@seams/wallet 0.9.2 → 0.9.4

package/dist/public/sdk/nearEd25519YaoMaterialActivation-fWQI3rYj.js

@@ -1 +0,0 @@
-import{A as e,B as t,I as n,L as r,P as i,V as a,f as o,j as s,w as c,x as l}from"./normalize-kUDm5zfS.js";import{C as u,S as d,c as f}from"./chains-CiYQT1K4.js";import{r as p}from"./base64-CsEj-_bC.js";import{y as m}from"./primitives-CAcl7ON7.js";import{o as h}from"./sessionPolicy-J-RrlPZQ.js";import{d as g,f as _,i as ee,r as te}from"./signingSessionSeal-CDLUmAFY.js";import{i as ne,n as re,r as ie}from"./activeWalletSession-DiZcKjB_.js";import{d as v,g as ae,h as y,m as oe}from"./capabilityKinds-CKQ4Uqnv.js";import{o as se,r as ce}from"./canonicalPrimitives-CKPGgpxg.js";import{d as le,g as ue,h as de,p as fe,u as pe}from"./digestEncoding-Dzc1rzWV.js";import{c as me,l as he,s as ge}from"./accountIds-BzZs7YoX.js";import{r as _e}from"./registrationAuthMethodInput-6ccY2Vuh.js";import{o as ve,u as ye}from"./registrationSignerPlan-B9GCvpTV.js";import{a as b,l as be,o as xe,s as Se}from"./ecdsaChainTarget-C8ZtMZ8l.js";import{n as Ce,r as we}from"./signerDomain-vQmlnsbF.js";import{P as Te,a as Ee,c as De,i as Oe,lt as ke,n as Ae,o as je,s as Me,t as Ne,vt as Pe,yt as Fe}from"./registrationIntent-DOkZcKSP.js";import{d as Ie}from"./walletAuthority-B5hXHWpK.js";import{At as Le,C as Re,Dt as x,E as ze,K as Be,M as Ve,b as He,en as Ue,it as We,l as Ge,nt as Ke,ot as qe,q as Je,rt as Ye,y as Xe}from"./emailOtpEcdsaDerivationIdentity-B8HzTh4T.js";import{K as S,O as Ze,U as Qe}from"./challengeDelivery-DxXAkOfS.js";import{r as $e}from"./walletAuthMethodRecord-CXedSgpV.js";import{a as et,i as C}from"./registrationIds-CdPqm-Ya.js";import{d as w,t as tt}from"./passkey-custody-BQj44jEM.js";import{n as nt}from"./thresholdEcdsa-CO7xo1So.js";function rt(e){let t=D(e);if(!t||!(`kind`in t)||typeof t.kind!=`string`)return null;switch(t.kind){case`issued`:{if(!O(t,[`kind`,`session`])||!(`session`in t))return null;let e=it(t.session);return e===null?null:{kind:`issued`,session:e}}case`already_committed`:{if(!O(t,[`kind`,`session`,`next`])||!(`session`in t)||!(`next`in t)||t.next!==`unlock_exact_method`)return null;let e=st(t.session);return e===null?null:{kind:`already_committed`,session:e,next:t.next}}default:return null}}function it(e){try{let t=D(e);if(!t||!O(t,[`kind`,`walletId`,`authorizationId`,`walletSessionId`,`quotaId`,`expiresAtMs`,`remainingUses`,`walletSession`,`operationCredential`,`tokens`])||!(`kind`in t)||!(`walletId`in t)||!(`authorizationId`in t)||!(`walletSessionId`in t)||!(`quotaId`in t)||!(`expiresAtMs`in t)||!(`remainingUses`in t)||!(`walletSession`in t)||!(`operationCredential`in t)||!(`tokens`in t)||t.kind!==`registration_established_wallet_session_v2`)return null;let n=r(t.walletId),i=y(t.walletSessionId),a=oe(t.authorizationId),o=v(t.quotaId);if(!n.ok||!a.ok||!i.ok||!o.ok)return null;let s=E(t.expiresAtMs),c=E(t.remainingUses);if(s===null||s<=0||c===null||c<=0)return null;let l=re(t.walletSession),u=ne(t.operationCredential);if(l.walletId!==n.value||l.authorizationId!==a.value||l.quotaId!==o.value||l.expiresAtMs!==s||u.walletSessionId!==i.value)return null;let d=ct(t.tokens);return d===null||!at(l,d)?null:{kind:`registration_established_wallet_session_v2`,walletId:n.value,authorizationId:a.value,walletSessionId:i.value,quotaId:o.value,expiresAtMs:s,remainingUses:c,walletSession:l,operationCredential:u,tokens:d}}catch{return null}}function at(e,t){switch(t.kind){case`evm_family_ecdsa`:return T(e,`ecdsa_secp256k1`,t.ecdsa.materialActivation)&&!ot(e,`ecdsa_secp256k1`);case`near_ed25519`:return T(e,`ed25519`,t.ed25519.materialActivation)&&!ot(e,`ed25519`);case`near_ed25519_and_evm_family_ecdsa`:return T(e,`ecdsa_secp256k1`,t.ecdsa.materialActivation)&&T(e,`ed25519`,t.ed25519.materialActivation)&&!ot(e,`ed25519`,`ecdsa_secp256k1`);default:return!1}}function T(e,t,n){return e.capabilitySubjects.some(e=>e.kind===`sign`&&e.keyFamily===t&&o(e.materialActivation,n))}function ot(e,...t){return e.capabilitySubjects.some(e=>e.kind===`sign`&&!t.includes(e.keyFamily))}function st(e){try{let t=D(e);if(!t||!O(t,[`kind`,`walletId`,`authorizationId`,`walletSessionId`,`quotaId`,`expiresAtMs`,`remainingUses`,`walletSession`,`tokens`])||!(`kind`in t)||!(`walletId`in t)||!(`authorizationId`in t)||!(`walletSessionId`in t)||!(`quotaId`in t)||!(`expiresAtMs`in t)||!(`remainingUses`in t)||!(`walletSession`in t)||!(`tokens`in t)||t.kind!==`registration_established_wallet_session_projection_v2`)return null;let n=r(t.walletId),i=oe(t.authorizationId),a=y(t.walletSessionId),o=v(t.quotaId);if(!n.ok||!i.ok||!a.ok||!o.ok||new Set([i.value,a.value,o.value]).size!==3)return null;let s=E(t.expiresAtMs),c=E(t.remainingUses),l=re(t.walletSession),u=ct(t.tokens);return s===null||s<=0||c===null||u===null||l.walletId!==n.value||l.authorizationId!==i.value||l.quotaId!==o.value||l.expiresAtMs!==s||!at(l,u)?null:{kind:`registration_established_wallet_session_projection_v2`,walletId:n.value,authorizationId:i.value,walletSessionId:a.value,quotaId:o.value,expiresAtMs:s,remainingUses:c,walletSession:l,tokens:u}}catch{return null}}function ct(e){let t=D(e);if(!t||!(`kind`in t)||typeof t.kind!=`string`)return null;switch(t.kind){case`evm_family_ecdsa`:{if(!O(t,[`kind`,`ecdsa`])||!(`ecdsa`in t))return null;let e=lt(t.ecdsa);return e===null?null:{kind:`evm_family_ecdsa`,ecdsa:e}}case`near_ed25519`:{if(!O(t,[`kind`,`ed25519`])||!(`ed25519`in t))return null;let e=ut(t.ed25519);return e===null?null:{kind:`near_ed25519`,ed25519:e}}case`near_ed25519_and_evm_family_ecdsa`:{if(!O(t,[`kind`,`ecdsa`,`ed25519`])||!(`ecdsa`in t)||!(`ed25519`in t))return null;let e=lt(t.ecdsa),n=ut(t.ed25519);return e===null||n===null?null:{kind:`near_ed25519_and_evm_family_ecdsa`,ecdsa:e,ed25519:n}}default:return null}}function lt(t){let n=D(t);if(!n||!O(n,[`sessionKind`,`thresholdSessionId`,`keyHandle`,`runtimePolicyScope`,`materialActivation`,`routerAbEcdsaDerivationNormalSigning`])||!(`sessionKind`in n)||!(`thresholdSessionId`in n)||!(`keyHandle`in n)||!(`runtimePolicyScope`in n)||!(`materialActivation`in n)||!(`routerAbEcdsaDerivationNormalSigning`in n)||n.sessionKind!==`credential_free_projection_v2`)return null;let r=e(n.thresholdSessionId);if(!r.ok)return null;try{let e=Ve(n.keyHandle),t=dt(n.runtimePolicyScope),i=c(n.materialActivation);if(!i.ok)return null;let a=Be(n.routerAbEcdsaDerivationNormalSigning);if(!a)return null;let s=Ue(a.scope.material_activation);return o(i.value,s)?{sessionKind:`credential_free_projection_v2`,thresholdSessionId:r.value,keyHandle:e,runtimePolicyScope:t,materialActivation:i.value,routerAbEcdsaDerivationNormalSigning:a}:null}catch{return null}}function ut(e){let t=D(e);if(!t||!O(t,[`sessionKind`,`thresholdSessionId`,`nearAccountId`,`nearEd25519SigningKeyId`,`runtimePolicyScope`,`materialActivation`,`routerAbNormalSigning`])||!(`sessionKind`in t)||!(`thresholdSessionId`in t)||!(`nearAccountId`in t)||!(`nearEd25519SigningKeyId`in t)||!(`runtimePolicyScope`in t)||!(`materialActivation`in t)||!(`routerAbNormalSigning`in t)||t.sessionKind!==`credential_free_projection_v2`)return null;let n=s(t.thresholdSessionId),r=he(t.nearAccountId);if(!n.ok||!r.ok)return null;try{let e=C(t.nearEd25519SigningKeyId),i=dt(t.runtimePolicyScope),a=c(t.materialActivation);if(!a.ok)return null;let o=g(t.routerAbNormalSigning);return o?{sessionKind:`credential_free_projection_v2`,thresholdSessionId:n.value,nearAccountId:r.value,nearEd25519SigningKeyId:e,runtimePolicyScope:i,materialActivation:a.value,routerAbNormalSigning:o}:null}catch{return null}}function dt(e){let t=D(e);if(!t||!O(t,[`orgId`,`projectId`,`envId`,`signingRootVersion`])||!(`orgId`in t)||!(`projectId`in t)||!(`envId`in t)||!(`signingRootVersion`in t))throw Error(`runtime policy scope projection is invalid`);return m({orgId:t.orgId,projectId:t.projectId,envId:t.envId,signingRootVersion:t.signingRootVersion})}function E(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=0?e:null}function D(e){return typeof e==`object`&&e&&!Array.isArray(e)?e:null}function O(e,t){return Object.keys(e).length===t.length&&t.every(t=>Object.prototype.hasOwnProperty.call(e,t))}function ft(e){let t=String(e||``).trim().toLowerCase();return/^0x[0-9a-f]{40}$/.test(t)?t:``}const pt=/^ederivation-key-[A-Za-z0-9_-]+$/;function k(e){let t=String(e||``).trim();return t?pt.test(t)?{kind:`resolved`,keyHandle:t}:{kind:`invalid`}:{kind:`missing`}}function mt(e){let t=k(e.keyHandle),n=d(e.sharedEvmFamilyKey)?k(e.sharedEvmFamilyKey.keyHandle):{kind:`missing`};return t.kind===`missing`?{kind:`blocked`,reason:`missing_key_handle`}:t.kind===`invalid`||n.kind===`invalid`?{kind:`blocked`,reason:`invalid_key_handle`}:n.kind===`resolved`&&t.keyHandle!==n.keyHandle?{kind:`blocked`,reason:`duplicate_key_handles`}:{kind:`resolved`,keyHandle:t.keyHandle}}function ht(e){let t=(d(e.metadata.sharedEvmFamilyKey)?e.metadata.sharedEvmFamilyKey:null)||e.metadata,n=String(t.thresholdEcdsaPublicKeyB64u||e.metadata.thresholdEcdsaPublicKeyB64u||``).trim();if(!n)return null;let r=String(t.walletId||``).trim();if(!r)return null;try{ze(n);let i=t.ecdsaThresholdKeyId||e.metadata.ecdsaThresholdKeyId,a=t.signingRootId||e.metadata.signingRootId,o=t.signingRootVersion||e.metadata.signingRootVersion,s=t.participantIds||e.metadata.participantIds,c=t.thresholdOwnerAddress||e.metadata.thresholdOwnerAddress||e.metadata.ownerAddress;return Ge({walletId:r,keyHandle:e.keyHandle,chainTarget:e.chainTarget,ecdsaThresholdKeyId:i,signingRootId:a,signingRootVersion:o,participantIds:s,thresholdOwnerAddress:c,thresholdEcdsaPublicKeyB64u:n})}catch{return null}}function gt(e){try{let t=Je(e.raw);return String(t.client_id)!==String(e.walletId)||t.public_identity.threshold_public_key33_b64u!==e.thresholdEcdsaPublicKeyB64u?null:t}catch{return null}}function _t(e){let t=e.signer;if(t.status!==`active`||t.signerKind!==we.thresholdEcdsa||t.signerAuthMethod!==Ce.passkey)return{kind:`skipped`};let n=d(t.metadata)?t.metadata:{};if(!d(n.chainTarget))return{kind:`blocked`,targetKey:``,reason:`missing_chain_target`};let r;try{r=b(n.chainTarget)}catch{return{kind:`blocked`,targetKey:``,reason:`invalid_chain_target`}}if(!e.configuredTargets.some(e=>Se(e,r)))return{kind:`skipped`};let i=xe(r),a=mt(n);if(a.kind===`blocked`)return{kind:`blocked`,targetKey:i,reason:a.reason};let o=ht({metadata:n,keyHandle:a.keyHandle,chainTarget:r});if(!o)return{kind:`key_facts_inventory_required`,chainTarget:r,targetKey:i,keyHandle:a.keyHandle,reason:`missing_key_facts`};let s=gt({raw:n.publicCapability,walletId:e.walletId,thresholdEcdsaPublicKeyB64u:o.keyFacts.thresholdEcdsaPublicKeyB64u});return{kind:`active_wallet_key`,chainTarget:r,targetKey:i,walletKey:o,publicCapability:s?{kind:`persisted_public_capability`,value:s}:{kind:`missing_public_capability`}}}function vt(e){let{raw:t}=e;if(!d(t)||!d(t.chainTarget))return null;let n=d(t.key)?t.key:t,r;try{r=b(t.chainTarget)}catch{return null}let i=k(t.keyHandle),a=k(n.keyHandle),o=ft(t.accountAddress),s=ft(t.ownerAddress),c=String(n.walletId||``).trim(),l=String(n.subjectId||``).trim(),u=String(be({walletId:e.walletId})),f=String(n.rpId||``).trim(),p=String(n.thresholdEcdsaPublicKeyB64u||t.thresholdEcdsaPublicKeyB64u||``).trim(),m=ft(n.thresholdOwnerAddress||t.ownerAddress||t.accountAddress||t.ethereumAddress);if(i.kind!==`resolved`||a.kind!==`resolved`||a.keyHandle!==i.keyHandle||!p||!s||!o||!m||c!==String(e.walletId)||l&&l!==u||f!==e.rpId||m!==s)return null;try{let a=gt({raw:t.publicCapability,walletId:e.walletId,thresholdEcdsaPublicKeyB64u:p});if(!a)return null;let c=Re(i.keyHandle),l=He({record:{ecdsaThresholdKeyId:t.ecdsaThresholdKeyId}}),u=Xe({signingRootId:t.signingRootId||n.signingRootId,signingRootVersion:t.signingRootVersion||n.signingRootVersion});return{accountAddress:o,ownerAddress:s,publicCapability:a,walletKey:Ge({walletId:e.walletId,keyHandle:c,chainTarget:r,ecdsaThresholdKeyId:l,signingRootId:u.signingRootId,signingRootVersion:u.signingRootVersion,participantIds:n.participantIds||t.participantIds,thresholdOwnerAddress:m,thresholdEcdsaPublicKeyB64u:p})}}catch{return null}}function yt(e){let t=[];for(let n of e.records){let r=vt({walletId:e.walletId,rpId:e.rpId,raw:n});r&&t.push(r)}return t}function A(e){let t=String(e.value||``).trim();if(!t)throw Error(`${e.responseName} response missing ${e.field}`);return t}function j(e){if(!u(e.value))throw Error(`${e.responseName} response missing ${e.field}`);return e.value}function M(e,t,n){let r=new Set(t);for(let t of Object.keys(e))if(!r.has(t))throw Error(`${n} response contains unexpected ${t}`)}function N(e){let t=Number(e.value);if(!Number.isSafeInteger(t)||t<e.minimum)throw Error(`${e.responseName} response has invalid ${e.field}`);return t}function P(e,t){if(!Array.isArray(e)||e.length!==2)throw Error(`${t} response has invalid participantIds`);let n=N({responseName:t,field:`participantIds[0]`,value:e[0],minimum:1}),r=N({responseName:t,field:`participantIds[1]`,value:e[1],minimum:1});if(n===r)throw Error(`${t} response has duplicate participantIds`);if(n!==1||r!==2)throw Error(`${t} response has unsupported participantIds`);return[n,r]}function F(e,t){let n=a(e);if(!n.ok)throw Error(`${t} response has invalid rpId`);return n.value}function bt(e,t){let n=j({responseName:t,field:`authorityScope`,value:e});switch(n.kind){case`passkey_rp`:return M(n,[`kind`,`rpId`],t),{kind:`passkey_rp`,rpId:F(n.rpId,t)};case`email_otp`:if(M(n,[`kind`,`provider`,`providerUserId`],t),n.provider!==`google`&&n.provider!==`email`)throw Error(`${t} response has invalid authorityScope provider`);return{kind:`email_otp`,provider:n.provider,providerUserId:A({responseName:t,field:`authorityScope.providerUserId`,value:n.providerUserId})};default:throw Error(`${t} response has invalid authorityScope`)}}function xt(e,t){let n=j({responseName:t,field:`ed25519`,value:e});if(M(n,[`signerSlot`,`nearAccountId`,`nearEd25519SigningKeyId`,`publicKey`,`relayerKeyId`,`keyVersion`,`recoveryExportCapable`,`participantIds`],t),n.recoveryExportCapable!==!0)throw Error(`${t} response is not recovery/export capable`);return{signerSlot:N({responseName:t,field:`ed25519.signerSlot`,value:n.signerSlot,minimum:1}),nearAccountId:A({responseName:t,field:`ed25519.nearAccountId`,value:n.nearAccountId}),nearEd25519SigningKeyId:A({responseName:t,field:`ed25519.nearEd25519SigningKeyId`,value:n.nearEd25519SigningKeyId}),publicKey:A({responseName:t,field:`ed25519.publicKey`,value:n.publicKey}),relayerKeyId:A({responseName:t,field:`ed25519.relayerKeyId`,value:n.relayerKeyId}),keyVersion:A({responseName:t,field:`ed25519.keyVersion`,value:n.keyVersion}),recoveryExportCapable:!0,participantIds:P(n.participantIds,t)}}function St(e,t){let n=j({responseName:t,field:`ed25519`,value:e});M(n,[`signerSlot`,`nearAccountId`,`nearEd25519SigningKeyId`,`publicKey`,`relayerKeyId`,`keyVersion`,`recoveryExportCapable`,`participantIds`,`thresholdSessionId`,`runtimePolicyScope`,`routerAbNormalSigning`],t);let r=xt({signerSlot:n.signerSlot,nearAccountId:n.nearAccountId,nearEd25519SigningKeyId:n.nearEd25519SigningKeyId,publicKey:n.publicKey,relayerKeyId:n.relayerKeyId,keyVersion:n.keyVersion,recoveryExportCapable:n.recoveryExportCapable,participantIds:n.participantIds},t),i=s(n.thresholdSessionId);if(!i.ok)throw Error(`${t} response has invalid ed25519.thresholdSessionId`);let a=h(n.runtimePolicyScope);if(!a)throw Error(`${t} response has invalid ed25519.runtimePolicyScope`);return{...r,thresholdSessionId:i.value,runtimePolicyScope:a,routerAbNormalSigning:_(n.routerAbNormalSigning)}}function Ct(e,t){let n=j({responseName:t,field:`chainTarget`,value:e});switch(n.kind){case`evm`:return M(n,[`kind`,`namespace`,`chainId`,`networkSlug`],t),b(n);case`tempo`:return M(n,[`kind`,`chainId`,`networkSlug`],t),b(n);default:throw Error(`${t} response has invalid chainTarget kind`)}}function wt(e,t){let n=j({responseName:t,field:`ecdsa.walletKeys[]`,value:e});if(M(n,[`keyScope`,`chainTarget`,`walletId`,`evmFamilySigningKeySlotId`,`keyHandle`,`ecdsaThresholdKeyId`,`signingRootId`,`signingRootVersion`,`thresholdEcdsaPublicKeyB64u`,`thresholdOwnerAddress`,`relayerKeyId`,`relayerVerifyingShareB64u`,`contextBinding32B64u`,`derivationClientSharePublicKey33B64u`,`clientShareRetryCounter`,`relayerShareRetryCounter`,`participantIds`,`publicCapability`],t),n.keyScope!==`evm-family`)throw Error(`${t} response has invalid keyScope`);return{keyScope:`evm-family`,chainTarget:Ct(n.chainTarget,t),walletId:A({responseName:t,field:`walletId`,value:n.walletId}),evmFamilySigningKeySlotId:A({responseName:t,field:`evmFamilySigningKeySlotId`,value:n.evmFamilySigningKeySlotId}),keyHandle:A({responseName:t,field:`keyHandle`,value:n.keyHandle}),ecdsaThresholdKeyId:A({responseName:t,field:`ecdsaThresholdKeyId`,value:n.ecdsaThresholdKeyId}),signingRootId:A({responseName:t,field:`signingRootId`,value:n.signingRootId}),signingRootVersion:A({responseName:t,field:`signingRootVersion`,value:n.signingRootVersion}),thresholdEcdsaPublicKeyB64u:A({responseName:t,field:`thresholdEcdsaPublicKeyB64u`,value:n.thresholdEcdsaPublicKeyB64u}),thresholdOwnerAddress:A({responseName:t,field:`thresholdOwnerAddress`,value:n.thresholdOwnerAddress}),relayerKeyId:A({responseName:t,field:`relayerKeyId`,value:n.relayerKeyId}),relayerVerifyingShareB64u:A({responseName:t,field:`relayerVerifyingShareB64u`,value:n.relayerVerifyingShareB64u}),contextBinding32B64u:A({responseName:t,field:`contextBinding32B64u`,value:n.contextBinding32B64u}),derivationClientSharePublicKey33B64u:A({responseName:t,field:`derivationClientSharePublicKey33B64u`,value:n.derivationClientSharePublicKey33B64u}),clientShareRetryCounter:N({responseName:t,field:`clientShareRetryCounter`,value:n.clientShareRetryCounter,minimum:0}),relayerShareRetryCounter:N({responseName:t,field:`relayerShareRetryCounter`,value:n.relayerShareRetryCounter,minimum:0}),participantIds:P(n.participantIds,t),publicCapability:Je(n.publicCapability)}}function Tt(e){switch(e){case`registrationIntentLoadMs`:case`registrationIntentDigestMs`:case`registrationIntentConsumeMs`:case`registrationAttemptGateMs`:case`registrationPreparationPersistMs`:case`registrationPreparationLoadMs`:case`registrationPreparationConsumeMs`:case`registrationPreparationScopeCheckMs`:case`registrationAuthorityVerifyMs`:case`registrationEcdsaPrepareMs`:case`registrationCeremonyPersistMs`:case`registerPrepareTotalMs`:case`registerStartTotalMs`:case`registrationEcdsaRespondMs`:case`registrationFinalizeReplayLoadMs`:case`registrationCeremonyLoadMs`:case`registrationEcdsaBootstrapVerifyMs`:case`sponsoredNearAccountCreateMs`:case`registrationKeygenMs`:case`registrationEmailOtpEnrollmentPlanMs`:case`relaySessionMintMs`:case`relayGoogleEmailOtpActivationPlanMs`:case`relayPersistenceMs`:case`registrationFinalizeReplayCacheMs`:case`registerFinalizeTotalMs`:return e;default:throw Error(`Wallet registration finalize response has invalid diagnostics timing name`)}}function Et(e){let t=`Wallet registration finalize`,n=j({responseName:t,field:`registrationDiagnostics`,value:e});if(M(n,[`kind`,`route`,`entries`],t),n.kind!