@seams/wallet-server 0.5.0

package/dist/esm/shared-ts/src/utils/routerAbEd25519Yao.js

@@ -0,0 +1,984 @@
+import { parseRouterAbMpcMaterialActivationRef, sameRouterAbMpcMaterialActivationRef } from "./routerAbNormalSigningIdentity.js";
+//#region ../shared-ts/src/utils/routerAbEd25519Yao.ts
+const ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1 = "/router-ab/ed25519/yao/registration/admit";
+const ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1 = "/router-ab/ed25519/yao/registration/execute";
+const ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1 = "/router-ab/ed25519/yao/recovery/admit";
+const ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1 = "/router-ab/ed25519/yao/recovery/execute";
+const ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1 = "/router-ab/ed25519/yao/recovery/activate";
+const ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1 = "/router-ab/ed25519/yao/recovery/status";
+const ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1 = "x-seams-wallet-recovery-challenge-id";
+const ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1 = "/router-ab/ed25519/yao/recovery/bootstrap";
+const ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1 = "router_ab_ed25519_yao_email_otp_recovery_v1";
+const ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1 = "/router-ab/ed25519/yao/export/admit";
+const ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1 = "/router-ab/ed25519/yao/export/execute";
+const ED25519_YAO_CONTROL_CIPHERTEXT_MAX_BYTES_V1 = 64 * 1024;
+function sameRouterAbEd25519YaoActivationBindingV1(left, right) {
+	return left.operation === right.operation && sameRouterAbEd25519YaoByteSequence(left.session_id, right.session_id) && sameRouterAbEd25519YaoByteSequence(left.stable_key_context_binding, right.stable_key_context_binding) && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation) && left.lifecycle.lifecycle_id === right.lifecycle.lifecycle_id && left.lifecycle.work_kind === right.lifecycle.work_kind && left.lifecycle.primitive_request_kind === right.lifecycle.primitive_request_kind && left.lifecycle.root_share_epoch === right.lifecycle.root_share_epoch && left.lifecycle.account_id === right.lifecycle.account_id && left.lifecycle.session_id === right.lifecycle.session_id && left.lifecycle.signer_set_id === right.lifecycle.signer_set_id && left.lifecycle.selected_server_id === right.lifecycle.selected_server_id;
+}
+function sameRouterAbEd25519YaoByteSequence(left, right) {
+	return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function sameRouterAbEd25519YaoParticipantPairV1(left, right) {
+	return left[0] === right[0] && left[1] === right[1];
+}
+function sameRouterAbEd25519YaoLifecycleScopeV1(left, right) {
+	return left.lifecycle_id === right.lifecycle_id && left.root_share_epoch === right.root_share_epoch && left.account_id === right.account_id && left.threshold_session_id === right.threshold_session_id && left.signer_set_id === right.signer_set_id && left.signing_worker_id === right.signing_worker_id && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation);
+}
+function sameRouterAbEd25519YaoApplicationBindingFactsV1(left, right) {
+	return left.wallet_id === right.wallet_id && left.near_ed25519_signing_key_id === right.near_ed25519_signing_key_id && left.signing_root_id === right.signing_root_id && left.key_creation_signer_slot === right.key_creation_signer_slot;
+}
+function sameRouterAbEd25519YaoRegistrationAdmissionRequestV1(left, right) {
+	return sameRouterAbEd25519YaoLifecycleScopeV1(left.scope, right.scope) && sameRouterAbEd25519YaoApplicationBindingFactsV1(left.application_binding, right.application_binding) && sameRouterAbEd25519YaoParticipantPairV1(left.participant_ids, right.participant_ids);
+}
+function sameRouterAbEd25519YaoRecoveryAdmissionRequestV1(left, right) {
+	return sameRouterAbEd25519YaoLifecycleScopeV1(left.scope, right.scope) && sameRouterAbMpcMaterialActivationRef(left.active_material_activation, right.active_material_activation) && sameRouterAbEd25519YaoApplicationBindingFactsV1(left.application_binding, right.application_binding) && sameRouterAbEd25519YaoParticipantPairV1(left.participant_ids, right.participant_ids) && sameRouterAbEd25519YaoByteSequence(left.active_capability_binding, right.active_capability_binding) && sameRouterAbEd25519YaoByteSequence(left.replacement_capability_binding, right.replacement_capability_binding) && sameRouterAbEd25519YaoByteSequence(left.registered_public_key, right.registered_public_key);
+}
+function sameRouterAbEd25519YaoActivationKeysetV1(left, right) {
+	return sameRouterAbEd25519YaoByteSequence(left.deriver_a_input_public_key, right.deriver_a_input_public_key) && sameRouterAbEd25519YaoByteSequence(left.deriver_b_input_public_key, right.deriver_b_input_public_key) && sameRouterAbEd25519YaoByteSequence(left.signing_worker_recipient_public_key, right.signing_worker_recipient_public_key);
+}
+function sameRouterAbEd25519YaoActivationPublicReceiptV1(left, right) {
+	return sameRouterAbEd25519YaoByteSequence(left.transcript, right.transcript) && sameRouterAbEd25519YaoByteSequence(left.registered_public_key, right.registered_public_key) && sameRouterAbEd25519YaoByteSequence(left.joined_client_commitment, right.joined_client_commitment) && sameRouterAbEd25519YaoByteSequence(left.joined_signing_worker_commitment, right.joined_signing_worker_commitment) && sameRouterAbEd25519YaoByteSequence(left.signing_worker_verifying_share, right.signing_worker_verifying_share) && left.state_epoch === right.state_epoch && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation);
+}
+const REGISTRATION_WORK_KIND = "registration_prepare";
+const REGISTRATION_PRIMITIVE_REQUEST_KIND = "registration";
+const RECOVERY_WORK_KIND = "recovery";
+const RECOVERY_PRIMITIVE_REQUEST_KIND = "recovery";
+const EXPORT_WORK_KIND = "key_export";
+const EXPORT_PRIMITIVE_REQUEST_KIND = "export";
+const APPLICATION_BINDING_DOMAIN = "seams/router-ab/ed25519-yao/application-binding/v1";
+const STABLE_KEY_CONTEXT_DOMAIN = "seams/router-ab/ed25519-yao/stable-key-context/v1";
+const STABLE_KEY_CONTEXT_BINDING_DOMAIN = "seams/router-ab/ed25519-yao/stable-key-context-binding/v1";
+const EXPORT_CONFIRMATION_DOMAIN = "seams/router-ab/ed25519-yao/export-confirmation/v1";
+const EXPORT_AUTHORIZATION_DOMAIN = "seams/router-ab/ed25519-yao/export-authorization/v1";
+const RUNTIME_POLICY_BINDING_DOMAIN = "seams/router-ab/runtime-policy-binding/v1";
