@seams/wallet 0.9.3 → 0.10.0

package/dist/public/wallet-service/index.html

@@ -5,14 +5,14 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Web3Authn Wallet Service</title>
     <!-- Surface styles are external so strict CSP can keep style-src 'self' -->
-    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.9.3" />
+    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.10.0" />
     <!-- Minimal shims some ESM bundles expect (externalized to enable strict CSP) -->
-    <script src="/sdk/wallet-shims.js?v=0.9.3"></script>
+    <script src="/sdk/wallet-shims.js?v=0.10.0"></script>
     <!-- Hint the browser to fetch the host script earlier -->
-    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.9.3" crossorigin>
+    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.10.0" crossorigin>
   </head>
   <body>
     <!-- sdkBasePath points to the SDK root (e.g. '/sdk'). Load the host directly. -->
-    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.9.3"></script>
+    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.10.0"></script>
   </body>
 </html>

package/dist/types/shared-ts/src/utils/walletManagementProtocol.d.ts

@@ -1,3 +1,3 @@
 export declare const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
-export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "3";
+export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "4";
 //# sourceMappingURL=walletManagementProtocol.d.ts.map

package/dist/types/wallet/src/SeamsWeb/signingSurface/BrowserSigningSurface.d.ts

@@ -14,7 +14,7 @@ import { establishEvmFamilyCustodyV1, joinEvmFamilyCustodyV1 } from '../../core/
 import { type WalletSessionEd25519RecoveryBasisV1 } from '../../core/signingEngine/walletCustody/walletRecoveryEd25519';
 import { recoverWalletCustodyManifestV1 } from '../../core/signingEngine/walletCustody/walletRecoveryManifest';
 import { type LoadedWalletCustodyEd25519MaterialV1, type WalletCustodyEd25519MaterialBindingV1, type WalletCustodySealedEd25519MaterialV1 } from '../../core/signingEngine/walletCustody/ed25519SeedMaterial';
-import type { EstablishedWalletCustodyEvmFamilyKeySetV1, EstablishedWalletCustodyNearEd25519KeySetV1, JoinedWalletCustodyNearEd25519KeySetV1, JoinedWalletCustodyEvmFamilyKeySetV1, RejoinedWalletCustodyEvmFamilyKeySetV1 } from './ports';
+import type { EstablishWalletCustodyNearEd25519KeySetArgs, EstablishedWalletCustodyEvmFamilyKeySetV1, EstablishedWalletCustodyNearEd25519KeySetV1, JoinedWalletCustodyNearEd25519KeySetV1, JoinedWalletCustodyEvmFamilyKeySetV1, RejoinedWalletCustodyEvmFamilyKeySetV1 } from './ports';
 import { type RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import type { RouterAbTraceContextV1 } from '../../../../shared-ts/src/utils/routerAbTraceContext';
 import type { SignerWorkerKind, SignerWorkerOperationRequest, SignerWorkerOperationResult, SignerWorkerOperationType, EmailOtpYaoPrewarmRequest, EmailOtpYaoPrewarmOutcome } from '../../core/signingEngine/workerManager/workerTypes';
@@ -133,21 +133,7 @@ export declare class BrowserSigningSurface {
      * PRF-derived path used, so the execute request goes to the same endpoint
      * with the same trace context — only the root behind it changed.
      */
-    establishWalletCustodyNearEd25519KeySet(args: {
-        readonly home: WalletSessionHome;
-        walletId: string;
-        factorJson: string;
-        factorSecret: ArrayBuffer;
-        nearEd25519SigningKeyId: string;
-        registrationCeremonyId: string;
-        admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
-        admissionReceipt: unknown;
-        participantIds: readonly [number, number];
-        routerOrigin: string;
-        /** The signed setup: the Router authorizes the execute round against it. */
-        authorization: string;
-        traceContext?: RouterAbTraceContextV1;
-    }): Promise<EstablishedWalletCustodyNearEd25519KeySetV1>;
+    establishWalletCustodyNearEd25519KeySet(args: EstablishWalletCustodyNearEd25519KeySetArgs): Promise<EstablishedWalletCustodyNearEd25519KeySetV1>;
     recoverWalletCustodyManifest(args: Omit<Parameters<typeof recoverWalletCustodyManifestV1>[0], 'runStep' | 'workerCtx'>): Promise<Awaited<ReturnType<typeof recoverWalletCustodyManifestV1>>>;
     createWalletRecoveryReplacementCredential(args: {
         readonly walletId: WalletId;

package/dist/types/wallet/src/SeamsWeb/signingSurface/ports.d.ts

@@ -44,6 +44,7 @@ import type { EcdsaBootstrapRequest } from '../../core/signingEngine/session/pas
 import type { ConnectEd25519SessionArgs } from '../../core/signingEngine/session/passkey/public';
 import type { HydrateWarmSigningSessionInput } from '../../core/signingEngine/session/passkey/warmSessionHydration';
 import type { LoginWithEmailOtpWalletCustodyEd25519Args } from '../../core/signingEngine/walletCustody/ed25519Login';
+import type { EstablishNearEd25519CustodyFactor } from '../../core/signingEngine/walletCustody/registrationCeremony';
 import type { EmailOtpEd25519YaoRecoveryBootstrapV1 } from '../../core/signingEngine/workerManager/workerTypes';
 import type { RouterAbEd25519YaoActiveClientMetadataV1 } from '../../core/signingEngine/threshold/ed25519/yaoClient';
 import type { RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../shared-ts/src/utils/routerAbEd25519Yao';
@@ -226,21 +227,7 @@ export interface WalletCustodyCeremonySurface {
         recoveryChallengeId: string;
         relayUrl: string;
     }): Promise<RecoveredWalletCustodyManifestV1>;
-    establishWalletCustodyNearEd25519KeySet(args: {
-        readonly home: WalletSessionHome;
-        walletId: string;
-        factorJson: string;
-        factorSecret: ArrayBuffer;
-        nearEd25519SigningKeyId: string;
-        registrationCeremonyId: string;
-        admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
-        admissionReceipt: unknown;
-        participantIds: readonly [number, number];
-        routerOrigin: string;
-        /** The signed setup: the Router authorizes the execute round against it. */
-        authorization: string;
-        traceContext?: RouterAbTraceContextV1;
-    }): Promise<EstablishedWalletCustodyNearEd25519KeySetV1>;
+    establishWalletCustodyNearEd25519KeySet(args: EstablishWalletCustodyNearEd25519KeySetArgs): Promise<EstablishedWalletCustodyNearEd25519KeySetV1>;
     joinWalletCustodyNearEd25519KeySet(args: {
         readonly routing: WalletSessionHome | {
             readonly kind: 'discovery';
@@ -609,4 +596,26 @@ export type WalletRecoverySigningSurface = AccountSyncSigningSurface & Ed25519Ya
 export type WalletRecoveryWebContext = SeamsWebBaseContext<WalletRecoverySigningSurface>;
 export type DeviceLinkingSigningSurface = LocalLoginStateSurface & LoginUnlockSigningSurface & NearSigningSurface & EmailOtpRegistrationEnrollmentSurface & Pick<SigningSessionSurface, 'hydrateSigningSession'> & RpIdSurface & WebAuthnRegistrationConfirmationSurface & Pick<UserProfileStoreSurface & RegistrationAccountSurface, 'storeUserData' | 'storeAuthenticator'> & Pick<EcdsaRegistrationSurface, 'storeWalletEcdsaSignerRecords'>;
 export type DeviceLinkingWebContext = SeamsWebBaseContext<DeviceLinkingSigningSurface>;
+export type EstablishWalletCustodyNearEd25519KeySetArgs = {
+    readonly home: WalletSessionHome;
+    walletId: string;
+    /** The factor that seals the custody: at hand, or asked for after the Router round. */
+    factor: EstablishNearEd25519CustodyFactor;
+    /**
+     * Sends the execute request together with the registration proof. It
+     * returns the activation result, or `null` when the Gateway admitted the
+     * registration and did not complete the execution: the run then sends the
+     * same request to the execute route.
+     */
+    executeWithProof?: (yaoExecuteRequestJson: string) => Promise<string | null>;
+    nearEd25519SigningKeyId: string;
+    registrationCeremonyId: string;
+    admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+    admissionReceipt: unknown;
+    participantIds: readonly [number, number];
+    routerOrigin: string;
+    /** The signed setup: the Router authorizes the execute round against it. */
+    authorization: string;
+    traceContext?: RouterAbTraceContextV1;
+};
 //# sourceMappingURL=ports.d.ts.map

