@seams/wallet 0.9.3 → 0.10.0

package/dist/esm/sdk/walletRecoveryCommit-Cc9AqHr0.js

@@ -1 +0,0 @@
-import{B as e,I as t,L as n,P as r,V as i,g as a,h as o,j as s,z as c}from"./normalize-kUDm5zfS.js";import{E as l,c as u,d,k as f}from"./chains-CiYQT1K4.js";import{i as p,r as m}from"./base64-CsEj-_bC.js";import{_ as h,c as g,i as _,n as v,o as y,r as b,s as x,t as S,y as C}from"./primitives-CAcl7ON7.js";import{o as ee}from"./sessionPolicy-J-RrlPZQ.js";import{n as w,t as T}from"./signingSessionSeal-CDLUmAFY.js";import{E,O as D,k as te}from"./activeWalletSession-DiZcKjB_.js";import{l as ne}from"./capabilityKinds-CKQ4Uqnv.js";import{d as O,h as k,l as re}from"./digestEncoding-Dzc1rzWV.js";import{d as ie,t as A}from"./accountIds-BzZs7YoX.js";import{M as ae,h as oe,m as se}from"./accountLifecycle-CAMVowDl.js";import{m as ce}from"./walletAuthority-B5hXHWpK.js";import{Jt as le,Kt as ue,Nt as de,Qt as fe,Wt as pe,Xt as me,Yt as he,en as ge,q as _e,qt as ve,tn as ye,tt as be,xt as xe}from"./emailOtpEcdsaDerivationIdentity-B8HzTh4T.js";import{n as Se}from"./challengeDelivery-DxXAkOfS.js";import{i as Ce}from"./walletAuthMethodRecord-CXedSgpV.js";import{d as j}from"./passkey-custody-BQj44jEM.js";import{C as we}from"./ecdsaCapabilityManifest-BlzJAQF8.js";import{E as Te,_ as Ee,r as De,u as M}from"./walletCustodyEcdsaContinuity-abNZ_dvX.js";import{a as Oe,f as ke,l as Ae,n as N,t as je,u as P}from"./wallet-recovery-C1kesLCF.js";import{o as Me}from"./helpers-Ddy72ULN.js";function Ne(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`wallet recovery target must be an object`);let t=e,n=Object.keys(t);switch(t.kind){case`passkey`:{if(n.length!==2||!n.includes(`rpId`))throw Error(`Passkey recovery target fields are invalid`);let e=i(t.rpId);if(!e.ok)throw Error(`Passkey recovery target RP ID is invalid`);return{kind:`passkey`,rpId:e.value}}case`google_email_otp`:if(n.length!==2||!n.includes(`googleProvider`)||t.googleProvider!==`google`)throw Error(`Google Email OTP recovery target fields are invalid`);return{kind:`google_email_otp`,googleProvider:`google`};default:throw Error(`wallet recovery target kind is unsupported`)}}const Pe=[`ok`,`walletId`,`target`,`recoveryOperationId`,`targetDeviceId`,`targetAuthorityId`,`targetWalletAuthMethodId`,`wrap`,`entries`,`keyManifest`,`reservationId`,`reservationExpiresAtMs`,`storeVersion`],Fe=[...Pe,`registration`];function F(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be an object`);return e}function Ie(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==r.size||i.some(e=>!r.has(e)))throw Error(`${n} contains unexpected fields`)}function I(e,t,n){let r=F(e,n);return Ie(r,t,n),r}function L(e,t){return Object.prototype.hasOwnProperty.call(e,t)?Reflect.get(e,t):void 0}function Le(e){try{return F(e,`walletRecoveryPrepare response`)}catch{return null}}function Re(e){let t=n(e.walletId);if(!t.ok)throw Error(`wallet recovery ${t.error.message}`);return JSON.stringify({walletId:String(t.value),wrap:e.prepared.wrap,entry:e.prepared.entries[0]})}async function ze(e){let t=await Be(e);return t.ok?await Ve({response:t.response,target:e.target,reservationId:e.reservationId}):{kind:t.kind}}async function Be(e){let t=`${k(e.relayUrl)}/wallets/recovery/prepare`,n=e.fetchImpl||fetch;try{return{ok:!0,response:await n(t,O({body:{recoveryCodeB64u:e.recoveryCodeB64u,reservationId:e.reservationId,target:e.target}}))}}catch{return{ok:!1,kind:`transport_uncertain`}}}async function Ve(e){let i=e.response,a=Le(await i.json().catch(()=>({})));if(i.status===200&&a&&L(a,`ok`)===!0)try{let i=I(a,e.target.kind===`passkey`?Fe:Pe,`walletRecoveryPrepare`),o=qe()(L(i,`wrap`),`walletRecoveryPrepare.wrap`),s=Je(L(i,`entries`)),l=n(L(i,`walletId`));if(!l.ok)throw Error(`walletRecoveryPrepare.walletId is invalid`);let u=l.value,d=Ne(L(i,`target`));if(!Ge(d,e.target))throw Error(`wallet recovery preparation changed the recovery target`);let f=c(L(i,`recoveryOperationId`)),p=ne(L(i,`targetDeviceId`)),m=t(L(i,`targetAuthorityId`)),h=r(L(i,`targetWalletAuthMethodId`));if(!f.ok||!p.ok||!m.ok||!h.ok)throw Error(`wallet recovery preparation target identity is invalid`);let _=Ye(L(i,`keyManifest`),u),v=ke(L(i,`reservationId`)),y=g(L(i,`reservationExpiresAtMs`),`walletRecoveryPrepare.reservationExpiresAtMs`),b=R(L(i,`storeVersion`),`storeVersion`);if(v!==e.reservationId)throw Error(`wallet recovery preparation changed the reservation identity`);let x={kind:`prepared`,walletId:u,recoveryOperationId:f.value,targetDeviceId:p.value,targetAuthorityId:m.value,targetWalletAuthMethodId:h.value,wrap:o,entries:s,keyManifest:_,reservationId:v,reservationExpiresAtMs:y,storeVersion:b};switch(d.kind){case`passkey`:{let e=He(String(u),d.rpId)(L(i,`registration`),`registration`);if(e.walletAuthMethodId!==h.value)throw Error(`wallet recovery registration changed the target auth method`);return{...x,target:d,registration:e}}case`google_email_otp`:if(Object.prototype.hasOwnProperty.call(i,`registration`))throw Error(`Google Email OTP recovery cannot carry passkey registration`);return{...x,target:d};default:return Ke(d)}}catch{return{kind:`transport_uncertain`}}return i.status===409?{kind:`retryable_conflict`}:i.status===401&&a&&L(a,`code`)===`recovery_code_used`?{kind:`consumed`}:i.status===401||i.status===400?{kind:`refused`}:{kind:`transport_uncertain`}}function He(t,n){let a=p(new TextEncoder().encode(t)),o=D({type:E(`public-key`),id:(t,n)=>{let r=te(e)(t,n);return st(r,n),r}});return D({kind:E(`webauthn_recovery_registration_v1`),challengeId:R,challengeB64u:(e,t)=>ot(e,32,t),replacementId:R,walletAuthMethodId:te(r),rpId:te(i),user:D({idB64u:st,name:R,displayName:R},(e,n)=>{if(e.idB64u!==a||e.name!==t||e.displayName!==t)throw Error(`${n} is bound to another wallet`)}),pubKeyCredParams:(e,t)=>{if(!Array.isArray(e)||e.length!==2)throw Error(`${t} is invalid`);return[Ue(-7)(e[0],`${t}[0]`),Ue(-257)(e[1],`${t}[1]`)]},authenticatorSelection:D({residentKey:E(`required`),userVerification:E(`preferred`)}),timeoutMs:(e,t)=>{let n=Number(e);if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} is invalid`);return n},attestation:E(`none`),extensions:D({prf:D({eval:D({firstB64u:We(T),secondB64u:We(w)})})}),excludeCredentials:(e,t)=>l(e,t).map((e,n)=>o(e,`${t}[${n}]`))},(e,t)=>{if(e.rpId!==n)throw Error(`${t} changed the relying party`)})}function Ue(e){return D({type:E(`public-key`),alg:(t,n)=>{if(t!==e)throw Error(`${n} is invalid`);return e}})}function We(e){return(t,n)=>{let r=ot(t,e.length,n);if(r!==p(e))throw Error(`${n} is unsupported`);return r}}function Ge(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId;case`google_email_otp`:return t.kind===`google_email_otp`&&e.googleProvider===t.googleProvider;default:return Ke(e)}}function Ke(e){throw Error(`unsupported wallet recovery target: ${String(e)}`)}function qe(){return D({nonceB64u:_,wrappedManifestKekB64u:b,aadHashB64u:S})}function Je(e){if(!Array.isArray(e)||e.length!==1)throw Error(`walletRecoveryPrepare.entries must contain exactly one custody seed`);return[Oe(e[0],`walletRecoveryPrepare.entries[0]`)]}function R(e,t){if(typeof e!=`string`||!e.trim())throw Error(`walletRecoveryPrepare.${t} must be a non-empty string`);return e.trim()}function Ye(e,t){let n=I(e,[`version`,`walletId`,`entries`],`walletRecoveryPrepare.keyManifest`);if(L(n,`version`)!==`wallet_recovery_preparation_key_manifest_v1`)throw Error(`walletRecoveryPrepare.keyManifest version is invalid`);let r=R(L(n,`walletId`),`keyManifest.walletId`);if(r!==t)throw Error(`walletRecoveryPrepare.keyManifest changed the wallet identity`);let i=L(n,`entries`);if(!Array.isArray(i)||i.length===0)throw Error(`walletRecoveryPrepare.keyManifest must contain a key set`);let a=i.map(e=>Xe(e,r));if(new Set(a.map(e=>e.keySetId)).size!==a.length)throw Error(`walletRecoveryPrepare.keyManifest contains duplicate key sets`);return{version:`wallet_recovery_preparation_key_manifest_v1`,walletId:r,entries:a}}function Xe(e,t){switch(L(F(e,`walletRecoveryPrepare.keyManifest.entries[]`),`kind`)){case`near_ed25519`:{let n=I(e,[`kind`,`keySetId`,`signerId`,`nearAccountId`,`recordedKeyManifestDigestB64u`,`recoveryBasis`],`walletRecoveryPrepare.keyManifest.entries[].near_ed25519`),r=R(L(n,`signerId`),`keyManifest.entries[].signerId`),i=R(L(n,`keySetId`),`keyManifest.entries[].keySetId`),a=`near_ed25519:${r}`;if(i!==a)throw Error(`walletRecoveryPrepare NEAR key-set identity is inconsistent`);let o=R(L(n,`nearAccountId`),`keyManifest.entries[].nearAccountId`),s=Ze(L(n,`recoveryBasis`),t);return{kind:`near_ed25519`,keySetId:a,signerId:r,nearAccountId:o,recordedKeyManifestDigestB64u:S(L(n,`recordedKeyManifestDigestB64u`),`walletRecoveryPrepare.keyManifest.entries[].recordedKeyManifestDigestB64u`),recoveryBasis:s}}case`evm_family_ecdsa`:{let n=I(e,[`kind`,`keySetId`,`keyHandle`,`evmFamilySigningKeySlotId`,`recordedKeyManifestDigestB64u`,`recoveryBasis`],`walletRecoveryPrepare.keyManifest.entries[].evm_family_ecdsa`),r=R(L(n,`keyHandle`),`keyManifest.entries[].keyHandle`),i=R(L(n,`keySetId`),`keyManifest.entries[].keySetId`),a=`evm_family_ecdsa:${r}`;if(i!==a)throw Error(`walletRecoveryPrepare ECDSA key-set identity is inconsistent`);let o=Qe(L(n,`recoveryBasis`),t);return{kind:`evm_family_ecdsa`,keySetId:a,keyHandle:r,evmFamilySigningKeySlotId:re(L(n,`evmFamilySigningKeySlotId`)),recordedKeyManifestDigestB64u:S(L(n,`recordedKeyManifestDigestB64u`),`walletRecoveryPrepare.keyManifest.entries[].recordedKeyManifestDigestB64u`),recoveryBasis:o}}default:throw Error(`walletRecoveryPrepare key-manifest entry kind is invalid`)}}function Ze(e,t){let n=I(e,[`capabilityKind`,`activeCapabilityBinding`,`scope`,`applicationBinding`,`participantIds`,`registeredPublicKey`,`runtimePolicyScope`,`activationTranscript`,`activationStateEpoch`,`signingWorkerVerifyingShare`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis`),r=L(n,`capabilityKind`);if(r!==`registration`&&r!==`recovery`)throw Error(`walletRecoveryPrepare NEAR recovery capability kind is invalid`);let i=z(L(n,`activeCapabilityBinding`),32,`NEAR recovery active capability binding`),a=nt(L(n,`scope`)),o=rt(L(n,`applicationBinding`)),s=at(L(n,`participantIds`),`NEAR recovery participant IDs`),c=z(L(n,`registeredPublicKey`),32,`NEAR recovery registered public key`),l=it(L(n,`runtimePolicyScope`)),u=z(L(n,`activationTranscript`),32,`NEAR recovery activation transcript`),d=Number(L(n,`activationStateEpoch`));if(!Number.isSafeInteger(d)||d<=0)throw Error(`walletRecoveryPrepare NEAR recovery activation state epoch is invalid`);let f=z(L(n,`signingWorkerVerifyingShare`),32,`NEAR recovery signing-worker verifying share`);if(o.wallet_id!==t||a.account_id!==t||a.root_share_epoch!==l.signingRootVersion)throw Error(`walletRecoveryPrepare NEAR recovery basis changed its wallet scope`);return{capabilityKind:r,activeCapabilityBinding:i,scope:a,applicationBinding:o,participantIds:s,registeredPublicKey:c,runtimePolicyScope:l,activationTranscript:u,activationStateEpoch:d,signingWorkerVerifyingShare:f}}function Qe(e,t){let n=I(e,[`publicCapability`,`activationReceipt`,`serverGeneration`,`clientRootPublicKey33B64u`,`chainTargets`,`ecdsaThresholdKeyId`,`signingRootId`,`signingRootVersion`,`runtimePolicyScope`,`participantIds`,`possessionChallenge`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis`),r=_e(L(n,`publicCapability`)),i=be(L(n,`activationReceipt`));if(r.client_id!==t)throw Error(`walletRecoveryPrepare ECDSA recovery capability changed the wallet scope`);let a=le(L(n,`signingRootId`)),o=he(L(n,`signingRootVersion`)),s=it(L(n,`runtimePolicyScope`));if(s.signingRootVersion!==o)throw Error(`walletRecoveryPrepare ECDSA recovery scope changed the signing root`);let c=pe(L(n,`serverGeneration`));if(String(i.server_generation)!==String(c))throw Error(`walletRecoveryPrepare ECDSA activation receipt changed server generation`);let l=je(L(n,`possessionChallenge`));if(l.walletId!==t||l.expectedServerGeneration!==String(c)||l.derivationClientSharePublicKey33B64u!==r.public_identity.derivation_client_share_public_key33_b64u)throw Error(`walletRecoveryPrepare ECDSA possession challenge changed its capability`);return{publicCapability:r,activationReceipt:i,serverGeneration:c,clientRootPublicKey33B64u:ve(R(L(n,`clientRootPublicKey33B64u`),`keyManifest.entries[].recoveryBasis.clientRootPublicKey33B64u`)),chainTargets:$e(L(n,`chainTargets`)),ecdsaThresholdKeyId:me(L(n,`ecdsaThresholdKeyId`)),signingRootId:a,signingRootVersion:o,runtimePolicyScope:s,participantIds:tt(L(n,`participantIds`)),possessionChallenge:l}}function $e(e){if(!Array.isArray(e)||e.length===0)throw Error(`walletRecoveryPrepare ECDSA recovery chain targets are invalid`);let t=e.map((e,t)=>et(e,t));if(new Set(t.map(Te)).size!==t.length)throw Error(`walletRecoveryPrepare ECDSA recovery chain targets are duplicated`);let n=t[0];if(!n)throw Error(`walletRecoveryPrepare ECDSA recovery chain targets are invalid`);return[n,...t.slice(1)]}function et(e,t){let n=`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.chainTargets[${t}]`,r=F(e,n),i=L(r,`kind`);Ie(r,i===`evm`?[`kind`,`namespace`,`chainId`,`networkSlug`]:[`kind`,`chainId`,`networkSlug`],n);let a=L(r,`namespace`),o=Number(L(r,`chainId`));if(!Number.isSafeInteger(o)||o<=0)throw Error(`walletRecoveryPrepare ECDSA recovery chain id is invalid`);let s=L(r,`networkSlug`),c=typeof s==`string`&&s.trim()?s.trim():null;if(i===`evm`){if(a!==`eip155`)throw Error(`walletRecoveryPrepare ECDSA recovery EVM namespace is invalid`);return{kind:`evm`,namespace:`eip155`,chainId:o,networkSlug:c??`evm-${o}`}}if(i===`tempo`)return{kind:`tempo`,chainId:o,networkSlug:c??`tempo-${o}`};throw Error(`walletRecoveryPrepare ECDSA recovery chain family is invalid`)}function tt(e){if(!Array.isArray(e)||e.length!==2||e[0]!==1||e[1]!==2)throw Error(`walletRecoveryPrepare ECDSA recovery participant IDs are invalid`);return[1,2]}function nt(e){let t=I(e,[`lifecycle_id`,`root_share_epoch`,`account_id`,`threshold_session_id`,`signer_set_id`,`signing_worker_id`,`material_activation`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.scope`);return{lifecycle_id:R(L(t,`lifecycle_id`),`keyManifest.entries[].recoveryBasis.scope.lifecycle_id`),root_share_epoch:R(L(t,`root_share_epoch`),`keyManifest.entries[].recoveryBasis.scope.root_share_epoch`),account_id:R(L(t,`account_id`),`keyManifest.entries[].recoveryBasis.scope.account_id`),threshold_session_id:R(L(t,`threshold_session_id`),`keyManifest.entries[].recoveryBasis.scope.threshold_session_id`),signer_set_id:R(L(t,`signer_set_id`),`keyManifest.entries[].recoveryBasis.scope.signer_set_id`),signing_worker_id:R(L(t,`signing_worker_id`),`keyManifest.entries[].recoveryBasis.scope.signing_worker_id`),material_activation:fe(L(t,`material_activation`))}}function rt(e){let t=I(e,[`wallet_id`,`near_ed25519_signing_key_id`,`signing_root_id`,`key_creation_signer_slot`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.applicationBinding`),n=Number(L(t,`key_creation_signer_slot`));if(!Number.isSafeInteger(n)||n<=0)throw Error(`walletRecoveryPrepare NEAR recovery key-creation signer slot is invalid`);return{wallet_id:R(L(t,`wallet_id`),`keyManifest.entries[].recoveryBasis.applicationBinding.wallet_id`),near_ed25519_signing_key_id:R(L(t,`near_ed25519_signing_key_id`),`keyManifest.entries[].recoveryBasis.applicationBinding.near_ed25519_signing_key_id`),signing_root_id:R(L(t,`signing_root_id`),`keyManifest.entries[].recoveryBasis.applicationBinding.signing_root_id`),key_creation_signer_slot:n}}function it(e){let t=I(e,[`orgId`,`projectId`,`envId`,`signingRootVersion`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.runtimePolicyScope`);try{return C(t)}catch{throw Error(`walletRecoveryPrepare NEAR recovery runtime policy scope is invalid`)}}function at(e,t){if(!Array.isArray(e)||e.length!==2||!Number.isSafeInteger(e[0])||!Number.isSafeInteger(e[1])||Number(e[0])<=0||Number(e[1])<=0||Number(e[0])===Number(e[1]))throw Error(`walletRecoveryPrepare ${t} is invalid`);return[Number(e[0]),Number(e[1])]}function ot(e,t,n){let r=R(e,n),i=m(r);if(i.length!==t||p(i)!==r)throw Error(`walletRecoveryPrepare ${n} is invalid`);return r}function st(e,t){let n=R(e,t),r=m(n);if(r.length===0||p(r)!==n)throw Error(`walletRecoveryPrepare ${t} is invalid`);return n}function z(e,t,n){if(!Array.isArray(e)||e.length!==t||e.some(e=>!Number.isInteger(e)||e<0||e>255))throw Error(`walletRecoveryPrepare ${n} is invalid`);return e.map(Number)}const ct=`/wallets/recovery/finalize`;async function lt(e){let t=`${k(e.relayUrl)}${ct}`,n=e.fetchImpl||fetch,r;try{r=Me(e.webauthnRegistration)}catch{return{kind:`refused`}}let i;try{let t=new Set;i=e.ecdsaMaterialPossessionProofs.map(e=>{if(typeof e.keySetId!=`string`||!e.keySetId.startsWith(`evm_family_ecdsa:`)||e.keySetId.length<=17)throw Error(`ECDSA possession proof key-set id is invalid`);if(t.has(e.keySetId))throw Error(`ECDSA possession proof key-set ids are duplicated`);return t.add(e.keySetId),{keySetId:e.keySetId,proof:N(e.proof)}})}catch{return{kind:`refused`}}let a;try{if(a=j(e.replacementEnvelope,`walletRecoveryFinalize.replacementEnvelope`),String(a.walletId)!==String(e.walletId))throw Error(`replacement envelope changed the wallet identity`);if(String(a.envelopeId)!==String(e.replacementId))throw Error(`replacement envelope changed the replacement identity`);if(a.factor.kind!==`passkey`)throw Error(`replacement envelope is not bound to a passkey`)}catch{return{kind:`refused`}}let o;try{o=await n(t,O({body:{kind:`finalize`,walletId:e.walletId,reservationId:e.reservationId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,challengeId:e.challengeId,replacementId:e.replacementId,webauthnRegistration:r,replacementEnvelope:a,ecdsaMaterialPossessionProofs:i}}))}catch{return{kind:`transport_uncertain`}}let s=dt(await o.json().catch(()=>({})));if(o.status===200&&s.kind===`success`)try{let t=await P(s.projection,ft(e,a));if(t.kind!==`passkey`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:t.storeVersion,authority:t.authority,authMethod:t.authMethod}}catch{return{kind:`transport_uncertain`}}return o.status===409?{kind:`retryable_conflict`}:o.status===400||o.status===401?{kind:`refused`}:{kind:`transport_uncertain`}}async function ut(e){let t;try{if(t=j(e.replacementEnvelope,`walletRecoveryReplay.replacementEnvelope`),String(t.walletId)!==String(e.walletId)||String(t.envelopeId)!==String(e.replacementId)||t.factor.kind!==`passkey`)throw Error(`recovery replay envelope identity is invalid`)}catch{return{kind:`refused`}}let n;try{n=await(e.fetchImpl??fetch)(`${k(e.relayUrl)}${ct}`,O({body:{kind:`replay`,walletId:e.walletId,reservationId:e.reservationId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,replacementId:e.replacementId,replacementEnvelope:t}}))}catch{return{kind:`transport_uncertain`}}let r=dt(await n.json().catch(()=>({})));if(n.status===200&&r.kind===`success`)try{let n=await P(r.projection,ft(e,t));if(n.kind!==`passkey`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:n.storeVersion,authority:n.authority,authMethod:n.authMethod}}catch{return{kind:`transport_uncertain`}}return n.status===409?{kind:`retryable_conflict`}:n.status===400||n.status===401?{kind:`refused`}:{kind:`transport_uncertain`}}function dt(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===2&&n.includes(`ok`)&&n.includes(`projection`)&&t.get(`ok`)===!0)return{kind:`success`,projection:t.get(`projection`)};let r=t.get(`code`),i=t.get(`message`);return t.size===3&&n.includes(`ok`)&&n.includes(`code`)&&n.includes(`message`)&&t.get(`ok`)===!1&&typeof r==`string`&&typeof i==`string`?{kind:`failure`,code:r,message:i}:{kind:`invalid`}}function ft(e,i){if(i.factor.kind!==`passkey`)throw Error(`replacement envelope is not a passkey envelope`);return{kind:`passkey`,walletId:B(n(e.walletId)),recoveryOperationId:B(c(e.recoveryOperationId)),targetDeviceId:B(ne(e.targetDeviceId)),targetAuthorityId:B(t(e.targetAuthorityId)),targetWalletAuthMethodId:B(r(e.targetWalletAuthMethodId)),rpId:i.factor.rpId,credentialIdB64u:i.factor.credentialIdB64u}}function B(e){if(!e.ok)throw Error(`invalid recovery identity`);return e.value}function V(e){return e.target.kind===`passkey`}function pt(e){return{kind:`email_otp_enrollment_reference_v1`,enrollmentId:e.enrollment.enrollmentId,enrollmentSealKeyVersion:e.enrollment.kind===`existing`?e.enrollment.enrollmentSealKeyVersion:e.enrollment.material.enrollmentSealKeyVersion}}const mt=[`kind`,`keySetId`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`participantIds`,`stateEpoch`,`signingWorkerVerifyingShareB64u`,`materialActivation`,`sealed`],ht=[`kind`,`keySetId`,`possessionProof`,`readyStateBlobB64u`,`publicFacts`],gt=[`contextBinding32B64u`,`derivationClientSharePublicKey33B64u`,`clientVerifyingShare33B64u`,`relayerPublicKey33B64u`,`groupPublicKey33B64u`,`ethereumAddress`,`clientShareRetryCounter`,`relayerShareRetryCounter`],_t=[`kind`,`version`,`recoveryOperationId`,`walletId`,`reservationId`,`targetDeviceId`,`targetAuthorityId`,`targetWalletAuthMethodId`,`replacementEnvelope`,`keyManifest`,`nearKeySets`,`ecdsaKeySets`,`target`];function H(e,t,n){if(h(e,t,n),Object.keys(e).length!==t.length)throw Error(n+` fields are invalid`)}function U(e,t){if(typeof e!=`string`||!e||e.trim()!==e)throw Error(t+` must be a non-empty canonical string`);return e}function W(e,t,n){let r=U(e,t),i=m(r);if(n!==void 0&&i.byteLength!==n)throw Error(t+` must decode to `+n+` bytes`);return r}function vt(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(t+` must be a non-negative safe integer`);return e}function yt(e,t){if(!Array.isArray(e)||e.length!==2||e.some(bt))throw Error(t+` must contain two positive participant IDs`);return[e[0],e[1]]}function bt(e){return typeof e!=`number`||!Number.isSafeInteger(e)||e<1}function xt(e,t){let n=U(f(t,`recovery durable NEAR key set`).keySetId,`recovery durable NEAR keySetId`),r=e.entries.find(e=>e.keySetId===n);if(!r||r.kind!==`near_ed25519`)throw Error(`recovery durable NEAR key-set manifest entry is invalid`);return r}function St(e,t){let n=U(f(t,`recovery durable ECDSA key set`).keySetId,`recovery durable ECDSA keySetId`),r=e.entries.find(e=>e.keySetId===n);if(!r||r.kind!==`evm_family_ecdsa`)throw Error(`recovery durable ECDSA key-set manifest entry is invalid`);return r}function Ct(e){let t=ee(e);if(!t)throw Error(`recovery runtime policy scope is invalid`);return t}function wt(e,t){let n=f(e,`recovery durable NEAR key set`);if(H(n,mt,`recovery durable NEAR key set`),n.kind!==`near_ed25519`||n.keySetId!==t.keySetId)throw Error(`recovery durable NEAR key-set identity is invalid`);let r=t.recoveryBasis,i=r.scope.threshold_session_id;if(!s(i).ok)throw Error(`recovery durable NEAR thresholdSessionId is invalid`);let a={kind:ae,applicationBindingDigestB64u:S(n.applicationBindingDigestB64u,`recovery durable NEAR application binding digest`),registeredPublicKeyB64u:v(n.registeredPublicKeyB64u,`recovery durable NEAR registered public key`),participantIds:yt(n.participantIds,`recovery durable NEAR participantIds`),stateEpoch:U(n.stateEpoch,`recovery durable NEAR stateEpoch`),walletId:r.applicationBinding.wallet_id,nearAccountId:t.nearAccountId,nearEd25519SigningKeyId:r.applicationBinding.near_ed25519_signing_key_id,signerSlot:y(r.applicationBinding.key_creation_signer_slot,`recovery durable NEAR signerSlot`),signingWorkerId:r.scope.signing_worker_id,signingWorkerVerifyingShareB64u:v(n.signingWorkerVerifyingShareB64u,`recovery durable NEAR signing-worker verifying share`)},o=f(n.sealed,`recovery durable NEAR sealed material`);return H(o,[`ciphertextB64u`,`nonceB64u`],`recovery durable NEAR sealed material`),{kind:`near_ed25519`,keySetId:t.keySetId,binding:a,thresholdSessionId:i,runtimePolicyScope:Ct(r.runtimePolicyScope),materialActivation:fe(n.materialActivation),sealed:{ciphertextB64u:b(o.ciphertextB64u,`recovery durable NEAR ciphertext`),nonceB64u:_(o.nonceB64u,`recovery durable NEAR nonce`)}}}function Tt(e){let t=f(e,`recovery durable ECDSA public facts`);H(t,gt,`recovery durable ECDSA public facts`);let n=U(t.ethereumAddress,`recovery durable ECDSA ethereumAddress`).toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(n))throw Error(`recovery durable ECDSA ethereumAddress is invalid`);return{contextBinding32B64u:S(t.contextBinding32B64u,`recovery durable ECDSA context binding`),derivationClientSharePublicKey33B64u:x(t.derivationClientSharePublicKey33B64u,`recovery durable ECDSA client share`),clientVerifyingShare33B64u:x(t.clientVerifyingShare33B64u,`recovery durable ECDSA client verifying share`),relayerPublicKey33B64u:x(t.relayerPublicKey33B64u,`recovery durable ECDSA relayer public key`),groupPublicKey33B64u:x(t.groupPublicKey33B64u,`recovery durable ECDSA group public key`),ethereumAddress:n,clientShareRetryCounter:vt(t.clientShareRetryCounter,`recovery durable ECDSA client-share retry counter`),relayerShareRetryCounter:vt(t.relayerShareRetryCounter,`recovery durable ECDSA relayer-share retry counter`)}}function Et(e,t){let n=f(e,`recovery durable ECDSA key set`);if(H(n,ht,`recovery durable ECDSA key set`),n.kind!==`evm_family_ecdsa`||n.keySetId!==t.keySetId)throw Error(`recovery durable ECDSA key-set identity is invalid`);return{kind:`evm_family_ecdsa`,entry:t,possessionProof:N(n.possessionProof),readyStateBlobB64u:W(n.readyStateBlobB64u,`recovery durable ECDSA ready-state blob`),publicFacts:Tt(n.publicFacts)}}function Dt(e){let t=f(e,`recovery durable registration`);if(H(t,[`kind`,`id`,`rawId`,`type`,`authenticatorAttachment`,`response`],`recovery durable registration`),t.kind!==`wallet_recovery_redacted_registration_v1`)throw Error(`recovery durable registration kind is invalid`);if(t.authenticatorAttachment!==null&&typeof t.authenticatorAttachment!=`string`)throw Error(`recovery durable registration authenticatorAttachment is invalid`);let n=f(t.response,`recovery durable registration response`);if(H(n,[`clientDataJSON`,`attestationObject`,`transports`],`recovery durable registration response`),!Array.isArray(n.transports))throw Error(`recovery durable registration transports are invalid`);return{kind:`wallet_recovery_redacted_registration_v1`,id:U(t.id,`recovery durable registration id`),rawId:W(t.rawId,`recovery durable registration rawId`),type:U(t.type,`recovery durable registration type`),authenticatorAttachment:t.authenticatorAttachment,response:{clientDataJSON:W(n.clientDataJSON,`recovery durable registration clientDataJSON`),attestationObject:W(n.attestationObject,`recovery durable registration attestationObject`),transports:n.transports.map((e,t)=>U(e,`recovery durable registration transports[`+t+`]`))}}}function Ot(e){let t=f(e,`recovery durable Email OTP enrollment`);if(t.kind===`existing`)return H(t,[`kind`,`enrollmentId`,`enrollmentSealKeyVersion`],`recovery durable existing Email OTP enrollment`),{kind:`existing`,enrollmentId:U(t.enrollmentId,`recovery enrollmentId`),enrollmentSealKeyVersion:U(t.enrollmentSealKeyVersion,`recovery enrollment seal-key version`)};if(t.kind!==`create`)throw Error(`recovery durable Email OTP enrollment kind is invalid`);H(t,[`kind`,`enrollmentId`,`providerSubject`,`verifiedEmail`,`material`],`recovery durable create Email OTP enrollment`);let n=f(t.material,`recovery durable enrollment material`);return H(n,[`enrollmentSealKeyVersion`,`clientUnlockPublicKeyB64u`,`unlockKeyVersion`,`serverSealedFactorCiphertextB64u`],`recovery durable enrollment material`),{kind:`create`,enrollmentId:U(t.enrollmentId,`recovery enrollmentId`),providerSubject:U(t.providerSubject,`recovery enrollment providerSubject`),verifiedEmail:U(t.verifiedEmail,`recovery enrollment verifiedEmail`),material:{enrollmentSealKeyVersion:U(n.enrollmentSealKeyVersion,`recovery enrollment material seal-key version`),clientUnlockPublicKeyB64u:W(n.clientUnlockPublicKeyB64u,`recovery enrollment client unlock public key`),unlockKeyVersion:U(n.unlockKeyVersion,`recovery enrollment unlock-key version`),serverSealedFactorCiphertextB64u:W(n.serverSealedFactorCiphertextB64u,`recovery enrollment sealed factor ciphertext`)}}}function G(e){let o=f(e,`wallet recovery durable payload`);if(o.kind!==`wallet_recovery_durable_payload_v1`||o.version!==1)throw Error(`wallet recovery durable payload version is invalid`);H(o,[..._t,...f(o.target,`wallet recovery durable target`).kind===`passkey`?[`replacementId`,`challengeId`,`registration`]:[`providerSubject`,`verifiedEmail`,`emailHashHex`,`registrationAuthorityId`,`replacementId`,`enrollment`]],`wallet recovery durable payload`);let s=c(o.recoveryOperationId),l=n(o.walletId),u;try{u=ke(o.reservationId)}catch(e){throw Error(`wallet recovery durable reservationId is invalid`,{cause:e})}let d=ne(o.targetDeviceId),p=t(o.targetAuthorityId),m=r(o.targetWalletAuthMethodId);if(!s.ok||!l.ok||!d.ok||!p.ok||!m.ok)throw Error(`wallet recovery durable payload identity is invalid`);if(!Array.isArray(o.nearKeySets)||!Array.isArray(o.ecdsaKeySets))throw Error(`wallet recovery durable key-set arrays are invalid`);let h=Ye(o.keyManifest,String(l.value)),g=o.nearKeySets.map(e=>wt(e,xt(h,e))),_=o.ecdsaKeySets.map(e=>Et(e,St(h,e))),v=[...g.map(e=>e.keySetId),..._.map(e=>e.entry.keySetId)];if(new Set(v).size!