@seams/wallet-server 0.5.0

package/dist/esm/router/domains/signingOperations/walletExecutionAdmission.js

@@ -0,0 +1,228 @@
+import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
+import { CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildWalletSessionCapabilitySubjectsV1, walletSessionCapabilitySubjectsV1Equal } from "../../../authorization/domain.js";
+import { computeOwnerLaneParticipantBindingDigestV1 } from "../../../shared-ts/src/signing-lanes/ownerContinuity.js";
+import { buildPreparedOwnerWalletExecution } from "../../../shared-ts/src/signing-lanes/execution.js";
+import "../../../shared-ts/src/signing-lanes/index.js";
+//#region src/router/domains/signingOperations/walletExecutionAdmission.ts
+function validateWalletSessionAuthorizationV2Context(input) {
+	if (!isPositiveSafeInteger(input.nowMs)) return "invalid_time";
+	if (input.retiredAtMs !== null) return "authorization_retired";
+	if (input.authorization.expiresAtMs <= input.nowMs) return "authorization_expired";
+	if (input.authorization.tenantId !== input.operation.tenantId || input.authorization.principalId !== input.operation.principalId) return "operation_identity_mismatch";
+	if (input.authorization.walletId !== input.operation.walletId || input.authority.walletId !== input.operation.walletId) return "wallet_mismatch";
+	if (input.authority.state !== "active") return "authority_inactive";
+	if (input.authorization.authorityId !== input.authority.authorityId) return "authority_mismatch";
+	if (input.authorization.authorityDigestB64u !== input.authority.authorityDigestB64u) return "authority_digest_mismatch";
+	if (input.authorization.authorityRevocationEpoch !== input.authority.revocationEpoch) return "authority_revocation_epoch_mismatch";
+	if (input.authMethod.status !== "active") return "auth_method_inactive";
+	if (input.authorization.walletAuthMethodId !== input.authMethod.walletAuthMethodId || input.authMethod.walletId !== input.authority.walletId || input.authMethod.walletAuthorityId !== input.authority.authorityId) return "auth_method_mismatch";
+	return null;
+}
+function validateWalletSessionAuthorizationV2CapabilitySubjects(input) {
+	let expectedSubjects;
+	try {
+		expectedSubjects = buildWalletSessionCapabilitySubjectsV1(input.authority);
+	} catch {
+		return "capability_subject_mismatch";
+	}
+	return walletSessionCapabilitySubjectsV1Equal(input.authorization.capabilitySubjects, expectedSubjects) ? null : "capability_subject_mismatch";
+}
+function resolveWalletSessionAuthorizationV2Admission(input) {
+	const contextError = validateWalletSessionAuthorizationV2Context(input);
+	if (contextError) return admissionRefused(contextError);
+	const requirement = requiredWalletSessionAuthorizationV2Capability(input.operation);
+	if (!input.authority.permissions.includes(requirement.permission)) return admissionRefused("permission_mismatch");
+	const capabilityError = validateWalletSessionAuthorizationV2CapabilitySubjects(input);
+	if (capabilityError) return admissionRefused(capabilityError);
+	const signer = resolveWalletSessionAuthorizationV2Signer(input.authority, input.operation.keyFamily);
+	if (!signer) return admissionRefused("signer_family_mismatch");
+	if (!hasExactWalletSessionAuthorizationV2SignerSubject(input.authorization.capabilitySubjects, requirement.subjectKind, input.operation.keyFamily, signer.materialActivation)) return admissionRefused("signer_activation_mismatch");
+	switch (input.operation.keyFamily) {
+		case "ed25519":
+			if (signer.keyFamily !== "ed25519") return admissionRefused("signer_family_mismatch");
+			return {
+				ok: true,
+				keyFamily: "ed25519",
+				operationKind: input.operation.operationKind,
+				walletKeyId: signer.walletKeyId,
+				signer: signer.signer,