+const UTF8 = new TextEncoder();
+function requireRecord(value, label) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
+	return value;
+}
+function requireExactKeys(record, label, allowedKeys) {
+	const allowed = new Set(allowedKeys);
+	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is not a supported field`);
+	for (const key of allowedKeys) if (!Object.hasOwn(record, key)) throw new Error(`${label}.${key} is required`);
+}
+function requireVisibleIdentifier(value, label) {
+	if (typeof value !== "string" || value.length === 0) throw new Error(`${label} must be a non-empty visible ASCII string`);
+	for (let index = 0; index < value.length; index += 1) {
+		const code = value.charCodeAt(index);
+		if (code < 33 || code > 126) throw new Error(`${label} must contain visible ASCII bytes`);
+	}
+	return value;
+}
+function requirePositiveU32(value, label) {
+	if (!Number.isInteger(value) || typeof value !== "number" || value <= 0 || value > 4294967295) throw new Error(`${label} must be a positive u32`);
+	return value;
+}
+function requirePositiveSafeInteger(value, label) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
+	return value;
+}
+function requireByte(value, label) {
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > 255) throw new Error(`${label} must be a byte`);
+	return value;
+}
+function requireBytes(value, label, minimumLength, maximumLength) {
+	if (!Array.isArray(value)) throw new Error(`${label} must be a byte array`);
+	if (value.length < minimumLength || value.length > maximumLength) throw new Error(`${label} has an invalid length`);
+	const parsed = [];
+	for (let index = 0; index < value.length; index += 1) parsed.push(requireByte(value[index], `${label}[${index}]`));
+	return parsed;
+}
+function requireBytes32(value, label, nonzero) {
+	const parsed = requireBytes(value, label, 32, 32);
+	if (nonzero && isZeroBytes(parsed)) throw new Error(`${label} must be nonzero`);
+	return parsed;
+}
+function isZeroBytes(value) {
+	for (const byte of value) if (byte !== 0) return false;
+	return true;
+}
+function equalBytes(left, right) {
+	if (left.length !== right.length) return false;
+	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
+	return true;
+}
+function u32BigEndian(value) {
+	const bytes = new Uint8Array(4);
+	new DataView(bytes.buffer).setUint32(0, value, false);
+	return bytes;
+}
+function u16BigEndian(value) {
+	const bytes = new Uint8Array(2);
+	new DataView(bytes.buffer).setUint16(0, value, false);
+	return bytes;
+}
+function u64BigEndian(value) {
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error("u64 value must be a positive safe integer");
+	const bytes = new Uint8Array(8);
+	new DataView(bytes.buffer).setBigUint64(0, BigInt(value), false);
+	return bytes;
+}
+function concatenateBytes(chunks) {
+	let length = 0;
+	for (const chunk of chunks) length += chunk.length;
+	const output = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of chunks) {
+		output.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return output;
+}
+function lengthDelimited(value) {
+	return concatenateBytes([u32BigEndian(value.length), value]);
+}
+function labeledField(label, value) {
+	return concatenateBytes([lengthDelimited(UTF8.encode(label)), lengthDelimited(value)]);
+}
+async function sha256(value) {
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", value);
+	return new Uint8Array(digest);
+}
+async function deriveRouterAbEd25519YaoApplicationBindingDigestV1(facts) {
+	const encoded = concatenateBytes([
+		lengthDelimited(UTF8.encode(APPLICATION_BINDING_DOMAIN)),
+		labeledField("walletId", UTF8.encode(facts.wallet_id)),
+		labeledField("nearEd25519SigningKeyId", UTF8.encode(facts.near_ed25519_signing_key_id)),
+		labeledField("signingRootId", UTF8.encode(facts.signing_root_id)),
+		labeledField("keyCreationSignerSlot", u32BigEndian(facts.key_creation_signer_slot))
+	]);
+	return Array.from(await sha256(encoded));
+}
+async function deriveRouterAbEd25519YaoStableContextBindingV1(applicationBinding, participantIds) {
+	const applicationDigest = await deriveRouterAbEd25519YaoApplicationBindingDigestV1(applicationBinding);
+	const context = concatenateBytes([
+		UTF8.encode(STABLE_KEY_CONTEXT_DOMAIN),
+		Uint8Array.from(applicationDigest),
+		u16BigEndian(participantIds[0]),
+		u16BigEndian(participantIds[1])
+	]);
+	return Array.from(await sha256(concatenateBytes([UTF8.encode(STABLE_KEY_CONTEXT_BINDING_DOMAIN), context])));
+}
+async function deriveRouterAbEd25519YaoRuntimePolicyBindingV1(input) {
+	const encoded = concatenateBytes([
+		lengthDelimited(UTF8.encode(RUNTIME_POLICY_BINDING_DOMAIN)),
+		labeledField("orgId", UTF8.encode(requireVisibleIdentifier(input.orgId, "orgId"))),
+		labeledField("projectId", UTF8.encode(requireVisibleIdentifier(input.projectId, "projectId"))),
+		labeledField("envId", UTF8.encode(requireVisibleIdentifier(input.envId, "envId"))),
+		labeledField("signingRootVersion", UTF8.encode(requireVisibleIdentifier(input.signingRootVersion, "signingRootVersion")))
+	]);
+	return Array.from(await sha256(encoded));
+}
+function exportIdentityFields(identity) {
+	const scope = identity.scope;
+	const application = identity.application_binding;
+	return [
+		labeledField("lifecycleId", UTF8.encode(scope.lifecycle_id)),
+		labeledField("rootShareEpoch", UTF8.encode(scope.root_share_epoch)),
+		labeledField("accountId", UTF8.encode(scope.account_id)),
+		labeledField("thresholdSessionId", UTF8.encode(scope.threshold_session_id)),
+		labeledField("signerSetId", UTF8.encode(scope.signer_set_id)),
+		labeledField("signingWorkerId", UTF8.encode(scope.signing_worker_id)),
+		labeledField("walletId", UTF8.encode(application.wallet_id)),
+		labeledField("nearEd25519SigningKeyId", UTF8.encode(application.near_ed25519_signing_key_id)),
+		labeledField("signingRootId", UTF8.encode(application.signing_root_id)),
+		labeledField("keyCreationSignerSlot", u32BigEndian(application.key_creation_signer_slot)),
+		labeledField("participantA", u16BigEndian(identity.participant_ids[0])),
+		labeledField("participantB", u16BigEndian(identity.participant_ids[1])),
+		labeledField("registeredPublicKey", Uint8Array.from(identity.registered_public_key)),
+		labeledField("stateEpoch", u64BigEndian(identity.state_epoch)),
+		labeledField("runtimePolicyBinding", Uint8Array.from(identity.runtime_policy_binding))
+	];
+}