package/dist/types/wallet/src/core/rpcClients/relayer/walletRegistration.d.ts

@@ -11,7 +11,7 @@ import type { RegistrationEstablishedSessionResultV2 } from '../../../../../shar
 import { type RootShareEpoch, type ThresholdEd25519SessionId, type WalletAuthMethodId } from '../../../../../shared-ts/src/utils/domainIds';
 import { type WebAuthnAuthenticatorDeviceInfo } from '../../../../../shared-ts/src/utils/webauthnDeviceInfo';
 import type { EcdsaKeyFactsInventoryWalletSessionCredential } from '../../types/sdkSentEvents';
-import { type RouterAbEd25519YaoActivationAdmissionReceiptV1, type RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import { type RouterAbEd25519YaoActivationAdmissionReceiptV1, type RouterAbEd25519YaoActivationExecuteRequestV1, type RouterAbEd25519YaoActivationResultV1, type RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import type { CreateRegistrationIntentRequest, WalletEd25519YaoSignerPublicResult, WalletRegistrationEd25519YaoActivationReference, WalletRegistrationEd25519YaoStart, WalletRegistrationFinalizeAuthMethod } from '../../../../../shared-ts/src/utils/registrationContracts';
 import { type WalletAuthAuthority } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
 import { type RouterAbEd25519NormalSigningState } from '../../../../../shared-ts/src/utils/signingSessionSeal';
@@ -132,12 +132,31 @@ type WalletRegistrationSetupSuccessBase = {
     intent: RegistrationIntentV1;
     signedSetup: string;
 };
+/**
+ * What setup says about the Yao admission of an Ed25519-only plan.
+ *
+ * `described` holds the admission that respond will issue. Nothing is
+ * admitted yet: the client only prepares its protocol inputs from it while
+ * the user answers the passkey prompt, and sends them with the proof.
+ * `after_proof` means that respond is the first to state the admission.
+ */
+export type WalletRegistrationSetupEd25519Admission = {
+    readonly status: 'described';
+    readonly admissionRequest: WalletRegistrationEd25519YaoStart['admissionRequest'];
+    readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+} | {
+    readonly status: 'after_proof';
+    readonly admissionRequest?: never;
+    readonly admissionReceipt?: never;
+};
 export type WalletRegistrationSetupSuccessV2 = (WalletRegistrationSetupSuccessBase & {
     kind: 'evm_family_ecdsa' | 'near_ed25519_and_evm_family_ecdsa';
     ecdsa: WalletRegistrationSetupEcdsaPreparePayload;
+    ed25519?: never;
 }) | (WalletRegistrationSetupSuccessBase & {
     kind: 'near_ed25519';
     ecdsa?: never;
+    ed25519: WalletRegistrationSetupEd25519Admission;
 });
 export type WalletRegistrationSetupResponseV2 = WalletRegistrationSetupSuccessV2 | {
     ok: false;
@@ -578,11 +597,24 @@ export type WalletRegistrationRespondResponseV2 = {
     registrationCeremonyId: string;
     kind: 'near_ed25519';
     ecdsa?: never;
-    ed25519: {
-        readonly status: 'admitted';
-        readonly admissionRequest: WalletRegistrationEd25519YaoStart['admissionRequest'];
-        readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
-    };
+    ed25519: WalletRegistrationRespondEd25519Admission;
+};
+/**
+ * `executed` answers a respond that carried the execute request: the Gateway
+ * admitted, ran the execution and returns what the execute route returns.
+ * `admitted` answers every other respond and one whose execution did not
+ * complete: the client then runs the execution through the execute route.
+ */
+export type WalletRegistrationRespondEd25519Admission = {
+    readonly status: 'admitted';
+    readonly admissionRequest: WalletRegistrationEd25519YaoStart['admissionRequest'];
+    readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+    readonly activationResult?: never;
+} | {
+    readonly status: 'executed';
+    readonly admissionRequest: WalletRegistrationEd25519YaoStart['admissionRequest'];
+    readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+    readonly activationResult: RouterAbEd25519YaoActivationResultV1<'registration'>;
 };
 export type WalletRegistrationNearAdmissionResponseV2 = {
     ok: true;
@@ -606,9 +638,15 @@ type WalletRegistrationRespondEcdsaRequest = {
 type RespondWalletRegistrationArgs = (RespondWalletRegistrationArgsBase & {
     signerPlanKind: 'near_ed25519';
     ecdsa?: never;
+    /**
+     * The execute request that the client prepared from the admission that
+     * setup described. The Gateway admits, then runs it in this request.
+     */
+    ed25519Execution?: RouterAbEd25519YaoActivationExecuteRequestV1<'registration'>;
 }) | (RespondWalletRegistrationArgsBase & {
     signerPlanKind: Exclude<WalletRegistrationSignerPlanKind, 'near_ed25519'>;
     ecdsa: WalletRegistrationRespondEcdsaRequest;
+    ed25519Execution?: never;
 });
 export declare function respondWalletRegistration(args: RespondWalletRegistrationArgs): Promise<WalletRegistrationRespondResponseV2>;
 export declare function authorizeWalletRegistrationNearAdmission(args: RespondWalletRegistrationArgsBase): Promise<WalletRegistrationNearAdmissionResponseV2>;

package/dist/types/wallet/src/core/rpcClients/relayer/walletRegistrationSetupPrewarm.d.ts

@@ -0,0 +1,4 @@
+export declare const WALLET_REGISTRATION_SETUP_PATH = "/wallets/register/setup";
+/** Warm setup without loading the wallet runtime or sending credentials. */
+export declare function prewarmWalletRegistrationSetup(relayerUrl: string): void;
+//# sourceMappingURL=walletRegistrationSetupPrewarm.d.ts.map

package/dist/types/wallet/src/core/signingEngine/walletCustody/ceremonyDriver.d.ts

@@ -44,6 +44,20 @@ type WalletCustodyCeremonyCustodyInput = {
     readonly factorJson: string;
     readonly factorSecret: ArrayBuffer;
     readonly recoveryCodesJson: string;
+} | {
+    /**
+     * Establishes custody for a NEAR key set whose factor exists only after
+     * the protocol round: a passkey that the user creates while this run
+     * prepares its inputs. The seed is sealed at the end of the run, so the
+     * run begins without the factor and asks for it once, after the round.
+     */
+    readonly origin: 'establish_factor_after_round';
+    readonly walletId: string;
+    readonly recoveryCodesJson: string;
+    readonly factor: () => Promise<{
+        readonly factorJson: string;
+        readonly factorSecret: ArrayBuffer;
+    }>;
 } | {
     readonly origin: 'join';
     /** `JoinCustodyWireV1`: the envelope binding and its sealed seed. */

package/dist/types/wallet/src/core/signingEngine/walletCustody/registrationCeremony.d.ts

@@ -11,13 +11,31 @@ import { type WalletCustodyCeremonyStepRunner } from './ceremonyDriver';
  * that are not shown are codes nobody can ever produce, and a payload committed
  * without its codes leaves a wallet whose owner holds nothing.
  */
-type EstablishNearEd25519CustodyInput = {
-    readonly runStep: WalletCustodyCeremonyStepRunner;
-    readonly walletId: string;
+/**
+ * The factor that seals the new custody. A passkey that the user creates
+ * while the run prepares its inputs exists only after the Router round, so
+ * the run can take it then instead of at its start.
+ */
+export type EstablishNearEd25519CustodyFactor = {
     /** The passkey or Email OTP factor, as the envelope will name it. */
     readonly factorJson: string;
     /** `PRF.first` or the Email OTP factor key. Owned by the caller. */
     readonly factorSecret: ArrayBuffer;
+    readonly factorAfterRouterRound?: never;
+} | {
+    readonly factorJson?: never;
+    readonly factorSecret?: never;
+    /** Asked once, after the Router round returned. The caller owns the secret. */
+    readonly factorAfterRouterRound: () => Promise<{
+        readonly factorJson: string;
+        readonly factorSecret: ArrayBuffer;
+    }>;
+};
+type EstablishNearEd25519CustodyInput = EstablishNearEd25519CustodyFactor & NearEd25519CustodyRunInput;
+/** What every NEAR custody run takes, whichever factor reaches its seed. */
+type NearEd25519CustodyRunInput = {
+    readonly runStep: WalletCustodyCeremonyStepRunner;
+    readonly walletId: string;
     readonly nearEd25519SigningKeyId: string;
     /** The Yao lifecycle this run registers under, and route 4's own scope. */
     readonly registrationCeremonyId: string;
@@ -171,7 +189,9 @@ export declare function walletCustodyCommitPayloadForWire(payload: WalletCustody
  * *establish* a key set — registering a second, different key for a wallet
  * that already has one, which no later check would undo.
  */
-type RejoinNearEd25519CustodyInput = Omit<EstablishNearEd25519CustodyInput, 'factorJson' | 'registrationCeremonyId'> & {
+type RejoinNearEd25519CustodyInput = Omit<NearEd25519CustodyRunInput, 'registrationCeremonyId'> & {
+    /** Opens the stored envelope. Owned by the caller. */
+    readonly factorSecret: ArrayBuffer;
     /** `JoinCustodyWireV1`: the stored envelope binding and its sealed seed. */
     readonly custodyJson: string;
     readonly recoveryLifecycleId: string;
@@ -189,7 +209,9 @@ type RejoinedNearEd25519Custody = JoinedNearEd25519CustodyBase & {
     readonly activationResultJson: string;
     readonly activationReceipt: RouterAbEd25519YaoRecoveryActivationReceiptV1;
 };
-type JoinNearEd25519CustodyInput = Omit<EstablishNearEd25519CustodyInput, 'walletId' | 'factorJson' | 'continuityRegisteredPublicKeyB64u'> & {
+type JoinNearEd25519CustodyInput = Omit<NearEd25519CustodyRunInput, 'walletId' | 'continuityRegisteredPublicKeyB64u'> & {
+    /** Opens the envelope that another key set established. Owned by the caller. */
+    readonly factorSecret: ArrayBuffer;
     readonly preparation: {
         readonly kind: 'fresh';
     } | {

package/dist/types/wallet/src/react/components/VoiceAssistantCard.d.ts

@@ -0,0 +1,38 @@
+import React from 'react';
+import { type VoiceBeamLevel } from 'voice-glow';
+import './VoiceAssistantCard.css';
+export type VoiceAssistantInput = {
+    readonly kind: 'level';
+    /** 0–1, or a getter sampled by the glow without React renders. */
+    readonly level: VoiceBeamLevel;
+    readonly stream?: never;
+} | {
+    readonly kind: 'microphone';
+    readonly stream: MediaStream;
+    readonly level?: never;
+};
+export type VoiceAssistantState = {
+    readonly kind: 'idle';
+    readonly input?: never;
+} | {
+    readonly kind: 'listening';
+    readonly input: VoiceAssistantInput;
+} | {
+    readonly kind: 'processing';
+    readonly input?: never;
+};
+export type VoiceAssistantCardProps = {
+    readonly name: string;
+    readonly initials: string;
+    readonly description: string;
+    readonly message: string;
+    readonly transcript: React.ReactNode;
+    readonly state: VoiceAssistantState;
+    readonly theme: 'dark' | 'light';
+    readonly onToggle: () => void;
+    readonly className?: string;
+    readonly style?: React.CSSProperties;
+};
+/** Controlled presentation. The caller owns audio, transcripts, and work. */
+export declare function VoiceAssistantCard(props: VoiceAssistantCardProps): React.ReactNode;
+//# sourceMappingURL=VoiceAssistantCard.d.ts.map

package/dist/types/wallet/src/react/components/VoiceAssistantCard.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=VoiceAssistantCard.typecheck.d.ts.map

package/dist/types/wallet/src/react/index.d.ts

@@ -4,7 +4,7 @@
  * This package provides React components and hooks for integrating Web3Authn Passkey
  * functionality into React applications.
  *
- * **Important:** All React components and hooks must be used inside a SeamsWeb context.
+ * **Important:** Wallet hooks and account components require a SeamsWeb context.
  * Wrap your app with SeamsWebProvider to provide the required context.
  *
  * @example
@@ -61,6 +61,10 @@ export { QRCodeScanner } from './components/QRCodeScanner';
 export type { QRCodeScannerProps } from './components/QRCodeScanner';
 export { ShowQRCode } from './components/ShowQRCode';
 export type { ShowQRCodeProps } from './components/ShowQRCode';
+export { VoiceAssistantCard } from './components/VoiceAssistantCard';
+export type { VoiceAssistantCardProps, VoiceAssistantInput, VoiceAssistantState, } from './components/VoiceAssistantCard';
+export { VoiceBeam } from 'voice-glow';
+export type { VoiceBeamLevel, VoiceBeamProps } from 'voice-glow';
 export { HostedSeamsAuthMenu, SeamsAuthMenuMock } from './components/HostedSeamsAuthMenu/public';
 export type { HostedAuthMenuCopy, HostedAuthMenuCopyInput, HostedAuthMenuExternalAuthBroker, HostedAuthMenuExternalAuthEvidence, HostedAuthMenuExternalAuthRequest, HostedAuthMenuExternalProvider, HostedAuthMenuMode, HostedAuthMenuOpenRequest, HostedAuthMenuOutcome, HostedAuthMenuRegistrationAccountInput, HostedAuthMenuSessionId, HostedSeamsAuthMenuProps, } from './components/HostedSeamsAuthMenu/public';
 export { default as TouchIcon } from './components/AccountMenuButton/icons/TouchIcon';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet",
-  "version": "0.9.3",
+  "version": "0.10.0",
   "type": "module",
   "description": "Seams web and runtime TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",
@@ -179,7 +179,8 @@
     "bs58": "^6.0.0",
     "idb": "^8.0.3",
     "preact": "10.29.8",
-    "viem": "^2.38.6"
+    "viem": "^2.38.6",
+    "voice-glow": "0.2.1"
   },
   "devDependencies": {
     "@simplewebauthn/server": "^13.2.2",

