecoveryGoogleEmailOtpFinalize`).projection,en(e,t));if(n.kind!==`google_email_otp`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:n.storeVersion,authority:n.authority,authMethod:n.authMethod}}catch{return{kind:`transport_uncertain`}}}async function qt(e){let t;try{if(t=j(e.replacementEnvelope,`walletRecoveryGoogleEmailOtpReplay.replacementEnvelope`),t.factor.kind!==`email_otp`||String(t.walletId)!==String(e.walletId))throw Error(`recovery replay envelope identity is invalid`)}catch{return{kind:`refused`}}let n=await Y(e,Ut,{kind:`replay`,recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,replacementEnvelope:t});if(!n.ok)return n.failure;try{let r=await P(Zt(n.body,`walletRecoveryGoogleEmailOtpReplay`).projection,en(e,t));if(r.kind!==`google_email_otp`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:r.storeVersion,authority:r.authority,authMethod:r.authMethod}}catch{return{kind:`transport_uncertain`}}}async function Y(e,t,n){let r;try{r=await(e.fetchImpl??fetch)(`${k(e.relayUrl)}${t}`,O({body:n}))}catch{return{ok:!1,failure:{kind:`transport_uncertain`}}}let i=await r.json().catch(()=>void 0);return r.status===200?{ok:!0,body:i}:r.status===409||r.status===429?{ok:!1,failure:{kind:`retryable_conflict`}}:r.status===400||r.status===401?{ok:!1,failure:{kind:`refused`}}:{ok:!1,failure:{kind:`transport_uncertain`}}}function Jt(e,t){let n=Q(c(e.recoveryOperationId)),r=ke(e.reservationId);if(n!==t.recoveryOperationId||r!==t.reservationId)throw Error(`recovery operation identity changed`);return{recoveryOperationId:n,reservationId:r}}function Yt(e){let t=X(e,[`ok`,`recoveryOperationId`,`reservationId`,`challengeId`,`delivery`,`expiresAtMs`],`walletRecoveryGoogleVerify`);return $t(t,`walletRecoveryGoogleVerify`),{recoveryOperationId:Z(t,`recoveryOperationId`),reservationId:Z(t,`reservationId`),challengeId:Z(t,`challengeId`),delivery:Z(t,`delivery`),expiresAtMs:Z(t,`expiresAtMs`)}}function Xt(e){let t=X(e,[`ok`,`recoveryOperationId`,`reservationId`,`challengeId`],`walletRecoveryEmailOtpVerify`);return $t(t,`walletRecoveryEmailOtpVerify`),{recoveryOperationId:Z(t,`recoveryOperationId`),reservationId:Z(t,`reservationId`),challengeId:Z(t,`challengeId`)}}function Zt(e,t){let n=X(e,[`ok`,`projection`],t);return $t(n,t),{projection:Z(n,`projection`)}}function X(e,t,n){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be a JSON object`);let r=Object.getPrototypeOf(e);if(r!==Object.prototype&&r!==null)throw Error(`${n} must be a plain JSON object`);let i=Object.keys(e);if(i.length!==t.length||!Qt(i,t))throw Error(`${n} has an unexpected response shape`);return e}function Qt(e,t){for(let n of t)if(!e.includes(n))return!1;return!0}function $t(e,t){if(Z(e,`ok`)!==!0)throw Error(`${t} did not succeed`)}function Z(e,t){let n=Object.getOwnPropertyDescriptor(e,t);if(!n||!(`value`in n))throw Error(`response field ${t} is missing`);return n.value}function Q(e){if(!e.ok)throw Error(`invalid domain identity`);return e.value}function $(e){if(typeof e!=`string`||!e.trim())throw Error(`value must be a string`);return e.trim()}function en(e,t){if(t.factor.kind!==`email_otp`)throw Error(`replacement envelope is not an Email OTP envelope`);return{kind:`google_email_otp`,walletId:e.walletId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,providerSubject:Q(a(e.expectedProviderSubject)),emailHashHex:tn(e.expectedEmailHashHex),registrationAuthorityId:$(e.expectedRegistrationAuthorityId),enrollment:{kind:`email_otp_enrollment_reference_v1`,enrollmentId:$(t.factor.enrollmentId),enrollmentSealKeyVersion:$(t.factor.enrollmentSealKeyVersion)}}}function tn(e){let t=$(e);if(!/^[0-9a-f]{64}$/.test(t))throw Error(`email hash is invalid`);return t}async function nn(e,t){if(e.version!==t.version||e.storeVersion!==t.storeVersion||e.walletId!==t.walletId||e.recoveryOperationId!==t.recoveryOperationId||e.targetDeviceId!==t.targetDeviceId||e.targetAuthorityId!==t.targetAuthorityId||e.targetWalletAuthMethodId!==t.targetWalletAuthMethodId||!await ce(e.authority,t.authority)||!Ce(e.authMethod,t.authMethod)||e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`?e.target.kind===t.target.kind&&e.target.rpId===t.target.rpId&&e.target.credentialIdB64u===t.target.credentialIdB64u:!1;case`google_email_otp`:return t.kind===`google_email_otp`?e.target.kind===t.target.kind&&e.target.provider===t.target.provider&&e.target.providerSubject===t.target.providerSubject&&e.target.emailHashHex===t.target.emailHashHex&&e.target.registrationAuthorityId===t.target.registrationAuthorityId&&e.target.enrollment.kind===t.target.enrollment.kind&&e.target.enrollment.enrollmentId===t.target.enrollment.enrollmentId&&e.target.enrollment.enrollmentSealKeyVersion===t.target.enrollment.enrollmentSealKeyVersion:!1;default:return rn(e)}}function rn(e){throw Error(`unsupported wallet recovery projection: ${String(e)}`)}function an(e){let t=J(e.payload.recoveryOperationId);switch(e.kind){case`passkey`:return Ae({kind:`passkey`,storeVersion:e.promotion.storeVersion,walletId:e.payload.walletId,recoveryOperationId:t,targetDeviceId:e.payload.targetDeviceId,targetAuthorityId:e.payload.targetAuthorityId,targetWalletAuthMethodId:e.payload.targetWalletAuthMethodId,authority:e.promotion.authority,authMethod:e.promotion.authMethod});case`google_email_otp`:{let n=a(e.payload.providerSubject);if(!n.ok)throw Error(`wallet recovery provider subject is invalid`);return Ae({kind:`google_email_otp`,storeVersion:e.promotion.storeVersion,walletId:e.payload.walletId,recoveryOperationId:t,targetDeviceId:e.payload.targetDeviceId,targetAuthorityId:e.payload.targetAuthorityId,targetWalletAuthMethodId:e.payload.targetWalletAuthMethodId,authority:e.promotion.authority,authMethod:e.promotion.authMethod,providerSubject:n.value,emailHashHex:e.payload.emailHashHex,registrationAuthorityId:e.payload.registrationAuthorityId,enrollment:pt(e.payload)})}}}function on(e){return e.ecdsaKeySets.map(e=>({keySetId:e.entry.keySetId,proof:e.possessionProof}))}function sn(e){return{id:e.registration.id,rawId:e.registration.rawId,type:e.registration.type,authenticatorAttachment:e.registration.authenticatorAttachment??void 0,response:{clientDataJSON:e.registration.response.clientDataJSON,attestationObject:e.registration.response.attestationObject,transports:[...e.registration.response.transports]},clientExtensionResults:{prf:{results:{first:void 0,second:void 0}}}}}async function cn(e){let{payload:t}=e;if(V(t)){let n=await lt({relayUrl:e.relayUrl,walletId:String(t.walletId),reservationId:String(t.reservationId),recoveryOperationId:J(t.recoveryOperationId),targetDeviceId:String(t.targetDeviceId),targetAuthorityId:String(t.targetAuthorityId),targetWalletAuthMethodId:String(t.targetWalletAuthMethodId),challengeId:t.challengeId,replacementId:t.replacementId,webauthnRegistration:sn(t),replacementEnvelope:t.replacementEnvelope,ecdsaMaterialPossessionProofs:on(t),fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`passkey`,payload:t,promotion:n}:n}let n=await Kt({relayUrl:e.relayUrl,recoveryOperationId:J(t.recoveryOperationId),reservationId:t.reservationId,walletId:t.walletId,targetDeviceId:t.targetDeviceId,targetAuthorityId:t.targetAuthorityId,targetWalletAuthMethodId:t.targetWalletAuthMethodId,expectedProviderSubject:t.providerSubject,expectedEmailHashHex:t.emailHashHex,expectedRegistrationAuthorityId:t.registrationAuthorityId,replacementEnvelope:t.replacementEnvelope,ecdsaMaterialPossessionProofs:on(t),emailOtpEnrollment:ln(t.enrollment),fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`google_email_otp`,payload:t,promotion:n}:n}function ln(e){return e.kind===`create`?