@seams/wallet-server 0.5.0

package/dist/esm/shared-ts/src/utils/routerAbNormalSigningIdentity.js

@@ -0,0 +1,118 @@
+import { parseMpcMaterialActivationRef } from "./domainIds.js";
+//#region ../shared-ts/src/utils/routerAbNormalSigningIdentity.ts
+function requireRecord(value, label) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
+	return value;
+}
+function requireExactFields(record, expectedFields, label) {
+	const actualFields = Object.keys(record).sort();
+	const expected = [...expectedFields].sort();
+	if (actualFields.length !== expected.length || actualFields.some((field, index) => field !== expected[index])) throw new Error(`${label} has invalid fields`);
+}
+function requireAsciiString(value, label) {
+	if (typeof value !== "string" || value.trim() !== value || !value) throw new Error(`${label} is required`);
+	if (!/^[\x20-\x7e]+$/.test(value)) throw new Error(`${label} must be printable ASCII`);
+	return value;
+}
+function parseRouterAbNormalSigningAuthorization(value) {
+	const authorization = requireRecord(value, "authorization");
+	switch (authorization.kind) {
+		case "reusable_wallet_session":
+			requireExactFields(authorization, ["kind", "wallet_session_id"], "authorization");
+			return {
+				kind: "reusable_wallet_session",
+				wallet_session_id: requireAsciiString(authorization.wallet_session_id, "authorization.wallet_session_id")
+			};
+		case "operation_step_up":
+			requireExactFields(authorization, ["kind"], "authorization");
+			return { kind: "operation_step_up" };
+		default: throw new Error("authorization.kind is not supported");
+	}
+}
+function parseRouterAbMpcMaterialActivationRef(value) {
+	const activation = requireRecord(value, "material_activation");
+	requireExactFields(activation, [
+		"kind",
+		"activation_id",
+		"capability",
+		"material_owner",
+		"key_binding",
+		"lifecycle_binding",
+		"signing_worker"
+	], "material_activation");
+	if (activation.kind !== "mpc_material_activation_ref") throw new Error("material_activation.kind is not supported");
+	return {
+		kind: "mpc_material_activation_ref",
+		activation_id: requireAsciiString(activation.activation_id, "material_activation.activation_id"),
+		capability: requireAsciiString(activation.capability, "material_activation.capability"),
+		material_owner: requireAsciiString(activation.material_owner, "material_activation.material_owner"),
+		key_binding: requireAsciiString(activation.key_binding, "material_activation.key_binding"),
+		lifecycle_binding: requireAsciiString(activation.lifecycle_binding, "material_activation.lifecycle_binding"),
+		signing_worker: requireAsciiString(activation.signing_worker, "material_activation.signing_worker")
+	};
+}
+function routerAbMpcMaterialActivationRefToWire(input) {
+	return parseRouterAbMpcMaterialActivationRef({
+		kind: input.kind,
+		activation_id: input.activationId,
+		capability: input.capability,
+		material_owner: input.materialOwner,
+		key_binding: input.keyBinding,
+		lifecycle_binding: input.lifecycleBinding,
+		signing_worker: input.signingWorker
+	});
+}
+function routerAbMpcMaterialActivationRefFromWire(value) {
+	const wire = parseRouterAbMpcMaterialActivationRef(value);
+	const parsed = parseMpcMaterialActivationRef({
+		kind: wire.kind,
+		activationId: wire.activation_id,
+		capability: wire.capability,
+		materialOwner: wire.material_owner,
+		keyBinding: wire.key_binding,
+		lifecycleBinding: wire.lifecycle_binding,
+		signingWorker: wire.signing_worker
+	});
+	if (!parsed.ok) throw new Error(`material_activation is invalid: ${parsed.error.message}`);
+	return parsed.value;
+}
+function asciiBytes(value) {
+	return new TextEncoder().encode(value);
+}
+function appendLen32(out, value) {
+	const bytes = asciiBytes(value);
+	const length = bytes.length >>> 0;
+	out.push(length >>> 24 & 255, length >>> 16 & 255, length >>> 8 & 255, length & 255);
+	out.push(...bytes);
+}
+function canonicalRouterAbNormalSigningAuthorizationBytes(value) {
+	const authorization = parseRouterAbNormalSigningAuthorization(value);
+	const out = [];
+	appendLen32(out, authorization.kind);
+	switch (authorization.kind) {
+		case "reusable_wallet_session":
+			appendLen32(out, authorization.wallet_session_id);
+			break;
+		case "operation_step_up": break;
+	}
+	return new Uint8Array(out);
+}
+function canonicalRouterAbMpcMaterialActivationRefBytes(value) {
+	const activation = parseRouterAbMpcMaterialActivationRef(value);
+	const out = [];
+	appendLen32(out, activation.kind);
+	appendLen32(out, activation.activation_id);
+	appendLen32(out, activation.capability);
+	appendLen32(out, activation.material_owner);
+	appendLen32(out, activation.key_binding);
+	appendLen32(out, activation.lifecycle_binding);
+	appendLen32(out, activation.signing_worker);
+	return new Uint8Array(out);
+}
+function sameRouterAbMpcMaterialActivationRef(left, right) {
+	return left.kind === right.kind && left.activation_id === right.activation_id && left.capability === right.capability && left.material_owner === right.material_owner && left.key_binding === right.key_binding && left.lifecycle_binding === right.lifecycle_binding && left.signing_worker === right.signing_worker;
+}
+//#endregion
+export { canonicalRouterAbMpcMaterialActivationRefBytes, canonicalRouterAbNormalSigningAuthorizationBytes, parseRouterAbMpcMaterialActivationRef, parseRouterAbNormalSigningAuthorization, routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef };
+
+//# sourceMappingURL=routerAbNormalSigningIdentity.js.map

