@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/signingLanes/cloudflareLaneCurveExecution.js

@@ -0,0 +1,597 @@
+import { buildMpcMaterialActivationRef, mpcMaterialActivationRefsEqual, parseMpcSigningWorkerRef } from "../../../shared-ts/src/utils/domainIds.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { sha256Bytes } from "../../../shared-ts/src/utils/digests.js";
+import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
+import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { parseEcdsaLifecycleId } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
+import { parseLaneProtocolCommitReceiptV1, parseLaneServerActivationReceiptV1, parseRevokeSigningLaneV1 } from "../../../shared-ts/src/signing-lanes/rotationParsers.js";
+import { encodeLaneProtocolCommitReceiptV1 } from "../../../shared-ts/src/signing-lanes/rotationDigests.js";
+import { buildEcdsaServerRetirementRequestV1, parseAndVerifyEcdsaServerRetirementEffectV1 } from "../../../core/signingLanes/ecdsaServerRetirement.js";
+import { buildEd25519ServerRetirementRequestV1, parseAndVerifyEd25519ServerRetirementEffectV1 } from "../../../core/signingLanes/ed25519ServerRetirement.js";
+//#region src/router/cloudflare/signingLanes/cloudflareLaneCurveExecution.ts
+const CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_EXECUTE_PATH_V1 = "/router-ab/internal/signing-worker/ecdsa-additive-lane/execute";
+const CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_ACTIVATE_PATH_V1 = "/router-ab/internal/signing-worker/ecdsa-additive-lane/activate";
+const CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_LANE_ACTIVATE_PATH_V1 = "/router-ab/internal/signing-worker/ed25519-yao-lane/activate";
+const CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_RETIRE_PATH_V1 = "/router-ab/internal/signing-worker/ecdsa-additive-lane/retire";
+const CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_LANE_RETIRE_PATH_V1 = "/router-ab/internal/signing-worker/ed25519-yao-lane/retire";
+var LaneLifecycleStoreEd25519LanePrivateBindingResolverV1 = class {
+	constructor(lifecycleStore) {
+		this.lifecycleStore = lifecycleStore;
+	}
+	async resolveRetirementBindingV1(input) {
+		const product = await this.lifecycleStore.getProductEpoch({
+			walletId: input.command.walletId,
+			walletKeyId: input.command.walletKeyId,
+			laneId: input.command.laneId,
+			laneShareEpoch: input.command.laneShareEpoch
+		});
+		if (product === null || product.keyFamily !== "ed25519" || product.state !== "active" && product.state !== "revocation_pending" && product.state !== "revoked" || !retirementProductMatchesCommandV1(product, input.command)) throw new Error("Ed25519 retirement source product is not the exact active epoch");
+		const protocol = await this.lifecycleStore.getProtocol(product.operationId);
+		if (protocol === null || protocol.value.lifecycle.state !== "active" || protocol.value.job.keyFamily !== "ed25519") throw new Error("Ed25519 retirement protocol is not active");
+		return { identity: ed25519IdentityFromActiveProductV1(product, protocol.value.lifecycle) };
+	}
+};
+var LaneLifecycleStoreEcdsaLanePrivateBindingResolverV1 = class {
+	constructor(lifecycleStore, walletRegistration) {
+		this.lifecycleStore = lifecycleStore;
+		this.walletRegistration = walletRegistration;
+	}
+	async resolveSourceMaterialV1(input) {
+		const product = await this.lifecycleStore.getProductEpoch({
+			walletId: input.job.walletId,
+			walletKeyId: input.job.walletKeyId,
+			laneId: input.job.source.laneId,
+			laneShareEpoch: input.job.source.laneShareEpoch
+		});
+		if (input.job.source.sourceKind === "owner_registration") {
+			if (product !== null) throw new Error("ECDSA registration-backed source conflicts with a lane product epoch");
+			const signer = await resolveOwnerEcdsaSourceSignerV1({
+				walletRegistration: this.walletRegistration,
+				job: input.job
+			});
+			return {
+				kind: "registration_activation",
+				lookup: {
+					accountId: input.job.walletId,
+					materialActivationId: input.job.source.materialActivation.activationId,
+					signingWorkerId: String(input.job.source.ownerParticipantContinuity.signingWorkerId)
+				},