==`wallet_registration_route_diagnostics_v1`||n.route!==`wallets_register_finalize`||!Array.isArray(n.entries))throw Error(`${t} response has invalid registrationDiagnostics`);return{kind:`wallet_registration_route_diagnostics_v1`,route:`wallets_register_finalize`,entries:n.entries.map(e=>{let n=j({responseName:t,field:`registrationDiagnostics.entries[]`,value:e});if(M(n,[`name`,`durationMs`],t),typeof n.durationMs!=`number`||!Number.isFinite(n.durationMs)||n.durationMs<0)throw Error(`${t} response has invalid diagnostics durationMs`);return{name:Tt(n.name),durationMs:n.durationMs}})}}function Dt(e){let t=`Wallet registration finalize`,n=j({responseName:t,field:`authority`,value:e});M(n,[`walletId`,`factor`,`verifier`,`bindingId`],t);let r=j({responseName:t,field:`authority.factor`,value:n.factor}),i=j({responseName:t,field:`authority.verifier`,value:n.verifier});switch(r.kind){case`passkey`:M(r,[`kind`,`credentialIdB64u`],t),M(i,[`kind`,`rpId`],t);break;case`email_otp`:M(r,[`kind`,`provider`,`providerUserId`],t),M(i,[`kind`,`emailHashHex`],t);break;default:throw Error(`${t} response has invalid authority factor`)}let a=Le(n);if(!a)throw Error(`${t} response has invalid authority`);return a}function Ot(e){let t=`Wallet registration finalize`,n=j({responseName:t,field:`authMethod`,value:e.response.authMethod});if(String(e.authority.walletId)!==String(e.walletId))throw Error(`${t} response authority wallet mismatch`);switch(n.kind){case`passkey`:{if(M(n,[`kind`,`credentialIdB64u`,`credentialPublicKeyB64u`],t),!x(e.authority))throw Error(`${t} response has inconsistent passkey authority`);let r=F(e.response.rpId,t),i=A({responseName:t,field:`authMethod.credentialIdB64u`,value:n.credentialIdB64u});if(String(e.authority.factor.credentialIdB64u)!==i||String(e.authority.verifier.rpId)!==String(r))throw Error(`${t} response passkey authority binding mismatch`);return{kind:`passkey`,rpId:r,authMethod:{kind:`passkey`,credentialIdB64u:i,credentialPublicKeyB64u:A({responseName:t,field:`authMethod.credentialPublicKeyB64u`,value:n.credentialPublicKeyB64u})}}}case`email_otp`:if(M(n,[`kind`,`registrationAuthorityId`],t),x(e.authority)||e.response.rpId!==void 0)throw Error(`${t} response has inconsistent email OTP authority`);return{kind:`email_otp`,authMethod:{kind:`email_otp`,registrationAuthorityId:A({responseName:t,field:`authMethod.registrationAuthorityId`,value:n.registrationAuthorityId})}};default:throw Error(`${t} response has invalid authMethod`)}}function kt(e){let t=`Wallet registration finalize`,n=j({responseName:t,field:`accountProvisioning`,value:e});switch(n.kind){case`implicit_account`:if(M(n,[`kind`,`accountIdSource`],t),n.accountIdSource!==`ed25519_public_key`)throw Error(`${t} response has invalid implicit account provisioning`);return{kind:`implicit_account`,accountIdSource:`ed25519_public_key`};case`sponsored_named_account`:{M(n,[`kind`,`requestedAccountId`,`sponsor`],t);let e=me(n.requestedAccountId);if(!e.ok||n.sponsor!==`relayer`)throw Error(`${t} response has invalid named account provisioning`);return{kind:`sponsored_named_account`,requestedAccountId:e.value,sponsor:`relayer`}}default:throw Error(`${t} response has invalid accountProvisioning kind`)}}function At(e){let t=`Wallet registration finalize`,n=j({responseName:t,field:`resolvedAccount`,value:e});switch(n.kind){case`implicit_account`:{M(n,[`kind`,`nearAccountId`,`nearEd25519SigningKeyId`],t);let e=ge(n.nearAccountId);if(!e.ok)throw Error(`${t} response has invalid implicit nearAccountId`);return{kind:`implicit_account`,nearAccountId:e.value,nearEd25519SigningKeyId:C(n.nearEd25519SigningKeyId)}}case`sponsored_named_account`:{M(n,[`kind`,`nearAccountId`,`nearEd25519SigningKeyId`,`transactionHash`],t);let e=me(n.nearAccountId);if(!e.ok)throw Error(`${t} response has invalid named nearAccountId`);return{kind:`sponsored_named_account`,nearAccountId:e.value,nearEd25519SigningKeyId:C(n.nearEd25519SigningKeyId),transactionHash:A({responseName:t,field:`resolvedAccount.transactionHash`,value:n.transactionHash})}}default:throw Error(`${t} response has invalid resolvedAccount kind`)}}function jt(e){let t=`Wallet registration finalize`,n=j({responseName:t,field:`ecdsa`,value:e.value});if(M(n,[`walletKeys`],t),!Array.isArray(n.walletKeys)||n.walletKeys.length===0)throw Error(`${t} response has invalid walletKeys`);let r=new Set;return{walletKeys:n.walletKeys.map(n=>{let i=wt(n,t);if(i.walletId!==String(e.walletId))throw Error(`${t} response ECDSA walletId mismatch`);if(String(i.publicCapability.client_id)!==String(e.walletId)||i.publicCapability.public_identity.context_binding_b64u!==i.contextBinding32B64u||i.publicCapability.public_identity.derivation_client_share_public_key33_b64u!==i.derivationClientSharePublicKey33B64u||i.publicCapability.public_identity.threshold_public_key33_b64u!==i.thresholdEcdsaPublicKeyB64u||i.publicCapability.public_identity.client_share_retry_counter!==i.clientShareRetryCounter||i.publicCapability.public_identity.server_share_retry_counter!==i.relayerShareRetryCounter)throw Error(`${t} response ECDSA public capability mismatch`);let a=xe(i.chainTarget);if(r.has(a))throw Error(`${t} response has duplicate ECDSA target ${a}`);return r.add(a),i})}}function Mt(e){let t=`Wallet registration finalize`,n=bt(e.response.authorityScope,t),r=kt(e.response.accountProvisioning),i=At(e.response.resolvedAccount),a=St(e.response.ed25519,t);if(r.kind!==i.kind||i.nearAccountId!==a.nearAccountId||i.nearEd25519SigningKeyId!==a.nearEd25519SigningKeyId)throw Error(`${t} response has inconsistent Ed25519 identity`);if(n.kind===`passkey_rp`&&(!x(e.authority)||String(e.authority.verifier.rpId)!==String(n.rpId))||n.kind===`email_otp`&&(x(e.authority)||e.authority.factor.provider!==n.provider||String(e.authority.factor.providerUserId)!==n.providerUserId))throw Error(`${t} response authorityScope mismatch`);return{authorityScope:n,accountProvisioning:r,resolvedAccount:i,ed25519:a}}function Nt(e){let t=`Wallet registration finalize`,n=j({responseName:t,field:`body`,value:e.value});if(M(n,[`ok`,`walletId`,`authority`,`foundingAuthority`,`foundingAuthMethod`,`registrationDiagnostics`,`rpId`,`authMethod`,`walletCustody`,`custodyKeyManifestDigestB64u`,`kind`,`authorityScope`,`accountProvisioning`,`resolvedAccount`,`ed25519`,`ecdsa`],t),n.ok!==!0||n.kind!==e.expectedKind)throw Error(`${t} response substituted signer branch`);let r=et(A({responseName:t,field:`walletId`,value:n.walletId})),i=Dt(n.authority),a=Ie(n.foundingAuthority),o=$e(n.foundingAuthMethod);if(!a.ok)throw Error(`${t} response has an invalid founding authority: ${a.error.message}`);if(a.value.state!==`active`)throw Error(`${t} response has an inactive founding authority`);if(!o)throw Error(`${t} response has an invalid founding auth method`);if(o.status!==`active`)throw Error(`${t} response has an inactive founding auth method`);if(a.value.walletId!==r||o.walletId!==r)throw Error(`${t} response changed the founding wallet identity`);if(o.walletAuthorityId!==a.value.authorityId)throw Error(`${t} response has mismatched founding authority identities`);if(o.walletAuthMethodId!==i.bindingId)throw Error(`${t} response has mismatched founding auth-method identities`);let s=Ot({response:n,walletId:r,authority:i}),c=n.registrationDiagnostics===void 0?void 0:Et(n.registrationDiagnostics),l=n.walletCustody===void 0?{}:{walletCustody:tt(n.walletCustody,t)},u=n.custodyKeyManifestDigestB64u===void 0?void 0:A({responseName:t,field:`custodyKeyManifestDigestB64u`,value:n.custodyKeyManifestDigestB64u});if(u!==void 0&&p(u).byteLength!==32)throw Error(`${t} response has invalid custodyKeyManifestDigestB64u`);let d=u===void 0?{}:{custodyKeyManifestDigestB64u:u};switch(n.kind){case`near_ed25519`:{if(n.ecdsa!==void 0)throw Error(`${t} response mixed signer branches`);let e=Mt({response:n,authority:i});return s.kind===`passkey`?{ok:!0,walletId:r,authority:i,foundingAuthority:a.value,foundingAuthMethod:o,...c?{registrationDiagnostics:c}:{},...l,...d,rpId:s.rpId,authMethod:s.authMethod,kind:`near_ed25519`,authorityScope:e.authorityScope,accountProvisioning:e.accountProvisioning,resolvedAccount:e.resolvedAccount,ed25519:e.ed25519}:{ok:!0,walletId:r,authority:i,foundingAuthority:a.value,foundingAuthMethod:o,...c?{registrationDiagnostics:c}:{},...l,...d,authMethod:s.authMethod,kind:`near_ed25519`,authorityScope:e.authorityScope,accountProvisioning:e.accountProvisioning,resolvedAccount:e.resolvedAccount,ed25519:e.ed25519}}case`evm_family_ecdsa`:{if(n.authorityScope!==void 0||n.accountProvisioning!==void 0||n.resolvedAccount!==void 0||n.ed25519!==void 0)throw Error(`${t} response mixed signer branches`);let e=jt({value:n.ecdsa,walletId:r});return s.kind===`passkey`?{ok:!0,walletId:r,authority:i,foundingAuthority:a.value,foundingAuthMethod:o,...c?{registrationDiagnostics:c}:{},...l,...d,rpId:s.rpId,authMethod:s.authMethod,kind:`evm_family_ecdsa`,ecdsa:e}:{ok:!0,walletId:r,authority:i,foundingAuthority:a.value,foundingAuthMethod:o,...c?{registrationDiagnostics:c}:{},...l,...d,authMethod:s.authMethod,kind:`evm_family_ecdsa`,ecdsa:e}}default:throw Error(`${t} response has invalid kind`)}}const Pt=`/wallets/register/respond`,Ft=`/wallets/register/activate`,It=`/wallets/register/near-provisioning`,Lt=`X-Seams-Environment-Id`;function Rt(e){let t=[Pt];e.evmFamilyEcdsa&&t.push(Ft),e.nearEd25519&&(e.evmFamilyEcdsa&&t.push(`/wallets/register/near-admission`),t.push(Ze,It,ee,te)),ue(e.relayerUrl,t)}function zt(e){try{return new TextEncoder().encode(String(e||``)).length}catch{return String(e||``).length}}function Bt(){try{return globalThis.__SEAMS_REGISTRATION_BENCHMARK_DIAGNOSTICS===!0}catch{return!1}}function Vt(e){if(!(!e.value||typeof e.value!=`object`||Array.isArray(e.value))&&!(Object.keys(e.out).length>=64))for(let[t,n]of Object.entries(e.value)){if(Object.keys(e.out).length>=64)return;let r=e.path?`${e.path}.${t}`:t;typeof n==`string`?e.out[`${r}Bytes`]=zt(n):Array.isArray(n)?e.out[`${r}Count`]=n.length:e.depth>0&&n&&typeof n==`object`&&Vt({value:n,out:e.out,path:r,depth:e.depth-1})}}function Ht(e){let t={};return Vt({value:e,out:t,path:``,depth:2}),t}function Ut(e){try{return JSON.parse(e)}catch{return}}function I(e,t){if(!(typeof e!=`object`||!e||Array.isArray(e)))return Reflect.get(e,t)}async function Wt(e){try{return await e.text()}catch{return`{}`}}async function L(e){let t=Date.now(),n=JSON.stringify(e.body),r=await fetch(`${de(e.relayerUrl,{trim:!1})}${e.path}`,le({headers:{...e.headers,"X-Seams-Wallet-Protocol":`3`},body:e.body,bodyJson:n}));if(e.onServerTiming)try{e.onServerTiming(r.headers.get(`Server-Timing`))}catch{}let i=await Wt(r),a=Ut(i);if(Bt()&&console.info(`[Registration] wallet route payload summary`,{path:e.path,status:r.status,requestBytes:zt(n),requestSizeBreakdown:Ht(e.body),responseBytes:zt(i),responseSizeBreakdown:Ht(a),totalMs:Date.now()-t}),!r.ok||I(a,`ok`)===!1)throw Error(String(I(a,`message`)||I(a,`error`)||I(a,`code`)||`HTTP ${r.status}`));return a}const Gt=[`ok`,`walletId`,`nearAccountId`,`fundedAmountYocto`],Kt=[`transactionHash`,`message`],qt=[`ok`,`code`,`message`];function Jt(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be an object`);return e}function Yt(e,t,n,r){let i=new Set([...t,...n]),a=Object.keys(e);if(a.some(e=>!i.has(e)))throw Error(`${r} contains unexpected fields`);for(let e of t)if(!a.includes(e))throw Error(`${r}.${e} is required`)}function R(e,t){return Reflect.get(e,t)}function Xt(e,t){if(typeof e!=`string`||e.trim().length===0)throw Error(`${t} must be a non-empty string`);return e.trim()}function Zt(e,t){if(e!==void 0){if(typeof e!=`string`)throw Error(`${t} must be a string`);return e}}function Qt(e){let t=Jt(e,`fund implicit NEAR account response`),n=R(t,`ok`);if(n===!0){Yt(t,Gt,Kt,`fund implicit NEAR account success response`);let e=r(R(t,`walletId`));if(!e.ok)throw Error(`fund implicit NEAR account walletId is invalid`);let n=ge(R(t,`nearAccountId`));if(!n.ok)throw Error(`fund implicit NEAR account nearAccountId is invalid`);let i=Zt(R(t,`transactionHash`),`fund implicit NEAR account transactionHash`),a=Zt(R(t,`message`),`fund implicit NEAR account message`);return{ok:!0,walletId:e.value,nearAccountId:n.value,fundedAmountYocto:Xt(R(t,`fundedAmountYocto`),`fund implicit NEAR account fundedAmountYocto`),...i===void 0?{}:{transactionHash:i},...a===void 0?{}:{message:a}}}if(n===!1)return Yt(t,qt,[],`fund implicit NEAR account failure response`),{ok:!1,code:Xt(R(t,`code`),`fund implicit NEAR account code`),message:Xt(R(t,`message`),`fund implicit NEAR account message`)};throw Error(`fund implicit NEAR account response has an invalid ok discriminator`)}async function $t(e){let t=String(e.walletId||``).trim(),n=String(e.nearAccountId||``).trim(),r=String(e.nearPublicKeyStr||``).trim(),i=String(e.walletSessionToken||``).trim();if(!t)throw Error(`walletId is required for implicit NEAR account funding`);if(!n)throw Error(`nearAccountId is required for implicit NEAR account funding`);if(!r)throw Error(`nearPublicKeyStr is required for implicit NEAR account funding`);if(!i)throw Error(`walletSessionToken is required for implicit NEAR account funding`);return Qt(await L({relayerUrl:e.relayerUrl,path:`/wallets/${encodeURIComponent(t)}/near/implicit-account/fund`,headers:pe({token:i,missingMessage:`walletSessionToken is required for implicit NEAR account funding`}),body:{nearAccountId:n,nearPublicKeyStr:r}}))}function en(e){let t=String(e||``).trim();if(!t)throw Error(`Registration preparation id is required`);return t}const tn=[`formatVersion`,`walletId`,`evmFamilySigningKeySlotId`,`ecdsaThresholdKeyId`,`signingRootId`,`signingRootVersion`,`keyScope`,`relayerKeyId`,`registrationPreparationId`,`requestId`,`thresholdSessionId`,`ttlMs`,`remainingUses`,`participantIds`,`runtimePolicyScope`];function z(e){if(e.value===null||typeof e.value!=`object`||Array.isArray(e.value))throw Error(`${e.responseName} response missing ${e.field}`);return e.value}function B(e,t,n){if(!Object.keys(e).includes(t))throw Error(`${n} is missing ${t}`);return Reflect.get(e,t)}function V(e,t,n){if(Object.keys(e).includes(t))return Reflect.get(e,t)}function H(e,t,n){let r=new Set(t);for(let t of Object.keys(e))if(!r.has(t))throw Error(`${n} contains unexpected ${t}`)}function U(e,t){if(!Array.isArray(e))throw Error(`${t} must be an array`);return e}function nn(e,t){return Object.keys(e).includes(t)}function rn(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} must be a non-empty canonical string`);return e}function an(e,t,n){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<n)throw Error(`${t} must be a safe integer`);return e}function W(e,t,n){return rn(B(e,t,n),`${n}.${t}`)}function G(e,t,n){if(nn(e,t))return rn(B(e,t,n),`${n}.${t}`)}function K(e,t,n,r){return an(B(e,t,n),`${n}.${t}`,r)}function on(e,t){let n=U(e,t);if(n.length===0)throw Error(`${t} must not be empty`);let r=[];for(let e=0;e<n.length;e+=1)r.push(an(n[e],`${t}[${e}]`,1));return r}function sn(e,t){let n=on(e,t);if(n.length!==2||n[0]!==1||n[1]!==2)throw Error(`${t} must be [1, 2]`);return[1,2]}function cn(e,t,n=!1){if(e===void 0)return;let r=`${t} runtimePolicyScope`,i=z({responseName:r,field:`value`,value:e});H(i,[`orgId`,`projectId`,`envId`,`signingRootVersion`],r);let a=G(i,`signingRootVersion`,r);if(n&&a===void 0)throw Error(`${r}.signingRootVersion is required`);let o={orgId:W(i,`orgId`,r),projectId:W(i,`projectId`,r),envId:W(i,`envId`,r)};return a===void 0?o:{...o,signingRootVersion:a}}function ln(e,t){let n=cn(e,t,!0);if(!n||n.signingRootVersion===void 0)throw Error(`${t} runtimePolicyScope is invalid`);return{orgId:n.orgId,projectId:n.projectId,envId:n.envId,signingRootVersion:n.signingRootVersion}}function un(e){let t=`Wallet registration setup intent authMethod`,n=z({responseName:t,field:`value`,value:e});switch(W(n,`kind`,t)){case`passkey`:if(H(n,[`kind`,`rpId`,`authenticatorOptions`],t),!a(W(n,`rpId`,t)).ok)throw Error(`${t}.rpId is invalid`);if(!nn(n,`authenticatorOptions`))break;if(B(n,`authenticatorOptions`,t)===void 0)throw Error(`${t}.authenticatorOptions must be defined when present`);break;case`email_otp`:switch(W(n,`proofKind`,t)){case`otp_challenge`:H(n,[`kind`,`proofKind`,`email`,`providerSubject`,`otpCode`,`challengeId`],t),G(n,`challengeId`,t),W(n,`email`,t),W(n,`providerSubject`,t),W(n,`otpCode`,t);break;case`google_sso_registration`:H(n,[`kind`,`proofKind`,`email`,`providerSubject`,`googleEmailOtpRegistrationAttemptId`,`googleEmailOtpRegistrationOfferId`,`googleEmailOtpRegistrationCandidateId`],t),W(n,`email`,t),W(n,`providerSubject`,t),W(n,`googleEmailOtpRegistrationAttemptId`,t),W(n,`googleEmailOtpRegistrationOfferId`,t),W(n,`googleEmailOtpRegistrationCandidateId`,t);break;default:throw Error(`${t}.proofKind is invalid`)}break;default:throw Error(`${t}.kind is invalid`)}let r=_e(e);if(!r)throw Error(`${t} is invalid`);return r}function dn(e){let t=`Wallet registration setup intent accountProvisioning`,n=z({responseName:t,field:`value`,value:e}),r=W(n,`kind`,t);switch(r){case`implicit_account`:if(H(n,[`kind`,`accountIdSource`],t),W(n,`accountIdSource`,t)!