package/dist/esm/shared-ts/src/utils/routerAbPublicKeyset.js

@@ -0,0 +1,138 @@
+//#region ../shared-ts/src/utils/routerAbPublicKeyset.ts
+const ROUTER_AB_PUBLIC_KEYSET_VERSION_V2 = "router_ab_keyset_v2";
+const ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH = "/.well-known/router-ab/keyset";
+const ROUTER_AB_PUBLIC_KEYSET_PATH = "/router-ab/keyset";
+function requireRecord(value, label) {
+	if (value && typeof value === "object" && !Array.isArray(value)) return value;
+	throw new Error(`${label} must be an object`);
+}
+function requireExactKeys(record, allowedKeys, label) {
+	const allowed = new Set(allowedKeys);
+	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is not supported`);
+}
+function requireNonEmptyString(value, label) {
+	const normalized = String(value || "").trim();
+	if (!normalized) throw new Error(`${label} is required`);
+	return normalized;
+}
+function requirePositiveInteger(value, label) {
+	const parsed = Number(value);
+	if (!Number.isSafeInteger(parsed) || parsed <= 0) throw new Error(`${label} must be a positive integer`);
+	return parsed;
+}
+function requireSignerRole(value, label) {
+	const role = requireNonEmptyString(value, label);
+	switch (role) {
+		case "signer_a":
+		case "signer_b": return role;
+		default: throw new Error(`${label} must be signer_a or signer_b`);
+	}
+}
+function requireLowerHex(value, label, byteLength) {
+	const hex = requireNonEmptyString(value, label);
+	if (!new RegExp(`^[0-9a-f]{${byteLength * 2}}$`).test(hex)) throw new Error(`${label} must be ${byteLength} lowercase-hex bytes`);
+	return hex;
+}
+function requireRouterAbX25519PublicKey(value, label) {
+	const publicKey = requireNonEmptyString(value, label);
+	if (!/^x25519:[0-9a-f]{64}$/.test(publicKey)) throw new Error(`${label} must use x25519:<64 lowercase hex chars> encoding`);
+	return publicKey;
+}
+function parseSignerEnvelopeHpkePublicKey(value, label) {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, [
+		"role",
+		"key_epoch",
+		"public_key"
+	], label);
+	return {
+		role: requireSignerRole(record.role, `${label}.role`),
+		key_epoch: requireNonEmptyString(record.key_epoch, `${label}.key_epoch`),
+		public_key: requireRouterAbX25519PublicKey(record.public_key, `${label}.public_key`)
+	};
+}
+function parseSignerEnvelopeHpkePublicKeySet(value, label) {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, ["deriver_a", "deriver_b"], label);
+	const deriverA = parseSignerEnvelopeHpkePublicKey(record.deriver_a, `${label}.deriver_a`);
+	const deriverB = parseSignerEnvelopeHpkePublicKey(record.deriver_b, `${label}.deriver_b`);
+	if (deriverA.role !== "signer_a") throw new Error(`${label}.deriver_a.role must be signer_a`);
+	if (deriverB.role !== "signer_b") throw new Error(`${label}.deriver_b.role must be signer_b`);
+	return {
+		deriver_a: deriverA,
+		deriver_b: deriverB
+	};
+}
+function requireRotatedSignerEnvelopeHpkeKey(label, current, previous) {
+	if (current.role !== previous.role) throw new Error(`${label}.previous.role must match current role`);
+	if (current.key_epoch === previous.key_epoch) throw new Error(`${label}.previous.key_epoch must differ from current key_epoch`);
+	if (current.public_key === previous.public_key) throw new Error(`${label}.previous.public_key must differ from current public_key`);
+}