package/dist/esm/sdk/activeWalletSession-DiZcKjB_.js

@@ -1 +0,0 @@
-import{B as e,I as t,L as n,N as r,P as i,R as a,V as o,b as s,f as c,v as l,w as u,y as d}from"./normalize-kUDm5zfS.js";import{k as f}from"./chains-CiYQT1K4.js";import{_ as p,c as m,g as h,p as g}from"./primitives-CAcl7ON7.js";import{d as _,h as v,l as y,m as b}from"./capabilityKinds-CKQ4Uqnv.js";import{r as x}from"./canonicalPrimitives-CKPGgpxg.js";function S(...e){return Object.assign((t,n)=>{if(!e.includes(t))throw Error(`${n} is invalid`);return t},{literals:e})}function C(e,t){let n=Object.keys(e),r=[...n.filter(t=>`literals`in e[t]),...n.filter(t=>!(`literals`in e[t]))];return Object.assign((i,a)=>{let o=h(i,n,a),s=new Map;for(let t of r)s.set(t,e[t](o[t],`${a}.${t}`));let c=Object.fromEntries(n.map(e=>[e,s.get(e)]));return t?.(c,a),c},{shape:e})}function w(e,t){let n=new Map;for(let r of t)for(let t of r.shape[e].literals)n.set(t,r);return(t,r)=>{let i=f(t,r),a=n.get(i[e]);if(!a)throw Error(`${r}.${e} is invalid`);return a(i,r)}}function T(e){return(t,n)=>t===null?null:e(t,n)}function E(e){return(t,n)=>{let r=e(t);if(r.ok)return r.value;throw Error(`${n} ${r.error.message}`)}}function D(e){return(t,n)=>{try{return e(t)}catch(e){throw Error(`${n} ${e instanceof Error?e.message:`is invalid`}`)}}}const ee=E(l),O=E(n),k=E(d),A=E(s),j=E(y),M=E(a),N=E(v),P=E(b),F=E(i),I=E(t),L=E(e),R=E(o),z=E(_),B=E(u),V=D(x),H=T(G);function U(e){return(t,n)=>e(t,n.slice(n.lastIndexOf(`.`)+1))}function W(e,t){try{return m(e,t)}catch(e){throw Error(e instanceof Error?e.message:`${t} is invalid`)}}function G(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} must be a non-empty canonical string`);for(let n of e){let e=n.charCodeAt(0);if(/\s/.test(n)||e<=31||e===127)throw Error(`${t} must not contain whitespace or control characters`)}return e}function K(e,t){if(!Number.isSafeInteger(e)||Number(e)<0)throw Error(`${t} must be a non-negative safe integer`);return Number(e)}function q(e,t){let n=g(e);if(!n.ok)throw Error(`${t}: ${n.error.message}`);return n.value}function J(e,t){let n=r(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function Y(e,t){if(e.kind!==t.kind||e.walletId!==t.walletId||e.authorityId!==t.authorityId||e.authMethodId!==t.authMethodId||e.authorizationId!==t.authorizationId||e.quotaId!==t.quotaId||e.authorityDigestB64u!==t.authorityDigestB64u||e.authorityRevocationEpoch!==t.authorityRevocationEpoch||e.issuedAtMs!==t.issuedAtMs||e.expiresAtMs!==t.expiresAtMs||e.capabilitySubjects.length!==t.capabilitySubjects.length)return!1;for(let n=0;n<e.capabilitySubjects.length;n+=1){let r=e.capabilitySubjects[n],i=t.capabilitySubjects[n];if(!r||!i||!X(r,i))return!1}return!0}function X(e,t){switch(e.kind){case`link_devices`:case`revoke_devices`:return t.kind===e.kind;case`sign`:case`export_keys`:return t.kind===e.kind&&t.keyFamily===e.keyFamily&&c(e.materialActivation,t.materialActivation);default:return!1}}function Z(e,t){for(let n of e.capabilitySubjects){let e=!1;for(let r of t.capabilitySubjects)if(X(n,r)){e=!0;break}if(!e)return!1}return!0}const Q=w(`kind`,[C({kind:S(`direct`)}),C({kind:S(`regional`),region:S(`US`,`WEUR`,`APAC`,`OC`)})]);function $(e){return Q(e,`Wallet Session home`)}function te(){return C({kind:S(`opaque_wallet_session_operation_credential_v1`),ownershipGeneration:K,home:$,token:(e,t)=>{if(typeof e!=`string`||e.length>8192)throw Error(`${t} is invalid`);return e},walletSessionId:U(N)},(e,t)=>{if(e.ownershipGeneration===0)throw Error(`${t} ownership generation must be positive`);if(!/^wst_[A-Za-z0-9_-]{43}$/.test(e.token))throw Error(`${t} opaque token is invalid`)})}function ne(e){return te()(e,`WalletSessionOperationCredentialV1`)}function re(e){return e.kind===`sign`||e.kind===`export_keys`?`${e.kind}:${e.keyFamily}:${e.materialActivation.activationId}`:e.kind}function ie(){return C({kind:S(`active_wallet_session_v1`),walletId:U(O),authorityId:U(I),authMethodId:U(F),authorizationId:U(P),quotaId:U(z),authorityDigestB64u:U(V),authorityRevocationEpoch:U(K),capabilitySubjects:(e,t)=>{if(!Array.isArray(e)||e.length===0)throw Error(`${t} must be non-empty`);let n=[];for(let[t,r]of e.entries())n.push(oe(r,`capabilitySubjects[${t}]`));let r=n[0];if(!r)throw Error(`${t} must be non-empty`);return[r,...n.slice(1)]},issuedAtMs:U(W),expiresAtMs:U(W)},(e,t)=>{let n=e.capabilitySubjects.map(re);if(new Set(n).size!==n.length)throw Error(`${t} capability subjects repeat`)})}function ae(e){return ie()(e,`ActiveWalletSessionV1`)}function oe(e,t){let n=f(e,t);if(n.kind===`link_devices`||n.kind===`revoke_devices`)return p(n,[`kind`],t),{kind:n.kind};if(n.kind!==`sign`&&n.kind!==`export_keys`)throw Error(`${t}.kind is invalid`);if(p(n,[`kind`,`keyFamily`,`materialActivation`],t),n.keyFamily!==`ed25519`&&n.keyFamily!==`ecdsa_secp256k1`)throw Error(`${t}.keyFamily is invalid`);return{kind:n.kind,keyFamily:n.keyFamily,materialActivation:B(n.materialActivation,`${t}.materialActivation`)}}export{w as A,M as C,T as D,S as E,C as O,O as S,N as T,W as _,Z as a,F as b,V as c,A as d,H as f,J as g,K as h,ne as i,E as k,k as l,G as m,ae as n,j as o,q as p,$ as r,L as s,Y as t,U as u,R as v,P as w,I as x,ee as y};