==`ed25519_public_key`)throw Error(`${t}.accountIdSource is invalid`);return{kind:r,accountIdSource:`ed25519_public_key`};case`sponsored_named_account`:{if(H(n,[`kind`,`requestedAccountId`,`sponsor`],t),W(n,`sponsor`,t)!==`relayer`)throw Error(`${t}.sponsor is invalid`);let e=me(W(n,`requestedAccountId`,t));if(!e.ok)throw Error(`${t}.requestedAccountId is invalid`);return{kind:r,requestedAccountId:e.value,sponsor:`relayer`}}default:throw Error(`${t}.kind is invalid`)}}function q(e,t){switch(e.kind){case`evm`:return t.kind===`evm`&&e.namespace===t.namespace&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;case`tempo`:return t.kind===`tempo`&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;default:return fn(e)}}function fn(e){throw Error(`Unsupported wallet registration setup chain target: ${String(e)}`)}function J(e,t){let n=z({responseName:t,field:`chainTarget`,value:e}),r=W(n,`kind`,t);switch(r){case`evm`:{if(H(n,[`kind`,`namespace`,`chainId`,`networkSlug`],t),W(n,`namespace`,t)!==`eip155`)throw Error(`${t}.namespace is invalid`);let e=K(n,`chainId`,t,1),i=G(n,`networkSlug`,t);return i===void 0?{kind:r,namespace:`eip155`,chainId:e}:{kind:r,namespace:`eip155`,chainId:e,networkSlug:i}}case`tempo`:{H(n,[`kind`,`chainId`,`networkSlug`],t);let e=K(n,`chainId`,t,1),i=G(n,`networkSlug`,t);return i===void 0?{kind:r,chainId:e}:{kind:r,chainId:e,networkSlug:i}}default:throw Error(`${t}.kind is invalid`)}}function pn(e){try{return J(e,`Wallet registration setup intent`)}catch{return null}}function mn(e){let t=`Wallet registration setup intent signer`,n=z({responseName:t,field:`value`,value:e}),r=W(n,`kind`,t);switch(r){case`near_ed25519`:if(H(n,[`kind`,`accountProvisioning`,`signerSlot`,`participantIds`,`derivationVersion`],t),K(n,`derivationVersion`,t,1)!==1)throw Error(`${t}.derivationVersion is invalid`);return{kind:r,accountProvisioning:dn(B(n,`accountProvisioning`,t)),signerSlot:K(n,`signerSlot`,t,1),participantIds:on(B(n,`participantIds`,t),`${t}.participantIds`),derivationVersion:1};case`evm_family_ecdsa`:{H(n,[`kind`,`participantIds`,`chainTargets`],t);let e=U(B(n,`chainTargets`,t),`${t}.chainTargets`);if(e.length===0)throw Error(`${t}.chainTargets must not be empty`);let i=[];for(let n of e){let e=J(n,`${t}.chainTargets`);if(i.some(t=>q(t,e)))throw Error(`${t}.chainTargets contains a duplicate target`);i.push(e)}return{kind:r,participantIds:on(B(n,`participantIds`,t),`${t}.participantIds`),chainTargets:i}}default:throw Error(`${t}.kind is invalid`)}}function hn(e){let t=`Wallet registration setup intent signerSelection`,n=z({responseName:t,field:`value`,value:e});if(H(n,[`kind`,`signers`],t),W(n,`kind`,t)!==`signer_set`)throw Error(`${t}.kind is invalid`);let r=U(B(n,`signers`,t),`${t}.signers`);if(r.length===0)throw Error(`${t}.signers must not be empty`);let i=[];for(let e of r)i.push(mn(e));return{kind:`signer_set`,signers:i}}function gn(e){let t=`Wallet registration setup intent`,n=z({responseName:t,field:`intent`,value:e});if(H(n,[`version`,`walletId`,`authMethod`,`signerSelection`,`foundingWalletAuthMethodId`,`runtimePolicyScope`,`nonceB64u`],t),W(n,`version`,t)!==`registration_intent_v1`)throw Error(`${t}.version is invalid`);let a=r(W(n,`walletId`,t));if(!a.ok)throw Error(`${t}.walletId is invalid`);let o=i(W(n,`foundingWalletAuthMethodId`,t));if(!o.ok)throw Error(`${t}.foundingWalletAuthMethodId is invalid`);let s=un(B(n,`authMethod`,t)),c=hn(B(n,`signerSelection`,t)),l=cn(V(n,`runtimePolicyScope`,t),t),u=W(n,`nonceB64u`,t);return l===void 0?{version:`registration_intent_v1`,walletId:a.value,authMethod:s,signerSelection:c,foundingWalletAuthMethodId:o.value,nonceB64u:u}:{version:`registration_intent_v1`,walletId:a.value,authMethod:s,signerSelection:c,foundingWalletAuthMethodId:o.value,runtimePolicyScope:l,nonceB64u:u}}function _n(e){let t=`Wallet add-signer ECDSA derivation`,n=z({responseName:t,field:`response`,value:e});if(H(n,[`ok`,`addSignerCeremonyId`,`ecdsa`],`${t} response`),B(n,`ok`,`${t} response`)!==!0)throw Error(`${t} response is not successful`);let r=z({responseName:t,field:`ecdsa`,value:B(n,`ecdsa`,`${t} response`)});if(H(r,[`kind`,`strictResult`],`${t} response ecdsa`),B(r,`kind`,`${t} response ecdsa`)!==`router_ab_ecdsa_registration_forwarded_v1`)throw Error(`${t} response kind is invalid`);return{ok:!0,addSignerCeremonyId:A({responseName:t,field:`addSignerCeremonyId`,value:B(n,`addSignerCeremonyId`,t)}),ecdsa:{kind:`router_ab_ecdsa_registration_forwarded_v1`,strictResult:We(B(r,`strictResult`,`${t} response ecdsa`))}}}function vn(e){let t=`Wallet add-signer ECDSA activation`,n=z({responseName:t,field:`response`,value:e});if(H(n,[`ok`,`addSignerCeremonyId`,`ecdsa`],`${t} response`),B(n,`ok`,`${t} response`)!==!0)throw Error(`${t} response is not successful`);let r=z({responseName:t,field:`ecdsa`,value:B(n,`ecdsa`,`${t} response`)});if(H(r,[`kind`,`activation`,`bootstrap`],`${t} response ecdsa`),B(r,`kind`,`${t} response ecdsa`)!==`router_ab_ecdsa_registration_activated_v1`)throw Error(`${t} response kind is invalid`);return{ok:!0,addSignerCeremonyId:A({responseName:t,field:`addSignerCeremonyId`,value:B(n,`addSignerCeremonyId`,t)}),ecdsa:{kind:`router_ab_ecdsa_registration_activated_v1`,activation:Ke(B(r,`activation`,`${t} response ecdsa`)),bootstrap:nt(B(r,`bootstrap`,`${t} response ecdsa`))}}}function yn(e){return e.authMethod.kind===`email_otp`}function bn(e){let t=`Wallet add-auth-method intent`,n=z({responseName:t,field:`body`,value:e});if(H(n,[`ok`,`intent`,`addAuthMethodIntentDigestB64u`,`addAuthMethodIntentGrant`,`expiresAtMs`],t),B(n,`ok`,t)!==!0)throw Error(`${t} response is not successful`);let r=Ee(B(n,`intent`,t)),i;try{i=ce(B(n,`addAuthMethodIntentDigestB64u`,t))}catch{throw Error(`${t} response has invalid addAuthMethodIntentDigestB64u`)}let a=B(n,`addAuthMethodIntentGrant`,t);if(typeof a!=`string`||!a.trim())throw Error(`${t} response is missing addAuthMethodIntentGrant`);return{ok:!0,intent:r,addAuthMethodIntentDigestB64u:i,addAuthMethodIntentGrant:Ne(a),expiresAtMs:N({responseName:t,field:`expiresAtMs`,value:B(n,`expiresAtMs`,t),minimum:1})}}function xn(e){let t=`Wallet add-signer intent`,n=z({responseName:t,field:`body`,value:e});if(H(n,[`ok`,`intent`,`addSignerIntentDigestB64u`,`addSignerIntentGrant`,`expiresAtMs`],t),B(n,`ok`,t)!==!0)throw Error(`${t} response is not successful`);let r=je(B(n,`intent`,t)),i;try{i=ce(B(n,`addSignerIntentDigestB64u`,t))}catch{throw Error(`${t} response has invalid addSignerIntentDigestB64u`)}let a=B(n,`addSignerIntentGrant`,t);if(typeof a!=`string`||!a.trim())throw Error(`${t} response is missing addSignerIntentGrant`);return{ok:!0,intent:r,addSignerIntentDigestB64u:i,addSignerIntentGrant:Ae(a),expiresAtMs:N({responseName:t,field:`expiresAtMs`,value:B(n,`expiresAtMs`,t),minimum:1})}}function Sn(e){let n=`Wallet add-auth-method finalize`,i=z({responseName:n,field:`body`,value:e});if(B(i,`ok`,n)!==!0)throw Error(`${n} response is not successful`);let o=z({responseName:n,field:`authMethod`,value:B(i,`authMethod`,n)}),s=B(o,`kind`,`${n} authMethod`);if(s!==`passkey`&&s!==`email_otp`)throw Error(`${n} response has invalid authMethod kind`);let c=r(B(i,`walletId`,n));if(!c.ok)throw Error(`${n} response has invalid walletId`);let l=Le(B(i,`authority`,n));if(!l)throw Error(`${n} response has invalid authority`);if(l.walletId!==c.value)throw Error(`${n} response authority wallet mismatch`);if(s===`passkey`){if(H(i,[`ok`,`walletId`,`authority`,`rpId`,`authMethod`],n),H(o,[`kind`,`status`,`credentialIdB64u`,`credentialPublicKeyB64u`,`counter`,`device`],`${n} authMethod`),B(o,`status`,n)!==`active`)throw Error(`${n} response has invalid authMethod status`);if(l.factor.kind!==`passkey`||l.verifier.kind!==`webauthn`)throw Error(`${n} response has inconsistent passkey authority`);let e=a(B(i,`rpId`,n));if(!e.ok)throw Error(`${n} response has invalid rpId`);let r=t(B(o,`credentialIdB64u`,n));if(!r.ok)throw Error(`${n} response has invalid credentialIdB64u`);let s=B(o,`credentialPublicKeyB64u`,n);if(typeof s!=`string`||!s.trim())throw Error(`${n} response is missing credentialPublicKeyB64u`);let u=B(o,`counter`,n);if(typeof u!=`number`||!Number.isSafeInteger(u)||u<0)throw Error(`${n} response has invalid counter`);let d=Te(B(o,`device`,n));if(!d)throw Error(`${n} response has invalid device`);if(l.factor.credentialIdB64u!==r.value||l.verifier.rpId!==e.value)throw Error(`${n} response passkey authority binding mismatch`);return{ok:!0,walletId:c.value,authority:l,rpId:e.value,authMethod:{kind:`passkey`,status:`active`,credentialIdB64u:r.value,credentialPublicKeyB64u:s.trim(),counter:u,device:d}}}if(H(i,[`ok`,`walletId`,`authority`,`authMethod`],n),H(o,[`kind`,`status`],`${n} authMethod`),B(o,`status`,n)!==`active`)throw Error(`${n} response has invalid authMethod status`);if(l.factor.kind!==`email_otp`||l.verifier.kind!==`email_otp_wallet_auth_method`)throw Error(`${n} response has inconsistent email OTP authority`);return{ok:!0,walletId:c.value,authority:l,authMethod:{kind:`email_otp`,status:`active`}}}function Cn(e){let t=`Wallet add-auth-method start`,n=z({responseName:t,field:`body`,value:e.value});if(B(n,`ok`,t)!==!0)throw Error(`${t} response is not successful`);let r=A({responseName:t,field:`addAuthMethodCeremonyId`,value:B(n,`addAuthMethodCeremonyId`,t)}),i=Tn(B(n,`intent`,t),e.expectedIntent);return e.expectedIntent.authMethod.kind===`email_otp`?(H(n,[`ok`,`addAuthMethodCeremonyId`,`intent`,`custodyEnvelope`,`addAuthMethodCeremonyExpiresAtMs`],t),{ok:!0,addAuthMethodCeremonyId:r,intent:i,custodyEnvelope:w(B(n,`custodyEnvelope`,t)),addAuthMethodCeremonyExpiresAtMs:N({responseName:t,field:`addAuthMethodCeremonyExpiresAtMs`,value:B(n,`addAuthMethodCeremonyExpiresAtMs`,t),minimum:1})}):(H(n,[`ok`,`addAuthMethodCeremonyId`,`intent`,`custodyEnvelope`,`registration`,`addAuthMethodCeremonyExpiresAtMs`],t),{ok:!0,addAuthMethodCeremonyId:r,intent:i,custodyEnvelope:w(B(n,`custodyEnvelope`,t)),registration:ke(B(n,`registration`,t)),addAuthMethodCeremonyExpiresAtMs:N({responseName:t,field:`addAuthMethodCeremonyExpiresAtMs`,value:B(n,`addAuthMethodCeremonyExpiresAtMs`,t),minimum:1})})}function wn(e,t){try{if(!De(je(e),t))throw Error(`intent mismatch`)}catch{throw Error(`Wallet add-signer start response changed the admitted intent`)}return t}function Tn(e,t){try{if(!Me(Ee(e),t))throw Error(`intent mismatch`)}catch{throw Error(`Wallet add-auth-method start response changed the admitted intent`)}return t}function En(e,t){let n=z({responseName:t,field:`ecdsa.prepare`,value:e});if(H(n,tn,t),B(n,`formatVersion`,t)!==`ecdsa-derivation-role-local`||B(n,`keyScope`,t)!==`evm-family`)throw Error(`${t} response has invalid prepare discriminator`);let r=h(B(n,`runtimePolicyScope`,t));if(!r)throw Error(`${t} response has invalid runtimePolicyScope`);return{formatVersion:`ecdsa-derivation-role-local`,walletId:A({responseName:t,field:`prepare.walletId`,value:B(n,`walletId`,t)}),evmFamilySigningKeySlotId:A({responseName:t,field:`prepare.evmFamilySigningKeySlotId`,value:B(n,`evmFamilySigningKeySlotId`,t)}),ecdsaThresholdKeyId:A({responseName:t,field:`prepare.ecdsaThresholdKeyId`,value:B(n,`ecdsaThresholdKeyId`,t)}),signingRootId:A({responseName:t,field:`prepare.signingRootId`,value:B(n,`signingRootId`,t)}),signingRootVersion:A({responseName:t,field:`prepare.signingRootVersion`,value:B(n,`signingRootVersion`,t)}),keyScope:`evm-family`,relayerKeyId:A({responseName:t,field:`prepare.relayerKeyId`,value:B(n,`relayerKeyId`,t)}),registrationPreparationId:en(A({responseName:t,field:`prepare.registrationPreparationId`,value:B(n,`registrationPreparationId`,t)})),requestId:A({responseName:t,field:`prepare.requestId`,value:B(n,`requestId`,t)}),thresholdSessionId:A({responseName:t,field:`prepare.thresholdSessionId`,value:B(n,`thresholdSessionId`,t)}),ttlMs:N({responseName:t,field:`prepare.ttlMs`,value:B(n,`ttlMs`,t),minimum:1}),remainingUses:N({responseName:t,field:`prepare.remainingUses`,value:B(n,`remainingUses`,t),minimum:0}),participantIds:[...P(B(n,`participantIds`,t),t)],runtimePolicyScope:r}}function Dn(e,t){let n=z({responseName:t,field:`ecdsa.prepare`,value:e});if(H(n,tn,t),B(n,`formatVersion`,t)!==`ecdsa-derivation-role-local`||B(n,`keyScope`,t)!==`evm-family`)throw Error(`${t} response has invalid prepare discriminator`);for(let e of[`walletId`,`evmFamilySigningKeySlotId`,`ecdsaThresholdKeyId`,`signingRootId`,`signingRootVersion`,`relayerKeyId`,`registrationPreparationId`,`requestId`,`thresholdSessionId`])W(n,e,t);K(n,`ttlMs`,t,1),K(n,`remainingUses`,t,0),sn(B(n,`participantIds`,t),`${t}.participantIds`),ln(B(n,`runtimePolicyScope`,t),t)}function On(e){let t=`Wallet registration setup ECDSA`,n=z({responseName:t,field:`ecdsa`,value:e});if(H(n,[`kind`,`chainTargets`,`prepare`,`strictRegistration`],t),B(n,`kind`,t)!==`evm_family_ecdsa_keygen`)throw Error(`${t} response has an invalid kind`);let r=B(n,`chainTargets`,t);if(!Array.isArray(r)||r.length===0)throw Error(`${t} response has invalid chainTargets`);let i=[];for(let e of r){let n=J(e,`${t}.chainTargets`);if(i.some(e=>q(e,n)))throw Error(`${t} response has duplicate chainTargets`);i.push(n)}let[a,...o]=i;if(!a)throw Error(`${t} response has invalid chainTargets`);let s=B(n,`prepare`,t);Dn(s,t);let c=En(s,t),l=Ye(B(n,`strictRegistration`,t));if(l.registration_purpose!==`wallet_registration`)throw Error(`${t} response has an invalid registration purpose`);return{kind:`evm_family_ecdsa_keygen`,chainTargets:[a,...o],prepare:c,strictRegistration:l}}function kn(e){let t=!1,n=!1;for(let r of e.signerSelection.signers)switch(r.kind){case`near_ed25519`:t=!0;break;case`evm_family_ecdsa`:n=!0;break;default:return An(r)}if(t&&n)return`near_ed25519_and_evm_family_ecdsa`;if(n)return`evm_family_ecdsa`;if(t)return`near_ed25519`;throw Error(`Wallet registration setup intent has no signer branch`)}function An(e){throw Error(`Unsupported wallet registration setup signer: ${String(e)}`)}function jn(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function Mn(e,t){return e!==void 0&&e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}function Nn(e,t){try{return q(J(e,`Wallet registration setup intent`),t)}catch{return!1}}function Pn(e){let t=e.intent.signerSelection.signers.find(e=>e.kind===`evm_family_ecdsa`);if(!t)throw Error(`${e.responseName} response has no ECDSA intent branch`);if(t.chainTargets.length!==e.ecdsa.chainTargets.length||t.chainTargets.some((t,n)=>!Nn(t,e.ecdsa.chainTargets[n])))throw Error(`${e.responseName} response ECDSA chainTargets do not match intent`);if(!jn(t.participantIds,e.ecdsa.prepare.participantIds))throw Error(`${e.responseName} response ECDSA participantIds do not match intent`);if(e.ecdsa.prepare.walletId!==String(e.walletId))throw Error(`${e.responseName} response ECDSA prepare walletId does not match response`);if(!Mn(e.intent.runtimePolicyScope,e.ecdsa.prepare.runtimePolicyScope))throw Error(`${e.responseName} response ECDSA runtimePolicyScope does not match intent`);let n=e.ecdsa.strictRegistration.lifecycle;if(n.lifecycle_id!==e.registrationCeremonyId||n.account_id!==String(e.walletId)||e.ecdsa.strictRegistration.client_id!==String(e.walletId))throw Error(`${e.responseName} response ECDSA identities do not match response`)}function Fn(e){let t=`Wallet registration setup`,n=z({responseName:t,field:`body`,value:e});if(B(n,`ok`,t)!==!0)throw Error(`${t} response is not successful`);let a=B(n,`kind`,t);if(a!==`near_ed25519`&&a!==`evm_family_ecdsa`&&a!==`near_ed25519_and_evm_family_ecdsa`)throw Error(`${t} response kind is invalid`);let o=a!==`near_ed25519`;H(n,[`ok`,`registrationCeremonyId`,`walletId`,`walletAuthMethodId`,`registrationIntentDigestB64u`,`intent`,`signedSetup`,`home`,`kind`,...o?[`ecdsa`]:[]],t);let s=W(n,`registrationCeremonyId`,t),c=r(W(n,`walletId`,t));if(!c.ok)throw Error(`${t} response has an invalid walletId`);let l=i(W(n,`walletAuthMethodId`,t));if(!l.ok)throw Error(`${t} response has an invalid walletAuthMethodId`);let u=gn(B(n,`intent`,t));if(u.walletId!==c.value)throw Error(`${t} response walletId does not match intent`);if(u.foundingWalletAuthMethodId!==l.value)throw Error(`${t} response walletAuthMethodId does not match intent`);let d;try{d=ce(B(n,`registrationIntentDigestB64u`,t))}catch{throw Error(`${t} response has an invalid registrationIntentDigestB64u`)}let f=ie(B(n,`home`,t)),p=B(n,`signedSetup`,t);if(typeof p!=`string`||!p.trim())throw Error(`${t} response missing signedSetup`);if(!o){if(kn(u)!==a)throw Error(`${t} response kind does not match intent`);return{ok:!0,registrationCeremonyId:s,walletId:c.value,walletAuthMethodId:l.value,registrationIntentDigestB64u:d,intent:u,signedSetup:p,home:f,kind:`near_ed25519`}}let m=On(B(n,`ecdsa`,t));if(kn(u)!==a)throw Error(`${t} response kind does not match intent`);return Pn({responseName:t,registrationCeremonyId:s,walletId:c.value,intent:u,ecdsa:m}),{ok:!0,registrationCeremonyId:s,walletId:c.value,walletAuthMethodId:l.value,registrationIntentDigestB64u:d,intent:u,signedSetup:p,home:f,kind:a,ecdsa:m}}function In(e){let t=_e(e.authMethod);if(!t)throw Error(`Wallet registration setup request authMethod is invalid`);let n=ve(e.signerSelection);if(!n.ok)throw Error(`Wallet registration setup request signerSelection is invalid: ${n.message}`);let r=ye(n.value,{normalizeEcdsaChainTarget:pn});if(!r.ok)throw Error(`Wallet registration setup request signerSelection is invalid: ${r.message}`);return{wallet:e.wallet??{kind:`server_allocated`},authMethod:t,signerSelection:r.value}}function Ln(e,t){let n={version:`registration_intent_v1`,walletId:e.walletId,authMethod:t.authMethod,signerSelection:t.signerSelection,foundingWalletAuthMethodId:e.foundingWalletAuthMethodId,nonceB64u:e.nonceB64u};return e.runtimePolicyScope===void 0?n:{...n,runtimePolicyScope:e.runtimePolicyScope}}async function Rn(e){if(e.requestedWallet?.kind===`provided`&&String(e.requestedWallet.walletId)!