@seams/wallet-server 0.5.0

package/dist/esm/router/domains/ecdsa/routerAbEcdsaStrictRegistration.js

@@ -0,0 +1,738 @@
+import { parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1, parseRouterAbEcdsaDerivationActivationRefreshResponseV1, parseRouterAbEcdsaDerivationExplicitExportRequestV1, parseRouterAbEcdsaExplicitExportProtocolForwardedResponseV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, projectRouterAbEcdsaDerivationExplicitExportRequestToProtocolV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
+//#region src/router/domains/ecdsa/routerAbEcdsaStrictRegistration.ts
+const STRICT_ECDSA_REGISTRATION_PATH = "/router-ab/ecdsa-derivation/register";
+const STRICT_ECDSA_ADD_SIGNER_PATH = "/router-ab/ecdsa-derivation/add-signer";
+const STRICT_ECDSA_ACTIVATION_PATH = "/router-ab/ecdsa-derivation/activate";
+const STRICT_ECDSA_EXPORT_PATH = "/router-ab/ecdsa-derivation/export";
+const STRICT_ECDSA_REFRESH_PATH = "/router-ab/ecdsa-derivation/refresh";
+const STRICT_ECDSA_POST_REGISTRATION_POLICY_VERSION = "router-ab-ecdsa-post-registration-request-policy-v1";
+const JSON_CONTENT_TYPE = "application/json; charset=utf-8";
+var StrictRegistrationForwarder = class {
+	constructor(config) {
+		this.config = config;
+	}
+	topology() {
+		return this.config.topology;
+	}
+	async registerWithTenantRoot(input) {
+		const authorityFailure = validateRegistrationAuthorityBinding(input);
+		if (authorityFailure) return authorityFailure;
+		const tenantRootFailure = validateRegistrationTenantRoot(input.tenantRoot);
+		if (tenantRootFailure) return tenantRootFailure;
+		const body = await this.forward({
+			kind: "tenant_root_registration",
+			path: strictRegistrationPath(input.request.registration_purpose),
+			authority: input.authority,
+			requestPolicy: input.requestPolicy,
+			request: input.request,
+			tenantRoot: input.tenantRoot,
+			traceContext: input.traceContext,
+			onServerTiming: input.onServerTiming,
+			onHeaderPresence: input.onHeaderPresence
+		});
+		if (!body.ok) return body;
+		return parseStrictRegistrationForwardingResult(body.value);
+	}
+	async activate(input) {
+		const body = await this.forward({
+			kind: "activation",
+			path: STRICT_ECDSA_ACTIVATION_PATH,
+			authority: input.authority,
+			activationCorrelationId: input.activationCorrelationId,
+			requestPolicy: input.requestPolicy,
+			pendingActivation: input.pendingActivation,
+			clientActivation: input.clientActivation,
+			traceContext: input.traceContext,
+			onServerTiming: input.onServerTiming,
+			onHeaderPresence: input.onHeaderPresence
+		});
+		if (!body.ok) return body;
+		try {
+			const rawReceipt = exactObject(body.value, [
+				"ecdsa_activation",
+				"lifecycle_id",
+				"transcript_digest",
+				"activated"
+			]);
+			const activationDigestB64u = nonEmptyString(objectValue(rawReceipt?.ecdsa_activation)?.activation_digest_b64u);
+			const requestDigestB64u = base64UrlString(input.activationRequestDigestB64u, 32);
+			if (!rawReceipt || rawReceipt.activated !== true || !activationDigestB64u || !requestDigestB64u) throw new Error("MPCRouter returned an incomplete ECDSA activation receipt");
+			const receipt = parseRouterAbEcdsaRegistrationActivationReceiptV1({
+				activation_correlation_id: input.activationCorrelationId,
+				activation_request_digest: { bytes: Array.from(decodeBase64Url(requestDigestB64u)) },
+				server_generation: `ecdsa-server-generation-v1:${activationDigestB64u}`,
+				ecdsa_activation: rawReceipt.ecdsa_activation,