+async function deriveRouterAbEd25519YaoExportConfirmationDigestV1(input) {
+	const nonce = requireBytes32(input.nonce, "export authorization nonce", true);
+	if (input.expiresAtMs <= input.issuedAtMs) throw new Error("export authorization expiry must follow issue time");
+	const encoded = concatenateBytes([
+		lengthDelimited(UTF8.encode(EXPORT_CONFIRMATION_DOMAIN)),
+		...exportIdentityFields(input.identity),
+		labeledField("nonce", Uint8Array.from(nonce)),
+		labeledField("issuedAtMs", u64BigEndian(input.issuedAtMs)),
+		labeledField("expiresAtMs", u64BigEndian(input.expiresAtMs))
+	]);
+	return Array.from(await sha256(encoded));
+}
+async function deriveRouterAbEd25519YaoExportAuthorizationDigestV1(input) {
+	const confirmationDigest = requireBytes32(input.confirmationDigest, "export confirmation digest", true);
+	const nonce = requireBytes32(input.nonce, "export authorization nonce", true);
+	const encoded = concatenateBytes([
+		lengthDelimited(UTF8.encode(EXPORT_AUTHORIZATION_DOMAIN)),
+		...exportIdentityFields(input.identity),
+		labeledField("confirmationDigest", Uint8Array.from(confirmationDigest)),
+		labeledField("nonce", Uint8Array.from(nonce)),
+		labeledField("issuedAtMs", u64BigEndian(input.issuedAtMs)),
+		labeledField("expiresAtMs", u64BigEndian(input.expiresAtMs)),
+		labeledField("authorityKind", UTF8.encode(input.authority.kind)),
+		labeledField("authoritySubject", UTF8.encode(input.authority.kind === "passkey" ? requireVisibleIdentifier(input.authority.credentialIdB64u, "credentialIdB64u") : requireVisibleIdentifier(input.authority.providerSubjectId, "providerSubjectId")))
+	]);
+	return Array.from(await sha256(encoded));
+}
+function parseOperation(value, label) {
+	switch (value) {
+		case "registration":
+		case "recovery":
+		case "refresh":
+		case "export":
+		case "lane_provisioning":
+		case "lane_refresh": return value;
+		default: throw new Error(`${label} is invalid`);
+	}
+}
+function parseDeriverRole(value, label) {
+	switch (value) {
+		case "deriver_a":
+		case "deriver_b": return value;
+		default: throw new Error(`${label} is invalid`);
+	}
+}
+function parseInputKind(value, label) {
+	switch (value) {
+		case "activation":
+		case "export": return value;
+		default: throw new Error(`${label} is invalid`);
+	}
+}
+function parsePackageKind(value, label) {
+	switch (value) {
+		case "activation_client":
+		case "activation_signing_worker":
+		case "export_client": return value;
+		default: throw new Error(`${label} is invalid`);
+	}
+}
+function parseWorkKind(value, label) {
+	switch (value) {
+		case "registration_prepare":
+		case "key_export":
+		case "recovery":
+		case "server_share_refresh": return value;
+		default: throw new Error(`${label} is invalid`);
+	}
+}
+function parsePrimitiveRequestKind(value, label) {
+	switch (value) {
+		case "registration":
+		case "recovery":
+		case "export":
+		case "refresh": return value;
+		default: throw new Error(`${label} is invalid`);
+	}
+}
+function parseRouterAbEd25519YaoApplicationBindingFactsV1(value) {
+	const record = requireRecord(value, "application_binding");
+	requireExactKeys(record, "application_binding", [
+		"wallet_id",
+		"near_ed25519_signing_key_id",
+		"signing_root_id",
+		"key_creation_signer_slot"
+	]);
+	return {
+		wallet_id: requireVisibleIdentifier(record.wallet_id, "application_binding.wallet_id"),
+		near_ed25519_signing_key_id: requireVisibleIdentifier(record.near_ed25519_signing_key_id, "application_binding.near_ed25519_signing_key_id"),
+		signing_root_id: requireVisibleIdentifier(record.signing_root_id, "application_binding.signing_root_id"),
+		key_creation_signer_slot: requirePositiveU32(record.key_creation_signer_slot, "application_binding.key_creation_signer_slot")
+	};
+}
+function parsePublicLifecycleScope(value) {
+	const record = requireRecord(value, "scope");
+	requireExactKeys(record, "scope", [
+		"lifecycle_id",
+		"root_share_epoch",
+		"account_id",
+		"threshold_session_id",
+		"signer_set_id",
+		"signing_worker_id",
+		"material_activation"
+	]);
+	const accountId = requireVisibleIdentifier(record.account_id, "scope.account_id");
+	const signingWorkerId = requireVisibleIdentifier(record.signing_worker_id, "scope.signing_worker_id");
+	const materialActivation = parseRouterAbMpcMaterialActivationRef(record.material_activation);
+	if (materialActivation.material_owner !== accountId || materialActivation.signing_worker !== signingWorkerId) throw new Error("scope.material_activation does not match the lifecycle owner and worker");
+	return {
+		lifecycle_id: requireVisibleIdentifier(record.lifecycle_id, "scope.lifecycle_id"),
+		root_share_epoch: requireVisibleIdentifier(record.root_share_epoch, "scope.root_share_epoch"),
+		account_id: accountId,
+		threshold_session_id: requireVisibleIdentifier(record.threshold_session_id, "scope.threshold_session_id"),
+		signer_set_id: requireVisibleIdentifier(record.signer_set_id, "scope.signer_set_id"),
+		signing_worker_id: signingWorkerId,
+		material_activation: materialActivation
+	};
+}
+function parseParticipantIds(value) {
+	if (!Array.isArray(value) || value.length !== 2) throw new Error("participant_ids must contain exactly two values");
+	const first = requirePositiveU32(value[0], "participant_ids[0]");
+	const second = requirePositiveU32(value[1], "participant_ids[1]");
+	if (first > 65535 || second > 65535 || first >= second) throw new Error("participant_ids must be distinct, nonzero, ascending u16 values");
+	return [first, second];
+}
+function parseRouterAbEd25519YaoParticipantIdsV1(value) {
+	return parseParticipantIds(value);
+}
+function parseAdmittedLifecycle(value) {
+	const record = requireRecord(value, "binding.lifecycle");
+	requireExactKeys(record, "binding.lifecycle", [
+		"lifecycle_id",
+		"work_kind",
+		"primitive_request_kind",
+		"root_share_epoch",
+		"account_id",
+		"session_id",
+		"signer_set_id",
+		"selected_server_id"
+	]);
+	const lifecycle = {
+		lifecycle_id: requireVisibleIdentifier(record.lifecycle_id, "binding.lifecycle.lifecycle_id"),
+		work_kind: parseWorkKind(record.work_kind, "binding.lifecycle.work_kind"),
+		primitive_request_kind: parsePrimitiveRequestKind(record.primitive_request_kind, "binding.lifecycle.primitive_request_kind"),
+		root_share_epoch: requireVisibleIdentifier(record.root_share_epoch, "binding.lifecycle.root_share_epoch"),
+		account_id: requireVisibleIdentifier(record.account_id, "binding.lifecycle.account_id"),