{kind:`create`,material:e.material}:null}async function un(e){let{payload:t}=e;if(V(t)){let n=await ut({relayUrl:e.relayUrl,walletId:String(t.walletId),reservationId:String(t.reservationId),recoveryOperationId:J(t.recoveryOperationId),targetDeviceId:String(t.targetDeviceId),targetAuthorityId:String(t.targetAuthorityId),targetWalletAuthMethodId:String(t.targetWalletAuthMethodId),replacementId:t.replacementId,replacementEnvelope:t.replacementEnvelope,fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`passkey`,payload:t,promotion:n}:n}let n=await qt({relayUrl:e.relayUrl,recoveryOperationId:J(t.recoveryOperationId),reservationId:t.reservationId,walletId:t.walletId,targetDeviceId:t.targetDeviceId,targetAuthorityId:t.targetAuthorityId,targetWalletAuthMethodId:t.targetWalletAuthMethodId,expectedProviderSubject:t.providerSubject,expectedEmailHashHex:t.emailHashHex,expectedRegistrationAuthorityId:t.registrationAuthorityId,replacementEnvelope:t.replacementEnvelope,fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`google_email_otp`,payload:t,promotion:n}:n}function dn(e){return e.kind===`passkey`||e.kind===`google_email_otp`}async function fn(e){let t=await un(e);return dn(t)||t.kind!==`refused`?t:await cn(e)}function pn(e,t){return{walletId:e.walletId,factor:{kind:`passkey`,credentialIdB64u:t.target.credentialIdB64u},verifier:{kind:`webauthn`,rpId:t.target.rpId},bindingId:t.authMethod.walletAuthMethodId}}function mn(e,t){let n=xe({walletId:e.walletId,provider:`google`,providerUserId:e.providerSubject,emailHashHex:e.emailHashHex});return{walletId:n.walletId,factor:n.factor,verifier:n.verifier,bindingId:t.authMethod.walletAuthMethodId}}async function hn(e,t){if(V(e)){if(t.kind!==`passkey`)throw Error(`wallet recovery projection branch changed`);return de({authority:pn(e,t)})}if(t.kind!==`google_email_otp`)throw Error(`wallet recovery projection branch changed`);return de({authority:mn(e,t)})}async function gn(e){let t=[],n=[];for(let r of e.payload.ecdsaKeySets){let i=r.entry,a=i.recoveryBasis,o=await ue({walletId:e.payload.walletId,signingRootId:a.signingRootId,signingRootVersion:a.signingRootVersion}),s=await De({authority:e.authority,chainTargets:a.chainTargets,walletId:String(e.payload.walletId),keyHandle:i.keyHandle,ecdsaThresholdKeyId:a.ecdsaThresholdKeyId,signingRootId:a.signingRootId,signingRootVersion:a.signingRootVersion,relayerKeyId:o,participantIds:a.participantIds,publicCapability:a.publicCapability,activationReceipt:a.activationReceipt,runtimePolicyScope:a.runtimePolicyScope,readyStateBlobB64u:r.readyStateBlobB64u,publicFacts:r.publicFacts});n.push(s);for(let n of a.chainTargets)t.push(_n({payload:e.payload,keySet:r,chainTarget:n,materialRef:s.roleLocalMaterialRef,relayerKeyId:o}))}return{walletKeys:t,ecdsaContinuity:n}}function _n(e){let t=e.keySet.entry,n=t.recoveryBasis,r=e.keySet.publicFacts,i=we({walletId:e.payload.walletId,chainTarget:e.chainTarget,keyHandle:t.keyHandle,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,applicationBindingDigestB64u:n.publicCapability.context.application_binding_digest_b64u,clientParticipantId:1,relayerParticipantId:2,participantIds:n.participantIds,contextBinding32B64u:r.contextBinding32B64u,derivationClientSharePublicKey33B64u:r.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:r.relayerPublicKey33B64u,groupPublicKey33B64u:r.groupPublicKey33B64u,ethereumAddress:r.ethereumAddress,publicCapability:n.publicCapability});return{keyScope:`evm-family`,chainTarget:e.chainTarget,walletId:String(e.payload.walletId),evmFamilySigningKeySlotId:t.evmFamilySigningKeySlotId,keyHandle:t.keyHandle,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,thresholdEcdsaPublicKeyB64u:r.groupPublicKey33B64u,thresholdOwnerAddress:r.ethereumAddress,relayerKeyId:e.relayerKeyId,relayerVerifyingShareB64u:r.relayerPublicKey33B64u,participantIds:n.participantIds,publicCapability:n.publicCapability,roleLocalMaterialRef:e.materialRef,ecdsaRoleLocalPublicFacts:i}}function vn(e){if(e.nearKeySets.length!==1)throw Error(`wallet recovery requires exactly one NEAR key set`);return e.nearKeySets[0]}function yn(e){return[...e.registration.response.transports]}function bn(e){return`ed25519:${ie(m(vn(e).binding.registeredPublicKeyB64u))}`}function xn(e,t){let n=s(t.thresholdSessionId);if(!n.ok)throw Error(`recovery NEAR threshold session id is invalid`);return{walletId:e.walletId,nearAccountId:A(t.binding.nearAccountId),thresholdSessionId:n.value,runtimePolicyScope:t.runtimePolicyScope,materialActivation:ge(t.materialActivation)}}async function Sn(e){if(V(e.payload)){if(e.projection.kind!==`passkey`)throw Error(`wallet recovery projection branch changed`);let t={walletId:e.payload.walletId,rpId:e.projection.target.rpId,credentialIdB64u:e.projection.target.credentialIdB64u,credentialPublicKeyB64u:e.projection.authMethod.credentialPublicKeyB64u,transports:yn(e.payload),walletKeys:e.walletKeys};if(e.payload.nearKeySets.length===0)return oe({kind:`evm_family_ecdsa`,...t});let n=vn(e.payload);return oe({kind:`near_ed25519`,...t,nearAccountId:A(n.binding.nearAccountId),nearEd25519SigningKeyId:n.binding.nearEd25519SigningKeyId,signerSlot:n.binding.signerSlot,operationalPublicKey:bn(e.payload),relayerKeyId:n.binding.signingWorkerId,participantIds:n.binding.participantIds,custodyMaterials:e.payload.nearKeySets.map(e=>({binding:e.binding,sealed:e.sealed}))})}if(e.projection.kind!==`google_email_otp`)throw Error(`wallet recovery projection branch changed`);let t=mn(e.payload,e.projection),n={walletId:e.payload.walletId,email:e.payload.verifiedEmail,registrationAuthorityId:e.payload.registrationAuthorityId,authority:t,walletKeys:e.walletKeys};if(e.payload.nearKeySets.length===0)return se({kind:`evm_family_ecdsa`,...n});let r=vn(e.payload);return se({kind:`near_ed25519`,...n,nearAccountId:A(r.binding.nearAccountId),nearEd25519SigningKeyId:r.binding.nearEd25519SigningKeyId,signerSlot:r.binding.signerSlot,operationalPublicKey:bn(e.payload),relayerKeyId:r.binding.signingWorkerId,participantIds:r.binding.participantIds,custodyMaterials:e.payload.nearKeySets.map(e=>({binding:e.binding,sealed:e.sealed}))})}async function Cn(e){let t=e.pending.projection,n=await hn(e.payload,t),r=await gn({payload:e.payload,authority:n}),i=await Sn({payload:e.payload,projection:t,walletKeys:r.walletKeys});await M.publishPendingWalletRecoveryCommit({pending:e.pending,authority:t.authority,authMethod:t.authMethod,registration:i,ecdsaContinuity:r.ecdsaContinuity,ed25519PublicCapabilityReferences:e.payload.nearKeySets.map(t=>xn(e.payload,t))})}async function wn(e){let t=await M.listPendingWalletRecoveryCommits(),n=[];for(let r of t)try{let t=await Lt(r),i=r.stage===`awaiting_server_promotion`?await fn({relayUrl:e.relayUrl,payload:t,fetchImpl:e.fetchImpl}):await un({relayUrl:e.relayUrl,payload:t,fetchImpl:e.fetchImpl});if(!dn(i)){if(i.kind===`refused`){await M.deletePendingWalletRecoveryCommit(r.recoveryOperationId),n.push({kind:`discarded`,recoveryOperationId:String(r.recoveryOperationId)});continue}n.push({kind:`pending`,recoveryOperationId:String(r.recoveryOperationId),failure:i});continue}let a=i,o=an(a),s=r.stage===`awaiting_server_promotion`?await M.advancePendingWalletRecoveryCommit({awaiting:r,promoted:Ht(r,a.payload,o,r.updatedAtMs+1)}):r;if(r.stage===`server_promoted`&&!await nn(r.projection,o))throw Error(`wallet recovery replay projection changed`);await Cn({pending:s,payload:a.payload}),n.push({kind:`completed`,recoveryOperationId:String(r.recoveryOperationId)})}catch(e){console.warn(`[SeamsWeb] pending wallet recovery replay failed before classification:`,String(r.recoveryOperationId),e instanceof Error?e.message:String(e||`unknown error`)),n.push({kind:`corrupt`,recoveryOperationId:String(r.recoveryOperationId)})}return n}async function Tn(e){let t=await Nt(e.operation);return{payload:t,pending:Vt(t,await It(t),e.nowMs)}}async function En(e){let t=an(e.promotion);return M.advancePendingWalletRecoveryCommit({awaiting:e.awaiting,promoted:Ht(e.awaiting,e.promotion.payload,t,e.awaiting.updatedAtMs+1)})}export{Kt as a,V as c,ze as d,wn as i,lt as l,En as n,Gt as o,Cn as r,Wt as s,Tn as t,Re as u};