+				lifecycle_id: rawReceipt.lifecycle_id,
+				transcript_digest: rawReceipt.transcript_digest
+			});
+			if (receipt.activation_correlation_id !== input.activationCorrelationId) throw new Error("MPCRouter activation receipt changed the journal correlation");
+			return {
+				ok: true,
+				value: receipt
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "mpc_router_activation_response_invalid",
+				message: errorMessage(error, "MPCRouter returned an invalid ECDSA activation receipt"),
+				retryable: false
+			};
+		}
+	}
+	async forward(input) {
+		const requestPolicy = parseRegistrationRequestPolicy(input.requestPolicy);
+		if (!requestPolicy) return {
+			ok: false,
+			code: "strict_registration_request_policy_invalid",
+			message: "Strict ECDSA registration request policy is invalid",
+			retryable: false
+		};
+		const headers = {
+			authorization: `Bearer ${await this.config.tokenIssuer.issueRequest(ceremonyTokenClaimsForAuthority(input.authority, this.config.tokenScope), requestPolicy)}`,
+			"content-type": JSON_CONTENT_TYPE
+		};
+		if (input.traceContext) headers[ROUTER_AB_TRACE_ID_HEADER_V1] = input.traceContext.value;
+		const response = await this.config.router.fetch(new Request(`https://router.router-ab.internal${input.path}`, {
+			method: "POST",
+			headers,
+			body: strictForwardBodyJson(input)
+		}));
+		try {
+			const header = response.headers.get("Server-Timing");
+			input.onHeaderPresence?.({
+				leg: input.path,
+				serverTiming: header ? "present" : "absent"
+			});
+			if (header) input.onServerTiming?.(header);
+		} catch {}
+		const body = await readJsonResponse(response);
+		if (!response.ok) {
+			const code = responseErrorCode(body, response.status);
+			return {
+				ok: false,
+				code,
+				message: responseErrorMessage(body, response.status),
+				retryable: responseFailureIsRetryable(response.status, code)
+			};
+		}
+		return {
+			ok: true,
+			value: body
+		};
+	}
+};
+var StrictPostRegistrationForwarder = class {
+	constructor(config) {
+		this.config = config;
+	}
+	topology() {
+		return this.config.topology;
+	}
+	async explicitExport(input) {
+		const forwarded = await this.forwardRaw({
+			kind: "explicit_export",
+			path: STRICT_ECDSA_EXPORT_PATH,
+			request: parseRouterAbEcdsaDerivationExplicitExportRequestV1(input.request),
+			requestDigestB64u: input.requestDigestB64u,
+			authority: input.authority,
+			tenantRoot: input.tenantRoot
+		});
+		if (!forwarded.ok) return forwarded;
+		try {
+			return {
+				ok: true,
+				value: parseRouterAbEcdsaExplicitExportProtocolForwardedResponseV1(forwarded.value)
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "mpc_router_export_response_invalid",
+				message: errorMessage(error, "MPCRouter returned an invalid ECDSA export response"),
+				retryable: false
+			};
+		}
+	}
+	async refresh(input) {
+		const command = parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1(input.request);
+		const forwarded = await this.forwardRaw({
+			kind: "post_registration_proof",
+			path: STRICT_ECDSA_REFRESH_PATH,
+			request: command.refresh_request,
+			requestDigestB64u: input.requestDigestB64u,
+			workKind: "server_share_refresh",
+			authority: input.authority,
+			tenantRoot: input.tenantRoot
+		});
+		if (!forwarded.ok) return forwarded;
+		try {
+			const response = parseRouterAbEcdsaDerivationActivationRefreshResponseV1(forwarded.value);