+		session_id: requireVisibleIdentifier(record.session_id, "binding.lifecycle.session_id"),
+		signer_set_id: requireVisibleIdentifier(record.signer_set_id, "binding.lifecycle.signer_set_id"),
+		selected_server_id: requireVisibleIdentifier(record.selected_server_id, "binding.lifecycle.selected_server_id")
+	};
+	if (lifecycle.work_kind === REGISTRATION_WORK_KIND && lifecycle.primitive_request_kind !== REGISTRATION_PRIMITIVE_REQUEST_KIND) throw new Error("binding.lifecycle primitive request kind does not match its work kind");
+	if (lifecycle.work_kind === RECOVERY_WORK_KIND && lifecycle.primitive_request_kind !== RECOVERY_PRIMITIVE_REQUEST_KIND) throw new Error("binding.lifecycle primitive request kind does not match its work kind");
+	if (lifecycle.work_kind === EXPORT_WORK_KIND && lifecycle.primitive_request_kind !== EXPORT_PRIMITIVE_REQUEST_KIND) throw new Error("binding.lifecycle primitive request kind does not match its work kind");
+	return lifecycle;
+}
+function parseCeremonyBinding(value) {
+	const record = requireRecord(value, "binding");
+	requireExactKeys(record, "binding", [
+		"lifecycle",
+		"operation",
+		"session_id",
+		"stable_key_context_binding",
+		"material_activation"
+	]);
+	const binding = {
+		lifecycle: parseAdmittedLifecycle(record.lifecycle),
+		operation: parseOperation(record.operation, "binding.operation"),
+		session_id: requireBytes32(record.session_id, "binding.session_id", true),
+		stable_key_context_binding: requireBytes32(record.stable_key_context_binding, "binding.stable_key_context_binding", false),
+		material_activation: parseRouterAbMpcMaterialActivationRef(record.material_activation)
+	};
+	if (binding.operation === "registration" && binding.lifecycle.work_kind !== REGISTRATION_WORK_KIND) throw new Error("binding operation does not match its lifecycle work kind");
+	if (binding.operation === "recovery" && binding.lifecycle.work_kind !== RECOVERY_WORK_KIND) throw new Error("binding operation does not match its lifecycle work kind");
+	if (binding.operation === "export" && binding.lifecycle.work_kind !== EXPORT_WORK_KIND) throw new Error("binding operation does not match its lifecycle work kind");
+	if (binding.material_activation.material_owner !== binding.lifecycle.account_id || binding.material_activation.signing_worker !== binding.lifecycle.selected_server_id) throw new Error("binding material activation does not match its lifecycle owner and worker");
+	return binding;
+}
+function parseRouterAbEd25519YaoCeremonyBindingV1(value) {
+	return parseCeremonyBinding(value);
+}
+function requireExportCeremonyBinding(value) {
+	const binding = parseCeremonyBinding(value);
+	if (binding.operation !== "export" || binding.lifecycle.work_kind !== EXPORT_WORK_KIND || binding.lifecycle.primitive_request_kind !== EXPORT_PRIMITIVE_REQUEST_KIND) throw new Error("export binding requires the exact export lifecycle");
+	return {
+		lifecycle: {
+			lifecycle_id: binding.lifecycle.lifecycle_id,
+			work_kind: EXPORT_WORK_KIND,
+			primitive_request_kind: EXPORT_PRIMITIVE_REQUEST_KIND,
+			root_share_epoch: binding.lifecycle.root_share_epoch,
+			account_id: binding.lifecycle.account_id,
+			session_id: binding.lifecycle.session_id,
+			signer_set_id: binding.lifecycle.signer_set_id,
+			selected_server_id: binding.lifecycle.selected_server_id
+		},
+		operation: "export",
+		session_id: binding.session_id,
+		stable_key_context_binding: binding.stable_key_context_binding,
+		material_activation: binding.material_activation
+	};
+}
+function parseExportBinding(value) {
+	const record = requireRecord(value, "export binding");
+	requireExactKeys(record, "export binding", [
+		"ceremony",
+		"registered_public_key",
+		"state_epoch",
+		"runtime_policy_binding",
+		"authorization_digest"
+	]);
+	return {
+		ceremony: requireExportCeremonyBinding(record.ceremony),
+		registered_public_key: requireBytes32(record.registered_public_key, "export binding.registered_public_key", true),
+		state_epoch: requirePositiveSafeInteger(record.state_epoch, "export binding.state_epoch"),
+		runtime_policy_binding: requireBytes32(record.runtime_policy_binding, "export binding.runtime_policy_binding", true),
+		authorization_digest: requireBytes32(record.authorization_digest, "export binding.authorization_digest", true)
+	};
+}
+function requireActivationBinding(binding) {
+	switch (binding.operation) {
+		case "registration":
+			if (binding.lifecycle.work_kind !== REGISTRATION_WORK_KIND || binding.lifecycle.primitive_request_kind !== REGISTRATION_PRIMITIVE_REQUEST_KIND) throw new Error("activation binding has the wrong registration lifecycle kind");
+			return {
+				lifecycle: {
+					lifecycle_id: binding.lifecycle.lifecycle_id,
+					work_kind: REGISTRATION_WORK_KIND,
+					primitive_request_kind: REGISTRATION_PRIMITIVE_REQUEST_KIND,
+					root_share_epoch: binding.lifecycle.root_share_epoch,
+					account_id: binding.lifecycle.account_id,
+					session_id: binding.lifecycle.session_id,
+					signer_set_id: binding.lifecycle.signer_set_id,
+					selected_server_id: binding.lifecycle.selected_server_id
+				},
+				operation: "registration",
+				session_id: binding.session_id,
+				stable_key_context_binding: binding.stable_key_context_binding,
+				material_activation: binding.material_activation
+			};
+		case "recovery":
+			if (binding.lifecycle.work_kind !== RECOVERY_WORK_KIND || binding.lifecycle.primitive_request_kind !== RECOVERY_PRIMITIVE_REQUEST_KIND) throw new Error("activation binding has the wrong recovery lifecycle kind");
+			return {
+				lifecycle: {
+					lifecycle_id: binding.lifecycle.lifecycle_id,
+					work_kind: RECOVERY_WORK_KIND,
+					primitive_request_kind: RECOVERY_PRIMITIVE_REQUEST_KIND,
+					root_share_epoch: binding.lifecycle.root_share_epoch,
+					account_id: binding.lifecycle.account_id,
+					session_id: binding.lifecycle.session_id,
+					signer_set_id: binding.lifecycle.signer_set_id,
+					selected_server_id: binding.lifecycle.selected_server_id
+				},
+				operation: "recovery",
+				session_id: binding.session_id,
+				stable_key_context_binding: binding.stable_key_context_binding,
+				material_activation: binding.material_activation
+			};
+		case "refresh":
+		case "export":
+		case "lane_provisioning":
+		case "lane_refresh": throw new Error("activation binding has a non-activation operation");
+	}
+}
+function parseKeyset(value) {