==v.length)throw Error(`wallet recovery durable key-set ids are duplicated`);if(h.entries.length!==v.length||h.entries.some(e=>!v.includes(e.keySetId)))throw Error(`wallet recovery durable key-set manifest coverage is invalid`);let y={kind:`wallet_recovery_durable_payload_v1`,version:1,recoveryOperationId:s.value,walletId:l.value,reservationId:u,targetDeviceId:d.value,targetAuthorityId:p.value,targetWalletAuthMethodId:m.value,replacementEnvelope:j(o.replacementEnvelope,`wallet recovery durable replacementEnvelope`),keyManifest:h,nearKeySets:g,ecdsaKeySets:_};if(String(y.replacementEnvelope.walletId)!==String(l.value))throw Error(`wallet recovery durable replacement envelope wallet changed`);if(y.replacementEnvelope.ownership.kind!==`method_bound`||y.replacementEnvelope.ownership.walletAuthMethodId!==m.value)throw Error(`wallet recovery durable replacement envelope method changed`);for(let e of g)if(e.binding.walletId!==String(l.value))throw Error(`wallet recovery durable NEAR binding wallet changed`);let b=f(o.target,`wallet recovery durable target`);if(b.kind===`passkey`){H(b,[`kind`,`rpId`],`wallet recovery durable passkey target`);let e=i(b.rpId);if(!e.ok)throw Error(`wallet recovery durable passkey RP ID is invalid`);let t=Dt(o.registration);if(t.rawId!==y.replacementEnvelope.factor.credentialIdB64u)throw Error(`wallet recovery durable passkey registration identity changed`);if(y.replacementEnvelope.factor.kind!==`passkey`)throw Error(`wallet recovery durable passkey envelope factor is invalid`);if(y.replacementEnvelope.factor.rpId!==e.value||y.replacementEnvelope.factor.credentialIdB64u!==t.rawId)throw Error(`wallet recovery durable passkey envelope identity changed`);let n=U(o.replacementId,`wallet recovery durable replacementId`);if(String(y.replacementEnvelope.envelopeId)!==n)throw Error(`wallet recovery durable passkey envelope id changed`);return{...y,target:{kind:`passkey`,rpId:e.value},replacementId:n,challengeId:U(o.challengeId,`wallet recovery durable challengeId`),registration:t}}if(b.kind!==`google_email_otp`)throw Error(`wallet recovery durable target kind is invalid`);H(b,[`kind`],`wallet recovery durable Email OTP target`);let x=U(o.providerSubject,`wallet recovery providerSubject`);if(!a(x).ok)throw Error(`wallet recovery durable providerSubject is invalid`);let S=U(o.verifiedEmail,`wallet recovery durable verifiedEmail`),C=U(o.emailHashHex,`wallet recovery durable emailHashHex`);if(!/^[0-9a-f]{64}$/.test(C))throw Error(`wallet recovery durable emailHashHex is invalid`);let ee=U(o.registrationAuthorityId,`wallet recovery durable registrationAuthorityId`),w=Ot(o.enrollment);if(y.replacementEnvelope.factor.kind!==`email_otp`)throw Error(`wallet recovery durable Email OTP envelope factor is invalid`);let T=w.kind===`existing`?{enrollmentId:w.enrollmentId,enrollmentSealKeyVersion:w.enrollmentSealKeyVersion}:{enrollmentId:w.enrollmentId,enrollmentSealKeyVersion:w.material.enrollmentSealKeyVersion};if(y.replacementEnvelope.factor.enrollmentId!==T.enrollmentId||y.replacementEnvelope.factor.enrollmentSealKeyVersion!==T.enrollmentSealKeyVersion)throw Error(`wallet recovery durable Email OTP envelope identity changed`);if(w.kind===`create`&&(w.providerSubject!==x||w.verifiedEmail!==S))throw Error(`wallet recovery durable Email OTP enrollment identity changed`);let E=U(o.replacementId,`wallet recovery durable replacementId`);if(String(y.replacementEnvelope.envelopeId)!==E)throw Error(`wallet recovery durable Email OTP envelope id changed`);return{...y,target:{kind:`google_email_otp`},providerSubject:x,verifiedEmail:S,emailHashHex:C,registrationAuthorityId:ee,replacementId:E,enrollment:w}}function kt(e){let t=e.nearKeySets.map(e=>({kind:e.kind,keySetId:e.keySetId,applicationBindingDigestB64u:e.binding.applicationBindingDigestB64u,registeredPublicKeyB64u:e.binding.registeredPublicKeyB64u,participantIds:e.binding.participantIds,stateEpoch:e.binding.stateEpoch,signingWorkerVerifyingShareB64u:e.binding.signingWorkerVerifyingShareB64u,materialActivation:e.materialActivation,sealed:e.sealed})),n=e.ecdsaKeySets.map(e=>({kind:e.kind,keySetId:e.entry.keySetId,possessionProof:e.possessionProof,readyStateBlobB64u:e.readyStateBlobB64u,publicFacts:e.publicFacts})),r={kind:e.kind,version:e.version,recoveryOperationId:String(e.recoveryOperationId),walletId:String(e.walletId),reservationId:String(e.reservationId),targetDeviceId:String(e.targetDeviceId),targetAuthorityId:String(e.targetAuthorityId),targetWalletAuthMethodId:String(e.targetWalletAuthMethodId),replacementEnvelope:e.replacementEnvelope,keyManifest:e.keyManifest,nearKeySets:t,ecdsaKeySets:n},i=V(e)?{...r,target:e.target,replacementId:e.replacementId,challengeId:e.challengeId,registration:e.registration}:{...r,target:e.target,providerSubject:e.providerSubject,verifiedEmail:e.verifiedEmail,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,replacementId:e.replacementId,enrollment:e.enrollment};return G(i),i}async function K(e){if(V(e))return;let t=await d(e.verifiedEmail);if(e.emailHashHex!==t)throw Error(`wallet recovery durable email hash does not match verified email`);if(e.enrollment.kind===`create`&&(e.enrollment.providerSubject!==e.providerSubject||e.enrollment.verifiedEmail!==e.verifiedEmail))throw Error(`wallet recovery durable enrollment does not match Email OTP identity`)}function q(t){if(V(t)){let n=e(t.registration.rawId);if(!n.ok)throw Error(`wallet recovery durable passkey credential id is invalid`);return{kind:`passkey`,rpId:t.target.rpId,credentialIdB64u:n.value}}let n=a(t.providerSubject);if(!n.ok)throw Error(`wallet recovery durable providerSubject is invalid`);return{kind:`google_email_otp`,providerSubject:n.value,emailHashHex:t.emailHashHex,registrationAuthorityId:t.registrationAuthorityId,enrollment:pt(t)}}function At(e){return{kind:`near_ed25519`,keySetId:e.entry.keySetId,applicationBindingDigestB64u:e.localMaterial.applicationBindingDigestB64u,registeredPublicKeyB64u:p(e.metadata.registeredPublicKey),participantIds:e.metadata.participantIds,stateEpoch:String(e.metadata.stateEpoch),signingWorkerVerifyingShareB64u:p(e.metadata.signingWorkerVerifyingShare),materialActivation:ye(e.metadata.materialActivation),sealed:{ciphertextB64u:e.localMaterial.b64u,nonceB64u:e.localMaterial.nonceB64u}}}function jt(e){return{kind:`evm_family_ecdsa`,keySetId:e.entry.keySetId,possessionProof:N(e.activation.possessionProof),readyStateBlobB64u:e.readyStateBlobB64u,publicFacts:e.publicFacts}}function Mt(e){return{kind:`wallet_recovery_redacted_registration_v1`,id:e.id,rawId:e.rawId,type:e.type,authenticatorAttachment:e.authenticatorAttachment??null,response:{clientDataJSON:e.response.clientDataJSON,attestationObject:e.response.attestationObject,transports:[...e.response.transports]}}}async function Nt(e){let t={kind:`wallet_recovery_durable_payload_v1`,version:1,recoveryOperationId:String(e.prepared.recoveryOperationId),walletId:e.walletId,reservationId:e.prepared.reservationId,targetDeviceId:e.prepared.targetDeviceId,targetAuthorityId:e.prepared.targetAuthorityId,targetWalletAuthMethodId:e.prepared.targetWalletAuthMethodId,replacementEnvelope:j(e.recovered.replacementEnvelope,`wallet recovery durable replacement envelope`),keyManifest:{version:`wallet_recovery_preparation_key_manifest_v1`,walletId:String(e.walletId),entries:[...e.recovered.nearKeySets.map(e=>e.entry),...e.recovered.ecdsaKeySets.map(e=>e.entry)]},nearKeySets:e.recovered.nearKeySets.map(At),ecdsaKeySets:e.recovered.ecdsaKeySets.map(jt)};if(e.replacement.kind===`passkey`){if(e.target.kind!==`passkey`)throw Error(`wallet recovery durable payload branch is invalid`);let n=e.prepared.registration;if(!n)throw Error(`wallet recovery registration options are unavailable`);let r=Mt(e.replacement.registration);if(r.rawId!==e.replacement.credentialIdB64u)throw Error(`wallet recovery passkey registration rawId changed its credential identity`);let i=G({...t,target:{kind:`passkey`,rpId:e.target.rpId},replacementId:n.replacementId,challengeId:n.challengeId,registration:r});return await K(i),i}if(e.target.kind!==`google_email_otp`)throw Error(`wallet recovery durable payload branch is invalid`);let n=e.replacement.enrollment;if(e.replacement.factor.walletAuthMethodId!==t.targetWalletAuthMethodId)throw Error(`wallet recovery Email OTP factor method changed its target identity`);let r=await d(e.replacement.verifiedEmail),i=G({...t,target:{kind:`google_email_otp`},enrollment:n,providerSubject:e.replacement.providerSubject,verifiedEmail:e.replacement.verifiedEmail,emailHashHex:r,registrationAuthorityId:e.replacement.registrationAuthorityId,replacementId:e.replacement.factor.replacementId});return await K(i),i}function Pt(e){return new TextEncoder().encode(u({kind:`pending_wallet_recovery_commit_v1`,version:1,...e}))}function Ft(e){return Pt({recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,reservationId:e.reservationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,target:q(e)})}async function It(e){let t=await crypto.subtle.generateKey({name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`]);if(!(t instanceof CryptoKey))throw Error(`wallet recovery durable key generation failed`);let n=crypto.getRandomValues(new Uint8Array(12)),r=new TextEncoder().encode(JSON.stringify(kt(e)));return{kind:`wallet_recovery_encrypted_material_v1`,key:t,iv:n,ciphertext:new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n,additionalData:Ft(e)},t,r))}}async function Lt(e){let t=await crypto.subtle.decrypt({name:`AES-GCM`,iv:e.localMaterial.iv,additionalData:Rt(e)},e.localMaterial.key,e.localMaterial.ciphertext),n=G(JSON.parse(new TextDecoder().decode(t)));if(await K(n),!zt(e,n))throw Error(`wallet recovery durable payload identity does not match its journal`);return n}function Rt(e){return Pt({recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,reservationId:e.reservationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,target:e.target})}function J(e){let t=c(e);if(!t.ok)throw Error(`wallet recovery operation id is invalid`);return t.value}function zt(e,t){let n={kind:`pending_wallet_recovery_commit_v1`,version:1,recoveryOperationId:J(t.recoveryOperationId),walletId:t.walletId,reservationId:t.reservationId,targetDeviceId:t.targetDeviceId,targetAuthorityId:t.targetAuthorityId,targetWalletAuthMethodId:t.targetWalletAuthMethodId,localMaterial:e.localMaterial,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs},r=q(t);if(e.stage===`awaiting_server_promotion`)return Ee(e,{...n,stage:`awaiting_server_promotion`,target:r});switch(r.kind){case`passkey`:return e.projection.kind===`passkey`?Ee(e,{...n,stage:`server_promoted`,target:r,projection:e.projection}):!1;case`google_email_otp`:return e.projection.kind===`google_email_otp`?Ee(e,{...n,stage:`server_promoted`,target:r,projection:e.projection}):!1}}function Bt(e,t,n,r){return{kind:`pending_wallet_recovery_commit_v1`,version:1,recoveryOperationId:J(e.recoveryOperationId),walletId:e.walletId,reservationId:e.reservationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,target:q(e),localMaterial:t,createdAtMs:n,updatedAtMs:r}}function Vt(e,t,n=Date.now()){return{...Bt(e,t,n,n),stage:`awaiting_server_promotion`}}function Ht(e,t,n,r=Date.now()){let i=Bt(t,e.localMaterial,e.createdAtMs,Math.max(r,e.createdAtMs+1));if(V(t)){if(n.kind!==`passkey`)throw Error(`wallet recovery promotion projection branch changed`);return{...i,stage:`server_promoted`,target:q(t),projection:n}}if(n.kind!==`google_email_otp`)throw Error(`wallet recovery promotion projection branch changed`);return{...i,stage:`server_promoted`,target:q(t),projection:n}}const Ut=`/wallets/recovery/google-email-otp/finalize`;async function Wt(e){let t=await Y(e,`/wallets/recovery/google/verify`,{recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,idToken:e.idToken});if(!t.ok)return t.failure;try{let n=Yt(t.body),r=Jt(n,e),i=Q(o(n.challengeId)),a=Number(n.expiresAtMs);if(!Number.isSafeInteger(a)||a<=0)throw Error(`invalid expiry`);return{kind:`verified`,...r,challengeId:i,delivery:Se(n.delivery,`walletRecoveryGoogleVerify.delivery`),expiresAtMs:a}}catch{return{kind:`transport_uncertain`}}}async function Gt(e){let t=await Y(e,`/wallets/recovery/email-otp/verify`,{recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,challengeId:e.challengeId,otpCode:e.otpCode});if(!t.ok)return t.failure;try{let n=Xt(t.body),r=Jt(n,e),i=Q(o(n.challengeId));if(i!==e.challengeId)throw Error(`challenge changed`);return{kind:`verified`,...r,challengeId:i}}catch{return{kind:`transport_uncertain`}}}async function Kt(e){let t,n;try{if(t=j(e.replacementEnvelope,`walletRecoveryGoogleEmailOtpFinalize.replacementEnvelope`),t.factor.kind!==`email_otp`)throw Error(`wrong factor`);n=e.ecdsaMaterialPossessionProofs.map(e=>({keySetId:e.keySetId,proof:N(e.proof)}))}catch{return{kind:`refused`}}let r=await Y(e,Ut,{kind:`finalize`,recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,replacementEnvelope:t,ecdsaMaterialPossessionProofs:n,...e.emailOtpEnrollment?{emailOtpEnrollment:e.emailOtpEnrollment}:{}});if(!r.ok)return r.failure;try{let n=await P(Zt(r.body,`walletRecoveryGoogleEmailOtpFinalize`).projection,en(e,t));if(n.kind!==`google_email_otp`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:n.storeVersion,authority:n.authority,authMethod:n.authMethod}}catch{return{kind:`transport_uncertain`}}}async function qt(e){let t;try{if(t=j(e.replacementEnvelope,`walletRecoveryGoogleEmailOtpReplay.replacementEnvelope`),t.factor.kind!==`email_otp`||String(t.walletId)!==String(e.walletId))throw Error(`recovery replay envelope identity is invalid`)}catch{return{kind:`refused`}}let n=await Y(e,Ut,{kind:`replay`,recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,replacementEnvelope:t});if(!n.ok)return n.failure;try{let r=await P(Zt(n.body,`walletRecoveryGoogleEmailOtpReplay`).projection,en(e,t));if(r.kind!==`google_email_otp`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:r.storeVersion,authority:r.authority,authMethod:r.authMethod}}catch{return{kind:`transport_uncertain`}}}async function Y(e,t,n){let r;try{r=await(e.fetchImpl??fetch)(`${k(e.relayUrl)}${t}`,O({body:n}))}catch{return{ok:!1,failure:{kind:`transport_uncertain`}}}let i=await r.json().catch(()=>void 0);return r.status===200?{ok:!0,body:i}:r.status===409||r.status===429?{ok:!1,failure:{kind:`retryable_conflict`}}:r.status===400||r.status===401?{ok:!1,failure:{kind:`refused`}}:{ok:!1,failure:{kind:`transport_uncertain`}}}function Jt(e,t){let n=Q(c(e.recoveryOperationId)),r=ke(e.reservationId);if(n!==t.recoveryOperationId||r!==t.reservationId)throw Error(`recovery operation identity changed`);return{recoveryOperationId:n,reservationId:r}}function Yt(e){let t=X(e,[`ok`,`recoveryOperationId`,`reservationId`,`challengeId`,`delivery`,`expiresAtMs`],`walletRecoveryGoogleVerify`);return $t(t,`walletRecoveryGoogleVerify`),{recoveryOperationId:Z(t,`recoveryOperationId`),reservationId:Z(t,`reservationId`),challengeId:Z(t,`challengeId`),delivery:Z(t,`delivery`),expiresAtMs:Z(t,`expiresAtMs`)}}function Xt(e){let t=X(e,[`ok`,`recoveryOperationId`,`reservationId`,`challengeId`],`walletRecoveryEmailOtpVerify`);return $t(t,`walletRecoveryEmailOtpVerify`),{recoveryOperationId:Z(t,`recoveryOperationId`),reservationId:Z(t,`reservationId`),challengeId:Z(t,`challengeId`)}}function Zt(e,t){let n=X(e,[`ok`,`projection`],t);return $t(n,t),{projection:Z(n,`projection`)}}function X(e,t,n){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be a JSON object`);let r=Object.getPrototypeOf(e);if(r!==Object.prototype&&r!==null)throw Error(`${n} must be a plain JSON object`);let i=Object.keys(e);if(i.length!==t.length||!Qt(i,t))throw Error(`${n} has an unexpected response shape`);return e}function Qt(e,t){for(let n of t)if(!e.includes(n))return!1;return!0}function $t(e,t){if(Z(e,`ok`)!==!0)throw Error(`${t} did not succeed`)}function Z(e,t){let n=Object.getOwnPropertyDescriptor(e,t);if(!n||!(`value`in n))throw Error(`response field ${t} is missing`);return n.value}function Q(e){if(!e.ok)throw Error(`invalid domain identity`);return e.value}function $(e){if(typeof e!=`string`||!e.trim())throw Error(`value must be a string`);return e.trim()}function en(e,t){if(t.factor.kind!==`email_otp`)throw Error(`replacement envelope is not an Email OTP envelope`);return{kind:`google_email_otp`,walletId:e.walletId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,providerSubject:Q(a(e.expectedProviderSubject)),emailHashHex:tn(e.expectedEmailHashHex),registrationAuthorityId:$(e.expectedRegistrationAuthorityId),enrollment:{kind:`email_otp_enrollment_reference_v1`,enrollmentId:$(t.factor.enrollmentId),enrollmentSealKeyVersion:$(t.factor.enrollmentSealKeyVersion)}}}function tn(e){let t=$(e);if(!/^[0-9a-f]{64}$/.test(t))throw Error(`email hash is invalid`);return t}async function nn(e,t){if(e.version!==t.version||e.storeVersion!==t.storeVersion||e.walletId!==t.walletId||e.recoveryOperationId!==t.recoveryOperationId||e.targetDeviceId!==t.targetDeviceId||e.targetAuthorityId!==t.targetAuthorityId||e.targetWalletAuthMethodId!==t.targetWalletAuthMethodId||!await ce(e.authority,t.authority)||!Ce(e.authMethod,t.authMethod)||e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`?e.target.kind===t.target.kind&&e.target.rpId===t.target.rpId&&e.target.credentialIdB64u===t.target.credentialIdB64u:!1;case`google_email_otp`:return t.kind===`google_email_otp`?e.target.kind===t.target.kind&&e.target.provider===t.target.provider&&e.target.providerSubject===t.target.providerSubject&&e.target.emailHashHex===t.target.emailHashHex&&e.target.registrationAuthorityId===t.target.registrationAuthorityId&&e.target.enrollment.kind===t.target.enrollment.kind&&e.target.enrollment.enrollmentId===t.target.enrollment.enrollmentId&&e.target.enrollment.enrollmentSealKeyVersion===t.target.enrollment.enrollmentSealKeyVersion:!1;default:return rn(e)}}function rn(e){throw Error(`unsupported wallet recovery projection: ${String(e)}`)}function an(e){let t=J(e.payload.recoveryOperationId);switch(e.kind){case`passkey`:return Ae({kind:`passkey`,storeVersion:e.promotion.storeVersion,walletId:e.payload.walletId,recoveryOperationId:t,targetDeviceId:e.payload.targetDeviceId,targetAuthorityId:e.payload.targetAuthorityId,targetWalletAuthMethodId:e.payload.targetWalletAuthMethodId,authority:e.promotion.authority,authMethod:e.promotion.authMethod});case`google_email_otp`:{let n=a(e.payload.providerSubject);if(!n.ok)throw Error(`wallet recovery provider subject is invalid`);return Ae({kind:`google_email_otp`,storeVersion:e.promotion.storeVersion,walletId:e.payload.walletId,recoveryOperationId:t,targetDeviceId:e.payload.targetDeviceId,targetAuthorityId:e.payload.targetAuthorityId,targetWalletAuthMethodId:e.payload.targetWalletAuthMethodId,authority:e.promotion.authority,authMethod:e.promotion.authMethod,providerSubject:n.value,emailHashHex:e.payload.emailHashHex,registrationAuthorityId:e.payload.registrationAuthorityId,enrollment:pt(e.payload)})}}}function on(e){return e.ecdsaKeySets.map(e=>({keySetId:e.entry.keySetId,proof:e.possessionProof}))}function sn(e){return{id:e.registration.id,rawId:e.registration.rawId,type:e.registration.type,authenticatorAttachment:e.registration.authenticatorAttachment??void 0,response:{clientDataJSON:e.registration.response.clientDataJSON,attestationObject:e.registration.response.attestationObject,transports:[...e.registration.response.transports]},clientExtensionResults:{prf:{results:{first:void 0,second:void 0}}}}}async function cn(e){let{payload:t}=e;if(V(t)){let n=await lt({relayUrl:e.relayUrl,walletId:String(t.walletId),reservationId:String(t.reservationId),recoveryOperationId:J(t.recoveryOperationId),targetDeviceId:String(t.targetDeviceId),targetAuthorityId:String(t.targetAuthorityId),targetWalletAuthMethodId:String(t.targetWalletAuthMethodId),challengeId:t.challengeId,replacementId:t.replacementId,webauthnRegistration:sn(t),replacementEnvelope:t.replacementEnvelope,ecdsaMaterialPossessionProofs:on(t),fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`passkey`,payload:t,promotion:n}:n}let n=await Kt({relayUrl:e.relayUrl,recoveryOperationId:J(t.recoveryOperationId),reservationId:t.reservationId,walletId:t.walletId,targetDeviceId:t.targetDeviceId,targetAuthorityId:t.targetAuthorityId,targetWalletAuthMethodId:t.targetWalletAuthMethodId,expectedProviderSubject:t.providerSubject,expectedEmailHashHex:t.emailHashHex,expectedRegistrationAuthorityId:t.registrationAuthorityId,replacementEnvelope:t.replacementEnvelope,ecdsaMaterialPossessionProofs:on(t),emailOtpEnrollment:ln(t.enrollment),fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`google_email_otp`,payload:t,promotion:n}:n}function ln(e){return e.kind===`create`?{kind:`create`,material:e.material}:null}async function un(e){let{payload:t}=e;if(V(t)){let n=await ut({relayUrl:e.relayUrl,walletId:String(t.walletId),reservationId:String(t.reservationId),recoveryOperationId:J(t.recoveryOperationId),targetDeviceId:String(t.targetDeviceId),targetAuthorityId:String(t.targetAuthorityId),targetWalletAuthMethodId:String(t.targetWalletAuthMethodId),replacementId:t.replacementId,replacementEnvelope:t.replacementEnvelope,fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`passkey`,payload:t,promotion:n}:n}let n=await qt({relayUrl:e.relayUrl,recoveryOperationId:J(t.recoveryOperationId),reservationId:t.reservationId,walletId:t.walletId,targetDeviceId:t.targetDeviceId,targetAuthorityId:t.targetAuthorityId,targetWalletAuthMethodId:t.targetWalletAuthMethodId,expectedProviderSubject:t.providerSubject,expectedEmailHashHex:t.emailHashHex,expectedRegistrationAuthorityId:t.registrationAuthorityId,replacementEnvelope:t.replacementEnvelope,fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`google_email_otp`,payload:t,promotion:n}:n}function dn(e){return e.kind===`passkey`||e.kind===`google_email_otp`}async function fn(e){let t=await un(e);return dn(t)||t.kind!==`refused`?t:await cn(e)}function pn(e,t){return{walletId:e.walletId,factor:{kind:`passkey`,credentialIdB64u:t.target.credentialIdB64u},verifier:{kind:`webauthn`,rpId:t.target.rpId},bindingId:t.authMethod.walletAuthMethodId}}function mn(e,t){let n=xe({walletId:e.walletId,provider:`google`,providerUserId:e.providerSubject,emailHashHex:e.emailHashHex});return{walletId:n.walletId,factor:n.factor,verifier:n.verifier,bindingId:t.authMethod.walletAuthMethodId}}async function hn(e,t){if(V(e)){if(t.kind!==`passkey`)throw Error(`wallet recovery projection branch changed`);return de({authority:pn(e,t)})}if(t.kind!==`google_email_otp`)throw Error(`wallet recovery projection branch changed`);return de({authority:mn(e,t)})}async function gn(e){let t=[],n=[];for(let r of e.payload.ecdsaKeySets){let i=r.entry,a=i.recoveryBasis,o=await ue({walletId:e.payload.walletId,signingRootId:a.signingRootId,signingRootVersion:a.signingRootVersion}),s=await De({authority:e.authority,chainTargets:a.chainTargets,walletId:String(e.payload.walletId),keyHandle:i.keyHandle,ecdsaThresholdKeyId:a.ecdsaThresholdKeyId,signingRootId:a.signingRootId,signingRootVersion:a.signingRootVersion,relayerKeyId:o,participantIds:a.participantIds,publicCapability:a.publicCapability,activationReceipt:a.activationReceipt,runtimePolicyScope:a.runtimePolicyScope,readyStateBlobB64u:r.readyStateBlobB64u,publicFacts:r.publicFacts});n.push(s);for(let n of a.chainTargets)t.push(_n({payload:e.payload,keySet:r,chainTarget:n,materialRef:s.roleLocalMaterialRef,relayerKeyId:o}))}return{walletKeys:t,ecdsaContinuity:n}}function _n(e){let t=e.keySet.entry,n=t.recoveryBasis,r=e.keySet.publicFacts,i=we({walletId:e.payload.walletId,chainTarget:e.chainTarget,keyHandle:t.keyHandle,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,applicationBindingDigestB64u:n.publicCapability.context.application_binding_digest_b64u,clientParticipantId:1,relayerParticipantId:2,participantIds:n.participantIds,contextBinding32B64u:r.contextBinding32B64u,derivationClientSharePublicKey33B64u:r.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:r.relayerPublicKey33B64u,groupPublicKey33B64u:r.groupPublicKey33B64u,ethereumAddress:r.ethereumAddress,publicCapability:n.publicCapability});return{keyScope:`evm-family`,chainTarget:e.chainTarget,walletId:String(e.payload.walletId),evmFamilySigningKeySlotId:t.evmFamilySigningKeySlotId,keyHandle:t.keyHandle,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,thresholdEcdsaPublicKeyB64u:r.groupPublicKey33B64u,thresholdOwnerAddress:r.ethereumAddress,relayerKeyId:e.relayerKeyId,relayerVerifyingShareB64u:r.relayerPublicKey33B64u,participantIds:n.participantIds,publicCapability:n.publicCapability,roleLocalMaterialRef:e.materialRef,ecdsaRoleLocalPublicFacts:i}}function vn(e){if(e.nearKeySets.length!==1)throw Error(`wallet recovery requires exactly one NEAR key set`);return e.nearKeySets[0]}function yn(e){return[...e.registration.response.transports]}function bn(e){return`ed25519:${ie(m(vn(e).binding.registeredPublicKeyB64u))}`}function xn(e,t){let n=s(t.thresholdSessionId);if(!n.ok)throw Error(`recovery NEAR threshold session id is invalid`);return{walletId:e.walletId,nearAccountId:A(t.binding.nearAccountId),thresholdSessionId:n.value,runtimePolicyScope:t.runtimePolicyScope,materialActivation:ge(t.materialActivation)}}async function Sn(e){if(V(e.payload)){if(e.projection.kind!==`passkey`)throw Error(`wallet recovery projection branch changed`);let t={walletId:e.payload.walletId,rpId:e.projection.target.rpId,credentialIdB64u:e.projection.target.credentialIdB64u,credentialPublicKeyB64u:e.projection.authMethod.credentialPublicKeyB64u,transports:yn(e.payload),walletKeys:e.walletKeys};if(e.payload.nearKeySets.length===0)return oe({kind:`evm_family_ecdsa`,...t});let n=vn(e.payload);return oe({kind:`near_ed25519`,...t,nearAccountId:A(n.binding.nearAccountId),nearEd25519SigningKeyId:n.binding.nearEd25519SigningKeyId,signerSlot:n.binding.signerSlot,operationalPublicKey:bn(e.payload),relayerKeyId:n.binding.signingWorkerId,participantIds:n.binding.participantIds,custodyMaterials:e.payload.nearKeySets.map(e=>({binding:e.binding,sealed:e.sealed}))})}if(e.projection.kind!==`google_email_otp`)throw Error(`wallet recovery projection branch changed`);let t=mn(e.payload,e.projection),n={walletId:e.payload.walletId,email:e.payload.verifiedEmail,registrationAuthorityId:e.payload.registrationAuthorityId,authority:t,walletKeys:e.walletKeys};if(e.payload.nearKeySets.length===0)return se({kind:`evm_family_ecdsa`,...n});let r=vn(e.payload);return se({kind:`near_ed25519`,...n,nearAccountId:A(r.binding.nearAccountId),nearEd25519SigningKeyId:r.binding.nearEd25519SigningKeyId,signerSlot:r.binding.signerSlot,operationalPublicKey:bn(e.payload),relayerKeyId:r.binding.signingWorkerId,participantIds:r.binding.participantIds,custodyMaterials:e.payload.nearKeySets.map(e=>({binding:e.binding,sealed:e.sealed}))})}async function Cn(e){let t=e.pending.projection,n=await hn(e.payload,t),r=await gn({payload:e.payload,authority:n}),i=await Sn({payload:e.payload,projection:t,walletKeys:r.walletKeys});await M.publishPendingWalletRecoveryCommit({pending:e.pending,authority:t.authority,authMethod:t.authMethod,registration:i,ecdsaContinuity:r.ecdsaContinuity,ed25519PublicCapabilityReferences:e.payload.nearKeySets.map(t=>xn(e.payload,t))})}async function wn(e){let t=await M.listPendingWalletRecoveryCommits(),n=[];for(let r of t)try{let t=await Lt(r),i=r.stage===`awaiting_server_promotion`?await fn({relayUrl:e.relayUrl,payload:t,fetchImpl:e.fetchImpl}):await un({relayUrl:e.relayUrl,payload:t,fetchImpl:e.fetchImpl});if(!dn(i)){if(i.kind===`refused`){await M.deletePendingWalletRecoveryCommit(r.recoveryOperationId),n.push({kind:`discarded`,recoveryOperationId:String(r.recoveryOperationId)});continue}n.push({kind:`pending`,recoveryOperationId:String(r.recoveryOperationId),failure:i});continue}let a=i,o=an(a),s=r.stage===`awaiting_server_promotion`?await M.advancePendingWalletRecoveryCommit({awaiting:r,promoted:Ht(r,a.payload,o,r.updatedAtMs+1)}):r;if(r.stage===`server_promoted`&&!await nn(r.projection,o))throw Error(`wallet recovery replay projection changed`);await Cn({pending:s,payload:a.payload}),n.push({kind:`completed`,recoveryOperationId:String(r.recoveryOperationId)})}catch(e){console.warn(`[SeamsWeb] pending wallet recovery replay failed before classification:`,String(r.recoveryOperationId),e instanceof Error?e.message:String(e||`unknown error`)),n.push({kind:`corrupt`,recoveryOperationId:String(r.recoveryOperationId)})}return n}async function Tn(e){let t=await Nt(e.operation);return{payload:t,pending:Vt(t,await It(t),e.nowMs)}}async function En(e){let t=an(e.promotion);return M.advancePendingWalletRecoveryCommit({awaiting:e.awaiting,promoted:Ht(e.awaiting,e.promotion.payload,t,e.awaiting.updatedAtMs+1)})}export{Kt as a,V as c,ze as d,wn as i,lt as l,En as n,Gt as o,Cn as r,Wt as s,Tn as t,Re as u};