==e.response.walletId)throw Error(`Wallet registration setup response walletId does not match request`);if(await Oe(e.response.intent)!==e.response.registrationIntentDigestB64u)throw Error(`Wallet registration setup response digest does not match intent`);if(await Oe(Ln(e.response.intent,e.request))!==e.response.registrationIntentDigestB64u)throw Error(`Wallet registration setup response intent does not match request`)}function zn(e,t){let n=`Wallet add-signer ECDSA start`,r=z({responseName:n,field:`ecdsa`,value:e});H(r,[`kind`,`chainTargets`,`prepare`,`strictRegistration`,`custodyEnvelope`],n);let i=B(r,`kind`,n),a=B(r,`chainTargets`,n);if(i!==`evm_family_ecdsa_keygen`||!Array.isArray(a))throw Error(`${n} response has invalid payload`);if(t.signerSelection.mode!==`ecdsa`)throw Error(`${n} response substituted signer branch`);let o=t.signerSelection.ecdsa.chainTargets;if(a.length!==o.length)throw Error(`${n} response changed target count`);let s=[];for(let e=0;e<a.length;e+=1){let t=a[e],r=Ct(t,n),i=o[e];if(!i||!Se(r,Ct(i,n)))throw Error(`${n} response changed chainTarget`);s.push(r)}let[c,...l]=s;if(!c)throw Error(`${n} response requires an EVM-family target`);let u=En(B(r,`prepare`,n),n),d=Ye(B(r,`strictRegistration`,n));if(d.registration_purpose!==`wallet_add_signer`)throw Error(`${n} response has invalid registration purpose`);return{kind:`evm_family_ecdsa_keygen`,chainTargets:[c,...l],prepare:u,strictRegistration:d}}function Bn(e){let t=`Wallet add-signer start`,n=z({responseName:t,field:`body`,value:e.value});if(H(n,[`ok`,`addSignerCeremonyId`,`intent`,`authorizationKind`,`kind`,`ed25519`,`ecdsa`],t),B(n,`ok`,t)!==!0)throw Error(`${t} response is not successful`);let r=A({responseName:t,field:`addSignerCeremonyId`,value:B(n,`addSignerCeremonyId`,t)}),i=wn(B(n,`intent`,t),e.expectedIntent),a=B(n,`authorizationKind`,t);if(a!==`webauthn_assertion`)throw Error(`${t} response has invalid authorization kind`);switch(B(n,`kind`,t)){case`near_ed25519`:{if(a!==`webauthn_assertion`||i.signerSelection.mode!==`ed25519`||V(n,`ecdsa`,t)!==void 0)throw Error(`${t} response substituted signer branch`);let e=z({responseName:t,field:`ed25519`,value:B(n,`ed25519`,t)});H(e,[`admissionRequest`,`custodyEnvelope`],t);let o=S(B(e,`admissionRequest`,t));if(!o.ok)throw Error(o.message);return{ok:!0,addSignerCeremonyId:r,intent:i,authorizationKind:`webauthn_assertion`,kind:`near_ed25519`,ed25519:{admissionRequest:o.value,custodyEnvelope:w(B(e,`custodyEnvelope`,t))}}}case`evm_family_ecdsa`:{if(i.signerSelection.mode!==`ecdsa`||V(n,`ed25519`,t)!==void 0)throw Error(`${t} response substituted signer branch`);let e=B(n,`ecdsa`,t),a=zn(e,i),o=z({responseName:t,field:`ecdsa`,value:e});return{ok:!0,addSignerCeremonyId:r,intent:i,authorizationKind:`webauthn_assertion`,kind:`evm_family_ecdsa`,ecdsa:{...a,custodyEnvelope:w(B(o,`custodyEnvelope`,t))}}}default:throw Error(`${t} response has invalid kind`)}}function Vn(e){let t=`Wallet add-signer finalize`,n=z({responseName:t,field:`body`,value:e.value});H(n,[`ok`,`walletId`,`kind`,`rpId`,`credentialIdB64u`,`ed25519`,`ecdsa`,`authority`],t);let r=B(n,`ok`,t),i=B(n,`kind`,t);if(r!==!0||i!==e.expectedKind)throw Error(`${t} response substituted signer branch`);let a=et(A({responseName:t,field:`walletId`,value:B(n,`walletId`,t)})),o=F(B(n,`rpId`,t),t);switch(i){case`near_ed25519`:{if(V(n,`ecdsa`,t)!==void 0||V(n,`authority`,t)!==void 0)throw Error(`${t} response mixed signer branches`);let e=xt(B(n,`ed25519`,t),`Wallet add-signer Ed25519 finalize`);return{ok:!0,walletId:a,kind:`near_ed25519`,rpId:o,credentialIdB64u:A({responseName:t,field:`credentialIdB64u`,value:B(n,`credentialIdB64u`,t)}),ed25519:e}}case`evm_family_ecdsa`:{if(V(n,`ed25519`,t)!==void 0||V(n,`credentialIdB64u`,t)!==void 0)throw Error(`${t} response mixed signer branches`);let e=z({responseName:t,field:`ecdsa`,value:B(n,`ecdsa`,t)});H(e,[`walletKeys`],t);let r=U(B(e,`walletKeys`,t),`${t} walletKeys`);if(r.length===0)throw Error(`${t} response has invalid walletKeys`);let i=Ie(B(n,`authority`,t));if(!i.ok||i.value.state!==`active`||i.value.walletId!==a)throw Error(`${t} response has invalid authority`);return{ok:!0,walletId:a,kind:`evm_family_ecdsa`,rpId:o,ecdsa:{walletKeys:r.map(Hn)},authority:i.value}}default:throw Error(`${t} response has invalid kind`)}}function Hn(e){return wt(e,`Wallet add-signer ECDSA finalize`)}function Y(e){let t=String(e.expected||``).trim(),n=String(e.actual||``).trim();if(!t||!n)throw Error(`ECDSA registration bootstrap returned incomplete ${e.field}`);if(t!==n)throw Error(`ECDSA registration bootstrap ${e.field} mismatch`);return n}function Un(e){let t=e.expected.map(e=>Math.floor(Number(e))),n=e.actual.map(e=>Math.floor(Number(e)));if(t.length===0||n.length===0||t.some(e=>!Number.isSafeInteger(e)||e<=0)||n.some(e=>!Number.isSafeInteger(e)||e<=0))throw Error(`ECDSA registration bootstrap returned incomplete participantIds`);if(t.length!==n.length||t.some((e,t)=>e!==n[t]))throw Error(`ECDSA registration bootstrap participantIds mismatch`);return n}function Wn(e){let t=e.clientBootstrap,n=e.serverBootstrap;Y({field:`derivationClientSharePublicKey33B64u`,expected:t.derivationClientSharePublicKey33B64u,actual:n.publicIdentity.derivationClientSharePublicKey33B64u});let r=Y({field:`contextBinding32B64u`,expected:t.contextBinding32B64u,actual:n.contextBinding32B64u}),i=Y({field:`walletId`,expected:t.walletId,actual:n.walletId}),a=Y({field:`evmFamilySigningKeySlotId`,expected:t.evmFamilySigningKeySlotId,actual:n.evmFamilySigningKeySlotId});Y({field:`activationEpoch`,expected:e.activationEpoch,actual:n.activationEpoch});let o=Un({expected:t.participantIds,actual:n.participantIds}),s=qe(n.routerAbEcdsaDerivationNormalSigning),c=String(n.ecdsaThresholdKeyId||``).trim(),l=String(n.keyHandle||``).trim(),u=String(n.signingRootId||``).trim(),d=String(n.signingRootVersion||``).trim(),f=String(n.applicationBindingDigestB64u||``).trim(),p=String(n.thresholdEcdsaPublicKeyB64u||``).trim(),m=String(n.ethereumAddress||``).trim(),h=String(n.relayerKeyId||``).trim(),g=String(n.relayerVerifyingShareB64u||``).trim(),_=Math.floor(Number(n.relayerShareRetryCounter));if(!i||!a||!l||!c||!u||!d||!f||!p||!m||!h||!g||!Number.isSafeInteger(_)||_<0||!o.length||o.some(e=>!Number.isSafeInteger(e)||e<=0))throw Error(`ECDSA registration bootstrap returned incomplete session material`);return{walletId:i,evmFamilySigningKeySlotId:a,ecdsaThresholdKeyId:c,relayerKeyId:h,applicationBindingDigestB64u:f,contextBinding32B64u:r,publicIdentity:n.publicIdentity,relayerShareRetryCounter:_,keyHandle:l,signingRootId:u,signingRootVersion:d,thresholdEcdsaPublicKeyB64u:p,ethereumAddress:m,relayerVerifyingShareB64u:g,participantIds:o,routerAbEcdsaDerivationNormalSigning:s}}function Gn(e){let t=`Wallet ECDSA key-facts inventory`,n=z({responseName:t,field:`body`,value:e.value});if(H(n,[`ok`,`ecdsaKeyIdentityTargets`,`diagnostics`],t),B(n,`ok`,t)!==!0)throw Error(`${t} response is not successful`);let r=U(B(n,`ecdsaKeyIdentityTargets`,t),`${t} ecdsaKeyIdentityTargets`);return{ok:!0,records:yt({walletId:e.walletId,rpId:e.rpId,records:r}),diagnostics:B(n,`diagnostics`,t)}}async function Kn(e){let t=String(e.auth?.publishableKey||``).trim(),n=String(e.auth?.environmentId||``).trim();if(!t||!n)return{ok:!1,code:`invalid_body`,message:`registration setup requires a publishable key and environment id`};let r=In(e.request),i=await Fe({relayerUrl:e.relayerUrl,publishableKey:t,environmentId:n}),a=await Pe.begin(i,r),o=Fn(await L({relayerUrl:e.relayerUrl,path:`/wallets/register/setup`,headers:{...e.headers,Authorization:`Bearer ${t}`,[Lt]:n},body:{registrationOperationId:a.operationId,wallet:r.wallet,signerSelection:r.signerSelection,authMethod:r.authMethod},...e.onServerTiming?{onServerTiming:e.onServerTiming}:{}}));return o.ok?(await Rn({response:o,...e.request.wallet?{requestedWallet:e.request.wallet}:{},request:r}),await Pe.accept(a,o),o):o}async function qn(e){let t=String(e.walletId||``).trim();if(!t)throw Error(`walletId is required for add-signer intent`);let n=String(e.auth.publishableKey||``).trim(),r=String(e.auth.environmentId||``).trim();if(!n||!r)throw Error(`add-signer intent requires a publishable key and environment id`);return xn(await L({relayerUrl:e.relayerUrl,path:`/wallets/${encodeURIComponent(t)}/signers/intent`,headers:{Authorization:`Bearer ${n}`,[Lt]:r},body:e.request}))}function Jn(e){let t=`Wallet auth-method revoke`,n=z({responseName:t,field:`body`,value:e});if(B(n,`ok`,t)!==!0)throw Error(`${t} response is not successful`);let i=r(B(n,`walletId`,t));if(!i.ok)throw Error(`${t} response has invalid walletId`);let a=z({responseName:t,field:`authMethod`,value:B(n,`authMethod`,t)});if(H(a,[`kind`,`status`],`${t} response authMethod`),B(a,`status`,t)!==`revoked`)throw Error(`${t} response has invalid authMethod status`);switch(B(a,`kind`,t)){case`passkey`:return H(n,[`ok`,`walletId`,`authMethod`,`rpId`],t),{ok:!0,walletId:i.value,authMethod:{kind:`passkey`,status:`revoked`},rpId:F(B(n,`rpId`,t),t)};case`email_otp`:return H(n,[`ok`,`walletId`,`authMethod`],t),{ok:!0,walletId:i.value,authMethod:{kind:`email_otp`,status:`revoked`}};default:throw Error(`${t} response has invalid authMethod kind`)}}async function Yn(e){let t=String(e.walletId||``).trim(),n=String(e.walletAuthMethodId||``).trim();if(!t||!n)throw Error(`auth-method revoke requires a wallet and a target method`);let r={relayerUrl:e.relayerUrl,path:`/wallets/${encodeURIComponent(t)}/auth-methods/${encodeURIComponent(n)}/revoke`,body:{walletId:t,walletAuthMethodId:n,requestedAtMs:e.requestedAtMs,sourceProof:e.sourceProof}},i;try{i=await L(r)}catch(e){if(!(e instanceof TypeError))throw e;i=await L(r)}return Jn(i)}async function Xn(e){let t=String(e.walletId||``).trim();if(!t)throw Error(`walletId is required for add-auth-method intent`);let n=String(e.auth.publishableKey||``).trim(),r=String(e.auth.environmentId||``).trim();if(!n||!r)throw Error(`add-auth-method intent requires a publishable key and environment id`);let i=e.request.caller.caller===`same_device_addition`?{caller:`same_device_addition`,source:e.request.caller.source}:{caller:`linked_device_ceremony`};return bn(await L({relayerUrl:e.relayerUrl,path:`/wallets/${encodeURIComponent(t)}/auth-methods/intent`,headers:{Authorization:`Bearer ${n}`,[Lt]:r},body:{walletId:e.request.walletId,rpId:e.request.rpId,authMethod:e.request.authMethod,...i}}))}function Zn(e){let t=`Wallet registration respond`,n=z({responseName:t,field:`body`,value:e});if(B(n,`ok`,t)!==!0)throw Error(`${t} response is not successful`);let r=A({responseName:t,field:`registrationCeremonyId`,value:B(n,`registrationCeremonyId`,t)}),i=B(n,`kind`,t);if(i!==`evm_family_ecdsa`&&i!==`near_ed25519_and_evm_family_ecdsa`&&i!==`near_ed25519`)throw Error(`${t} response kind is invalid`);let a=i!==`near_ed25519`,o=i!==`evm_family_ecdsa`;H(n,[`ok`,`registrationCeremonyId`,`kind`,...a?[`ecdsa`]:[],...o?[`ed25519`]:[]],t);let s=V(n,`ed25519`,t);if(o&&s===void 0)throw Error(`${t} signer plan is missing its ed25519 deferred work`);if(!a)return{ok:!0,registrationCeremonyId:r,kind:`near_ed25519`,ed25519:Qn(s)};let c=z({responseName:t,field:`ecdsa`,value:B(n,`ecdsa`,t)});if(H(c,[`kind`,`strictResult`],`${t} ecdsa`),B(c,`kind`,`${t} ecdsa`)!==`router_ab_ecdsa_registration_forwarded_v1`)throw Error(`${t} ecdsa kind is invalid`);let l=o?$n(s):null,u={kind:`router_ab_ecdsa_registration_forwarded_v1`,strictResult:We(B(c,`strictResult`,`${t} ecdsa`))};return l?{ok:!0,registrationCeremonyId:r,kind:`near_ed25519_and_evm_family_ecdsa`,ecdsa:u,ed25519:l}:{ok:!0,registrationCeremonyId:r,kind:`evm_family_ecdsa`,ecdsa:u}}function Qn(e){let t=`Wallet registration respond ed25519 admission`,n=z({responseName:t,field:`ed25519`,value:e});if(H(n,[`status`,`admissionRequest`,`admissionReceipt`],t),B(n,`status`,t)!==`admitted`)throw Error(`${t} status is invalid`);let r=S(B(n,`admissionRequest`,t)),i=Qe(B(n,`admissionReceipt`,t));if(!r.ok||!i.ok)throw Error(`${t} request or receipt is invalid`);return{status:`admitted`,admissionRequest:r.value,admissionReceipt:i.value}}function $n(e){let t=`Wallet registration respond ed25519`,n=z({responseName:t,field:`ed25519`,value:e});if(H(n,[`status`,`admissionRequest`],t),B(n,`status`,t)!==`deferred`)throw Error(`${t} status is invalid`);let r=S(B(n,`admissionRequest`,t));if(!r.ok)throw Error(`${t} admissionRequest is invalid`);return{status:`deferred`,admissionRequest:r.value}}function er(e){let t={registrationCeremonyId:e.registrationCeremonyId,signedSetup:e.signedSetup,kind:e.signerPlanKind};switch(e.kind){case`passkey`:t.webauthn_registration=e.webauthnRegistration;break;case`email_otp`:t.emailOtpRegistrationProof=e.emailOtpRegistrationProof;break}return t.ecdsa=e.ecdsa,t}async function tr(e){return Zn(await L({relayerUrl:e.relayerUrl,path:Pt,headers:e.headers,body:er(e),onServerTiming:e.onServerTiming}))}function nr(e,t){let n=rt(e);if(n===null||n.session.walletId!==t)throw Error(`Wallet registration established session direct session result is invalid`);return n}function rr(e,t){let n=`Wallet registration activate`,r=V(e,`registrationDiagnostics`,n),i=V(e,`rpId`,n),a=V(e,`walletCustody`,n),o=V(e,`custodyKeyManifestDigestB64u`,n);return{ok:B(e,`ok`,n),walletId:B(e,`walletId`,n),authority:B(e,`authority`,n),foundingAuthority:B(e,`foundingAuthority`,n),foundingAuthMethod:B(e,`foundingAuthMethod`,n),...r===void 0?{}:{registrationDiagnostics:r},...i===void 0?{}:{rpId:i},authMethod:B(e,`authMethod`,n),...a===void 0?{}:{walletCustody:a},...o===void 0?{}:{custodyKeyManifestDigestB64u:o},kind:`evm_family_ecdsa`,ecdsa:{walletKeys:B(t,`walletKeys`,n)}}}function ir(e){let t=`Wallet registration NEAR provisioning`,n=V(e,`registrationDiagnostics`,t),r=V(e,`rpId`,t),i=V(e,`walletCustody`,t),a=V(e,`custodyKeyManifestDigestB64u`,t);return{ok:B(e,`ok`,t),walletId:B(e,`walletId`,t),authority:B(e,`authority`,t),foundingAuthority:B(e,`foundingAuthority`,t),foundingAuthMethod:B(e,`foundingAuthMethod`,t),...n===void 0?{}:{registrationDiagnostics:n},...r===void 0?{}:{rpId:r},authMethod:B(e,`authMethod`,t),...i===void 0?{}:{walletCustody:i},...a===void 0?{}:{custodyKeyManifestDigestB64u:a},kind:`near_ed25519`,authorityScope:B(e,`authorityScope`,t),accountProvisioning:B(e,`accountProvisioning`,t),resolvedAccount:B(e,`resolvedAccount`,t),ed25519:B(e,`ed25519`,t)}}function ar(e){let t=`Wallet registration activate`,n=z({responseName:t,field:`body`,value:e}),r=B(n,`kind`,t),i=V(n,`nearProvisioning`,t),a=V(n,`registrationEstablishedSession`,t);if(r!==`evm_family_ecdsa`)throw Error(`${t} response has invalid kind`);let o=z({responseName:t,field:`ecdsa`,value:B(n,`ecdsa`,t)});H(n,[`ok`,`walletId`,`authority`,`foundingAuthority`,`foundingAuthMethod`,`registrationDiagnostics`,`rpId`,`authMethod`,`walletCustody`,`custodyKeyManifestDigestB64u`,`kind`,`ecdsa`,`nearProvisioning`,`registrationEstablishedSession`],t),H(o,[`walletKeys`,`activation`,`bootstrap`],t);let s=V(o,`activation`,t),c=V(o,`bootstrap`,t);if(i!==void 0){let e=z({responseName:t,field:`nearProvisioning`,value:i});if(H(e,[`status`],`${t} nearProvisioning`),B(e,`status`,`${t} nearProvisioning`)!==`near_pending`)throw Error(`${t} nearProvisioning status is invalid`)}if(s===void 0||c===void 0)throw Error(`${t} is missing the activation payload the client needs to build its ECDSA session`);let l=Nt({value:rr(n,o),expectedKind:`evm_family_ecdsa`});if(!l.ok||l.kind!==`evm_family_ecdsa`)throw Error(`${t} did not return an activated ECDSA wallet`);let u=nr(a,l.walletId);return{...l,ecdsa:{...l.ecdsa,activation:Ke(s),bootstrap:nt(c)},registrationEstablishedSession:u,...i===void 0?{}:{nearProvisioning:{status:`near_pending`}}}}function or(e){let t={registrationCeremonyId:e.registrationCeremonyId,kind:e.signerPlanKind,signedSetup:e.signedSetup,idempotencyKey:e.idempotencyKey};return t.ecdsa=e.ecdsa,e.emailOtpEnrollment&&(t.emailOtpEnrollment=e.emailOtpEnrollment),e.walletCustodyCommit&&(t.walletCustodyCommit=e.walletCustodyCommit),t}async function sr(e){return ar(await L({relayerUrl:e.relayerUrl,path:Ft,headers:e.headers,body:or(e),onServerTiming:e.onServerTiming}))}function cr(e){let t=`Wallet registration session seal`,n=z({responseName:t,field:`body`,value:e});H(n,[`ciphertext`,`keyVersion`,`expiresAtMs`,`remainingUses`],t);let r=B(n,`ciphertext`,t),i=B(n,`keyVersion`,t),a=B(n,`expiresAtMs`,t),o=B(n,`remainingUses`,t);if(typeof r!=`string`||!r.trim()||typeof i!=`string`||!i.trim()||typeof a!=`number`||!Number.isSafeInteger(a)||a<=0||typeof o!=`number`||!Number.isSafeInteger(o)||o<0)throw Error(`${t} is invalid`);return{ciphertext:r,keyVersion:i,expiresAtMs:a,remainingUses:o}}function lr(e){let t=`Wallet registration NEAR provisioning`,n=z({responseName:t,field:`body`,value:e});if(B(n,`ok`,t)!==!0){H(n,[`ok`,`code`,`message`,`nearProvisioning`],t);let e=B(n,`code`,t),r=B(n,`message`,t);if(typeof e!=`string`||typeof r!=`string`)throw Error(`${t} failure is invalid`);let i=V(n,`nearProvisioning`,t);if(i!==void 0){let n=z({responseName:t,field:`nearProvisioning`,value:i});if(H(n,[`status`],`${t} nearProvisioning`),B(n,`status`,`${t} nearProvisioning`)!==`near_failed_retryable`)throw Error(`${t} failure status is invalid`);return{ok:!1,code:e,message:r,nearProvisioning:{status:`near_failed_retryable`}}}return{ok:!1,code:e,message:r}}H(n,[`ok`,`walletId`,`authority`,`foundingAuthority`,`foundingAuthMethod`,`registrationDiagnostics`,`rpId`,`authMethod`,`walletCustody`,`custodyKeyManifestDigestB64u`,`kind`,`accountProvisioning`,`resolvedAccount`,`ed25519`,`authorityScope`,`nearProvisioning`,`registrationEstablishedSession`,`sessionSeal`],t);let r=z({responseName:t,field:`nearProvisioning`,value:B(n,`nearProvisioning`,t)});if(H(r,[`status`],`${t} nearProvisioning`),B(r,`status`,`${t} nearProvisioning`)!