+				materialActivation: signer.materialActivation
+			};
+		case "ecdsa_secp256k1":
+			if (signer.keyFamily !== "ecdsa_secp256k1") return admissionRefused("signer_family_mismatch");
+			return {
+				ok: true,
+				keyFamily: "ecdsa_secp256k1",
+				operationKind: input.operation.operationKind,
+				walletKeyId: signer.walletKeyId,
+				signer: signer.signer,
+				materialActivation: signer.materialActivation
+			};
+		default: return assertNeverWalletSessionAuthorizationV2Operation(input.operation);
+	}
+}
+function resolveWalletSessionAuthorizationV2AdministrationAdmission(input) {
+	const contextError = validateWalletSessionAuthorizationV2Context(input);
+	if (contextError) return admissionRefused(contextError);
+	switch (input.operation.kind) {
+		case "link_devices": {
+			if (!input.authority.permissions.includes("link_devices")) return admissionRefused("permission_mismatch");
+			const capabilityError = validateWalletSessionAuthorizationV2CapabilitySubjects(input);
+			if (capabilityError) return admissionRefused(capabilityError);
+			const subject = input.authorization.capabilitySubjects.find((candidate) => candidate.kind === "link_devices");
+			if (!subject || subject.authorityId !== input.authority.authorityId) return admissionRefused("capability_subject_mismatch");
+			return {
+				ok: true,
+				operationKind: "link_devices",
+				authorityId: input.authority.authorityId
+			};
+		}
+		default: return assertNeverWalletSessionAuthorizationV2AdministrationOperation(input.operation.kind);
+	}
+}
+function requiredWalletSessionAuthorizationV2Capability(operation) {
+	switch (operation.keyFamily) {
+		case "ed25519": switch (operation.operationKind) {
+			case NEAR_ED25519_MPC_OPERATION_KINDS.signTransaction:
+			case NEAR_ED25519_MPC_OPERATION_KINDS.signDelegateAction:
+			case NEAR_ED25519_MPC_OPERATION_KINDS.signNep413Message: return {
+				permission: "sign",
+				subjectKind: "sign"
+			};
+			case NEAR_ED25519_MPC_OPERATION_KINDS.exportKey: return {
+				permission: "export_keys",
+				subjectKind: "export_keys"
+			};
+			default: return assertNeverWalletSessionAuthorizationV2Operation(operation);
+		}
+		case "ecdsa_secp256k1": switch (operation.operationKind) {
+			case EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction: return {
+				permission: "sign",
+				subjectKind: "sign"
+			};
+			case EVM_ECDSA_MPC_OPERATION_KINDS.exportKey: return {
+				permission: "export_keys",
+				subjectKind: "export_keys"
+			};
+			default: return assertNeverWalletSessionAuthorizationV2Operation(operation);
+		}
+	}
+}
+function resolveWalletSessionAuthorizationV2Signer(authority, keyFamily) {
+	switch (keyFamily) {
+		case "ed25519": {
+			const activation = authority.signerActivations.ed25519;
+			if (!activation) return null;
+			if (activation.signer.keyFamily !== "ed25519" || activation.signer.walletId !== authority.walletId || String(activation.materialActivation.materialOwner) !== String(authority.walletId)) return null;
+			return {
+				keyFamily,
+				walletKeyId: activation.signer.walletKeyId,
+				signer: activation.signer,
+				materialActivation: activation.materialActivation
+			};
+		}
+		case "ecdsa_secp256k1": {
+			const activation = authority.signerActivations.ecdsa;
+			if (!activation) return null;
+			if (activation.signer.keyFamily !== "ecdsa_secp256k1" || activation.signer.walletId !== authority.walletId || String(activation.materialActivation.materialOwner) !== String(authority.walletId)) return null;
+			return {
+				keyFamily,
+				walletKeyId: activation.signer.walletKeyId,
+				signer: activation.signer,
+				materialActivation: activation.materialActivation
+			};
+		}
+	}
+}
+function hasExactWalletSessionAuthorizationV2SignerSubject(subjects, subjectKind, keyFamily, materialActivation) {