+function parseSignerEnvelopeHpkeRotationPublicKeySet(value, label) {
+	const record = requireRecord(value, label);
+	const hasPrevious = "previous" in record || "previous_retire_at_ms" in record;
+	requireExactKeys(record, hasPrevious ? [
+		"current",
+		"previous",
+		"previous_retire_at_ms"
+	] : ["current"], label);
+	const current = parseSignerEnvelopeHpkePublicKeySet(record.current, `${label}.current`);
+	if (!hasPrevious) return { current };
+	const previous = parseSignerEnvelopeHpkePublicKeySet(record.previous, `${label}.previous`);
+	requireRotatedSignerEnvelopeHpkeKey(`${label}.deriver_a`, current.deriver_a, previous.deriver_a);
+	requireRotatedSignerEnvelopeHpkeKey(`${label}.deriver_b`, current.deriver_b, previous.deriver_b);
+	return {
+		current,
+		previous,
+		previous_retire_at_ms: requirePositiveInteger(record.previous_retire_at_ms, `${label}.previous_retire_at_ms`)
+	};
+}
+function parseSignerPeerVerifyingKey(value, label) {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, ["role", "verifying_key_hex"], label);
+	return {
+		role: requireSignerRole(record.role, `${label}.role`),
+		verifying_key_hex: requireLowerHex(record.verifying_key_hex, `${label}.verifying_key_hex`, 32)
+	};
+}
+function parseSignerPeerVerifyingKeySet(value, label) {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, ["deriver_a", "deriver_b"], label);
+	const deriverA = parseSignerPeerVerifyingKey(record.deriver_a, `${label}.deriver_a`);
+	const deriverB = parseSignerPeerVerifyingKey(record.deriver_b, `${label}.deriver_b`);
+	if (deriverA.role !== "signer_a") throw new Error(`${label}.deriver_a.role must be signer_a`);
+	if (deriverB.role !== "signer_b") throw new Error(`${label}.deriver_b.role must be signer_b`);
+	return {
+		deriver_a: deriverA,
+		deriver_b: deriverB
+	};
+}
+function parsePublicHpkeKeyDescriptor(value, label) {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, ["key_epoch", "public_key"], label);
+	return {
+		key_epoch: requireNonEmptyString(record.key_epoch, `${label}.key_epoch`),
+		public_key: requireRouterAbX25519PublicKey(record.public_key, `${label}.public_key`)
+	};
+}
+function parseRouterAbPublicKeysetV2(value) {
+	const record = requireRecord(value, "Router A/B public keyset");
+	requireExactKeys(record, [
+		"keyset_version",
+		"signer_envelope_hpke",
+		"signer_peer_verifying_keys",
+		"signing_worker_server_output_hpke"
+	], "Router A/B public keyset");
+	const keysetVersion = requireNonEmptyString(record.keyset_version, "keyset_version");
+	if (keysetVersion !== "router_ab_keyset_v2") throw new Error(`Unsupported Router A/B public keyset version: ${keysetVersion}`);
+	return {
+		keyset_version: ROUTER_AB_PUBLIC_KEYSET_VERSION_V2,
+		signer_envelope_hpke: parseSignerEnvelopeHpkeRotationPublicKeySet(record.signer_envelope_hpke, "signer_envelope_hpke"),
+		signer_peer_verifying_keys: parseSignerPeerVerifyingKeySet(record.signer_peer_verifying_keys, "signer_peer_verifying_keys"),
+		signing_worker_server_output_hpke: parsePublicHpkeKeyDescriptor(record.signing_worker_server_output_hpke, "signing_worker_server_output_hpke")
+	};
+}
+//#endregion
+export { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, parseRouterAbPublicKeysetV2, requireRouterAbX25519PublicKey };
+
+//# sourceMappingURL=routerAbPublicKeyset.js.map