==`near_ready`)throw Error(`${t} success status is invalid`);let i=Nt({value:ir(n),expectedKind:`near_ed25519`});if(!i.ok||i.kind!==`near_ed25519`)throw Error(`${t} did not return a finalized Ed25519 wallet`);let a=V(n,`sessionSeal`,t),o=nr(B(n,`registrationEstablishedSession`,t),i.walletId);if(yn(i)){if(a!==void 0)throw Error(`${t} returned a session seal for an Email OTP authority`);return{...i,nearProvisioning:{status:`near_ready`},registrationEstablishedSession:o}}let s={...i,nearProvisioning:{status:`near_ready`},registrationEstablishedSession:o};return a===void 0?s:{...s,sessionSeal:cr(a)}}async function ur(e){let t={registrationCeremonyId:e.registrationCeremonyId,signedSetup:e.signedSetup,idempotencyKey:e.idempotencyKey,ed25519:e.ed25519};return e.auth.kind===`email_otp`&&(t.emailOtpEnrollment=e.auth.enrollment),e.walletCustodyCommit&&(t.walletCustodyCommit=e.walletCustodyCommit),e.sessionSeal&&(t.sessionSeal=e.sessionSeal),lr(await L({relayerUrl:e.relayerUrl,path:It,headers:e.headers,body:t,...e.onServerTiming?{onServerTiming:e.onServerTiming}:{}}))}function dr(e){switch(e.kind){case`webauthn_assertion`:return{kind:`webauthn_assertion`,rpId:e.rpId,credential:e.credential,expectedChallengeDigestB64u:e.expectedChallengeDigestB64u}}}function fr(e){switch(e.kind){case`webauthn_assertion`:return{kind:`webauthn_assertion`,rpId:e.rpId,credential:e.credential,expectedChallengeDigestB64u:e.expectedChallengeDigestB64u};case`wallet_session`:return{kind:`wallet_session`};case`email_otp`:return{kind:`email_otp`,challengeId:e.challengeId,otpCode:e.otpCode,expectedChallengeDigestB64u:e.expectedChallengeDigestB64u}}}function pr(e){switch(e.kind){case`passkey`:return{};case`email_otp`:return{emailOtpRegistrationProof:e.emailOtpRegistrationProof}}}async function mr(e){let t=String(e.walletId||``).trim();if(!t)throw Error(`walletId is required for add-signer start`);return Bn({value:await L({relayerUrl:e.relayerUrl,path:`/wallets/${encodeURIComponent(t)}/signers/start`,body:{addSignerIntentGrant:e.addSignerIntentGrant,addSignerIntentDigestB64u:e.addSignerIntentDigestB64u,intent:e.intent,auth:dr(e.auth)}}),expectedIntent:e.intent})}function hr(e){let t=`Email OTP enrollment code`,n=z({responseName:t,field:`body`,value:e});if(H(n,[`ok`,`challengeId`,`expiresAtMs`,`emailHint`],t),B(n,`ok`,t)!==!0)throw Error(`${t} response is not successful`);let r=B(n,`challengeId`,t);if(typeof r!=`string`||!r.trim())throw Error(`${t} response missing challengeId`);let i=B(n,`expiresAtMs`,t);if(typeof i!=`number`||!Number.isSafeInteger(i)||i<1)throw Error(`${t} response has invalid expiresAtMs`);let a=B(n,`emailHint`,t);if(typeof a!=`string`)throw Error(`${t} response has invalid emailHint`);return{challengeId:r.trim(),expiresAtMs:i,emailHint:a}}async function gr(e){let t=String(e.walletId||``).trim();if(!t)throw Error(`walletId is required for the Email OTP enrollment code`);return hr(await L({relayerUrl:e.relayerUrl,path:`/wallets/${encodeURIComponent(t)}/auth-methods/email-otp/challenge`,body:{addAuthMethodIntentGrant:e.addAuthMethodIntentGrant,addAuthMethodIntentDigestB64u:e.addAuthMethodIntentDigestB64u}}))}async function _r(e){let t=String(e.walletId||``).trim();if(!t)throw Error(`walletId is required for add-auth-method start`);return Cn({value:await L({relayerUrl:e.relayerUrl,path:`/wallets/${encodeURIComponent(t)}/auth-methods/start`,body:{addAuthMethodIntentGrant:e.addAuthMethodIntentGrant,addAuthMethodIntentDigestB64u:e.addAuthMethodIntentDigestB64u,intent:e.intent,auth:fr(e.auth),...pr(e.authority)},...e.auth.kind===`wallet_session`?{headers:{authorization:`Bearer ${e.auth.walletSessionToken}`}}:{}}),expectedIntent:e.intent})}async function vr(e){let t=String(e.walletId||``).trim();if(!t)throw Error(`walletId is required for add-signer ECDSA respond`);return _n(await L({relayerUrl:e.relayerUrl,path:`/wallets/${encodeURIComponent(t)}/signers/derivation/respond`,body:{addSignerCeremonyId:e.addSignerCeremonyId,ecdsa:e.ecdsa}}))}async function yr(e){let t=String(e.walletId||``).trim();if(!t)throw Error(`walletId is required for add-signer ECDSA activation`);return vn(await L({relayerUrl:e.relayerUrl,path:`/wallets/${encodeURIComponent(t)}/signers/derivation/activate`,body:{addSignerCeremonyId:e.addSignerCeremonyId,ecdsa:{kind:`router_ab_ecdsa_registration_activation_v1`,activationCorrelationId:e.activationCorrelationId,publicFacts:e.publicFacts,expectedActivationRequestDigest:e.expectedActivationRequestDigest}}}))}function br(e){switch(e.kind){case`near_ed25519`:return{addSignerCeremonyId:e.addSignerCeremonyId,idempotencyKey:e.idempotencyKey,kind:e.kind,ed25519:e.ed25519,custodyKeySet:e.custodyKeySet};case`evm_family_ecdsa`:return{addSignerCeremonyId:e.addSignerCeremonyId,idempotencyKey:e.idempotencyKey,kind:e.kind,ecdsa:e.ecdsa,custodyKeySet:e.custodyKeySet}}}async function xr(e){let t=String(e.walletId||``).trim();if(!t)throw Error(`walletId is required for add-signer finalize`);return Vn({value:await L({relayerUrl:e.relayerUrl,path:`/wallets/${encodeURIComponent(t)}/signers/finalize`,body:br(e)}),expectedKind:e.kind})}async function Sr(e){let t=String(e.walletId||``).trim();if(!t)throw Error(`walletId is required for add-auth-method finalize`);let n=e.custodyEnvelope===void 0?{addAuthMethodCeremonyId:e.addAuthMethodCeremonyId}:e.webauthnRegistration===void 0?{addAuthMethodCeremonyId:e.addAuthMethodCeremonyId,custodyEnvelope:w(e.custodyEnvelope),emailOtpTarget:e.emailOtpTarget}:{addAuthMethodCeremonyId:e.addAuthMethodCeremonyId,webauthnRegistration:e.webauthnRegistration,custodyEnvelope:w(e.custodyEnvelope)},r={relayerUrl:e.relayerUrl,path:`/wallets/${encodeURIComponent(t)}/auth-methods/finalize`,body:n},i;try{i=await L(r)}catch(e){if(!(e instanceof TypeError))throw e;i=await L(r)}return Sn(i)}async function Cr(e){let t=String(e.walletId||``).trim(),n=String(e.rpId||``).trim(),r=e.operationCredential;if(!t)throw Error(`walletId is required for ECDSA key-facts inventory`);if(!n)throw Error(`rpId is required for ECDSA key-facts inventory`);return Gn({value:await L({relayerUrl:e.relayerUrl,path:`/wallets/${encodeURIComponent(t)}/signers/ecdsa/key-facts/inventory`,headers:fe(r),body:{rpId:n,keyTargets:e.keyTargets,auth:{kind:r.kind,walletSessionId:r.walletSessionId}}}),walletId:e.walletId,rpId:n})}async function wr(e){let t=String(e.walletId||``).trim(),n=String(e.rpId||``).trim(),r=String(e.serverNonceB64u||``).trim(),i=String(e.expectedChallengeDigestB64u||``).trim();if(!t)throw Error(`walletId is required for ECDSA key-facts inventory`);if(!n)throw Error(`rpId is required for ECDSA key-facts inventory`);if(!r||!i)throw Error(`WebAuthn ECDSA key-facts inventory requires challenge binding`);return Gn({value:await L({relayerUrl:e.relayerUrl,path:`/wallets/${encodeURIComponent(t)}/signers/ecdsa/key-facts/inventory`,body:{rpId:n,keyTargets:e.keyTargets,auth:{kind:`webauthn_assertion`,credential:e.credential,serverNonceB64u:r,expectedChallengeDigestB64u:i,...e.runtimePolicyScope?{runtimePolicyScope:e.runtimePolicyScope}:{}}}}),walletId:e.walletId,rpId:n})}async function Tr(e){return se(`seams:wallet-custody:challenge:v1|${f({walletId:e.walletId,operation:e.operation,payload:e.payload,requestOrigin:e.requestOrigin})}`)}function X(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return!1;let n=Object.keys(e);return n.length===t.length&&n.every(e=>t.includes(e))}const Er=[`kind`,`walletId`,`authorityId`,`walletAuthMethodId`,`mintId`,`authorizationId`,`walletSessionId`,`quotaId`],Dr=[`ok`,`code`,`message`,`next`,`committed`],Or=[`ok`,`code`,`message`,`next`,`kind`,`walletId`,`authorityId`,`walletAuthMethodId`,`mintId`,`authorizationId`,`walletSessionId`,`quotaId`],kr=[...Or,`unlocked`,`unlockBackend`];function Ar(e){if(!u(e)||!X(e,Er)||e.kind!==`already_committed_wallet_session_v1`)return null;let t=r(e.walletId),a=n(e.authorityId),o=i(e.walletAuthMethodId),s=ae(e.mintId),c=oe(e.authorizationId),l=y(e.walletSessionId),d=v(e.quotaId);return!t.ok||!a.ok||!o.ok||!s.ok||!c.ok||!l.ok||!d.ok?null:{kind:`already_committed_wallet_session_v1`,walletId:t.value,authorityId:a.value,walletAuthMethodId:o.value,mintId:s.value,authorizationId:c.value,walletSessionId:l.value,quotaId:d.value}}function jr(e){return e.ok!==!1||e.code!==`already_committed`||typeof e.message!=`string`||e.next!==`unlock_exact_method`?null:{ok:!1,code:`already_committed`,message:e.message,next:`unlock_exact_method`}}function Mr(e){return!X(e,Or)&&!X(e,kr)||X(e,kr)&&(e.unlocked!==!1||e.unlockBackend!==`passkey`&&e.unlockBackend!==`email_otp`)||e.kind!==`already_committed`?null:Ar({kind:`already_committed_wallet_session_v1`,walletId:e.walletId,authorityId:e.authorityId,walletAuthMethodId:e.walletAuthMethodId,mintId:e.mintId,authorizationId:e.authorizationId,walletSessionId:e.walletSessionId,quotaId:e.quotaId})}function Nr(e,t){return{ok:!1,code:`already_committed`,message:e.message,next:`unlock_exact_method`,committed:t}}function Pr(e){if(!u(e))return null;let t=jr(e);if(!t||!X(e,Dr))return null;let n=Ar(e.committed);return n?Nr(t,n):null}function Fr(e){if(!u(e))return null;let t=jr(e);if(!t)return null;let n=Mr(e);return n?Nr(t,n):null}var Z=class{retainProof(){return!0}constructor(){this.retainProof()}},Ir=class extends Z{constructor(e){super(),this.kind=`use_live_runtime`,this.capability=e.materialActivation.capability,this.materialOwner=e.materialActivation.materialOwner,this.authority=e.authority,this.runtime=e.runtime,this.materialActivation=e.materialActivation}},Lr=class extends Z{constructor(e){super(),this.kind=`rehydrate_material_activation`,this.capability=e.materialActivation.capability,this.materialOwner=e.materialActivation.materialOwner,this.authority=e.authority,this.materialActivation=e.materialActivation,this.sealedMaterial=e.sealedMaterial}},Rr=class extends Z{constructor(e){super(),this.kind=`reauthorize_public_anchor`,this.capability=e.publicReauthAnchor.capability,this.materialOwner=e.publicReauthAnchor.materialOwner,this.authority=e.publicReauthAnchor.authority,this.retirement=e.retirement,this.publicReauthAnchor=e.publicReauthAnchor}},zr=class extends Z{constructor(...e){super(...e),this.kind=`blocked`}},Br=class extends zr{constructor(...e){super(...e),this.capability=null,this.reason=`missing_capability`}},Vr=class extends zr{constructor(e){super(),this.capability=e.capability,this.reason=e.reason}};function Hr(e){return new Ir(e)}function Ur(e){return new Lr(e)}function Wr(e){return new Rr(e)}function Q(e){return e.reason===`missing_capability`?new Br:new Vr(e)}function Gr(e){if(!e.ok)throw Error(e.error.message);return e.value}function Kr(e){return e.materialActivation}function qr(e){return Gr(l(`near-ed25519-yao:${e.activationId}`))}function $(e,t){let n=e.sealed.kind===`available`?e.sealed.materialActivation.capability:e.runtime.kind===`live`?e.runtime.materialActivation.capability:e.publicLocator.kind===`available`?e.publicLocator.materialActivation.capability:null;return Q(n?{capability:n,reason:t}:{capability:null,reason:`missing_capability`})}function Jr(e){switch(e.publicLocator.kind){case`missing`:return Q({capability:null,reason:`missing_capability`});case`retired`:return Wr({retirement:e.publicLocator.retirement,publicReauthAnchor:e.publicLocator.publicReauthAnchor});case`conflict`:return $(e,`exact_record_conflict`);case`corrupt`:return $(e,`corrupt`);case`unavailable`:return Q({capability:e.publicLocator.capability,reason:`persistence_unavailable`});case`available`:break;default:e.publicLocator}let t=e.publicLocator.materialActivation;if(String(t.materialOwner)!==e.publicLocator.walletId)return $(e,`binding_mismatch`);switch(e.runtime.kind){case`live`:return o(t,e.runtime.materialActivation)?Hr({authority:e.publicLocator.authority,runtime:e.runtime.runtime,materialActivation:t}):$(e,`binding_mismatch`);case`absent`:break;default:e.runtime}switch(e.sealed.kind){case`missing`:return $(e,`missing_material`);case`corrupt`:return $(e,`corrupt`);case`available`:break;default:e.sealed}let n=e.sealed;if(String(n.authority.walletId)!==e.publicLocator.walletId||String(n.authority.authorityDigest)!==String(e.publicLocator.authority.authorityDigest)||String(n.materialActivation.materialOwner)!==e.publicLocator.walletId||!o(n.materialActivation,e.publicLocator.materialActivation))return $(e,`binding_mismatch`);switch(e.unlockSource.kind){case`unavailable`:return $(e,`missing_material`);case`available`:return String(e.unlockSource.authority.walletId)!==String(n.authority.walletId)||String(e.unlockSource.authority.authorityDigest)!==String(n.authority.authorityDigest)?$(e,`binding_mismatch`):Ur({authority:n.authority,materialActivation:n.materialActivation,sealedMaterial:n.sealedMaterial});default:e.unlockSource}throw Error(`Unsupported Near Ed25519 unlock-source observation`)}export{mr as A,Rt as C,Yn as D,tr as E,Kn as O,Wn as S,vr as T,wr as _,Ur as a,$t as b,Fr as c,yr as d,sr as f,Cr as g,qn as h,Q as i,_t as j,_r as k,X as l,Xn as m,qr as n,Hr as o,ur as p,Jr as r,Pr as s,Kr as t,Tr as u,Sr as v,gr as w,yn as x,xr as y};

package/dist/public/sdk/normalize-kUDm5zfS.js

@@ -1 +0,0 @@
-var e=class{retainProof(){return!0}constructor(e){this.retainProof(),this.kind=`mpc_material_activation_ref`,this.activationId=e.activationId,this.capability=e.capability,this.materialOwner=e.materialOwner,this.keyBinding=e.keyBinding,this.lifecycleBinding=e.lifecycleBinding,this.signingWorker=e.signingWorker}};function t(e,t){if(e==null)return{ok:!1,error:{code:`missing`,message:`${t} is required`}};if(typeof e!=`string`)return{ok:!1,error:{code:`invalid`,message:`${t} must be a string`}};let n=e.trim();return n?{ok:!0,value:n}:{ok:!1,error:{code:`missing`,message:`${t} is required`}}}function n(e){for(let t of e){let e=t.charCodeAt(0);if(e<=31||e===127)return!0}return!1}function r(e){for(let t of e)if(/\s/.test(t))return!0;return n(e)}function i(e){let n=t(e,`walletId`);return n.ok&&r(n.value)?{ok:!1,error:{code:`invalid`,message:`walletId must not contain whitespace or control characters`}}:n}function a(e){let n=t(e,`verifiedEmailAddress`);if(!n.ok)return n;let r=n.value.toLowerCase();return/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(r)?{ok:!0,value:r}:{ok:!1,error:{code:`invalid`,message:`verifiedEmailAddress must be an email address`}}}function o(e){return t(e,`emailOtpProviderUserId`)}function s(e){return t(e,`emailOtpChallengeId`)}function c(e){let n=t(e,`rpId`);return n.ok&&r(n.value)?{ok:!1,error:{code:`invalid`,message:`rpId contains whitespace or control characters`}}:n}function l(e){return t(e,`credentialIdB64u`)}function u(e){return t(e,`passkeyEnvelopeId`)}function d(e){return t(e,`walletAuthMethodId`)}function f(e){return t(e,`walletAuthorityId`)}function p(e){return t(e,`walletAuthorityBindingDigest`)}function m(e){return t(e,`capabilityInstanceRef`)}function h(e){return t(e,`mpcMaterialOwnerRef`)}function g(e){return t(e,`mpcCapabilityRuntimeRef`)}function _(e){return t(e,`mpcMaterialActivationId`)}function v(e){return t(e,`mpcSigningWorkerRef`)}function y(e){return t(e,`mpcKeyBindingRef`)}function b(e){return t(e,`mpcLifecycleBindingRef`)}function x(t){return new e(t)}function S(e,t){return e.activationId===t.activationId&&e.capability===t.capability&&e.materialOwner===t.materialOwner&&e.keyBinding===t.keyBinding&&e.lifecycleBinding===t.lifecycleBinding&&e.signingWorker===t.signingWorker}function C(e){switch(e){case`kind`:case`activationId`:case`capability`:case`materialOwner`:case`keyBinding`:case`lifecycleBinding`:case`signingWorker`:return!0;default:return!1}}function w(e){if(e==null)return{ok:!1,error:{code:`missing`,message:`mpcMaterialActivationRef is required`}};if(typeof e!=`object`||Array.isArray(e))return{ok:!1,error:{code:`invalid`,message:`mpcMaterialActivationRef must be an object`}};let t=e,n=Object.keys(t);if(n.length!==7)return{ok:!1,error:{code:`invalid`,message:`mpcMaterialActivationRef has invalid fields`}};for(let e of n)if(!C(e))return{ok:!1,error:{code:`invalid`,message:`mpcMaterialActivationRef has invalid fields`}};if(t.kind!==`mpc_material_activation_ref`)return{ok:!1,error:{code:`invalid`,message:`mpcMaterialActivationRef.kind is invalid`}};let r=_(t.activationId);if(!r.ok)return r;let i=m(t.capability);if(!i.ok)return i;let a=h(t.materialOwner);if(!a.ok)return a;let o=y(t.keyBinding);if(!o.ok)return o;let s=b(t.lifecycleBinding);if(!s.ok)return s;let c=v(t.signingWorker);return c.ok?{ok:!0,value:x({activationId:r.value,capability:i.value,materialOwner:a.value,keyBinding:o.value,lifecycleBinding:s.value,signingWorker:c.value})}:c}function T(e){return t(e,`thresholdEd25519SessionId`)}function E(e){return t(e,`thresholdEcdsaSessionId`)}function D(e){return t(e,`ecdsaActiveStateId`)}function O(e){return t(e,`thresholdSessionId`)}function k(e){return t(e,`rootShareEpoch`)}function A(e){return t(e,`walletKeyId`)}function j(e){return t(e,`signingLaneId`)}function M(e){return t(e,`laneShareEpoch`)}function N(e){return t(e,`linkedDeviceId`)}function P(e){return t(e,`linkedDeviceEnrollmentId`)}function F(e){return t(e,`walletRecoveryOperationId`)}function I(e){return t(e,`linkDeviceSessionId`)}function L(e){return typeof e==`string`?e:``}function R(e){return L(e).trim()}function z(e){return String(e??``).trim()}function B(e){return z(e).toLowerCase()}function V(e){return z(e)||void 0}function H(e){let t=typeof e==`number`?e:Number(e);return Number.isFinite(t)?t:null}function U(e){let t=H(e);return t==null?null:Math.trunc(t)}function W(e){let t=U(e);return t==null||t<=0?null:t}function G(e,t){let n=W(t.min)??1,r=W(t.fallback)??n,i=Math.max(n,r),a=W(t.max),o=U(e);return o==null||o<n?i:a==null?o:Math.min(o,a)}function K(e){return String(e??``).replace(/\/+$/,``)}function q(e){let t=z(e);return t?t.startsWith(`/`)?t:`/${t}`:``}function J(e,t){let n=K(z(e)),r=q(z(t));if(!n)throw Error(`Missing base URL`);return`${n}${r}`}export{E as A,l as B,_ as C,u as D,v as E,p as F,f as I,i as L,O as M,a as N,k as O,d as P,A as R,b as S,h as T,c as V,M as _,B as a,N as b,z as c,r as d,S as f,o as g,s as h,U as i,T as j,j as k,K as l,D as m,G as n,V as o,m as p,H as r,R as s,J as t,x as u,I as v,w,g as x,P as y,F as z};