+	const record = requireRecord(value, "keyset");
+	requireExactKeys(record, "keyset", [
+		"deriver_a_input_public_key",
+		"deriver_b_input_public_key",
+		"signing_worker_recipient_public_key"
+	]);
+	const keyset = {
+		deriver_a_input_public_key: requireBytes32(record.deriver_a_input_public_key, "keyset.deriver_a_input_public_key", true),
+		deriver_b_input_public_key: requireBytes32(record.deriver_b_input_public_key, "keyset.deriver_b_input_public_key", true),
+		signing_worker_recipient_public_key: requireBytes32(record.signing_worker_recipient_public_key, "keyset.signing_worker_recipient_public_key", true)
+	};
+	if (equalBytes(keyset.deriver_a_input_public_key, keyset.deriver_b_input_public_key) || equalBytes(keyset.deriver_a_input_public_key, keyset.signing_worker_recipient_public_key) || equalBytes(keyset.deriver_b_input_public_key, keyset.signing_worker_recipient_public_key)) throw new Error("keyset public keys must be distinct");
+	return keyset;
+}
+function parseRouterAbEd25519YaoActivationKeysetV1(value) {
+	return parseKeyset(value);
+}
+function parseEncryptedInput(value, label) {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"kind",
+		"deriver",
+		"operation",
+		"session",
+		"stable_context_binding",
+		"encapsulated_key",
+		"ciphertext"
+	]);
+	const input = {
+		kind: parseInputKind(record.kind, `${label}.kind`),
+		deriver: parseDeriverRole(record.deriver, `${label}.deriver`),
+		operation: parseOperation(record.operation, `${label}.operation`),
+		session: requireBytes32(record.session, `${label}.session`, true),
+		stable_context_binding: requireBytes32(record.stable_context_binding, `${label}.stable_context_binding`, true),
+		encapsulated_key: requireBytes32(record.encapsulated_key, `${label}.encapsulated_key`, true),
+		ciphertext: requireBytes(record.ciphertext, `${label}.ciphertext`, 16, ED25519_YAO_CONTROL_CIPHERTEXT_MAX_BYTES_V1)
+	};
+	if (input.kind === "activation" && input.operation === "export") throw new Error(`${label} operation does not match its circuit family`);
+	if (input.kind === "export" && input.operation !== "export") throw new Error(`${label} operation does not match its circuit family`);
+	return input;
+}
+function requireActivationInput(binding, input, expectedDeriver, label) {
+	if (input.kind !== "activation" || input.deriver !== expectedDeriver || input.operation !== binding.operation || !equalBytes(input.session, binding.session_id) || !equalBytes(input.stable_context_binding, binding.stable_key_context_binding)) throw new Error(`${label} does not match the admitted activation binding`);
+	switch (binding.operation) {
+		case "registration": return {
+			kind: "activation",
+			deriver: expectedDeriver,
+			operation: "registration",
+			session: input.session,
+			stable_context_binding: input.stable_context_binding,
+			encapsulated_key: input.encapsulated_key,
+			ciphertext: input.ciphertext
+		};
+		case "recovery": return {
+			kind: "activation",
+			deriver: expectedDeriver,
+			operation: "recovery",
+			session: input.session,
+			stable_context_binding: input.stable_context_binding,
+			encapsulated_key: input.encapsulated_key,
+			ciphertext: input.ciphertext
+		};
+	}
+}
+function requireExportInput(binding, input, expectedDeriver, label) {
+	if (input.kind !== "export" || input.deriver !== expectedDeriver || input.operation !== "export" || !equalBytes(input.session, binding.ceremony.session_id) || !equalBytes(input.stable_context_binding, binding.ceremony.stable_key_context_binding)) throw new Error(`${label} does not match the admitted export binding`);
+	return {
+		kind: "export",
+		deriver: expectedDeriver,
+		operation: "export",
+		session: input.session,
+		stable_context_binding: input.stable_context_binding,
+		encapsulated_key: input.encapsulated_key,
+		ciphertext: input.ciphertext
+	};
+}
+function parseEncryptedPackage(value, label) {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"kind",
+		"deriver",
+		"session",
+		"transcript",
+		"encapsulated_key",
+		"ciphertext"
+	]);
+	return {
+		kind: parsePackageKind(record.kind, `${label}.kind`),
+		deriver: parseDeriverRole(record.deriver, `${label}.deriver`),
+		session: requireBytes32(record.session, `${label}.session`, true),
+		transcript: requireBytes32(record.transcript, `${label}.transcript`, true),
+		encapsulated_key: requireBytes32(record.encapsulated_key, `${label}.encapsulated_key`, true),
+		ciphertext: requireBytes(record.ciphertext, `${label}.ciphertext`, 16, ED25519_YAO_CONTROL_CIPHERTEXT_MAX_BYTES_V1)
+	};
+}
+function parseRouterAbEd25519YaoActivationPublicReceiptV1(value) {
+	const record = requireRecord(value, "public_receipt");
+	requireExactKeys(record, "public_receipt", [
+		"transcript",
+		"registered_public_key",
+		"joined_client_commitment",
+		"joined_signing_worker_commitment",
+		"signing_worker_verifying_share",
+		"state_epoch",
+		"material_activation"
+	]);
+	return {
+		transcript: requireBytes32(record.transcript, "public_receipt.transcript", true),
+		registered_public_key: requireBytes32(record.registered_public_key, "public_receipt.registered_public_key", true),
+		joined_client_commitment: requireBytes32(record.joined_client_commitment, "public_receipt.joined_client_commitment", true),
+		joined_signing_worker_commitment: requireBytes32(record.joined_signing_worker_commitment, "public_receipt.joined_signing_worker_commitment", true),
+		signing_worker_verifying_share: requireBytes32(record.signing_worker_verifying_share, "public_receipt.signing_worker_verifying_share", true),
+		state_epoch: requirePositiveSafeInteger(record.state_epoch, "public_receipt.state_epoch"),
+		material_activation: parseRouterAbMpcMaterialActivationRef(record.material_activation)
+	};
+}
+function requireActivationClientPackage(binding, receipt, packageValue, expectedDeriver, label) {
+	if (packageValue.kind !== "activation_client" || packageValue.deriver !== expectedDeriver || !equalBytes(packageValue.session, binding.session_id) || !equalBytes(packageValue.transcript, receipt.transcript)) throw new Error(`${label} does not match the terminal activation receipt`);
+	return {
+		kind: "activation_client",
+		deriver: expectedDeriver,
+		session: packageValue.session,
+		transcript: packageValue.transcript,
+		encapsulated_key: packageValue.encapsulated_key,
+		ciphertext: packageValue.ciphertext
+	};
+}
+function requireExportClientPackage(binding, transcript, packageValue, expectedDeriver, label) {