package/dist/esm/sdk/walletRecoveryRotate-DWTAFYiv.js

@@ -1 +0,0 @@
-import{d as e,h as t}from"./digestEncoding-Dzc1rzWV.js";function n(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===5&&n.every(e=>[`ok`,`challengeId`,`challenge_digest`,`expiresAtMs`,`otpChannel`].includes(e))&&t.get(`ok`)===!0)return{kind:`success`,challengeId:t.get(`challengeId`),challengeDigest:t.get(`challenge_digest`),expiresAtMs:t.get(`expiresAtMs`),otpChannel:t.get(`otpChannel`)};let r=[`ok`,`code`,`message`,`retryAfterMs`];if((t.size===3||t.size===4)&&n.every(e=>r.includes(e))&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`&&typeof t.get(`message`)==`string`&&(t.size===3||typeof t.get(`retryAfterMs`)==`number`)){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function r(e){let t;try{t=await u({relayUrl:e.relayUrl,path:`/wallets/custody/email-otp/challenge`,body:{walletId:e.walletId,providerSubjectId:e.providerSubjectId,operation:e.operation,payload:e.payload,...e.requestOrigin?{requestOrigin:e.requestOrigin}:{}},fetchImpl:e.fetchImpl})}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`Email OTP challenge request failed`}}let r=n(await t.json().catch(()=>null)),i=r.kind===`failure`&&r.message?r.message:``;if(t.status!==200||r.kind!==`success`)return{kind:t.status>=400&&t.status<500?`rejected`:`transport_failed`,message:i||`Email OTP challenge failed (HTTP ${t.status})`};let a=typeof r.challengeId==`string`?r.challengeId.trim():``,o=typeof r.challengeDigest==`string`?r.challengeDigest.trim():``,s=Number(r.expiresAtMs),c=typeof r.otpChannel==`string`?r.otpChannel.trim():``;return!a||!o||!Number.isSafeInteger(s)||s<=0||!c?{kind:`transport_failed`,message:`Email OTP challenge returned an unusable payload`}:{kind:`ready`,challengeId:a,challenge_digest:o,expiresAtMs:s,otpChannel:c}}function i(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[`ok`,`activeCodeCount`,`totalCodeCount`,`issuedAtMs`,`storeVersion`,`backupOutstanding`],r=[...t.keys()];if(t.size===n.length&&r.every(e=>n.includes(e))&&t.get(`ok`)===!0)return{kind:`success`,activeCodeCount:t.get(`activeCodeCount`),totalCodeCount:t.get(`totalCodeCount`),issuedAtMs:t.get(`issuedAtMs`),storeVersion:t.get(`storeVersion`),backupOutstanding:t.get(`backupOutstanding`)};let i=[`ok`,`code`,`message`];if(t.size===i.length&&r.every(e=>i.includes(e))&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function a(e){let n=`${t(e.relayUrl)}/wallets/${encodeURIComponent(e.walletId)}/recovery/status`,r=e.fetchImpl||fetch,a;try{a=await r(n,{method:`GET`,credentials:`include`,headers:{Accept:`application/json`}})}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`recovery status request failed`}}let o=i(await a.json().catch(()=>null)),s=o.kind===`failure`&&o.message?o.message:``;if(a.status===401||a.status===403)return{kind:`unauthorized`,message:s||`recovery status is unauthorized`};if(a.status===404)return{kind:`no_recovery_set`,message:s||`this wallet has no recovery set`};if(a.status!==200)return{kind:`transport_failed`,message:s||`recovery status failed (HTTP ${a.status})`};if(o.kind!==`success`)return{kind:`transport_failed`,message:`recovery status returned an unusable payload`};let c=Number(o.activeCodeCount),l=Number(o.totalCodeCount),u=Number(o.issuedAtMs),d=typeof o.storeVersion==`string`?o.storeVersion.trim():``;return!Number.isSafeInteger(c)||c<0||!Number.isSafeInteger(l)||l<c||!Number.isSafeInteger(u)||u<=0||!d||typeof o.backupOutstanding!=`boolean`?{kind:`transport_failed`,message:`recovery status returned an unusable payload`}:{kind:`ready`,walletId:e.walletId,activeCodeCount:c,totalCodeCount:l,issuedAtMs:u,storeVersion:d,backupOutstanding:o.backupOutstanding,pendingLocalBackup:!1}}function o(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===2&&n.includes(`ok`)&&n.includes(`issuedAtMs`)&&t.get(`ok`)===!0)return{kind:`success`,issuedAtMs:t.get(`issuedAtMs`)};if(t.size===3&&n.includes(`ok`)&&n.includes(`code`)&&n.includes(`message`)&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function s(e){let t;try{t=await u({relayUrl:e.relayUrl,path:`/wallets/recovery/acknowledge-backup`,body:{walletId:e.walletId},fetchImpl:e.fetchImpl})}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`recovery backup acknowledgement failed`}}let n=o(await t.json().catch(()=>null)),r=n.kind===`failure`&&n.message?n.message:``;if(t.status===401||t.status===403)return{kind:`unauthorized`,message:r||`recovery backup acknowledgement is unauthorized`};if(t.status===404)return{kind:`no_recovery_set`,message:r||`this wallet has no recovery set`};if(t.status!==200)return{kind:`transport_failed`,message:r||`recovery backup acknowledgement failed (HTTP ${t.status})`};if(n.kind!==`success`)return{kind:`transport_failed`,message:`recovery backup acknowledgement returned an unusable payload`};let i=Number(n.issuedAtMs);return!Number.isSafeInteger(i)||i<=0?{kind:`transport_failed`,message:`recovery backup acknowledgement returned an unusable payload`}:{kind:`acknowledged`,walletId:e.walletId,issuedAtMs:i}}function c(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===3&&n.every(e=>[`ok`,`issuedAtMs`,`storeVersion`].includes(e))&&t.get(`ok`)===!0)return{kind:`success`,issuedAtMs:t.get(`issuedAtMs`),storeVersion:t.get(`storeVersion`)};if(t.size===3&&n.every(e=>[`ok`,`code`,`message`].includes(e))&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function l(e){let t=await u({relayUrl:e.relayUrl,path:`/wallets/recovery/rotate`,body:{walletId:e.walletId,expectedStoreVersion:e.expectedStoreVersion,manifestKekWraps:e.replacement.manifestKekWraps,entries:[e.replacement.entry],recoveryCodeLocators:e.recoveryCodeLocators,factorProof:e.factorProof},fetchImpl:e.fetchImpl}),n=c(await t.json().catch(()=>null)),r=n.kind===`failure`&&n.message?n.message:``;if(t.status===200&&n.kind===`success`){let e=Number(n.issuedAtMs),t=typeof n.storeVersion==`string`?n.storeVersion.trim():``;return!Number.isSafeInteger(e)||e<=0||!t?{kind:`transport_failed`,message:`rotation returned an unusable response`}:{kind:`rotated`,issuedAtMs:e,storeVersion:t}}return t.status===404?{kind:`no_recovery_set`,message:r||`no recovery set`}:t.status===409?{kind:`conflict`,message:r||`recovery set changed`}:t.status===400?{kind:`rejected`,message:r||`rotation rejected`}:{kind:`transport_failed`,message:r||`rotation failed (HTTP ${t.status})`}}async function u(n){let r=`${t(n.relayUrl)}${n.path}`;return await(n.fetchImpl||fetch)(r,e({headers:{Accept:`application/json`},body:n.body}))}export{l as i,a as n,r,s as t};

package/dist/esm/sdk/walletSessionAuthorizationStatus-o1VgsLhA.js

@@ -1 +0,0 @@
-import{i as e,n as t}from"./activeWalletSession-DiZcKjB_.js";import{d as n,h as r}from"./capabilityKinds-CKQ4Uqnv.js";import{d as i,h as a,p as o}from"./digestEncoding-Dzc1rzWV.js";const s=(e,t)=>globalThis.fetch(e,t),c=new WeakMap;let l=0;const u=new Map;function d(e){return JSON.stringify([e])}function f(e,t){return d(e.operationCredential.token)+JSON.stringify([a(e.relayerUrl),t.walletSessionId,t.quotaId])}function p(e,t,n,r){let i=c.get(e);i||(i=new Map,c.set(e,i));let a=i.get(t);if(a&&a.sequence>n)return r;if(u.delete(t),i.delete(t),i.set(t,{kind:`local_wallet_session_observation`,sequence:n,status:r}),i.size>32){let e=i.keys().next();e.done||i.delete(e.value)}return r}function m(e){let t=e.remainingUses-1;return t>0?{...e,remainingUses:t}:{...e,status:`exhausted`,remainingUses:0,quotaLifecycle:`exhausted`}}var h=class e{constructor(){this.readsByFetch=new Map,this.suppliedStatus={kind:`remote`}}static fromPrepare(t,n){let r=new e;return r.suppliedStatus={kind:`server_response`,key:f(t,n),status:n,observation:m(n)},r}static fromRegistration(t,n){let r=g(n),i=new e;return i.suppliedStatus={kind:`server_response`,key:f({relayerUrl:t,operationCredential:n.operationCredential},r),status:r,observation:r},i}static acceptRegistrationSession(e,t){let n=g(t);if(u.set(f({relayerUrl:e,operationCredential:t.operationCredential},n),n),u.size>8){let e=u.keys().next();e.done||u.delete(e.value)}}static forHostObservation(){let t=new e;return t.suppliedStatus={kind:`host_observation`},t}static forgetCredential(e){let t=d(e);for(let e of[c.get(s),u])if(e)for(let n of[...e.keys()])n.startsWith(t)&&e.delete(n)}static observationForConfirmation(e,t){return c.get(e.fetchImpl??s)?.get(f(e,t))??null}read(e,t){if(this.suppliedStatus.kind===`server_response`){if(this.suppliedStatus.key!==f(e,t))throw Error(`Wallet Session response identity changed before reconciliation`);return p(e.fetchImpl??s,this.suppliedStatus.key,++l,this.suppliedStatus.observation),Promise.resolve(this.suppliedStatus.status)}let n=e.fetchImpl??s,r=this.readsByFetch.get(n);r||(r=new Map,this.readsByFetch.set(n,r));let i=f(e,t),a=r.get(i);if(a)return a;let o=++l,c=this.suppliedStatus.kind===`host_observation`?u.get(i):void 0,d=c?Promise.resolve(p(n,i,o,c)):D(e).read(t).then(p.bind(null,n,i,o));return r.set(i,d),d}};function g(e){return{status:`active`,walletSessionId:e.walletSessionId,quotaId:e.quotaId,remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs,quotaLifecycle:`active`,authorization:e.walletSession}}const _=[`ok`,`status`,`walletSessionId`,`quotaId`,`remainingUses`,`expiresAtMs`,`quotaLifecycle`,`authorization`],v=[`ok`,`status`,`walletSessionId`,`quotaId`];function y(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`error`,message:null};let t=new Map(Object.entries(e)),n=[...t.keys()],r=t.get(`status`),i=t.get(`walletSessionId`),a=t.get(`quotaId`);if(t.get(`ok`)===!0&&typeof r==`string`){let e=r===`active`||r===`exhausted`||r===`expired`||r===`superseded`||r===`authority_unavailable`||r===`method_unavailable`||r===`capability_unavailable`?r:null;if(e&&n.length===_.length){let r=new Set(_);if(n.every(e=>r.has(e)))return{kind:`observed`,status:e,walletSessionId:i,quotaId:a,remainingUses:t.get(`remainingUses`),expiresAtMs:t.get(`expiresAtMs`),quotaLifecycle:t.get(`quotaLifecycle`),authorization:t.get(`authorization`)}}if((r===`missing`||r===`invalid`)&&n.length===v.length){let e=new Set(v);if(n.every(t=>e.has(t)))return{kind:`terminal`,status:r,walletSessionId:i,quotaId:a}}}if(n.every(e=>e===`code`||e===`message`)){let e=t.get(`message`);return{kind:`error`,message:typeof e==`string`?e:null}}return{kind:`error`,message:null}}function b(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>0}function x(e,t){let i=r(e.walletSessionId),a=n(e.quotaId);return!i.ok||!a.ok||i.value!==t.walletSessionId||a.value!==t.quotaId?null:{walletSessionId:i.value,quotaId:a.value}}function S(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=0}function C(e,n){if(e.quotaLifecycle!==`active`&&e.quotaLifecycle!==`exhausted`||!S(e.remainingUses)||e.quotaLifecycle===`exhausted`!=(e.remainingUses===0)||!b(e.expiresAtMs))return null;let r;try{r=t(e.authorization)}catch{return null}return r.quotaId!==n.quotaId||r.expiresAtMs!==e.expiresAtMs?null:{remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs,quotaLifecycle:e.quotaLifecycle,authorization:r}}function w(e,t){return T(y(e),t)}function T(e,t){if(e.kind===`error`)return null;let n=x(e,t);if(!n)return null;if(e.kind===`terminal`)return{status:e.status,...n};switch(e.status){case`active`:{let t=C(e,n);return!t||t.quotaLifecycle!==`active`?null:{status:`active`,...n,...t}}case`exhausted`:{let t=C(e,n);return!t||t.remainingUses!==0?null:{status:`exhausted`,...n,...t,remainingUses:0}}case`expired`:case`superseded`:case`authority_unavailable`:case`method_unavailable`:case`capability_unavailable`:{let t=C(e,n);return t?{status:e.status,...n,...t}:null}default:return null}}var E=class{constructor(t){if(this.relayerUrl=a(t.relayerUrl),!this.relayerUrl)throw Error(`Relayer URL is required`);this.operationCredential=e(t.operationCredential),this.fetchImpl=t.fetchImpl??s}async read(e){let t=await this.fetchImpl(`${this.relayerUrl}/wallet/session/status`,{...i({body:{walletSessionId:e.walletSessionId,quotaId:e.quotaId},headers:o(this.operationCredential)}),credentials:`omit`}),n=y(await t.json().catch(()=>null));if(!t.ok){let e=n.kind===`error`&&n.message?n.message:`Wallet Session status request failed with HTTP ${t.status}`;throw Error(e)}let r=T(n,e);if(!r)throw Error(`Wallet Session status response is invalid`);return r}};function D(e){return new E(e)}export{D as n,w as r,h as t};

package/dist/esm/sdk/warmSessionHydration-DgjuUacN.js

@@ -1 +0,0 @@
-import{t as e}from"./prfCache-BMpqZZ-v.js";function t(t){return{hydrateSigningSession:n=>e(t.getWarmSessionMaterialWriter(),n)}}export{t as createWarmSessionHydrationService};

package/dist/public/sdk/activeWalletSession-DiZcKjB_.js

@@ -1 +0,0 @@
-import{B as e,I as t,L as n,N as r,P as i,R as a,V as o,b as s,f as c,v as l,w as u,y as d}from"./normalize-kUDm5zfS.js";import{k as f}from"./chains-CiYQT1K4.js";import{_ as p,c as m,g as h,p as g}from"./primitives-CAcl7ON7.js";import{d as _,h as v,l as y,m as b}from"./capabilityKinds-CKQ4Uqnv.js";import{r as x}from"./canonicalPrimitives-CKPGgpxg.js";function S(...e){return Object.assign((t,n)=>{if(!e.includes(t))throw Error(`${n} is invalid`);return t},{literals:e})}function C(e,t){let n=Object.keys(e),r=[...n.filter(t=>`literals`in e[t]),...n.filter(t=>!(`literals`in e[t]))];return Object.assign((i,a)=>{let o=h(i,n,a),s=new Map;for(let t of r)s.set(t,e[t](o[t],`${a}.${t}`));let c=Object.fromEntries(n.map(e=>[e,s.get(e)]));return t?.(c,a),c},{shape:e})}function w(e,t){let n=new Map;for(let r of t)for(let t of r.shape[e].literals)n.set(t,r);return(t,r)=>{let i=f(t,r),a=n.get(i[e]);if(!a)throw Error(`${r}.${e} is invalid`);return a(i,r)}}function T(e){return(t,n)=>t===null?null:e(t,n)}function E(e){return(t,n)=>{let r=e(t);if(r.ok)return r.value;throw Error(`${n} ${r.error.message}`)}}function D(e){return(t,n)=>{try{return e(t)}catch(e){throw Error(`${n} ${e instanceof Error?e.message:`is invalid`}`)}}}const ee=E(l),O=E(n),k=E(d),A=E(s),j=E(y),M=E(a),N=E(v),P=E(b),F=E(i),I=E(t),L=E(e),R=E(o),z=E(_),B=E(u),V=D(x),H=T(G);function U(e){return(t,n)=>e(t,n.slice(n.lastIndexOf(`.`)+1))}function W(e,t){try{return m(e,t)}catch(e){throw Error(e instanceof Error?e.message:`${t} is invalid`)}}function G(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} must be a non-empty canonical string`);for(let n of e){let e=n.charCodeAt(0);if(/\s/.test(n)||e<=31||e===127)throw Error(`${t} must not contain whitespace or control characters`)}return e}function K(e,t){if(!Number.isSafeInteger(e)||Number(e)<0)throw Error(`${t} must be a non-negative safe integer`);return Number(e)}function q(e,t){let n=g(e);if(!n.ok)throw Error(`${t}: ${n.error.message}`);return n.value}function J(e,t){let n=r(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function Y(e,t){if(e.kind!==t.kind||e.walletId!==t.walletId||e.authorityId!==t.authorityId||e.authMethodId!==t.authMethodId||e.authorizationId!==t.authorizationId||e.quotaId!==t.quotaId||e.authorityDigestB64u!==t.authorityDigestB64u||e.authorityRevocationEpoch!==t.authorityRevocationEpoch||e.issuedAtMs!==t.issuedAtMs||e.expiresAtMs!==t.expiresAtMs||e.capabilitySubjects.length!==t.capabilitySubjects.length)return!1;for(let n=0;n<e.capabilitySubjects.length;n+=1){let r=e.capabilitySubjects[n],i=t.capabilitySubjects[n];if(!r||!i||!X(r,i))return!1}return!0}function X(e,t){switch(e.kind){case`link_devices`:case`revoke_devices`:return t.kind===e.kind;case`sign`:case`export_keys`:return t.kind===e.kind&&t.keyFamily===e.keyFamily&&c(e.materialActivation,t.materialActivation);default:return!1}}function Z(e,t){for(let n of e.capabilitySubjects){let e=!1;for(let r of t.capabilitySubjects)if(X(n,r)){e=!0;break}if(!e)return!1}return!0}const Q=w(`kind`,[C({kind:S(`direct`)}),C({kind:S(`regional`),region:S(`US`,`WEUR`,`APAC`,`OC`)})]);function $(e){return Q(e,`Wallet Session home`)}function te(){return C({kind:S(`opaque_wallet_session_operation_credential_v1`),ownershipGeneration:K,home:$,token:(e,t)=>{if(typeof e!=`string`||e.length>8192)throw Error(`${t} is invalid`);return e},walletSessionId:U(N)},(e,t)=>{if(e.ownershipGeneration===0)throw Error(`${t} ownership generation must be positive`);if(!/^wst_[A-Za-z0-9_-]{43}$/.test(e.token))throw Error(`${t} opaque token is invalid`)})}function ne(e){return te()(e,`WalletSessionOperationCredentialV1`)}function re(e){return e.kind===`sign`||e.kind===`export_keys`?`${e.kind}:${e.keyFamily}:${e.materialActivation.activationId}`:e.kind}function ie(){return C({kind:S(`active_wallet_session_v1`),walletId:U(O),authorityId:U(I),authMethodId:U(F),authorizationId:U(P),quotaId:U(z),authorityDigestB64u:U(V),authorityRevocationEpoch:U(K),capabilitySubjects:(e,t)=>{if(!Array.isArray(e)||e.length===0)throw Error(`${t} must be non-empty`);let n=[];for(let[t,r]of e.entries())n.push(oe(r,`capabilitySubjects[${t}]`));let r=n[0];if(!r)throw Error(`${t} must be non-empty`);return[r,...n.slice(1)]},issuedAtMs:U(W),expiresAtMs:U(W)},(e,t)=>{let n=e.capabilitySubjects.map(re);if(new Set(n).size!==n.length)throw Error(`${t} capability subjects repeat`)})}function ae(e){return ie()(e,`ActiveWalletSessionV1`)}function oe(e,t){let n=f(e,t);if(n.kind===`link_devices`||n.kind===`revoke_devices`)return p(n,[`kind`],t),{kind:n.kind};if(n.kind!==`sign`&&n.kind!==`export_keys`)throw Error(`${t}.kind is invalid`);if(p(n,[`kind`,`keyFamily`,`materialActivation`],t),n.keyFamily!==`ed25519`&&n.keyFamily!==`ecdsa_secp256k1`)throw Error(`${t}.keyFamily is invalid`);return{kind:n.kind,keyFamily:n.keyFamily,materialActivation:B(n.materialActivation,`${t}.materialActivation`)}}export{w as A,M as C,T as D,S as E,C as O,O as S,N as T,W as _,Z as a,F as b,V as c,A as d,H as f,J as g,K as h,ne as i,E as k,k as l,G as m,ae as n,j as o,q as p,$ as r,L as s,Y as t,U as u,R as v,P as w,I as x,ee as y};