package/dist/esm/sdk/challengeDelivery-DxXAkOfS.js

@@ -1 +0,0 @@
-import{I as e,L as t,R as n,V as r,f as i,v as a,w as o,y as s}from"./normalize-kUDm5zfS.js";import{A as c,j as l,k as u}from"./chains-CiYQT1K4.js";import{i as d,r as f}from"./base64-CsEj-_bC.js";import{n as ee,r as p,s as m}from"./primitives-CAcl7ON7.js";import{l as h}from"./capabilityKinds-CKQ4Uqnv.js";import{r as g}from"./canonicalPrimitives-CKPGgpxg.js";import{c as te,s as _}from"./accountIds-BzZs7YoX.js";import{Qt as v,Xt as ne,en as y,nn as re,ot as ie}from"./emailOtpEcdsaDerivationIdentity-B8HzTh4T.js";import{r as ae}from"./registrationIds-CdPqm-Ya.js";const b=new TextEncoder;function x(e,t){if(typeof e!=`string`||e.length===0)throw Error(`${t} must be a non-empty visible ASCII string`);for(let n=0;n<e.length;n+=1){let r=e.charCodeAt(n);if(r<33||r>126)throw Error(`${t} must contain visible ASCII bytes`)}return e}function oe(e,t){if(typeof e!=`number`||!Number.isInteger(e)||e<0||e>255)throw Error(`${t} must be a byte`);return e}function se(e,t,n,r){if(!Array.isArray(e))throw Error(`${t} must be a byte array`);if(e.length<n||e.length>r)throw Error(`${t} has an invalid length`);let i=[];for(let n=0;n<e.length;n+=1)i.push(oe(e[n],`${t}[${n}]`));return i}function S(e,t,n){let r=se(e,t,32,32);if(n&&ce(r))throw Error(`${t} must be nonzero`);return r}function ce(e){for(let t of e)if(t!==0)return!1;return!0}function C(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function le(e){let t=new Uint8Array(4);return new DataView(t.buffer).setUint32(0,e,!1),t}function w(e){let t=0;for(let n of e)t+=n.length;let n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function T(e){return w([le(e.length),e])}function E(e,t){return w([T(b.encode(e)),T(t)])}async function ue(e){let t=await globalThis.crypto.subtle.digest(`SHA-256`,e);return new Uint8Array(t)}async function de(e){let t=w([T(b.encode(`seams/router-ab/ed25519-yao/application-binding/v1`)),E(`walletId`,b.encode(e.wallet_id)),E(`nearEd25519SigningKeyId`,b.encode(e.near_ed25519_signing_key_id)),E(`signingRootId`,b.encode(e.signing_root_id)),E(`keyCreationSignerSlot`,le(e.key_creation_signer_slot))]);return Array.from(await ue(t))}const fe=`/router-ab/ed25519/yao/registration/admit`,pe=`/router-ab/ed25519/yao/registration/execute`,me=`/router-ab/ed25519/yao/recovery/admit`,he=`/router-ab/ed25519/yao/recovery/execute`,ge=`/router-ab/ed25519/yao/recovery/activate`,_e=`x-seams-wallet-recovery-challenge-id`,ve=`/router-ab/ed25519/yao/recovery/bootstrap`,ye=`router_ab_ed25519_yao_email_otp_recovery_v1`,be=`/router-ab/ed25519/yao/export/admit`,xe=`/router-ab/ed25519/yao/export/execute`,Se=64*1024;function Ce(e,t){return e.operation===t.operation&&D(e.session_id,t.session_id)&&D(e.stable_key_context_binding,t.stable_key_context_binding)&&re(e.material_activation,t.material_activation)&&e.lifecycle.lifecycle_id===t.lifecycle.lifecycle_id&&e.lifecycle.work_kind===t.lifecycle.work_kind&&e.lifecycle.primitive_request_kind===t.lifecycle.primitive_request_kind&&e.lifecycle.root_share_epoch===t.lifecycle.root_share_epoch&&e.lifecycle.account_id===t.lifecycle.account_id&&e.lifecycle.session_id===t.lifecycle.session_id&&e.lifecycle.signer_set_id===t.lifecycle.signer_set_id&&e.lifecycle.selected_server_id===t.lifecycle.selected_server_id}function D(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function we(e,t){return e[0]===t[0]&&e[1]===t[1]}function Te(e,t){return e.lifecycle_id===t.lifecycle_id&&e.root_share_epoch===t.root_share_epoch&&e.account_id===t.account_id&&e.threshold_session_id===t.threshold_session_id&&e.signer_set_id===t.signer_set_id&&e.signing_worker_id===t.signing_worker_id&&re(e.material_activation,t.material_activation)}function Ee(e,t){return e.wallet_id===t.wallet_id&&e.near_ed25519_signing_key_id===t.near_ed25519_signing_key_id&&e.signing_root_id===t.signing_root_id&&e.key_creation_signer_slot===t.key_creation_signer_slot}function De(e,t){return Te(e.scope,t.scope)&&Ee(e.application_binding,t.application_binding)&&we(e.participant_ids,t.participant_ids)}const O=`registration_prepare`,Oe=`registration`,k=`recovery`,ke=`recovery`,A=`key_export`,Ae=`export`;function j(e,t,n){let r=new Set(n);for(let n of Object.keys(e))if(!r.has(n))throw Error(`${t}.${n} is not a supported field`);for(let r of n)if(!Object.hasOwn(e,r))throw Error(`${t}.${r} is required`)}function je(e,t){if(!Number.isInteger(e)||typeof e!=`number`||e<=0||e>4294967295)throw Error(`${t} must be a positive u32`);return e}function Me(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive safe integer`);return e}function Ne(e,t){switch(e){case`registration`:case`recovery`:case`refresh`:case`export`:case`lane_provisioning`:case`lane_refresh`:return e;default:throw Error(`${t} is invalid`)}}function Pe(e,t){switch(e){case`deriver_a`:case`deriver_b`:return e;default:throw Error(`${t} is invalid`)}}function Fe(e,t){switch(e){case`activation`:case`export`:return e;default:throw Error(`${t} is invalid`)}}function Ie(e,t){switch(e){case`activation_client`:case`activation_signing_worker`:case`export_client`:return e;default:throw Error(`${t} is invalid`)}}function Le(e,t){switch(e){case`registration_prepare`:case`key_export`:case`recovery`:case`server_share_refresh`:return e;default:throw Error(`${t} is invalid`)}}function Re(e,t){switch(e){case`registration`:case`recovery`:case`export`:case`refresh`:return e;default:throw Error(`${t} is invalid`)}}function M(e){let t=u(e,`application_binding`);return j(t,`application_binding`,[`wallet_id`,`near_ed25519_signing_key_id`,`signing_root_id`,`key_creation_signer_slot`]),{wallet_id:x(t.wallet_id,`application_binding.wallet_id`),near_ed25519_signing_key_id:x(t.near_ed25519_signing_key_id,`application_binding.near_ed25519_signing_key_id`),signing_root_id:x(t.signing_root_id,`application_binding.signing_root_id`),key_creation_signer_slot:je(t.key_creation_signer_slot,`application_binding.key_creation_signer_slot`)}}function ze(e){let t=u(e,`scope`);j(t,`scope`,[`lifecycle_id`,`root_share_epoch`,`account_id`,`threshold_session_id`,`signer_set_id`,`signing_worker_id`,`material_activation`]);let n=x(t.account_id,`scope.account_id`),r=x(t.signing_worker_id,`scope.signing_worker_id`),i=v(t.material_activation);if(i.material_owner!==n||i.signing_worker!==r)throw Error(`scope.material_activation does not match the lifecycle owner and worker`);return{lifecycle_id:x(t.lifecycle_id,`scope.lifecycle_id`),root_share_epoch:x(t.root_share_epoch,`scope.root_share_epoch`),account_id:n,threshold_session_id:x(t.threshold_session_id,`scope.threshold_session_id`),signer_set_id:x(t.signer_set_id,`scope.signer_set_id`),signing_worker_id:r,material_activation:i}}function N(e){if(!Array.isArray(e)||e.length!==2)throw Error(`participant_ids must contain exactly two values`);let t=je(e[0],`participant_ids[0]`),n=je(e[1],`participant_ids[1]`);if(t>65535||n>65535||t>=n)throw Error(`participant_ids must be distinct, nonzero, ascending u16 values`);return[t,n]}function P(e){return N(e)}function Be(e){let t=u(e,`binding.lifecycle`);j(t,`binding.lifecycle`,[`lifecycle_id`,`work_kind`,`primitive_request_kind`,`root_share_epoch`,`account_id`,`session_id`,`signer_set_id`,`selected_server_id`]);let n={lifecycle_id:x(t.lifecycle_id,`binding.lifecycle.lifecycle_id`),work_kind:Le(t.work_kind,`binding.lifecycle.work_kind`),primitive_request_kind:Re(t.primitive_request_kind,`binding.lifecycle.primitive_request_kind`),root_share_epoch:x(t.root_share_epoch,`binding.lifecycle.root_share_epoch`),account_id:x(t.account_id,`binding.lifecycle.account_id`),session_id:x(t.session_id,`binding.lifecycle.session_id`),signer_set_id:x(t.signer_set_id,`binding.lifecycle.signer_set_id`),selected_server_id:x(t.selected_server_id,`binding.lifecycle.selected_server_id`)};if(n.work_kind===O&&n.primitive_request_kind!==Oe||n.work_kind===k&&n.primitive_request_kind!==ke||n.work_kind===A&&n.primitive_request_kind!==Ae)throw Error(`binding.lifecycle primitive request kind does not match its work kind`);return n}function F(e){let t=u(e,`binding`);j(t,`binding`,[`lifecycle`,`operation`,`session_id`,`stable_key_context_binding`,`material_activation`]);let n={lifecycle:Be(t.lifecycle),operation:Ne(t.operation,`binding.operation`),session_id:S(t.session_id,`binding.session_id`,!0),stable_key_context_binding:S(t.stable_key_context_binding,`binding.stable_key_context_binding`,!1),material_activation:v(t.material_activation)};if(n.operation===`registration`&&n.lifecycle.work_kind!==O||n.operation===`recovery`&&n.lifecycle.work_kind!==k||n.operation===`export`&&n.lifecycle.work_kind!==A)throw Error(`binding operation does not match its lifecycle work kind`);if(n.material_activation.material_owner!==n.lifecycle.account_id||n.material_activation.signing_worker!==n.lifecycle.selected_server_id)throw Error(`binding material activation does not match its lifecycle owner and worker`);return n}function Ve(e){return F(e)}function He(e){let t=F(e);if(t.operation!==`export`||t.lifecycle.work_kind!==A||t.lifecycle.primitive_request_kind!==Ae)throw Error(`export binding requires the exact export lifecycle`);return{lifecycle:{lifecycle_id:t.lifecycle.lifecycle_id,work_kind:A,primitive_request_kind:Ae,root_share_epoch:t.lifecycle.root_share_epoch,account_id:t.lifecycle.account_id,session_id:t.lifecycle.session_id,signer_set_id:t.lifecycle.signer_set_id,selected_server_id:t.lifecycle.selected_server_id},operation:`export`,session_id:t.session_id,stable_key_context_binding:t.stable_key_context_binding,material_activation:t.material_activation}}function I(e){let t=u(e,`export binding`);return j(t,`export binding`,[`ceremony`,`registered_public_key`,`state_epoch`,`runtime_policy_binding`,`authorization_digest`]),{ceremony:He(t.ceremony),registered_public_key:S(t.registered_public_key,`export binding.registered_public_key`,!0),state_epoch:Me(t.state_epoch,`export binding.state_epoch`),runtime_policy_binding:S(t.runtime_policy_binding,`export binding.runtime_policy_binding`,!0),authorization_digest:S(t.authorization_digest,`export binding.authorization_digest`,!0)}}function L(e){switch(e.operation){case`registration`:if(e.lifecycle.work_kind!==O||e.lifecycle.primitive_request_kind!==Oe)throw Error(`activation binding has the wrong registration lifecycle kind`);return{lifecycle:{lifecycle_id:e.lifecycle.lifecycle_id,work_kind:O,primitive_request_kind:Oe,root_share_epoch:e.lifecycle.root_share_epoch,account_id:e.lifecycle.account_id,session_id:e.lifecycle.session_id,signer_set_id:e.lifecycle.signer_set_id,selected_server_id:e.lifecycle.selected_server_id},operation:`registration`,session_id:e.session_id,stable_key_context_binding:e.stable_key_context_binding,material_activation:e.material_activation};case`recovery`:if(e.lifecycle.work_kind!==k||e.lifecycle.primitive_request_kind!==ke)throw Error(`activation binding has the wrong recovery lifecycle kind`);return{lifecycle:{lifecycle_id:e.lifecycle.lifecycle_id,work_kind:k,primitive_request_kind:ke,root_share_epoch:e.lifecycle.root_share_epoch,account_id:e.lifecycle.account_id,session_id:e.lifecycle.session_id,signer_set_id:e.lifecycle.signer_set_id,selected_server_id:e.lifecycle.selected_server_id},operation:`recovery`,session_id:e.session_id,stable_key_context_binding:e.stable_key_context_binding,material_activation:e.material_activation};case`refresh`:case`export`:case`lane_provisioning`:case`lane_refresh`:throw Error(`activation binding has a non-activation operation`)}}function Ue(e){let t=u(e,`keyset`);j(t,`keyset`,[`deriver_a_input_public_key`,`deriver_b_input_public_key`,`signing_worker_recipient_public_key`]);let n={deriver_a_input_public_key:S(t.deriver_a_input_public_key,`keyset.deriver_a_input_public_key`,!0),deriver_b_input_public_key:S(t.deriver_b_input_public_key,`keyset.deriver_b_input_public_key`,!0),signing_worker_recipient_public_key:S(t.signing_worker_recipient_public_key,`keyset.signing_worker_recipient_public_key`,!0)};if(C(n.deriver_a_input_public_key,n.deriver_b_input_public_key)||C(n.deriver_a_input_public_key,n.signing_worker_recipient_public_key)||C(n.deriver_b_input_public_key,n.signing_worker_recipient_public_key))throw Error(`keyset public keys must be distinct`);return n}function R(e,t){let n=u(e,t);j(n,t,[`kind`,`deriver`,`operation`,`session`,`stable_context_binding`,`encapsulated_key`,`ciphertext`]);let r={kind:Fe(n.kind,`${t}.kind`),deriver:Pe(n.deriver,`${t}.deriver`),operation:Ne(n.operation,`${t}.operation`),session:S(n.session,`${t}.session`,!0),stable_context_binding:S(n.stable_context_binding,`${t}.stable_context_binding`,!0),encapsulated_key:S(n.encapsulated_key,`${t}.encapsulated_key`,!0),ciphertext:se(n.ciphertext,`${t}.ciphertext`,16,Se)};if(r.kind===`activation`&&r.operation===`export`||r.kind===`export`&&r.operation!