+				sourceDerivation: {
+					applicationBindingDigestB64u: signer.walletKey.publicCapability.context.application_binding_digest_b64u,
+					clientShareRetryCounter: signer.walletKey.publicCapability.public_identity.client_share_retry_counter
+				}
+			};
+		}
+		if (product === null) throw new Error("ECDSA lane-backed source product epoch is missing");
+		if (product.state !== "active" || product.keyFamily !== "ecdsa_secp256k1" || product.holderParticipant.participantId !== input.job.source.holderParticipantId || product.signingWorkerParticipant.participantId !== input.job.source.signingWorkerParticipantId || product.signingWorkerParticipant.recipientKeyId !== input.job.source.signingWorkerRecipientKeyId || !mpcMaterialActivationRefsEqual(product.materialActivation, input.job.source.materialActivation)) throw new Error("ECDSA source product epoch does not match the admitted job");
+		const protocol = await this.lifecycleStore.getProtocol(product.operationId);
+		if (protocol === null || protocol.value.lifecycle.state !== "active") throw new Error("ECDSA source product protocol is not active");
+		const identity = identityFromActiveProductV1(product, protocol.value.lifecycle);
+		return {
+			kind: "lane_material",
+			lookup: {
+				identity,
+				admittedLaneIdentityDigestB64u: await digestSigningWorkerLaneIdentityV1(identity)
+			}
+		};
+	}
+	async resolveActivationBindingV1(input) {
+		const receipt = parseLaneProtocolCommitReceiptV1(input.protocolCommitReceipt);
+		return {
+			identity: await identityFromProtocolReceiptV1(input.job, receipt),
+			targetMaterialActivation: buildMpcMaterialActivationRef({
+				activationId: input.job.targetMaterialActivationId,
+				capability: input.job.source.materialActivation.capability,
+				materialOwner: input.job.source.materialActivation.materialOwner,
+				keyBinding: input.job.source.materialActivation.keyBinding,
+				lifecycleBinding: input.job.source.materialActivation.lifecycleBinding,
+				signingWorker: targetSigningWorkerRefV1(input.job)
+			})
+		};
+	}
+	async resolveRetirementBindingV1(input) {
+		const product = await this.lifecycleStore.getProductEpoch({
+			walletId: input.command.walletId,
+			walletKeyId: input.command.walletKeyId,
+			laneId: input.command.laneId,
+			laneShareEpoch: input.command.laneShareEpoch
+		});
+		if (product === null || product.keyFamily !== "ecdsa_secp256k1" || product.state !== "active" && product.state !== "revocation_pending" && product.state !== "revoked" || !retirementProductMatchesCommandV1(product, input.command)) throw new Error("ECDSA retirement source product is not the exact active epoch");
+		const protocol = await this.lifecycleStore.getProtocol(product.operationId);
+		if (protocol === null || protocol.value.lifecycle.state !== "active" || protocol.value.job.keyFamily !== "ecdsa_secp256k1") throw new Error("ECDSA retirement protocol is not active");
+		const job = protocol.value.job;
+		return {
+			identity: identityFromActiveProductV1(product, protocol.value.lifecycle),
+			manifest: {
+				manifestId: job.targetCapability.manifestId,
+				manifestRevision: job.targetCapability.manifestRevision
+			},
+			materialActivation: product.materialActivation,
+			serverGeneration: job.sourceCapability.serverGeneration,
+			lifecycleId: parseEcdsaLifecycleId(product.materialActivation.lifecycleBinding)
+		};
+	}
+};
+function targetSigningWorkerRefV1(job) {
+	const parsed = parseMpcSigningWorkerRef(job.targetSigningWorker.participantId);
+	if (!parsed.ok) throw new Error(`ECDSA target SigningWorker is invalid: ${parsed.error.message}`);
+	return parsed.value;
+}
+async function resolveOwnerEcdsaSourceSignerV1(input) {
+	const signers = await input.walletRegistration.listWalletEcdsaCustodyContinuity({ walletId: input.job.walletId });
+	const expectedMaterialActivation = routerAbMpcMaterialActivationRefToWire(input.job.source.materialActivation);
+	const matching = matchingOwnerEcdsaSourceSignersV1({
+		signers,
+		job: input.job,
+		expectedMaterialActivation
+	});
+	const first = matching[0];
+	if (!first) throw new Error("authoritative ECDSA registration source signer is unavailable");