package/dist/public/sdk/challengeDelivery-DxXAkOfS.js

@@ -1 +0,0 @@
-import{I as e,L as t,R as n,V as r,f as i,v as a,w as o,y as s}from"./normalize-kUDm5zfS.js";import{A as c,j as l,k as u}from"./chains-CiYQT1K4.js";import{i as d,r as f}from"./base64-CsEj-_bC.js";import{n as ee,r as p,s as m}from"./primitives-CAcl7ON7.js";import{l as h}from"./capabilityKinds-CKQ4Uqnv.js";import{r as g}from"./canonicalPrimitives-CKPGgpxg.js";import{c as te,s as _}from"./accountIds-BzZs7YoX.js";import{Qt as v,Xt as ne,en as y,nn as re,ot as ie}from"./emailOtpEcdsaDerivationIdentity-B8HzTh4T.js";import{r as ae}from"./registrationIds-CdPqm-Ya.js";const b=new TextEncoder;function x(e,t){if(typeof e!=`string`||e.length===0)throw Error(`${t} must be a non-empty visible ASCII string`);for(let n=0;n<e.length;n+=1){let r=e.charCodeAt(n);if(r<33||r>126)throw Error(`${t} must contain visible ASCII bytes`)}return e}function oe(e,t){if(typeof e!=`number`||!Number.isInteger(e)||e<0||e>255)throw Error(`${t} must be a byte`);return e}function se(e,t,n,r){if(!Array.isArray(e))throw Error(`${t} must be a byte array`);if(e.length<n||e.length>r)throw Error(`${t} has an invalid length`);let i=[];for(let n=0;n<e.length;n+=1)i.push(oe(e[n],`${t}[${n}]`));return i}function S(e,t,n){let r=se(e,t,32,32);if(n&&ce(r))throw Error(`${t} must be nonzero`);return r}function ce(e){for(let t of e)if(t!==0)return!1;return!0}function C(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function le(e){let t=new Uint8Array(4);return new DataView(t.buffer).setUint32(0,e,!1),t}function w(e){let t=0;for(let n of e)t+=n.length;let n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function T(e){return w([le(e.length),e])}function E(e,t){return w([T(b.encode(e)),T(t)])}async function ue(e){let t=await globalThis.crypto.subtle.digest(`SHA-256`,e);return new Uint8Array(t)}async function de(e){let t=w([T(b.encode(`seams/router-ab/ed25519-yao/application-binding/v1`)),E(`walletId`,b.encode(e.wallet_id)),E(`nearEd25519SigningKeyId`,b.encode(e.near_ed25519_signing_key_id)),E(`signingRootId`,b.encode(e.signing_root_id)),E(`keyCreationSignerSlot`,le(e.key_creation_signer_slot))]);return Array.from(await ue(t))}const fe=`/router-ab/ed25519/yao/registration/admit`,pe=`/router-ab/ed25519/yao/registration/execute`,me=`/router-ab/ed25519/yao/recovery/admit`,he=`/router-ab/ed25519/yao/recovery/execute`,ge=`/router-ab/ed25519/yao/recovery/activate`,_e=`x-seams-wallet-recovery-challenge-id`,ve=`/router-ab/ed25519/yao/recovery/bootstrap`,ye=`router_ab_ed25519_yao_email_otp_recovery_v1`,be=`/router-ab/ed25519/yao/export/admit`,xe=`/router-ab/ed25519/yao/export/execute`,Se=64*1024;function Ce(e,t){return e.operation===t.operation&&D(e.session_id,t.session_id)&&D(e.stable_key_context_binding,t.stable_key_context_binding)&&re(e.material_activation,t.material_activation)&&e.lifecycle.lifecycle_id===t.lifecycle.lifecycle_id&&e.lifecycle.work_kind===t.lifecycle.work_kind&&e.lifecycle.primitive_request_kind===t.lifecycle.primitive_request_kind&&e.lifecycle.root_share_epoch===t.lifecycle.root_share_epoch&&e.lifecycle.account_id===t.lifecycle.account_id&&e.lifecycle.session_id===t.lifecycle.session_id&&e.lifecycle.signer_set_id===t.lifecycle.signer_set_id&&e.lifecycle.selected_server_id===t.lifecycle.selected_server_id}function D(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function we(e,t){return e[0]===t[0]&&e[1]===t[1]}function Te(e,t){return e.lifecycle_id===t.lifecycle_id&&e.root_share_epoch===t.root_share_epoch&&e.account_id===t.account_id&&e.threshold_session_id===t.threshold_session_id&&e.signer_set_id===t.signer_set_id&&e.signing_worker_id===t.signing_worker_id&&re(e.material_activation,t.material_activation)}function Ee(e,t){return e.wallet_id===t.wallet_id&&e.near_ed25519_signing_key_id===t.near_ed25519_signing_key_id&&e.signing_root_id===t.signing_root_id&&e.key_creation_signer_slot===t.key_creation_signer_slot}function De(e,t){return Te(e.scope,t.scope)&&Ee(e.application_binding,t.application_binding)&&we(e.participant_ids,t.participant_ids)}const O=`registration_prepare`,Oe=`registration`,k=`recovery`,ke=`recovery`,A=`key_export`,Ae=`export`;function j(e,t,n){let r=new Set(n);for(let n of Object.keys(e))if(!r.has(n))throw Error(`${t}.${n} is not a supported field`);for(let r of n)if(!Object.hasOwn(e,r))throw Error(`${t}.${r} is required`)}function je(e,t){if(!Number.isInteger(e)||typeof e!=`number`||e<=0||e>4294967295)throw Error(`${t} must be a positive u32`);return e}function Me(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive safe integer`);return e}function Ne(e,t){switch(e){case`registration`:case`recovery`:case`refresh`:case`export`:case`lane_provisioning`:case`lane_refresh`:return e;default:throw Error(`${t} is invalid`)}}function Pe(e,t){switch(e){case`deriver_a`:case`deriver_b`:return e;default:throw Error(`${t} is invalid`)}}function Fe(e,t){switch(e){case`activation`:case`export`:return e;default:throw Error(`${t} is invalid`)}}function Ie(e,t){switch(e){case`activation_client`:case`activation_signing_worker`:case`export_client`:return e;default:throw Error(`${t} is invalid`)}}function Le(e,t){switch(e){case`registration_prepare`:case`key_export`:case`recovery`:case`server_share_refresh`:return e;default:throw Error(`${t} is invalid`)}}function Re(e,t){switch(e){case`registration`:case`recovery`:case`export`:case`refresh`:return e;default:throw Error(`${t} is invalid`)}}function M(e){let t=u(e,`application_binding`);return j(t,`application_binding`,[`wallet_id`,`near_ed25519_signing_key_id`,`signing_root_id`,`key_creation_signer_slot`]),{wallet_id:x(t.wallet_id,`application_binding.wallet_id`),near_ed25519_signing_key_id:x(t.near_ed25519_signing_key_id,`application_binding.near_ed25519_signing_key_id`),signing_root_id:x(t.signing_root_id,`application_binding.signing_root_id`),key_creation_signer_slot:je(t.key_creation_signer_slot,`application_binding.key_creation_signer_slot`)}}function ze(e){let t=u(e,`scope`);j(t,`scope`,[`lifecycle_id`,`root_share_epoch`,`account_id`,`threshold_session_id`,`signer_set_id`,`signing_worker_id`,`material_activation`]);let n=x(t.account_id,`scope.account_id`),r=x(t.signing_worker_id,`scope.signing_worker_id`),i=v(t.material_activation);if(i.material_owner!==n||i.signing_worker!==r)throw Error(`scope.material_activation does not match the lifecycle owner and worker`);return{lifecycle_id:x(t.lifecycle_id,`scope.lifecycle_id`),root_share_epoch:x(t.root_share_epoch,`scope.root_share_epoch`),account_id:n,threshold_session_id:x(t.threshold_session_id,`scope.threshold_session_id`),signer_set_id:x(t.signer_set_id,`scope.signer_set_id`),signing_worker_id:r,material_activation:i}}function N(e){if(!Array.isArray(e)||e.length!==2)throw Error(`participant_ids must contain exactly two values`);let t=je(e[0],`participant_ids[0]`),n=je(e[1],`participant_ids[1]`);if(t>65535||n>65535||t>=n)throw Error(`participant_ids must be distinct, nonzero, ascending u16 values`);return[t,n]}function P(e){return N(e)}function Be(e){let t=u(e,`binding.lifecycle`);j(t,`binding.lifecycle`,[`lifecycle_id`,`work_kind`,`primitive_request_kind`,`root_share_epoch`,`account_id`,`session_id`,`signer_set_id`,`selected_server_id`]);let n={lifecycle_id:x(t.lifecycle_id,`binding.lifecycle.lifecycle_id`),work_kind:Le(t.work_kind,`binding.lifecycle.work_kind`),primitive_request_kind:Re(t.primitive_request_kind,`binding.lifecycle.primitive_request_kind`),root_share_epoch:x(t.root_share_epoch,`binding.lifecycle.root_share_epoch`),account_id:x(t.account_id,`binding.lifecycle.account_id`),session_id:x(t.session_id,`binding.lifecycle.session_id`),signer_set_id:x(t.signer_set_id,`binding.lifecycle.signer_set_id`),selected_server_id:x(t.selected_server_id,`binding.lifecycle.selected_server_id`)};if(n.work_kind===O&&n.primitive_request_kind!==Oe||n.work_kind===k&&n.primitive_request_kind!==ke||n.work_kind===A&&n.primitive_request_kind!==Ae)throw Error(`binding.lifecycle primitive request kind does not match its work kind`);return n}function F(e){let t=u(e,`binding`);j(t,`binding`,[`lifecycle`,`operation`,`session_id`,`stable_key_context_binding`,`material_activation`]);let n={lifecycle:Be(t.lifecycle),operation:Ne(t.operation,`binding.operation`),session_id:S(t.session_id,`binding.session_id`,!0),stable_key_context_binding:S(t.stable_key_context_binding,`binding.stable_key_context_binding`,!1),material_activation:v(t.material_activation)};if(n.operation===`registration`&&n.lifecycle.work_kind!==O||n.operation===`recovery`&&n.lifecycle.work_kind!==k||n.operation===`export`&&n.lifecycle.work_kind!==A)throw Error(`binding operation does not match its lifecycle work kind`);if(n.material_activation.material_owner!==n.lifecycle.account_id||n.material_activation.signing_worker!==n.lifecycle.selected_server_id)throw Error(`binding material activation does not match its lifecycle owner and worker`);return n}function Ve(e){return F(e)}function He(e){let t=F(e);if(t.operation!==`export`||t.lifecycle.work_kind!==A||t.lifecycle.primitive_request_kind!==Ae)throw Error(`export binding requires the exact export lifecycle`);return{lifecycle:{lifecycle_id:t.lifecycle.lifecycle_id,work_kind:A,primitive_request_kind:Ae,root_share_epoch:t.lifecycle.root_share_epoch,account_id:t.lifecycle.account_id,session_id:t.lifecycle.session_id,signer_set_id:t.lifecycle.signer_set_id,selected_server_id:t.lifecycle.selected_server_id},operation:`export`,session_id:t.session_id,stable_key_context_binding:t.stable_key_context_binding,material_activation:t.material_activation}}function I(e){let t=u(e,`export binding`);return j(t,`export binding`,[`ceremony`,`registered_public_key`,`state_epoch`,`runtime_policy_binding`,`authorization_digest`]),{ceremony:He(t.ceremony),registered_public_key:S(t.registered_public_key,`export binding.registered_public_key`,!0),state_epoch:Me(t.state_epoch,`export binding.state_epoch`),runtime_policy_binding:S(t.runtime_policy_binding,`export binding.runtime_policy_binding`,!0),authorization_digest:S(t.authorization_digest,`export binding.authorization_digest`,!0)}}function L(e){switch(e.operation){case`registration`:if(e.lifecycle.work_kind!==O||e.lifecycle.primitive_request_kind!==Oe)throw Error(`activation binding has the wrong registration lifecycle kind`);return{lifecycle:{lifecycle_id:e.lifecycle.lifecycle_id,work_kind:O,primitive_request_kind:Oe,root_share_epoch:e.lifecycle.root_share_epoch,account_id:e.lifecycle.account_id,session_id:e.lifecycle.session_id,signer_set_id:e.lifecycle.signer_set_id,selected_server_id:e.lifecycle.selected_server_id},operation:`registration`,session_id:e.session_id,stable_key_context_binding:e.stable_key_context_binding,material_activation:e.material_activation};case`recovery`:if(e.lifecycle.work_kind!==k||e.lifecycle.primitive_request_kind!==ke)throw Error(`activation binding has the wrong recovery lifecycle kind`);return{lifecycle:{lifecycle_id:e.lifecycle.lifecycle_id,work_kind:k,primitive_request_kind:ke,root_share_epoch:e.lifecycle.root_share_epoch,account_id:e.lifecycle.account_id,session_id:e.lifecycle.session_id,signer_set_id:e.lifecycle.signer_set_id,selected_server_id:e.lifecycle.selected_server_id},operation:`recovery`,session_id:e.session_id,stable_key_context_binding:e.stable_key_context_binding,material_activation:e.material_activation};case`refresh`:case`export`:case`lane_provisioning`:case`lane_refresh`:throw Error(`activation binding has a non-activation operation`)}}function Ue(e){let t=u(e,`keyset`);j(t,`keyset`,[`deriver_a_input_public_key`,`deriver_b_input_public_key`,`signing_worker_recipient_public_key`]);let n={deriver_a_input_public_key:S(t.deriver_a_input_public_key,`keyset.deriver_a_input_public_key`,!0),deriver_b_input_public_key:S(t.deriver_b_input_public_key,`keyset.deriver_b_input_public_key`,!0),signing_worker_recipient_public_key:S(t.signing_worker_recipient_public_key,`keyset.signing_worker_recipient_public_key`,!0)};if(C(n.deriver_a_input_public_key,n.deriver_b_input_public_key)||C(n.deriver_a_input_public_key,n.signing_worker_recipient_public_key)||C(n.deriver_b_input_public_key,n.signing_worker_recipient_public_key))throw Error(`keyset public keys must be distinct`);return n}function R(e,t){let n=u(e,t);j(n,t,[`kind`,`deriver`,`operation`,`session`,`stable_context_binding`,`encapsulated_key`,`ciphertext`]);let r={kind:Fe(n.kind,`${t}.kind`),deriver:Pe(n.deriver,`${t}.deriver`),operation:Ne(n.operation,`${t}.operation`),session:S(n.session,`${t}.session`,!0),stable_context_binding:S(n.stable_context_binding,`${t}.stable_context_binding`,!0),encapsulated_key:S(n.encapsulated_key,`${t}.encapsulated_key`,!0),ciphertext:se(n.ciphertext,`${t}.ciphertext`,16,Se)};if(r.kind===`activation`&&r.operation===`export`||r.kind===`export`&&r.operation!==`export`)throw Error(`${t} operation does not match its circuit family`);return r}function We(e,t,n,r){if(t.kind!==`activation`||t.deriver!==n||t.operation!==e.operation||!C(t.session,e.session_id)||!C(t.stable_context_binding,e.stable_key_context_binding))throw Error(`${r} does not match the admitted activation binding`);switch(e.operation){case`registration`:return{kind:`activation`,deriver:n,operation:`registration`,session:t.session,stable_context_binding:t.stable_context_binding,encapsulated_key:t.encapsulated_key,ciphertext:t.ciphertext};case`recovery`:return{kind:`activation`,deriver:n,operation:`recovery`,session:t.session,stable_context_binding:t.stable_context_binding,encapsulated_key:t.encapsulated_key,ciphertext:t.ciphertext}}}function Ge(e,t,n,r){if(t.kind!==`export`||t.deriver!==n||t.operation!==`export`||!C(t.session,e.ceremony.session_id)||!C(t.stable_context_binding,e.ceremony.stable_key_context_binding))throw Error(`${r} does not match the admitted export binding`);return{kind:`export`,deriver:n,operation:`export`,session:t.session,stable_context_binding:t.stable_context_binding,encapsulated_key:t.encapsulated_key,ciphertext:t.ciphertext}}function z(e,t){let n=u(e,t);return j(n,t,[`kind`,`deriver`,`session`,`transcript`,`encapsulated_key`,`ciphertext`]),{kind:Ie(n.kind,`${t}.kind`),deriver:Pe(n.deriver,`${t}.deriver`),session:S(n.session,`${t}.session`,!0),transcript:S(n.transcript,`${t}.transcript`,!0),encapsulated_key:S(n.encapsulated_key,`${t}.encapsulated_key`,!0),ciphertext:se(n.ciphertext,`${t}.ciphertext`,16,Se)}}function B(e){let t=u(e,`public_receipt`);return j(t,`public_receipt`,[`transcript`,`registered_public_key`,`joined_client_commitment`,`joined_signing_worker_commitment`,`signing_worker_verifying_share`,`state_epoch`,`material_activation`]),{transcript:S(t.transcript,`public_receipt.transcript`,!0),registered_public_key:S(t.registered_public_key,`public_receipt.registered_public_key`,!0),joined_client_commitment:S(t.joined_client_commitment,`public_receipt.joined_client_commitment`,!0),joined_signing_worker_commitment:S(t.joined_signing_worker_commitment,`public_receipt.joined_signing_worker_commitment`,!0),signing_worker_verifying_share:S(t.signing_worker_verifying_share,`public_receipt.signing_worker_verifying_share`,!0),state_epoch:Me(t.state_epoch,`public_receipt.state_epoch`),material_activation:v(t.material_activation)}}function Ke(e,t,n,r,i){if(n.kind!==`activation_client`||n.deriver!==r||!C(n.session,e.session_id)||!C(n.transcript,t.transcript))throw Error(`${i} does not match the terminal activation receipt`);return{kind:`activation_client`,deriver:r,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}}function qe(e,t,n,r,i){if(n.kind!==`export_client`||n.deriver!==r||!C(n.session,e.ceremony.session_id)||!C(n.transcript,t))throw Error(`${i} does not match the terminal export result`);return{kind:`export_client`,deriver:r,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}}function V(e,t){try{return{ok:!0,value:e(t)}}catch(e){return{ok:!1,code:`invalid_body`,message:e instanceof Error?e.message:String(e)}}}function Je(e){let t=u(e,`registration admission request`);return j(t,`registration admission request`,[`scope`,`application_binding`,`participant_ids`]),{scope:ze(t.scope),application_binding:M(t.application_binding),participant_ids:N(t.participant_ids)}}function Ye(e){let t=u(e,`recovery admission request`);j(t,`recovery admission request`,[`scope`,`active_material_activation`,`application_binding`,`participant_ids`,`active_capability_binding`,`replacement_capability_binding`,`registered_public_key`]);let n=S(t.active_capability_binding,`recovery admission request.active_capability_binding`,!0),r=S(t.replacement_capability_binding,`recovery admission request.replacement_capability_binding`,!0);if(C(n,r))throw Error(`recovery replacement capability binding must be fresh`);let i=ze(t.scope),a=v(t.active_material_activation),o=i.material_activation;if(a.activation_id===o.activation_id||a.lifecycle_binding===o.lifecycle_binding)throw Error(`recovery replacement material activation identity must be fresh`);if(a.capability!==o.capability||a.material_owner!==o.material_owner||a.key_binding!==o.key_binding||a.signing_worker!==o.signing_worker)throw Error(`recovery replacement material activation changed stable identity facts`);return{scope:i,active_material_activation:a,application_binding:M(t.application_binding),participant_ids:N(t.participant_ids),active_capability_binding:n,replacement_capability_binding:r,registered_public_key:S(t.registered_public_key,`recovery admission request.registered_public_key`,!0)}}function Xe(e){let t=u(e,`warm recovery bootstrap request`);if(j(t,`warm recovery bootstrap request`,[`kind`,`walletId`,`nearAccountId`,`nearEd25519SigningKeyId`,`signerSlot`,`thresholdSessionId`,`signingWorkerId`,`participantIds`]),t.kind!==`router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1`)throw Error(`warm recovery bootstrap request.kind is invalid`);return{kind:`router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1`,walletId:x(t.walletId,`warm recovery bootstrap request.walletId`),nearAccountId:x(t.nearAccountId,`warm recovery bootstrap request.nearAccountId`),nearEd25519SigningKeyId:x(t.nearEd25519SigningKeyId,`warm recovery bootstrap request.nearEd25519SigningKeyId`),signerSlot:Me(t.signerSlot,`warm recovery bootstrap request.signerSlot`),thresholdSessionId:x(t.thresholdSessionId,`warm recovery bootstrap request.thresholdSessionId`),signingWorkerId:x(t.signingWorkerId,`warm recovery bootstrap request.signingWorkerId`),participantIds:N(t.participantIds)}}function Ze(e){let t=u(e,`export admission receipt`);return j(t,`export admission receipt`,[`binding`,`keyset`]),{binding:I(t.binding),keyset:Ue(t.keyset)}}function Qe(e){let t=u(e,`export execute request`);j(t,`export execute request`,[`binding`,`deriver_a_input`,`deriver_b_input`]);let n=I(t.binding);return{binding:n,deriver_a_input:Ge(n,R(t.deriver_a_input,`deriver_a_input`),`deriver_a`,`deriver_a_input`),deriver_b_input:Ge(n,R(t.deriver_b_input,`deriver_b_input`),`deriver_b`,`deriver_b_input`)}}function $e(e){let t=u(e,`export result`);j(t,`export result`,[`binding`,`transcript`,`deriver_a_client_package`,`deriver_b_client_package`]);let n=I(t.binding),r=S(t.transcript,`export result.transcript`,!0);return{binding:n,transcript:r,deriver_a_client_package:qe(n,r,z(t.deriver_a_client_package,`deriver_a_client_package`),`deriver_a`,`deriver_a_client_package`),deriver_b_client_package:qe(n,r,z(t.deriver_b_client_package,`deriver_b_client_package`),`deriver_b`,`deriver_b_client_package`)}}function et(e){let t=u(e,`activation admission receipt`);j(t,`activation admission receipt`,[`binding`,`keyset`]);let n=L(F(t.binding)),r=Ue(t.keyset);switch(n.operation){case`registration`:return{binding:n,keyset:r};case`recovery`:return{binding:n,keyset:r}}}function tt(e){let t=u(e,`activation execute request`);j(t,`activation execute request`,[`binding`,`deriver_a_input`,`deriver_b_input`]);let n=L(F(t.binding)),r=We(n,R(t.deriver_a_input,`deriver_a_input`),`deriver_a`,`deriver_a_input`),i=We(n,R(t.deriver_b_input,`deriver_b_input`),`deriver_b`,`deriver_b_input`);if(n.operation===`registration`){if(r.operation!==`registration`||i.operation!==`registration`)throw Error(`activation inputs do not match registration binding`);return{binding:n,deriver_a_input:r,deriver_b_input:i}}if(r.operation!==`recovery`||i.operation!==`recovery`)throw Error(`activation inputs do not match recovery binding`);return{binding:n,deriver_a_input:r,deriver_b_input:i}}function nt(e){let t=u(e,`activation result`);j(t,`activation result`,[`binding`,`deriver_a_client_package`,`deriver_b_client_package`,`public_receipt`]);let n=L(F(t.binding)),r=B(t.public_receipt);if(!re(n.material_activation,r.material_activation))throw Error(`activation result receipt material does not match the admitted binding`);let i=z(t.deriver_a_client_package,`deriver_a_client_package`),a=z(t.deriver_b_client_package,`deriver_b_client_package`),o=Ke(n,r,i,`deriver_a`,`deriver_a_client_package`),s=Ke(n,r,a,`deriver_b`,`deriver_b_client_package`);switch(n.operation){case`registration`:return{binding:n,deriver_a_client_package:o,deriver_b_client_package:s,public_receipt:r};case`recovery`:return{binding:n,deriver_a_client_package:o,deriver_b_client_package:s,public_receipt:r}}}function rt(e){let t=L(F(e));switch(t.operation){case`registration`:throw Error(`recovery activation requires a recovery binding`);case`recovery`:return t}}function it(e){let t=u(e,`recovery activation receipt`);j(t,`recovery activation receipt`,[`binding`,`public_receipt`,`active_capability_binding`,`retired_capability_binding`]);let n=S(t.active_capability_binding,`recovery activation receipt.active_capability_binding`,!0),r=S(t.retired_capability_binding,`recovery activation receipt.retired_capability_binding`,!0);if(C(n,r))throw Error(`recovery activation receipt capability bindings must be distinct`);return{binding:rt(t.binding),public_receipt:B(t.public_receipt),active_capability_binding:n,retired_capability_binding:r}}function at(e,t){return e.binding.operation===t}function ot(e,t){return e.binding.operation===t}function st(e,t){return e.binding.operation===t}function H(e){return{ok:!1,code:`invalid_body`,message:`activation value must use the ${e} operation`}}function ct(e){return V(Je,e)}function lt(e){return V(Ye,e)}function ut(e){return V(Xe,e)}function dt(e){return V(Ze,e)}function ft(e){return V(Qe,e)}function pt(e){return V($e,e)}function mt(e){return V(et,e)}function ht(e){let t=mt(e);return t.ok?at(t.value,`registration`)?{ok:!0,value:t.value}:H(`registration`):t}function gt(e){let t=mt(e);return t.ok?at(t.value,`recovery`)?{ok:!0,value:t.value}:H(`recovery`):t}function _t(e){return V(tt,e)}function vt(e){let t=_t(e);return t.ok?ot(t.value,`registration`)?{ok:!0,value:t.value}:H(`registration`):t}function yt(e){let t=_t(e);return t.ok?ot(t.value,`recovery`)?{ok:!0,value:t.value}:H(`recovery`):t}function bt(e){return V(nt,e)}function xt(e){let t=bt(e);return t.ok?st(t.value,`registration`)?{ok:!0,value:t.value}:H(`registration`):t}function St(e){let t=bt(e);return t.ok?st(t.value,`recovery`)?{ok:!0,value:t.value}:H(`recovery`):t}function Ct(e){return V(it,e)}function wt(e){return V(Tt,e)}function Tt(e){return z(e,`encrypted_package`)}const Et=`seams/linked-device/ecdsa-source-contribution-envelope/v1`;function Dt(e){let t=c(e,`linked-device ordinary source contribution`);switch(t.kind){case`linked_device_ed25519_source_contribution_v1`:return Pt(t);case`linked_device_ecdsa_source_contribution_v1`:return Ft(t);default:throw Error(`linked-device ordinary source contribution kind is invalid`)}}function Ot(e){let t=Q(e,[`state`,`reservation_id`,`participant_ids`,`activation_receipt`,`deriver_a_client_package`,`deriver_b_client_package`],`linked-device Ed25519 source-preserving reservation`);if(t.state!==`inactive`)throw Error(`linked-device Ed25519 source-preserving reservation is not inactive`);let n=B(t.activation_receipt),r=P(t.participant_ids),i=U(t.deriver_a_client_package,`deriver_a`),a=U(t.deriver_b_client_package,`deriver_b`);if(!D(n.transcript,i.transcript)||!D(n.transcript,a.transcript))throw Error(`linked-device Ed25519 reservation packages have mismatched transcripts`);return{state:`inactive`,reservationId:Z(t.reservation_id,`reservation_id`),participantIds:r,activationReceipt:n,deriver_a_client_package:i,deriver_b_client_package:a}}function kt(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`linked-device ordinary source contributions must contain one or two entries`);let t=e.map(Dt),n=t.map(e=>e.keyFamily);if(new Set(n).size!==n.length)throw Error(`linked-device ordinary source contributions repeat a key family`);if(t.length===2&&(t[0]?.keyFamily!==`ed25519`||t[1]?.keyFamily!==`ecdsa_secp256k1`))throw Error(`linked-device ordinary source contributions must be Ed25519 then ECDSA`);let r=t[0];if(!r)throw Error(`linked-device ordinary source contributions are empty`);return[r,...t.slice(1)]}function At(e){let t=Q(e,[`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`source`,`target`],`linked-device ECDSA source contribution preparation`),n=Ut(t.source),r=Wt(t.target);return Zt(n.activation,r.activation),{linkSessionId:G(t.linkSessionId),enrollmentId:K(t.enrollmentId),sourceAuthorityId:q(t.sourceAuthorityId),source:n,target:r}}function jt(e){let t=c(e,`linked-device ordinary source contribution preparation`);if(t.kind===`linked_device_ed25519_source_contribution_preparation_v1`)return Nt(t);if(Object.prototype.hasOwnProperty.call(t,`source`)&&Object.prototype.hasOwnProperty.call(t,`target`))return At(t);throw Error(`linked-device ordinary source contribution preparation family is invalid`)}function Mt(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`linked-device ordinary source contribution preparations must contain one or two entries`);let t=e.map(jt),n=t.map(e=>`kind`in e?`ed25519`:`ecdsa_secp256k1`);if(new Set(n).size!==n.length)throw Error(`linked-device ordinary source contribution preparations repeat a key family`);if(t.length===2&&(n[0]!==`ed25519`||n[1]!==`ecdsa_secp256k1`))throw Error(`linked-device ordinary source contribution preparations must be ordered Ed25519 then ECDSA`);let r=t[0];if(!r)throw Error(`linked-device ordinary source contribution preparation is empty`);return[r,...t.slice(1)]}function Nt(e){if(Q(e,[`kind`,`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`walletKeyId`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`sourceBinding`,`targetAdmission`,`applicationBinding`,`sourceRevocationEpoch`,`participantIds`,`targetMaterialActivation`,`targetClientRecipientPublicKeyB64u`,`targetSigningWorkerRecipientPublicKeyB64u`,`sourceRegisteredPublicKeyB64u`],`linked-device Ed25519 source contribution preparation`),e.kind!==`linked_device_ed25519_source_contribution_preparation_v1`)throw Error(`linked-device Ed25519 source contribution preparation kind is invalid`);let t=Kt(e.sourceBinding,`sourceBinding`),n=ht(e.targetAdmission);if(!n.ok)throw Error(`targetAdmission ${n.message}`);let r=n.value,a=M(e.applicationBinding);if(typeof e.sourceRevocationEpoch!=`number`||!Number.isSafeInteger(e.sourceRevocationEpoch)||e.sourceRevocationEpoch<0)throw Error(`sourceRevocationEpoch must be a non-negative safe integer`);let o=W(e.targetMaterialActivation,`targetMaterialActivation`),s=G(e.linkSessionId),c=K(e.enrollmentId),l=q(e.sourceAuthorityId),u=$t(e.walletKeyId),d=J(e.targetDeviceId),f=Y(e.targetFactorVerificationDigestB64u,`targetFactorVerificationDigestB64u`),p=X(e.targetClientRecipientPublicKeyB64u,32,`targetClientRecipientPublicKeyB64u`),m=X(e.targetSigningWorkerRecipientPublicKeyB64u,32,`targetSigningWorkerRecipientPublicKeyB64u`);if(p===m)throw Error(`linked-device Ed25519 source contribution recipients must differ`);let h=P(e.participantIds);if(Jt(t,s,`sourceBinding`),!i(o,y(r.binding.material_activation)))throw Error(`targetAdmission activation differs from targetMaterialActivation`);if(!Yt(t,r.binding))throw Error(`source and target Ed25519 contribution bindings differ`);if(t.material_activation.activation_id===o.activationId)throw Error(`source and target Ed25519 contribution activations must differ`);return{kind:`linked_device_ed25519_source_contribution_preparation_v1`,linkSessionId:s,enrollmentId:c,sourceAuthorityId:l,walletKeyId:u,targetDeviceId:d,targetFactorVerificationDigestB64u:f,sourceBinding:t,targetAdmission:r,applicationBinding:a,sourceRevocationEpoch:e.sourceRevocationEpoch,participantIds:h,targetMaterialActivation:o,targetClientRecipientPublicKeyB64u:p,targetSigningWorkerRecipientPublicKeyB64u:m,sourceRegisteredPublicKeyB64u:ee(e.sourceRegisteredPublicKeyB64u,`sourceRegisteredPublicKeyB64u`)}}function Pt(e){if(Q(e,[`kind`,`keyFamily`,`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`walletKeyId`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`targetMaterialActivation`,`targetClientRecipientPublicKeyB64u`,`targetSigningWorkerRecipientPublicKeyB64u`,`sourceBinding`,`reservationId`,`targetBinding`,`activationReceipt`,`participantIds`,`deriver_a_client_package`,`deriver_b_client_package`,`sourceRegisteredPublicKeyB64u`],`linked-device Ed25519 source contribution`),e.kind!==`linked_device_ed25519_source_contribution_v1`)throw Error(`linked-device Ed25519 source contribution kind is invalid`);if(e.keyFamily!==`ed25519`)throw Error(`linked-device Ed25519 source contribution family is invalid`);let t=Kt(e.sourceBinding,`sourceBinding`),n=W(e.targetMaterialActivation,`source contribution targetMaterialActivation`),r=Kt(e.targetBinding,`targetBinding`),a=B(e.activationReceipt),o=Z(e.reservationId,`reservationId`),s=P(e.participantIds),c=G(e.linkSessionId),l=K(e.enrollmentId),u=q(e.sourceAuthorityId),d=$t(e.walletKeyId),p=J(e.targetDeviceId),m=Y(e.targetFactorVerificationDigestB64u,`targetFactorVerificationDigestB64u`),h=X(e.targetClientRecipientPublicKeyB64u,32,`targetClientRecipientPublicKeyB64u`),g=X(e.targetSigningWorkerRecipientPublicKeyB64u,32,`targetSigningWorkerRecipientPublicKeyB64u`);if(h===g)throw Error(`linked-device Ed25519 source contribution recipients must differ`);if(Jt(t,c,`sourceBinding`),qt(r,c,n,`targetBinding`),!Yt(t,r))throw Error(`linked-device Ed25519 source contribution stable identity differs`);if(!i(y(a.material_activation),n))throw Error(`linked-device Ed25519 source contribution receipt activation differs`);let te=ee(e.sourceRegisteredPublicKeyB64u,`sourceRegisteredPublicKeyB64u`);if(!D(a.registered_public_key,Array.from(f(te))))throw Error(`linked-device Ed25519 source contribution receipt public key differs`);let _=U(e.deriver_a_client_package,`deriver_a`),v=U(e.deriver_b_client_package,`deriver_b`);if(!D(a.transcript,_.transcript)||!D(a.transcript,v.transcript))throw Error(`linked-device Ed25519 source contribution package transcript differs`);if(t.material_activation.activation_id===n.activationId)throw Error(`linked-device Ed25519 source contribution reuses the source activation`);return{kind:`linked_device_ed25519_source_contribution_v1`,keyFamily:`ed25519`,linkSessionId:c,enrollmentId:l,sourceAuthorityId:u,walletKeyId:d,targetDeviceId:p,targetFactorVerificationDigestB64u:m,targetMaterialActivation:n,targetClientRecipientPublicKeyB64u:h,targetSigningWorkerRecipientPublicKeyB64u:g,sourceBinding:t,reservationId:o,targetBinding:r,activationReceipt:a,participantIds:s,deriver_a_client_package:_,deriver_b_client_package:v,sourceRegisteredPublicKeyB64u:te}}function Ft(e){if(Q(e,[`kind`,`keyFamily`,`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`walletKeyId`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`sourceSigner`,`sourceDerivation`,`target`,`package`],`linked-device ECDSA source contribution`),e.kind!==`linked_device_ecdsa_source_contribution_v1`)throw Error(`linked-device ECDSA source contribution kind is invalid`);if(e.keyFamily!==`ecdsa_secp256k1`)throw Error(`linked-device ECDSA source contribution family is invalid`);let t=G(e.linkSessionId),n=K(e.enrollmentId),r=q(e.sourceAuthorityId),i=$t(e.walletKeyId),a=J(e.targetDeviceId),o=Y(e.targetFactorVerificationDigestB64u,`targetFactorVerificationDigestB64u`),s=Ut(e.sourceSigner),c=It(e.sourceDerivation),l=Wt(e.target);Zt(s.activation,l.activation);let u=Vt(e.package);if(u.binding.linkSessionId!==t||u.binding.enrollmentId!==n||u.binding.sourceAuthorityId!==r||u.binding.target.targetDeviceId!==a||u.binding.target.targetFactorVerificationDigestB64u!==o)throw Error(`linked-device ECDSA source contribution package binding differs`);if(!Xt(u.binding.source,s))throw Error(`linked-device ECDSA source contribution signer differs from package binding`);if(!Qt(u.binding.target,l))throw Error(`linked-device ECDSA source contribution target differs from package binding`);return{kind:`linked_device_ecdsa_source_contribution_v1`,keyFamily:`ecdsa_secp256k1`,linkSessionId:t,enrollmentId:n,sourceAuthorityId:r,walletKeyId:i,targetDeviceId:a,targetFactorVerificationDigestB64u:o,sourceSigner:s,sourceDerivation:c,target:l,package:u}}function It(e){let t=Q(e,[`applicationBindingDigestB64u`,`clientShareRetryCounter`,`ecdsaThresholdKeyId`,`sourceNormalSigning`],`linked-device ECDSA source derivation`),n=t.clientShareRetryCounter;if(typeof n!=`number`||!Number.isSafeInteger(n)||n<0)throw Error(`linked-device ECDSA source derivation retry counter is invalid`);let r=Y(t.applicationBindingDigestB64u,`sourceDerivation.applicationBindingDigestB64u`),i=ie(t.sourceNormalSigning),a=ne(t.ecdsaThresholdKeyId);if(i.scope.context.application_binding_digest_b64u!==r||i.scope.public_identity.client_share_retry_counter!==n||i.scope.ecdsa_threshold_key_id!==a)throw Error(`linked-device ECDSA source derivation differs from normal signing`);return{applicationBindingDigestB64u:r,clientShareRetryCounter:n,ecdsaThresholdKeyId:a,sourceNormalSigning:i}}function Lt(e){let t=Q(e,[`state`,`binding`,`sourceDerivation`,`targetRelayerPublicKey33B64u`,`thresholdPublicKey33B64u`,`thresholdEthereumAddress20B64u`,`normalSigning`],`linked-device ECDSA source-preserving activation receipt`);if(t.state!==`inactive`)throw Error(`linked-device ECDSA source-preserving activation receipt is not inactive`);let n=Ht(t.binding),r=It(t.sourceDerivation),i=m(t.targetRelayerPublicKey33B64u,`targetRelayerPublicKey33B64u`),a=m(t.thresholdPublicKey33B64u,`thresholdPublicKey33B64u`),o=X(t.thresholdEthereumAddress20B64u,20,`thresholdEthereumAddress20B64u`),s=ie(t.normalSigning);return Rt({binding:n,sourceDerivation:r,targetRelayerPublicKey33B64u:i,thresholdPublicKey33B64u:a,thresholdEthereumAddress20B64u:o,normalSigning:s}),{state:`inactive`,binding:n,sourceDerivation:r,targetRelayerPublicKey33B64u:i,thresholdPublicKey33B64u:a,thresholdEthereumAddress20B64u:o,normalSigning:s}}function Rt(e){let t=e.sourceDerivation.sourceNormalSigning.scope,n=e.normalSigning.scope;if(!i(y(t.material_activation),e.binding.source.activation)||!i(y(n.material_activation),e.binding.target.activation)||t.wallet_id!==n.wallet_id||t.wallet_id!==e.binding.source.activation.materialOwner||n.wallet_id!==e.binding.target.activation.materialOwner||t.ecdsa_threshold_key_id!==n.ecdsa_threshold_key_id||t.signing_root_id!==n.signing_root_id||t.signing_root_version!==n.signing_root_version||t.context.application_binding_digest_b64u!==n.context.application_binding_digest_b64u||t.activation_epoch!==n.activation_epoch||t.public_identity.derivation_client_share_public_key33_b64u!==e.binding.source.clientPublicKey33B64u||t.public_identity.server_public_key33_b64u!==e.binding.source.relayerPublicKey33B64u||t.public_identity.threshold_public_key33_b64u!==e.binding.source.thresholdPublicKey33B64u||t.public_identity.ethereum_address20_b64u!==e.binding.source.thresholdEthereumAddress20B64u||n.public_identity.context_binding_b64u!==t.public_identity.context_binding_b64u||n.public_identity.derivation_client_share_public_key33_b64u!==e.binding.targetClientPublicKey33B64u||n.public_identity.server_public_key33_b64u!==e.targetRelayerPublicKey33B64u||n.public_identity.threshold_public_key33_b64u!==e.thresholdPublicKey33B64u||n.public_identity.ethereum_address20_b64u!==e.thresholdEthereumAddress20B64u||n.public_identity.client_share_retry_counter!==t.public_identity.client_share_retry_counter||n.public_identity.server_share_retry_counter!==t.public_identity.server_share_retry_counter||n.signing_worker.server_id!==e.binding.target.activation.signingWorker||n.signing_worker.key_epoch!==t.signing_worker.key_epoch||n.signing_worker.recipient_encryption_key!==zt(e.binding.target.signingWorkerRecipientPublicKeyB64u))throw Error(`linked-device ECDSA normal signing state differs from its activation receipt`)}function zt(e){let t=f(e);if(t.length!==32||d(t)!==e)throw Error(`linked-device signing-worker recipient key is invalid`);let n=``;for(let e of t)n+=e.toString(16).padStart(2,`0`);return`x25519:${n}`}function U(e,t){let n=Bt(e,`${t} client package`);if(n.kind!==`activation_client`||n.deriver!==t)throw Error(`${t} client package is not an activation client package`);return t===`deriver_a`?{kind:`activation_client`,deriver:`deriver_a`,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}:{kind:`activation_client`,deriver:`deriver_b`,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}}function Bt(e,t){let n=wt(e);if(!n.ok)throw Error(`${t} ${n.message}`);return n.value}function Vt(e){let t=Q(e,[`binding`,`encryptedDelta`,`encryptedTargetClientShare`],`linked-device ECDSA source contribution package`),n=Ht(t.binding),r=Gt(t.encryptedDelta,`encryptedDelta`),i=Gt(t.encryptedTargetClientShare,`encryptedTargetClientShare`),a=r.bindingDigestB64u;if(i.bindingDigestB64u!==a)throw Error(`linked-device ECDSA source contribution envelope bindings differ`);if(r.recipientPublicKeyB64u!==n.target.signingWorkerRecipientPublicKeyB64u||i.recipientPublicKeyB64u!==n.target.clientRecipientPublicKeyB64u)throw Error(`linked-device ECDSA source contribution envelope recipients differ`);return{binding:n,encryptedDelta:r,encryptedTargetClientShare:i}}function Ht(e){let t=Q(e,[`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`source`,`target`,`targetClientPublicKey33B64u`],`linked-device ECDSA source contribution binding`),n=Ut(t.source),r=Wt(t.target);return Zt(n.activation,r.activation),{linkSessionId:Z(t.linkSessionId,`binding.linkSessionId`),enrollmentId:Z(t.enrollmentId,`binding.enrollmentId`),sourceAuthorityId:Z(t.sourceAuthorityId,`binding.sourceAuthorityId`),source:n,target:r,targetClientPublicKey33B64u:m(t.targetClientPublicKey33B64u,`binding.targetClientPublicKey33B64u`)}}function Ut(e){let t=Q(e,[`activation`,`clientPublicKey33B64u`,`relayerPublicKey33B64u`,`thresholdPublicKey33B64u`,`thresholdEthereumAddress20B64u`],`linked-device ECDSA source signer`);return{activation:W(t.activation,`source.activation`),clientPublicKey33B64u:m(t.clientPublicKey33B64u,`source.clientPublicKey33B64u`),relayerPublicKey33B64u:m(t.relayerPublicKey33B64u,`source.relayerPublicKey33B64u`),thresholdPublicKey33B64u:m(t.thresholdPublicKey33B64u,`source.thresholdPublicKey33B64u`),thresholdEthereumAddress20B64u:X(t.thresholdEthereumAddress20B64u,20,`source.thresholdEthereumAddress20B64u`)}}function Wt(e){let t=Q(e,[`activation`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`clientRecipientPublicKeyB64u`,`signingWorkerRecipientPublicKeyB64u`],`linked-device ECDSA target recipient`),n=X(t.clientRecipientPublicKeyB64u,32,`target.clientRecipientPublicKeyB64u`),r=X(t.signingWorkerRecipientPublicKeyB64u,32,`target.signingWorkerRecipientPublicKeyB64u`);if(n===r)throw Error(`linked-device ECDSA target recipients must differ`);return{activation:W(t.activation,`target.activation`),targetDeviceId:J(t.targetDeviceId),targetFactorVerificationDigestB64u:Y(t.targetFactorVerificationDigestB64u,`target.targetFactorVerificationDigestB64u`),clientRecipientPublicKeyB64u:n,signingWorkerRecipientPublicKeyB64u:r}}function Gt(e,t){let n=Q(e,[`kind`,`recipientPublicKeyB64u`,`bindingDigestB64u`,`encappedKeyB64u`,`ciphertextB64u`],`linked-device ECDSA ${t}`);if(n.kind!==Et)throw Error(`${t}.kind is invalid`);return{kind:Et,recipientPublicKeyB64u:X(n.recipientPublicKeyB64u,32,`${t}.recipientPublicKeyB64u`),bindingDigestB64u:Y(n.bindingDigestB64u,`${t}.bindingDigestB64u`),encappedKeyB64u:X(n.encappedKeyB64u,32,`${t}.encappedKeyB64u`),ciphertextB64u:p(n.ciphertextB64u,`${t}.ciphertextB64u`)}}function Kt(e,t){let n=Ve(e);if(n.operation!==`registration`)throw Error(`${t} must use the registration operation`);return n}function qt(e,t,n,r){if(e.material_activation.activation_id!==n.activationId)throw Error(`${r} activation does not match the target activation`);if(e.material_activation.material_owner!==n.materialOwner)throw Error(`${r} material owner does not match the target activation`);if(e.material_activation.signing_worker!==n.signingWorker)throw Error(`${r} signing worker does not match the target activation`);if(e.session_id.length!==32||String(t).length===0)throw Error(`${r} link binding is invalid`)}function Jt(e,t,n){if(e.session_id.length!==32||String(t).length===0)throw Error(`${n} link binding is invalid`)}function Yt(e,t){return e.operation===t.operation&&e.stable_key_context_binding.every((e,n)=>e===t.stable_key_context_binding[n])&&e.material_activation.capability===t.material_activation.capability&&e.material_activation.material_owner===t.material_activation.material_owner&&e.material_activation.key_binding===t.material_activation.key_binding&&e.material_activation.lifecycle_binding===t.material_activation.lifecycle_binding&&e.material_activation.signing_worker===t.material_activation.signing_worker&&e.lifecycle.root_share_epoch===t.lifecycle.root_share_epoch&&e.lifecycle.account_id===t.lifecycle.account_id&&e.lifecycle.signer_set_id===t.lifecycle.signer_set_id&&e.lifecycle.selected_server_id===t.lifecycle.selected_server_id}function Xt(e,t){return i(e.activation,t.activation)&&e.clientPublicKey33B64u===t.clientPublicKey33B64u&&e.relayerPublicKey33B64u===t.relayerPublicKey33B64u&&e.thresholdPublicKey33B64u===t.thresholdPublicKey33B64u&&e.thresholdEthereumAddress20B64u===t.thresholdEthereumAddress20B64u}function Zt(e,t){if(i(e,t)||e.materialOwner!==t.materialOwner||e.signingWorker!==t.signingWorker)throw Error(`linked-device ECDSA source and target activations are invalid`)}function Qt(e,t){return i(e.activation,t.activation)&&e.targetDeviceId===t.targetDeviceId&&e.targetFactorVerificationDigestB64u===t.targetFactorVerificationDigestB64u&&e.clientRecipientPublicKeyB64u===t.clientRecipientPublicKeyB64u&&e.signingWorkerRecipientPublicKeyB64u===t.signingWorkerRecipientPublicKeyB64u}function W(e,t){let n=o(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function G(e){let t=a(Z(e,`linkSessionId`));if(!t.ok)throw Error(`linkSessionId ${t.error.message}`);return t.value}function K(e){let t=s(Z(e,`enrollmentId`));if(!t.ok)throw Error(`enrollmentId ${t.error.message}`);return t.value}function q(t){let n=e(Z(t,`sourceAuthorityId`));if(!n.ok)throw Error(`sourceAuthorityId ${n.error.message}`);return n.value}function $t(e){let t=n(Z(e,`walletKeyId`));if(!t.ok)throw Error(`walletKeyId ${t.error.message}`);return t.value}function J(e){let t=h(Z(e,`targetDeviceId`));if(!t.ok)throw Error(`targetDeviceId ${t.error.message}`);return t.value}function Y(e,t){try{return g(e)}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is invalid`}`)}}function X(e,t,n){if(typeof e!=`string`||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${n} must be canonical base64url`);let r;try{r=f(e)}catch{throw Error(`${n} must be canonical base64url`)}if(r.length!==t||d(r)!==e)throw Error(`${n} must decode to ${t} bytes`);return e}function Z(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e||[...e].some(e=>{let t=e.charCodeAt(0);return t<32||t===127}))throw Error(`${t} must be a non-empty visible string`);return e}function Q(e,t,n){let r=c(e,n),i=new Set(t),a=Object.keys(r);if(a.length!==t.length||a.some(e=>!i.has(e))||t.some(e=>!Object.prototype.hasOwnProperty.call(r,e)))throw Error(`${n} contains unknown or missing fields`);return r}function en(e){return!e||typeof e!=`object`||Array.isArray(e)?null:e}function $(e){return typeof e==`string`?e.trim():``}function tn(e,t){let n=$(e);return n?{ok:!0,value:n}:{ok:!1,error:{code:`missing`,message:`${t} is required`}}}function nn(e){let t=typeof e==`number`?e:Number(e);return!Number.isSafeInteger(t)||t<1?{ok:!1,error:{code:`invalid`,message:`signerSlot must be an integer >= 1`}}:{ok:!0,value:t}}function rn(e){return{ok:!1,error:{code:`invalid`,message:`${e} must be an object`}}}function an(e){let t=r(e);return t.ok?{ok:!0,value:t.value}:{ok:!1,error:t.error}}function on(e){let n=en(e);if(!n)return rn(`WalletIdentity`);let r=t(n.walletId);return r.ok?{ok:!0,value:{walletId:r.value}}:{ok:!1,error:r.error}}function sn(e){return{walletId:e.walletId}}function cn(e){return{wallet:e.wallet,rpId:e.rpId}}function ln(e){let t=$(e.credentialIdB64u);if(!t)throw Error(`credentialIdB64u is required`);return{kind:`passkey`,walletAuthMethodId:e.walletAuthMethodId,scope:e.scope,credentialIdB64u:t}}function un(e){let t=$(e.emailHashHex),n=$(e.registrationAuthorityId);if(!t)throw Error(`emailHashHex is required`);if(!n)throw Error(`registrationAuthorityId is required`);return{kind:`email_otp`,walletAuthMethodId:e.walletAuthMethodId,wallet:e.wallet,emailHashHex:t,registrationAuthorityId:n}}function dn(e){return{kind:`implicit_near_account`,wallet:e.wallet,nearAccountId:e.nearAccountId}}function fn(e){return{kind:`named_near_account`,wallet:e.wallet,nearAccountId:e.nearAccountId}}function pn(e){let t=en(e);if(!t)return rn(`NearAccountBinding`);let n=on(t.wallet);if(!n.ok)return n;let r=$(t.kind);if(r===`implicit_near_account`){let e=_(t.nearAccountId);return e.ok?{ok:!0,value:dn({wallet:n.value,nearAccountId:e.value})}:{ok:!1,error:{code:e.code,message:e.message}}}if(r===`named_near_account`){let e=te(t.nearAccountId);return e.ok?{ok:!0,value:fn({wallet:n.value,nearAccountId:e.value})}:{ok:!1,error:{code:e.code,message:e.message}}}return{ok:!1,error:{code:`invalid`,message:`NearAccountBinding kind is invalid`}}}function mn(e){let t=nn(e.signerSlot);if(!t.ok)throw Error(t.error.message);return{kind:`near_ed25519_signer`,account:e.account,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:t.value}}function hn(e){let t=en(e);if(!t)return rn(`NearEd25519SignerBinding`);let n=pn(t.account);if(!n.ok)return n;let r=tn(t.nearEd25519SigningKeyId,`nearEd25519SigningKeyId`);if(!r.ok)return r;let i=nn(t.signerSlot);return i.ok?{ok:!0,value:mn({account:n.value,nearEd25519SigningKeyId:ae(r.value),signerSlot:i.value})}:i}function gn(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`${t} must be an object`);return e}function _n(e,t){let n=l(e,t);switch(n){case`sent`:case`reused`:return n;default:throw Error(`${t} must be sent or reused`)}}function vn(e,t){return{kind:`provider`,status:e,emailHint:t}}function yn(e,t){let n=gn(e,t),r=l(n.kind,`${t}.kind`),i=_n(n.status,`${t}.status`),a=l(n.emailHint,`${t}.emailHint`);switch(r){case`provider`:case`development`:if(n.otpCode!==void 0)throw Error(`${t}.otpCode is only valid for code-bearing delivery`);return vn(i,a);case`demo_code_response`:case`provider_and_demo_code`:{let e=l(n.otpCode,`${t}.otpCode`);if(!/^\d{6}$/.test(e))throw Error(`${t}.otpCode must be a 6-digit code`);return{kind:r,status:i,emailHint:a,otpCode:e}}default:throw Error(`${t}.kind is invalid`)}}function bn(e){switch(e.kind){case`provider`:return null;case`demo_code_response`:case`provider_and_demo_code`:return e.otpCode}}export{B as A,Ct as B,ge as C,fe as D,he as E,ft as F,xt as G,lt as H,pt as I,Ce as J,ct as K,P as L,Ve as M,wt as N,pe as O,dt as P,gt as R,xe as S,_e as T,ht as U,St as V,vt as W,De as X,D as Y,de as Z,kt as _,fn as a,ye as b,ln as c,an as d,Gt as f,jt as g,Mt as h,dn as i,M as j,ve as k,sn as l,Ot as m,yn as n,mn as o,Lt as p,ut as q,un as r,cn as s,bn as t,hn as u,Xt as v,me as w,be as x,Qt as y,yt as z};