package/dist/esm/sdk/walletRecoveryRotate-DWTAFYiv.js

@@ -0,0 +1 @@
+import{d as e,h as t}from"./digestEncoding-Dzc1rzWV.js";function n(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===5&&n.every(e=>[`ok`,`challengeId`,`challenge_digest`,`expiresAtMs`,`otpChannel`].includes(e))&&t.get(`ok`)===!0)return{kind:`success`,challengeId:t.get(`challengeId`),challengeDigest:t.get(`challenge_digest`),expiresAtMs:t.get(`expiresAtMs`),otpChannel:t.get(`otpChannel`)};let r=[`ok`,`code`,`message`,`retryAfterMs`];if((t.size===3||t.size===4)&&n.every(e=>r.includes(e))&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`&&typeof t.get(`message`)==`string`&&(t.size===3||typeof t.get(`retryAfterMs`)==`number`)){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function r(e){let t;try{t=await u({relayUrl:e.relayUrl,path:`/wallets/custody/email-otp/challenge`,body:{walletId:e.walletId,providerSubjectId:e.providerSubjectId,operation:e.operation,payload:e.payload,...e.requestOrigin?{requestOrigin:e.requestOrigin}:{}},fetchImpl:e.fetchImpl})}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`Email OTP challenge request failed`}}let r=n(await t.json().catch(()=>null)),i=r.kind===`failure`&&r.message?r.message:``;if(t.status!==200||r.kind!==`success`)return{kind:t.status>=400&&t.status<500?`rejected`:`transport_failed`,message:i||`Email OTP challenge failed (HTTP ${t.status})`};let a=typeof r.challengeId==`string`?r.challengeId.trim():``,o=typeof r.challengeDigest==`string`?r.challengeDigest.trim():``,s=Number(r.expiresAtMs),c=typeof r.otpChannel==`string`?r.otpChannel.trim():``;return!a||!o||!Number.isSafeInteger(s)||s<=0||!c?{kind:`transport_failed`,message:`Email OTP challenge returned an unusable payload`}:{kind:`ready`,challengeId:a,challenge_digest:o,expiresAtMs:s,otpChannel:c}}function i(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[`ok`,`activeCodeCount`,`totalCodeCount`,`issuedAtMs`,`storeVersion`,`backupOutstanding`],r=[...t.keys()];if(t.size===n.length&&r.every(e=>n.includes(e))&&t.get(`ok`)===!0)return{kind:`success`,activeCodeCount:t.get(`activeCodeCount`),totalCodeCount:t.get(`totalCodeCount`),issuedAtMs:t.get(`issuedAtMs`),storeVersion:t.get(`storeVersion`),backupOutstanding:t.get(`backupOutstanding`)};let i=[`ok`,`code`,`message`];if(t.size===i.length&&r.every(e=>i.includes(e))&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function a(e){let n=`${t(e.relayUrl)}/wallets/${encodeURIComponent(e.walletId)}/recovery/status`,r=e.fetchImpl||fetch,a;try{a=await r(n,{method:`GET`,credentials:`include`,headers:{Accept:`application/json`}})}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`recovery status request failed`}}let o=i(await a.json().catch(()=>null)),s=o.kind===`failure`&&o.message?o.message:``;if(a.status===401||a.status===403)return{kind:`unauthorized`,message:s||`recovery status is unauthorized`};if(a.status===404)return{kind:`no_recovery_set`,message:s||`this wallet has no recovery set`};if(a.status!==200)return{kind:`transport_failed`,message:s||`recovery status failed (HTTP ${a.status})`};if(o.kind!==`success`)return{kind:`transport_failed`,message:`recovery status returned an unusable payload`};let c=Number(o.activeCodeCount),l=Number(o.totalCodeCount),u=Number(o.issuedAtMs),d=typeof o.storeVersion==`string`?o.storeVersion.trim():``;return!Number.isSafeInteger(c)||c<0||!Number.isSafeInteger(l)||l<c||!Number.isSafeInteger(u)||u<=0||!d||typeof o.backupOutstanding!=`boolean`?{kind:`transport_failed`,message:`recovery status returned an unusable payload`}:{kind:`ready`,walletId:e.walletId,activeCodeCount:c,totalCodeCount:l,issuedAtMs:u,storeVersion:d,backupOutstanding:o.backupOutstanding,pendingLocalBackup:!1}}function o(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===2&&n.includes(`ok`)&&n.includes(`issuedAtMs`)&&t.get(`ok`)===!0)return{kind:`success`,issuedAtMs:t.get(`issuedAtMs`)};if(t.size===3&&n.includes(`ok`)&&n.includes(`code`)&&n.includes(`message`)&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function s(e){let t;try{t=await u({relayUrl:e.relayUrl,path:`/wallets/recovery/acknowledge-backup`,body:{walletId:e.walletId},fetchImpl:e.fetchImpl})}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`recovery backup acknowledgement failed`}}let n=o(await t.json().catch(()=>null)),r=n.kind===`failure`&&n.message?n.message:``;if(t.status===401||t.status===403)return{kind:`unauthorized`,message:r||`recovery backup acknowledgement is unauthorized`};if(t.status===404)return{kind:`no_recovery_set`,message:r||`this wallet has no recovery set`};if(t.status!==200)return{kind:`transport_failed`,message:r||`recovery backup acknowledgement failed (HTTP ${t.status})`};if(n.kind!==`success`)return{kind:`transport_failed`,message:`recovery backup acknowledgement returned an unusable payload`};let i=Number(n.issuedAtMs);return!Number.isSafeInteger(i)||i<=0?{kind:`transport_failed`,message:`recovery backup acknowledgement returned an unusable payload`}:{kind:`acknowledged`,walletId:e.walletId,issuedAtMs:i}}function c(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===3&&n.every(e=>[`ok`,`issuedAtMs`,`storeVersion`].includes(e))&&t.get(`ok`)===!0)return{kind:`success`,issuedAtMs:t.get(`issuedAtMs`),storeVersion:t.get(`storeVersion`)};if(t.size===3&&n.every(e=>[`ok`,`code`,`message`].includes(e))&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function l(e){let t=await u({relayUrl:e.relayUrl,path:`/wallets/recovery/rotate`,body:{walletId:e.walletId,expectedStoreVersion:e.expectedStoreVersion,manifestKekWraps:e.replacement.manifestKekWraps,entries:[e.replacement.entry],recoveryCodeLocators:e.recoveryCodeLocators,factorProof:e.factorProof},fetchImpl:e.fetchImpl}),n=c(await t.json().catch(()=>null)),r=n.kind===`failure`&&n.message?n.message:``;if(t.status===200&&n.kind===`success`){let e=Number(n.issuedAtMs),t=typeof n.storeVersion==`string`?n.storeVersion.trim():``;return!Number.isSafeInteger(e)||e<=0||!t?{kind:`transport_failed`,message:`rotation returned an unusable response`}:{kind:`rotated`,issuedAtMs:e,storeVersion:t}}return t.status===404?{kind:`no_recovery_set`,message:r||`no recovery set`}:t.status===409?{kind:`conflict`,message:r||`recovery set changed`}:t.status===400?{kind:`rejected`,message:r||`rotation rejected`}:{kind:`transport_failed`,message:r||`rotation failed (HTTP ${t.status})`}}async function u(n){let r=`${t(n.relayUrl)}${n.path}`;return await(n.fetchImpl||fetch)(r,e({headers:{Accept:`application/json`},body:n.body}))}export{l as i,a as n,r,s as t};

package/dist/esm/sdk/walletSessionAuthorizationProjection-DWBksIJR.js

@@ -0,0 +1 @@
+function e(e){return{walletId:e.authority.walletId,authorityId:e.authority.authorityId,walletAuthMethodId:e.walletAuthMethodId,authorityDigestB64u:e.authority.authorityDigestB64u,authorityRevocationEpoch:e.authority.revocationEpoch}}function t(e){let{walletSession:t,operationCredential:n}=e;if(t.walletId!==e.walletId||t.authMethodId!==e.authority.walletAuthMethodId||t.authorizationId!==e.expectedAuthorizationId||t.quotaId!==e.expectedQuotaId||t.expiresAtMs!==e.expectedExpiresAtMs||n.walletSessionId!==e.expectedWalletSessionId)throw Error(`ECDSA bootstrap exact Wallet Session authority does not match its request`);return{record:t,operationCredential:n}}function n(e){if(e.walletSession.walletId!==e.expected.walletId||e.walletSession.authorityId!==e.expected.authorityId||e.walletSession.authMethodId!==e.expected.walletAuthMethodId||e.walletSession.authorityDigestB64u!==e.expected.authorityDigestB64u||e.walletSession.authorityRevocationEpoch!==e.expected.authorityRevocationEpoch)throw Error(`ECDSA bootstrap exact Wallet Session authority identity changed`)}async function r(e,t){return{record:await e.writeExactWithOperationCredential({record:t.walletSession,operationCredential:t.operationCredential}),operationCredential:t.operationCredential}}async function i(e,n){let r=n.bootstrap.session,i=t({walletId:n.walletId,authority:n.authority,walletSession:r.walletSession,operationCredential:r.operationCredential,expectedAuthorizationId:r.authorizationId,expectedWalletSessionId:r.walletSessionId,expectedQuotaId:r.quotaId,expectedExpiresAtMs:r.expiresAtMs});return{record:await e.writeExactWithOperationCredential(i),operationCredential:i.operationCredential}}export{t as a,n as i,r as n,i as r,e as t};

package/dist/esm/sdk/walletSessionAuthorizationStatus-o1VgsLhA.js

@@ -0,0 +1 @@
+import{i as e,n as t}from"./activeWalletSession-DiZcKjB_.js";import{d as n,h as r}from"./capabilityKinds-CKQ4Uqnv.js";import{d as i,h as a,p as o}from"./digestEncoding-Dzc1rzWV.js";const s=(e,t)=>globalThis.fetch(e,t),c=new WeakMap;let l=0;const u=new Map;function d(e){return JSON.stringify([e])}function f(e,t){return d(e.operationCredential.token)+JSON.stringify([a(e.relayerUrl),t.walletSessionId,t.quotaId])}function p(e,t,n,r){let i=c.get(e);i||(i=new Map,c.set(e,i));let a=i.get(t);if(a&&a.sequence>n)return r;if(u.delete(t),i.delete(t),i.set(t,{kind:`local_wallet_session_observation`,sequence:n,status:r}),i.size>32){let e=i.keys().next();e.done||i.delete(e.value)}return r}function m(e){let t=e.remainingUses-1;return t>0?{...e,remainingUses:t}:{...e,status:`exhausted`,remainingUses:0,quotaLifecycle:`exhausted`}}var h=class e{constructor(){this.readsByFetch=new Map,this.suppliedStatus={kind:`remote`}}static fromPrepare(t,n){let r=new e;return r.suppliedStatus={kind:`server_response`,key:f(t,n),status:n,observation:m(n)},r}static fromRegistration(t,n){let r=g(n),i=new e;return i.suppliedStatus={kind:`server_response`,key:f({relayerUrl:t,operationCredential:n.operationCredential},r),status:r,observation:r},i}static acceptRegistrationSession(e,t){let n=g(t);if(u.set(f({relayerUrl:e,operationCredential:t.operationCredential},n),n),u.size>8){let e=u.keys().next();e.done||u.delete(e.value)}}static forHostObservation(){let t=new e;return t.suppliedStatus={kind:`host_observation`},t}static forgetCredential(e){let t=d(e);for(let e of[c.get(s),u])if(e)for(let n of[...e.keys()])n.startsWith(t)&&e.delete(n)}static observationForConfirmation(e,t){return c.get(e.fetchImpl??s)?.get(f(e,t))??null}read(e,t){if(this.suppliedStatus.kind===`server_response`){if(this.suppliedStatus.key!==f(e,t))throw Error(`Wallet Session response identity changed before reconciliation`);return p(e.fetchImpl??s,this.suppliedStatus.key,++l,this.suppliedStatus.observation),Promise.resolve(this.suppliedStatus.status)}let n=e.fetchImpl??s,r=this.readsByFetch.get(n);r||(r=new Map,this.readsByFetch.set(n,r));let i=f(e,t),a=r.get(i);if(a)return a;let o=++l,c=this.suppliedStatus.kind===`host_observation`?u.get(i):void 0,d=c?Promise.resolve(p(n,i,o,c)):D(e).read(t).then(p.bind(null,n,i,o));return r.set(i,d),d}};function g(e){return{status:`active`,walletSessionId:e.walletSessionId,quotaId:e.quotaId,remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs,quotaLifecycle:`active`,authorization:e.walletSession}}const _=[`ok`,`status`,`walletSessionId`,`quotaId`,`remainingUses`,`expiresAtMs`,`quotaLifecycle`,`authorization`],v=[`ok`,`status`,`walletSessionId`,`quotaId`];function y(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`error`,message:null};let t=new Map(Object.entries(e)),n=[...t.keys()],r=t.get(`status`),i=t.get(`walletSessionId`),a=t.get(`quotaId`);if(t.get(`ok`)===!0&&typeof r==`string`){let e=r===`active`||r===`exhausted`||r===`expired`||r===`superseded`||r===`authority_unavailable`||r===`method_unavailable`||r===`capability_unavailable`?r:null;if(e&&n.length===_.length){let r=new Set(_);if(n.every(e=>r.has(e)))return{kind:`observed`,status:e,walletSessionId:i,quotaId:a,remainingUses:t.get(`remainingUses`),expiresAtMs:t.get(`expiresAtMs`),quotaLifecycle:t.get(`quotaLifecycle`),authorization:t.get(`authorization`)}}if((r===`missing`||r===`invalid`)&&n.length===v.length){let e=new Set(v);if(n.every(t=>e.has(t)))return{kind:`terminal`,status:r,walletSessionId:i,quotaId:a}}}if(n.every(e=>e===`code`||e===`message`)){let e=t.get(`message`);return{kind:`error`,message:typeof e==`string`?e:null}}return{kind:`error`,message:null}}function b(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>0}function x(e,t){let i=r(e.walletSessionId),a=n(e.quotaId);return!i.ok||!a.ok||i.value!==t.walletSessionId||a.value!==t.quotaId?null:{walletSessionId:i.value,quotaId:a.value}}function S(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=0}function C(e,n){if(e.quotaLifecycle!==`active`&&e.quotaLifecycle!==`exhausted`||!S(e.remainingUses)||e.quotaLifecycle===`exhausted`!=(e.remainingUses===0)||!b(e.expiresAtMs))return null;let r;try{r=t(e.authorization)}catch{return null}return r.quotaId!==n.quotaId||r.expiresAtMs!==e.expiresAtMs?null:{remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs,quotaLifecycle:e.quotaLifecycle,authorization:r}}function w(e,t){return T(y(e),t)}function T(e,t){if(e.kind===`error`)return null;let n=x(e,t);if(!n)return null;if(e.kind===`terminal`)return{status:e.status,...n};switch(e.status){case`active`:{let t=C(e,n);return!t||t.quotaLifecycle!==`active`?null:{status:`active`,...n,...t}}case`exhausted`:{let t=C(e,n);return!t||t.remainingUses!==0?null:{status:`exhausted`,...n,...t,remainingUses:0}}case`expired`:case`superseded`:case`authority_unavailable`:case`method_unavailable`:case`capability_unavailable`:{let t=C(e,n);return t?{status:e.status,...n,...t}:null}default:return null}}var E=class{constructor(t){if(this.relayerUrl=a(t.relayerUrl),!this.relayerUrl)throw Error(`Relayer URL is required`);this.operationCredential=e(t.operationCredential),this.fetchImpl=t.fetchImpl??s}async read(e){let t=await this.fetchImpl(`${this.relayerUrl}/wallet/session/status`,{...i({body:{walletSessionId:e.walletSessionId,quotaId:e.quotaId},headers:o(this.operationCredential)}),credentials:`omit`}),n=y(await t.json().catch(()=>null));if(!t.ok){let e=n.kind===`error`&&n.message?n.message:`Wallet Session status request failed with HTTP ${t.status}`;throw Error(e)}let r=T(n,e);if(!r)throw Error(`Wallet Session status response is invalid`);return r}};function D(e){return new E(e)}export{D as n,w as r,h as t};