package/dist/esm/shared-ts/src/utils/routerAbTraceContext.js

@@ -0,0 +1,36 @@
+//#region ../shared-ts/src/utils/routerAbTraceContext.ts
+const ROUTER_AB_TRACE_ID_HEADER_V1 = "x-seams-trace-id";
+const TRACE_ID_PATTERN = /^[0-9a-f]{32}$/;
+function parseRouterAbTraceContextV1(raw) {
+	if (raw === null || raw === void 0 || raw === "") return {
+		ok: false,
+		reason: "missing",
+		message: "Router trace ID is missing"
+	};
+	if (typeof raw !== "string" || !TRACE_ID_PATTERN.test(raw)) return {
+		ok: false,
+		reason: "invalid",
+		message: "Router trace ID must be 32 lowercase hexadecimal characters"
+	};
+	return {
+		ok: true,
+		value: {
+			kind: "router_ab_trace_context_v1",
+			value: raw
+		}
+	};
+}
+function createRouterAbTraceContextV1() {
+	const bytes = new Uint8Array(16);
+	globalThis.crypto.getRandomValues(bytes);
+	let value = "";
+	for (const byte of bytes) value += byte.toString(16).padStart(2, "0");
+	return {
+		kind: "router_ab_trace_context_v1",
+		value
+	};
+}
+//#endregion
+export { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 };
+
+//# sourceMappingURL=routerAbTraceContext.js.map

package/dist/esm/shared-ts/src/utils/secureRandomId.js

@@ -0,0 +1,35 @@
+import { base64UrlEncode } from "./base64.js";
+//#region ../shared-ts/src/utils/secureRandomId.ts
+const DEFAULT_SECURE_RANDOM_ID_BYTES = 32;
+const BASE36_ALPHABET = "0123456789abcdefghijklmnopqrstuvwxyz";
+function secureRandomBytes(length = DEFAULT_SECURE_RANDOM_ID_BYTES, label = "secure random bytes") {
+	const byteLength = Math.max(1, Math.floor(Number(length) || 0));
+	const cryptoApi = globalThis.crypto;
+	if (typeof cryptoApi?.getRandomValues !== "function") throw new Error(`WebCrypto getRandomValues is required for ${label}`);
+	return cryptoApi.getRandomValues(new Uint8Array(byteLength));
+}
+function secureRandomBase64Url(byteLength = DEFAULT_SECURE_RANDOM_ID_BYTES, label = "secure random id") {
+	return base64UrlEncode(secureRandomBytes(byteLength, label));
+}
+function secureRandomId(prefix, byteLength = DEFAULT_SECURE_RANDOM_ID_BYTES, label = `${prefix} id`) {
+	return `${String(prefix || "").trim() || "id"}-${secureRandomBase64Url(byteLength, label)}`;
+}
+function secureRandomUintBelow(maxExclusive, label = "bounded random integer") {
+	const max = Math.floor(Number(maxExclusive) || 0);
+	if (max <= 0 || max > 256) throw new Error(`Invalid upper bound for ${label}`);
+	const rejectionLimit = Math.floor(256 / max) * max;
+	for (;;) {
+		const candidate = secureRandomBytes(1, label)[0] ?? 0;
+		if (candidate < rejectionLimit) return candidate % max;
+	}
+}
+function secureRandomBase36(length, label = "base36 random id") {
+	const outputLength = Math.max(1, Math.floor(Number(length) || 0));
+	let value = "";
+	for (let i = 0; i < outputLength; i++) value += BASE36_ALPHABET[secureRandomUintBelow(36, label)] || "0";
+	return value;
+}
+//#endregion
+export { secureRandomBase36, secureRandomBase64Url, secureRandomId };
+
+//# sourceMappingURL=secureRandomId.js.map