package/dist/public/sdk/digestEncoding-Dzc1rzWV.js

@@ -1 +0,0 @@
-import{R as e,l as t}from"./normalize-kUDm5zfS.js";import{C as n}from"./chains-CiYQT1K4.js";import{i as r,r as i}from"./base64-CsEj-_bC.js";import{r as a}from"./canonicalPrimitives-CKPGgpxg.js";function o(e,n={trim:!0}){let r=String(e??``);return t(n.trim?r.trim():r)}function s(e){let t=String(e.token??``).trim();if(!t)throw Error(e.missingMessage);return{Authorization:`Bearer ${t}`}}function c(e){return{method:`POST`,headers:{"Content-Type":`application/json`,...e.headers||{}},credentials:`omit`,body:e.bodyJson??JSON.stringify(e.body)}}function l(e,t){let n=o(e),r=globalThis.location?.origin,i;try{i=new URL(n).origin}catch{return}if(!(!r||i===r))for(let e of t)fetch(`${n}${e}`,{method:`OPTIONS`,credentials:`omit`}).catch(()=>{})}function u(e){return{...s({token:e.token,missingMessage:`Wallet Session token is required`}),...d(e.home)}}function d(e){switch(e.kind){case`direct`:return{};case`regional`:return{"X-Seams-Wallet-Region":e.region}}}async function f(e){let t=await fetch(e.clone());if(t.status!==409||!e.headers.has(`X-Seams-Wallet-Region`))return t;let r;try{r=await t.clone().json()}catch{return t}if(!n(r)||r.code!==`wallet_home_discovery_required`)return t;let i=new Headers(e.headers);return i.delete(`X-Seams-Wallet-Region`),fetch(new Request(e,{headers:i}))}function p(e,t){if(typeof e!=`string`)throw Error(`EVM-family signing key slot id requires ${t}`);let n=e.trim();if(!n)throw Error(`EVM-family signing key slot id requires ${t}`);return n}function m(e){return encodeURIComponent(p(e,`non-empty components`))}function h(e){let t=e.split(`:`);return t.length===5&&t[0]===`wallet-key`&&t[1]===`evm-family`&&t.slice(2).every(e=>e.length>0)}function g(t){let n=e(t);return n.ok?h(String(n.value))?{ok:!0,value:String(n.value)}:{ok:!1,error:{code:`invalid`,message:`EVM-family signing key slot id must be wallet-key:evm-family:<walletId>:<signingRootId>:<signingRootVersion>`}}:n}function _(e,t=`evmFamilySigningKeySlotId`){let n=g(e);if(n.ok)return n.value;throw n.error.code===`missing`?Error(`${t} is required`):Error(`${t} must be an EVM-family signing key slot id`)}function v(e){return _([`wallet-key`,`evm-family`,m(e.walletId),m(e.signingRootId),m(e.signingRootVersion)].join(`:`))}const y=new TextEncoder;function b(e){let t=0;for(let n of e)t+=n.length;let n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function x(e,t){if(!Number.isSafeInteger(e)||e<0||e>4294967295)throw Error(`${t} must be a non-negative u32`);return Uint8Array.from([e>>>24&255,e>>>16&255,e>>>8&255,e&255])}function S(e,t){if(!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);let n=BigInt(e),r=new Uint8Array(8);for(let e=7;e>=0;--e)r[e]=Number(n&255n),n>>=8n;return r}function C(e,t){return b([x(e.length,`${t}.length`),e])}function w(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);return C(y.encode(e),t)}function T(e,t){try{let t=i(a(e));if(t.length!==32)throw Error(`must decode to 32 bytes`);return t}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is invalid`}`)}}function E(e,t){try{let t=i(e);if(t.length===0||r(t)!==e)throw Error(`must be canonical base64url`);return t}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is invalid`}`)}}export{w as a,v as c,c as d,d as f,l as g,o as h,E as i,_ as l,f as m,C as n,x as o,u as p,T as r,S as s,b as t,s as u};