package/dist/esm/sdk/walletSessionAuthorizationStore-gEYPmu-G.js

@@ -0,0 +1 @@
+import{I as e,L as t,P as n,w as r}from"./normalize-kUDm5zfS.js";import{i,t as a}from"./activeWalletSession-DiZcKjB_.js";import{d as o,h as s,m as c}from"./capabilityKinds-CKQ4Uqnv.js";import{r as l}from"./canonicalPrimitives-CKPGgpxg.js";import{a as u,i as d,t as f}from"./singletons-8UH3gOnZ.js";import{t as p}from"./walletOwnershipGeneration-DoXVMDWe.js";var m=class extends Error{constructor(e){super(e),this.kind=`upgrade_required`,this.code=`upgrade_required`,this.name=`WalletSessionAuthorizationUpgradeRequiredError`}};const h=u.walletSessionAuthorizations;function g(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=Object.keys(e);if(n.length!==t.length||n.some(e=>!t.includes(e)))return null;let r=new Map;for(let t of n)r.set(t,Reflect.get(e,t));return r}function _(e,t){if(!(typeof e!=`object`||!e||Array.isArray(e)))return Reflect.get(e,t)}function v(e){switch(e){case`expired`:case`exhausted`:case`replaced`:case`wallet_locked`:case`invalidated`:return e;default:return null}}const y=[`kind`,`walletId`,`authorityId`,`authMethodId`,`authorizationId`,`quotaId`,`authorityDigestB64u`,`authorityRevocationEpoch`,`capabilitySubjects`,`issuedAtMs`,`expiresAtMs`],b=[...y,`retiredAtMs`,`retirementReason`],x=[`record_version`,`wallet_session_id`,`authorization_id`,`wallet_id`,`wallet_authority_id`,`wallet_auth_method_id`,`authority_digest_b64u`,`authority_revocation_epoch`,`status`,`issued_at_ms`,`expires_at_ms`,`record`,`operation_credential`],S=/^wallet_session_authorization_v([0-9]+)$/;function C(e){if(typeof e!=`string`)return null;let t=S.exec(e);if(!t)return null;let n=Number(t[1]);return Number.isSafeInteger(n)?n:null}function w(e){let t=typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.prototype.hasOwnProperty.call(e,`record_version`),n=C(_(e,`record_version`)),r=t?null:C(_(_(e,`record`),`recordVersion`)),i=n??r;return i===null?{kind:`unknown`}:i>=3&&i<6?{kind:`legacy`,version:i}:t&&i===6?{kind:`current`,version:i}:t&&i>6?{kind:`future`,version:i}:{kind:`unknown`}}function T(e,t){if(w(e).kind!==`future`||_(e,`wallet_id`)!==t.walletId)return!1;let n=_(e,`wallet_authority_id`),r=_(e,`wallet_auth_method_id`);return typeof n!=`string`||typeof r!=`string`?!0:n===t.authorityId&&r===t.authMethodId}function E(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=0}function D(e){let t=_(e,`wallet_session_id`);if(typeof t!=`string`)throw Error(`Stored Wallet Session authorization key is invalid`);return t}function O(e){switch(e.kind){case`sign`:case`export_keys`:return`${e.kind}:${e.keyFamily}:${e.materialActivation.activationId}`;case`link_devices`:case`revoke_devices`:return e.kind;default:return k(e)}}function k(e){throw Error(`Unknown Wallet Capability subject: ${String(e)}`)}function A(e){let t=_(e,`kind`);if(t===`sign`||t===`export_keys`){let n=g(e,[`kind`,`keyFamily`,`materialActivation`]);if(!n)return null;let i=n.get(`keyFamily`);if(i!==`ed25519`&&i!==`ecdsa_secp256k1`)return null;let a=r(n.get(`materialActivation`));return a.ok?{kind:t,keyFamily:i,materialActivation:a.value}:null}return(t===`link_devices`||t===`revoke_devices`)&&g(e,[`kind`])?{kind:t}:null}function j(e){if(!Array.isArray(e)||e.length===0)return null;let t=[];for(let n of e){let e=A(n);if(!e)return null;t.push(e)}let n=new Set;for(let e of t){let t=O(e);if(n.has(t))return null;n.add(t)}let[r,...i]=t;return r?[r,...i]:null}function M(r){let i=_(r,`kind`),a=i===`active_wallet_session_v1`?g(r,y):i===`retired_wallet_session_v1`?g(r,b):null;if(!a)return null;let s=t(a.get(`walletId`)),u=e(a.get(`authorityId`)),d=n(a.get(`authMethodId`)),f=c(a.get(`authorizationId`)),p=o(a.get(`quotaId`));if(!s.ok||!u.ok||!d.ok||!f.ok||!p.ok)return null;let m;try{m=l(a.get(`authorityDigestB64u`))}catch{return null}let h=j(a.get(`capabilitySubjects`)),x=a.get(`authorityRevocationEpoch`),S=a.get(`issuedAtMs`),C=a.get(`expiresAtMs`);if(!h||!E(x)||!E(S)||!E(C)||C<=S)return null;let w={walletId:s.value,authorityId:u.value,authMethodId:d.value,authorizationId:f.value,quotaId:p.value,authorityDigestB64u:m,authorityRevocationEpoch:x,capabilitySubjects:h,issuedAtMs:S,expiresAtMs:C};if(i===`active_wallet_session_v1`)return{kind:`active_wallet_session_v1`,walletId:w.walletId,authorityId:w.authorityId,authMethodId:w.authMethodId,authorizationId:w.authorizationId,quotaId:w.quotaId,authorityDigestB64u:w.authorityDigestB64u,authorityRevocationEpoch:w.authorityRevocationEpoch,capabilitySubjects:w.capabilitySubjects,issuedAtMs:w.issuedAtMs,expiresAtMs:w.expiresAtMs};if(i===`retired_wallet_session_v1`){let e=a.get(`retiredAtMs`);if(!E(e)||e<w.issuedAtMs)return null;let t=v(a.get(`retirementReason`));return!t||t===`expired`&&e<w.expiresAtMs?null:{kind:`retired_wallet_session_v1`,walletId:w.walletId,authorityId:w.authorityId,authMethodId:w.authMethodId,authorizationId:w.authorizationId,quotaId:w.quotaId,authorityDigestB64u:w.authorityDigestB64u,authorityRevocationEpoch:w.authorityRevocationEpoch,capabilitySubjects:w.capabilitySubjects,issuedAtMs:w.issuedAtMs,expiresAtMs:w.expiresAtMs,retiredAtMs:e,retirementReason:t}}return null}function N(e){if(!E(e.retiredAtMs))throw Error(`Retired Wallet Session v1 time is invalid`);let t=M({kind:`retired_wallet_session_v1`,walletId:e.active.walletId,authorityId:e.active.authorityId,authMethodId:e.active.authMethodId,authorizationId:e.active.authorizationId,quotaId:e.active.quotaId,authorityDigestB64u:e.active.authorityDigestB64u,authorityRevocationEpoch:e.active.authorityRevocationEpoch,capabilitySubjects:e.active.capabilitySubjects,issuedAtMs:e.active.issuedAtMs,expiresAtMs:e.active.expiresAtMs,retiredAtMs:e.retiredAtMs,retirementReason:e.reason});if(!t||t.kind!==`retired_wallet_session_v1`)throw Error(`Retired Wallet Session v1 is invalid`);return t}function P(e,t){let n=M(e);if(!n||n.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let r;try{r=i(t)}catch{throw Error(`Wallet Session operation credential is invalid`)}let a={record_version:`wallet_session_authorization_v6`,wallet_session_id:r.walletSessionId,authorization_id:n.authorizationId,wallet_id:n.walletId,wallet_authority_id:n.authorityId,wallet_auth_method_id:n.authMethodId,authority_digest_b64u:n.authorityDigestB64u,authority_revocation_epoch:n.authorityRevocationEpoch,status:`active`,issued_at_ms:n.issuedAtMs,expires_at_ms:n.expiresAtMs,record:{kind:n.kind,walletId:n.walletId,authorityId:n.authorityId,authMethodId:n.authMethodId,authorizationId:n.authorizationId,walletSessionId:r.walletSessionId,quotaId:n.quotaId,authorityDigestB64u:n.authorityDigestB64u,authorityRevocationEpoch:n.authorityRevocationEpoch,capabilitySubjects:n.capabilitySubjects,issuedAtMs:n.issuedAtMs,expiresAtMs:n.expiresAtMs},operation_credential:r};if(!F(a))throw Error(`Wallet Session authorization v6 is invalid`);return a}function F(e){let t=g(e,x);if(!t||t.get(`record_version`)!==`wallet_session_authorization_v6`||t.get(`status`)!==`active`)return null;let n=s(t.get(`wallet_session_id`)),r=c(t.get(`authorization_id`));if(!n.ok||!r.ok)return null;let a;try{a=i(t.get(`operation_credential`))}catch{return null}if(n.value!==a.walletSessionId)return null;let o=g(t.get(`record`),[...y,`walletSessionId`]);if(!o)return null;let l=s(o.get(`walletSessionId`));if(!l.ok||l.value!==n.value)return null;let u=M({kind:o.get(`kind`),walletId:o.get(`walletId`),authorityId:o.get(`authorityId`),authMethodId:o.get(`authMethodId`),authorizationId:o.get(`authorizationId`),quotaId:o.get(`quotaId`),authorityDigestB64u:o.get(`authorityDigestB64u`),authorityRevocationEpoch:o.get(`authorityRevocationEpoch`),capabilitySubjects:o.get(`capabilitySubjects`),issuedAtMs:o.get(`issuedAtMs`),expiresAtMs:o.get(`expiresAtMs`)});return!u||u.kind!