+	const firstContext = first.walletKey.publicCapability.context.application_binding_digest_b64u;
+	const firstClientRetry = first.walletKey.publicCapability.public_identity.client_share_retry_counter;
+	for (const signer of matching.slice(1)) if (signer.walletKey.publicCapability.context.application_binding_digest_b64u !== firstContext || signer.walletKey.publicCapability.public_identity.client_share_retry_counter !== firstClientRetry) throw new Error("authoritative ECDSA registration source signer records conflict");
+	return first;
+}
+function matchingOwnerEcdsaSourceSignersV1(input) {
+	const matching = [];
+	for (const signer of input.signers) {
+		if (signer.walletId !== input.job.walletId || signer.walletKey.ecdsaThresholdKeyId !== String(input.job.sourceCapability.ecdsaThresholdKeyId) || signer.walletKey.relayerKeyId !== String(input.job.sourceCapability.relayerKeyId) || signer.walletKey.derivationClientSharePublicKey33B64u !== input.job.sourceHolderVerifyingShare33B64u || signer.walletKey.relayerVerifyingShareB64u !== input.job.sourceServerVerifyingShare33B64u || !sameRouterAbMpcMaterialActivationRef(signer.walletKey.publicCapability.material_activation, input.expectedMaterialActivation)) continue;
+		matching.push(signer);
+	}
+	return matching;
+}
+var CloudflareSigningWorkerEcdsaRetirementTransportV1 = class {
+	constructor(options) {
+		this.options = options;
+		this.internalServiceAuth = requiredText(options.internalServiceAuth, "internalServiceAuth");
+	}
+	async retireServerMaterialV1(input) {
+		if (input.curve === "ed25519_yao") {
+			const binding = await this.options.ed25519BindingResolver.resolveRetirementBindingV1({ command: input.command });
+			const request = buildEd25519ServerRetirementRequestV1({
+				command: input.command,
+				binding
+			});
+			const effect = await parseAndVerifyEd25519ServerRetirementEffectV1({
+				raw: await postSigningWorkerJsonV1({
+					binding: this.options.signingWorker,
+					internalServiceAuth: this.internalServiceAuth,
+					path: CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_LANE_RETIRE_PATH_V1,
+					body: request
+				}),
+				request
+			});
+			return {
+				kind: "signing_worker_lane_retirement_projection_v1",
+				outcome: effect.outcome,
+				command: input.command,
+				retirementEffectBindingDigestB64u: effect.retirementEffectBindingDigestB64u,
+				retirementReceipt: effect.receipt
+			};
+		}
+		const binding = await this.options.bindingResolver.resolveRetirementBindingV1({ command: input.command });
+		const request = buildEcdsaServerRetirementRequestV1({
+			command: input.command,
+			binding
+		});
+		const effect = await parseAndVerifyEcdsaServerRetirementEffectV1({
+			raw: await postSigningWorkerJsonV1({
+				binding: this.options.signingWorker,
+				internalServiceAuth: this.internalServiceAuth,
+				path: CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_RETIRE_PATH_V1,
+				body: request
+			}),
+			expectation: {
+				manifest: binding.manifest,
+				materialActivation: binding.materialActivation,
+				walletKeyId: input.command.walletKeyId,
+				laneId: input.command.laneId,
+				laneShareEpoch: input.command.laneShareEpoch,
+				revocationEpoch: input.command.expectedRevocationEpoch,
+				retirementReason: request.retirementReason,
+				retirementCorrelationId: request.retirementCorrelationId,
+				retirementRequestDigestB64u: request.retirementRequestDigestB64u,
+				serverGeneration: binding.serverGeneration,
+				lifecycleId: binding.lifecycleId,
+				retirementEffectBindingDigestB64u: request.retirementEffectBindingDigestB64u
+			}
+		});
+		return {
+			kind: "signing_worker_lane_retirement_projection_v1",
+			outcome: effect.outcome,
+			command: input.command,
+			retirementEffectBindingDigestB64u: effect.retirementEffectBindingDigestB64u,
+			retirementReceipt: effect.receipt
+		};
+	}
+};
+var CloudflareSigningWorkerEcdsaLaneTransportV1 = class {
+	constructor(options) {
+		this.options = options;
+		this.internalServiceAuth = requiredText(options.internalServiceAuth, "internalServiceAuth");
+	}
+	async commitEcdsaProtocolV1(input) {