+			if (response.result !== "stopped" && response.signing_worker_activation.activation_correlation_id !== command.activation_correlation_id) throw new Error("MPCRouter refresh receipt changed the journal correlation");
+			return {
+				ok: true,
+				value: response
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "mpc_router_refresh_response_invalid",
+				message: errorMessage(error, "MPCRouter returned an invalid ECDSA refresh response"),
+				retryable: false
+			};
+		}
+	}
+	async forwardRaw(input) {
+		const authorityFailure = validatePostRegistrationAuthorityBinding(input);
+		if (authorityFailure) return authorityFailure;
+		const token = await this.config.tokenIssuer.issueRequest(ceremonyTokenClaimsForAuthority(input.authority, this.config.tokenScope), postRegistrationRequestPolicy(input.kind === "explicit_export" ? {
+			workKind: "key_export",
+			requestDigestB64u: input.requestDigestB64u
+		} : {
+			workKind: input.workKind,
+			requestDigestB64u: input.requestDigestB64u
+		}));
+		const response = await this.config.router.fetch(new Request(`https://router.router-ab.internal${input.path}`, {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${token}`,
+				"content-type": JSON_CONTENT_TYPE
+			},
+			body: strictPostRegistrationForwardBodyJson(input)
+		}));
+		const body = await readJsonResponse(response);
+		if (!response.ok) {
+			const code = responseErrorCode(body, response.status);
+			return {
+				ok: false,
+				code,
+				message: responseErrorMessage(body, response.status),
+				retryable: responseFailureIsRetryable(response.status, code)
+			};
+		}
+		return {
+			ok: true,
+			value: body
+		};
+	}
+};
+function strictPostRegistrationForwardBodyJson(input) {
+	switch (input.kind) {
+		case "explicit_export": return JSON.stringify({
+			request: projectRouterAbEcdsaDerivationExplicitExportRequestToProtocolV1(input.request),
+			export_authority: {
+				key_handle: input.authority.keyHandle,
+				authorization: input.authority.authorization,
+				normal_signing_scope: input.authority.normalSigningScope
+			},
+			material_source: registrationMaterialSourceForEcdsaScope(input.authority.normalSigningScope),
+			private_authorization: privateExportAuthorizationWire(input.authority.privateAuthorization),
+			tenant_root: {
+				identity_digest_b64u: input.tenantRoot.identityDigestB64u,
+				custody_lineage_b64u: input.tenantRoot.custodyLineageB64u
+			}
+		});
+		case "post_registration_proof": return JSON.stringify({
+			refresh_request: input.request,
+			tenant_root: {
+				identity_digest_b64u: input.tenantRoot.identityDigestB64u,
+				custody_lineage_b64u: input.tenantRoot.custodyLineageB64u
+			}
+		});
+	}
+}
+function registrationMaterialSourceForEcdsaScope(scope) {
+	return {
+		kind: "registration_activation",
+		lookup: {
+			account_id: scope.wallet_id,
+			material_activation_id: scope.material_activation.activation_id,
+			signing_worker_id: scope.signing_worker.server_id
+		}
+	};
+}
+function privateExportAuthorizationWire(authorization) {
+	switch (authorization.kind) {
+		case "reusable_wallet_session": return {
+			kind: "reusable_wallet_session",
+			wallet_session_id: authorization.walletSessionId
+		};
+		case "operation_step_up": return {
+			kind: "operation_step_up",
+			evidence_set_digest: authorization.evidenceSetDigest
+		};
+		default: {
+			const exhaustive = authorization;
+			throw new Error(`Unsupported private ECDSA export authorization: ${String(exhaustive)}`);
+		}
+	}
+}
+function strictForwardBodyJson(input) {
+	switch (input.kind) {