+	for (const subject of subjects) if ((subject.kind === "sign" || subject.kind === "export_keys") && subject.kind === subjectKind && subject.keyFamily === keyFamily) return mpcMaterialActivationRefsEqual(subject.materialActivation, materialActivation);
+	return false;
+}
+function isPositiveSafeInteger(value) {
+	return Number.isSafeInteger(value) && value > 0;
+}
+function admissionRefused(error) {
+	return {
+		ok: false,
+		error
+	};
+}
+function assertNeverWalletSessionAuthorizationV2Operation(value) {
+	throw new Error(`Unsupported Wallet Session authorization V2 operation: ${String(value)}`);
+}
+function assertNeverWalletSessionAuthorizationV2AdministrationOperation(value) {
+	throw new Error(`Unsupported Wallet Session authorization V2 administration operation: ${String(value)}`);
+}
+async function prepareOwnerWalletExecution(input) {
+	if (input.authorizedOperation.lifecycle !== "claimed") return refused("operation_not_claimed");
+	const claimedOperation = input.authorizedOperation;
+	if (input.evidence.walletKey.lifecycle.state !== "active") return refused("wallet_key_inactive");
+	if (input.evidence.lane.lifecycle.state !== "active") return refused("lane_inactive");
+	if (!isActiveOwnerLane(input.evidence.lane)) return refused("unsupported_lane");
+	const lane = input.evidence.lane;
+	if (input.evidence.walletKey.walletId !== input.evidence.walletId || lane.walletId !== input.evidence.walletId || String(input.evidence.materialActivation.materialOwner) !== String(input.evidence.walletId)) return refused("wallet_mismatch");
+	if (lane.walletKeyId !== input.evidence.walletKey.walletKeyId) return refused("wallet_key_mismatch");
+	if (!operationMatchesWalletKey(input.authorizedOperation, input.evidence.walletKey)) return refused("curve_mismatch");
+	if (String(claimedOperation.operation.capabilityId) !== String(input.evidence.materialActivation.capability)) return refused("capability_mismatch");
+	if (!sameMaterialActivation(input.evidence.materialActivation, input.evidence.expectedMaterialActivation)) return refused("material_activation_mismatch");
+	if (lane.participantBindingDigestB64u !== input.evidence.verifiedLaneParticipantBindingDigestB64u || String(lane.ownerParticipantContinuity.signingWorkerId) !== String(input.evidence.materialActivation.signingWorker)) return refused("participant_binding_mismatch");
+	if (await computeOwnerLaneParticipantBindingDigestV1(lane.ownerParticipantContinuity) !== lane.participantBindingDigestB64u) return refused("participant_binding_mismatch");
+	if (lane.lifecycle.activationReceiptDigestB64u !== input.evidence.verifiedActivationReceiptDigestB64u) return refused("activation_receipt_mismatch");
+	return {
+		kind: "prepared",
+		execution: buildPreparedOwnerWalletExecution({
+			authorization: claimedExecutionAuthorization(claimedOperation),
+			materialActivation: input.evidence.materialActivation,
+			lane: {
+				kind: "signing_lane_reference_v1",
+				walletId: lane.walletId,
+				walletKeyId: lane.walletKeyId,
+				laneId: lane.laneId,
+				laneKind: lane.laneKind,
+				laneShareEpoch: lane.laneShareEpoch,
+				participantBindingDigestB64u: lane.participantBindingDigestB64u,
+				lifecycle: lane.lifecycle,
+				materialActivation: input.evidence.materialActivation
+			}
+		})
+	};
+}
+function claimedExecutionAuthorization(operation) {
+	return {
+		kind: "claimed_wallet_execution_authorization_v1",
+		authorizedOperationId: operation.authorizedOperationId,
+		operationFingerprintDigest: operation.operationFingerprintDigest,
+		capabilityId: operation.operation.capabilityId
+	};
+}
+function isActiveOwnerLane(lane) {
+	if (lane.lifecycle.state !== "active") return false;
+	switch (lane.laneKind) {
+		case "owner_passkey":
+		case "owner_email_otp":