+		const sourceMaterial = await this.options.bindingResolver.resolveSourceMaterialV1({ job: input.job });
+		const holderPackage = parseJsonRecord(input.holderPackage.ecdsaEncryptedMaterialEnvelopeJson, "holderPackage.ecdsaEncryptedMaterialEnvelopeJson");
+		const encryptedDelta = parseJsonRecord(input.encryptedDeltaPackageJson, "encryptedDeltaPackageJson");
+		const effect = exactRecord(await postSigningWorkerJsonV1({
+			binding: this.options.signingWorker,
+			internalServiceAuth: this.internalServiceAuth,
+			path: CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_EXECUTE_PATH_V1,
+			body: {
+				job: input.job,
+				holderRound: input.holderRound,
+				holderPackage,
+				encryptedDelta,
+				sourceMaterial: sourceMaterialWireV1(sourceMaterial)
+			}
+		}), ["outcome", "receipt"], "ecdsaLaneExecuteEffect");
+		return {
+			kind: "signing_worker_lane_protocol_commit_projection_v1",
+			outcome: parseMutationOutcome(Reflect.get(effect, "outcome"), "ecdsaLaneExecuteEffect.outcome"),
+			receipt: parseLaneProtocolCommitReceiptV1(Reflect.get(effect, "receipt"))
+		};
+	}
+	async activateServerMaterialV1(input) {
+		const binding = input.curve === "ecdsa_additive" ? await this.options.bindingResolver.resolveActivationBindingV1({
+			job: input.job,
+			protocolCommitReceipt: input.protocolCommitReceipt
+		}) : await buildEd25519ActivationBindingV1({
+			job: input.job,
+			protocolCommitReceipt: input.protocolCommitReceipt
+		});
+		const effect = exactRecord(await postSigningWorkerJsonV1({
+			binding: this.options.signingWorker,
+			internalServiceAuth: this.internalServiceAuth,
+			path: input.curve === "ecdsa_additive" ? CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_ACTIVATE_PATH_V1 : CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_LANE_ACTIVATE_PATH_V1,
+			body: {
+				identity: binding.identity,
+				targetMaterialActivation: binding.targetMaterialActivation,
+				holderDeliveryReceipt: input.holderDeliveryReceipt
+			}
+		}), ["outcome", "receipt"], input.curve === "ecdsa_additive" ? "ecdsaLaneActivateEffect" : "ed25519LaneActivateEffect");
+		return {
+			kind: "signing_worker_lane_server_activation_projection_v1",
+			outcome: parseMutationOutcome(Reflect.get(effect, "outcome"), input.curve === "ecdsa_additive" ? "ecdsaLaneActivateEffect.outcome" : "ed25519LaneActivateEffect.outcome"),
+			receipt: parseLaneServerActivationReceiptV1(Reflect.get(effect, "receipt"))
+		};
+	}
+	async retireServerMaterialV1(input) {
+		return await this.options.retirementTransport.retireServerMaterialV1(input);
+	}
+};
+function sourceMaterialWireV1(source) {
+	switch (source.kind) {
+		case "lane_material": return source;
+		case "registration_activation": return {
+			kind: source.kind,
+			lookup: {
+				account_id: source.lookup.accountId,
+				material_activation_id: source.lookup.materialActivationId,
+				signing_worker_id: source.lookup.signingWorkerId
+			},
+			sourceDerivation: {
+				application_binding_digest_b64u: source.sourceDerivation.applicationBindingDigestB64u,
+				client_share_retry_counter: source.sourceDerivation.clientShareRetryCounter
+			}
+		};
+	}
+}
+function createCloudflareLaneCurveExecutionPortsV1(options) {
+	return {
+		ed25519: {
+			async executeProtocolCommitV1(input) {
+				return parseLaneProtocolCommitReceiptV1((await options.ed25519Transport.executeProtocolCommitV1(input)).receipt);
+			},
+			async executeServerActivationV1(input) {
+				const projection = await options.signingWorker.activateServerMaterialV1({
+					curve: "ed25519_yao",
+					...input
+				});
+				requireProjection(projection, "signing_worker_lane_server_activation_projection_v1");
+				return parseLaneServerActivationReceiptV1(projection.receipt);
+			},
+			async executeServerRetirementV1(input) {
+				return retirementExecution(await options.signingWorker.retireServerMaterialV1({
+					curve: "ed25519_yao",
+					command: input.command
+				}));
+			}
+		},
+		ecdsa: {
+			async executeProtocolCommitV1(input) {
+				const projection = await options.signingWorker.commitEcdsaProtocolV1(input);
+				requireProjection(projection, "signing_worker_lane_protocol_commit_projection_v1");