==`active_wallet_session_v1`||t.get(`wallet_id`)!==u.walletId||t.get(`wallet_authority_id`)!==u.authorityId||t.get(`wallet_auth_method_id`)!==u.authMethodId||t.get(`authority_digest_b64u`)!==u.authorityDigestB64u||t.get(`authority_revocation_epoch`)!==u.authorityRevocationEpoch||t.get(`issued_at_ms`)!==u.issuedAtMs||t.get(`expires_at_ms`)!==u.expiresAtMs||r.value!==u.authorizationId?null:{record:u,operationCredential:a,physicalKey:n.value}}async function I(e){let t=M(e.active);if(!t||t.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let n=i(e.operationCredential);await p(e.ctx,t.walletId,n.ownershipGeneration);let r=P(t,n),o=!0,s=e.ctx.store(h),c=await s.index(d.walletId).getAll(t.walletId);for(let e of c){let r=w(e);if(r.kind===`future`)continue;if(r.kind===`legacy`){await s.delete(D(e));continue}if(r.kind!==`current`)throw Error(`Stored Wallet Session authorization row is corrupt`);let i=F(e);if(!i)throw Error(`Stored Wallet Session authorization v6 is corrupt`);let c=i.record;if(i.operationCredential.walletSessionId===n.walletSessionId&&(i.operationCredential.token!==n.token||i.operationCredential.ownershipGeneration!==n.ownershipGeneration))throw Error(`Stored Wallet Session conflicts with the issued operation credential`);if(i.operationCredential.ownershipGeneration<n.ownershipGeneration){await s.delete(i.physicalKey);continue}if(!(c.kind!==`active_wallet_session_v1`||c.authorityId!==t.authorityId||c.authMethodId!==t.authMethodId)){if(c.authorizationId===t.authorizationId&&i.operationCredential.walletSessionId===n.walletSessionId){o=!a(c,t);continue}await s.delete(i.physicalKey)}}return o&&await s.put(r),t}async function L(e){let t=e.ctx.store(h),n=await t.index(d.walletId).getAll(e.walletId),r=null,i=!1;for(let a of n){if(T(a,e)){i=!0;continue}let n=w(a);if(n.kind===`legacy`){await t.delete(D(a));continue}if(n.kind!==`current`)return{kind:`corrupt`};let o=F(a);if(!o)return{kind:`corrupt`};if(!(o.record.walletId!==e.walletId||o.record.authorityId!==e.authorityId||o.record.authMethodId!==e.authMethodId)){if(r)return{kind:`corrupt`};r=o}}return i?{kind:`upgrade_required`}:r?{kind:`found`,...r}:{kind:`missing`}}var R=class{constructor(e=f){this.manager=e}async writeExactWithOperationCredential(e){let t=M(e.record);if(!t||t.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let n=i(e.operationCredential);return await this.replaceExactActive({active:t,operationCredential:n}),t}async refreshExactWithOperationCredential(e){let t=M(e.expected),n=M(e.record);if(!t||t.kind!==`active_wallet_session_v1`||!n||n.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session refresh is invalid`);for(let e of y)if(!(e===`kind`||e===`capabilitySubjects`)&&t[e]!==n[e])throw Error(`Wallet Session refresh changed its exact identity`);let r=P(n,i(e.operationCredential));return this.manager.runTransaction([h],`readwrite`,B.bind(null,t,r))}async readExact(e){return this.manager.runTransaction([h],`readwrite`,V.bind(null,e))}async readExactWithOperationCredential(e){let t=await this.readExactActiveForWallet(e);switch(t.kind){case`found`:case`missing`:case`upgrade_required`:return t;case`corrupt`:throw Error(`Stored Wallet Session authorization v6 is corrupt`);case`persistence_unavailable`:throw Error(`Wallet Session authorization persistence is unavailable`)}}async readExactActiveForWallet(e){try{return await this.manager.runTransaction([h],`readwrite`,H.bind(null,e))}catch(e){return e instanceof z?{kind:`corrupt`}:{kind:`persistence_unavailable`}}}async retireExactActiveForWallet(e){if(!E(e.retiredAtMs))throw Error(`Wallet Session v1 retirement time is invalid`);return this.manager.runTransaction([h],`readwrite`,U.bind(null,e))}async replaceExactActive(e){return this.manager.runTransaction([h,u.appState,u.ecdsaClientPresignatures],`readwrite`,W.bind(null,e))}async clearWallet(e){await this.manager.runTransaction([h],`readwrite`,G.bind(null,e))}async clearAll(){await this.manager.runTransaction([h],`readwrite`,K)}},z=class extends Error{};async function B(e,t,n){let r=n.store(h),i=t.operation_credential,o=await r.get(i.walletSessionId);if(o===void 0)return`superseded`;let s=F(o);if(!s)throw Error(`Stored Wallet Session authorization v6 is corrupt`);return!a(s.record,e)||s.operationCredential.token!==i.token?`superseded`:(await r.put(t),`updated`)}async function V(e,t){let n=t.store(h),r=await n.get(e);if(r===void 0)return null;switch(w(r).kind){case`future`:throw new m(`Wallet Session authorization requires a newer client`);case`legacy`:return await n.delete(D(r)),null;case`current`:break;case`unknown`:throw Error(`Stored Wallet Session authorization v6 is corrupt`)}let i=F(r);if(!i)throw Error(`Stored Wallet Session authorization v6 is corrupt`);return i.record}async function H(e,t){let n=await L({ctx:t,walletId:e.walletId,authorityId:e.authorityId,authMethodId:e.authMethodId});if(n.kind===`corrupt`)throw new z(`Stored Wallet Session authorization v6 is corrupt`);return n}async function U(e,t){let n=t.store(h),r=[],i=await n.index(d.walletId).getAll(e.walletId);for(let t of i){let i=w(t);if(i.kind===`future`)continue;if(i.kind===`legacy`){await n.delete(D(t));continue}if(i.kind!==`current`)continue;let a=F(t);if(!a)throw Error(`Stored Wallet Session authorization v6 is corrupt`);let o=a.record;if(o.kind!==`active_wallet_session_v1`)continue;let s=N({active:o,reason:e.reason,retiredAtMs:e.retiredAtMs});await n.delete(a.physicalKey),r.push(s)}return r}function W(e,t){return I({ctx:t,active:e.active,operationCredential:e.operationCredential})}async function G(e,t){let n=t.store(h),r=await n.index(d.walletId).getAllKeys(e);for(let e of r)await n.delete(e)}function K(e){return e.store(h).clear()}const q=new R;export{P as a,I as i,F as n,q as o,L as r,m as t};

package/dist/esm/sdk/walletSessionFailure-Bu4VPKTz.js

@@ -0,0 +1 @@
+const e={missing:`wallet_session_missing`,signatureInvalid:`wallet_session_signature_invalid`,claimsInvalid:`wallet_session_claims_invalid`,invalid:`wallet_session_invalid`,expired:`wallet_session_expired`,scopeMismatch:`wallet_session_scope_mismatch`,unavailable:`wallet_session_unavailable`,budgetExhausted:`wallet_budget_exhausted`};function t(t){switch(t){case e.missing:case e.signatureInvalid:case e.claimsInvalid:case e.invalid:case e.expired:case e.scopeMismatch:case e.unavailable:case e.budgetExhausted:return!0;default:return!1}}var n=class extends Error{constructor(e){super(e.message),this.name=`WalletSessionFailureError`,this.failure=e.failure,this.code=e.failure.code}};function r(t){switch(t){case e.expired:return{kind:`expired`,code:t};case e.missing:return{kind:`missing`,code:t};case e.signatureInvalid:return{kind:`invalid`,code:t,reason:`signature_invalid`};case e.claimsInvalid:return{kind:`invalid`,code:t,reason:`claims_invalid`};case e.invalid:return{kind:`invalid`,code:t,reason:`invalid`};case e.scopeMismatch:return{kind:`invalid`,code:t,reason:`scope_mismatch`};case e.unavailable:return{kind:`unavailable`,code:t};case e.budgetExhausted:return{kind:`exhausted`,code:t}}}function i(e){return t(e.code)?new n({failure:r(e.code),message:e.message}):null}function a(e){if(e instanceof n)return e.failure;if(!e||typeof e!=`object`)return null;let i=e;return t(i.coreCode)?r(i.coreCode):t(i.code)?r(i.code):null}export{e as a,a as i,i as n,r,n as t};