package/dist/public/sdk/emailOtpEcdsaDerivationIdentity-B8HzTh4T.js

@@ -1 +0,0 @@
-import{A as e,B as t,E as n,F as r,L as i,O as a,P as o,V as s,d as c,g as l,m as u,w as ee}from"./normalize-kUDm5zfS.js";import{c as d,h as te,k as f,u as ne}from"./chains-CiYQT1K4.js";import{i as p,r as m}from"./base64-CsEj-_bC.js";import{_ as re,l as ie,t as h,w as ae,x as oe,y as se}from"./primitives-CAcl7ON7.js";import{i as ce,n as le}from"./activeWalletSession-DiZcKjB_.js";import{d as ue,g as de,h as fe,m as pe,n as me,u as he}from"./capabilityKinds-CKQ4Uqnv.js";import{n as ge,r as _e}from"./canonicalPrimitives-CKPGgpxg.js";import{c as ve}from"./digestEncoding-Dzc1rzWV.js";import{c as g,l as ye}from"./ecdsaChainTarget-C8ZtMZ8l.js";import{n as be}from"./signerDomain-vQmlnsbF.js";import{r as xe}from"./types-D3GM-uHR.js";function Se(e,t){let n=te(e,t);if(!/^x25519:[0-9a-f]{64}$/.test(n))throw Error(`${t} must use x25519:<64 lowercase hex chars> encoding`);return n}function Ce(e,t,n){let r=Object.keys(e).sort(),i=[...t].sort();if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`${n} has invalid fields`)}function _(e,t){if(typeof e!=`string`||e.trim()!==e||!e)throw Error(`${t} is required`);if(!/^[\x20-\x7e]+$/.test(e))throw Error(`${t} must be printable ASCII`);return e}function v(e){let t=f(e,`authorization`);switch(t.kind){case`reusable_wallet_session`:return Ce(t,[`kind`,`wallet_session_id`],`authorization`),{kind:`reusable_wallet_session`,wallet_session_id:_(t.wallet_session_id,`authorization.wallet_session_id`)};case`operation_step_up`:return Ce(t,[`kind`],`authorization`),{kind:`operation_step_up`};default:throw Error(`authorization.kind is not supported`)}}function y(e){let t=f(e,`material_activation`);if(Ce(t,[`kind`,`activation_id`,`capability`,`material_owner`,`key_binding`,`lifecycle_binding`,`signing_worker`],`material_activation`),t.kind!==`mpc_material_activation_ref`)throw Error(`material_activation.kind is not supported`);return{kind:`mpc_material_activation_ref`,activation_id:_(t.activation_id,`material_activation.activation_id`),capability:_(t.capability,`material_activation.capability`),material_owner:_(t.material_owner,`material_activation.material_owner`),key_binding:_(t.key_binding,`material_activation.key_binding`),lifecycle_binding:_(t.lifecycle_binding,`material_activation.lifecycle_binding`),signing_worker:_(t.signing_worker,`material_activation.signing_worker`)}}function we(e){return y({kind:e.kind,activation_id:e.activationId,capability:e.capability,material_owner:e.materialOwner,key_binding:e.keyBinding,lifecycle_binding:e.lifecycleBinding,signing_worker:e.signingWorker})}function Te(e){let t=y(e),n=ee({kind:t.kind,activationId:t.activation_id,capability:t.capability,materialOwner:t.material_owner,keyBinding:t.key_binding,lifecycleBinding:t.lifecycle_binding,signingWorker:t.signing_worker});if(!n.ok)throw Error(`material_activation is invalid: ${n.error.message}`);return n.value}function Ee(e){return new TextEncoder().encode(e)}function b(e,t){let n=Ee(t),r=n.length>>>0;e.push(r>>>24&255,r>>>16&255,r>>>8&255,r&255),e.push(...n)}function De(e){let t=v(e),n=[];switch(b(n,t.kind),t.kind){case`reusable_wallet_session`:b(n,t.wallet_session_id);break;case`operation_step_up`:break}return new Uint8Array(n)}function x(e){let t=y(e),n=[];return b(n,t.kind),b(n,t.activation_id),b(n,t.capability),b(n,t.material_owner),b(n,t.key_binding),b(n,t.lifecycle_binding),b(n,t.signing_worker),new Uint8Array(n)}function S(e,t){return e.kind===t.kind&&e.activation_id===t.activation_id&&e.capability===t.capability&&e.material_owner===t.material_owner&&e.key_binding===t.key_binding&&e.lifecycle_binding===t.lifecycle_binding&&e.signing_worker===t.signing_worker}function Oe(e){let t=e.trim(),n=m(t);if(n.length!==33||p(n)!==t)throw Error(`ECDSA client root public key must be canonical base64url for 33 bytes`);return t}function ke(e,t){let n=String(e??``).trim();if(!n)throw Error(`${t} is required`);return n}function Ae(e){return ke(e,`ecdsaThresholdKeyId`)}function je(e){return ke(e,`signingRootId`)}function Me(e){return ke(e,`signingRootVersion`)}async function Ne(e){let t=ve(e);return`ederivation-relayer-${p(await ne(d({version:`threshold_ecdsa_derivation_relayer_key_id_v1`,schemeId:`threshold-secp256k1-ecdsa-2p-v1`,walletId:e.walletId,evmFamilySigningKeySlotId:t})))}`}function C(e,t){if(typeof e!=`string`||e.trim()!==e||e.length===0)throw Error(`${t} must be a non-empty canonical string`);return e}function w(e,t,n){if(typeof e!=`string`||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be unpadded base64url`);let r;try{r=m(e)}catch{throw Error(`${t} must be valid base64url`)}if(r.length===0||n!==null&&r.length!==n||p(r)!==e)throw Error(`${t} has an invalid canonical byte length`);return e}function Pe(e){return C(e,`ECDSA signer id`)}function Fe(e){return C(e,`ECDSA server generation`)}function Ie(e){return C(e,`ECDSA manifest id`)}function Le(e){if(!Number.isSafeInteger(e)||Number(e)<1)throw Error(`ECDSA manifest revision must be a positive safe integer`);return e}function Re(e){return w(e,`ECDSA ciphertext digest`,32)}function ze(e){return w(e,`ECDSA pending ciphertext digest`,32)}function Be(e){return w(e,`ECDSA activation digest`,32)}function Ve(e){return C(e,`ECDSA lifecycle id`)}function He(e){return C(e,`ECDSA material sealing key id`)}function Ue(e){return w(e,`ECDSA AES-GCM IV`,12)}function We(e){return w(e,`ECDSA ciphertext`,null)}function Ge(e){if(typeof e!=`string`||e.trim()!==e)throw Error(`ECDSA server activation request must be canonical JSON`);let t;try{t=JSON.parse(e)}catch{throw Error(`ECDSA server activation request must be canonical JSON`)}if(typeof t!=`object`||!t||Array.isArray(t)||d(t)!==e)throw Error(`ECDSA server activation request must be a canonical JSON object`);return e}function T(e){return e.factor.kind===`passkey`}function E(e){return e.factor.kind===`email_otp`}function Ke(e,t){return e.walletId!==t.walletId||e.bindingId!==t.bindingId?!1:T(e)?T(t)?e.factor.credentialIdB64u===t.factor.credentialIdB64u&&e.verifier.rpId===t.verifier.rpId:!1:E(e)&&E(t)?e.factor.provider===t.factor.provider&&e.factor.providerUserId===t.factor.providerUserId&&e.verifier.emailHashHex===t.verifier.emailHashHex:!1}function qe(e){if(!e||typeof e!=`object`||Array.isArray(e))return null;let t=e,n=Object.keys(t);if(n.length!==4||!n.every(e=>[`kind`,`walletId`,`authorityDigest`,`walletAuthMethodId`].includes(e))||t.kind!==`wallet_auth_authority_ref`)return null;let a=i(t.walletId),s=r(t.authorityDigest),c=o(t.walletAuthMethodId);return!a.ok||!s.ok||!c.ok?null:{kind:`wallet_auth_authority_ref`,walletId:a.value,authorityDigest:s.value,walletAuthMethodId:c.value}}function Je(e){let t=String(e||``).trim().toLowerCase();return t===`google`||t===`email`?t:null}function D(e,t){if(e.ok)return e.value;throw Error(t)}function Ye(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function Xe(e,t){for(let n of t)if(Ye(e,n))return!0;return!1}function Ze(e){let n=D(i(e.walletId),`Passkey wallet auth authority requires walletId`),r=D(s(e.rpId),`Passkey wallet auth authority requires rpId`),a=D(t(e.credentialIdB64u),`Passkey wallet auth authority requires credentialIdB64u`),c=D(o(`passkey:${r}:${a}`),`Passkey wallet auth authority requires bindingId`);return{walletId:n,factor:{kind:`passkey`,credentialIdB64u:a},verifier:{kind:`webauthn`,rpId:r},bindingId:c}}function Qe(e){let t=Je(e.provider);if(!t)throw Error(`Email OTP factor identity requires provider`);return{kind:`email_otp`,provider:t,providerUserId:D(l(e.providerUserId),`Email OTP factor identity requires providerUserId`)}}function $e(e){let t=D(i(e.walletId),`Email OTP wallet auth authority requires walletId`),n=Qe(e),r=String(e.emailHashHex||``).trim();if(!r)throw Error(`Email OTP wallet auth authority requires emailHashHex`);let a=D(o(`email_otp:${t}:${r}`),`Email OTP wallet auth authority requires bindingId`);return{walletId:t,factor:n,verifier:{kind:`email_otp_wallet_auth_method`,emailHashHex:r},bindingId:a}}function et(e){return e.factor.provider}function tt(e){return e.factor.providerUserId}function nt(e){return e.verifier.emailHashHex}function rt(e){let n=e.factor;if(!n||typeof n!=`object`||Array.isArray(n))return null;let r=e.verifier;if(!r||typeof r!=`object`||Array.isArray(r))return null;let a=n,c=r,l=String(a.kind||``).trim().toLowerCase(),u=String(c.kind||``).trim().toLowerCase();if(l!==`passkey`||u!==`webauthn`)return null;try{if(Xe(e,[`kind`,`rpId`,`credentialIdB64u`,`provider`,`providerUserId`]))return null;let n=i(e.walletId),r=s(c.rpId),l=t(a.credentialIdB64u),u=o(e.bindingId);return!n.ok||!r.ok||!l.ok||!u.ok?null:{walletId:n.value,factor:{kind:`passkey`,credentialIdB64u:l.value},verifier:{kind:`webauthn`,rpId:r.value},bindingId:u.value}}catch{return null}}function it(e){let t=e.factor;if(!t||typeof t!=`object`||Array.isArray(t))return null;let n=e.verifier;if(!n||typeof n!=`object`||Array.isArray(n))return null;let r=t,a=n,s=String(r.kind||``).trim().toLowerCase(),c=String(a.kind||``).trim().toLowerCase();if(s!==`email_otp`||c!==`email_otp_wallet_auth_method`)return null;try{if(Xe(e,[`kind`,`rpId`,`credentialIdB64u`,`provider`,`providerUserId`]))return null;let t=i(e.walletId),n=Je(r.provider),s=l(r.providerUserId),c=String(a.emailHashHex||``).trim(),u=o(e.bindingId);return!t.ok||!n||!s.ok||!c||!u.ok?null:{walletId:t.value,factor:{kind:`email_otp`,provider:n,providerUserId:s.value},verifier:{kind:`email_otp_wallet_auth_method`,emailHashHex:c},bindingId:u.value}}catch{return null}}function at(e){if(!e||typeof e!=`object`||Array.isArray(e))return null;let t=e;return rt(t)||it(t)}function ot(e){return!e||typeof e!=`object`||Array.isArray(e)?null:it(e)}function st(e){return!e||typeof e!=`object`||Array.isArray(e)?null:rt(e)}function ct(e){return`seams:wallet-authority-binding:v1|${d(e.authority)}`}async function lt(e){return D(r(p(await ne(ct(e)))),`Wallet authority binding digest must be non-empty`)}async function ut(e){return{kind:`wallet_auth_authority_ref`,walletId:e.authority.walletId,authorityDigest:await lt({authority:e.authority}),walletAuthMethodId:e.authority.bindingId}}const dt=5*6e4,ft=`/router-ab/ecdsa-derivation/export`,pt=`/router-ab/ecdsa-derivation/presignature-pool/fill/init`,mt=`/router-ab/ecdsa-derivation/presignature-pool/fill/step`,ht=`/router-ab/ecdsa-derivation/session/activate`,gt=`/router-ab/ecdsa-derivation/operation-step-up`,_t=[1,2];function vt(e,t){if(e===`reusable_wallet_session`||e===`verified_step_up`)return e;throw Error(`${t} must be reusable_wallet_session or verified_step_up`)}function yt(e){let t=f(e,`operationStepUpAuthorizationResponse.export_topology`);O(t,`operationStepUpAuthorizationResponse.export_topology`,[`signer_set`,`deriver_recipient_keys`,`router_id`]);let n=Ft(t.signer_set,`operationStepUpAuthorizationResponse.export_topology.signer_set`),r=Rt(t.deriver_recipient_keys,`operationStepUpAuthorizationResponse.export_topology.deriver_recipient_keys`);if(r.deriver_a.key_epoch!==n.signer_a.key_epoch||r.deriver_b.key_epoch!==n.signer_b.key_epoch)throw Error(`operationStepUpAuthorizationResponse.export_topology recipient key epochs do not match signer_set`);return{signer_set:n,deriver_recipient_keys:r,router_id:k(t.router_id,`operationStepUpAuthorizationResponse.export_topology.router_id`)}}function bt(e){let t=f(e,`operationStepUpAuthorizationResponse`),n=Gn(t.operation_kind);if(O(t,`operationStepUpAuthorizationResponse`,[`ok`,`kind`,`authorization`,`expires_at_ms`,`operation_kind`,...n===`evm.export_key`?[`export_topology`]:[]]),t.ok!==!0||t.kind!==`verified_step_up`)throw Error(`operationStepUpAuthorizationResponse is invalid`);let r=f(t.authorization,`operationStepUpAuthorizationResponse.authorization`);if(O(r,`operationStepUpAuthorizationResponse.authorization`,[`kind`,`evidence_set_digest`,`unseal`]),r.kind!==`operation_step_up`)throw Error(`operationStepUpAuthorizationResponse.authorization.kind is invalid`);let i=j(t.expires_at_ms,`operationStepUpAuthorizationResponse.expires_at_ms`);if(i<=Date.now())throw Error(`operationStepUpAuthorizationResponse.expires_at_ms is expired`);let a=f(r.unseal,`operationStepUpAuthorizationResponse.authorization.unseal`),o=k(a.kind,`operationStepUpAuthorizationResponse.authorization.unseal.kind`),s;switch(o){case`not_requested`:O(a,`operationStepUpAuthorizationResponse.authorization.unseal`,[`kind`]),s={kind:`not_requested`};break;case`email_otp_grant`:O(a,`operationStepUpAuthorizationResponse.authorization.unseal`,[`kind`,`grant`,`challenge_id`]),s={kind:`email_otp_grant`,grant:k(a.grant,`operationStepUpAuthorizationResponse.authorization.unseal.grant`),challenge_id:k(a.challenge_id,`operationStepUpAuthorizationResponse.authorization.unseal.challenge_id`)};break;default:throw Error(`operationStepUpAuthorizationResponse.authorization.unseal.kind is invalid`)}let c={ok:!0,kind:`verified_step_up`,authorization:{kind:`operation_step_up`,evidence_set_digest:_e(r.evidence_set_digest),unseal:s},expires_at_ms:i};return n===`evm.sign_transaction`?{...c,operation_kind:`evm.sign_transaction`}:{...c,operation_kind:`evm.export_key`,export_topology:yt(t.export_topology)}}async function xt(e){return p(await ne(d({domain:`router-ab-ecdsa-operation-step-up/challenge/v1`,operation:Wn(e)})))}function O(e,t,n){let r=new Set(n);for(let n of Object.keys(e))if(!r.has(n))throw Error(`${t}.${n} is not a supported field`)}function k(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} is required`);if(!/^[\x20-\x7e]+$/.test(n))throw Error(`${t} must be printable ASCII`);return n}function A(e,t){let n=a(k(e,t));if(!n.ok)throw Error(`${t} is invalid`);return n.value}function St(t,n){let r=e(k(t,n));if(!r.ok)throw Error(`${n} is invalid`);return r.value}function Ct(e,t){let n=he(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function wt(e,t){let n=pe(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function Tt(e,t){let n=fe(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function Et(e,t){let n=ue(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function j(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive safe integer`);return e}function M(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive safe-integer counter`);return e}function Dt(e,t){if(typeof e!=`number`||!Number.isFinite(e))throw Error(`${t} must be a finite number`);let n=Math.floor(e);if(n!==e||n<0||n>4294967295)throw Error(`${t} must be a u32 integer`);return n}function Ot(e,t){if(typeof e!=`number`||!Number.isFinite(e))throw Error(`${t} must be a finite number`);let n=Math.floor(e);if(n!==e||n<0||n>255)throw Error(`${t} must be a byte`);return n}function N(e,t,n){let r=k(e,t);if(!/^[A-Za-z0-9_-]+$/.test(r))throw Error(`${t} must be unpadded base64url`);let i;try{i=m(r)}catch{throw Error(`${t} must be valid base64url`)}if(i.length!==n)throw Error(`${t} must decode to ${n} bytes`);return r}function P(e,t){let n=N(e,t,33),r=m(n);if(r[0]!==2&&r[0]!==3)throw Error(`${t} must be a compressed secp256k1 public key`);return n}function kt(e,t){let n=k(e,t);if(!/^[A-Za-z0-9_-]+$/.test(n))throw Error(`${t} must be unpadded base64url`);let r;try{r=m(n)}catch{throw Error(`${t} must be valid base64url`)}if(r.length===0)throw Error(`${t} must decode to non-empty bytes`);return n}function At(e,t){let n=k(e,t);if(!/^x25519:[0-9a-f]{64}$/.test(n))throw Error(`${t} must use x25519:<64 lowercase hex chars> encoding`);return n}function F(e,t,n){if(!(e instanceof Uint8Array))throw Error(`${t} must be a Uint8Array`);if(e.length!==n)throw Error(`${t} must contain ${n} bytes`);return e}function jt(e,t){let n=k(e,t);if(n!==`ecdsa_secp256k1_recoverable_v1`)throw Error(`${t} must be ecdsa_secp256k1_recoverable_v1`);return n}function I(e,t){let n=f(e,t);if(O(n,t,[`bytes`]),!Array.isArray(n.bytes))throw Error(`${t}.bytes must be an array`);if(n.bytes.length!==32)throw Error(`${t}.bytes must contain 32 bytes`);return{bytes:n.bytes.map((e,n)=>Ot(e,`${t}.bytes[${n}]`))}}function L(e){let t=f(e,`scope.context`);O(t,`scope.context`,[`application_binding_digest_b64u`]);let n=m(k(t.application_binding_digest_b64u,`scope.context.application_binding_digest_b64u`));if(n.length!==32)throw Error(`scope.context.application_binding_digest_b64u must decode to 32 bytes`);return{application_binding_digest_b64u:p(n)}}function R(e){let t=f(e,`scope.public_identity`);return O(t,`scope.public_identity`,[`context_binding_b64u`,`derivation_client_share_public_key33_b64u`,`server_public_key33_b64u`,`threshold_public_key33_b64u`,`ethereum_address20_b64u`,`client_share_retry_counter`,`server_share_retry_counter`]),{context_binding_b64u:N(t.context_binding_b64u,`scope.public_identity.context_binding_b64u`,32),derivation_client_share_public_key33_b64u:P(t.derivation_client_share_public_key33_b64u,`scope.public_identity.derivation_client_share_public_key33_b64u`),server_public_key33_b64u:P(t.server_public_key33_b64u,`scope.public_identity.server_public_key33_b64u`),threshold_public_key33_b64u:P(t.threshold_public_key33_b64u,`scope.public_identity.threshold_public_key33_b64u`),ethereum_address20_b64u:N(t.ethereum_address20_b64u,`scope.public_identity.ethereum_address20_b64u`,20),client_share_retry_counter:Dt(t.client_share_retry_counter,`scope.public_identity.client_share_retry_counter`),server_share_retry_counter:Dt(t.server_share_retry_counter,`scope.public_identity.server_share_retry_counter`)}}function Mt(e){return Nt(e,`scope.signing_worker`)}function Nt(e,t){let n=f(e,t);return O(n,t,[`server_id`,`key_epoch`,`recipient_encryption_key`]),{server_id:k(n.server_id,`${t}.server_id`),key_epoch:k(n.key_epoch,`${t}.key_epoch`),recipient_encryption_key:Se(n.recipient_encryption_key,`${t}.recipient_encryption_key`)}}function Pt(e,t,n){let r=f(e,t);if(O(r,t,[`role`,`signer_id`,`key_epoch`]),k(r.role,`${t}.role`)!==n)throw Error(`${t}.role must be ${n}`);return{role:n,signer_id:k(r.signer_id,`${t}.signer_id`),key_epoch:k(r.key_epoch,`${t}.key_epoch`)}}function Ft(e,t){let n=f(e,t);O(n,t,[`signer_set_id`,`policy`,`signer_a`,`signer_b`,`selected_server`]);let r=k(n.policy,`${t}.policy`);if(r!==`all_2`)throw Error(`${t}.policy must be all_2`);let i=Pt(n.signer_a,`${t}.signer_a`,`signer_a`),a=Pt(n.signer_b,`${t}.signer_b`,`signer_b`);if(i.signer_id===a.signer_id)throw Error(`${t} requires distinct signer ids`);return{signer_set_id:k(n.signer_set_id,`${t}.signer_set_id`),policy:r,signer_a:i,signer_b:a,selected_server:Nt(n.selected_server,`${t}.selected_server`)}}function It(e){let t=`registration.lifecycle`,n=f(e,t);if(O(n,t,[`lifecycle_id`,`work_kind`,`primitive_request_kind`,`root_share_epoch`,`account_id`,`session_id`,`signer_set_id`,`selected_server_id`]),n.work_kind!==`registration_prepare`)throw Error(`${t}.work_kind must be registration_prepare`);if(n.primitive_request_kind!==`registration`)throw Error(`${t}.primitive_request_kind must be registration`);return{lifecycle_id:k(n.lifecycle_id,`${t}.lifecycle_id`),work_kind:`registration_prepare`,primitive_request_kind:`registration`,root_share_epoch:A(n.root_share_epoch,`${t}.root_share_epoch`),account_id:k(n.account_id,`${t}.account_id`),session_id:k(n.session_id,`${t}.session_id`),signer_set_id:k(n.signer_set_id,`${t}.signer_set_id`),selected_server_id:k(n.selected_server_id,`${t}.selected_server_id`)}}function Lt(e,t,n){let r=f(e,t);if(O(r,t,[`role`,`key_epoch`,`public_key`]),r.role!==n)throw Error(`${t}.role must be ${n}`);return{role:n,key_epoch:k(r.key_epoch,`${t}.key_epoch`),public_key:Se(r.public_key,`${t}.public_key`)}}function Rt(e,t=`registration.deriver_recipient_keys`){let n=f(e,t);return O(n,t,[`deriver_a`,`deriver_b`]),{deriver_a:Lt(n.deriver_a,`${t}.deriver_a`,`signer_a`),deriver_b:Lt(n.deriver_b,`${t}.deriver_b`,`signer_b`)}}function zt(e){let t=`registration`,n=f(e,t);if(O(n,t,[`registration_purpose`,`context`,`lifecycle`,`signer_set`,`router_id`,`client_id`,`replay_nonce`,`expires_at_ms`,`deriver_recipient_keys`]),n.registration_purpose!==`wallet_registration`&&n.registration_purpose!==`wallet_add_signer`)throw Error(`${t}.registration_purpose is invalid`);let r=It(n.lifecycle),i=Ft(n.signer_set,`${t}.signer_set`);if(r.signer_set_id!==i.signer_set_id)throw Error(`${t}.lifecycle signer set does not match signer_set`);if(r.selected_server_id!==i.selected_server.server_id)throw Error(`${t}.lifecycle selected server does not match signer_set`);let a=Rt(n.deriver_recipient_keys);if(a.deriver_a.key_epoch!==i.signer_a.key_epoch)throw Error(`${t}.deriver_a recipient key epoch does not match signer_set`);if(a.deriver_b.key_epoch!==i.signer_b.key_epoch)throw Error(`${t}.deriver_b recipient key epoch does not match signer_set`);return{registration_purpose:n.registration_purpose,context:L(n.context),lifecycle:r,signer_set:i,router_id:k(n.router_id,`${t}.router_id`),client_id:k(n.client_id,`${t}.client_id`),replay_nonce:k(n.replay_nonce,`${t}.replay_nonce`),expires_at_ms:j(n.expires_at_ms,`${t}.expires_at_ms`),deriver_recipient_keys:a}}function Bt(e,t){let n=f(e,t);if(O(n,t,[`kind`,`transcriptDigestB64u`,`payloadB64u`]),n.kind!==`recipient_proof_bundle`)throw Error(`${t}.kind must be recipient_proof_bundle`);return{kind:`recipient_proof_bundle`,transcriptDigestB64u:N(n.transcriptDigestB64u,`${t}.transcriptDigestB64u`,32),payloadB64u:kt(n.payloadB64u,`${t}.payloadB64u`)}}function Vt(e){let t=`registrationForwarded`,n=f(e,t);if(O(n,t,[`result`,`response`]),n.result!==`forwarded`)throw Error(`${t}.result must be forwarded`);return{result:`forwarded`,response:qt(n.response,`${t}.response`)}}function Ht(e){return Ut(e,Wt)}function Ut(e,t){let n=`explicitExportForwarded`,r=f(e,n);if(O(r,n,[`result`,`response`,`signing_worker_export`]),r.result!==`forwarded`)throw Error(`${n}.result must be forwarded`);return{result:`forwarded`,response:qt(r.response,`${n}.response`),signing_worker_export:t(r.signing_worker_export)}}function Wt(e){return Kt(e,y)}function Gt(e,t,n){let r=f(e,n);O(r,n,[`wallet_id`,`key_handle`,`ecdsa_threshold_key_id`,`signing_root_id`,`signing_root_version`,`activation_epoch`,`signing_worker_id`,`context_binding_b64u`,`threshold_public_key33_b64u`,`export_request_digest_b64u`,`export_authorization_digest_b64u`,`export_nonce`,`authorization_kind`,`authorization_id`,`material_activation`,`lifecycle_id`,`recipient_identity`,`recipient_public_key`,`expires_at_ms`]);let i=t(r.material_activation);if(i.material_owner!==r.wallet_id||i.signing_worker!==r.signing_worker_id)throw Error(`${n}.material_activation is not bound to wallet and worker`);return{wallet_id:k(r.wallet_id,`${n}.wallet_id`),key_handle:k(r.key_handle,`${n}.key_handle`),ecdsa_threshold_key_id:k(r.ecdsa_threshold_key_id,`${n}.ecdsa_threshold_key_id`),signing_root_id:k(r.signing_root_id,`${n}.signing_root_id`),signing_root_version:k(r.signing_root_version,`${n}.signing_root_version`),activation_epoch:A(r.activation_epoch,`${n}.activation_epoch`),signing_worker_id:k(r.signing_worker_id,`${n}.signing_worker_id`),context_binding_b64u:N(r.context_binding_b64u,`${n}.context_binding_b64u`,32),threshold_public_key33_b64u:P(r.threshold_public_key33_b64u,`${n}.threshold_public_key33_b64u`),export_request_digest_b64u:N(r.export_request_digest_b64u,`${n}.export_request_digest_b64u`,32),export_authorization_digest_b64u:N(r.export_authorization_digest_b64u,`${n}.export_authorization_digest_b64u`,32),export_nonce:k(r.export_nonce,`${n}.export_nonce`),authorization_kind:vt(r.authorization_kind,`${n}.authorization_kind`),authorization_id:k(r.authorization_id,`${n}.authorization_id`),material_activation:i,lifecycle_id:k(r.lifecycle_id,`${n}.lifecycle_id`),recipient_identity:k(r.recipient_identity,`${n}.recipient_identity`),recipient_public_key:At(r.recipient_public_key,`${n}.recipient_public_key`),expires_at_ms:j(r.expires_at_ms,`${n}.expires_at_ms`)}}function Kt(e,t){let n=`signingWorkerExportShare`,r=f(e,n);if(O(r,n,[`version`,`algorithm`,`binding`,`ciphertext_and_tag`]),r.version!==`router-ab-ecdsa-derivation/signing-worker-export-share-envelope/v1`)throw Error(`${n}.version is invalid`);if(r.algorithm!==`hpke_x25519_hkdf_sha256_aes256gcm_v1`)throw Error(`${n}.algorithm is invalid`);if(!Array.isArray(r.ciphertext_and_tag)||r.ciphertext_and_tag.length<=48)throw Error(`${n}.ciphertext_and_tag is invalid`);return{version:`router-ab-ecdsa-derivation/signing-worker-export-share-envelope/v1`,algorithm:`hpke_x25519_hkdf_sha256_aes256gcm_v1`,binding:Gt(r.binding,t,`${n}.binding`),ciphertext_and_tag:r.ciphertext_and_tag.map((e,t)=>Ot(e,`${n}.ciphertext_and_tag[${t}]`))}}function qt(e,t){let n=f(e,t);O(n,t,[`bundles`]);let r=`${t}.bundles`,i=f(n.bundles,r);return O(i,r,[`signerA`,`signerB`]),{bundles:{signerA:Bt(i.signerA,`${r}.signerA`),signerB:Bt(i.signerB,`${r}.signerB`)}}}function Jt(e){let t=`registrationActivation.publicFacts`,n=f(e,t);if(O(n,t,[`registrationRequestDigestB64u`,`proofTranscriptDigestB64u`,`contextBinding32B64u`,`derivationClientSharePublicKey33B64u`,`clientShareRetryCounter`,`participantId`]),n.participantId!==1)throw Error(`${t}.participantId must be 1`);return{registrationRequestDigestB64u:N(n.registrationRequestDigestB64u,`${t}.registrationRequestDigestB64u`,32),proofTranscriptDigestB64u:N(n.proofTranscriptDigestB64u,`${t}.proofTranscriptDigestB64u`,32),contextBinding32B64u:N(n.contextBinding32B64u,`${t}.contextBinding32B64u`,32),derivationClientSharePublicKey33B64u:P(n.derivationClientSharePublicKey33B64u,`${t}.derivationClientSharePublicKey33B64u`),clientShareRetryCounter:Dt(n.clientShareRetryCounter,`${t}.clientShareRetryCounter`),participantId:1}}function Yt(e){let t=`registrationActivationReceipt`,n=f(e,t);O(n,t,[`activation_correlation_id`,`activation_request_digest`,`server_generation`,`ecdsa_activation`,`lifecycle_id`,`transcript_digest`]);let r=`${t}.ecdsa_activation`,i=f(n.ecdsa_activation,r);O(i,r,[`context`,`public_identity`,`signing_worker`,`material_activation`,`activation_epoch`,`activation_digest_b64u`,`activated_at_ms`]);let a=Nt(i.signing_worker,`${r}.signing_worker`),o=y(i.material_activation);if(o.signing_worker!==a.server_id)throw Error(`${r}.material_activation.signing_worker does not match signing_worker`);let s=N(i.activation_digest_b64u,`${r}.activation_digest_b64u`,32),c=I(n.transcript_digest,`${t}.transcript_digest`);return{activation_correlation_id:ge(n.activation_correlation_id),activation_request_digest:I(n.activation_request_digest,`${t}.activation_request_digest`),server_generation:Fe(n.server_generation),ecdsa_activation:{context:L(i.context),public_identity:R(i.public_identity),signing_worker:a,material_activation:o,activation_epoch:A(i.activation_epoch,`${r}.activation_epoch`),activation_digest_b64u:s,activated_at_ms:j(i.activated_at_ms,`${r}.activated_at_ms`)},lifecycle_id:k(n.lifecycle_id,`${t}.lifecycle_id`),transcript_digest:c}}function Xt(e){return Yt(e)}function z(e,t){return e.server_id===t.server_id&&e.key_epoch===t.key_epoch&&e.recipient_encryption_key===t.recipient_encryption_key}function Zt(e,t){return e.registrationRequestDigestB64u===t.registrationRequestDigestB64u&&e.proofTranscriptDigestB64u===t.proofTranscriptDigestB64u&&e.contextBinding32B64u===t.contextBinding32B64u&&e.derivationClientSharePublicKey33B64u===t.derivationClientSharePublicKey33B64u&&e.clientShareRetryCounter===t.clientShareRetryCounter&&e.participantId===t.participantId}function Qt(e,t){return e.signer_set_id===t.signer_set_id&&e.policy===t.policy&&e.signer_a.role===t.signer_a.role&&e.signer_a.signer_id===t.signer_a.signer_id&&e.signer_a.key_epoch===t.signer_a.key_epoch&&e.signer_b.role===t.signer_b.role&&e.signer_b.signer_id===t.signer_b.signer_id&&e.signer_b.key_epoch===t.signer_b.key_epoch&&z(e.selected_server,t.selected_server)}function B(e){let t=`ecdsaPublicCapability`,n=f(e,t);if(O(n,t,[`kind`,`context`,`public_identity`,`material_activation`,`signer_set`,`deriver_recipient_keys`,`router_id`,`client_id`,`activation_epoch`,`registration_request_digest_b64u`,`proof_transcript_digest_b64u`]),n.kind!==`router_ab_ecdsa_derivation_public_capability_v1`)throw Error(`${t}.kind is invalid`);let r=Ft(n.signer_set,`${t}.signer_set`),i=Rt(n.deriver_recipient_keys,`${t}.deriver_recipient_keys`);if(i.deriver_a.key_epoch!==r.signer_a.key_epoch||i.deriver_b.key_epoch!==r.signer_b.key_epoch)throw Error(`${t} Deriver recipient key epochs do not match signer_set`);return{kind:`router_ab_ecdsa_derivation_public_capability_v1`,context:L(n.context),public_identity:R(n.public_identity),material_activation:y(n.material_activation),signer_set:r,deriver_recipient_keys:i,router_id:k(n.router_id,`${t}.router_id`),client_id:k(n.client_id,`${t}.client_id`),activation_epoch:A(n.activation_epoch,`${t}.activation_epoch`),registration_request_digest_b64u:N(n.registration_request_digest_b64u,`${t}.registration_request_digest_b64u`,32),proof_transcript_digest_b64u:N(n.proof_transcript_digest_b64u,`${t}.proof_transcript_digest_b64u`,32)}}function $t(e){let t=`postRegistrationSessionActivation.session_policy`,n=f(e,t);return O(n,t,[`threshold_session_id`,`wallet_session_mint_id`,`ttl_ms`,`remaining_uses`,`runtime_policy_scope`]),{threshold_session_id:St(n.threshold_session_id,`${t}.threshold_session_id`),wallet_session_mint_id:tn(n.wallet_session_mint_id,`${t}.wallet_session_mint_id`),ttl_ms:M(n.ttl_ms,`${t}.ttl_ms`),remaining_uses:M(n.remaining_uses,`${t}.remaining_uses`),runtime_policy_scope:se(n.runtime_policy_scope)}}function en(e){let t=`postRegistrationSessionActivationPolicy`,n=f(e,t);if(O(n,t,[`kind`,`key_handle`,`session_policy`]),n.kind!==`router_ab_ecdsa_post_registration_session_activation_policy_v1`)throw Error(`${t}.kind is invalid`);return{kind:`router_ab_ecdsa_post_registration_session_activation_policy_v1`,key_handle:k(n.key_handle,`${t}.key_handle`),session_policy:$t(n.session_policy)}}function tn(e,t){let n=de(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function V(e,t){return e.context_binding_b64u===t.context_binding_b64u&&e.derivation_client_share_public_key33_b64u===t.derivation_client_share_public_key33_b64u&&e.server_public_key33_b64u===t.server_public_key33_b64u&&e.threshold_public_key33_b64u===t.threshold_public_key33_b64u&&e.ethereum_address20_b64u===t.ethereum_address20_b64u&&e.client_share_retry_counter===t.client_share_retry_counter&&e.server_share_retry_counter===t.server_share_retry_counter}function nn(e,t){for(let n of e.capabilitySubjects)if(!(n.kind!==`sign`||n.keyFamily!==`ecdsa_secp256k1`))return S(t.material_activation,we(n.materialActivation));return!1}function rn(e){let t=`postRegistrationSessionActivation`,n=f(e,t);if(O(n,t,[`kind`,`public_capability`,`session_policy`]),n.kind!==`router_ab_ecdsa_post_registration_session_activation_v1`)throw Error(`${t}.kind is invalid`);return{kind:`router_ab_ecdsa_post_registration_session_activation_v1`,public_capability:B(n.public_capability),session_policy:$t(n.session_policy)}}function an(e){let t=`postRegistrationSessionActivated`,n=f(e,t);if(O(n,t,[`kind`,`public_capability`,`session`,`normal_signing`]),n.kind!==`router_ab_ecdsa_post_registration_session_activated_v1`)throw Error(`${t}.kind is invalid`);let r=B(n.public_capability),i=f(n.session,`${t}.session`);O(i,`${t}.session`,[`authorization_session_id`,`authorization_id`,`threshold_session_id`,`wallet_session_id`,`quota_id`,`expires_at_ms`,`remaining_uses`,`wallet_session`,`operation_credential`]);let a=Ln(n.normal_signing),o=wt(i.authorization_id,`${t}.session.authorization_id`),s=Tt(i.wallet_session_id,`${t}.session.wallet_session_id`),c=j(i.expires_at_ms,`${t}.session.expires_at_ms`),l=le(i.wallet_session),u=ce(i.operation_credential);if(!V(r.public_identity,a.scope.public_identity)||r.context.application_binding_digest_b64u!==a.scope.context.application_binding_digest_b64u||a.scope.activation_epoch!==r.activation_epoch||!z(a.scope.signing_worker,r.signer_set.selected_server)||l.authorizationId!==o||l.walletId!==r.client_id||l.expiresAtMs!==c||!nn(l,r)||u.walletSessionId!==s)throw Error(`${t} exact Wallet Session does not match the activated capability`);return{kind:`router_ab_ecdsa_post_registration_session_activated_v1`,public_capability:r,session:{authorization_session_id:Ct(i.authorization_session_id,`${t}.session.authorization_session_id`),authorization_id:o,threshold_session_id:St(i.threshold_session_id,`${t}.session.threshold_session_id`),wallet_session_id:s,quota_id:Et(i.quota_id,`${t}.session.quota_id`),expires_at_ms:c,remaining_uses:M(i.remaining_uses,`${t}.session.remaining_uses`),wallet_session:l,operation_credential:u},normal_signing:a}}function on(e){let t=`credentialFreeSessionActivated`,n=f(e,t);if(O(n,t,[`kind`,`public_capability`,`session`,`normal_signing`]),n.kind!==`router_ab_ecdsa_credential_free_session_activated_v1`)throw Error(`${t}.kind is invalid`);let r=B(n.public_capability),i=f(n.session,`${t}.session`);O(i,`${t}.session`,[`authorization_session_id`,`authorization_id`,`threshold_session_id`,`wallet_session_id`,`quota_id`,`expires_at_ms`,`remaining_uses`]);let a=Ln(n.normal_signing);if(!V(r.public_identity,a.scope.public_identity)||r.context.application_binding_digest_b64u!==a.scope.context.application_binding_digest_b64u||a.scope.activation_epoch!