+	if (packageValue.kind !== "export_client" || packageValue.deriver !== expectedDeriver || !equalBytes(packageValue.session, binding.ceremony.session_id) || !equalBytes(packageValue.transcript, transcript)) throw new Error(`${label} does not match the terminal export result`);
+	return {
+		kind: "export_client",
+		deriver: expectedDeriver,
+		session: packageValue.session,
+		transcript: packageValue.transcript,
+		encapsulated_key: packageValue.encapsulated_key,
+		ciphertext: packageValue.ciphertext
+	};
+}
+function parseBoundary(parser, value) {
+	try {
+		return {
+			ok: true,
+			value: parser(value)
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+function parseRegistrationAdmissionRequestValue(value) {
+	const record = requireRecord(value, "registration admission request");
+	requireExactKeys(record, "registration admission request", [
+		"scope",
+		"application_binding",
+		"participant_ids"
+	]);
+	return {
+		scope: parsePublicLifecycleScope(record.scope),
+		application_binding: parseRouterAbEd25519YaoApplicationBindingFactsV1(record.application_binding),
+		participant_ids: parseParticipantIds(record.participant_ids)
+	};
+}
+function parseRecoveryAdmissionRequestValue(value) {
+	const record = requireRecord(value, "recovery admission request");
+	requireExactKeys(record, "recovery admission request", [
+		"scope",
+		"active_material_activation",
+		"application_binding",
+		"participant_ids",
+		"active_capability_binding",
+		"replacement_capability_binding",
+		"registered_public_key"
+	]);
+	const activeCapabilityBinding = requireBytes32(record.active_capability_binding, "recovery admission request.active_capability_binding", true);
+	const replacementCapabilityBinding = requireBytes32(record.replacement_capability_binding, "recovery admission request.replacement_capability_binding", true);
+	if (equalBytes(activeCapabilityBinding, replacementCapabilityBinding)) throw new Error("recovery replacement capability binding must be fresh");
+	const scope = parsePublicLifecycleScope(record.scope);
+	const activeMaterialActivation = parseRouterAbMpcMaterialActivationRef(record.active_material_activation);
+	const replacementMaterialActivation = scope.material_activation;
+	if (activeMaterialActivation.activation_id === replacementMaterialActivation.activation_id || activeMaterialActivation.lifecycle_binding === replacementMaterialActivation.lifecycle_binding) throw new Error("recovery replacement material activation identity must be fresh");
+	if (activeMaterialActivation.capability !== replacementMaterialActivation.capability || activeMaterialActivation.material_owner !== replacementMaterialActivation.material_owner || activeMaterialActivation.key_binding !== replacementMaterialActivation.key_binding || activeMaterialActivation.signing_worker !== replacementMaterialActivation.signing_worker) throw new Error("recovery replacement material activation changed stable identity facts");
+	return {
+		scope,
+		active_material_activation: activeMaterialActivation,
+		application_binding: parseRouterAbEd25519YaoApplicationBindingFactsV1(record.application_binding),
+		participant_ids: parseParticipantIds(record.participant_ids),
+		active_capability_binding: activeCapabilityBinding,
+		replacement_capability_binding: replacementCapabilityBinding,
+		registered_public_key: requireBytes32(record.registered_public_key, "recovery admission request.registered_public_key", true)
+	};
+}
+function parseRecoveryStatusRequestValue(value) {
+	const record = requireRecord(value, "recovery status request");
+	requireExactKeys(record, "recovery status request", ["kind", "admission"]);
+	if (record.kind !== "router_ab_ed25519_yao_recovery_status_request_v1") throw new Error("recovery status request.kind is invalid");
+	return {
+		kind: "router_ab_ed25519_yao_recovery_status_request_v1",
+		admission: parseRecoveryAdmissionRequestValue(record.admission)
+	};
+}
+function parseWarmRecoveryBootstrapRequestValue(value) {
+	const record = requireRecord(value, "warm recovery bootstrap request");
+	requireExactKeys(record, "warm recovery bootstrap request", [
+		"kind",
+		"walletId",
+		"nearAccountId",
+		"nearEd25519SigningKeyId",
+		"signerSlot",
+		"thresholdSessionId",
+		"signingWorkerId",
+		"participantIds"
+	]);
+	if (record.kind !== "router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1") throw new Error("warm recovery bootstrap request.kind is invalid");
+	return {
+		kind: "router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1",
+		walletId: requireVisibleIdentifier(record.walletId, "warm recovery bootstrap request.walletId"),
+		nearAccountId: requireVisibleIdentifier(record.nearAccountId, "warm recovery bootstrap request.nearAccountId"),
+		nearEd25519SigningKeyId: requireVisibleIdentifier(record.nearEd25519SigningKeyId, "warm recovery bootstrap request.nearEd25519SigningKeyId"),
+		signerSlot: requirePositiveSafeInteger(record.signerSlot, "warm recovery bootstrap request.signerSlot"),
+		thresholdSessionId: requireVisibleIdentifier(record.thresholdSessionId, "warm recovery bootstrap request.thresholdSessionId"),
+		signingWorkerId: requireVisibleIdentifier(record.signingWorkerId, "warm recovery bootstrap request.signingWorkerId"),
+		participantIds: parseParticipantIds(record.participantIds)
+	};
+}
+function parseExportAuthorization(value) {
+	const record = requireRecord(value, "export authorization");
+	requireExactKeys(record, "export authorization", [
+		"confirmation_digest",
+		"authorization_digest",
+		"nonce",
+		"issued_at_ms",
+		"expires_at_ms"
+	]);
+	const issuedAtMs = requirePositiveSafeInteger(record.issued_at_ms, "export authorization.issued_at_ms");
+	const expiresAtMs = requirePositiveSafeInteger(record.expires_at_ms, "export authorization.expires_at_ms");
+	if (expiresAtMs <= issuedAtMs) throw new Error("export authorization expiry must follow its issue time");
+	return {
+		confirmation_digest: requireBytes32(record.confirmation_digest, "export authorization.confirmation_digest", true),
+		authorization_digest: requireBytes32(record.authorization_digest, "export authorization.authorization_digest", true),
+		nonce: requireBytes32(record.nonce, "export authorization.nonce", true),
+		issued_at_ms: issuedAtMs,
+		expires_at_ms: expiresAtMs
+	};
+}
+function parseExportAdmissionRequestValue(value) {
+	const record = requireRecord(value, "export admission request");