package/dist/esm/sdk/warmSessionHydration-DgjuUacN.js

@@ -0,0 +1 @@
+import{t as e}from"./prfCache-BMpqZZ-v.js";function t(t){return{hydrateSigningSession:n=>e(t.getWarmSessionMaterialWriter(),n)}}export{t as createWarmSessionHydrationService};

package/dist/esm/sdk/{webauthnP256-qu06GNFm.js → webauthnP256-BEz4DEAs.js}

@@ -1 +1 @@
-import{r as e,t}from"./base64-ojm5DKcF.js";import{n}from"./evmCryptoWasm-CwEXiLrC.js";function r(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n++)if(e[n]!==t[n])return!1;return!0}var i=class{constructor(e,t){this.workerCtx=e,this.beforeSigning=t,this.algorithm=`webauthnP256`}async buildWebauthnSignature(e){if(!this.workerCtx)throw Error(`[WebAuthnP256Engine] workerCtx is required for wasm-backed WebAuthn signature packing`);return await n({challenge32:e.challenge32,authenticatorData:e.authenticatorData,clientDataJSON:e.clientDataJSON,signatureDer:e.signatureDer,pubKeyX32:e.pubKeyX32,pubKeyY32:e.pubKeyY32,workerCtx:this.workerCtx})}async sign(n,i){if(n.kind!==`webauthn`||n.algorithm!==`webauthnP256`)throw Error(`[WebAuthnP256Engine] unsupported sign request`);if(n.challenge32.length!==32)throw Error(`[WebAuthnP256Engine] challenge32 must be 32 bytes`);if(i.type!==`webauthnP256`)throw Error(`[WebAuthnP256Engine] keyRef must be webauthnP256`);if(i.pubKeyX.length!==32||i.pubKeyY.length!==32)throw Error(`[WebAuthnP256Engine] pubKeyX/pubKeyY must be 32 bytes each`);if(i.credentialId.length===0)throw Error(`[WebAuthnP256Engine] credentialId must be non-empty`);let a=async a=>{let o=a&&typeof a==`object`?a:{};if(!r(t(String(o.rawId||``).trim()),i.credentialId))throw Error(`[WebAuthnP256Engine] WebAuthn credential rawId does not match keyRef`);let s=o.response,c=e(String(s?.authenticatorData||``)),l=e(String(s?.clientDataJSON||``)),u=e(String(s?.signature||``));if(c.length===0||l.length===0||u.length===0)throw Error(`[WebAuthnP256Engine] missing authenticatorData/clientDataJSON/signature in credential`);return await this.buildWebauthnSignature({challenge32:n.challenge32,authenticatorData:c,clientDataJSON:l,signatureDer:u,pubKeyX32:i.pubKeyX,pubKeyY32:i.pubKeyY})};if(n.credential)return await a(n.credential);if(typeof navigator>`u`||!navigator.credentials||typeof navigator.credentials.get!=`function`)throw Error(`[WebAuthnP256Engine] WebAuthn not available (must run in a browser context)`);let o=new Uint8Array(n.challenge32),s=new Uint8Array(i.credentialId);this.beforeSigning?.();let c=await navigator.credentials.get({publicKey:{challenge:o,allowCredentials:[{type:`public-key`,id:s}],rpId:n.rpId??i.rpId,userVerification:`preferred`}});if(!c)throw Error(`[WebAuthnP256Engine] user cancelled WebAuthn assertion`);if(!r(new Uint8Array(c.rawId),i.credentialId))throw Error(`[WebAuthnP256Engine] WebAuthn assertion returned unexpected credentialId`);let l=c.response;if(!l||!l.authenticatorData||!l.clientDataJSON||!l.signature)throw Error(`[WebAuthnP256Engine] invalid WebAuthn assertion response`);let u=new Uint8Array(l.authenticatorData),d=new Uint8Array(l.clientDataJSON),f=new Uint8Array(l.signature);return await this.buildWebauthnSignature({challenge32:n.challenge32,authenticatorData:u,clientDataJSON:d,signatureDer:f,pubKeyX32:i.pubKeyX,pubKeyY32:i.pubKeyY})}};export{i as WebAuthnP256Engine};
+import{r as e,t}from"./base64-CsEj-_bC.js";import{n}from"./evmCryptoWasm-BXsIyRon.js";function r(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n++)if(e[n]!==t[n])return!1;return!0}var i=class{constructor(e,t){this.workerCtx=e,this.beforeSigning=t,this.algorithm=`webauthnP256`}async buildWebauthnSignature(e){if(!this.workerCtx)throw Error(`[WebAuthnP256Engine] workerCtx is required for wasm-backed WebAuthn signature packing`);return await n({challenge32:e.challenge32,authenticatorData:e.authenticatorData,clientDataJSON:e.clientDataJSON,signatureDer:e.signatureDer,pubKeyX32:e.pubKeyX32,pubKeyY32:e.pubKeyY32,workerCtx:this.workerCtx})}async sign(n,i){if(n.kind!==`webauthn`||n.algorithm!==`webauthnP256`)throw Error(`[WebAuthnP256Engine] unsupported sign request`);if(n.challenge32.length!==32)throw Error(`[WebAuthnP256Engine] challenge32 must be 32 bytes`);if(i.type!==`webauthnP256`)throw Error(`[WebAuthnP256Engine] keyRef must be webauthnP256`);if(i.pubKeyX.length!==32||i.pubKeyY.length!==32)throw Error(`[WebAuthnP256Engine] pubKeyX/pubKeyY must be 32 bytes each`);if(i.credentialId.length===0)throw Error(`[WebAuthnP256Engine] credentialId must be non-empty`);let a=async a=>{let o=a&&typeof a==`object`?a:{};if(!r(t(String(o.rawId||``).trim()),i.credentialId))throw Error(`[WebAuthnP256Engine] WebAuthn credential rawId does not match keyRef`);let s=o.response,c=e(String(s?.authenticatorData||``)),l=e(String(s?.clientDataJSON||``)),u=e(String(s?.signature||``));if(c.length===0||l.length===0||u.length===0)throw Error(`[WebAuthnP256Engine] missing authenticatorData/clientDataJSON/signature in credential`);return await this.buildWebauthnSignature({challenge32:n.challenge32,authenticatorData:c,clientDataJSON:l,signatureDer:u,pubKeyX32:i.pubKeyX,pubKeyY32:i.pubKeyY})};if(n.credential)return await a(n.credential);if(typeof navigator>`u`||!navigator.credentials||typeof navigator.credentials.get!=`function`)throw Error(`[WebAuthnP256Engine] WebAuthn not available (must run in a browser context)`);let o=new Uint8Array(n.challenge32),s=new Uint8Array(i.credentialId);this.beforeSigning?.();let c=await navigator.credentials.get({publicKey:{challenge:o,allowCredentials:[{type:`public-key`,id:s}],rpId:n.rpId??i.rpId,userVerification:`preferred`}});if(!c)throw Error(`[WebAuthnP256Engine] user cancelled WebAuthn assertion`);if(!r(new Uint8Array(c.rawId),i.credentialId))throw Error(`[WebAuthnP256Engine] WebAuthn assertion returned unexpected credentialId`);let l=c.response;if(!l||!l.authenticatorData||!l.clientDataJSON||!l.signature)throw Error(`[WebAuthnP256Engine] invalid WebAuthn assertion response`);let u=new Uint8Array(l.authenticatorData),d=new Uint8Array(l.clientDataJSON),f=new Uint8Array(l.signature);return await this.buildWebauthnSignature({challenge32:n.challenge32,authenticatorData:u,clientDataJSON:d,signatureDer:f,pubKeyX32:i.pubKeyX,pubKeyY32:i.pubKeyY})}};export{i as WebAuthnP256Engine};

package/dist/esm/sdk/{webauthnPromptCoordinator-DO-qfECu.js → webauthnPromptCoordinator-BEudHQBr.js}