+		case "recovery":
+		case "break_glass": return true;
+		case "linked_device":
+		case "delegated_execution": return false;
+	}
+}
+function operationMatchesWalletKey(operation, walletKey) {
+	switch (walletKey.keyFamily) {
+		case "ed25519": return operation.operation.operation.capabilityKind === CAPABILITY_KINDS.nearEd25519MpcSigning;
+		case "ecdsa_secp256k1": return operation.operation.operation.capabilityKind === CAPABILITY_KINDS.evmEcdsaMpcSigning;
+	}
+}
+function sameMaterialActivation(left, right) {
+	return left.activationId === right.activationId && left.capability === right.capability && left.materialOwner === right.materialOwner && left.keyBinding === right.keyBinding && left.lifecycleBinding === right.lifecycleBinding && left.signingWorker === right.signingWorker;
+}
+function refused(reason) {
+	return {
+		kind: "refused",
+		reason
+	};
+}
+//#endregion
+export { prepareOwnerWalletExecution, resolveWalletSessionAuthorizationV2AdministrationAdmission, resolveWalletSessionAuthorizationV2Admission };
+
+//# sourceMappingURL=walletExecutionAdmission.js.map

package/dist/esm/router/domains/syncAccount/syncAccountRequestValidation.js

@@ -0,0 +1,78 @@
+import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { parseWebAuthnAuthenticationCredential } from "../../auth/webAuthnCredentialCodecs.js";
+//#region src/router/domains/syncAccount/syncAccountRequestValidation.ts
+const SYNC_ACCOUNT_OPTIONS_KEYS = [
+	"rp_id",
+	"account_id",
+	"ttl_ms"
+];
+const SYNC_ACCOUNT_VERIFY_KEYS = ["challengeId", "webauthn_authentication"];
+function invalidSyncAccountBody(message) {
+	return {
+		ok: false,
+		status: 400,
+		body: {
+			ok: false,
+			code: "invalid_body",
+			message
+		}
+	};
+}
+function unexpectedSyncAccountKey(record, allowedKeys) {
+	for (const key of Object.keys(record)) if (!allowedKeys.includes(key)) return key;
+	return null;
+}
+function parseOptionalPositiveInteger(raw, fieldName) {
+	if (raw == null) return { ok: true };
+	const value = typeof raw === "number" ? raw : Number(raw);
+	if (!Number.isFinite(value) || value <= 0) return {
+		ok: false,
+		message: `${fieldName} must be a positive number`
+	};
+	return {
+		ok: true,
+		value: Math.floor(value)
+	};
+}
+function parseSyncAccountOptionsRequest(raw) {
+	if (!isPlainObject(raw)) return invalidSyncAccountBody("Expected JSON object body");
+	const unexpectedKey = unexpectedSyncAccountKey(raw, SYNC_ACCOUNT_OPTIONS_KEYS);
+	if (unexpectedKey) return invalidSyncAccountBody(`Unsupported sync-account options field: ${unexpectedKey}`);
+	const rpId = normalizeOptionalTrimmedString(raw.rp_id);
+	if (!rpId) return invalidSyncAccountBody("rp_id is required");
+	const accountId = normalizeOptionalTrimmedString(raw.account_id);
+	const parsedTtl = parseOptionalPositiveInteger(raw.ttl_ms, "ttl_ms");
+	if (!parsedTtl.ok) return invalidSyncAccountBody(parsedTtl.message);
+	return {
+		ok: true,
+		request: {
+			rp_id: rpId,
+			...accountId ? { account_id: accountId } : {},
+			...parsedTtl.value ? { ttl_ms: parsedTtl.value } : {}
+		}
+	};
+}
+function parseSyncAccountVerifyRequest(input) {
+	if (!isPlainObject(input.body)) return invalidSyncAccountBody("Expected JSON object body");
+	const unexpectedKey = unexpectedSyncAccountKey(input.body, SYNC_ACCOUNT_VERIFY_KEYS);
+	if (unexpectedKey) return invalidSyncAccountBody(`Unsupported sync-account verify field: ${unexpectedKey}`);
+	const challengeId = normalizeOptionalTrimmedString(input.body.challengeId);
+	if (!challengeId) return invalidSyncAccountBody("challengeId is required");
+	const webauthnAuthentication = parseWebAuthnAuthenticationCredential(input.body.webauthn_authentication);
+	if (!webauthnAuthentication) return invalidSyncAccountBody("webauthn_authentication is required");