+	requireExactKeys(record, "export admission request", [
+		"scope",
+		"application_binding",
+		"participant_ids",
+		"registered_public_key",
+		"state_epoch",
+		"runtime_policy_binding",
+		"authorization"
+	]);
+	return {
+		scope: parsePublicLifecycleScope(record.scope),
+		application_binding: parseRouterAbEd25519YaoApplicationBindingFactsV1(record.application_binding),
+		participant_ids: parseParticipantIds(record.participant_ids),
+		registered_public_key: requireBytes32(record.registered_public_key, "export admission request.registered_public_key", true),
+		state_epoch: requirePositiveSafeInteger(record.state_epoch, "export admission request.state_epoch"),
+		runtime_policy_binding: requireBytes32(record.runtime_policy_binding, "export admission request.runtime_policy_binding", true),
+		authorization: parseExportAuthorization(record.authorization)
+	};
+}
+function parseExportAdmissionReceiptValue(value) {
+	const record = requireRecord(value, "export admission receipt");
+	requireExactKeys(record, "export admission receipt", ["binding", "keyset"]);
+	return {
+		binding: parseExportBinding(record.binding),
+		keyset: parseKeyset(record.keyset)
+	};
+}
+function parseExportExecuteRequestValue(value) {
+	const record = requireRecord(value, "export execute request");
+	requireExactKeys(record, "export execute request", [
+		"binding",
+		"deriver_a_input",
+		"deriver_b_input"
+	]);
+	const binding = parseExportBinding(record.binding);
+	return {
+		binding,
+		deriver_a_input: requireExportInput(binding, parseEncryptedInput(record.deriver_a_input, "deriver_a_input"), "deriver_a", "deriver_a_input"),
+		deriver_b_input: requireExportInput(binding, parseEncryptedInput(record.deriver_b_input, "deriver_b_input"), "deriver_b", "deriver_b_input")
+	};
+}
+function parseExportResultValue(value) {
+	const record = requireRecord(value, "export result");
+	requireExactKeys(record, "export result", [
+		"binding",
+		"transcript",
+		"deriver_a_client_package",
+		"deriver_b_client_package"
+	]);
+	const binding = parseExportBinding(record.binding);
+	const transcript = requireBytes32(record.transcript, "export result.transcript", true);
+	return {
+		binding,
+		transcript,
+		deriver_a_client_package: requireExportClientPackage(binding, transcript, parseEncryptedPackage(record.deriver_a_client_package, "deriver_a_client_package"), "deriver_a", "deriver_a_client_package"),
+		deriver_b_client_package: requireExportClientPackage(binding, transcript, parseEncryptedPackage(record.deriver_b_client_package, "deriver_b_client_package"), "deriver_b", "deriver_b_client_package")
+	};
+}
+function parseActivationAdmissionReceiptValue(value) {
+	const record = requireRecord(value, "activation admission receipt");
+	requireExactKeys(record, "activation admission receipt", ["binding", "keyset"]);
+	const binding = requireActivationBinding(parseCeremonyBinding(record.binding));
+	const keyset = parseKeyset(record.keyset);
+	switch (binding.operation) {
+		case "registration": return {
+			binding,
+			keyset
+		};
+		case "recovery": return {
+			binding,
+			keyset
+		};
+	}
+}
+function parseActivationExecuteRequestValue(value) {
+	const record = requireRecord(value, "activation execute request");
+	requireExactKeys(record, "activation execute request", [
+		"binding",
+		"deriver_a_input",
+		"deriver_b_input"
+	]);
+	const binding = requireActivationBinding(parseCeremonyBinding(record.binding));
+	const deriverAInput = requireActivationInput(binding, parseEncryptedInput(record.deriver_a_input, "deriver_a_input"), "deriver_a", "deriver_a_input");
+	const deriverBInput = requireActivationInput(binding, parseEncryptedInput(record.deriver_b_input, "deriver_b_input"), "deriver_b", "deriver_b_input");
+	if (binding.operation === "registration") {
+		if (deriverAInput.operation !== "registration" || deriverBInput.operation !== "registration") throw new Error("activation inputs do not match registration binding");
+		return {
+			binding,
+			deriver_a_input: deriverAInput,
+			deriver_b_input: deriverBInput
+		};
+	}
+	if (deriverAInput.operation !== "recovery" || deriverBInput.operation !== "recovery") throw new Error("activation inputs do not match recovery binding");
+	return {
+		binding,
+		deriver_a_input: deriverAInput,
+		deriver_b_input: deriverBInput
+	};
+}
+function parseActivationResultValue(value) {
+	const record = requireRecord(value, "activation result");
+	requireExactKeys(record, "activation result", [
+		"binding",
+		"deriver_a_client_package",
+		"deriver_b_client_package",
+		"public_receipt"
+	]);
+	const binding = requireActivationBinding(parseCeremonyBinding(record.binding));
+	const receipt = parseRouterAbEd25519YaoActivationPublicReceiptV1(record.public_receipt);
+	if (!sameRouterAbMpcMaterialActivationRef(binding.material_activation, receipt.material_activation)) throw new Error("activation result receipt material does not match the admitted binding");
+	const packageA = parseEncryptedPackage(record.deriver_a_client_package, "deriver_a_client_package");
+	const packageB = parseEncryptedPackage(record.deriver_b_client_package, "deriver_b_client_package");
+	const deriverAPackage = requireActivationClientPackage(binding, receipt, packageA, "deriver_a", "deriver_a_client_package");
+	const deriverBPackage = requireActivationClientPackage(binding, receipt, packageB, "deriver_b", "deriver_b_client_package");
+	switch (binding.operation) {
+		case "registration": return {
+			binding,
+			deriver_a_client_package: deriverAPackage,
+			deriver_b_client_package: deriverBPackage,
+			public_receipt: receipt
+		};
+		case "recovery": return {
+			binding,
+			deriver_a_client_package: deriverAPackage,
+			deriver_b_client_package: deriverBPackage,
+			public_receipt: receipt
+		};
+	}
+}
+function requireRecoveryBinding(value) {
+	const binding = requireActivationBinding(parseCeremonyBinding(value));
+	switch (binding.operation) {
+		case "registration": throw new Error("recovery activation requires a recovery binding");
+		case "recovery": return binding;
+	}
+}
+function parseRecoveryActivationRequestValue(value) {
+	const record = requireRecord(value, "recovery activation request");
+	requireExactKeys(record, "recovery activation request", ["binding", "public_receipt"]);
+	return {
+		binding: requireRecoveryBinding(record.binding),
+		public_receipt: parseRouterAbEd25519YaoActivationPublicReceiptV1(record.public_receipt)