+				return parseLaneProtocolCommitReceiptV1(projection.receipt);
+			},
+			async executeServerActivationV1(input) {
+				const projection = await options.signingWorker.activateServerMaterialV1({
+					curve: "ecdsa_additive",
+					...input
+				});
+				requireProjection(projection, "signing_worker_lane_server_activation_projection_v1");
+				return parseLaneServerActivationReceiptV1(projection.receipt);
+			},
+			async executeServerRetirementV1(input) {
+				return retirementExecution(await options.signingWorker.retireServerMaterialV1({
+					curve: "ecdsa_additive",
+					command: input.command
+				}));
+			}
+		}
+	};
+}
+function retirementExecution(projection) {
+	requireProjection(projection, "signing_worker_lane_retirement_projection_v1");
+	const command = parseRevokeSigningLaneV1(projection.command);
+	if (typeof projection.retirementEffectBindingDigestB64u !== "string" || projection.retirementEffectBindingDigestB64u.length === 0) throw new Error("SigningWorker lane retirement effect binding digest is invalid");
+	return {
+		kind: "lane_lifecycle_retirement_execution_v1",
+		command,
+		retirementEffectBindingDigestB64u: parseDigestB64u(projection.retirementEffectBindingDigestB64u),
+		retirementReceipt: projection.retirementReceipt
+	};
+}
+function requireProjection(projection, expectedKind) {
+	if (projection.kind !== expectedKind) throw new Error("SigningWorker lane material projection kind is invalid");
+	if (projection.outcome !== "applied" && projection.outcome !== "replayed") throw new Error("SigningWorker lane material projection outcome is invalid");
+}
+function requiredText(value, label) {
+	const normalized = value.trim();
+	if (normalized.length === 0) throw new Error(`${label} is required`);
+	return normalized;
+}
+function requiredTextValue(value, label) {
+	if (typeof value !== "string") throw new Error(`${label} must be a string`);
+	return requiredText(value, label);
+}
+/**
+* Resolves one exact active child product before a normal-signing request is
+* forwarded to SigningWorker. The resolver deliberately requires immutable
+* lane coordinates and the full activation reference; activation IDs alone
+* cannot select a private lane artifact.
+*/
+var LaneLifecycleStoreNormalSigningLaneMaterialResolverV1 = class {
+	constructor(lifecycleStore) {
+		this.lifecycleStore = lifecycleStore;
+	}
+	async resolveV1(input) {
+		const product = await this.lifecycleStore.getProductEpoch(input.lookup);
+		if (product === null || product.state !== "active" || product.keyFamily !== input.keyFamily || !mpcMaterialActivationRefsEqual(product.materialActivation, input.materialActivation) || product.targetMaterialActivationId !== input.materialActivation.activationId) throw new Error("normal-signing lane product is not the exact active child");
+		const enrollment = await this.lifecycleStore.getEnrollment(product.enrollmentId);
+		if (enrollment === null || enrollment.value.lifecycle.state !== "active" || enrollment.value.lifecycle.manifestDigestB64u !== product.aggregateManifestDigestB64u) throw new Error("normal-signing lane enrollment is not active for the child product");
+		const protocol = await this.lifecycleStore.getProtocol(product.operationId);
+		if (protocol === null || protocol.value.lifecycle.state !== "active" || protocol.value.job.keyFamily !== product.keyFamily) throw new Error("normal-signing lane protocol is not active for the child product");
+		assertActiveLaneProtocolMatchesProductV1(product, protocol.value.job);
+		const identity = signingWorkerIdentityFromActiveProductV1(product, protocol.value.lifecycle);
+		return {
+			product,
+			source: {
+				kind: "rotatable_lane",
+				lookup: {
+					identity,
+					admittedLaneIdentityDigestB64u: await digestSigningWorkerLaneIdentityV1(identity)
+				},
+				group_public_key: groupPublicKeyFromLaneJobV1(protocol.value.job)
+			}
+		};
+	}
+};
+function assertActiveLaneProtocolMatchesProductV1(product, job) {