+	const expectedOrigin = normalizeOptionalTrimmedString(input.origin);
+	if (!expectedOrigin) return invalidSyncAccountBody("Origin header is required");
+	return {
+		ok: true,
+		request: {
+			challengeId,
+			webauthn_authentication: webauthnAuthentication,
+			expected_origin: expectedOrigin
+		}
+	};
+}
+//#endregion
+export { parseSyncAccountOptionsRequest, parseSyncAccountVerifyRequest };
+
+//# sourceMappingURL=syncAccountRequestValidation.js.map

package/dist/esm/router/domains/tenantRoot/tenantRootEcdsaWalletSessionComposition.js

@@ -0,0 +1,55 @@
+import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { findForbiddenTenantRootSelectorFieldV1, resolveTenantRootIdentityV1 } from "./tenantRootIdentityResolution.js";
+//#region src/router/domains/tenantRoot/tenantRootEcdsaWalletSessionComposition.ts
+function compositionFailure(code, message) {
+	return {
+		ok: false,
+		code,
+		message
+	};
+}
+function ecdsaWalletSessionWalletId(admission) {
+	return String(admission.context.authorization.session.walletId);
+}
+function ecdsaWalletSessionMaterialActivation(admission) {
+	return routerAbMpcMaterialActivationRefToWire(admission.admission.materialActivation);
+}
+function b5MaterialMatchesEcdsaWalletSessionAdmission(input) {
+	if (!sameRouterAbMpcMaterialActivationRef(input.activeMaterial.materialActivation, input.materialActivation)) return compositionFailure("material_activation_mismatch", "B5 material activation does not match the exact B4 admission");
+	const normalSigning = input.activeMaterial.routerAbEcdsaDerivationNormalSigning;
+	const signer = input.admission.admission.signer;
+	if (normalSigning.scope.wallet_id !== String(signer.walletId)) return compositionFailure("wallet_mismatch", "B5 normal-signing wallet ID does not match the B4 signer");
+	if (normalSigning.scope.public_identity.threshold_public_key33_b64u !== signer.thresholdPublicKey33B64u) return compositionFailure("threshold_public_key_mismatch", "B5 normal-signing threshold public key does not match the B4 signer");
+	return null;
+}
+async function resolveTenantRootEcdsaWalletSessionCompositionV1(input) {
+	const forbiddenSelector = findForbiddenTenantRootSelectorFieldV1(input);
+	if (forbiddenSelector) return compositionFailure("caller_selected_tenant_root", `Caller-supplied tenant-root selector field is forbidden: ${forbiddenSelector}`);
+	const materialActivation = ecdsaWalletSessionMaterialActivation(input.admission);
+	const activeMaterial = await input.resolveEcdsaMaterialActivation({
+		walletId: ecdsaWalletSessionWalletId(input.admission),
+		materialActivation
+	});
+	if (!activeMaterial.ok) return compositionFailure(activeMaterial.code, activeMaterial.message);
+	const admissionMismatch = b5MaterialMatchesEcdsaWalletSessionAdmission({
+		admission: input.admission,
+		activeMaterial,
+		materialActivation
+	});
+	if (admissionMismatch) return admissionMismatch;
+	const identity = resolveTenantRootIdentityV1({
+		kind: "ecdsa_b5_active_material",
+		activeMaterial
+	});
+	if (!identity.ok) return compositionFailure(identity.code, identity.message);
+	return {
+		ok: true,
+		admission: input.admission,
+		activeMaterial,
+		tenantRootIdentity: identity.identity
+	};
+}
+//#endregion
+export { resolveTenantRootEcdsaWalletSessionCompositionV1 };
+
+//# sourceMappingURL=tenantRootEcdsaWalletSessionComposition.js.map

package/dist/esm/router/domains/tenantRoot/tenantRootEd25519WalletSessionComposition.js

@@ -0,0 +1,56 @@
+import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { findForbiddenTenantRootSelectorFieldV1, resolveTenantRootIdentityV1 } from "./tenantRootIdentityResolution.js";
+//#region src/router/domains/tenantRoot/tenantRootEd25519WalletSessionComposition.ts
+function compositionFailure(code, message) {
+	return {