==`export`)throw Error(`${t} operation does not match its circuit family`);return r}function We(e,t,n,r){if(t.kind!==`activation`||t.deriver!==n||t.operation!==e.operation||!C(t.session,e.session_id)||!C(t.stable_context_binding,e.stable_key_context_binding))throw Error(`${r} does not match the admitted activation binding`);switch(e.operation){case`registration`:return{kind:`activation`,deriver:n,operation:`registration`,session:t.session,stable_context_binding:t.stable_context_binding,encapsulated_key:t.encapsulated_key,ciphertext:t.ciphertext};case`recovery`:return{kind:`activation`,deriver:n,operation:`recovery`,session:t.session,stable_context_binding:t.stable_context_binding,encapsulated_key:t.encapsulated_key,ciphertext:t.ciphertext}}}function Ge(e,t,n,r){if(t.kind!==`export`||t.deriver!==n||t.operation!==`export`||!C(t.session,e.ceremony.session_id)||!C(t.stable_context_binding,e.ceremony.stable_key_context_binding))throw Error(`${r} does not match the admitted export binding`);return{kind:`export`,deriver:n,operation:`export`,session:t.session,stable_context_binding:t.stable_context_binding,encapsulated_key:t.encapsulated_key,ciphertext:t.ciphertext}}function z(e,t){let n=u(e,t);return j(n,t,[`kind`,`deriver`,`session`,`transcript`,`encapsulated_key`,`ciphertext`]),{kind:Ie(n.kind,`${t}.kind`),deriver:Pe(n.deriver,`${t}.deriver`),session:S(n.session,`${t}.session`,!0),transcript:S(n.transcript,`${t}.transcript`,!0),encapsulated_key:S(n.encapsulated_key,`${t}.encapsulated_key`,!0),ciphertext:se(n.ciphertext,`${t}.ciphertext`,16,Se)}}function B(e){let t=u(e,`public_receipt`);return j(t,`public_receipt`,[`transcript`,`registered_public_key`,`joined_client_commitment`,`joined_signing_worker_commitment`,`signing_worker_verifying_share`,`state_epoch`,`material_activation`]),{transcript:S(t.transcript,`public_receipt.transcript`,!0),registered_public_key:S(t.registered_public_key,`public_receipt.registered_public_key`,!0),joined_client_commitment:S(t.joined_client_commitment,`public_receipt.joined_client_commitment`,!0),joined_signing_worker_commitment:S(t.joined_signing_worker_commitment,`public_receipt.joined_signing_worker_commitment`,!0),signing_worker_verifying_share:S(t.signing_worker_verifying_share,`public_receipt.signing_worker_verifying_share`,!0),state_epoch:Me(t.state_epoch,`public_receipt.state_epoch`),material_activation:v(t.material_activation)}}function Ke(e,t,n,r,i){if(n.kind!==`activation_client`||n.deriver!==r||!C(n.session,e.session_id)||!C(n.transcript,t.transcript))throw Error(`${i} does not match the terminal activation receipt`);return{kind:`activation_client`,deriver:r,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}}function qe(e,t,n,r,i){if(n.kind!==`export_client`||n.deriver!==r||!C(n.session,e.ceremony.session_id)||!C(n.transcript,t))throw Error(`${i} does not match the terminal export result`);return{kind:`export_client`,deriver:r,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}}function V(e,t){try{return{ok:!0,value:e(t)}}catch(e){return{ok:!1,code:`invalid_body`,message:e instanceof Error?e.message:String(e)}}}function Je(e){let t=u(e,`registration admission request`);return j(t,`registration admission request`,[`scope`,`application_binding`,`participant_ids`]),{scope:ze(t.scope),application_binding:M(t.application_binding),participant_ids:N(t.participant_ids)}}function Ye(e){let t=u(e,`recovery admission request`);j(t,`recovery admission request`,[`scope`,`active_material_activation`,`application_binding`,`participant_ids`,`active_capability_binding`,`replacement_capability_binding`,`registered_public_key`]);let n=S(t.active_capability_binding,`recovery admission request.active_capability_binding`,!0),r=S(t.replacement_capability_binding,`recovery admission request.replacement_capability_binding`,!0);if(C(n,r))throw Error(`recovery replacement capability binding must be fresh`);let i=ze(t.scope),a=v(t.active_material_activation),o=i.material_activation;if(a.activation_id===o.activation_id||a.lifecycle_binding===o.lifecycle_binding)throw Error(`recovery replacement material activation identity must be fresh`);if(a.capability!==o.capability||a.material_owner!==o.material_owner||a.key_binding!==o.key_binding||a.signing_worker!==o.signing_worker)throw Error(`recovery replacement material activation changed stable identity facts`);return{scope:i,active_material_activation:a,application_binding:M(t.application_binding),participant_ids:N(t.participant_ids),active_capability_binding:n,replacement_capability_binding:r,registered_public_key:S(t.registered_public_key,`recovery admission request.registered_public_key`,!0)}}function Xe(e){let t=u(e,`warm recovery bootstrap request`);if(j(t,`warm recovery bootstrap request`,[`kind`,`walletId`,`nearAccountId`,`nearEd25519SigningKeyId`,`signerSlot`,`thresholdSessionId`,`signingWorkerId`,`participantIds`]),t.kind!==`router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1`)throw Error(`warm recovery bootstrap request.kind is invalid`);return{kind:`router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1`,walletId:x(t.walletId,`warm recovery bootstrap request.walletId`),nearAccountId:x(t.nearAccountId,`warm recovery bootstrap request.nearAccountId`),nearEd25519SigningKeyId:x(t.nearEd25519SigningKeyId,`warm recovery bootstrap request.nearEd25519SigningKeyId`),signerSlot:Me(t.signerSlot,`warm recovery bootstrap request.signerSlot`),thresholdSessionId:x(t.thresholdSessionId,`warm recovery bootstrap request.thresholdSessionId`),signingWorkerId:x(t.signingWorkerId,`warm recovery bootstrap request.signingWorkerId`),participantIds:N(t.participantIds)}}function Ze(e){let t=u(e,`export admission receipt`);return j(t,`export admission receipt`,[`binding`,`keyset`]),{binding:I(t.binding),keyset:Ue(t.keyset)}}function Qe(e){let t=u(e,`export execute request`);j(t,`export execute request`,[`binding`,`deriver_a_input`,`deriver_b_input`]);let n=I(t.binding);return{binding:n,deriver_a_input:Ge(n,R(t.deriver_a_input,`deriver_a_input`),`deriver_a`,`deriver_a_input`),deriver_b_input:Ge(n,R(t.deriver_b_input,`deriver_b_input`),`deriver_b`,`deriver_b_input`)}}function $e(e){let t=u(e,`export result`);j(t,`export result`,[`binding`,`transcript`,`deriver_a_client_package`,`deriver_b_client_package`]);let n=I(t.binding),r=S(t.transcript,`export result.transcript`,!0);return{binding:n,transcript:r,deriver_a_client_package:qe(n,r,z(t.deriver_a_client_package,`deriver_a_client_package`),`deriver_a`,`deriver_a_client_package`),deriver_b_client_package:qe(n,r,z(t.deriver_b_client_package,`deriver_b_client_package`),`deriver_b`,`deriver_b_client_package`)}}function et(e){let t=u(e,`activation admission receipt`);j(t,`activation admission receipt`,[`binding`,`keyset`]);let n=L(F(t.binding)),r=Ue(t.keyset);switch(n.operation){case`registration`:return{binding:n,keyset:r};case`recovery`:return{binding:n,keyset:r}}}function tt(e){let t=u(e,`activation execute request`);j(t,`activation execute request`,[`binding`,`deriver_a_input`,`deriver_b_input`]);let n=L(F(t.binding)),r=We(n,R(t.deriver_a_input,`deriver_a_input`),`deriver_a`,`deriver_a_input`),i=We(n,R(t.deriver_b_input,`deriver_b_input`),`deriver_b`,`deriver_b_input`);if(n.operation===`registration`){if(r.operation!==`registration`||i.operation!==`registration`)throw Error(`activation inputs do not match registration binding`);return{binding:n,deriver_a_input:r,deriver_b_input:i}}if(r.operation!==`recovery`||i.operation!==`recovery`)throw Error(`activation inputs do not match recovery binding`);return{binding:n,deriver_a_input:r,deriver_b_input:i}}function nt(e){let t=u(e,`activation result`);j(t,`activation result`,[`binding`,`deriver_a_client_package`,`deriver_b_client_package`,`public_receipt`]);let n=L(F(t.binding)),r=B(t.public_receipt);if(!re(n.material_activation,r.material_activation))throw Error(`activation result receipt material does not match the admitted binding`);let i=z(t.deriver_a_client_package,`deriver_a_client_package`),a=z(t.deriver_b_client_package,`deriver_b_client_package`),o=Ke(n,r,i,`deriver_a`,`deriver_a_client_package`),s=Ke(n,r,a,`deriver_b`,`deriver_b_client_package`);switch(n.operation){case`registration`:return{binding:n,deriver_a_client_package:o,deriver_b_client_package:s,public_receipt:r};case`recovery`:return{binding:n,deriver_a_client_package:o,deriver_b_client_package:s,public_receipt:r}}}function rt(e){let t=L(F(e));switch(t.operation){case`registration`:throw Error(`recovery activation requires a recovery binding`);case`recovery`:return t}}function it(e){let t=u(e,`recovery activation receipt`);j(t,`recovery activation receipt`,[`binding`,`public_receipt`,`active_capability_binding`,`retired_capability_binding`]);let n=S(t.active_capability_binding,`recovery activation receipt.active_capability_binding`,!0),r=S(t.retired_capability_binding,`recovery activation receipt.retired_capability_binding`,!0);if(C(n,r))throw Error(`recovery activation receipt capability bindings must be distinct`);return{binding:rt(t.binding),public_receipt:B(t.public_receipt),active_capability_binding:n,retired_capability_binding:r}}function at(e,t){return e.binding.operation===t}function ot(e,t){return e.binding.operation===t}function st(e,t){return e.binding.operation===t}function H(e){return{ok:!1,code:`invalid_body`,message:`activation value must use the ${e} operation`}}function ct(e){return V(Je,e)}function lt(e){return V(Ye,e)}function ut(e){return V(Xe,e)}function dt(e){return V(Ze,e)}function ft(e){return V(Qe,e)}function pt(e){return V($e,e)}function mt(e){return V(et,e)}function ht(e){let t=mt(e);return t.ok?at(t.value,`registration`)?{ok:!0,value:t.value}:H(`registration`):t}function gt(e){let t=mt(e);return t.ok?at(t.value,`recovery`)?{ok:!0,value:t.value}:H(`recovery`):t}function _t(e){return V(tt,e)}function vt(e){let t=_t(e);return t.ok?ot(t.value,`registration`)?{ok:!0,value:t.value}:H(`registration`):t}function yt(e){let t=_t(e);return t.ok?ot(t.value,`recovery`)?{ok:!0,value:t.value}:H(`recovery`):t}function bt(e){return V(nt,e)}function xt(e){let t=bt(e);return t.ok?st(t.value,`registration`)?{ok:!0,value:t.value}:H(`registration`):t}function St(e){let t=bt(e);return t.ok?st(t.value,`recovery`)?{ok:!0,value:t.value}:H(`recovery`):t}function Ct(e){return V(it,e)}function wt(e){return V(Tt,e)}function Tt(e){return z(e,`encrypted_package`)}const Et=`seams/linked-device/ecdsa-source-contribution-envelope/v1`;function Dt(e){let t=c(e,`linked-device ordinary source contribution`);switch(t.kind){case`linked_device_ed25519_source_contribution_v1`:return Pt(t);case`linked_device_ecdsa_source_contribution_v1`:return Ft(t);default:throw Error(`linked-device ordinary source contribution kind is invalid`)}}function Ot(e){let t=Q(e,[`state`,`reservation_id`,`participant_ids`,`activation_receipt`,`deriver_a_client_package`,`deriver_b_client_package`],`linked-device Ed25519 source-preserving reservation`);if(t.state!