+	if (job.operationId !== product.operationId || job.enrollmentId !== product.enrollmentId || job.walletId !== product.walletId || job.walletKeyId !== product.walletKeyId || job.target.laneId !== product.laneId || job.target.laneShareEpoch !== product.laneShareEpoch || job.targetMaterialActivationId !== product.targetMaterialActivationId || job.target.laneKind !== product.laneKind || job.keyFamily !== product.keyFamily || job.targetHolder.participantId !== product.holderParticipant.participantId || job.targetHolder.participantBindingDigestB64u !== product.holderParticipant.participantBindingDigestB64u || job.targetHolder.hpkePublicKeyDigestB64u !== product.holderParticipant.hpkePublicKeyDigestB64u || job.targetSigningWorker.participantId !== product.signingWorkerParticipant.participantId || job.targetSigningWorker.participantBindingDigestB64u !== product.signingWorkerParticipant.participantBindingDigestB64u || job.targetSigningWorker.recipientKeyId !== product.signingWorkerParticipant.recipientKeyId || job.targetSigningWorker.hpkePublicKeyDigestB64u !== product.signingWorkerParticipant.hpkePublicKeyDigestB64u) throw new Error("normal-signing lane protocol does not match the active child product");
+}
+function signingWorkerIdentityFromActiveProductV1(product, lifecycle) {
+	return product.keyFamily === "ed25519" ? ed25519IdentityFromActiveProductV1(product, lifecycle) : identityFromActiveProductV1(product, lifecycle);
+}
+function groupPublicKeyFromLaneJobV1(job) {
+	if (job.keyFamily === "ecdsa_secp256k1") return requiredText(job.thresholdPublicKey33B64u, "ECDSA lane threshold public key");
+	const registeredPublicKey = base64UrlDecode(job.registeredPublicKeyB64u);
+	if (registeredPublicKey.length !== 32) throw new Error("Ed25519 lane registered public key must be 32 bytes");
+	return `ed25519:${base58Encode(registeredPublicKey)}`;
+}
+function identityFromActiveProductV1(product, lifecycle) {
+	if (product.keyFamily !== "ecdsa_secp256k1") throw new Error("ECDSA source product has the wrong key family");
+	return {
+		operationId: product.operationId,
+		enrollmentId: product.enrollmentId,
+		walletId: product.walletId,
+		walletKeyId: product.walletKeyId,
+		targetLaneId: product.laneId,
+		targetLaneShareEpoch: product.laneShareEpoch,
+		targetMaterialActivationId: product.targetMaterialActivationId,
+		keyFamily: "ecdsa_secp256k1",
+		holderParticipantBindingDigestB64u: product.holderParticipant.participantBindingDigestB64u,
+		signingWorkerParticipantBindingDigestB64u: product.signingWorkerParticipant.participantBindingDigestB64u,
+		holderRecipientKeyDigestB64u: product.holderParticipant.hpkePublicKeyDigestB64u,
+		serverRecipientKeyDigestB64u: product.signingWorkerParticipant.hpkePublicKeyDigestB64u,
+		transcriptHashB64u: parseDigestB64u(lifecycle.transcriptHashB64u),
+		protocolCommitReceiptDigestB64u: parseDigestB64u(lifecycle.protocolCommitReceiptDigestB64u)
+	};
+}
+function ed25519IdentityFromActiveProductV1(product, lifecycle) {
+	if (product.keyFamily !== "ed25519") throw new Error("Ed25519 source product has the wrong key family");
+	return {
+		operationId: product.operationId,
+		enrollmentId: product.enrollmentId,
+		walletId: product.walletId,
+		walletKeyId: product.walletKeyId,
+		targetLaneId: product.laneId,
+		targetLaneShareEpoch: product.laneShareEpoch,
+		targetMaterialActivationId: product.targetMaterialActivationId,
+		keyFamily: "ed25519",
+		holderParticipantBindingDigestB64u: product.holderParticipant.participantBindingDigestB64u,
+		signingWorkerParticipantBindingDigestB64u: product.signingWorkerParticipant.participantBindingDigestB64u,
+		holderRecipientKeyDigestB64u: product.holderParticipant.hpkePublicKeyDigestB64u,
+		serverRecipientKeyDigestB64u: product.signingWorkerParticipant.hpkePublicKeyDigestB64u,
+		transcriptHashB64u: parseDigestB64u(lifecycle.transcriptHashB64u),
+		protocolCommitReceiptDigestB64u: parseDigestB64u(lifecycle.protocolCommitReceiptDigestB64u)
+	};
+}
+function retirementProductMatchesCommandV1(product, command) {
+	if (product.state === "active") return product.revocationEpoch === command.expectedRevocationEpoch;
+	return product.revocationEpoch === command.expectedRevocationEpoch + 1 && product.retirementEffectBindingDigestB64u === command.retirementEffectBindingDigestB64u;
+}
+async function identityFromProtocolReceiptV1(job, receipt) {