+	};
+}
+function parseRecoveryActivationReceiptValue(value) {
+	const record = requireRecord(value, "recovery activation receipt");
+	requireExactKeys(record, "recovery activation receipt", [
+		"binding",
+		"public_receipt",
+		"active_capability_binding",
+		"retired_capability_binding"
+	]);
+	const activeCapabilityBinding = requireBytes32(record.active_capability_binding, "recovery activation receipt.active_capability_binding", true);
+	const retiredCapabilityBinding = requireBytes32(record.retired_capability_binding, "recovery activation receipt.retired_capability_binding", true);
+	if (equalBytes(activeCapabilityBinding, retiredCapabilityBinding)) throw new Error("recovery activation receipt capability bindings must be distinct");
+	return {
+		binding: requireRecoveryBinding(record.binding),
+		public_receipt: parseRouterAbEd25519YaoActivationPublicReceiptV1(record.public_receipt),
+		active_capability_binding: activeCapabilityBinding,
+		retired_capability_binding: retiredCapabilityBinding
+	};
+}
+function isActivationAdmissionReceiptFor(value, operation) {
+	return value.binding.operation === operation;
+}
+function isActivationExecuteRequestFor(value, operation) {
+	return value.binding.operation === operation;
+}
+function isActivationResultFor(value, operation) {
+	return value.binding.operation === operation;
+}
+function operationMismatch(operation) {
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: `activation value must use the ${operation} operation`
+	};
+}
+function parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(value) {
+	return parseBoundary(parseRegistrationAdmissionRequestValue, value);
+}
+function parseRouterAbEd25519YaoRecoveryAdmissionRequestV1(value) {
+	return parseBoundary(parseRecoveryAdmissionRequestValue, value);
+}
+function parseRouterAbEd25519YaoRecoveryStatusRequestV1(value) {
+	return parseBoundary(parseRecoveryStatusRequestValue, value);
+}
+function parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1(value) {
+	return parseBoundary(parseWarmRecoveryBootstrapRequestValue, value);
+}
+function parseRouterAbEd25519YaoExportAdmissionRequestV1(value) {
+	return parseBoundary(parseExportAdmissionRequestValue, value);
+}
+function parseRouterAbEd25519YaoExportAdmissionReceiptV1(value) {
+	return parseBoundary(parseExportAdmissionReceiptValue, value);
+}
+function parseRouterAbEd25519YaoExportExecuteRequestV1(value) {
+	return parseBoundary(parseExportExecuteRequestValue, value);
+}
+function parseRouterAbEd25519YaoExportResultV1(value) {
+	return parseBoundary(parseExportResultValue, value);
+}
+function parseRouterAbEd25519YaoActivationAdmissionReceiptV1(value) {
+	return parseBoundary(parseActivationAdmissionReceiptValue, value);
+}
+function parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(value) {
+	const parsed = parseRouterAbEd25519YaoActivationAdmissionReceiptV1(value);
+	if (!parsed.ok) return parsed;
+	if (!isActivationAdmissionReceiptFor(parsed.value, "registration")) return operationMismatch("registration");
+	return {
+		ok: true,
+		value: parsed.value
+	};
+}
+function parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1(value) {
+	const parsed = parseRouterAbEd25519YaoActivationAdmissionReceiptV1(value);
+	if (!parsed.ok) return parsed;
+	if (!isActivationAdmissionReceiptFor(parsed.value, "recovery")) return operationMismatch("recovery");
+	return {
+		ok: true,
+		value: parsed.value
+	};
+}
+function parseRouterAbEd25519YaoActivationExecuteRequestV1(value) {
+	return parseBoundary(parseActivationExecuteRequestValue, value);
+}
+function parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1(value) {
+	const parsed = parseRouterAbEd25519YaoActivationExecuteRequestV1(value);
+	if (!parsed.ok) return parsed;
+	if (!isActivationExecuteRequestFor(parsed.value, "registration")) return operationMismatch("registration");
+	return {
+		ok: true,
+		value: parsed.value
+	};
+}
+function parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1(value) {
+	const parsed = parseRouterAbEd25519YaoActivationExecuteRequestV1(value);
+	if (!parsed.ok) return parsed;
+	if (!isActivationExecuteRequestFor(parsed.value, "recovery")) return operationMismatch("recovery");
+	return {
+		ok: true,
+		value: parsed.value
+	};
+}
+function parseRouterAbEd25519YaoActivationResultV1(value) {
+	return parseBoundary(parseActivationResultValue, value);
+}
+function parseRouterAbEd25519YaoRegistrationActivationResultV1(value) {
+	const parsed = parseRouterAbEd25519YaoActivationResultV1(value);
+	if (!parsed.ok) return parsed;
+	if (!isActivationResultFor(parsed.value, "registration")) return operationMismatch("registration");
+	return {
+		ok: true,
+		value: parsed.value
+	};
+}
+function parseRouterAbEd25519YaoRecoveryActivationResultV1(value) {
+	const parsed = parseRouterAbEd25519YaoActivationResultV1(value);
+	if (!parsed.ok) return parsed;
+	if (!isActivationResultFor(parsed.value, "recovery")) return operationMismatch("recovery");
+	return {
+		ok: true,
+		value: parsed.value
+	};
+}
+function parseRouterAbEd25519YaoRecoveryActivationRequestV1(value) {
+	return parseBoundary(parseRecoveryActivationRequestValue, value);
+}
+function parseRouterAbEd25519YaoRecoveryActivationReceiptV1(value) {
+	return parseBoundary(parseRecoveryActivationReceiptValue, value);
+}
+function parseRouterAbEd25519YaoEncryptedPackageV1(value) {
+	return parseBoundary(parseEncryptedPackageValue, value);
+}
+function parseEncryptedPackageValue(value) {
+	return parseEncryptedPackage(value, "encrypted_package");
+}
+//#endregion
+export { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, deriveRouterAbEd25519YaoApplicationBindingDigestV1, deriveRouterAbEd25519YaoExportAuthorizationDigestV1, deriveRouterAbEd25519YaoExportConfirmationDigestV1, deriveRouterAbEd25519YaoRuntimePolicyBindingV1, deriveRouterAbEd25519YaoStableContextBindingV1, parseRouterAbEd25519YaoActivationKeysetV1, parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportAdmissionRequestV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationRequestV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRecoveryStatusRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoActivationKeysetV1, sameRouterAbEd25519YaoActivationPublicReceiptV1, sameRouterAbEd25519YaoRecoveryAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 };
+
+//# sourceMappingURL=routerAbEd25519Yao.js.map