==`inactive`)throw Error(`linked-device Ed25519 source-preserving reservation is not inactive`);let n=B(t.activation_receipt),r=P(t.participant_ids),i=U(t.deriver_a_client_package,`deriver_a`),a=U(t.deriver_b_client_package,`deriver_b`);if(!D(n.transcript,i.transcript)||!D(n.transcript,a.transcript))throw Error(`linked-device Ed25519 reservation packages have mismatched transcripts`);return{state:`inactive`,reservationId:Z(t.reservation_id,`reservation_id`),participantIds:r,activationReceipt:n,deriver_a_client_package:i,deriver_b_client_package:a}}function kt(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`linked-device ordinary source contributions must contain one or two entries`);let t=e.map(Dt),n=t.map(e=>e.keyFamily);if(new Set(n).size!==n.length)throw Error(`linked-device ordinary source contributions repeat a key family`);if(t.length===2&&(t[0]?.keyFamily!==`ed25519`||t[1]?.keyFamily!==`ecdsa_secp256k1`))throw Error(`linked-device ordinary source contributions must be Ed25519 then ECDSA`);let r=t[0];if(!r)throw Error(`linked-device ordinary source contributions are empty`);return[r,...t.slice(1)]}function At(e){let t=Q(e,[`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`source`,`target`],`linked-device ECDSA source contribution preparation`),n=Ut(t.source),r=Wt(t.target);return Zt(n.activation,r.activation),{linkSessionId:G(t.linkSessionId),enrollmentId:K(t.enrollmentId),sourceAuthorityId:q(t.sourceAuthorityId),source:n,target:r}}function jt(e){let t=c(e,`linked-device ordinary source contribution preparation`);if(t.kind===`linked_device_ed25519_source_contribution_preparation_v1`)return Nt(t);if(Object.prototype.hasOwnProperty.call(t,`source`)&&Object.prototype.hasOwnProperty.call(t,`target`))return At(t);throw Error(`linked-device ordinary source contribution preparation family is invalid`)}function Mt(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`linked-device ordinary source contribution preparations must contain one or two entries`);let t=e.map(jt),n=t.map(e=>`kind`in e?`ed25519`:`ecdsa_secp256k1`);if(new Set(n).size!==n.length)throw Error(`linked-device ordinary source contribution preparations repeat a key family`);if(t.length===2&&(n[0]!==`ed25519`||n[1]!==`ecdsa_secp256k1`))throw Error(`linked-device ordinary source contribution preparations must be ordered Ed25519 then ECDSA`);let r=t[0];if(!r)throw Error(`linked-device ordinary source contribution preparation is empty`);return[r,...t.slice(1)]}function Nt(e){if(Q(e,[`kind`,`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`walletKeyId`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`sourceBinding`,`targetAdmission`,`applicationBinding`,`sourceRevocationEpoch`,`participantIds`,`targetMaterialActivation`,`targetClientRecipientPublicKeyB64u`,`targetSigningWorkerRecipientPublicKeyB64u`,`sourceRegisteredPublicKeyB64u`],`linked-device Ed25519 source contribution preparation`),e.kind!==`linked_device_ed25519_source_contribution_preparation_v1`)throw Error(`linked-device Ed25519 source contribution preparation kind is invalid`);let t=Kt(e.sourceBinding,`sourceBinding`),n=ht(e.targetAdmission);if(!n.ok)throw Error(`targetAdmission ${n.message}`);let r=n.value,a=M(e.applicationBinding);if(typeof e.sourceRevocationEpoch!=`number`||!Number.isSafeInteger(e.sourceRevocationEpoch)||e.sourceRevocationEpoch<0)throw Error(`sourceRevocationEpoch must be a non-negative safe integer`);let o=W(e.targetMaterialActivation,`targetMaterialActivation`),s=G(e.linkSessionId),c=K(e.enrollmentId),l=q(e.sourceAuthorityId),u=$t(e.walletKeyId),d=J(e.targetDeviceId),f=Y(e.targetFactorVerificationDigestB64u,`targetFactorVerificationDigestB64u`),p=X(e.targetClientRecipientPublicKeyB64u,32,`targetClientRecipientPublicKeyB64u`),m=X(e.targetSigningWorkerRecipientPublicKeyB64u,32,`targetSigningWorkerRecipientPublicKeyB64u`);if(p===m)throw Error(`linked-device Ed25519 source contribution recipients must differ`);let h=P(e.participantIds);if(Jt(t,s,`sourceBinding`),!i(o,y(r.binding.material_activation)))throw Error(`targetAdmission activation differs from targetMaterialActivation`);if(!Yt(t,r.binding))throw Error(`source and target Ed25519 contribution bindings differ`);if(t.material_activation.activation_id===o.activationId)throw Error(`source and target Ed25519 contribution activations must differ`);return{kind:`linked_device_ed25519_source_contribution_preparation_v1`,linkSessionId:s,enrollmentId:c,sourceAuthorityId:l,walletKeyId:u,targetDeviceId:d,targetFactorVerificationDigestB64u:f,sourceBinding:t,targetAdmission:r,applicationBinding:a,sourceRevocationEpoch:e.sourceRevocationEpoch,participantIds:h,targetMaterialActivation:o,targetClientRecipientPublicKeyB64u:p,targetSigningWorkerRecipientPublicKeyB64u:m,sourceRegisteredPublicKeyB64u:ee(e.sourceRegisteredPublicKeyB64u,`sourceRegisteredPublicKeyB64u`)}}function Pt(e){if(Q(e,[`kind`,`keyFamily`,`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`walletKeyId`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`targetMaterialActivation`,`targetClientRecipientPublicKeyB64u`,`targetSigningWorkerRecipientPublicKeyB64u`,`sourceBinding`,`reservationId`,`targetBinding`,`activationReceipt`,`participantIds`,`deriver_a_client_package`,`deriver_b_client_package`,`sourceRegisteredPublicKeyB64u`],`linked-device Ed25519 source contribution`),e.kind!==`linked_device_ed25519_source_contribution_v1`)throw Error(`linked-device Ed25519 source contribution kind is invalid`);if(e.keyFamily!==`ed25519`)throw Error(`linked-device Ed25519 source contribution family is invalid`);let t=Kt(e.sourceBinding,`sourceBinding`),n=W(e.targetMaterialActivation,`source contribution targetMaterialActivation`),r=Kt(e.targetBinding,`targetBinding`),a=B(e.activationReceipt),o=Z(e.reservationId,`reservationId`),s=P(e.participantIds),c=G(e.linkSessionId),l=K(e.enrollmentId),u=q(e.sourceAuthorityId),d=$t(e.walletKeyId),p=J(e.targetDeviceId),m=Y(e.targetFactorVerificationDigestB64u,`targetFactorVerificationDigestB64u`),h=X(e.targetClientRecipientPublicKeyB64u,32,`targetClientRecipientPublicKeyB64u`),g=X(e.targetSigningWorkerRecipientPublicKeyB64u,32,`targetSigningWorkerRecipientPublicKeyB64u`);if(h===g)throw Error(`linked-device Ed25519 source contribution recipients must differ`);if(Jt(t,c,`sourceBinding`),qt(r,c,n,`targetBinding`),!Yt(t,r))throw Error(`linked-device Ed25519 source contribution stable identity differs`);if(!i(y(a.material_activation),n))throw Error(`linked-device Ed25519 source contribution receipt activation differs`);let te=ee(e.sourceRegisteredPublicKeyB64u,`sourceRegisteredPublicKeyB64u`);if(!D(a.registered_public_key,Array.from(f(te))))throw Error(`linked-device Ed25519 source contribution receipt public key differs`);let _=U(e.deriver_a_client_package,`deriver_a`),v=U(e.deriver_b_client_package,`deriver_b`);if(!D(a.transcript,_.transcript)||!D(a.transcript,v.transcript))throw Error(`linked-device Ed25519 source contribution package transcript differs`);if(t.material_activation.activation_id===n.activationId)throw Error(`linked-device Ed25519 source contribution reuses the source activation`);return{kind:`linked_device_ed25519_source_contribution_v1`,keyFamily:`ed25519`,linkSessionId:c,enrollmentId:l,sourceAuthorityId:u,walletKeyId:d,targetDeviceId:p,targetFactorVerificationDigestB64u:m,targetMaterialActivation:n,targetClientRecipientPublicKeyB64u:h,targetSigningWorkerRecipientPublicKeyB64u:g,sourceBinding:t,reservationId:o,targetBinding:r,activationReceipt:a,participantIds:s,deriver_a_client_package:_,deriver_b_client_package:v,sourceRegisteredPublicKeyB64u:te}}function Ft(e){if(Q(e,[`kind`,`keyFamily`,`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`walletKeyId`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`sourceSigner`,`sourceDerivation`,`target`,`package`],`linked-device ECDSA source contribution`),e.kind!==`linked_device_ecdsa_source_contribution_v1`)throw Error(`linked-device ECDSA source contribution kind is invalid`);if(e.keyFamily!==`ecdsa_secp256k1`)throw Error(`linked-device ECDSA source contribution family is invalid`);let t=G(e.linkSessionId),n=K(e.enrollmentId),r=q(e.sourceAuthorityId),i=$t(e.walletKeyId),a=J(e.targetDeviceId),o=Y(e.targetFactorVerificationDigestB64u,`targetFactorVerificationDigestB64u`),s=Ut(e.sourceSigner),c=It(e.sourceDerivation),l=Wt(e.target);Zt(s.activation,l.activation);let u=Vt(e.package);if(u.binding.linkSessionId!==t||u.binding.enrollmentId!==n||u.binding.sourceAuthorityId!==r||u.binding.target.targetDeviceId!==a||u.binding.target.targetFactorVerificationDigestB64u!==o)throw Error(`linked-device ECDSA source contribution package binding differs`);if(!Xt(u.binding.source,s))throw Error(`linked-device ECDSA source contribution signer differs from package binding`);if(!Qt(u.binding.target,l))throw Error(`linked-device ECDSA source contribution target differs from package binding`);return{kind:`linked_device_ecdsa_source_contribution_v1`,keyFamily:`ecdsa_secp256k1`,linkSessionId:t,enrollmentId:n,sourceAuthorityId:r,walletKeyId:i,targetDeviceId:a,targetFactorVerificationDigestB64u:o,sourceSigner:s,sourceDerivation:c,target:l,package:u}}function It(e){let t=Q(e,[`applicationBindingDigestB64u`,`clientShareRetryCounter`,`ecdsaThresholdKeyId`,`sourceNormalSigning`],`linked-device ECDSA source derivation`),n=t.clientShareRetryCounter;if(typeof n!=`number`||!Number.isSafeInteger(n)||n<0)throw Error(`linked-device ECDSA source derivation retry counter is invalid`);let r=Y(t.applicationBindingDigestB64u,`sourceDerivation.applicationBindingDigestB64u`),i=ie(t.sourceNormalSigning),a=ne(t.ecdsaThresholdKeyId);if(i.scope.context.application_binding_digest_b64u!==r||i.scope.public_identity.client_share_retry_counter!==n||i.scope.ecdsa_threshold_key_id!==a)throw Error(`linked-device ECDSA source derivation differs from normal signing`);return{applicationBindingDigestB64u:r,clientShareRetryCounter:n,ecdsaThresholdKeyId:a,sourceNormalSigning:i}}function Lt(e){let t=Q(e,[`state`,`binding`,`sourceDerivation`,`targetRelayerPublicKey33B64u`,`thresholdPublicKey33B64u`,`thresholdEthereumAddress20B64u`,`normalSigning`],`linked-device ECDSA source-preserving activation receipt`);if(t.state!==`inactive`)throw Error(`linked-device ECDSA source-preserving activation receipt is not inactive`);let n=Ht(t.binding),r=It(t.sourceDerivation),i=m(t.targetRelayerPublicKey33B64u,`targetRelayerPublicKey33B64u`),a=m(t.thresholdPublicKey33B64u,`thresholdPublicKey33B64u`),o=X(t.thresholdEthereumAddress20B64u,20,`thresholdEthereumAddress20B64u`),s=ie(t.normalSigning);return Rt({binding:n,sourceDerivation:r,targetRelayerPublicKey33B64u:i,thresholdPublicKey33B64u:a,thresholdEthereumAddress20B64u:o,normalSigning:s}),{state:`inactive`,binding:n,sourceDerivation:r,targetRelayerPublicKey33B64u:i,thresholdPublicKey33B64u:a,thresholdEthereumAddress20B64u:o,normalSigning:s}}function Rt(e){let t=e.sourceDerivation.sourceNormalSigning.scope,n=e.normalSigning.scope;if(!i(y(t.material_activation),e.binding.source.activation)||!i(y(n.material_activation),e.binding.target.activation)||t.wallet_id!==n.wallet_id||t.wallet_id!==e.binding.source.activation.materialOwner||n.wallet_id!==e.binding.target.activation.materialOwner||t.ecdsa_threshold_key_id!==n.ecdsa_threshold_key_id||t.signing_root_id!==n.signing_root_id||t.signing_root_version!==n.signing_root_version||t.context.application_binding_digest_b64u!==n.context.application_binding_digest_b64u||t.activation_epoch!==n.activation_epoch||t.public_identity.derivation_client_share_public_key33_b64u!==e.binding.source.clientPublicKey33B64u||t.public_identity.server_public_key33_b64u!==e.binding.source.relayerPublicKey33B64u||t.public_identity.threshold_public_key33_b64u!==e.binding.source.thresholdPublicKey33B64u||t.public_identity.ethereum_address20_b64u!==e.binding.source.thresholdEthereumAddress20B64u||n.public_identity.context_binding_b64u!==t.public_identity.context_binding_b64u||n.public_identity.derivation_client_share_public_key33_b64u!==e.binding.targetClientPublicKey33B64u||n.public_identity.server_public_key33_b64u!==e.targetRelayerPublicKey33B64u||n.public_identity.threshold_public_key33_b64u!