+		case "tenant_root_registration": return JSON.stringify({
+			registration_request: input.request,
+			tenant_root: {
+				identity_digest_b64u: input.tenantRoot.identityDigestB64u,
+				custody_lineage_b64u: input.tenantRoot.custodyLineageB64u
+			}
+		});
+		case "activation": return `{"activation_correlation_id":${JSON.stringify(input.activationCorrelationId)},"pending":${input.pendingActivation.canonicalPayloadJson},"client_activation":${JSON.stringify(input.clientActivation)}}`;
+		default: return assertNeverStrictForwardBody(input);
+	}
+}
+function strictRegistrationPath(purpose) {
+	switch (purpose) {
+		case "wallet_registration": return STRICT_ECDSA_REGISTRATION_PATH;
+		case "wallet_add_signer": return STRICT_ECDSA_ADD_SIGNER_PATH;
+		default: return assertNeverStrictRegistrationPurpose(purpose);
+	}
+}
+function assertNeverStrictRegistrationPurpose(value) {
+	throw new Error(`Unsupported strict ECDSA registration purpose: ${String(value)}`);
+}
+function assertNeverStrictForwardBody(value) {
+	throw new Error(`Unexpected strict ECDSA forwarding body: ${String(value)}`);
+}
+function canonicalPendingActivationJson(value) {
+	if (!exactObject(value, [
+		"registration",
+		"tenant_root_custody_binding_digest",
+		"activation_context",
+		"activation"
+	])) throw new Error("MPCRouter pending activation has an invalid envelope");
+	return canonicalJson(value);
+}
+function parseStoredRouterAbEcdsaPendingActivationV1(value) {
+	const record = exactObject(value, ["kind", "canonicalPayloadJson"]);
+	if (!record || record.kind !== "router_ab_ecdsa_pending_activation_v1" || typeof record.canonicalPayloadJson !== "string") throw new Error("Stored MPCRouter ECDSA pending activation is invalid");
+	const canonicalPayloadJson = canonicalPendingActivationJson(JSON.parse(record.canonicalPayloadJson));
+	if (canonicalPayloadJson !== record.canonicalPayloadJson) throw new Error("Stored MPCRouter ECDSA pending activation is not canonical");
+	return {
+		kind: "router_ab_ecdsa_pending_activation_v1",
+		canonicalPayloadJson
+	};
+}
+function canonicalJson(value) {
+	if (value === null) return "null";
+	switch (typeof value) {
+		case "boolean":
+		case "string": return JSON.stringify(value);
+		case "number":
+			if (!Number.isFinite(value)) throw new Error("Canonical JSON rejects non-finite numbers");
+			return JSON.stringify(value);
+		case "object": return canonicalJsonObjectOrArray(value);
+		default: throw new Error("Canonical JSON contains an unsupported value");
+	}
+}
+function canonicalJsonObjectOrArray(value) {
+	if (Array.isArray(value)) {
+		const entries = [];
+		for (const entry of value) entries.push(canonicalJson(entry));
+		return `[${entries.join(",")}]`;
+	}
+	const record = value;
+	const keys = Object.keys(record).sort();
+	const fields = [];
+	for (const key of keys) fields.push(`${JSON.stringify(key)}:${canonicalJson(record[key])}`);
+	return `{${fields.join(",")}}`;
+}
+function parseStrictRegistrationForwardingResult(raw) {
+	const record = exactObject(raw, [
+		"result",
+		"response",
+		"pending_activation"
+	]);
+	const pendingActivationPayload = objectValue(record?.pending_activation);
+	if (!record || record.result !== "forwarded" || !pendingActivationPayload) return {
+		ok: false,
+		code: "mpc_router_registration_rejected",
+		message: "MPCRouter did not return one pending ECDSA registration activation",
+		retryable: false
+	};
+	try {
+		return {
+			ok: true,
+			value: {
+				publicResponse: parseRouterAbEcdsaStrictForwardedRegistrationResponseV1({