package/dist/public/sdk/passkey-custody-BQj44jEM.js

@@ -1 +0,0 @@
-import{A as e,B as t,D as n,L as r,P as i,R as a,V as o,_ as s,b as c,k as l,v as u,y as ee}from"./normalize-kUDm5zfS.js";import{k as d}from"./chains-CiYQT1K4.js";import{_ as f,a as p,c as m,i as h,n as g,r as te,s as _,t as v}from"./primitives-CAcl7ON7.js";import{l as y}from"./digestEncoding-Dzc1rzWV.js";import{i as b}from"./registrationIds-CdPqm-Ya.js";const x=`wallet_seed_parallel_hkdf_sha256_v1`;function S(e){return e.kind===`wallet_custody_seed_v1`}function C(){return{kind:`wallet_custody_seed_v1`,derivationScheme:x}}function w(e){return{kind:`ed25519_yao_client_root_v1`,linkSessionId:e.linkSessionId,walletKeyId:e.walletKeyId,targetFactor:e.targetFactor,applicationBindingDigestB64u:e.applicationBindingDigestB64u,registeredPublicKeyB64u:e.registeredPublicKeyB64u,enrollmentId:e.enrollmentId,deviceId:e.deviceId,revocationEpoch:e.revocationEpoch}}function T(e){return{kind:`ed25519_lane_holder_share_v1`,walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,registeredPublicKeyB64u:e.registeredPublicKeyB64u,participantBindingDigestB64u:e.participantBindingDigestB64u}}function ne(e){return{kind:`ecdsa_lane_holder_share_v1`,walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,thresholdSessionId:e.thresholdSessionId,thresholdPublicKey33B64u:e.thresholdPublicKey33B64u}}const E=[`kind`,`walletKeyId`,`laneId`,`laneShareEpoch`],D={wallet_custody_seed_v1:[`kind`,`derivationScheme`],ed25519_yao_client_root_v1:[`kind`,`linkSessionId`,`walletKeyId`,`targetFactor`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`enrollmentId`,`deviceId`,`revocationEpoch`],ed25519_lane_holder_share_v1:[...E,`nearEd25519SigningKeyId`,`registeredPublicKeyB64u`,`participantBindingDigestB64u`],ecdsa_lane_holder_share_v1:[...E,`evmFamilySigningKeySlotId`,`thresholdSessionId`,`thresholdPublicKey33B64u`]},re=Array.from(new Set(Object.values(D).flat()));function ie(e,t){if(e===`wallet_custody_seed_v1`||e===`ed25519_yao_client_root_v1`||e===`ed25519_lane_holder_share_v1`||e===`ecdsa_lane_holder_share_v1`)return e;throw Error(`${t}.kind must be a known passkey custody secret kind`)}function O(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function k(e,t){let n=d(e,t);if(f(n,[`kind`],t),n.kind===`passkey_prf`||n.kind===`email_otp`)return{kind:n.kind};throw Error(`${t}.kind must be passkey_prf or email_otp`)}function A(e,t){let n=a(e.walletKeyId);if(!n.ok)throw Error(`${t}.walletKeyId ${n.error.message}`);let r=l(e.laneId);if(!r.ok)throw Error(`${t}.laneId ${r.error.message}`);let i=s(e.laneShareEpoch);if(!i.ok)throw Error(`${t}.laneShareEpoch ${i.error.message}`);return{walletKeyId:n.value,laneId:r.value,laneShareEpoch:i.value}}function j(t,n){let r=e(t);if(!r.ok)throw Error(`${n} ${r.error.message}`);return r.value}function M(e,t=`passkeyCustodySecretBinding`){let n=d(e,t),r=ie(n.kind,t);switch(f(n,D[r],t,re),r){case`wallet_custody_seed_v1`:if(n.derivationScheme!==x)throw Error(`${t}.derivationScheme must be ${x}`);return C();case`ed25519_yao_client_root_v1`:{let e=u(n.linkSessionId);if(!e.ok)throw Error(`${t}.linkSessionId ${e.error.message}`);let r=a(n.walletKeyId);if(!r.ok)throw Error(`${t}.walletKeyId ${r.error.message}`);let i=ee(n.enrollmentId);if(!i.ok)throw Error(`${t}.enrollmentId ${i.error.message}`);let o=c(n.deviceId);if(!o.ok)throw Error(`${t}.deviceId ${o.error.message}`);return w({linkSessionId:e.value,walletKeyId:r.value,targetFactor:k(n.targetFactor,`${t}.targetFactor`),applicationBindingDigestB64u:v(n.applicationBindingDigestB64u,`${t}.applicationBindingDigestB64u`),registeredPublicKeyB64u:g(n.registeredPublicKeyB64u,`${t}.registeredPublicKeyB64u`),enrollmentId:i.value,deviceId:o.value,revocationEpoch:O(n.revocationEpoch,`${t}.revocationEpoch`)})}case`ed25519_lane_holder_share_v1`:{let e=A(n,t);return T({walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,nearEd25519SigningKeyId:b(n.nearEd25519SigningKeyId),registeredPublicKeyB64u:g(n.registeredPublicKeyB64u,`${t}.registeredPublicKeyB64u`),participantBindingDigestB64u:v(n.participantBindingDigestB64u,`${t}.participantBindingDigestB64u`)})}case`ecdsa_lane_holder_share_v1`:{let e=A(n,t);return ne({walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,evmFamilySigningKeySlotId:y(n.evmFamilySigningKeySlotId,`${t}.evmFamilySigningKeySlotId`),thresholdSessionId:j(n.thresholdSessionId,`${t}.thresholdSessionId`),thresholdPublicKey33B64u:_(n.thresholdPublicKey33B64u,`${t}.thresholdPublicKey33B64u`)})}}}const N=`wallet_custody_envelope_v2`,P=`passkey_prf_kek_hkdf_sha256_v1`,F=`email_otp_factor_kek_hkdf_sha256_v1`,I=[`kind`,`walletAuthMethodId`];function L(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be an object`);let n=e;switch(f(n,I,t),n.kind){case`unbound`:if(n.walletAuthMethodId!==void 0)throw Error(`${t}.walletAuthMethodId belongs to the method_bound branch`);return{kind:`unbound`};case`method_bound`:{let e=i(n.walletAuthMethodId);if(!e.ok)throw Error(`${t}.walletAuthMethodId ${e.error.message}`);return{kind:`method_bound`,walletAuthMethodId:e.value}}default:throw Error(`${t}.kind must be unbound or method_bound`)}}function R(e){return JSON.stringify({walletId:e.walletId,envelopeId:e.envelopeId,factor:e.factor,envelopeRevision:e.envelopeRevision,binding:e.binding,ownership:B(e.ownership)})}function z(e,t){if(e===`unbound`)return{kind:`unbound`};if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be "unbound" or a methodBound object`);let n=e;f(n,[`methodBound`],t);let r=n.methodBound;if(typeof r!=`object`||!r||Array.isArray(r))throw Error(`${t}.methodBound must be an object`);let a=r;f(a,[`walletAuthMethodId`],`${t}.methodBound`);let o=i(a.walletAuthMethodId);if(!o.ok)throw Error(`${t}.methodBound.walletAuthMethodId ${o.error.message}`);return{kind:`method_bound`,walletAuthMethodId:o.value}}function B(e){switch(e.kind){case`unbound`:return`unbound`;case`method_bound`:return{methodBound:{walletAuthMethodId:String(e.walletAuthMethodId)}};default:throw Error(`Unhandled custody envelope ownership: ${String(e)}`)}}function V(e){return{kind:`method_bound`,walletAuthMethodId:e}}function H(e){return{kind:`passkey`,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,kekVersion:P}}function U(e){return{kind:`email_otp`,enrollmentId:e.enrollmentId,enrollmentSealKeyVersion:e.enrollmentSealKeyVersion,kekVersion:F}}function W(e){return{state:`active`,activatedAtMs:e.activatedAtMs}}function G(e){return{state:`retired`,activatedAtMs:e.activatedAtMs,retiredAtMs:e.retiredAtMs}}function K(e){return{state:`revoked`,activatedAtMs:e.activatedAtMs,revokedAtMs:e.revokedAtMs}}function q(e){return{kind:`wallet_custody_envelope_v2`,envelopeId:e.envelopeId,walletId:e.walletId,ownership:e.ownership,binding:e.binding,factor:e.factor,envelopeVersion:N,envelopeRevision:e.envelopeRevision,nonceB64u:e.nonceB64u,sealedCustodySecretB64u:e.sealedCustodySecretB64u,ciphertextDigestB64u:e.ciphertextDigestB64u,aadHashB64u:e.aadHashB64u,lifecycle:e.lifecycle,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs}}const J=[`state`,`activatedAtMs`,`retiredAtMs`,`revokedAtMs`];function ae(e,t=`lifecycle`){let n=d(e,t);f(n,J,t);let r=m(n.activatedAtMs,`${t}.activatedAtMs`);switch(n.state){case`active`:if(n.retiredAtMs!==void 0||n.revokedAtMs!==void 0)throw Error(`${t} cannot be active and carry a retired or revoked timestamp`);return W({activatedAtMs:r});case`retired`:{if(n.revokedAtMs!==void 0)throw Error(`${t} cannot be retired and carry a revoked timestamp`);let e=m(n.retiredAtMs,`${t}.retiredAtMs`);if(e<r)throw Error(`${t}.retiredAtMs cannot precede activation`);return G({activatedAtMs:r,retiredAtMs:e})}case`revoked`:{if(n.retiredAtMs!==void 0)throw Error(`${t} cannot be revoked and carry a retired timestamp`);let e=m(n.revokedAtMs,`${t}.revokedAtMs`);if(e<r)throw Error(`${t}.revokedAtMs cannot precede activation`);return K({activatedAtMs:r,revokedAtMs:e})}default:throw Error(`${t}.state must be active, retired, or revoked`)}}const Y=[`kind`,`rpId`,`credentialIdB64u`,`kekVersion`],X=[`kind`,`enrollmentId`,`enrollmentSealKeyVersion`,`kekVersion`],Z=Array.from(new Set([...Y,...X]));function Q(e,t){if(typeof e!=`string`||!e.trim())throw Error(`${t} is required`);return e}function oe(e,n=`factor`){let r=d(e,n);switch(r.kind){case`passkey`:{if(f(r,Y,n,Z),r.kekVersion!==P)throw Error(`${n}.kekVersion must be ${P}`);let e=o(r.rpId);if(!e.ok)throw Error(`${n}.rpId ${e.error.message}`);let i=t(r.credentialIdB64u);if(!i.ok)throw Error(`${n}.credentialIdB64u ${i.error.message}`);return H({rpId:e.value,credentialIdB64u:i.value})}case`email_otp`:if(f(r,X,n,Z),r.kekVersion!==F)throw Error(`${n}.kekVersion must be ${F}`);return U({enrollmentId:Q(r.enrollmentId,`${n}.enrollmentId`),enrollmentSealKeyVersion:Q(r.enrollmentSealKeyVersion,`${n}.enrollmentSealKeyVersion`)});default:throw Error(`${n}.kind must be passkey or email_otp`)}}const se=[`kind`,`envelopeId`,`walletId`,`ownership`,`binding`,`factor`,`envelopeVersion`,`envelopeRevision`,`nonceB64u`,`sealedCustodySecretB64u`,`ciphertextDigestB64u`,`aadHashB64u`,`lifecycle`,`createdAtMs`,`updatedAtMs`];function ce(e,t=`walletCustodyEnvelope`){let i=d(e,t);if(i.kind!==`wallet_custody_envelope_v2`)throw Error(`${t}.kind must be ${N}`);if(f(i,se,t),i.envelopeVersion!==`wallet_custody_envelope_v2`)throw Error(`${t}.envelopeVersion must be ${N}`);let a=n(i.envelopeId);if(!a.ok)throw Error(`${t}.envelopeId ${a.error.message}`);let o=r(i.walletId);if(!o.ok)throw Error(`${t}.walletId ${o.error.message}`);let s=L(i.ownership,`${t}.ownership`),c=m(i.createdAtMs,`${t}.createdAtMs`),l=m(i.updatedAtMs,`${t}.updatedAtMs`);if(l<c)throw Error(`${t}.updatedAtMs cannot precede createdAtMs`);return q({envelopeId:a.value,walletId:o.value,ownership:s,binding:M(i.binding,`${t}.binding`),factor:oe(i.factor,`${t}.factor`),envelopeRevision:p(i.envelopeRevision,`${t}.envelopeRevision`),nonceB64u:h(i.nonceB64u,`${t}.nonceB64u`),sealedCustodySecretB64u:te(i.sealedCustodySecretB64u,`${t}.sealedCustodySecretB64u`),ciphertextDigestB64u:v(i.ciphertextDigestB64u,`${t}.ciphertextDigestB64u`),aadHashB64u:v(i.aadHashB64u,`${t}.aadHashB64u`),lifecycle:ae(i.lifecycle,`${t}.lifecycle`),createdAtMs:c,updatedAtMs:l})}function le(e,t){return e.kind===t.kind?e.kind===`unbound`?!0:t.kind===`method_bound`&&String(e.walletAuthMethodId)===String(t.walletAuthMethodId):!1}function $(e){if(!e.establishedCustody)throw Error(`only a custody-establishing commit issues recovery codes`);return{...e,recoveryBackupAcknowledged:!0}}function ue(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} walletCustody must be an object`);let n=e;switch(n.status){case`not_requested`:case`committed`:case`custody_already_established`:return{status:n.status};case`joined`:{let e=n.keyManifestDigestB64u;if(typeof e!=`string`||!e)throw Error(`${t} joined custody carries no key manifest digest`);return{status:`joined`,keyManifestDigestB64u:e}}case`rejected`:{let e=n.reason;if(typeof e!=`string`||!e)throw Error(`${t} rejected custody carries no reason`);return{status:`rejected`,reason:e}}default:throw Error(`${t} walletCustody status is unrecognised`)}}export{U as a,H as c,ce as d,z as f,S as h,W as i,R as l,w as m,$ as n,V as o,le as p,N as r,q as s,ue as t,B as u};

package/dist/public/sdk/presignaturePool-DwlTReFO.js

@@ -1 +0,0 @@
-import{c as e,l as t}from"./normalize-kUDm5zfS.js";import{i as n,r}from"./base64-CsEj-_bC.js";import{r as i}from"./secureRandomId-BIekT8bE.js";import{m as a,p as o}from"./digestEncoding-Dzc1rzWV.js";import{B as s,F as c,G as l,I as u,R as d,dt as ee,z as f}from"./emailOtpEcdsaDerivationIdentity-B8HzTh4T.js";import{I as p,L as m,R as h}from"./ecdsaCapabilityManifest-BlzJAQF8.js";import{ct as g,n as _,ut as v}from"./walletOwnershipGeneration-DoXVMDWe.js";import{t as y}from"./presignatures-DB2IPD-A.js";import{i as b,n as x,r as te,u as S}from"./trace-BvbCxdXF.js";import{A as ne,C,D as re,E as ie,O as ae,S as w,T,k as E,w as oe,x as D,y as se}from"./ecdsaDerivationClientWasm-CVeNEou2.js";import{t as O}from"./authorizationAdmission-Ckx6q6tp.js";import{t as k}from"./walletSessionFailure-Bu4VPKTz.js";import{c as ce,f as A,o as le,t as j}from"./routerAbNormalSigning-BG75eyI2.js";import{o as M,s as ue,t as de}from"./evmCryptoWasm-BXsIyRon.js";async function fe(e){let t=e.clientShare.material;if(t.kind===`worker_loaded`)return;let n=await se({materialHandle:e.clientShare.handle.materialHandle,bindingDigest:e.clientShare.handle.bindingDigest,stateBlob:t.stateBlob,workerCtx:e.workerCtx});if(n.materialHandle!==e.clientShare.handle.materialHandle||n.bindingDigest!==e.clientShare.handle.bindingDigest)throw Error(`[multichain] ECDSA role-local worker material handle mismatch`)}async function pe(e){let t=e.signerSession,n=t.clientShare;if(n.kind===`linked_holder_worker_share`){let e=n.holderHandleId;return{signerSession:t,clientSigningMaterial:me(e),cleanupAfterSign:async()=>void 0}}let r=n;return{signerSession:t,clientSigningMaterial:{kind:`router_ab_ecdsa_derivation_client_signing_material_source_v1`,initClientPresignSession:async t=>(await fe({workerCtx:e.workerCtx,clientShare:r}),await ae({materialHandle:r.handle.materialHandle,material:r.material.kind===`worker_loaded`?{kind:`persisted`,materialRef:r.material.materialRef}:{kind:`runtime_loaded`,expectedBindingDigest:r.handle.bindingDigest},...t})),stepClientPresignSession:E,abortClientPresignSession:re,admitClientPresignature:C,destroyClientPresignature:ie,reserveClientPresignature:ne,commitClientPresignature:oe,listAvailableClientPresignatures:w.bind(void 0,`role_local_derivation_handle`),computeSignatureShareFromPresignatureHandle:T},cleanupAfterSign:async()=>void 0}}async function N(e,t){return await D({holderHandleId:e,...t})}function me(e){return{kind:`router_ab_ecdsa_derivation_client_signing_material_source_v1`,initClientPresignSession:N.bind(void 0,e),stepClientPresignSession:E,abortClientPresignSession:re,admitClientPresignature:C,destroyClientPresignature:ie,reserveClientPresignature:ne,commitClientPresignature:oe,listAvailableClientPresignatures:w.bind(void 0,`linked_holder_signing_material`),computeSignatureShareFromPresignatureHandle:T}}function P(e,t,n,r){let i=Math.floor(Number(e));return Number.isFinite(i)?i<n?n:i>r?r:i:t}function he(e,t){return P(e,t,1,5)}function ge(e,t,n){return P(e,t,0,n)}function _e(e){let t=e||A,n=he(t.targetDepth,A.targetDepth),r=ge(t.lowWatermark,A.lowWatermark,n);return{enabled:typeof t.enabled==`boolean`?t.enabled:A.enabled,targetDepth:n,lowWatermark:r,maxRefillInFlight:P(t.maxRefillInFlight,A.maxRefillInFlight,1,8),refillAttemptTimeoutMs:P(t.refillAttemptTimeoutMs,A.refillAttemptTimeoutMs,5e3,12e4)}}function ve(e){let t=Math.floor(Number(e));return Number.isFinite(t)&&t>0?t:2e4}function ye(e){return String(e&&typeof e==`object`&&`message`in e?e.message:e||``)}function be(e){return Error(`[router-ab-ecdsa-derivation] ${e.operation} request timed out after ${e.timeoutMs}ms`)}async function xe(e){let t=ve(e.timeoutMs),n=typeof AbortController==`function`?new AbortController:null,r={...e.init},i=null,o=null,s=!1;try{let c;if(n){let l=e.init.signal;if(l){if(l.aborted)n.abort();else if(typeof l.addEventListener==`function`){let e=()=>n.abort();l.addEventListener(`abort`,e,{once:!0}),o=()=>l.removeEventListener(`abort`,e)}}i=setTimeout(()=>{s=!0,n.abort()},t),c=await a(new Request(e.url,{...r,signal:n.signal}))}else c=await Promise.race([a(new Request(e.url,r)),new Promise((n,r)=>{i=setTimeout(()=>{s=!0,r(be({operation:e.operation,timeoutMs:t}))},t)})]);let l=await c.json().catch(()=>({}));if(s)throw be({operation:e.operation,timeoutMs:t});return{response:c,data:l}}catch(n){if(s)throw be({operation:e.operation,timeoutMs:t});let r=ye(n);throw Error(r||`[router-ab-ecdsa-derivation] ${e.operation} request failed`)}finally{i&&clearTimeout(i),o?.()}}const Se=5e3;function Ce(e,t){let n=Math.min(e-Date.now(),t??Se,Se);return Number.isFinite(n)&&n>0?n:null}function we(n){return t(e(n))||null}function Te(e){let t={"Content-Type":`application/json`};switch(e.credential.kind){case`operation_step_up`:return{ok:!0,headers:t,credentials:`omit`};case`wallet_session_opaque`:{let n=String(e.credential.walletSessionToken||``).trim();return n?(Object.assign(t,o({token:n,home:e.credential.home})),{ok:!0,headers:t,credentials:`omit`}):{ok:!1,code:`invalid_args`,message:`Missing opaque Wallet Session token for Router A/B ECDSA derivation presign pool fill`}}}}function Ee(e){switch(e.authorization.kind){case`reusable_wallet_session`:return{authorization:e.authorization};case`operation_step_up`:{let t=e.operation;if(!t)throw Error(`Operation step-up pool fill requires exact operation preparation`);return{authorization:e.authorization,operation:t}}}}function De(e){let t=String(e.keyHandle||``).trim();return t?{ok:!0,value:{keyHandle:t}}:{ok:!1,code:`invalid_args`,message:`Missing keyHandle for Router A/B ECDSA derivation pool-fill init`}}async function Oe(e){let t=we(e.relayerUrl);if(!t)return{ok:!1,code:`invalid_args`,message:`Missing relayerUrl for Router A/B ECDSA derivation pool-fill init`};if(typeof fetch!=`function`)return{ok:!1,code:`unsupported`,message:`fetch is not available for Router A/B ECDSA derivation pool-fill init`};let n=De(e);if(!n.ok)return n;let r=String(e.requestTag||``).trim(),i=Te(e);if(!i.ok)return i;let a=Ce(e.poolFill.ceremonyExpiresAtMs,e.requestTimeoutMs);if(a===null)return{ok:!1,code:`presign_timeout`,message:`Presign ceremony deadline has elapsed`};try{let{response:o,data:s}=await xe({url:`${t}${e.path}`,operation:`presign/init`,timeoutMs:a,init:{method:`POST`,headers:i.headers,credentials:i.credentials,body:JSON.stringify({...n.value,count:Number.isFinite(e.count)?Math.max(1,Math.floor(Number(e.count))):1,...r?