==e.thresholdPublicKey33B64u||n.public_identity.ethereum_address20_b64u!==e.thresholdEthereumAddress20B64u||n.public_identity.client_share_retry_counter!==t.public_identity.client_share_retry_counter||n.public_identity.server_share_retry_counter!==t.public_identity.server_share_retry_counter||n.signing_worker.server_id!==e.binding.target.activation.signingWorker||n.signing_worker.key_epoch!==t.signing_worker.key_epoch||n.signing_worker.recipient_encryption_key!==zt(e.binding.target.signingWorkerRecipientPublicKeyB64u))throw Error(`linked-device ECDSA normal signing state differs from its activation receipt`)}function zt(e){let t=f(e);if(t.length!==32||d(t)!==e)throw Error(`linked-device signing-worker recipient key is invalid`);let n=``;for(let e of t)n+=e.toString(16).padStart(2,`0`);return`x25519:${n}`}function U(e,t){let n=Bt(e,`${t} client package`);if(n.kind!==`activation_client`||n.deriver!==t)throw Error(`${t} client package is not an activation client package`);return t===`deriver_a`?{kind:`activation_client`,deriver:`deriver_a`,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}:{kind:`activation_client`,deriver:`deriver_b`,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}}function Bt(e,t){let n=wt(e);if(!n.ok)throw Error(`${t} ${n.message}`);return n.value}function Vt(e){let t=Q(e,[`binding`,`encryptedDelta`,`encryptedTargetClientShare`],`linked-device ECDSA source contribution package`),n=Ht(t.binding),r=Gt(t.encryptedDelta,`encryptedDelta`),i=Gt(t.encryptedTargetClientShare,`encryptedTargetClientShare`),a=r.bindingDigestB64u;if(i.bindingDigestB64u!==a)throw Error(`linked-device ECDSA source contribution envelope bindings differ`);if(r.recipientPublicKeyB64u!==n.target.signingWorkerRecipientPublicKeyB64u||i.recipientPublicKeyB64u!==n.target.clientRecipientPublicKeyB64u)throw Error(`linked-device ECDSA source contribution envelope recipients differ`);return{binding:n,encryptedDelta:r,encryptedTargetClientShare:i}}function Ht(e){let t=Q(e,[`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`source`,`target`,`targetClientPublicKey33B64u`],`linked-device ECDSA source contribution binding`),n=Ut(t.source),r=Wt(t.target);return Zt(n.activation,r.activation),{linkSessionId:Z(t.linkSessionId,`binding.linkSessionId`),enrollmentId:Z(t.enrollmentId,`binding.enrollmentId`),sourceAuthorityId:Z(t.sourceAuthorityId,`binding.sourceAuthorityId`),source:n,target:r,targetClientPublicKey33B64u:m(t.targetClientPublicKey33B64u,`binding.targetClientPublicKey33B64u`)}}function Ut(e){let t=Q(e,[`activation`,`clientPublicKey33B64u`,`relayerPublicKey33B64u`,`thresholdPublicKey33B64u`,`thresholdEthereumAddress20B64u`],`linked-device ECDSA source signer`);return{activation:W(t.activation,`source.activation`),clientPublicKey33B64u:m(t.clientPublicKey33B64u,`source.clientPublicKey33B64u`),relayerPublicKey33B64u:m(t.relayerPublicKey33B64u,`source.relayerPublicKey33B64u`),thresholdPublicKey33B64u:m(t.thresholdPublicKey33B64u,`source.thresholdPublicKey33B64u`),thresholdEthereumAddress20B64u:X(t.thresholdEthereumAddress20B64u,20,`source.thresholdEthereumAddress20B64u`)}}function Wt(e){let t=Q(e,[`activation`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`clientRecipientPublicKeyB64u`,`signingWorkerRecipientPublicKeyB64u`],`linked-device ECDSA target recipient`),n=X(t.clientRecipientPublicKeyB64u,32,`target.clientRecipientPublicKeyB64u`),r=X(t.signingWorkerRecipientPublicKeyB64u,32,`target.signingWorkerRecipientPublicKeyB64u`);if(n===r)throw Error(`linked-device ECDSA target recipients must differ`);return{activation:W(t.activation,`target.activation`),targetDeviceId:J(t.targetDeviceId),targetFactorVerificationDigestB64u:Y(t.targetFactorVerificationDigestB64u,`target.targetFactorVerificationDigestB64u`),clientRecipientPublicKeyB64u:n,signingWorkerRecipientPublicKeyB64u:r}}function Gt(e,t){let n=Q(e,[`kind`,`recipientPublicKeyB64u`,`bindingDigestB64u`,`encappedKeyB64u`,`ciphertextB64u`],`linked-device ECDSA ${t}`);if(n.kind!==Et)throw Error(`${t}.kind is invalid`);return{kind:Et,recipientPublicKeyB64u:X(n.recipientPublicKeyB64u,32,`${t}.recipientPublicKeyB64u`),bindingDigestB64u:Y(n.bindingDigestB64u,`${t}.bindingDigestB64u`),encappedKeyB64u:X(n.encappedKeyB64u,32,`${t}.encappedKeyB64u`),ciphertextB64u:p(n.ciphertextB64u,`${t}.ciphertextB64u`)}}function Kt(e,t){let n=Ve(e);if(n.operation!==`registration`)throw Error(`${t} must use the registration operation`);return n}function qt(e,t,n,r){if(e.material_activation.activation_id!==n.activationId)throw Error(`${r} activation does not match the target activation`);if(e.material_activation.material_owner!==n.materialOwner)throw Error(`${r} material owner does not match the target activation`);if(e.material_activation.signing_worker!==n.signingWorker)throw Error(`${r} signing worker does not match the target activation`);if(e.session_id.length!==32||String(t).length===0)throw Error(`${r} link binding is invalid`)}function Jt(e,t,n){if(e.session_id.length!==32||String(t).length===0)throw Error(`${n} link binding is invalid`)}function Yt(e,t){return e.operation===t.operation&&e.stable_key_context_binding.every((e,n)=>e===t.stable_key_context_binding[n])&&e.material_activation.capability===t.material_activation.capability&&e.material_activation.material_owner===t.material_activation.material_owner&&e.material_activation.key_binding===t.material_activation.key_binding&&e.material_activation.lifecycle_binding===t.material_activation.lifecycle_binding&&e.material_activation.signing_worker===t.material_activation.signing_worker&&e.lifecycle.root_share_epoch===t.lifecycle.root_share_epoch&&e.lifecycle.account_id===t.lifecycle.account_id&&e.lifecycle.signer_set_id===t.lifecycle.signer_set_id&&e.lifecycle.selected_server_id===t.lifecycle.selected_server_id}function Xt(e,t){return i(e.activation,t.activation)&&e.clientPublicKey33B64u===t.clientPublicKey33B64u&&e.relayerPublicKey33B64u===t.relayerPublicKey33B64u&&e.thresholdPublicKey33B64u===t.thresholdPublicKey33B64u&&e.thresholdEthereumAddress20B64u===t.thresholdEthereumAddress20B64u}function Zt(e,t){if(i(e,t)||e.materialOwner!==t.materialOwner||e.signingWorker!==t.signingWorker)throw Error(`linked-device ECDSA source and target activations are invalid`)}function Qt(e,t){return i(e.activation,t.activation)&&e.targetDeviceId===t.targetDeviceId&&e.targetFactorVerificationDigestB64u===t.targetFactorVerificationDigestB64u&&e.clientRecipientPublicKeyB64u===t.clientRecipientPublicKeyB64u&&e.signingWorkerRecipientPublicKeyB64u===t.signingWorkerRecipientPublicKeyB64u}function W(e,t){let n=o(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function G(e){let t=a(Z(e,`linkSessionId`));if(!t.ok)throw Error(`linkSessionId ${t.error.message}`);return t.value}function K(e){let t=s(Z(e,`enrollmentId`));if(!t.ok)throw Error(`enrollmentId ${t.error.message}`);return t.value}function q(t){let n=e(Z(t,`sourceAuthorityId`));if(!n.ok)throw Error(`sourceAuthorityId ${n.error.message}`);return n.value}function $t(e){let t=n(Z(e,`walletKeyId`));if(!t.ok)throw Error(`walletKeyId ${t.error.message}`);return t.value}function J(e){let t=h(Z(e,`targetDeviceId`));if(!t.ok)throw Error(`targetDeviceId ${t.error.message}`);return t.value}function Y(e,t){try{return g(e)}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is invalid`}`)}}function X(e,t,n){if(typeof e!=`string`||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${n} must be canonical base64url`);let r;try{r=f(e)}catch{throw Error(`${n} must be canonical base64url`)}if(r.length!==t||d(r)!==e)throw Error(`${n} must decode to ${t} bytes`);return e}function Z(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e||[...e].some(e=>{let t=e.charCodeAt(0);return t<32||t===127}))throw Error(`${t} must be a non-empty visible string`);return e}function Q(e,t,n){let r=c(e,n),i=new Set(t),a=Object.keys(r);if(a.length!==t.length||a.some(e=>!i.has(e))||t.some(e=>!Object.prototype.hasOwnProperty.call(r,e)))throw Error(`${n} contains unknown or missing fields`);return r}function en(e){return!e||typeof e!=`object`||Array.isArray(e)?null:e}function $(e){return typeof e==`string`?e.trim():``}function tn(e,t){let n=$(e);return n?{ok:!0,value:n}:{ok:!1,error:{code:`missing`,message:`${t} is required`}}}function nn(e){let t=typeof e==`number`?e:Number(e);return!Number.isSafeInteger(t)||t<1?{ok:!1,error:{code:`invalid`,message:`signerSlot must be an integer >= 1`}}:{ok:!0,value:t}}function rn(e){return{ok:!1,error:{code:`invalid`,message:`${e} must be an object`}}}function an(e){let t=r(e);return t.ok?{ok:!0,value:t.value}:{ok:!1,error:t.error}}function on(e){let n=en(e);if(!n)return rn(`WalletIdentity`);let r=t(n.walletId);return r.ok?{ok:!0,value:{walletId:r.value}}:{ok:!1,error:r.error}}function sn(e){return{walletId:e.walletId}}function cn(e){return{wallet:e.wallet,rpId:e.rpId}}function ln(e){let t=$(e.credentialIdB64u);if(!t)throw Error(`credentialIdB64u is required`);return{kind:`passkey`,walletAuthMethodId:e.walletAuthMethodId,scope:e.scope,credentialIdB64u:t}}function un(e){let t=$(e.emailHashHex),n=$(e.registrationAuthorityId);if(!t)throw Error(`emailHashHex is required`);if(!n)throw Error(`registrationAuthorityId is required`);return{kind:`email_otp`,walletAuthMethodId:e.walletAuthMethodId,wallet:e.wallet,emailHashHex:t,registrationAuthorityId:n}}function dn(e){return{kind:`implicit_near_account`,wallet:e.wallet,nearAccountId:e.nearAccountId}}function fn(e){return{kind:`named_near_account`,wallet:e.wallet,nearAccountId:e.nearAccountId}}function pn(e){let t=en(e);if(!t)return rn(`NearAccountBinding`);let n=on(t.wallet);if(!n.ok)return n;let r=$(t.kind);if(r===`implicit_near_account`){let e=_(t.nearAccountId);return e.ok?{ok:!0,value:dn({wallet:n.value,nearAccountId:e.value})}:{ok:!1,error:{code:e.code,message:e.message}}}if(r===`named_near_account`){let e=te(t.nearAccountId);return e.ok?{ok:!0,value:fn({wallet:n.value,nearAccountId:e.value})}:{ok:!1,error:{code:e.code,message:e.message}}}return{ok:!1,error:{code:`invalid`,message:`NearAccountBinding kind is invalid`}}}function mn(e){let t=nn(e.signerSlot);if(!t.ok)throw Error(t.error.message);return{kind:`near_ed25519_signer`,account:e.account,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:t.value}}function hn(e){let t=en(e);if(!t)return rn(`NearEd25519SignerBinding`);let n=pn(t.account);if(!n.ok)return n;let r=tn(t.nearEd25519SigningKeyId,`nearEd25519SigningKeyId`);if(!r.ok)return r;let i=nn(t.signerSlot);return i.ok?{ok:!0,value:mn({account:n.value,nearEd25519SigningKeyId:ae(r.value),signerSlot:i.value})}:i}function gn(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`${t} must be an object`);return e}function _n(e,t){let n=l(e,t);switch(n){case`sent`:case`reused`:return n;default:throw Error(`${t} must be sent or reused`)}}function vn(e,t){return{kind:`provider`,status:e,emailHint:t}}function yn(e,t){let n=gn(e,t),r=l(n.kind,`${t}.kind`),i=_n(n.status,`${t}.status`),a=l(n.emailHint,`${t}.emailHint`);switch(r){case`provider`:case`development`:if(n.otpCode!==void 0)throw Error(`${t}.otpCode is only valid for code-bearing delivery`);return vn(i,a);case`demo_code_response`:case`provider_and_demo_code`:{let e=l(n.otpCode,`${t}.otpCode`);if(!/^\d{6}$/.test(e))throw Error(`${t}.otpCode must be a 6-digit code`);return{kind:r,status:i,emailHint:a,otpCode:e}}default:throw Error(`${t}.kind is invalid`)}}function bn(e){switch(e.kind){case`provider`:return null;case`demo_code_response`:case`provider_and_demo_code`:return e.otpCode}}export{B as A,Ct as B,ge as C,fe as D,he as E,ft as F,xt as G,lt as H,pt as I,Ce as J,ct as K,P as L,Ve as M,wt as N,pe as O,dt as P,gt as R,xe as S,_e as T,ht as U,St as V,vt as W,De as X,D as Y,de as Z,kt as _,fn as a,ye as b,ln as c,an as d,Gt as f,jt as g,Mt as h,dn as i,M as j,ve as k,sn as l,Ot as m,yn as n,mn as o,Lt as p,ut as q,un as r,cn as s,bn as t,hn as u,Xt as v,me as w,be as x,Qt as y,yt as z};