+					result: "forwarded",
+					response: record.response
+				}),
+				pendingActivation: {
+					kind: "router_ab_ecdsa_pending_activation_v1",
+					canonicalPayloadJson: canonicalPendingActivationJson(pendingActivationPayload)
+				}
+			}
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			code: "mpc_router_response_invalid",
+			message: errorMessage(error, "MPCRouter returned an invalid ECDSA registration response"),
+			retryable: false
+		};
+	}
+}
+function ceremonyTokenClaimsForAuthority(authority, scope) {
+	return {
+		subjectId: authority.subjectId,
+		sessionId: authority.sessionId,
+		orgId: scope.orgId,
+		projectId: scope.projectId,
+		environment: scope.environment,
+		accountId: authority.accountId,
+		expiresAtMs: authority.expiresAtMs
+	};
+}
+function parseRegistrationRequestPolicy(policy) {
+	const policyVersion = nonEmptyString(policy.policyVersion);
+	const requestDigestB64u = base64UrlString(policy.requestDigestB64u, 32);
+	if (!policyVersion || !requestDigestB64u) return null;
+	return {
+		policyVersion,
+		workKind: "registration_prepare",
+		requestDigest: { bytes: Array.from(decodeBase64Url(requestDigestB64u)) }
+	};
+}
+function postRegistrationRequestPolicy(input) {
+	const requestDigestB64u = base64UrlString(input.requestDigestB64u, 32);
+	if (!requestDigestB64u) throw new Error("Strict ECDSA post-registration request digest is invalid");
+	return {
+		policyVersion: STRICT_ECDSA_POST_REGISTRATION_POLICY_VERSION,
+		workKind: input.workKind,
+		requestDigest: { bytes: Array.from(decodeBase64Url(requestDigestB64u)) }
+	};
+}
+function validateRegistrationAuthorityBinding(input) {
+	if (input.request.client_id !== input.authority.subjectId || input.request.lifecycle.session_id !== input.authority.sessionId || input.request.lifecycle.account_id !== input.authority.accountId || input.request.expires_at_ms !== input.authority.expiresAtMs) return {
+		ok: false,
+		code: "strict_registration_authority_mismatch",
+		message: "Strict ECDSA registration request is outside the admitted ceremony authority",
+		retryable: false
+	};
+	return null;
+}
+function validateRegistrationTenantRoot(tenantRoot) {
+	if (!base64UrlString(tenantRoot.identityDigestB64u, 32) || !base64UrlString(tenantRoot.custodyLineageB64u, 16)) return {
+		ok: false,
+		code: "strict_registration_tenant_root_invalid",
+		message: "Strict ECDSA registration tenant-root binding is invalid",
+		retryable: false
+	};
+	return null;
+}
+function validatePostRegistrationAuthorityBinding(input) {
+	const request = input.request;
+	if (request.client_id !== input.authority.subjectId || request.lifecycle.session_id !== input.authority.sessionId || request.lifecycle.account_id !== input.authority.accountId || request.expires_at_ms !== input.authority.expiresAtMs) return {
+		ok: false,
+		code: "strict_post_registration_authority_mismatch",
+		message: "Strict ECDSA post-registration request is outside the admitted authority",
+		retryable: false
+	};
+	return null;
+}
+function routerAbEcdsaStrictRegistrationRequestMatchesFacts(input) {
+	return routerAbEcdsaStrictRegistrationRequestBindingJson(input.request) === routerAbEcdsaStrictRegistrationFactsBindingJson(input.facts);
+}
+function routerAbEcdsaStrictRegistrationFactsBindingJson(facts) {
+	return canonicalJson({
+		registration_purpose: facts.registration_purpose,
+		context: facts.context,
+		lifecycle: facts.lifecycle,
+		signer_set: facts.signer_set,