+		ok: false,
+		code,
+		message
+	};
+}
+function ed25519WalletSessionWalletId(admission) {
+	return String(admission.context.authorization.session.walletId);
+}
+function ed25519WalletSessionMaterialActivation(admission) {
+	return routerAbMpcMaterialActivationRefToWire(admission.admission.materialActivation);
+}
+function b5MaterialMatchesEd25519WalletSessionAdmission(input) {
+	if (!sameRouterAbMpcMaterialActivationRef(input.activeMaterial.materialActivation, input.materialActivation)) return compositionFailure("material_activation_mismatch", "B5 material activation does not match the exact B4 admission");
+	const exportIdentity = input.activeMaterial.exportIdentity;
+	const signer = input.admission.admission.signer;
+	if (exportIdentity.scope.account_id !== String(signer.walletId) || exportIdentity.application_binding.wallet_id !== String(signer.walletId)) return compositionFailure("wallet_mismatch", "B5 Ed25519 wallet ID does not match the B4 signer");
+	if (base64UrlEncode(Uint8Array.from(exportIdentity.registered_public_key)) !== signer.registeredPublicKeyB64u) return compositionFailure("registered_public_key_mismatch", "B5 Ed25519 public key does not match the B4 signer");
+	return null;
+}
+async function resolveTenantRootEd25519WalletSessionCompositionV1(input) {
+	const forbiddenSelector = findForbiddenTenantRootSelectorFieldV1(input);
+	if (forbiddenSelector) return compositionFailure("caller_selected_tenant_root", `Caller-supplied tenant-root selector field is forbidden: ${forbiddenSelector}`);
+	const materialActivation = ed25519WalletSessionMaterialActivation(input.admission);
+	const activeMaterial = await input.resolveEd25519MaterialActivation({
+		walletId: ed25519WalletSessionWalletId(input.admission),
+		materialActivation
+	});
+	if (!activeMaterial.ok) return compositionFailure(activeMaterial.code, activeMaterial.message);
+	const admissionMismatch = b5MaterialMatchesEd25519WalletSessionAdmission({
+		admission: input.admission,
+		activeMaterial,
+		materialActivation
+	});
+	if (admissionMismatch) return admissionMismatch;
+	const identity = resolveTenantRootIdentityV1({
+		kind: "ed25519_b5_active_material",
+		activeMaterial
+	});
+	if (!identity.ok) return compositionFailure(identity.code, identity.message);
+	return {
+		ok: true,
+		admission: input.admission,
+		activeMaterial,
+		tenantRootIdentity: identity.identity
+	};
+}
+//#endregion
+export { resolveTenantRootEd25519WalletSessionCompositionV1 };
+
+//# sourceMappingURL=tenantRootEd25519WalletSessionComposition.js.map

package/dist/esm/router/domains/tenantRoot/tenantRootIdentityResolution.js

@@ -0,0 +1,111 @@
+import { sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { signingRootScopeFromRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
+import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, isTenantRootIdentityFieldCanonicalV1 } from "../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
+//#region src/router/domains/tenantRoot/tenantRootIdentityResolution.ts
+const FORBIDDEN_TENANT_ROOT_SELECTOR_FIELDS_V1 = [
+	"orgId",
+	"projectId",
+	"envId",
+	"signingRootId",
+	"signingRootVersion",
+	"walletId",
+	"materialActivation",
+	"tenantRootIdentity",
+	"tenantRootId",
+	"tenantRootShareEpoch",
+	"rootShareEpoch",
+	"epoch",
+	"role",
+	"walletSession",
+	"walletSessionId",
+	"authorization",
+	"authorizationId",
+	"credential",
+	"credentialIdB64u",
+	"browser",
+	"browserRecord",
+	"requestBody",
+	"requestId",
+	"diagnostics"
+];
+const TENANT_ROOT_RUNTIME_POLICY_SCOPE_FIELDS_V1 = [
+	"orgId",
+	"projectId",
+	"envId",
+	"signingRootVersion"
+];
+function findNonCanonicalRuntimePolicyScopeFieldV1(scope) {
+	for (const field of TENANT_ROOT_RUNTIME_POLICY_SCOPE_FIELDS_V1) {
+		const value = scope[field];