package/dist/esm/sdk/digestEncoding-Dzc1rzWV.js

@@ -1 +0,0 @@
-import{R as e,l as t}from"./normalize-kUDm5zfS.js";import{C as n}from"./chains-CiYQT1K4.js";import{i as r,r as i}from"./base64-CsEj-_bC.js";import{r as a}from"./canonicalPrimitives-CKPGgpxg.js";function o(e,n={trim:!0}){let r=String(e??``);return t(n.trim?r.trim():r)}function s(e){let t=String(e.token??``).trim();if(!t)throw Error(e.missingMessage);return{Authorization:`Bearer ${t}`}}function c(e){return{method:`POST`,headers:{"Content-Type":`application/json`,...e.headers||{}},credentials:`omit`,body:e.bodyJson??JSON.stringify(e.body)}}function l(e,t){let n=o(e),r=globalThis.location?.origin,i;try{i=new URL(n).origin}catch{return}if(!(!r||i===r))for(let e of t)fetch(`${n}${e}`,{method:`OPTIONS`,credentials:`omit`}).catch(()=>{})}function u(e){return{...s({token:e.token,missingMessage:`Wallet Session token is required`}),...d(e.home)}}function d(e){switch(e.kind){case`direct`:return{};case`regional`:return{"X-Seams-Wallet-Region":e.region}}}async function f(e){let t=await fetch(e.clone());if(t.status!==409||!e.headers.has(`X-Seams-Wallet-Region`))return t;let r;try{r=await t.clone().json()}catch{return t}if(!n(r)||r.code!==`wallet_home_discovery_required`)return t;let i=new Headers(e.headers);return i.delete(`X-Seams-Wallet-Region`),fetch(new Request(e,{headers:i}))}function p(e,t){if(typeof e!=`string`)throw Error(`EVM-family signing key slot id requires ${t}`);let n=e.trim();if(!n)throw Error(`EVM-family signing key slot id requires ${t}`);return n}function m(e){return encodeURIComponent(p(e,`non-empty components`))}function h(e){let t=e.split(`:`);return t.length===5&&t[0]===`wallet-key`&&t[1]===`evm-family`&&t.slice(2).every(e=>e.length>0)}function g(t){let n=e(t);return n.ok?h(String(n.value))?{ok:!0,value:String(n.value)}:{ok:!1,error:{code:`invalid`,message:`EVM-family signing key slot id must be wallet-key:evm-family:<walletId>:<signingRootId>:<signingRootVersion>`}}:n}function _(e,t=`evmFamilySigningKeySlotId`){let n=g(e);if(n.ok)return n.value;throw n.error.code===`missing`?Error(`${t} is required`):Error(`${t} must be an EVM-family signing key slot id`)}function v(e){return _([`wallet-key`,`evm-family`,m(e.walletId),m(e.signingRootId),m(e.signingRootVersion)].join(`:`))}const y=new TextEncoder;function b(e){let t=0;for(let n of e)t+=n.length;let n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function x(e,t){if(!Number.isSafeInteger(e)||e<0||e>4294967295)throw Error(`${t} must be a non-negative u32`);return Uint8Array.from([e>>>24&255,e>>>16&255,e>>>8&255,e&255])}function S(e,t){if(!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);let n=BigInt(e),r=new Uint8Array(8);for(let e=7;e>=0;--e)r[e]=Number(n&255n),n>>=8n;return r}function C(e,t){return b([x(e.length,`${t}.length`),e])}function w(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);return C(y.encode(e),t)}function T(e,t){try{let t=i(a(e));if(t.length!==32)throw Error(`must decode to 32 bytes`);return t}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is invalid`}`)}}function E(e,t){try{let t=i(e);if(t.length===0||r(t)!==e)throw Error(`must be canonical base64url`);return t}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is invalid`}`)}}export{w as a,v as c,c as d,d as f,l as g,o as h,E as i,_ as l,f as m,C as n,x as o,u as p,T as r,S as s,b as t,s as u};