+		router_id: facts.router_id,
+		client_id: facts.client_id,
+		replay_nonce: facts.replay_nonce,
+		expires_at_ms: facts.expires_at_ms,
+		deriver_a_role: facts.deriver_recipient_keys.deriver_a.role,
+		deriver_b_role: facts.deriver_recipient_keys.deriver_b.role
+	});
+}
+function routerAbEcdsaStrictRegistrationRequestBindingJson(request) {
+	return canonicalJson({
+		registration_purpose: request.registration_purpose,
+		context: request.context,
+		lifecycle: request.lifecycle,
+		signer_set: request.signer_set,
+		router_id: request.router_id,
+		client_id: request.client_id,
+		replay_nonce: request.replay_nonce,
+		expires_at_ms: request.expires_at_ms,
+		deriver_a_role: request.deriver_a_envelope.recipient_role,
+		deriver_b_role: request.deriver_b_envelope.recipient_role
+	});
+}
+var Ed25519CeremonyTokenIssuer = class {
+	constructor(config) {
+		this.config = config;
+		this.signingKey = null;
+		validateCeremonyTokenIssuerConfig(config);
+	}
+	async issue(claims) {
+		return await this.issueClaims(claims, null);
+	}
+	async issueRequest(claims, requestPolicy) {
+		return await this.issueClaims(claims, requestPolicy);
+	}
+	async issueClaims(claims, requestPolicy) {
+		validateCeremonyTokenClaims(claims);
+		const nowSec = Math.floor(Date.now() / 1e3);
+		const signingInput = `${encodeJsonBase64Url({
+			alg: "EdDSA",
+			kid: this.config.keyId,
+			typ: "JWT"
+		})}.${encodeJsonBase64Url({
+			iss: this.config.issuer,
+			sub: claims.subjectId,
+			aud: this.config.audience,
+			iat: nowSec,
+			nbf: nowSec,
+			exp: Math.ceil(claims.expiresAtMs / 1e3),
+			sid: claims.sessionId,
+			org_id: claims.orgId,
+			project_id: claims.projectId,
+			environment: claims.environment,
+			account_id: claims.accountId,
+			...requestPolicy ? { routerAbRequestPolicy: requestPolicy } : {}
+		})}`;
+		const signature = await crypto.subtle.sign({ name: "Ed25519" }, await this.requireSigningKey(), new TextEncoder().encode(signingInput));
+		return `${signingInput}.${encodeBytesBase64Url(new Uint8Array(signature))}`;
+	}
+	publicJwks() {
+		const { crv, kty, x } = this.config.privateJwk;
+		return { keys: [{
+			alg: "EdDSA",
+			crv,
+			kid: this.config.keyId,
+			kty,
+			use: "sig",
+			x
+		}] };
+	}
+	requireSigningKey() {
+		if (!this.signingKey) this.signingKey = crypto.subtle.importKey("jwk", this.config.privateJwk, { name: "Ed25519" }, false, ["sign"]);
+		return this.signingKey;
+	}
+};
+function createRouterAbEcdsaStrictRegistrationPort(config) {
+	return new StrictRegistrationForwarder(config);
+}
+function createRouterAbEcdsaStrictPostRegistrationPort(config) {
+	return new StrictPostRegistrationForwarder(config);
+}
+function createRouterAbEcdsaEd25519CeremonyTokenIssuer(config) {
+	return new Ed25519CeremonyTokenIssuer(config);
+}
+function parseRouterAbEcdsaEd25519PrivateJwk(raw) {
+	const record = exactObject(raw, [
+		"kty",
+		"crv",
+		"x",
+		"d"
+	]);
+	const x = base64UrlString(record?.x, 32);
+	const d = base64UrlString(record?.d, 32);
+	if (!record || record.kty !== "OKP" || record.crv !== "Ed25519" || !x || !d) return null;
+	return {
+		kty: "OKP",
+		crv: "Ed25519",
+		x,
+		d
+	};
+}
+function parseRouterAbEcdsaStrictRegistrationTopology(raw) {
+	const record = exactObject(raw, [
+		"routerId",
+		"signerSet",
+		"deriverRecipientKeys"
+	]);
+	const routerId = nonEmptyString(record?.routerId);
+	const signerSet = parseSignerSet(record?.signerSet);
+	const deriverRecipientKeys = parseDeriverRecipientKeys(record?.deriverRecipientKeys);