+	if (receipt.operationId !== job.operationId || receipt.enrollmentId !== job.enrollmentId || receipt.walletId !== job.walletId || receipt.walletKeyId !== job.walletKeyId || receipt.targetLaneId !== job.target.laneId || receipt.targetLaneShareEpoch !== job.target.laneShareEpoch || receipt.targetMaterialActivationId !== job.targetMaterialActivationId || receipt.keyFamily !== "ecdsa_secp256k1") throw new Error("ECDSA protocol receipt does not match the admitted job");
+	return {
+		operationId: job.operationId,
+		enrollmentId: job.enrollmentId,
+		walletId: job.walletId,
+		walletKeyId: job.walletKeyId,
+		targetLaneId: job.target.laneId,
+		targetLaneShareEpoch: job.target.laneShareEpoch,
+		targetMaterialActivationId: job.targetMaterialActivationId,
+		keyFamily: "ecdsa_secp256k1",
+		holderParticipantBindingDigestB64u: job.targetHolder.participantBindingDigestB64u,
+		signingWorkerParticipantBindingDigestB64u: job.targetSigningWorker.participantBindingDigestB64u,
+		holderRecipientKeyDigestB64u: job.targetHolder.hpkePublicKeyDigestB64u,
+		serverRecipientKeyDigestB64u: job.targetSigningWorker.hpkePublicKeyDigestB64u,
+		transcriptHashB64u: parseDigestB64u(receipt.transcriptHashB64u),
+		protocolCommitReceiptDigestB64u: parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeLaneProtocolCommitReceiptV1(receipt))))
+	};
+}
+async function buildEd25519ActivationBindingV1(input) {
+	const receipt = parseLaneProtocolCommitReceiptV1(input.protocolCommitReceipt);
+	if (receipt.operationId !== input.job.operationId || receipt.enrollmentId !== input.job.enrollmentId || receipt.walletId !== input.job.walletId || receipt.walletKeyId !== input.job.walletKeyId || receipt.targetLaneId !== input.job.target.laneId || receipt.targetLaneShareEpoch !== input.job.target.laneShareEpoch || receipt.targetMaterialActivationId !== input.job.targetMaterialActivationId || receipt.keyFamily !== "ed25519") throw new Error("Ed25519 protocol receipt does not match the admitted job");
+	const targetSigningWorker = parseMpcSigningWorkerRef(input.job.targetSigningWorker.participantId);
+	if (!targetSigningWorker.ok) throw new Error(`Ed25519 target SigningWorker is invalid: ${targetSigningWorker.error.message}`);
+	return {
+		identity: {
+			operationId: input.job.operationId,
+			enrollmentId: input.job.enrollmentId,
+			walletId: input.job.walletId,
+			walletKeyId: input.job.walletKeyId,
+			targetLaneId: input.job.target.laneId,
+			targetLaneShareEpoch: input.job.target.laneShareEpoch,
+			targetMaterialActivationId: input.job.targetMaterialActivationId,
+			keyFamily: "ed25519",
+			holderParticipantBindingDigestB64u: input.job.targetHolder.participantBindingDigestB64u,
+			signingWorkerParticipantBindingDigestB64u: input.job.targetSigningWorker.participantBindingDigestB64u,
+			holderRecipientKeyDigestB64u: input.job.targetHolder.hpkePublicKeyDigestB64u,
+			serverRecipientKeyDigestB64u: input.job.targetSigningWorker.hpkePublicKeyDigestB64u,
+			transcriptHashB64u: parseDigestB64u(receipt.transcriptHashB64u),
+			protocolCommitReceiptDigestB64u: parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeLaneProtocolCommitReceiptV1(receipt))))
+		},
+		targetMaterialActivation: buildMpcMaterialActivationRef({
+			activationId: input.job.targetMaterialActivationId,
+			capability: input.job.source.materialActivation.capability,
+			materialOwner: input.job.source.materialActivation.materialOwner,
+			keyBinding: input.job.source.materialActivation.keyBinding,
+			lifecycleBinding: input.job.source.materialActivation.lifecycleBinding,
+			signingWorker: targetSigningWorker.value
+		})
+	};
+}
+async function digestSigningWorkerLaneIdentityV1(identity) {
+	const encoder = new TextEncoder();
+	const chunks = [encoder.encode("seams/signing-worker/lane-material-identity/v1")];
+	for (const value of [
+		identity.operationId,
+		identity.enrollmentId,
+		identity.walletId,
+		identity.walletKeyId,
+		identity.targetLaneId,
+		identity.targetLaneShareEpoch,
+		identity.targetMaterialActivationId,
+		identity.keyFamily,
+		identity.holderParticipantBindingDigestB64u,
+		identity.signingWorkerParticipantBindingDigestB64u,