==r.activation_epoch||!z(a.scope.signing_worker,r.signer_set.selected_server))throw Error(`${t} normal-signing state does not match public capability`);return{kind:`router_ab_ecdsa_credential_free_session_activated_v1`,public_capability:r,session:{authorization_session_id:Ct(i.authorization_session_id,`${t}.session.authorization_session_id`),authorization_id:wt(i.authorization_id,`${t}.session.authorization_id`),threshold_session_id:St(i.threshold_session_id,`${t}.session.threshold_session_id`),wallet_session_id:Tt(i.wallet_session_id,`${t}.session.wallet_session_id`),quota_id:Et(i.quota_id,`${t}.session.quota_id`),expires_at_ms:j(i.expires_at_ms,`${t}.session.expires_at_ms`),remaining_uses:M(i.remaining_uses,`${t}.session.remaining_uses`)},normal_signing:a}}function sn(e,t=`signing_digest_b64u`){return{bytes:Array.from(m(N(e,t,32)))}}function H(e,t){return e.bytes.length===32&&t.bytes.length===32&&e.bytes.every((e,n)=>e===t.bytes[n])}function cn(e,t){return e.bytes.length===t.bytes.length&&e.bytes.every((e,n)=>e===t.bytes[n])}function ln(e,t){return e.deriver_a.role===t.deriver_a.role&&e.deriver_a.key_epoch===t.deriver_a.key_epoch&&e.deriver_a.public_key===t.deriver_a.public_key&&e.deriver_b.role===t.deriver_b.role&&e.deriver_b.key_epoch===t.deriver_b.key_epoch&&e.deriver_b.public_key===t.deriver_b.public_key}function un(e,t){let n=e.ecdsa_activation,r=t.ecdsa_activation;return e.activation_correlation_id===t.activation_correlation_id&&cn(e.activation_request_digest,t.activation_request_digest)&&e.server_generation===t.server_generation&&e.lifecycle_id===t.lifecycle_id&&cn(e.transcript_digest,t.transcript_digest)&&n.context.application_binding_digest_b64u===r.context.application_binding_digest_b64u&&V(n.public_identity,r.public_identity)&&z(n.signing_worker,r.signing_worker)&&S(n.material_activation,r.material_activation)&&n.activation_epoch===r.activation_epoch&&n.activation_digest_b64u===r.activation_digest_b64u&&n.activated_at_ms===r.activated_at_ms}function dn(e,t){let n=e.scope,r=t.scope;return e.kind===t.kind&&n.wallet_id===r.wallet_id&&n.ecdsa_threshold_key_id===r.ecdsa_threshold_key_id&&n.signing_root_id===r.signing_root_id&&n.signing_root_version===r.signing_root_version&&n.context.application_binding_digest_b64u===r.context.application_binding_digest_b64u&&V(n.public_identity,r.public_identity)&&S(n.material_activation,r.material_activation)&&z(n.signing_worker,r.signing_worker)&&n.activation_epoch===r.activation_epoch}function fn(e,t){return e.kind===t.kind&&e.context.application_binding_digest_b64u===t.context.application_binding_digest_b64u&&V(e.public_identity,t.public_identity)&&S(e.material_activation,t.material_activation)&&Qt(e.signer_set,t.signer_set)&&ln(e.deriver_recipient_keys,t.deriver_recipient_keys)&&e.router_id===t.router_id&&e.client_id===t.client_id&&e.activation_epoch===t.activation_epoch&&e.registration_request_digest_b64u===t.registration_request_digest_b64u&&e.proof_transcript_digest_b64u===t.proof_transcript_digest_b64u}function U(e){return new TextEncoder().encode(k(e,`canonical string`))}function pn(e){let t=e.reduce((e,t)=>e+t.length,0),n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function W(e,t){for(let n of t)e.push(n)}function mn(e,t){W(e,m(t.lane_digest_b64u)),W(e,m(t.intent_digest_b64u)),W(e,m(t.display_digest_b64u))}function hn(e,t){if(!Number.isInteger(t)||t<0||t>65535)throw Error(`canonical u16 must be an integer between 0 and 65535`);e.push(t>>>8&255,t&255)}function gn(e,t){if(!Number.isInteger(t)||t<0||t>4294967295)throw Error(`canonical u32 must be an integer between 0 and 4294967295`);e.push(t>>>24&255,t>>>16&255,t>>>8&255,t&255)}function _n(e,t){if(!Number.isSafeInteger(t)||t<0)throw Error(`canonical u64 must be a non-negative safe integer`);let n=BigInt(t);for(let t=56;t>=0;t-=8)e.push(Number(n>>BigInt(t)&255n))}function G(e,t){gn(e,t.length),W(e,t)}function vn(e,t){let n=U(t);hn(e,n.length),W(e,n)}function yn(e,t){G(e,U(t.server_id)),G(e,U(t.key_epoch)),G(e,U(t.recipient_encryption_key))}async function bn(e){let t=globalThis.crypto?.subtle;if(!t)throw Error(`crypto.subtle is required for Router A/B ECDSA derivation request digest binding`);let n=new ArrayBuffer(e.byteLength);return new Uint8Array(n).set(e),new Uint8Array(await t.digest(`SHA-256`,n))}async function xn(e){let t=F(e,`clientRerandomizationContribution32`,32);return await bn(pn([U(`router-ab-ecdsa-derivation/client-rerandomization-commitment/v1`),t]))}function Sn(e){let t=L(e),n=[];W(n,U(`router-ab-ecdsa-derivation/context/v1`)),vn(n,`router-ab-ecdsa-derivation-v1`),vn(n,`secp256k1`),W(n,m(t.application_binding_digest_b64u)),n.push(_t.length);for(let e of _t)hn(n,e);return new Uint8Array(n)}function Cn(e){let t=[];return W(t,U(`router-ab-ecdsa-derivation/role-local/context-binding/v1`)),t.push(1),t.push(1),hn(t,e.length),W(t,e),new Uint8Array(t)}async function wn(e){return An(Cn(Sn(e)))}function Tn(e){let t=R(e),n=[];return G(n,U(`router-ab-ecdsa-derivation/public-identity/v1`)),G(n,U(t.context_binding_b64u)),G(n,U(t.derivation_client_share_public_key33_b64u)),G(n,U(t.server_public_key33_b64u)),G(n,U(t.threshold_public_key33_b64u)),G(n,U(t.ethereum_address20_b64u)),gn(n,t.client_share_retry_counter),gn(n,t.server_share_retry_counter),new Uint8Array(n)}function En(e){let t=K(e),n=[];return G(n,U(`router-ab-ecdsa-derivation/normal-signing-scope/v1`)),G(n,U(t.wallet_id)),G(n,U(t.ecdsa_threshold_key_id)),G(n,U(t.signing_root_id)),G(n,U(t.signing_root_version)),G(n,Sn(t.context)),G(n,Tn(t.public_identity)),n.push(...x(t.material_activation)),yn(n,t.signing_worker),G(n,U(t.activation_epoch)),new Uint8Array(n)}function Dn(e){return En(e)}function On(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function kn(e,t){try{return On(Dn(e),Dn(t))}catch{return!1}}async function An(e){return{bytes:Array.from(await bn(e))}}async function jn(e){let t=K(e),n=await wn(t.context);if(!H(sn(t.public_identity.context_binding_b64u,`scope.public_identity.context_binding_b64u`),n))throw Error(`scope.public_identity.context_binding_b64u does not match scope.context`);return t}function Mn(e){let t=q(e),n=[];return G(n,U(`router-ab-ecdsa-derivation/normal-signing-request/v1`)),G(n,En(t.scope)),G(n,U(t.request_id)),G(n,U(t.operation_id)),mn(n,t.operation_digests),n.push(...De(t.authorization)),n.push(...x(t.material_activation)),G(n,U(t.client_presignature_id)),_n(n,t.expires_at_ms),W(n,m(t.signing_digest_b64u)),G(n,m(t.client_rerandomization_commitment32_b64u)),new Uint8Array(n)}async function Nn(e){let t=q(e);return await jn(t.scope),An(Mn(t))}function Pn(e){let t=J(e),n=[];return G(n,U(`router-ab-ecdsa-derivation/normal-signing-finalize-request/v1`)),G(n,En(t.scope)),G(n,U(t.request_id)),G(n,U(t.operation_id)),mn(n,t.operation_digests),n.push(...De(t.authorization)),n.push(...x(t.material_activation)),_n(n,t.expires_at_ms),W(n,m(t.signing_digest_b64u)),G(n,U(t.server_presignature_id)),G(n,m(t.client_signature_share32_b64u)),G(n,m(t.client_rerandomization_contribution32_b64u)),new Uint8Array(n)}async function Fn(e){let t=J(e);return await jn(t.scope),An(Pn(t))}function K(e){let t=f(e,`scope`);return O(t,`scope`,[`wallet_id`,`ecdsa_threshold_key_id`,`signing_root_id`,`signing_root_version`,`context`,`public_identity`,`material_activation`,`signing_worker`,`activation_epoch`]),{wallet_id:k(t.wallet_id,`scope.wallet_id`),ecdsa_threshold_key_id:k(t.ecdsa_threshold_key_id,`scope.ecdsa_threshold_key_id`),signing_root_id:k(t.signing_root_id,`scope.signing_root_id`),signing_root_version:k(t.signing_root_version,`scope.signing_root_version`),context:L(t.context),public_identity:R(t.public_identity),material_activation:y(t.material_activation),signing_worker:Mt(t.signing_worker),activation_epoch:A(t.activation_epoch,`scope.activation_epoch`)}}function In(e){if(e==null)return null;let t=f(e,`routerAbEcdsaDerivationNormalSigning`);if(O(t,`routerAbEcdsaDerivationNormalSigning`,[`kind`,`scope`]),k(t.kind,`routerAbEcdsaDerivationNormalSigning.kind`)!==`router_ab_ecdsa_derivation_normal_signing_v1`)throw Error(`routerAbEcdsaDerivationNormalSigning.kind is not supported`);return{kind:`router_ab_ecdsa_derivation_normal_signing_v1`,scope:K(t.scope)}}function Ln(e){let t=In(e);if(!t)throw Error(`Router A/B ECDSA derivation normal-signing state is required`);return t}function Rn(e){let t=u([k(e.ecdsaThresholdKeyId,`ecdsaThresholdKeyId`),k(e.signingRootId,`signingRootId`),k(e.signingRootVersion,`signingRootVersion`),A(e.activationEpoch,`activationEpoch`)].join(`:`));if(!t.ok)throw Error(`activeStateId ${t.error.message}`);return t.value}function zn(e){return Rn({ecdsaThresholdKeyId:e.scope.ecdsa_threshold_key_id,signingRootId:e.scope.signing_root_id,signingRootVersion:e.scope.signing_root_version,activationEpoch:e.scope.activation_epoch})}function Bn(e,t){let n=f(e,t);return O(n,t,[`lane_digest_b64u`,`intent_digest_b64u`,`display_digest_b64u`]),{lane_digest_b64u:N(n.lane_digest_b64u,`${t}.lane_digest_b64u`,32),intent_digest_b64u:N(n.intent_digest_b64u,`${t}.intent_digest_b64u`,32),display_digest_b64u:N(n.display_digest_b64u,`${t}.display_digest_b64u`,32)}}function Vn(e){return q({scope:e.scope,request_id:e.requestId,operation_id:e.operationId,operation_digests:e.operationDigests,authorization:e.authorization,material_activation:e.materialActivation,client_presignature_id:e.clientPresignatureId,expires_at_ms:e.expiresAtMs,signing_digest_b64u:p(F(e.signingDigest32,`signingDigest32`,32)),client_rerandomization_commitment32_b64u:p(F(e.clientRerandomizationCommitment32,`clientRerandomizationCommitment32`,32))})}function q(e){let t=f(e,`ecdsaSigningRequest`);O(t,`ecdsaSigningRequest`,[`scope`,`request_id`,`operation_id`,`operation_digests`,`authorization`,`material_activation`,`client_presignature_id`,`expires_at_ms`,`signing_digest_b64u`,`client_rerandomization_commitment32_b64u`]);let n={scope:K(t.scope),request_id:k(t.request_id,`ecdsaSigningRequest.request_id`),operation_id:k(t.operation_id,`ecdsaSigningRequest.operation_id`),operation_digests:Bn(t.operation_digests,`ecdsaSigningRequest.operation_digests`),authorization:v(t.authorization),material_activation:y(t.material_activation),client_presignature_id:k(t.client_presignature_id,`ecdsaSigningRequest.client_presignature_id`),expires_at_ms:j(t.expires_at_ms,`ecdsaSigningRequest.expires_at_ms`),signing_digest_b64u:N(t.signing_digest_b64u,`ecdsaSigningRequest.signing_digest_b64u`,32),client_rerandomization_commitment32_b64u:N(t.client_rerandomization_commitment32_b64u,`ecdsaSigningRequest.client_rerandomization_commitment32_b64u`,32)};if(n.operation_digests.intent_digest_b64u!==n.signing_digest_b64u)throw Error(`ecdsaSigningRequest intent digest must equal the admitted signing digest`);return n}function Hn(e){let t=f(e,`webauthn_authentication`);O(t,`webauthn_authentication`,[`id`,`rawId`,`type`,`authenticatorAttachment`,`response`,`clientExtensionResults`]);let n=f(t.response,`webauthn_authentication.response`);O(n,`webauthn_authentication.response`,[`clientDataJSON`,`authenticatorData`,`signature`,`userHandle`]);let r=t.authenticatorAttachment===null?null:k(t.authenticatorAttachment,`webauthn_authentication.authenticatorAttachment`),i=n.userHandle===null?null:k(n.userHandle,`webauthn_authentication.response.userHandle`);return{id:k(t.id,`webauthn_authentication.id`),rawId:k(t.rawId,`webauthn_authentication.rawId`),type:k(t.type,`webauthn_authentication.type`),authenticatorAttachment:r,response:{clientDataJSON:k(n.clientDataJSON,`webauthn_authentication.response.clientDataJSON`),authenticatorData:k(n.authenticatorData,`webauthn_authentication.response.authenticatorData`),signature:k(n.signature,`webauthn_authentication.response.signature`),userHandle:i},clientExtensionResults:t.clientExtensionResults}}function Un(e){let t=f(e,`operationStepUpAuthorizationRequest`);if(O(t,`operationStepUpAuthorizationRequest`,[`kind`,`operation`,`proof`]),t.kind!==`router_ab_ecdsa_operation_step_up_v1`)throw Error(`operationStepUpAuthorizationRequest.kind must be router_ab_ecdsa_operation_step_up_v1`);let n=Wn(t.operation),r=f(t.proof,`operationStepUpAuthorizationRequest.proof`),i=at(r.authority),a;switch(r.kind){case`passkey`:if(O(r,`operationStepUpAuthorizationRequest.proof`,[`kind`,`authority`,`webauthn_authentication`]),!i||!T(i))throw Error(`operationStepUpAuthorizationRequest.proof requires an exact passkey authority`);a={kind:`passkey`,authority:i,webauthn_authentication:Hn(r.webauthn_authentication)};break;case`email_otp`:if(O(r,`operationStepUpAuthorizationRequest.proof`,[`kind`,`authority`,`challenge_id`,`otp_code`]),!i||!E(i))throw Error(`operationStepUpAuthorizationRequest.proof requires an exact Email OTP authority`);a={kind:`email_otp`,authority:i,challenge_id:k(r.challenge_id,`operationStepUpAuthorizationRequest.proof.challenge_id`),otp_code:k(r.otp_code,`operationStepUpAuthorizationRequest.proof.otp_code`)};break;default:throw Error(`operationStepUpAuthorizationRequest.proof.kind is invalid`)}return{kind:`router_ab_ecdsa_operation_step_up_v1`,operation:n,proof:a}}function Wn(e){let t=f(e,`ecdsaOperationStepUpPreparation`);if(O(t,`operationStepUpGrantRequest.operation`,[`wallet_id`,`operation_kind`,`operation_id`,`operation_digests`,`material_activation`,`normal_signing_scope`,`signing_worker_id`,`key_handle`,`relayer_key_id`,`participant_ids`,`expires_at_ms`]),!Array.isArray(t.participant_ids)||t.participant_ids.length!==2||!t.participant_ids.every(e=>Number.isSafeInteger(e)&&e>0))throw Error(`operationStepUpGrantRequest.operation.participant_ids must contain two positive integers`);return{wallet_id:k(t.wallet_id,`operationStepUpGrantRequest.operation.wallet_id`),operation_kind:Gn(t.operation_kind),operation_id:k(t.operation_id,`operationStepUpGrantRequest.operation.operation_id`),operation_digests:Bn(t.operation_digests,`operationStepUpGrantRequest.operation.operation_digests`),material_activation:y(t.material_activation),normal_signing_scope:K(t.normal_signing_scope),signing_worker_id:k(t.signing_worker_id,`operationStepUpGrantRequest.operation.signing_worker_id`),key_handle:k(t.key_handle,`operationStepUpGrantRequest.operation.key_handle`),relayer_key_id:k(t.relayer_key_id,`operationStepUpGrantRequest.operation.relayer_key_id`),participant_ids:[Number(t.participant_ids[0]),Number(t.participant_ids[1])],expires_at_ms:j(t.expires_at_ms,`operationStepUpGrantRequest.operation.expires_at_ms`)}}function Gn(e){switch(e){case me.signTransaction:case me.exportKey:return e;default:throw Error(`operationStepUpGrantRequest.operation.operation_kind must be evm.sign_transaction or evm.export_key`)}}function Kn(e){return J({scope:e.scope,request_id:e.requestId,operation_id:e.operationId,operation_digests:e.operationDigests,authorization:e.authorization,material_activation:e.materialActivation,expires_at_ms:e.expiresAtMs,signing_digest_b64u:p(F(e.signingDigest32,`signingDigest32`,32)),server_presignature_id:e.serverPresignatureId,client_signature_share32_b64u:p(F(e.clientSignatureShare32,`clientSignatureShare32`,32)),client_rerandomization_contribution32_b64u:p(F(e.clientRerandomizationContribution32,`clientRerandomizationContribution32`,32))})}function J(e){let t=f(e,`ecdsaFinalizeCoreRequest`);return O(t,`ecdsaFinalizeCoreRequest`,[`scope`,`request_id`,`operation_id`,`operation_digests`,`authorization`,`material_activation`,`expires_at_ms`,`signing_digest_b64u`,`server_presignature_id`,`client_signature_share32_b64u`,`client_rerandomization_contribution32_b64u`]),qn(t)}function qn(e){let t={scope:K(e.scope),request_id:k(e.request_id,`ecdsaFinalizeRequest.request_id`),operation_id:k(e.operation_id,`ecdsaFinalizeRequest.operation_id`),operation_digests:Bn(e.operation_digests,`ecdsaFinalizeRequest.operation_digests`),authorization:v(e.authorization),material_activation:y(e.material_activation),expires_at_ms:j(e.expires_at_ms,`ecdsaFinalizeRequest.expires_at_ms`),signing_digest_b64u:N(e.signing_digest_b64u,`ecdsaFinalizeRequest.signing_digest_b64u`,32),server_presignature_id:k(e.server_presignature_id,`ecdsaFinalizeRequest.server_presignature_id`),client_signature_share32_b64u:N(e.client_signature_share32_b64u,`ecdsaFinalizeRequest.client_signature_share32_b64u`,32),client_rerandomization_contribution32_b64u:N(e.client_rerandomization_contribution32_b64u,`ecdsaFinalizeRequest.client_rerandomization_contribution32_b64u`,32)};if(t.operation_digests.intent_digest_b64u!==t.signing_digest_b64u)throw Error(`ecdsaFinalizeRequest intent digest must equal the admitted signing digest`);return t}function Jn(e){let t=f(e,`ecdsaPrepareResponse`);return O(t,`ecdsaPrepareResponse`,[`scope`,`request_id`,`request_digest`,`signing_digest`,`server_presignature_id`,`server_big_r33_b64u`,`signing_worker_rerandomization_contribution32_b64u`,`signature_scheme`,`prepared_at_ms`,`expires_at_ms`]),{scope:K(t.scope),request_id:k(t.request_id,`ecdsaPrepareResponse.request_id`),request_digest:I(t.request_digest,`ecdsaPrepareResponse.request_digest`),signing_digest:I(t.signing_digest,`ecdsaPrepareResponse.signing_digest`),server_presignature_id:k(t.server_presignature_id,`ecdsaPrepareResponse.server_presignature_id`),server_big_r33_b64u:N(t.server_big_r33_b64u,`ecdsaPrepareResponse.server_big_r33_b64u`,33),signing_worker_rerandomization_contribution32_b64u:N(t.signing_worker_rerandomization_contribution32_b64u,`ecdsaPrepareResponse.signing_worker_rerandomization_contribution32_b64u`,32),signature_scheme:jt(t.signature_scheme,`ecdsaPrepareResponse.signature_scheme`),prepared_at_ms:j(t.prepared_at_ms,`ecdsaPrepareResponse.prepared_at_ms`),expires_at_ms:j(t.expires_at_ms,`ecdsaPrepareResponse.expires_at_ms`)}}async function Yn(e,t){let n=q(e),r=Jn(t);if(!kn(r.scope,n.scope))throw Error(`ecdsaPrepareResponse.scope does not match request`);if(r.request_id!==n.request_id)throw Error(`ecdsaPrepareResponse.request_id does not match request`);if(r.server_presignature_id!==n.client_presignature_id)throw Error(`ecdsaPrepareResponse.server_presignature_id does not match request`);if(!H(r.signing_digest,sn(n.signing_digest_b64u)))throw Error(`ecdsaPrepareResponse.signing_digest does not match request`);if(r.expires_at_ms!==n.expires_at_ms)throw Error(`ecdsaPrepareResponse.expires_at_ms does not match request`);if(!H(r.request_digest,await Nn(n)))throw Error(`ecdsaPrepareResponse.request_digest does not match request`);return r}function Xn(e){let t=f(e,`ecdsaSigningResponse`);return O(t,`ecdsaSigningResponse`,[`scope`,`request_id`,`request_digest`,`signing_digest`,`signature_scheme`,`signature65_b64u`]),{scope:K(t.scope),request_id:k(t.request_id,`ecdsaSigningResponse.request_id`),request_digest:I(t.request_digest,`ecdsaSigningResponse.request_digest`),signing_digest:I(t.signing_digest,`ecdsaSigningResponse.signing_digest`),signature_scheme:jt(t.signature_scheme,`ecdsaSigningResponse.signature_scheme`),signature65_b64u:N(t.signature65_b64u,`ecdsaSigningResponse.signature65_b64u`,65)}}async function Zn(e,t){let n=J(e),r=Xn(t);if(!kn(r.scope,n.scope))throw Error(`ecdsaSigningResponse.scope does not match request`);if(r.request_id!==n.request_id)throw Error(`ecdsaSigningResponse.request_id does not match request`);if(!H(r.signing_digest,sn(n.signing_digest_b64u)))throw Error(`ecdsaSigningResponse.signing_digest does not match request`);if(!H(r.request_digest,await Fn(n)))throw Error(`ecdsaSigningResponse.request_digest does not match request`);return r}function Qn(e){let t=typeof e==`string`?e.trim():``;if(!t.startsWith(`ederivation-key-`))throw Error(`Threshold ECDSA key handle is invalid`);return t}function $n(e,t){let n=String(e??``).trim();if(!n)throw Error(`[threshold-ecdsa-key-handle] ${t} is required`);return n}function er(e){return String(e??``).trim()||`default`}async function tr(e){return`ederivation-key-${p(await ne(d({domain:`seams.threshold_ecdsa.key_handle.v1`,ecdsaThresholdKeyId:$n(e.ecdsaThresholdKeyId,`ecdsaThresholdKeyId`),signingRootId:$n(e.signingRootId,`signingRootId`),signingRootVersion:er(e.signingRootVersion)})))}`}function Y(e){return{code:`missing`,message:`${e} is required`}}function X(e,t){return{code:`invalid`,message:`${e} ${t}`}}function Z(e,t){if(e==null)return{ok:!1,error:Y(t)};if(typeof e!=`string`)return{ok:!1,error:X(t,`must be a string`)};let n=e.trim();return n?c(n)?{ok:!1,error:X(t,`must not contain whitespace or control characters`)}:{ok:!0,value:n}:{ok:!1,error:Y(t)}}function nr(e,t){if(e==null)return{ok:!1,error:Y(t)};if(typeof e!=`string`||e.length===0)return{ok:!1,error:X(t,`must be non-empty base64url`)};try{let n=m(e);if(n.length===0||p(n)!==e)return{ok:!1,error:X(t,`must be canonical unpadded base64url`)}}catch{return{ok:!1,error:X(t,`must be canonical unpadded base64url`)}}return{ok:!0,value:e}}function rr(e,t,n){if(e==null)return{ok:!1,error:Y(t)};try{return{ok:!0,value:n(_e(e))}}catch{return{ok:!1,error:X(t,`must be canonical base64url for 32 bytes`)}}}function ir(e){return e}function ar(e){return e}function or(e){return e}function Q(e,t,n){let r=new Set(t);for(let t of Object.keys(e))if(!r.has(t))throw Error(`${n}.${t} is not supported`);for(let r of t)if(!(r in e))throw Error(`${n}.${r} is required`)}function sr(e){return Z(e,`laneHolderParticipantId`)}function cr(e){return Z(e,`signingWorkerParticipantId`)}function lr(e){return Z(e,`signingWorkerRecipientKeyId`)}function ur(e){return Z(e,`laneHolderCustodyBindingId`)}function dr(e){return rr(e,`participantBindingDigestB64u`,or)}function fr(e){return rr(e,`custodyBindingDigestB64u`,ir)}function pr(e){return rr(e,`hpkePublicKeyDigestB64u`,ar)}function mr(e){return{kind:`lane_holder_custody_identity_v1`,custodyBindingId:e.custodyBindingId,custodyBindingDigestB64u:e.custodyBindingDigestB64u}}function hr(e){return{kind:`signing_worker_recipient_identity_v1`,recipientKeyId:e.recipientKeyId,hpkePublicKeyB64u:e.hpkePublicKeyB64u,hpkePublicKeyDigestB64u:e.hpkePublicKeyDigestB64u}}function gr(e,t=`laneHolderCustodyIdentity`){let n=f(e,t);if(Q(n,[`kind`,`custodyBindingId`,`custodyBindingDigestB64u`],t),n.kind!==`lane_holder_custody_identity_v1`)throw Error(`${t}.kind is invalid`);let r=ur(n.custodyBindingId);if(!r.ok)throw Error(`${t}.${r.error.message}`);let i=fr(n.custodyBindingDigestB64u);if(!i.ok)throw Error(`${t}.${i.error.message}`);return mr({custodyBindingId:r.value,custodyBindingDigestB64u:i.value})}function _r(e,t=`signingWorkerRecipientIdentity`){let n=f(e,t);if(Q(n,[`kind`,`recipientKeyId`,`hpkePublicKeyB64u`,`hpkePublicKeyDigestB64u`],t),n.kind!==`signing_worker_recipient_identity_v1`)throw Error(`${t}.kind is invalid`);let r=lr(n.recipientKeyId);if(!r.ok)throw Error(`${t}.${r.error.message}`);let i=nr(n.hpkePublicKeyB64u,`${t}.hpkePublicKeyB64u`);if(!i.ok)throw Error(i.error.message);let a=pr(n.hpkePublicKeyDigestB64u);if(!a.ok)throw Error(`${t}.${a.error.message}`);return hr({recipientKeyId:r.value,hpkePublicKeyB64u:i.value,hpkePublicKeyDigestB64u:a.value})}function vr(e){return{kind:`lane_holder_participant_v1`,participantId:e.participantId,custodyBindingId:e.custody.custodyBindingId,custodyBindingDigestB64u:e.custody.custodyBindingDigestB64u,hpkePublicKeyB64u:e.hpkePublicKeyB64u,hpkePublicKeyDigestB64u:e.hpkePublicKeyDigestB64u,participantBindingDigestB64u:e.participantBindingDigestB64u}}function yr(e){return{kind:`signing_worker_participant_v1`,participantId:e.participantId,recipientKeyId:e.recipient.recipientKeyId,hpkePublicKeyB64u:e.recipient.hpkePublicKeyB64u,hpkePublicKeyDigestB64u:e.recipient.hpkePublicKeyDigestB64u,participantBindingDigestB64u:e.participantBindingDigestB64u}}function br(e,t=`laneHolderParticipant`){let n=f(e,t);if(Q(n,[`kind`,`participantId`,`custodyBindingId`,`custodyBindingDigestB64u`,`hpkePublicKeyB64u`,`hpkePublicKeyDigestB64u`,`participantBindingDigestB64u`],t),n.kind!==`lane_holder_participant_v1`)throw Error(`${t}.kind is invalid`);let r=sr(n.participantId);if(!r.ok)throw Error(`${t}.${r.error.message}`);let i=gr({kind:`lane_holder_custody_identity_v1`,custodyBindingId:n.custodyBindingId,custodyBindingDigestB64u:n.custodyBindingDigestB64u},`${t}.custody`),a=nr(n.hpkePublicKeyB64u,`${t}.hpkePublicKeyB64u`);if(!a.ok)throw Error(a.error.message);let o=pr(n.hpkePublicKeyDigestB64u);if(!o.ok)throw Error(`${t}.${o.error.message}`);let s=dr(n.participantBindingDigestB64u);if(!s.ok)throw Error(`${t}.${s.error.message}`);return vr({participantId:r.value,custody:i,hpkePublicKeyB64u:a.value,hpkePublicKeyDigestB64u:o.value,participantBindingDigestB64u:s.value})}function xr(e,t=`signingWorkerParticipant`){let n=f(e,t);if(Q(n,[`kind`,`participantId`,`recipientKeyId`,`hpkePublicKeyB64u`,`hpkePublicKeyDigestB64u`,`participantBindingDigestB64u`],t),n.kind!==`signing_worker_participant_v1`)throw Error(`${t}.kind is invalid`);let r=cr(n.participantId);if(!r.ok)throw Error(`${t}.${r.error.message}`);let i=_r({kind:`signing_worker_recipient_identity_v1`,recipientKeyId:n.recipientKeyId,hpkePublicKeyB64u:n.hpkePublicKeyB64u,hpkePublicKeyDigestB64u:n.hpkePublicKeyDigestB64u},`${t}.recipient`),a=dr(n.participantBindingDigestB64u);if(!a.ok)throw Error(`${t}.${a.error.message}`);return yr({participantId:r.value,recipient:i,participantBindingDigestB64u:a.value})}const Sr=[`kind`,`signerId`,`participantIds`,`signingWorkerId`,`custodyKeyManifestDigestB64u`,`sourceIdentityDigestB64u`];function Cr(e,t=`walletSignerId`){if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} is required`);if(c(n))throw Error(`${t} must not contain whitespace or control characters`);return n}function wr(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive safe integer`);return e}function Tr(e,t){if(!Array.isArray(e)||e.length!==2)throw Error(`${t} must contain exactly two participant ids`);let n=wr(e[0],`${t}[0]`),r=wr(e[1],`${t}[1]`);if(n===r)throw Error(`${t} must contain distinct participant ids`);return[n,r]}function Er(e){let t=Tr(e.participantIds,`participantIds`);return{kind:`owner_lane_participant_continuity_v1`,signerId:Cr(e.signerId),participantIds:t,signingWorkerId:ie(n(e.signingWorkerId),`signingWorkerId`),custodyKeyManifestDigestB64u:h(e.custodyKeyManifestDigestB64u,`custodyKeyManifestDigestB64u`),sourceIdentityDigestB64u:h(e.sourceIdentityDigestB64u,`sourceIdentityDigestB64u`)}}function Dr(e,t=`ownerParticipantContinuity`){let r=f(e,t);if(re(r,Sr,t),r.kind!==`owner_lane_participant_continuity_v1`)throw Error(`${t}.kind must be owner_lane_participant_continuity_v1`);return Er({signerId:Cr(r.signerId,`${t}.signerId`),participantIds:Tr(r.participantIds,`${t}.participantIds`),signingWorkerId:ie(n(r.signingWorkerId),`${t}.signingWorkerId`),custodyKeyManifestDigestB64u:h(r.custodyKeyManifestDigestB64u,`${t}.custodyKeyManifestDigestB64u`),sourceIdentityDigestB64u:h(r.sourceIdentityDigestB64u,`${t}.sourceIdentityDigestB64u`)})}function $(e,t){let n=String(e??``).trim();if(!n)throw Error(`[evm-family-ecdsa] ${t} is required`);return n}function Or(e){return $(e,`rpId`)}function kr(e){return ve({walletId:g(e.walletId),signingRootId:jr(e.signingRootId),signingRootVersion:Mr(e.signingRootVersion)})}function Ar(e){return $(e,`ecdsaThresholdKeyId`)}function jr(e){return $(e,`signingRootId`)}function Mr(e){return String(e??``).trim()||`default`}function Nr(e){let t=String(e??``).trim().toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(t))throw Error(`[evm-family-ecdsa] thresholdOwnerAddress must be an EVM address`);return t}function Pr(e){return Nr(e)}function Fr(e){return Or(e)}function Ir(e){return $(e,`keyHandle`)}function Lr(e){return Ar(String(e.record.ecdsaThresholdKeyId??``).trim())}function Rr(e){return{signingRootId:jr(e.signingRootId),signingRootVersion:Mr(e.signingRootVersion)}}function zr(e){return Rr({signingRootId:e.record.signingRootId,signingRootVersion:e.record.signingRootVersion})}function Br(e){let t=oe(e.runtimePolicyScope);return Rr({signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion})}function Vr(e){let t=$(e,`thresholdEcdsaPublicKeyB64u`),n;try{n=m(t)}catch{throw Error(`[evm-family-ecdsa] thresholdEcdsaPublicKeyB64u must be base64url`)}if(n.length!==33)throw Error(`[evm-family-ecdsa] thresholdEcdsaPublicKeyB64u must decode to 33 bytes`);return t}function Hr(e){let t=Math.floor(Number(e));if(!Number.isSafeInteger(t)||t<1||t>65535)throw Error(`[evm-family-ecdsa] participantId must be a positive safe integer`);return t}function Ur(e){let t=ae(e);if(!t?.length)throw Error(`[evm-family-ecdsa] participantIds are required`);return t.map(Hr)}function Wr(e){return e.map(e=>String(Number(e))).join(`,`)}function Gr(e){let t=2166136261;for(let n=0;n<e.length;n+=1)t^=e.charCodeAt(n),t=Math.imul(t,16777619)>>>0;return t.toString(16).padStart(8,`0`)}function Kr(e){return{walletId:e.walletId,keyScope:`evm-family`,ecdsaThresholdKeyId:Ar(e.ecdsaThresholdKeyId),signingRootId:jr(e.signingRootId),signingRootVersion:Mr(e.signingRootVersion),participantIds:Ur(e.participantIds),thresholdOwnerAddress:Nr(e.thresholdOwnerAddress)}}function qr(e){return Kr({walletId:g(e.walletId),ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,participantIds:e.participantIds,thresholdOwnerAddress:e.thresholdOwnerAddress})}function Jr(e){return ye({walletId:g(e)})}async function Yr(e){return await tr(e)}function Xr(e){return{kind:`verified_ecdsa_public_facts`,keyHandle:e.keyHandle,publicKeyB64u:Vr(e.publicKeyB64u),participantIds:Ur(e.participantIds),thresholdOwnerAddress:Nr(e.thresholdOwnerAddress)}}function Zr(e){return{walletId:e.walletId,keyScope:e.keyFacts.keyScope,ecdsaThresholdKeyId:e.keyFacts.ecdsaThresholdKeyId,signingRootId:e.keyFacts.signingRootId,signingRootVersion:e.keyFacts.signingRootVersion,participantIds:e.keyFacts.participantIds,thresholdOwnerAddress:e.keyFacts.thresholdOwnerAddress}}function Qr(e){let t=Ir(e.keyHandle),n=qr(e),r=Xr({keyHandle:t,publicKeyB64u:e.thresholdEcdsaPublicKeyB64u,participantIds:n.participantIds,thresholdOwnerAddress:n.thresholdOwnerAddress});return{kind:`evm_family_ecdsa_wallet_key`,walletId:n.walletId,keyHandle:t,chainTarget:e.chainTarget,keyFacts:{kind:`evm_family_ecdsa_key_facts`,keyScope:n.keyScope,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,participantIds:r.participantIds,thresholdOwnerAddress:r.thresholdOwnerAddress,thresholdEcdsaPublicKeyB64u:r.publicKeyB64u}}}function $r(e){let t=[];if(String(e.expected.keyHandle)!==String(e.actual.keyHandle)&&t.push(`keyHandle`),String(e.expected.publicKeyB64u)!==String(e.actual.publicKeyB64u)&&t.push(`publicKeyB64u`),Wr(e.expected.participantIds)!==Wr(e.actual.participantIds)&&t.push(`participantIds`),String(e.expected.thresholdOwnerAddress)!==String(e.actual.thresholdOwnerAddress)&&t.push(`thresholdOwnerAddress`),t.length)throw Error(`[evm-family-ecdsa] ${e.context} public facts mismatch: ${t.join(`, `)}`)}function ei(e){return{kind:`passkey_ecdsa_auth_binding`,authMethod:be.passkey,rpId:Or(e.rpId),credentialIdB64u:$(e.credentialIdB64u,`credentialIdB64u`)}}function ti(e){return{kind:`resolved_evm_family_ecdsa_key`,walletId:g(e.walletId),publicFacts:e.publicFacts,authBinding:e.authBinding}}function ni(e){return{kind:`hydrated_ecdsa_signer_material`,walletId:e.walletId,materialActivation:e.materialActivation,publicFacts:e.publicFacts,transport:e.transport,clientShare:e.clientShare,routerAbEcdsaDerivationNormalSigning:e.routerAbEcdsaDerivationNormalSigning}}function ri(e){let t=Math.floor(Number(e.ttlMs)),n=Math.floor(Number(e.remainingUses));if(!Number.isFinite(t)||t<=0)throw Error(`[evm-family-ecdsa] ttlMs must be a positive finite value`);if(!Number.isFinite(n)||n<=0)throw Error(`[evm-family-ecdsa] remainingUses must be a positive finite value`);return{chainTarget:e.chainTarget,thresholdSessionId:xe.thresholdEcdsaSession(e.thresholdSessionId),ttlMs:t,remainingUses:n,runtimePolicyScope:e.runtimePolicyScope}}function ii(e){let t=Math.floor(Number(e.ttlMs)),n=Math.floor(Number(e.remainingUses));if(!Number.isFinite(t)||t<=0)throw Error(`[evm-family-ecdsa] ttlMs must be a positive finite value`);if(!Number.isFinite(n)||n<=0)throw Error(`[evm-family-ecdsa] remainingUses must be a positive finite value`);return{chainTarget:e.chainTarget,thresholdSessionId:xe.thresholdEcdsaSession(e.thresholdSessionId),ttlMs:t,remainingUses:n,runtimePolicyScope:e.runtimePolicyScope}}function ai(e){return`evmfam-ecdsa:${Gr(d({version:`evm_family_ecdsa_key_fingerprint_v2`,walletId:String(e.walletId),baseEcdsaSubjectId:String(Jr(e.walletId)),keyScope:e.keyScope,ecdsaThresholdKeyId:String(e.ecdsaThresholdKeyId),signingRootId:String(e.signingRootId),signingRootVersion:String(e.signingRootVersion),participantIds:e.participantIds.map(e=>Number(e)),thresholdOwnerAddress:String(e.thresholdOwnerAddress)}))}`}function oi(e){return`evmfam-ecdsa:${Gr(d({version:`evm_family_ecdsa_public_facts_fingerprint_v1`,walletId:String(g(e.walletId)),keyHandle:String(e.publicFacts.keyHandle),publicKeyB64u:String(e.publicFacts.publicKeyB64u),participantIds:e.publicFacts.participantIds.map(e=>Number(e)),thresholdOwnerAddress:String(e.publicFacts.thresholdOwnerAddress)}))}`}function si(e,t){let n=String(e??``).trim();if(!n)throw Error(`[email-otp-derivation] ${t} is required`);return n}function ci(e){return si(e,`authSubjectId`)}function li(e){return Ae(e)}function ui(e){return je(e)}function di(e){return Me(e)}export{rn as $,v as $t,dr as A,at as At,Vn as B,Ue as Bt,Ir as C,nt as Ct,Pr as D,T as Dt,Vr as E,E as Et,pt as F,Be as Ft,K as G,Pe as Gt,on as H,He as Ht,mt as I,Ie as It,Ht as J,je as Jt,In as K,Ne as Kt,ht as L,Le as Lt,Qn as M,Ke as Mt,ft as N,ut as Nt,Dr as O,ot as Ot,gt as P,Ge as Pt,en as Q,y as Qt,dt as R,We as Rt,Br as S,Ze as St,Fr as T,tt as Tt,Yn as U,ze as Ut,xt as V,Ve as Vt,Zn as W,Fe as Wt,bt as X,Ae as Xt,Un as Y,Me as Yt,Wn as Z,x as Zt,kr as _,V as _t,$r as a,Jt as at,Lr as b,z as bt,ri as c,Fn as ct,ei as d,xn as dt,Te as en,an as et,ti as f,ln as ft,oi as g,fn as gt,ai as h,dn as ht,ci as i,Vt as it,xr as j,qe as jt,br as k,st as kt,Qr as l,Nn as lt,Yr as m,kn as mt,di as n,S as nn,Xt as nt,qr as o,Ln as ot,Xr as p,Qt as pt,B as q,Oe as qt,li as r,Se as rn,zt as rt,ii as s,zn as st,ui as t,we as tn,Yt as tt,ni as u,Dn as ut,Zr as v,un as vt,Hr as w,et as wt,zr as x,$e as xt,Rr as y,Zt as yt,Kn as z,Re as zt};