{requestTag:r}:{},poolFill:e.poolFill,presignSessionId:e.presignSessionId,firstMessageB64u:e.firstMessageB64u,...Ee(e)})}});return typeof s.presignSessionId==`string`&&x(s.presignSessionId,`init`,o.headers.get(`Server-Timing`)),o.ok?{ok:s.ok===!0,presignSessionId:s.presignSessionId,...Number.isSafeInteger(s.ceremonyExpiresAtMs)?{ceremonyExpiresAtMs:s.ceremonyExpiresAtMs}:{},...Number.isSafeInteger(s.materialExpiresAtMs)?{materialExpiresAtMs:s.materialExpiresAtMs}:{},stage:s.stage,outgoingMessagesB64u:Array.isArray(s.outgoingMessagesB64u)?s.outgoingMessagesB64u:[],...s.code?{code:s.code}:{},...s.message?{message:s.message}:{}}:{ok:!1,code:s.code||`http_error`,message:s.message||`HTTP ${o.status}`}}catch(e){return{ok:!1,code:`network_error`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||`Failed Router A/B ECDSA derivation pool-fill init`)}}}async function ke(e){return Oe({...e,path:c})}async function Ae(e){let t=we(e.relayerUrl);if(!t)return{ok:!1,code:`invalid_args`,message:`Missing relayerUrl for Router A/B ECDSA derivation pool-fill step`};if(typeof fetch!=`function`)return{ok:!1,code:`unsupported`,message:`fetch is not available for Router A/B ECDSA derivation pool-fill step`};let n=String(e.presignSessionId||``).trim();if(!n)return{ok:!1,code:`invalid_args`,message:`Missing presignSessionId for Router A/B ECDSA derivation pool-fill step`};let r=String(e.requestTag||``).trim(),i=Te(e);if(!i.ok)return i;let a=Ce(e.ceremonyExpiresAtMs,e.requestTimeoutMs);if(a===null)return{ok:!1,code:`presign_timeout`,message:`Presign ceremony deadline has elapsed`};try{let{response:o,data:s}=await xe({url:`${t}${e.path}`,operation:`presign/step`,timeoutMs:a,init:{method:`POST`,headers:i.headers,credentials:i.credentials,body:JSON.stringify({presignSessionId:n,ceremonyExpiresAtMs:e.ceremonyExpiresAtMs,materialExpiresAtMs:e.materialExpiresAtMs,stage:e.stage,outgoingMessagesB64u:Array.isArray(e.outgoingMessagesB64u)?e.outgoingMessagesB64u:[],...r?{requestTag:r}:{},...Ee(e)})}});return x(n,`step`,o.headers.get(`Server-Timing`)),o.ok?{ok:s.ok===!0,stage:s.stage,event:s.event,outgoingMessagesB64u:Array.isArray(s.outgoingMessagesB64u)?s.outgoingMessagesB64u:[],...s.presignatureId?{presignatureId:s.presignatureId}:{},...s.bigRB64u?{bigRB64u:s.bigRB64u}:{},...s.code?{code:s.code}:{},...s.message?{message:s.message}:{}}:{ok:!1,code:s.code||`http_error`,message:s.message||`HTTP ${o.status}`}}catch(e){return{ok:!1,code:`network_error`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||`Failed Router A/B ECDSA derivation pool-fill step`)}}}async function je(e){return Ae({...e,path:u})}var Me=class{constructor(){this.state={kind:`refilling`,revision:0},this.waiters=new Map}snapshot(){return this.state}hasForegroundWaiters(){for(let e of this.waiters.values())if(e===`foreground`)return!0;return!1}publishAvailable(){this.state.kind!==`settled`&&(this.state={kind:`refilling`,revision:this.state.revision+1},this.flushWaiters())}settle(){this.state.kind!==`settled`&&(this.state={kind:`settled`,revision:this.state.revision},this.flushWaiters())}waitForChange(e,t){return this.state.kind===`settled`||this.state.revision!==e.revision?Promise.resolve(this.state):new Promise(n=>{this.waiters.set(n,t),(this.state.kind===`settled`||this.state.revision!==e.revision)&&(this.waiters.delete(n),n(this.state))})}flushWaiters(){let e=this.state,t=[...this.waiters.keys()];this.waiters.clear();for(let n of t)n(e)}};function Ne(){let e=globalThis.crypto;if(!e||typeof e.getRandomValues!=`function`)throw Error(`WebCrypto getRandomValues is required for ECDSA rerandomization`);return e.getRandomValues(new Uint8Array(32))}function F(e){switch(e.authorization.kind){case`reusable_wallet_session`:return{authorization:e.authorization};case`operation_step_up`:{let t=e.operation;if(!t)throw Error(`Operation step-up pool fill requires exact operation preparation`);return{authorization:e.authorization,operation:t}}}}function Pe(e){return String(e&&typeof e==`object`&&`message`in e?e.message:e||`signature recovery failed`)}function I(e){e instanceof Uint8Array&&e.fill(0)}function Fe(e){if(e?.kind!==`router_ab_ecdsa_derivation_client_signing_material_source_v1`)throw Error(`Router A/B ECDSA derivation client signing material source is required`)}const Ie=6e4,L=new Map,R=new Map,z=new Map,B=new Map,V=new Map,H=new Map;function Le(e){return e===`triples_done`||e===`presign`||e===`done`}function Re(e){return Le(e.clientStage)&&Le(e.serverStage)?`presign`:`triples`}function ze(e){let t=L.get(e);if(!t?.length)return null;let n=t.shift()??null;return t.length?L.set(e,t):L.delete(e),n}async function U(e){return await Ue(e),ze(e.poolKey)}function Be(e,t,n){if(!K(n))return`invalid`;let r=L.get(e)||[];for(let e of r)if(e.materialHandle===n.materialHandle)return`duplicate`;return r.filter(e=>K(e)).length>=5?`capacity_full`:(r.push(n),L.set(e,r),R.set(e,t),`stored`)}function Ve(e,t=Date.now()){let n=L.get(e);if(!n?.length)return[];let r=[],i=[];for(let e of n)K(e,t)?r.push(e):i.push(e);return r.length>0?L.set(e,r):L.delete(e),i}async function He(e){for(let t of e.refs)await e.clientSigningMaterial.destroyClientPresignature({materialHandle:t.materialHandle,poolIdentity:e.poolIdentity,workerCtx:e.workerCtx}).catch(()=>{})}async function Ue(e){await He({refs:Ve(e.poolKey),poolIdentity:e.poolIdentity,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx})}async function W(e,t,n){try{await _(e.walletId,e.ownershipGeneration)}catch(r){throw await qe({poolIdentity:e,poolKey:g(e),clientSigningMaterial:t,workerCtx:n}),r}}async function We(e){await W(e.poolIdentity,e.clientSigningMaterial,e.workerCtx);let t=V.get(e.poolKey);if(t){await t;return}let n=Ge(e);V.set(e.poolKey,n);try{await n}finally{V.get(e.poolKey)===n&&V.delete(e.poolKey)}}async function Ge(e){await Ue(e);let t;t=await e.clientSigningMaterial.listAvailableClientPresignatures({poolIdentity:e.poolIdentity,workerCtx:e.workerCtx});try{await W(e.poolIdentity,e.clientSigningMaterial,e.workerCtx)}catch{}if(q(e.poolKey)!==e.generation){for(let n of t)I(n.bigR33),await e.clientSigningMaterial.destroyClientPresignature({materialHandle:n.materialHandle,poolIdentity:e.poolIdentity,workerCtx:e.workerCtx}).catch(()=>{});return}for(let r of t){let t=Be(e.poolKey,e.poolIdentity,{presignatureId:r.presignatureId,materialHandle:r.materialHandle,bigRB64u:n(r.bigR33),createdAtMs:r.createdAtMs,expiresAtMs:r.expiresAtMs});I(r.bigR33),(t===`invalid`||t===`capacity_full`)&&await e.clientSigningMaterial.destroyClientPresignature({materialHandle:r.materialHandle,poolIdentity:e.poolIdentity,workerCtx:e.workerCtx}).catch(()=>{})}}function G(e){let t=L.get(e);return t?t.reduce((e,t)=>e+(K(t)?1:0),0):0}function K(e,t=Date.now()){let n=Math.floor(Number(e.expiresAtMs));return!!(e.presignatureId&&e.bigRB64u&&e.materialHandle)&&Number.isSafeInteger(n)&&n>t+2e3}function q(e){let t=H.get(e);return t===void 0?(H.set(e,0),0):t}function Ke(e){Z(e);let t=q(e)+1;return H.set(e,t),t}async function qe(e){let t=L.get(e.poolKey)??[];$e(e.poolKey),await He({...e,refs:t})}function J(e){return B.get(e)||0}function Je(e){let t=J(e);B.set(e,t+1)}function Ye(e){let t=J(e);if(t<=1){B.delete(e),Q(e,0);return}B.set(e,t-1)}async function Xe(e,t){let n=z.get(e);if(!n)return;let r=n.snapshot();for(;G(e)===0&&r.kind===`refilling`;)r=await n.waitForChange(r,t)}async function Ze(e){let t=g(v({ownershipGeneration:e.ownershipGeneration,relayerUrl:e.relayerUrl,scope:e.scope,materialActivation:e.materialActivation}));return G(t)>0?!0:(await Xe(t,`background`),G(t)>0)}function Y(e,t,n){return{scheduled:!1,reason:e,depth:t,targetDepth:n}}function Qe(){let e=new Set([...X.keys(),...L.keys(),...z.keys(),...B.keys(),...H.keys()]);for(let t of e)Ke(t);L.clear(),R.clear();for(let e of z.values())e.settle();z.clear(),B.clear()}function $e(e){L.delete(e),R.delete(e),Ke(e),z.get(e)?.settle(),z.delete(e)}function et(e){let t=String(e).trim();if(!t)throw Error(`ECDSA presignature wallet id is required`);for(let[e,n]of[...R])n.walletId===t&&$e(e)}const X=new Map;function Z(e){let t=X.get(e);t&&t.timer!==null&&clearTimeout(t.timer),X.delete(e),X.size===0&&typeof window<`u`&&(window.removeEventListener(`online`,$),document.removeEventListener(`visibilitychange`,$))}function Q(e,t){let n=X.get(e);if(!n)return;n.timer!==null&&clearTimeout(n.timer);let r=n.input.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs-Date.now();if(r<=0||q(e)!==n.generation){Z(e);return}n.timer=setTimeout(tt,Math.min(t,r),e)}function $(){if(!(typeof document<`u`&&document.visibilityState===`hidden`))for(let e of X.keys())Q(e,0)}function tt(e){let t=X.get(e);if(!t)return;if(t.timer=null,Date.now()>=t.input.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs){Z(e);return}if(typeof navigator<`u`&&navigator.onLine===!1){Q(e,3e4);return}let n=at(t.input);n.scheduled||Q(e,n.depth>=n.targetDepth?3e4:5e3)}function nt(e,t){t.authorization.kind===`reusable_wallet_session`&&X.get(e)?.input!==t&&(Z(e),X.size===0&&typeof window<`u`&&(window.addEventListener(`online`,$),document.addEventListener(`visibilitychange`,$)),X.set(e,{input:t,generation:q(e),failures:0,timer:null}),Q(e,3e4))}function rt(e,t,n){let r=X.get(e);if(!(!r||r!==t)){switch(n){case`network_error`:case`internal`:case`presign_timeout`:case`temporarily_unavailable`:case`service_unavailable`:case`wallet_session_unavailable`:if(r.failures+=1,r.failures<=3)return}Z(e)}}async function it(e){let{args:t,refillInput:n,poolKey:r,poolIdentity:i,scheduledGeneration:a,targetDepth:o,refillAttemptTimeoutMs:s,progress:c}=e,l=X.get(r)??null;try{for(await We({poolKey:r,poolIdentity:i,clientSigningMaterial:t.clientSigningMaterial,workerCtx:t.workerCtx,generation:a}),G(r)>0&&c.publishAvailable();Date.now()<t.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs;){if(q(r)!==a||(X.get(r)??null)!==l||G(r)>=o||J(r)>0||typeof navigator<`u`&&navigator.onLine===!1)return;let e=Math.min(Date.now()+s,t.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs),i=await _t({...n,routerAbEcdsaDerivationPoolFill:{kind:`router_ab_ecdsa_derivation_signing_worker_pool`,scope:n.routerAbEcdsaDerivationPoolFill.scope,ceremonyExpiresAtMs:e,materialExpiresAtMs:n.routerAbEcdsaDerivationPoolFill.materialExpiresAtMs},trafficClass:`background`});if(S(`evm-family`,{event:`ecdsa_background_refill_result`,authorization:t.authorization.kind,outcome:i.ok?`available`:`failed`,code:i.ok?null:i.code,depth:G(r),targetDepth:o}),!i.ok){rt(r,l,i.code);return}let u=X.get(r);u&&u===l&&(u.failures=0),c.publishAvailable()}}catch{rt(r,l,`internal`)}finally{c.settle(),z.get(r)===c&&z.delete(r);let e=X.get(r);if(e){let t=e.failures>0?2e3*2**e.failures:1e3;G(r)>=o&&(t=3e4),e!==l&&(t=0),Q(r,t)}}}function at(e){try{let t=_e(e.poolPolicy),n=v({ownershipGeneration:e.credential.ownershipGeneration,relayerUrl:e.relayerUrl,scope:e.routerAbEcdsaDerivationPoolFill.scope,materialActivation:e.materialActivation}),r=g(n);R.set(r,n);let i=he(e.targetDepth,t.targetDepth),a=ge(e.triggerIfDepthAtOrBelow,t.lowWatermark,i),o=G(r),s=q(r);if(!t.enabled)return Y(`disabled`,o,i);if(e.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs<=Date.now())return Z(r),Y(`invalid_args`,o,i);if(nt(r,e),o>a)return Y(`depth_above_trigger`,o,i);if(o>=i)return Y(`depth_at_or_above_target`,o,i);if(z.has(r)||J(r)>0)return Y(`in_flight_for_pool_key`,o,i);if(z.size>=t.maxRefillInFlight)return Y(`global_in_flight_limit`,o,i);let c={relayerUrl:e.relayerUrl,keyHandle:e.keyHandle,ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,clientVerifyingShareB64u:e.clientVerifyingShareB64u,clientSigningMaterial:e.clientSigningMaterial,thresholdEcdsaPublicKeyB64u:e.thresholdEcdsaPublicKeyB64u,relayerVerifyingShareB64u:e.relayerVerifyingShareB64u,credential:e.credential,materialActivation:e.materialActivation,routerAbEcdsaDerivationPoolFill:e.routerAbEcdsaDerivationPoolFill,workerCtx:e.workerCtx,...F(e)},l=new Me;return z.set(r,l),it({args:e,refillInput:c,poolKey:r,poolIdentity:n,scheduledGeneration:s,targetDepth:i,refillAttemptTimeoutMs:t.refillAttemptTimeoutMs,progress:l}),{scheduled:!0,reason:`scheduled`,depth:o,targetDepth:i}}catch{return Y(`invalid_args`,0,0)}}function ot(e){return e.map(e=>n(e))}function st(e){return Array.isArray(e)?e.map(e=>String(e||``).trim()).filter(e=>!!e).map(e=>r(e)):[]}async function ct(e){let t=String(e.thresholdEcdsaPublicKeyB64u||``).trim();if(t){let n=r(t);if(n.length!==33)throw Error(`thresholdEcdsaPublicKeyB64u must decode to 33 bytes`);return await M({publicKey33:n,workerCtx:e.workerCtx})}let n=String(e.clientVerifyingShareB64u||``).trim(),i=String(e.relayerVerifyingShareB64u||``).trim();if(!n||!i)throw Error(`Missing thresholdEcdsaPublicKeyB64u (or relayerVerifyingShareB64u fallback) for Router A/B ECDSA derivation signing`);let a=r(n),o=r(i);if(a.length!==33)throw Error(`clientVerifyingShareB64u must decode to 33 bytes`);if(o.length!==33)throw Error(`relayerVerifyingShareB64u must decode to 33 bytes`);return await de({left33:await M({publicKey33:a,workerCtx:e.workerCtx}),right33:await M({publicKey33:o,workerCtx:e.workerCtx}),workerCtx:e.workerCtx})}function lt(e){return e.trafficClass===`foreground`||z.get(e.poolKey)?.hasForegroundWaiters()?`foreground_presign_pool_refill`:`background_presign_pool_refill`}async function ut(e){for(let t=0;t<2;t+=1){let n=await dt(e);if(n.ok||!ft(n)||t===1)return n}return{ok:!1,code:`stale_session_state`,message:`Router A/B ECDSA derivation pool-fill session stayed stale after retry`}}async function dt(e){Fe(e.clientSigningMaterial);let t=performance.now(),r=e.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs,i=e.routerAbEcdsaDerivationPoolFill.materialExpiresAtMs,a=`ecdsa-presign-v2:${r}:${n(crypto.getRandomValues(new Uint8Array(32)))}`,o=a,s=v({ownershipGeneration:e.credential.ownershipGeneration,relayerUrl:e.relayerUrl,scope:e.routerAbEcdsaDerivationPoolFill.scope,materialActivation:e.materialActivation}),c=null,l=null,u=null,d=null,ee=!1,f=`triples`,p=[],m=!0,h=!1;try{let t=await e.clientSigningMaterial.initClientPresignSession({sessionId:o,groupPublicKey33:e.groupPublicKey33,ceremonyExpiresAtMs:r,materialExpiresAtMs:i,poolIdentity:s,workerCtx:e.workerCtx});if(t.stage!==`triples`||t.outgoingMessages.length!==1)return{ok:!1,code:`presign_init_failed`,message:`Client presign init must emit exactly one first message`};f=t.stage;let g=await ke({relayerUrl:e.relayerUrl,...e.poolFillInitKeySelector,count:1,presignSessionId:a,firstMessageB64u:n(t.outgoingMessages[0]),credential:e.credential,requestTag:lt(e),poolFill:e.routerAbEcdsaDerivationPoolFill,...F(e)});if(!g.ok)return{ok:!1,code:g.code||`presign_init_failed`,message:g.message||`Presign initialization failed`};if(g.presignSessionId!==a||g.ceremonyExpiresAtMs!==r||g.materialExpiresAtMs!==i||r<=Date.now())return{ok:!1,code:`invalid_pool_fill_expiry`,message:`Presign initialization changed the bound identity or deadlines`};let _=g.stage||`triples`,v=st(g.outgoingMessagesB64u);for(let t=0;t<64;t++){if(v.length>0&&!c){let t=await e.clientSigningMaterial.stepClientPresignSession({sessionId:o,stage:Re({clientStage:f,serverStage:_}),incomingMessages:v,workerCtx:e.workerCtx});f=t.stage,v=[],p.push(...t.outgoingMessages),t.presignatureHandle&&t.presignatureBigR33&&(c=t.presignatureHandle,l=t.presignatureBigR33)}if(!ee){let n=performance.now(),o=lt(e),s={relayerUrl:e.relayerUrl,presignSessionId:a,ceremonyExpiresAtMs:r,materialExpiresAtMs:i,stage:Re({clientStage:f,serverStage:_}),outgoingMessagesB64u:ot(p),credential:e.credential,requestTag:o,...F(e)},c=await je(s);if(S(`evm-family`,{event:`ecdsa_presignature_round`,requestTag:o,presignSessionId:a,authorization:e.authorization.kind,round:t,stage:s.stage,durationMs:performance.now()-n,outcome:c.ok?`succeeded`:`failed`}),p=[],!c.ok)return{ok:!1,code:c.code||`presign_step_failed`,message:c.message||`Router A/B ECDSA derivation pool-fill step failed`};v=st(c.outgoingMessagesB64u),_=c.stage||_,c.event===`presign_done`&&(u=String(c.presignatureId||``).trim()||null,d=String(c.bigRB64u||``).trim()||null,ee=!0)}if(c&&l&&u&&d)break}if(!c||!l)return{ok:!1,code:`presign_timeout`,message:`Client presign session did not reach done state`};if(!u||!d)return{ok:!1,code:`presign_timeout`,message:`Server presign session did not reach done state`};if(l.length!==33)return{ok:!1,code:`internal`,message:`Invalid local presignature bigR bytes (expected 33, got ${l.length})`};try{let t=Date.now(),r=n(l);if(r!==d)return{ok:!1,code:`presign_mismatch`,message:`Client/server presignature mismatch (bigR mismatch)`};let a=await e.clientSigningMaterial.admitClientPresignature({materialHandle:c,expectedPresignatureId:u,poolIdentity:s,admissionMode:e.authorization.kind===`operation_step_up`?`resident`:`durable`,workerCtx:e.workerCtx});return a.kind===`discarded_capacity`?{ok:!1,code:`pool_full`,message:`Router A/B ECDSA derivation client presignature pool is full`}:a.kind===`discarded_ambiguous`?{ok:!1,code:`presign_failed`,message:`Router A/B ECDSA derivation client presignature admission was ambiguous`}:(h=!0,m=!1,{ok:!0,kind:`available`,presignature:{presignatureId:u,bigRB64u:r,materialHandle:c,createdAtMs:t,expiresAtMs:i}})}finally{I(l)}}catch(e){return{ok:!1,code:`presign_failed`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||`Router A/B ECDSA derivation pool-fill handshake failed`)}}finally{S(`evm-family`,{event:`ecdsa_presignature_generation`,requestTag:lt(e),presignSessionId:a,authorization:e.authorization.kind,durationMs:performance.now()-t,outcome:h?`available`:`failed`}),I(l),!h&&c&&await e.clientSigningMaterial.destroyClientPresignature({materialHandle:c,poolIdentity:s,workerCtx:e.workerCtx}).catch(()=>{}),m&&await e.clientSigningMaterial.abortClientPresignSession({sessionId:o,workerCtx:e.workerCtx}).catch(()=>{})}}function ft(e){return e.code===`stale_session_state`||e.code===`stale_pool_fill_session`}function pt(e){let t=l(e);return{ecdsaThresholdKeyId:p(t.ecdsa_threshold_key_id),clientVerifyingShareB64u:h(t.public_identity.derivation_client_share_public_key33_b64u),thresholdEcdsaPublicKeyB64u:t.public_identity.threshold_public_key33_b64u}}function mt(e){let t=Math.floor(Number(e.materialExpiresAtMs)),n=Number.isSafeInteger(e.authorizationExpiresAtMs)?Math.floor(Number(e.authorizationExpiresAtMs)):e.nowMs+Ie,r=Math.min(t,n,e.nowMs+Ie);return Number.isSafeInteger(r)&&r>e.nowMs?r:null}async function ht(e,t,a){let o=null,c=null,l=null,u=null,d=null,p={kind:`unclaimed`},m=null,h={kind:`before_prepare`};try{let _=String(e.relayerUrl||``).trim().replace(/\/+$/g,``);if(!