+	if (!record || !routerId || !signerSet || !deriverRecipientKeys) return null;
+	return {
+		routerId,
+		signerSet,
+		deriverRecipientKeys
+	};
+}
+function parseSignerSet(raw) {
+	const record = exactObject(raw, [
+		"signer_set_id",
+		"policy",
+		"signer_a",
+		"signer_b",
+		"selected_server"
+	]);
+	const signerSetId = nonEmptyString(record?.signer_set_id);
+	const signerA = parseSignerIdentity(record?.signer_a, "signer_a");
+	const signerB = parseSignerIdentity(record?.signer_b, "signer_b");
+	const selectedServer = parseServerIdentity(record?.selected_server);
+	if (!record || record.policy !== "all_2" || !signerSetId || !signerA || !signerB || !selectedServer) return null;
+	return {
+		signer_set_id: signerSetId,
+		policy: "all_2",
+		signer_a: signerA,
+		signer_b: signerB,
+		selected_server: selectedServer
+	};
+}
+function parseSignerIdentity(raw, role) {
+	const record = exactObject(raw, [
+		"role",
+		"signer_id",
+		"key_epoch"
+	]);
+	const signerId = nonEmptyString(record?.signer_id);
+	const keyEpoch = nonEmptyString(record?.key_epoch);
+	if (!record || record.role !== role || !signerId || !keyEpoch) return null;
+	switch (role) {
+		case "signer_a": return {
+			role: "signer_a",
+			signer_id: signerId,
+			key_epoch: keyEpoch
+		};
+		case "signer_b": return {
+			role: "signer_b",
+			signer_id: signerId,
+			key_epoch: keyEpoch
+		};
+	}
+}
+function parseServerIdentity(raw) {
+	const record = exactObject(raw, [
+		"server_id",
+		"key_epoch",
+		"recipient_encryption_key"
+	]);
+	const serverId = nonEmptyString(record?.server_id);
+	const keyEpoch = nonEmptyString(record?.key_epoch);
+	const recipientEncryptionKey = nonEmptyString(record?.recipient_encryption_key);
+	if (!record || !serverId || !keyEpoch || !recipientEncryptionKey) return null;
+	return {
+		server_id: serverId,
+		key_epoch: keyEpoch,
+		recipient_encryption_key: recipientEncryptionKey
+	};
+}
+function parseDeriverRecipientKeys(raw) {
+	const record = exactObject(raw, ["deriver_a", "deriver_b"]);
+	const deriverA = parseDeriverRecipientKey(record?.deriver_a, "signer_a");
+	const deriverB = parseDeriverRecipientKey(record?.deriver_b, "signer_b");
+	return record && deriverA && deriverB ? {
+		deriver_a: deriverA,
+		deriver_b: deriverB
+	} : null;
+}
+function parseDeriverRecipientKey(raw, role) {
+	const record = exactObject(raw, [
+		"role",
+		"key_epoch",
+		"public_key"
+	]);
+	const keyEpoch = nonEmptyString(record?.key_epoch);
+	const publicKey = nonEmptyString(record?.public_key);
+	if (!record || record.role !== role || !keyEpoch || !publicKey) return null;
+	switch (role) {
+		case "signer_a": return {
+			role: "signer_a",
+			key_epoch: keyEpoch,
+			public_key: publicKey
+		};
+		case "signer_b": return {
+			role: "signer_b",
+			key_epoch: keyEpoch,
+			public_key: publicKey
+		};
+	}
+}
+function validateCeremonyTokenIssuerConfig(config) {
+	if (!nonEmptyString(config.issuer) || !nonEmptyString(config.audience) || !nonEmptyString(config.keyId) || config.privateJwk.kty !== "OKP" || config.privateJwk.crv !== "Ed25519" || !base64UrlString(config.privateJwk.x, 32) || !base64UrlString(config.privateJwk.d, 32)) throw new Error("Router A/B ECDSA ceremony token issuer requires an Ed25519 private JWK");
+}
+function validateCeremonyTokenClaims(claims) {