@@ -1 +1 @@
-import{t as e}from"./secureRandomId-CTdlJ5Mx.js";var t=class extends Error{constructor(e,t){super(t),this.name=`WebAuthnPromptCoordinatorError`,this.code=e}};function n(e,t){switch(e.kind){case`registration_modal`:return t.kind===`registration_modal`&&e.requestId===t.requestId;case`hosted_auth_menu_registration`:return t.kind===`hosted_auth_menu_registration`&&e.authMenuSessionId===t.authMenuSessionId&&e.requestId===t.requestId;default:return r(e)}}function r(e){throw Error(`Unknown registration WebAuthn prompt owner: ${String(e)}`)}function i(){return`webauthn-reservation-${e(18,`WebAuthn reservation IDs`)}`}function a(){return`webauthn-operation-${e(18,`WebAuthn operation IDs`)}`}const o=new class{constructor(){this.state={kind:`idle`},this.idleWaiters=new Set,this.reservationExpiryTimer=null,this.consumedReservationIds=new Set}async reserveRegistrationPrompt(e){if(this.throwIfReservationCancelled(e.cancellation),Date.now()>=e.expiresAtMs)throw new t(`webauthn_prompt_reservation_expired`,`WebAuthn prompt reservation expired before acquisition`);for(;this.state.kind!==`idle`;)await this.waitUntilIdle(e.expiresAtMs,e.cancellation),this.throwIfReservationCancelled(e.cancellation);let n={kind:`reserved_registration_webauthn_prompt_v1`,reservationId:i(),owner:e.owner,expiresAtMs:e.expiresAtMs};return this.state={kind:`reserved`,reservation:n},this.armReservationExpiry(n),n}releaseReservation(e){this.state.kind===`reserved`&&this.state.reservation.reservationId===e.reservationId&&(this.clearReservationExpiry(),this.state={kind:`idle`},this.notifyIdle())}isLiveReservation(e){return Date.now()<e.reservation.expiresAtMs&&this.state.kind===`reserved`&&this.state.reservation.reservationId===e.reservation.reservationId&&n(e.reservation.owner,e.owner)}runReserved(e){this.assertLiveReservation(e.reservation,e.owner);let t=a();return this.consumedReservationIds.add(e.reservation.reservationId),this.clearReservationExpiry(),this.state={kind:`running`,operationId:t,owner:e.owner},this.startOperation(t,e.operation)}runImmediate(e){if(this.state.kind!==`idle`)throw new t(`webauthn_prompt_busy`,`Another WebAuthn prompt owns the coordinator`);let n=a();return this.state={kind:`running`,operationId:n,owner:e.owner},this.startOperation(n,e.operation)}startOperation(e,t){let n;try{n=t()}catch(t){throw this.finishOperation(e),t}let r=this.finishOperation.bind(this,e);return n.then(r,r),n}assertLiveReservation(e,r){if(this.consumedReservationIds.has(e.reservationId))throw new t(`webauthn_prompt_reservation_reused`,`WebAuthn prompt reservation was already consumed`);if(Date.now()>=e.expiresAtMs)throw this.releaseReservation(e),new t(`webauthn_prompt_reservation_expired`,`WebAuthn prompt reservation expired`);if(this.state.kind!==`reserved`||this.state.reservation.reservationId!==e.reservationId)throw new t(`webauthn_prompt_reservation_reused`,`WebAuthn prompt reservation is no longer active`);if(!n(e.owner,r))throw new t(`webauthn_prompt_reservation_owner_mismatch`,`WebAuthn prompt reservation owner does not match`)}finishOperation(e){this.state.kind!==`running`||this.state.operationId!==e||(this.state={kind:`idle`},this.notifyIdle())}waitUntilIdle(e,n){let r=Math.max(1,e-Date.now());return new Promise((e,i)=>{let a={resolve:e,reject:i,signal:n.kind===`abort_signal`?n.signal:null,onAbort:null,timer:setTimeout(()=>{this.idleWaiters.delete(a),this.removeWaiterAbortListener(a),i(new t(`webauthn_prompt_reservation_expired`,`WebAuthn prompt reservation expired while waiting for the coordinator`))},r)};a.signal&&(a.onAbort=()=>{this.idleWaiters.delete(a),clearTimeout(a.timer),this.removeWaiterAbortListener(a),i(Error(`WebAuthn prompt reservation acquisition cancelled`))},a.signal.addEventListener(`abort`,a.onAbort,{once:!0})),this.idleWaiters.add(a)})}notifyIdle(){for(let e of this.idleWaiters)clearTimeout(e.timer),this.removeWaiterAbortListener(e),e.resolve();this.idleWaiters.clear()}armReservationExpiry(e){this.clearReservationExpiry(),this.reservationExpiryTimer=setTimeout(this.releaseReservation.bind(this,e),Math.max(1,e.expiresAtMs-Date.now()))}clearReservationExpiry(){this.reservationExpiryTimer!==null&&(clearTimeout(this.reservationExpiryTimer),this.reservationExpiryTimer=null)}throwIfReservationCancelled(e){if(e.kind===`abort_signal`&&e.signal.aborted)throw Error(`WebAuthn prompt reservation acquisition cancelled`)}removeWaiterAbortListener(e){!e.signal||!e.onAbort||(e.signal.removeEventListener(`abort`,e.onAbort),e.onAbort=null)}};export{o as t};
+import{t as e}from"./secureRandomId-BIekT8bE.js";var t=class extends Error{constructor(e,t){super(t),this.name=`WebAuthnPromptCoordinatorError`,this.code=e}};function n(e,t){switch(e.kind){case`registration_modal`:return t.kind===`registration_modal`&&e.requestId===t.requestId;case`hosted_auth_menu_registration`:return t.kind===`hosted_auth_menu_registration`&&e.authMenuSessionId===t.authMenuSessionId&&e.requestId===t.requestId;default:return r(e)}}function r(e){throw Error(`Unknown registration WebAuthn prompt owner: ${String(e)}`)}function i(){return`webauthn-reservation-${e(18,`WebAuthn reservation IDs`)}`}function a(){return`webauthn-operation-${e(18,`WebAuthn operation IDs`)}`}const o=new class{constructor(){this.state={kind:`idle`},this.idleWaiters=new Set,this.reservationExpiryTimer=null,this.consumedReservationIds=new Set}async reserveRegistrationPrompt(e){if(this.throwIfReservationCancelled(e.cancellation),Date.now()>=e.expiresAtMs)throw new t(`webauthn_prompt_reservation_expired`,`WebAuthn prompt reservation expired before acquisition`);for(;this.state.kind!==`idle`;)await this.waitUntilIdle(e.expiresAtMs,e.cancellation),this.throwIfReservationCancelled(e.cancellation);let n={kind:`reserved_registration_webauthn_prompt_v1`,reservationId:i(),owner:e.owner,expiresAtMs:e.expiresAtMs};return this.state={kind:`reserved`,reservation:n},this.armReservationExpiry(n),n}releaseReservation(e){this.state.kind===`reserved`&&this.state.reservation.reservationId===e.reservationId&&(this.clearReservationExpiry(),this.state={kind:`idle`},this.notifyIdle())}isLiveReservation(e){return Date.now()<e.reservation.expiresAtMs&&this.state.kind===`reserved`&&this.state.reservation.reservationId===e.reservation.reservationId&&n(e.reservation.owner,e.owner)}runReserved(e){this.assertLiveReservation(e.reservation,e.owner);let t=a();return this.consumedReservationIds.add(e.reservation.reservationId),this.clearReservationExpiry(),this.state={kind:`running`,operationId:t,owner:e.owner},this.startOperation(t,e.operation)}runImmediate(e){if(this.state.kind!==`idle`)throw new t(`webauthn_prompt_busy`,`Another WebAuthn prompt owns the coordinator`);let n=a();return this.state={kind:`running`,operationId:n,owner:e.owner},this.startOperation(n,e.operation)}startOperation(e,t){let n;try{n=t()}catch(t){throw this.finishOperation(e),t}let r=this.finishOperation.bind(this,e);return n.then(r,r),n}assertLiveReservation(e,r){if(this.consumedReservationIds.has(e.reservationId))throw new t(`webauthn_prompt_reservation_reused`,`WebAuthn prompt reservation was already consumed`);if(Date.now()>=e.expiresAtMs)throw this.releaseReservation(e),new t(`webauthn_prompt_reservation_expired`,`WebAuthn prompt reservation expired`);if(this.state.kind!==`reserved`||this.state.reservation.reservationId!==e.reservationId)throw new t(`webauthn_prompt_reservation_reused`,`WebAuthn prompt reservation is no longer active`);if(!n(e.owner,r))throw new t(`webauthn_prompt_reservation_owner_mismatch`,`WebAuthn prompt reservation owner does not match`)}finishOperation(e){this.state.kind!==`running`||this.state.operationId!==e||(this.state={kind:`idle`},this.notifyIdle())}waitUntilIdle(e,n){let r=Math.max(1,e-Date.now());return new Promise((e,i)=>{let a={resolve:e,reject:i,signal:n.kind===`abort_signal`?n.signal:null,onAbort:null,timer:setTimeout(()=>{this.idleWaiters.delete(a),this.removeWaiterAbortListener(a),i(new t(`webauthn_prompt_reservation_expired`,`WebAuthn prompt reservation expired while waiting for the coordinator`))},r)};a.signal&&(a.onAbort=()=>{this.idleWaiters.delete(a),clearTimeout(a.timer),this.removeWaiterAbortListener(a),i(Error(`WebAuthn prompt reservation acquisition cancelled`))},a.signal.addEventListener(`abort`,a.onAbort,{once:!0})),this.idleWaiters.add(a)})}notifyIdle(){for(let e of this.idleWaiters)clearTimeout(e.timer),this.removeWaiterAbortListener(e),e.resolve();this.idleWaiters.clear()}armReservationExpiry(e){this.clearReservationExpiry(),this.reservationExpiryTimer=setTimeout(this.releaseReservation.bind(this,e),Math.max(1,e.expiresAtMs-Date.now()))}clearReservationExpiry(){this.reservationExpiryTimer!==null&&(clearTimeout(this.reservationExpiryTimer),this.reservationExpiryTimer=null)}throwIfReservationCancelled(e){if(e.kind===`abort_signal`&&e.signal.aborted)throw Error(`WebAuthn prompt reservation acquisition cancelled`)}removeWaiterAbortListener(e){!e.signal||!e.onAbort||(e.signal.removeEventListener(`abort`,e.onAbort),e.onAbort=null)}};export{o as t};

package/dist/esm/shared-ts/src/authorization/capabilityKinds.js

@@ -53,9 +53,6 @@ function parseTenantId(value) {
 function parsePrincipalId(value) {
 	return parseAuthorizationId(value, "principalId");
 }
-function parseEcdsaAuthorizationSessionId(value) {
-	return parseAuthorizationId(value, "ecdsaAuthorizationSessionId");
-}
 function parseDeviceId(value) {
 	return parseAuthorizationId(value, "deviceId");
 }
@@ -74,9 +71,6 @@ function parseWalletSessionId(value) {
 function parseMpcWalletSigningQuotaId(value) {
 	return parseAuthorizationId(value, "mpcWalletSigningQuotaId");
 }
-function parseWalletSessionMintId(value) {
-	return parseAuthorizationId(value, "walletSessionMintId");
-}
 function parseAuthorizationId(value, fieldName) {
 	if (typeof value !== "string") return {
 		ok: false,
@@ -106,6 +100,6 @@ function parseAuthorizationId(value, fieldName) {
 	};
 }
 //#endregion
-export { AUTHORIZATION_EVIDENCE_KINDS, CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS, VAULT_OPERATION_KINDS, buildEvmEcdsaMpcOperationRef, buildNearEd25519MpcOperationRef, buildVaultOperationRef, parseCapabilityId, parseCapabilityOperationId, parseDeviceId, parseEcdsaAuthorizationSessionId, parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId };
+export { AUTHORIZATION_EVIDENCE_KINDS, CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS, VAULT_OPERATION_KINDS, buildEvmEcdsaMpcOperationRef, buildNearEd25519MpcOperationRef, buildVaultOperationRef, parseCapabilityId, parseCapabilityOperationId, parseDeviceId, parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId };
 