package/dist/public/sdk/host-CWE1mHHY.js

@@ -1 +0,0 @@
-import{C as e,S as t}from"./chains-CiYQT1K4.js";import{_ as n,c as r,f as i,g as a,h as o,l as s,m as c,n as l,o as u,t as d,v as f}from"./messages-vxz27Way.js";import{a as p,c as m,i as h,l as g,n as _,o as v,s as y,t as b,u as x}from"./transactionReviewAdmission-C-a3ctCJ.js";import{t as S}from"./events-DsQJQ0Cl.js";import{t as C}from"./walletIframeIdentity-DJ0KOBHg.js";import{t as w}from"./errors-BZO3LF6G.js";function T(){let e=globalThis;e.global===void 0&&(e.global=globalThis),!e.process||typeof e.process!=`object`?e.process={env:{}}:(!e.process.env||typeof e.process.env!=`object`)&&(e.process.env={})}function E(){T(),window.location.origin===`null`&&(window.parent?.postMessage({type:`SERVICE_HOST_DEBUG_ORIGIN`,origin:window.location.origin,href:window.location.href},`*`),console.warn(`[WalletHost] iframe is running with opaque (null) origin. Check COEP/CORP headers and ensure navigation succeeded.`)),D(),window.parent?.postMessage({type:`SERVICE_HOST_BOOTED`},`*`),window.parent?.postMessage({type:`SERVICE_HOST_DEBUG_ORIGIN`,origin:window.location.origin,href:window.location.href},`*`);let e=new URL(import.meta.url),t=e.searchParams.get(`v`);t&&c(t);let n=new URL(`.`,e).toString(),r=n.endsWith(`/`)?n:n+`/`;i()||o(r)}function D(){let e=()=>{let e=document;e.documentElement.classList.add(`seams-transparent`),e.body?.classList.add(`seams-transparent`),e.documentElement.classList.remove(`dark`),e.body?.classList.remove(`dark`)};document.readyState===`loading`?document.addEventListener(`DOMContentLoaded`,()=>e(),{once:!0}):e(),window.addEventListener(`load`,()=>e(),{once:!0})}const O={};let k=null,A=null;function j(e){return e.type===`PM_ACKNOWLEDGE_WALLET_RECOVERY_CODE_BACKUP`?(k??=import(`./runtime-recovery-codes-BZMiAR_5.js`),k):(O[e.kind]??=N(e.kind),O[e.kind])}async function M(){k??=import(`./runtime-recovery-codes-BZMiAR_5.js`),A??=Promise.all([k,import(`./mountRecoveryCodeBackupSurface-B1qhFF6G.js`)]).then(()=>void 0),await A}function N(e){switch(e){case`auth`:return import(`./runtime-auth-DiEJDFkJ.js`);case`near`:return import(`./runtime-near-BxYOozPP.js`);case`ecdsa`:return import(`./runtime-ecdsa-tempo-C3CRzwph.js`);case`email_otp`:return import(`./runtime-email-otp-DHlirACG.js`);case`recovery`:return import(`./runtime-recovery-DSbvI1DT.js`);case`export`:return import(`./runtime-export-CFy4-Ebn.js`);case`device_link`:return import(`./runtime-device-link-5u31t1H0.js`);case`preferences`:return import(`./runtime-preferences-C1Exkn4E.js`)}return P(e)}function P(e){throw Error(`Unhandled wallet host runtime route: ${String(e)}`)}function F(e){throw Error(`Unhandled wallet host route: ${String(e)}`)}function I(e,t){if(e===null)throw Error(`Invalid ${t} payload`);return e}function L(e){try{return C(e)}catch{throw Error(`Hosted auth-menu request requires a non-empty requestId`)}}function R(e){switch(e.type){case`PM_ACTIVATE_TRANSACTION_REVIEW`:case`PING`:case`PM_SET_CONFIG`:case`PM_CANCEL`:case`PM_SET_TRANSACTION_VIEW`:case`PM_TRANSACTION_BROADCAST_STARTED`:return{kind:`boot`,type:e.type,request:e};case`PM_REGISTER_WALLET`:case`PM_ADD_WALLET_SIGNER`:case`PM_ADD_PASSKEY`:case`PM_ADD_EMAIL_OTP`:case`PM_REVOKE_AUTH_METHOD`:case`PM_GET_NEAR_PROVISIONING_STATE`:case`PM_SIGN_TX_WITH_ACTIONS`:case`PM_SIGN_AND_SEND_TX`:case`PM_SEND_TRANSACTION`:case`PM_SIGN_DELEGATE_ACTION`:case`PM_SIGN_NEP413`:return{kind:`near`,type:e.type,request:e};case`PM_OPEN_AUTH_MENU`:{let t=L(e.requestId);return{kind:`auth`,type:e.type,request:{...e,requestId:t,payload:I(s(e.payload),`hosted auth-menu open`)}}}case`PM_CANCEL_AUTH_MENU`:{let t=L(e.requestId);return{kind:`auth`,type:e.type,request:{...e,requestId:t,payload:I(u(e.payload),`hosted auth-menu cancellation`)}}}case`PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH`:{let t=L(e.requestId);return{kind:`auth`,type:e.type,request:{...e,requestId:t,payload:I(r(e.payload),`hosted auth-menu external-auth resolution`)}}}case`PM_UNLOCK`:case`PM_LOCK`:case`PM_LOCK_EXACT_WALLET_SESSION`:case`PM_GET_LAST_WALLET_MOVE_REQUEST`:case`PM_MOVE_WALLET`:case`PM_GET_WALLET_MOVE`:case`PM_GET_WALLET_PLACEMENT`:case`PM_GET_WALLET_SESSION`:case`PM_GET_EXACT_WALLET_SESSION_STATE`:case`PM_GET_RECENT_UNLOCKS`:return{kind:`auth`,type:e.type,request:e};case`PM_SIGN_TEMPO`:case`PM_REPORT_TEMPO_BROADCAST_ACCEPTED`:case`PM_REPORT_TEMPO_BROADCAST_REJECTED`:case`PM_REPORT_TEMPO_FINALIZED`:case`PM_REPORT_TEMPO_DROPPED_OR_REPLACED`:case`PM_RECONCILE_TEMPO_NONCE_LANE`:return{kind:`ecdsa`,type:e.type,request:e};case`PM_REDEEM_HOSTED_WALLET_SEAMS_SESSION`:case`PM_REQUEST_EMAIL_OTP_CHALLENGE`:case`PM_BEGIN_GOOGLE_EMAIL_OTP_WALLET_AUTH`:case`PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_RESEND`:case`PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_REROLL_WALLET_ID`:case`PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_SUBMIT`:case`PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_COMPLETE_REGISTRATION`:case`PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_CANCEL`:case`PM_GET_WALLET_RECOVERY_CODE_STATUS`:case`PM_ACKNOWLEDGE_WALLET_RECOVERY_CODE_BACKUP`:case`PM_ROTATE_WALLET_RECOVERY_CODES`:case`PM_REQUEST_WALLET_CUSTODY_EMAIL_OTP_CHALLENGE`:return{kind:`email_otp`,type:e.type,request:e};case`PM_SYNC_ACCOUNT_FLOW`:return{kind:`recovery`,type:e.type,request:e};case`PM_RESOLVE_EXACT_KEY_EXPORT_LANE`:case`PM_EXPORT_KEYPAIR_UI`:return{kind:`export`,type:e.type,request:e};case`PM_HAS_PASSKEY`:case`PM_LIST_LINKED_DEVICES`:case`PM_REVOKE_LINKED_DEVICE`:case`PM_SCAN_AND_LINK_DEVICE`:case`PM_START_DEVICE2_LINKING_FLOW`:case`PM_DEVICE_LINK_TARGET_FACTOR_ACTION`:case`PM_DEVICE_LINK_EMAIL_OTP_BASE_FACTOR_ACTION`:case`PM_CANCEL_DEVICE_LINKING`:return{kind:`device_link`,type:e.type,request:e};case`PM_SET_CONFIRM_BEHAVIOR`:case`PM_SET_CONFIRMATION_CONFIG`:case`PM_GET_CONFIRMATION_CONFIG`:return{kind:`preferences`,type:e.type,request:e}}return F(e)}function z(e){return e.kind!==`boot`}let B=!1;const V=[{selector:`.seams-auth-menu-surface`,cancellationKind:`native_cancel`},{selector:`.seams-confirmation-surface`,cancellationKind:`native_cancel`},{selector:`.seams-export-surface`,cancellationKind:`wallet_iframe_cancel`},{selector:`[data-seams-wallet-recovery-backup-dialog]`,cancellationKind:`native_cancel`}];function H(e,t){let n=new Set(t),r=Object.keys(e);return r.length===t.length&&r.every(e=>n.has(e))}function U(t){return!e(t)||!H(t,[`type`,`payload`])||t.type!==`CONNECT`||!e(t.payload)||!H(t.payload,[`protocolVersion`])?null:typeof t.payload.protocolVersion==`string`?{type:`CONNECT`,payload:{protocolVersion:t.payload.protocolVersion}}:null}function W(e){if(e===`null`)return!0;try{let t=new URL(e);return(t.protocol===`https:`||t.protocol===`http:`)&&t.origin===e}catch{return!1}}function G(e){try{e.close()}catch{}}function K(e,t){if(t===`15.0.0`)return!1;let n={expectedProtocolVersion:l,receivedProtocolVersion:t};try{e.postMessage({type:`ERROR`,payload:{code:d,message:`Wallet iframe protocol version mismatch: expected ${l}, received ${t??`missing`}`,details:n}})}catch{}return G(e),!0}function q(e,t){return!t||t.has(e.kind)}function J(e,t,n,r){e.executionGeneration===t&&n(r)}function Y(e,t,n,r){return e.executionGeneration!==t||n(r)}function X(e={}){if(B)return;B=!0,E(),(!e.supportedRuntimeRouteKinds||e.supportedRuntimeRouteKinds.has(`email_otp`))&&M().catch(()=>void 0);let r=new Set,i=new Set,o={parentOrigin:null,port:null,configuration:{kind:`unconfigured`},executionGeneration:0,onConfigurationChanged:null},s=e=>{try{o.port?.postMessage(e)}catch{}},c=e=>{e&&r.add(e)},u=e=>!!e&&(r.has(e)||h(e)?.cancelled===!0),d=e=>{e&&r.delete(e)},C=e=>{e&&s({type:`ERROR`,requestId:e,payload:{code:`cancelled`,message:`Request cancelled`}})},T=e=>!e||!u(e)?!1:h(e)?.cancelled?!0:(C(e),d(e),!0),D=()=>{for(let e of V){let t=document.querySelectorAll(e.selector);for(let n of t)try{e.cancellationKind===`native_cancel`?n.dispatchEvent(new Event(`cancel`,{cancelable:!0})):n.dispatchEvent(new CustomEvent(S.TX_CONFIRMER_CANCEL,{bubbles:!0,composed:!0}))}catch{}}},O=async r=>{let l=r.data;if(!l||!t(l))return;let S=l.requestId,E=o.executionGeneration,O=J.bind(null,o,E,s),k=null;try{if(`transactionReview`in l){if(l.type!==`PM_SIGN_AND_SEND_TX`&&l.type!==`PM_SIGN_TEMPO`)throw new p(`review_invalid_input`,`Review is unsupported for this request`);let e=m(l.transactionReview);if(e.requestId!==S)throw new p(`review_invalid_input`,`Review request identity mismatch`);let t=l.payload?.options?.confirmationConfig;if(t?.uiMode!==`modal`||t.behavior!==`requireClick`)throw new p(`review_unsupported_mode`,`Review requires modal presentation and explicit approval`);k=new b(e,l.type===`PM_SIGN_TEMPO`&&l.payload?.request.senderSignatureAlgorithm!==`secp256k1`?`credential`:`mpc`,e=>O({type:`TRANSACTION_REVIEW_STATE`,requestId:S,payload:e}),e=>O({type:`ERROR`,requestId:S,payload:{code:e instanceof p?e.code:`cancelled`,message:e.message}}))}(l.type===`PM_LOCK`||l.type===`PM_LOCK_EXACT_WALLET_SESSION`)&&_(new p(`review_identity_changed`,`The wallet session changed`));let t=R(l);if(!z(t))switch(t.type){case`PING`:s({type:`PONG`,requestId:S});return;case`PM_SET_CONFIG`:{let e=a(o.configuration,n(t.request.payload)),r=f(o.configuration.kind===`configured`?o.configuration.config:null)!==f(e.config);if(o.configuration=e,r){o.executionGeneration+=1;for(let e of i)s({type:`ERROR`,requestId:e,payload:{code:`wallet_configuration_changed`,message:`Wallet configuration changed during request`}});i.clear()}o.onConfigurationChanged?.(),r&&(_(new p(`review_identity_changed`,`Wallet execution configuration changed`)),D()),s({type:`PONG`,requestId:S});return}case`PM_ACTIVATE_TRANSACTION_REVIEW`:{let e=y(t.request.payload);e&&h(e.requestId)?.activate(e);return}case`PM_CANCEL`:{let e=t.request.payload?.requestId,n=t.request.payload,r=n&&typeof n==`object`?Reflect.get(n,`transactionReview`):void 0;if(r!==void 0){let t=m(r),i=h(t.requestId);if(t.requestId===e&&i&&g(t,i.metadata)){let e=new p(x(n&&typeof n==`object`?Reflect.get(n,`reviewErrorCode`):void 0),`Reviewed request cancelled`);try{v(i.metadata.validity)}catch(t){t instanceof Error&&(e=t)}i.cancel(e)}s({type:`PONG`,requestId:S});return}let i=e?h(e):void 0;if(i){i.cancel(new p(`cancelled`,`Request cancelled`)),s({type:`PONG`,requestId:S});return}c(e),D(),e&&C(e),s({type:`PONG`,requestId:S});return}case`PM_SET_TRANSACTION_VIEW`:{let e=t.request.payload,n=e&&typeof e==`object`?Reflect.get(e,`requestId`):null,r=e&&typeof e==`object`?Reflect.get(e,`view`):null;typeof n==`string`&&(r===`toast`||r===`closed`)&&(await import(`./transaction-activity-D40ih2j-.js`).then(e=>e.o)).setTransactionActivityView(n,r);return}case`PM_TRANSACTION_BROADCAST_STARTED`:{let e=t.request.payload,n=e&&typeof e==`object`?Reflect.get(e,`signedTransaction`):null;typeof n==`string`&&(await import(`./transaction-activity-D40ih2j-.js`).then(e=>e.o)).transactionBroadcastStarted(n);return}}if(!q(t,e.supportedRuntimeRouteKinds)){s({type:`ERROR`,requestId:S,payload:{code:`unsupported_request`,message:`Unsupported wallet iframe request type: ${t.type}`}});return}S&&i.add(S);let r=await j(t);if(E!==o.executionGeneration)return;await r.handleWalletHostRuntimeRequest({transactionReview:k,state:o,executionGeneration:E,req:t.request,post:J.bind(null,o,E,s),isCancelled:Y.bind(null,o,E,u),respondIfCancelled:Y.bind(null,o,E,T)})}catch(e){if(E!==o.executionGeneration&&l.type!==`PM_SET_CONFIG`||k?.cancelled)return;let t=await import(`./canonicalSignerErrorCode-DEHsPxNm.js`);if(E!==o.executionGeneration&&l.type!==`PM_SET_CONFIG`)return;let n=e&&typeof e==`object`&&`code`in e?e.code:void 0,r=w(e),i=t.resolveWalletBoundaryErrorCode({requestType:l.type,rawCode:n,message:r,defaultCode:`HOST_ERROR`}),a=t.resolveWalletBoundaryErrorMessage({requestType:l.type,rawCode:n,code:i,message:r}),c=t.resolveWalletBoundarySignerKind(l.type);s({type:`ERROR`,requestId:S,payload:{code:i,message:a,...t.isWalletSignerBoundaryRequestType(l.type)&&t.isCanonicalSignerSessionBoundaryCode(i)&&c?{signerKind:c}:{}}})}finally{S&&(i.delete(S),d(S)),k?.finish()}};window.addEventListener(`message`,e=>{let t=U(e.data),n=e.ports[0];if(!(!t||!n||o.port)){if(e.source!==window.parent||!W(e.origin)){G(n);return}if(!K(n,t.payload.protocolVersion)){typeof e.origin==`string`&&e.origin.length&&e.origin!==`null`&&(o.parentOrigin=e.origin),o.port=n;try{o.port.onmessage=O,o.port.start?.()}catch{}s({type:`READY`,payload:{protocolVersion:l}})}}})}try{X()}catch(e){console.error(`[WalletHost] init failed`,e)}export{X as t};