_)return{ok:!1,code:`invalid_args`,message:`Missing relayerUrl for Router A/B ECDSA derivation signing`};let y=pt(e.scope);if(!y.ecdsaThresholdKeyId)return{ok:!1,code:`invalid_args`,message:`Missing ecdsaThresholdKeyId for Router A/B ECDSA derivation signing`};let x=y.clientVerifyingShareB64u;if(!x)return{ok:!1,code:`invalid_args`,message:`Missing clientVerifyingShareB64u for Router A/B ECDSA derivation signing`};if(!(e.signingDigest32 instanceof Uint8Array)||e.signingDigest32.length!==32)return{ok:!1,code:`invalid_args`,message:`signingDigest32 must be 32 bytes for Router A/B ECDSA derivation signing`};let ne=performance.now(),C=await ct({clientVerifyingShareB64u:x,thresholdEcdsaPublicKeyB64u:y.thresholdEcdsaPublicKeyB64u,workerCtx:e.workerCtx});b(e.operationId,`public_key_validation`,ne),c=v({ownershipGeneration:e.credential.ownershipGeneration,relayerUrl:_,scope:e.scope,materialActivation:e.materialActivation}),await W(c,e.clientSigningMaterial,e.workerCtx),o=g(c),R.set(o,c),m=q(o);let re=performance.now();if(l=await U({poolKey:o,poolIdentity:c,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx}),b(e.operationId,`pool_lookup`,re),!l){let t=performance.now();await We({poolKey:o,poolIdentity:c,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx,generation:m}),b(e.operationId,`pool_restore`,t),m=q(o),l=await U({poolKey:o,poolIdentity:c,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx})}if(!l){let t=performance.now();await Xe(o,`foreground`),b(e.operationId,`refill_wait`,t),m=q(o),l=await U({poolKey:o,poolIdentity:c,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx})}if(!l&&a.kind===`on_demand`){let t=performance.now();Je(o);try{let t=await _t({...a.refill,trafficClass:`foreground`});if(!t.ok&&t.code===`invalidated`&&(t=await _t({...a.refill,trafficClass:`foreground`})),!t.ok&&t.code!==`pool_full`)return t;!t.ok&&t.code===`pool_full`&&await We({poolKey:o,poolIdentity:c,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx,generation:q(o)})}finally{Ye(o)}m=q(o),l=await U({poolKey:o,poolIdentity:c,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx}),b(e.operationId,`foreground_refill`,t)}if(S(`evm-family`,{event:`ecdsa_presignature_selection`,operationId:e.operationId,authorization:e.authorization.kind,outcome:l?`available`:`empty`,remainingDepth:G(o),attempt:t}),!l)return{ok:!1,code:`pool_empty`,message:`Router A/B ECDSA derivation client presignature pool is empty`};let ie=Date.now(),ae=mt({authorizationExpiresAtMs:e.expiresAtMs,materialExpiresAtMs:l.expiresAtMs,nowMs:ie});if(!ae)return{ok:!1,code:`pool_entry_expired`,message:`Router A/B ECDSA derivation client presignature is expired`};if(await W(c,e.clientSigningMaterial,e.workerCtx),m!==q(o))return{ok:!1,code:`pool_entry_unavailable`,message:`Router A/B ECDSA derivation client presignature pool was invalidated before prepare`};d=Ne();let w=await ee(d),T=s({scope:e.scope,requestId:i(`router-ab-ecdsa-sign`,32,`Router A/B ECDSA derivation sign request`),operationId:e.operationId,operationDigests:e.operationDigests,authorization:e.authorization,materialActivation:e.materialActivation,clientPresignatureId:l.presignatureId,expiresAtMs:ae,signingDigest32:e.signingDigest32,clientRerandomizationCommitment32:w});I(w);let E=i(`router-ab-ecdsa-reservation`,32,`Router A/B ECDSA Client presignature reservation`);p={kind:`destroy`};let oe=performance.now(),D=await e.clientSigningMaterial.reserveClientPresignature({materialHandle:l.materialHandle,expectedPresignatureId:l.presignatureId,poolIdentity:c,requestBinding:T.request_id,reservationId:E,leaseExpiresAtMs:T.expires_at_ms,workerCtx:e.workerCtx});if(b(e.operationId,`presignature_reserve`,oe),D.kind===`unavailable`)return D.reason===`claimed_elsewhere`&&(p={kind:`owned_elsewhere`}),t<4?await ht(e,t+1,a):{ok:!1,code:D.reason===`expired`?`pool_entry_expired`:`pool_entry_unavailable`,message:`Router A/B ECDSA derivation client presignature is unavailable: ${D.reason}`};if(await W(c,e.clientSigningMaterial,e.workerCtx),m!==q(o))return{ok:!1,code:`pool_entry_unavailable`,message:`Router A/B ECDSA derivation client presignature pool was invalidated before prepare`};Q(o,0),h={kind:`prepare_submitted`};let se=performance.now(),O=await ce({relayServerUrl:_,credential:e.credential,request:T,onServerTiming:te.bind(void 0,e.operationId,`prepare`)});if(b(e.operationId,`prepare`,se),O.kind===`reusable_wallet_session`){if(!e.reconcileSession)throw Error(`Wallet Session reconciliation is required`);await e.reconcileSession(O.sessionStatus)}let k=O.signing;if(k.server_big_r33_b64u!==l.bigRB64u)return{ok:!1,code:`presign_mismatch`,message:`Router A/B ECDSA derivation SigningWorker returned a different presignature bigR`};let A=performance.now();await e.clientSigningMaterial.commitClientPresignature({materialHandle:l.materialHandle,poolIdentity:c,requestBinding:T.request_id,reservationId:E,workerCtx:e.workerCtx}),b(e.operationId,`presignature_commit`,A);let j=r(l.bigRB64u),M=r(k.signing_worker_rerandomization_contribution32_b64u);try{if(j.length!==33)return{ok:!1,code:`internal`,message:`Router A/B ECDSA derivation presign bigR must decode to 33 bytes`};if(M.length!==32)return{ok:!1,code:`internal`,message:`Router A/B ECDSA derivation SigningWorker rerandomization contribution must decode to 32 bytes`};let t=performance.now();u=await e.clientSigningMaterial.computeSignatureShareFromPresignatureHandle({materialHandle:l.materialHandle,poolIdentity:c,requestBinding:T.request_id,reservationId:E,groupPublicKey33:C,expectedPresignBigR33:j,digest32:e.signingDigest32,clientRerandomizationContribution32:d,signingWorkerRerandomizationContribution32:M,workerCtx:e.workerCtx}),b(e.operationId,`client_share`,t),p={kind:`consumed`}}finally{I(j),I(M)}if(u.length!==32)return{ok:!1,code:`internal`,message:`Invalid Router A/B ECDSA derivation client signature share length (expected 32, got ${u.length})`};let de=f({scope:e.scope,requestId:T.request_id,operationId:T.operation_id,operationDigests:T.operation_digests,authorization:e.authorization,materialActivation:e.materialActivation,expiresAtMs:T.expires_at_ms,signingDigest32:e.signingDigest32,serverPresignatureId:k.server_presignature_id,clientSignatureShare32:u,clientRerandomizationContribution32:d}),fe=performance.now(),pe=await le({relayServerUrl:_,credential:e.credential,request:de,onServerTiming:te.bind(void 0,e.operationId,`finalize`)});b(e.operationId,`finalize`,fe);let N=r(pe.signature65_b64u);if(N.length!==65)return{ok:!1,code:`internal`,message:`Router A/B ECDSA derivation returned invalid signature length (expected 65, got ${N.length})`};try{let t=performance.now();await ue({digest32:e.signingDigest32,signature65:N,publicKey33:C,workerCtx:e.workerCtx}),b(e.operationId,`signature_verify`,t)}catch(e){return{ok:!1,code:`internal`,message:`Router A/B ECDSA derivation returned a signature that does not recover to the threshold group public key: ${Pe(e)}`}}return{ok:!0,signature65:N,signature65B64u:pe.signature65_b64u,rB64u:n(N.slice(0,32)),sB64u:n(N.slice(32,64)),recId:N[64]}}catch(t){if(t instanceof O||t instanceof k)throw t;let n=String(t&&typeof t==`object`&&`message`in t?t.message:t||`Router A/B ECDSA derivation signing failed`);return t instanceof j&&t.code===`expired_local_request`?{ok:!1,code:`pool_entry_expired`,message:n}:o&&c&&m!==null&&h.kind===`before_prepare`&&q(o)!==m?(await qe({poolKey:o,poolIdentity:c,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx}),{ok:!1,code:`pool_entry_unavailable`,message:`Router A/B ECDSA derivation client presignature pool was invalidated before prepare`}):{ok:!1,code:`router_ab_sign_failed`,message:n}}finally{if(I(u),I(d),l&&c&&p.kind!==`consumed`&&p.kind!==`owned_elsewhere`){let t=!1;if(p.kind===`unclaimed`&&o&&m!==null&&m===q(o)){let e=Be(o,c,l);t=e===`stored`||e===`duplicate`}t||await e.clientSigningMaterial.destroyClientPresignature({materialHandle:l.materialHandle,poolIdentity:c,workerCtx:e.workerCtx}).catch(()=>{})}o&&Q(o,0)}}async function gt(e){let t=pt(e.scope),n=Math.floor(Number(e.expiresAtMs));if(!Number.isSafeInteger(n)||n<=Date.now())return{ok:!1,code:`invalid_pool_fill_expiry`,message:`Router A/B ECDSA derivation pool fill expiry is unavailable or expired`};let r={kind:`on_demand`,refill:{relayerUrl:e.relayerUrl,keyHandle:e.keyHandle,ecdsaThresholdKeyId:t.ecdsaThresholdKeyId,clientVerifyingShareB64u:t.clientVerifyingShareB64u,clientSigningMaterial:e.clientSigningMaterial,thresholdEcdsaPublicKeyB64u:t.thresholdEcdsaPublicKeyB64u,credential:e.credential,materialActivation:e.materialActivation,routerAbEcdsaDerivationPoolFill:{kind:`router_ab_ecdsa_derivation_signing_worker_pool`,scope:e.scope,ceremonyExpiresAtMs:Math.min(n,Date.now()+d-3e4),materialExpiresAtMs:e.authorization.kind===`operation_step_up`?n:Date.now()+y},workerCtx:e.workerCtx,...F(e)}},i=await ht(e,0,r);return!i.ok&&(i.code===`pool_entry_expired`||i.code===`pool_entry_unavailable`)?await ht(e,0,r):i}async function _t(e){try{let t=v({ownershipGeneration:e.credential.ownershipGeneration,relayerUrl:e.relayerUrl,scope:e.routerAbEcdsaDerivationPoolFill.scope,materialActivation:e.materialActivation});await W(t,e.clientSigningMaterial,e.workerCtx);let n=g(t);await Ue({poolKey:n,poolIdentity:t,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx});let r=q(n),i=await ct({clientVerifyingShareB64u:e.clientVerifyingShareB64u,thresholdEcdsaPublicKeyB64u:e.thresholdEcdsaPublicKeyB64u,relayerVerifyingShareB64u:e.relayerVerifyingShareB64u,workerCtx:e.workerCtx}),a=await ut({relayerUrl:e.relayerUrl,poolFillInitKeySelector:{keyHandle:m(e.keyHandle)},clientSigningMaterial:e.clientSigningMaterial,groupPublicKey33:i,materialActivation:e.materialActivation,credential:e.credential,poolKey:n,trafficClass:e.trafficClass,routerAbEcdsaDerivationPoolFill:e.routerAbEcdsaDerivationPoolFill,workerCtx:e.workerCtx,...F(e)});if(!a.ok)return a;try{await W(t,e.clientSigningMaterial,e.workerCtx)}catch{}if(q(n)!==r)return await e.clientSigningMaterial.destroyClientPresignature({materialHandle:a.presignature.materialHandle,poolIdentity:t,workerCtx:e.workerCtx}).catch(()=>{}),{ok:!1,code:`invalidated`,message:`Router A/B ECDSA derivation presignature pool invalidated`};let o=Be(n,t,a.presignature);return(o===`capacity_full`||o===`invalid`)&&await e.clientSigningMaterial.destroyClientPresignature({materialHandle:a.presignature.materialHandle,poolIdentity:t,workerCtx:e.workerCtx}).catch(()=>{}),{ok:!0,presignatureId:a.presignature.presignatureId}}catch(e){return{ok:!1,code:`internal`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||`Router A/B ECDSA derivation presignature refill failed`)}}}export{Ze as a,pe as c,gt as i,et as n,_e as o,at as r,me as s,Qe as t};

package/dist/public/sdk/primitives-CAcl7ON7.js

@@ -1 +0,0 @@
-import{s as e}from"./normalize-kUDm5zfS.js";import{k as t}from"./chains-CiYQT1K4.js";import{i as n,r}from"./base64-CsEj-_bC.js";import{r as i}from"./canonicalPrimitives-CKPGgpxg.js";const a=[1,2];function o(e){let t=Number(e);return!Number.isSafeInteger(t)||t<1||t>65535?null:t}function s(e){if(!Array.isArray(e)||e.length===0)return null;let t=[],n=new Set;for(let r of e){let e=o(r);if(!e)return null;n.has(e)||(n.add(e),t.push(e))}return t.sort((e,t)=>e-t),t.length?t:null}function c(t){if(!Array.isArray(t)||t.length===0)return null;let n=[];for(let r of t){if(!r||typeof r!=`object`||Array.isArray(r))return null;let t=r,i=o(t.id),a=e(t.role);if(!i||a!==`client`&&a!==`relayer`)return null;let s={id:i,role:a},c=e(t.relayerUrl);c&&(s.relayerUrl=c);let l=e(t.relayerKeyId);l&&(s.relayerKeyId=l);let u=e(t.shareDerivation);(u===`prf_first_v1`||u===`derived_master_secret_v1`||u===`kv_random_v1`||u===`unknown`)&&(s.shareDerivation=u),n.push(s)}return n.length?n:null}function l(t){let n=e(t.relayerKeyId),r=e(t.relayerUrl),i=o(t.clientParticipantId)??1,a=o(t.relayerParticipantId)??2;return[{id:i,role:`client`,shareDerivation:t.clientShareDerivation||`prf_first_v1`},{id:a,role:`relayer`,...r?{relayerUrl:r}:{},...n?{relayerKeyId:n}:{},...t.relayerShareDerivation?{shareDerivation:t.relayerShareDerivation}:{}}]}function u(t,n){let r=e(n);if(!r)throw Error(`${t} is required`);return r}function d(e){return`${u(`projectId`,e.projectId)}:${u(`envId`,e.envId)}`}function f(e){let t=p(e);return{...t,signingRootVersion:u(`signingRootVersion`,t.signingRootVersion)}}function p(t){if(!t||typeof t!=`object`||Array.isArray(t))throw Error(`runtimePolicyScope must be an object`);let n=t;if(Object.prototype.hasOwnProperty.call(n,`environmentId`))throw Error(`runtimePolicyScope.environmentId is stale; use envId`);if(Object.prototype.hasOwnProperty.call(n,`runtimeSnapshotScope`))throw Error(`runtimePolicyScope.runtimeSnapshotScope is stale; use runtimePolicyScope`);return{orgId:u(`orgId`,n.orgId),projectId:u(`projectId`,n.projectId),envId:u(`envId`,n.envId),...e(n.signingRootVersion)?{signingRootVersion:e(n.signingRootVersion)}:{}}}function m(e,t){return e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}function h(e){return{signingRootId:d(e),signingRootVersion:u(`signingRootVersion`,e.signingRootVersion)}}const g=[`prf`,`kek`,`seed`,`scalar`,`secretkey`,`privatekey`,`plaintext`,`recoverycode`,`clientroot`,`holdershare`];function _(e,t,n,r=[]){let i=new Set(t),a=new Set(r);for(let t of Object.keys(e)){if(i.has(t))continue;if(a.has(t))throw Error(`${n}.${t} is not part of ${n}`);let e=t.toLowerCase().replace(/_/g,``);throw!e.includes(`publickey`)&&g.some(t=>e.includes(t))?Error(`${n}.${t} must never carry plaintext custody material`):Error(`${n}.${t} is not part of ${n}`)}}function v(e,n,r){let i=t(e,r);_(i,n,r);for(let e of n)if(!Object.prototype.hasOwnProperty.call(i,e)||i[e]===void 0)throw Error(`${r}.${e} is required`);return i}const y=Object.freeze([`export_keys`,`link_devices`,`revoke_devices`,`sign`]);Object.freeze([`sign`]);const b=new Set([`export_keys`,`link_devices`,`revoke_devices`,`sign`]),x=Symbol(`canonicalPermissionSetBrand`);var S=class e extends Array{constructor(e){super(...e),this[x]=!0,Object.freeze(this)}static create(t){return new e(t)}static get[Symbol.species](){return Array}};function C(e){return typeof e==`string`&&b.has(e)}function w(e){if(!Array.isArray(e))return I(e==null?`delegated wallet permissions are required`:`delegated wallet permissions must be an array`);if(e.length===0)return I(`delegated wallet permissions must be non-empty`);let t=[],n=new Set;for(let r of e){if(!C(r))return I(`delegated wallet permission is unsupported`);if(n.has(r))return I(`delegated wallet permission ${r} is duplicated`);n.add(r),t.push(r)}return t.sort(N),{ok:!0,value:S.create(P(t))}}function T(e){return{kind:`delegated_wallet_authority_v1`,permissions:e.permissions}}function E(e){if(!F(e))return L(`delegated wallet authority must contain exactly kind and permissions`);if(e.kind!==`delegated_wallet_authority_v1`)return L(`delegated wallet authority kind is unsupported`);let t=w(e.permissions);return t.ok?{ok:!0,value:T({permissions:t.value})}:t}function D(){return M(y)}function O(){return T({permissions:D()})}function k(e,t){return e.permissions.includes(t)}function A(e){return Object.freeze([...e.permissions])}function j(e,t){if(e.kind!==t.kind||e.permissions.length!==t.permissions.length)return!1;for(let n=0;n<e.permissions.length;n+=1)if(e.permissions[n]!==t.permissions[n])return!1;return!0}function M(e){let t=w(e);if(!t.ok)throw Error(t.error.message);return t.value}function N(e,t){return e<t?-1:e>t?1:0}function P(e){let[t,...n]=e;if(!t)throw Error(`delegated wallet permissions must be non-empty`);return[t,...n]}function F(e){if(typeof e!=`object`||!e||Array.isArray(e))return!1;let t=Object.keys(e);return t.length===2&&t.includes(`kind`)&&t.includes(`permissions`)}function I(e){return{ok:!1,error:{code:`invalid`,message:e}}}function L(e){return{ok:!1,error:{code:`invalid`,message:e}}}const R=/^[A-Za-z0-9_-]+$/;function z(e,t){if(typeof e!=`string`||!R.test(e))throw Error(`${t} must be unpadded base64url`);let i;try{i=r(e)}catch{throw Error(`${t} must be valid base64url`)}if(n(i)!==e)throw Error(`${t} must be canonical base64url`);return i}function B(e,t){if(e.ok)return e.value;throw Error(`${t} ${e.error.message}`)}function V(e,t){try{return i(e)}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is not a digest`}`)}}function H(e,t=`nonceB64u`){if(z(e,t).length!==12)throw Error(`${t} must decode to a 12-byte ChaCha20Poly1305 nonce`);return e}function U(e,t=`ciphertextB64u`){if(z(e,t).length<17)throw Error(`${t} must decode to sealed ciphertext with an authentication tag`);return e}function W(e,t=`registeredPublicKeyB64u`){if(z(e,t).length!==32)throw Error(`${t} must decode to a 32-byte Ed25519 public key`);return e}function G(e,t=`publicKey33B64u`){let n=z(e,t);if(n.length!==33)throw Error(`${t} must decode to a 33-byte compressed secp256k1 point`);if(n[0]!==2&&n[0]!==3)throw Error(`${t} must be a compressed secp256k1 public key`);return e}function K(e,t=`keyCreationSignerSlot`){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0||e>4294967295)throw Error(`${t} must be a positive u32`);return e}function q(e,t=`envelopeRevision`){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive integer revision`);return e}function J(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive unix-millisecond timestamp`);return e}export{l as C,a as S,c as T,_,q as a,m as b,J as c,A as d,k as f,v as g,j as h,H as i,B as l,w as m,W as n,K as o,E as p,U as r,G as s,V as t,O as u,d as v,s as w,h as x,f as y};