package/dist/esm/shared-ts/src/utils/signingSessionSeal.js

@@ -0,0 +1,118 @@
+//#region ../shared-ts/src/utils/signingSessionSeal.ts
+const SIGNING_SESSION_SEAL_ALG = "shamir3pass-v2";
+const SIGNING_SESSION_SEAL_GROUP_ID = "rfc2409-group2";
+const ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND = "router_ab_ed25519_normal_signing_v1";
+const ROUTER_AB_ED25519_HEALTH_PATH = "/router-ab/ed25519/healthz";
+const ROUTER_AB_ED25519_WALLET_SESSION_PATH = "/router-ab/wallet-session/ed25519";
+const ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH = "/router-ab/ed25519/sign/prepare";
+const ROUTER_AB_ED25519_NORMAL_SIGNING_PATH = "/router-ab/ed25519/sign";
+const WALLET_SESSION_SEAL_BASE_PATH = "/wallet-session/seal";
+const PASSKEY_PRF_FIRST_SALT_V1 = new Uint8Array([
+	64,
+	12,
+	49,
+	139,
+	102,
+	149,
+	151,
+	54,
+	89,
+	161,
+	105,
+	138,
+	229,
+	128,
+	223,
+	216,
+	0,
+	29,
+	153,
+	81,
+	186,
+	50,
+	198,
+	149,
+	230,
+	52,
+	153,
+	71,
+	80,
+	79,
+	63,
+	132
+]);
+const PASSKEY_PRF_SECOND_SALT_V1 = new Uint8Array([
+	38,
+	218,
+	80,
+	229,
+	172,
+	150,
+	74,
+	126,
+	160,
+	132,
+	82,
+	127,
+	182,
+	71,
+	246,
+	51,
+	11,
+	50,
+	222,
+	81,
+	169,
+	175,
+	70,
+	82,
+	75,
+	0,
+	109,
+	143,
+	127,
+	231,
+	244,
+	209
+]);
+function normalizeRouterAbNonEmptyString(value) {
+	return String(value || "").trim() || null;
+}
+function parseRouterAbEd25519NormalSigningState(value) {
+	const record = value && typeof value === "object" ? value : null;
+	if (!record) return null;
+	if (record.kind !== "router_ab_ed25519_normal_signing_v1") return null;
+	const signingWorkerId = normalizeRouterAbNonEmptyString(record.signingWorkerId);
+	if (!signingWorkerId) throw new Error("Invalid Router A/B Ed25519 normal-signing state: missing signingWorkerId");
+	return {
+		kind: ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND,
+		signingWorkerId
+	};
+}
+function encodeSigningSessionHkdfTuple(fields) {
+	const encoder = new TextEncoder();
+	const chunks = fields.map((field) => {
+		const bytes = encoder.encode(String(field || ""));
+		const len = new Uint8Array(4);
+		new DataView(len.buffer).setUint32(0, bytes.length, false);
+		return {
+			len,
+			bytes
+		};
+	});
+	let total = 0;
+	for (const chunk of chunks) total += chunk.len.length + chunk.bytes.length;
+	const out = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		out.set(chunk.len, offset);
+		offset += chunk.len.length;
+		out.set(chunk.bytes, offset);
+		offset += chunk.bytes.length;
+	}
+	return out;
+}
+//#endregion
+export { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1, ROUTER_AB_ED25519_HEALTH_PATH, ROUTER_AB_ED25519_NORMAL_SIGNING_PATH, ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND, ROUTER_AB_ED25519_WALLET_SESSION_PATH, SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, WALLET_SESSION_SEAL_BASE_PATH, encodeSigningSessionHkdfTuple, parseRouterAbEd25519NormalSigningState };
+
+//# sourceMappingURL=signingSessionSeal.js.map