 //# sourceMappingURL=capabilityKinds.js.map

package/dist/esm/shared-ts/src/authorization/delegatedAuthority.js

@@ -1,5 +1,4 @@
-//#region ../shared-ts/src/authorization/delegatedAuthority.ts
-const FULL_OWNER_PERMISSIONS = Object.freeze([
+Object.freeze([
 	"export_keys",
 	"link_devices",
 	"revoke_devices",
@@ -62,28 +61,11 @@ function parseDelegatedWalletAuthorityV1(raw) {
 		value: buildDelegatedWalletAuthorityV1({ permissions: permissions.value })
 	};
 }
-function buildFullOwnerPermissionsV1() {
-	return buildPresetPermissionSet(FULL_OWNER_PERMISSIONS);
-}
-function buildFullOwnerDelegatedWalletAuthorityV1() {
-	return buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() });
-}
-function hasDelegatedWalletPermissionV1(authority, permission) {
-	return authority.permissions.includes(permission);
-}
-function delegatedWalletPermissionNamesV1(authority) {
-	return Object.freeze([...authority.permissions]);
-}
 function sameDelegatedWalletAuthorityV1(left, right) {
 	if (left.kind !== right.kind || left.permissions.length !== right.permissions.length) return false;
 	for (let index = 0; index < left.permissions.length; index += 1) if (left.permissions[index] !== right.permissions[index]) return false;
 	return true;
 }
-function buildPresetPermissionSet(permissions) {
-	const parsed = parseDelegatedWalletPermissionSetV1(permissions);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
 function compareDelegatedWalletPermissions(left, right) {
 	return left < right ? -1 : left > right ? 1 : 0;
 }
@@ -116,6 +98,6 @@ function invalidAuthorityResult(message) {
 	};
 }
 //#endregion
-export { buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, delegatedWalletPermissionNamesV1, hasDelegatedWalletPermissionV1, parseDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, sameDelegatedWalletAuthorityV1 };
+export { buildDelegatedWalletAuthorityV1, parseDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, sameDelegatedWalletAuthorityV1 };
 
 //# sourceMappingURL=delegatedAuthority.js.map

package/dist/esm/shared-ts/src/authorization/index.js

@@ -1,6 +1,5 @@
-import "./capabilityKinds.js";
 import "./delegatedAuthority.js";
+import "./capabilityKinds.js";
 import "./walletAuthority.js";
 import "./operationFingerprint.js";
-import "./walletCustodyOperation.js";
 import "./walletSessionIssuance.js";

package/dist/esm/shared-ts/src/authorization/operationFingerprint.js

@@ -1,8 +1,5 @@
-import { base64UrlEncode } from "../utils/base64.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../utils/digests.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 //#region ../shared-ts/src/authorization/operationFingerprint.ts
-const CAPABILITY_OPERATION_FINGERPRINT_DOMAIN_V1 = "seams:authorization:capability-operation-fingerprint:v1";
 var CapabilityOperationEnvelopeProof = class {
 	retainProof() {
 		return true;
@@ -31,27 +28,11 @@ function buildCapabilityOperationEnvelope(fields) {
 		}
 	});
 }
-function canonicalCapabilityOperationFingerprintPreimageV1(envelope) {
-	return `${CAPABILITY_OPERATION_FINGERPRINT_DOMAIN_V1}|${alphabetizeStringify({
-		tenantId: envelope.tenantId,
-		principalId: envelope.principalId,
-		capabilityId: envelope.capabilityId,
-		operationId: envelope.operationId,
-		operation: envelope.operation,
-		digests: envelope.digests
-	})}`;
-}
-async function computeCapabilityOperationFingerprintDigest(envelope) {
-	return parseCapabilityOperationFingerprintDigest(base64UrlEncode(await sha256BytesUtf8(canonicalCapabilityOperationFingerprintPreimageV1(envelope))));
-}
-function parseCapabilityOperationFingerprintDigest(value) {
-	return parseDigestB64u(value);
-}
 function parseSigningOperationFingerprintDigest(value) {
 	if (typeof value !== "string" || !value.startsWith("sha256:")) throw new Error("signing operation fingerprint must use the sha256: prefix");
 	return parseDigestB64u(value.slice(7));
 }
 //#endregion
-export { buildCapabilityOperationEnvelope, canonicalCapabilityOperationFingerprintPreimageV1, computeCapabilityOperationFingerprintDigest, parseCapabilityOperationFingerprintDigest, parseSigningOperationFingerprintDigest };
+export { buildCapabilityOperationEnvelope, parseSigningOperationFingerprintDigest };
 
 //# sourceMappingURL=operationFingerprint.js.map

package/dist/esm/shared-ts/src/authorization/walletAuthority.js

@@ -1,12 +1,12 @@
-import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseMpcMaterialActivationRef, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId } from "../utils/domainIds.js";
-import { parseDeviceId } from "./capabilityKinds.js";
 import { requireRecord } from "../utils/validation.js";
 import { parseDelegatedWalletPermissionSetV1 } from "./delegatedAuthority.js";
+import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseMpcMaterialActivationRef, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId } from "../utils/domainIds.js";
+import { parseDeviceId } from "./capabilityKinds.js";
 import { base64UrlEncode } from "../utils/base64.js";
 import { sha256Bytes } from "../utils/digests.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { concat, lp32, rawDigest, rawPublicKey, text, u32, u64 } from "../utils/digestEncoding.js";
 import { buildExactAdministeredSignerManifestV1, parseExactAdministeredSignerManifestV1 } from "../device-linking/delegatedActivationPlan.js";
+import { concat, lp32, rawDigest, rawPublicKey, text, u32, u64 } from "../utils/digestEncoding.js";
 //#region ../shared-ts/src/authorization/walletAuthority.ts
 const SIGNER_ACTIVATION_SET_DOMAIN = "seams/wallet-signer-activation-set/v1";
 const WALLET_AUTHORITY_DOMAIN = "seams/wallet-authority/v1";
@@ -182,45 +182,6 @@ function buildActiveWalletAuthorityV1(input) {
 		activatedAtMs: input.activatedAtMs
 	};
 }
-async function replaceActiveWalletAuthorityEd25519MaterialActivationV1(input) {
-	const current = input.authority.signerActivations;
-	if (!current.ed25519) throw new Error("active Wallet Authority has no Ed25519 material activation to replace");
-	const signerActivations = current.ecdsa ? buildWalletSignerActivationSetV1({
-		manifest: buildExactAdministeredSignerManifestV1([current.ed25519.signer, current.ecdsa.signer]),
-		materialActivations: {
-			keyFamilies: ["ed25519", "ecdsa_secp256k1"],
-			ed25519: input.materialActivation,
-			ecdsa: current.ecdsa.materialActivation
-		}
-	}) : buildWalletSignerActivationSetV1({
-		manifest: buildExactAdministeredSignerManifestV1([current.ed25519.signer]),
-		materialActivations: {
-			keyFamilies: ["ed25519"],
-			ed25519: input.materialActivation
-		}
-	});
-	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
-	const draft = {
-		kind: input.authority.kind,
-		authorityId: input.authority.authorityId,
-		walletId: input.authority.walletId,
-		principal: input.authority.principal,
-		provenance: input.authority.provenance,
-		permissions: input.authority.permissions,
-		signerActivations,
-		signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authority.authorityDigestB64u,
-		revocationEpoch: input.authority.revocationEpoch,
-		createdAtMs: input.authority.createdAtMs,
-		updatedAtMs: Math.max(input.authority.updatedAtMs, input.updatedAtMs),
-		state: "active",
-		activatedAtMs: input.authority.activatedAtMs
-	};
-	return buildActiveWalletAuthorityV1({
-		...draft,
-		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft)
-	});
-}
 function buildActiveCombinedWalletAuthorityV1(input) {
 	validateWalletAuthorityV1(input);
 	return {
@@ -324,14 +285,6 @@ async function walletAuthorityDigestsMatchV1(value) {
 	if (await computeWalletSignerActivationSetDigestB64u(value.signerActivations) !== value.signerActivationSetDigestB64u) return false;
 	return await computeWalletAuthorityDigestB64u(value) === value.authorityDigestB64u;
 }
-/**
-* True when both authorities' stored digests verify and agree. The authority digest does not
-* cover the timestamps, so those must agree too.
-*/
-async function sameVerifiedActiveWalletAuthorityV1(left, right) {
-	const [leftVerified, rightVerified] = await Promise.all([walletAuthorityDigestsMatchV1(left), walletAuthorityDigestsMatchV1(right)]);
-	return leftVerified && rightVerified && left.authorityDigestB64u === right.authorityDigestB64u && left.signerActivationSetDigestB64u === right.signerActivationSetDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs && left.activatedAtMs === right.activatedAtMs;
-}
 function parseWalletAuthorityCommon(record) {
 	if (record.kind !== "wallet_authority_v1") throw new Error("WalletAuthorityV1.kind is unsupported");
 	const authorityId = requireParsed(parseWalletAuthorityId(record.authorityId), "authorityId");
@@ -714,6 +667,6 @@ function isEd25519ExtensionOfEcdsaWalletAuthority(previous, next) {
 	return isActiveEcdsaWalletAuthorityV1(previous) && isCombinedWalletSignerActivationSetV1(next.signerActivations) && previous.provenance.kind === "wallet_registration" && keepsWalletAuthorityApartFromSigners(previous, next) && base64UrlEncode(encodeEcdsaActivation(previous.signerActivations.ecdsa)) === base64UrlEncode(encodeEcdsaActivation(next.signerActivations.ecdsa));
 }
 //#endregion
-export { buildActiveCombinedWalletAuthorityV1, buildActiveWalletAuthorityV1, buildPendingWalletAuthorityV1, buildRevokedWalletAuthorityV1, buildWalletEcdsaSignerActivationV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, encodeWalletSignerActivationSetV1, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1, isActiveEd25519WalletAuthorityV1, isActiveRecoveredWalletAuthorityV1, isCombinedWalletSignerActivationSetV1, isEcdsaExtensionOfEd25519WalletAuthority, isEd25519ExtensionOfEcdsaWalletAuthority, parseWalletAuthorityV1, parseWalletSignerActivationSetV1, replaceActiveWalletAuthorityEd25519MaterialActivationV1, sameVerifiedActiveWalletAuthorityV1, walletAuthorityDigestsMatchV1 };
+export { buildActiveCombinedWalletAuthorityV1, buildActiveWalletAuthorityV1, buildPendingWalletAuthorityV1, buildRevokedWalletAuthorityV1, buildWalletEcdsaSignerActivationV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, encodeWalletSignerActivationSetV1, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1, isActiveEd25519WalletAuthorityV1, isActiveRecoveredWalletAuthorityV1, isCombinedWalletSignerActivationSetV1, isEcdsaExtensionOfEd25519WalletAuthority, isEd25519ExtensionOfEcdsaWalletAuthority, parseWalletAuthorityV1, parseWalletSignerActivationSetV1, walletAuthorityDigestsMatchV1 };
 
 //# sourceMappingURL=walletAuthority.js.map