+		identity.holderRecipientKeyDigestB64u,
+		identity.serverRecipientKeyDigestB64u,
+		identity.transcriptHashB64u,
+		identity.protocolCommitReceiptDigestB64u
+	]) {
+		const encoded = encoder.encode(value);
+		chunks.push(u64Length(encoded.length), encoded);
+	}
+	let length = 0;
+	for (const chunk of chunks) length += chunk.length;
+	const bytes = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return parseDigestB64u(base64UrlEncode(await sha256Bytes(bytes)));
+}
+function u64Length(value) {
+	let remaining = BigInt(value);
+	const bytes = new Uint8Array(8);
+	for (let index = 7; index >= 0; index -= 1) {
+		bytes[index] = Number(remaining & 255n);
+		remaining >>= 8n;
+	}
+	return bytes;
+}
+function parseJsonRecord(value, label) {
+	let parsed;
+	try {
+		parsed = JSON.parse(requiredText(value, label));
+	} catch {
+		throw new Error(`${label} must contain valid JSON`);
+	}
+	const record = exactObject(parsed, [
+		"kind",
+		"recipientPublicKeyB64u",
+		"aadDigestB64u",
+		"encappedKeyB64u",
+		"ciphertextB64u"
+	], label);
+	if (Reflect.get(record, "kind") !== "ecdsa_additive_lane_encrypted_payload_v1") throw new Error(`${label}.kind is invalid`);
+	return {
+		kind: "ecdsa_additive_lane_encrypted_payload_v1",
+		recipientPublicKeyB64u: requiredTextValue(Reflect.get(record, "recipientPublicKeyB64u"), `${label}.recipientPublicKeyB64u`),
+		aadDigestB64u: requiredTextValue(Reflect.get(record, "aadDigestB64u"), `${label}.aadDigestB64u`),
+		encappedKeyB64u: requiredTextValue(Reflect.get(record, "encappedKeyB64u"), `${label}.encappedKeyB64u`),
+		ciphertextB64u: requiredTextValue(Reflect.get(record, "ciphertextB64u"), `${label}.ciphertextB64u`)
+	};
+}
+function requireObject(value, label) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} must be an object`);
+	return value;
+}
+function exactObject(value, fields, label) {
+	const record = requireObject(value, label);
+	const allowed = new Set(fields);
+	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is unsupported`);
+	for (const field of fields) if (!Object.hasOwn(record, field)) throw new Error(`${label}.${field} is required`);
+	return record;
+}
+function exactRecord(value, fields, label) {
+	return exactObject(value, fields, label);
+}
+function parseMutationOutcome(value, label) {
+	if (value === "applied" || value === "replayed") return value;
+	throw new Error(`${label} is invalid`);
+}
+async function postSigningWorkerJsonV1(input) {
+	const response = await input.binding.fetch(new Request(`https://signing-worker.router-ab.internal${input.path}`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			"x-router-ab-internal-service-auth": input.internalServiceAuth
+		},
+		body: JSON.stringify(input.body)
+	}));
+	const body = await response.text();
+	if (!response.ok) {
+		const detail = boundedSigningWorkerErrorBodyV1(body);
+		throw new Error(detail ? `SigningWorker lane endpoint returned HTTP ${response.status}: ${detail}` : `SigningWorker lane endpoint returned HTTP ${response.status}`);
+	}
+	try {
+		return body.length === 0 ? null : JSON.parse(body);
+	} catch {
+		throw new Error("SigningWorker lane endpoint returned invalid JSON");
+	}
+}
+const SIGNING_WORKER_ERROR_BODY_LIMIT_V1 = 512;
+function boundedSigningWorkerErrorBodyV1(body) {
+	const normalized = body.trim().replace(/\s+/g, " ");
+	if (normalized.length <= SIGNING_WORKER_ERROR_BODY_LIMIT_V1) return normalized;
+	return `${normalized.slice(0, SIGNING_WORKER_ERROR_BODY_LIMIT_V1 - 1)}…`;
+}
+//#endregion
+export { CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_ACTIVATE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_RETIRE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_LANE_ACTIVATE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_LANE_RETIRE_PATH_V1, CloudflareSigningWorkerEcdsaLaneTransportV1, CloudflareSigningWorkerEcdsaRetirementTransportV1, LaneLifecycleStoreEcdsaLanePrivateBindingResolverV1, LaneLifecycleStoreEd25519LanePrivateBindingResolverV1, LaneLifecycleStoreNormalSigningLaneMaterialResolverV1, createCloudflareLaneCurveExecutionPortsV1, digestSigningWorkerLaneIdentityV1 };
+
+//# sourceMappingURL=cloudflareLaneCurveExecution.js.map