+		if (!isTenantRootIdentityFieldCanonicalV1(field, value)) return field;
+	}
+	return null;
+}
+function ed25519StableMaterialRootBinding(activeMaterial) {
+	return {
+		materialActivationMatches: sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, activeMaterial.exportIdentity.scope.material_activation),
+		signingRootId: activeMaterial.exportIdentity.application_binding.signing_root_id,
+		signingRootVersion: activeMaterial.exportIdentity.scope.root_share_epoch
+	};
+}
+function ecdsaStableMaterialRootBinding(activeMaterial) {
+	const scope = activeMaterial.routerAbEcdsaDerivationNormalSigning.scope;
+	return {
+		materialActivationMatches: sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, scope.material_activation),
+		signingRootId: scope.signing_root_id,
+		signingRootVersion: scope.signing_root_version
+	};
+}
+function assertNeverServerResolvedMaterial(value) {
+	throw new Error(`Unsupported server-resolved tenant-root material: ${String(value)}`);
+}
+function mismatch(code, message) {
+	return {
+		ok: false,
+		code,
+		message
+	};
+}
+function findForbiddenTenantRootSelectorFieldV1(input) {
+	for (const field of FORBIDDEN_TENANT_ROOT_SELECTOR_FIELDS_V1) if (Object.prototype.hasOwnProperty.call(input, field)) return field;
+	return null;
+}
+function resolveTenantRootIdentityV1(input) {
+	const forbiddenSelector = findForbiddenTenantRootSelectorFieldV1(input);
+	if (forbiddenSelector) return mismatch("caller_selected_tenant_root", `Caller-supplied tenant-root selector field is forbidden: ${forbiddenSelector}`);
+	let runtimePolicyScope;
+	let materialRootBinding;
+	switch (input.kind) {
+		case "ed25519_b5_active_material":
+			runtimePolicyScope = input.activeMaterial.runtimePolicyScope;
+			materialRootBinding = ed25519StableMaterialRootBinding(input.activeMaterial);
+			break;
+		case "ecdsa_b5_active_material":
+			runtimePolicyScope = input.activeMaterial.runtimePolicyScope;
+			materialRootBinding = ecdsaStableMaterialRootBinding(input.activeMaterial);
+			break;
+		default: return assertNeverServerResolvedMaterial(input);
+	}
+	if (!materialRootBinding.materialActivationMatches) return mismatch("material_activation_mismatch", "B5 material activation does not match its established material identity");
+	const nonCanonicalScopeField = findNonCanonicalRuntimePolicyScopeFieldV1(runtimePolicyScope);
+	if (nonCanonicalScopeField) return mismatch("non_canonical_tenant_root_field", `B5 runtime policy scope field is not canonical: ${nonCanonicalScopeField}`);
+	const expectedSigningRoot = signingRootScopeFromRuntimePolicyScope(runtimePolicyScope);
+	if (materialRootBinding.signingRootId !== expectedSigningRoot.signingRootId) return mismatch("signing_root_id_mismatch", "B5 signing-root ID does not match authenticated deployment configuration");
+	if (materialRootBinding.signingRootVersion !== expectedSigningRoot.signingRootVersion) return mismatch("signing_root_version_mismatch", "B5 signing-root version does not match authenticated deployment configuration");
+	const identity = buildTenantRootIdentityFromAuthenticatedDeploymentV1({
+		orgId: runtimePolicyScope.orgId,
+		projectId: runtimePolicyScope.projectId,
+		envId: runtimePolicyScope.envId,
+		signingRootId: expectedSigningRoot.signingRootId,
+		signingRootVersion: expectedSigningRoot.signingRootVersion
+	});
+	if (!identity.ok) return mismatch("non_canonical_tenant_root_field", `Authenticated tenant-root identity field is not canonical: ${identity.error.kind === "invalid_field" ? identity.error.field : "identity"}`);
+	return {
+		ok: true,
+		identity: identity.value
+	};
+}
+//#endregion
+export { findForbiddenTenantRootSelectorFieldV1, resolveTenantRootIdentityV1 };
+
+//# sourceMappingURL=tenantRootIdentityResolution.js.map