+	if (!nonEmptyString(claims.subjectId) || !nonEmptyString(claims.sessionId) || !nonEmptyString(claims.orgId) || !nonEmptyString(claims.projectId) || !nonEmptyString(claims.environment) || !nonEmptyString(claims.accountId) || !Number.isSafeInteger(claims.expiresAtMs) || claims.expiresAtMs <= Date.now()) throw new Error("Router A/B ECDSA ceremony token claims are invalid");
+}
+function exactObject(raw, keys) {
+	const record = objectValue(raw);
+	if (!record) return null;
+	const actual = Object.keys(record).sort();
+	const expected = [...keys].sort();
+	if (actual.length !== expected.length) return null;
+	for (let index = 0; index < expected.length; index += 1) if (actual[index] !== expected[index]) return null;
+	return record;
+}
+function objectValue(raw) {
+	return typeof raw === "object" && raw !== null && !Array.isArray(raw) ? raw : null;
+}
+function nonEmptyString(raw) {
+	return (typeof raw === "string" ? raw.trim() : "") || null;
+}
+function base64UrlString(raw, decodedLength) {
+	const value = nonEmptyString(raw);
+	if (!value || !/^[A-Za-z0-9_-]+$/u.test(value)) return null;
+	try {
+		return decodeBase64Url(value).byteLength === decodedLength ? value : null;
+	} catch {
+		return null;
+	}
+}
+function decodeBase64Url(value) {
+	const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+	const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+	const binary = atob(padded);
+	const out = new Uint8Array(binary.length);
+	for (let index = 0; index < binary.length; index += 1) out[index] = binary.charCodeAt(index);
+	return out;
+}
+function encodeJsonBase64Url(value) {
+	return encodeBytesBase64Url(new TextEncoder().encode(JSON.stringify(value)));
+}
+function encodeBytesBase64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/u, "");
+}
+async function readJsonResponse(response) {
+	const body = await response.text();
+	if (!body) return null;
+	try {
+		return JSON.parse(body);
+	} catch {
+		return body;
+	}
+}
+function responseErrorCode(body, status) {
+	if (typeof body === "string") {
+		const protocolCode = protocolErrorCodeFromText(body);
+		if (protocolCode) return protocolCode;
+	}
+	return nonEmptyString(objectValue(body)?.code) || `mpc_router_http_${status}`;
+}
+function protocolErrorCodeFromText(body) {
+	const separator = body.indexOf(":");
+	if (separator <= 0) return null;
+	switch (body.slice(0, separator)) {
+		case "InvalidLocalServiceConfig": return "invalid_local_service_config";
+		case "MissingLocalBinding": return "missing_local_binding";
+		case "ForbiddenLocalBinding": return "forbidden_local_binding";
+		default: return null;
+	}
+}
+function responseFailureIsRetryable(status, code) {
+	if (status < 500) return false;
+	switch (code) {
+		case "invalid_local_service_config":
+		case "missing_local_binding":
+		case "forbidden_local_binding": return false;
+		default: return true;
+	}
+}
+function responseErrorMessage(body, status) {
+	if (typeof body === "string" && body.trim()) return body.trim();
+	return nonEmptyString(objectValue(body)?.message) || `MPCRouter returned HTTP ${status}`;
+}
+function errorMessage(error, fallback) {
+	return error instanceof Error && error.message ? error.message : fallback;
+}
+//#endregion
+export { createRouterAbEcdsaEd25519CeremonyTokenIssuer, createRouterAbEcdsaStrictPostRegistrationPort, createRouterAbEcdsaStrictRegistrationPort, parseRouterAbEcdsaEd25519PrivateJwk, parseRouterAbEcdsaStrictRegistrationTopology, parseStoredRouterAbEcdsaPendingActivationV1, routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson, routerAbEcdsaStrictRegistrationRequestMatchesFacts };
+
+//# sourceMappingURL=routerAbEcdsaStrictRegistration.js.map