package/dist/esm/shared-ts/src/utils/thresholdEcdsaKeyHandle.js

@@ -0,0 +1,28 @@
+import { base64UrlEncode } from "./base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
+//#region ../shared-ts/src/utils/thresholdEcdsaKeyHandle.ts
+function parseThresholdEcdsaKeyHandle(value) {
+	const normalized = typeof value === "string" ? value.trim() : "";
+	if (!normalized.startsWith("ederivation-key-")) throw new Error("Threshold ECDSA key handle is invalid");
+	return normalized;
+}
+function requiredString(value, field) {
+	const normalized = String(value ?? "").trim();
+	if (!normalized) throw new Error(`[threshold-ecdsa-key-handle] ${field} is required`);
+	return normalized;
+}
+function normalizedSigningRootVersion(value) {
+	return String(value ?? "").trim() || "default";
+}
+async function deriveThresholdEcdsaKeyHandle(input) {
+	return `ederivation-key-${base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		domain: "seams.threshold_ecdsa.key_handle.v1",
+		ecdsaThresholdKeyId: requiredString(input.ecdsaThresholdKeyId, "ecdsaThresholdKeyId"),
+		signingRootId: requiredString(input.signingRootId, "signingRootId"),
+		signingRootVersion: normalizedSigningRootVersion(input.signingRootVersion)
+	})))}`;
+}
+//#endregion
+export { deriveThresholdEcdsaKeyHandle, parseThresholdEcdsaKeyHandle };
+
+//# sourceMappingURL=thresholdEcdsaKeyHandle.js.map

package/dist/esm/shared-ts/src/utils/validation.js

@@ -0,0 +1,23 @@
+import "./near.js";
+import { normalizeOptionalTrimmedString } from "./normalize.js";
+//#region ../shared-ts/src/utils/validation.ts
+function isObject(x) {
+	return x !== null && typeof x === "object";
+}
+function isPlainObject(x) {
+	return isObject(x) && !Array.isArray(x);
+}
+function toOptionalRecordString(record, key) {
+	if (!isPlainObject(record)) return void 0;
+	return normalizeOptionalTrimmedString(record[key]);
+}
+function isString(x) {
+	return typeof x === "string";
+}
+function isFunction(x) {
+	return typeof x === "function";
+}
+//#endregion
+export { isFunction, isObject, isPlainObject, isString, toOptionalRecordString };
+
+//# sourceMappingURL=validation.js.map

package/dist/esm/shared-ts/src/utils/walletAddSignerActivation.js

@@ -0,0 +1,32 @@
+import { base64UrlEncode } from "./base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
+import { parseCanonicalEcdsaServerActivationRequest } from "./ecdsaCapabilityActivation.js";
+//#region ../shared-ts/src/utils/walletAddSignerActivation.ts
+/**
+* The canonical wallet add-signer ECDSA activation command — the add-signer
+* counterpart of registration's `wallet_registration_activate_v2` command.
+*
+* The client computes the activation request digest locally over this exact
+* alphabetized JSON and journals both before calling activate; the server
+* recomputes the digest from the same coordinates and rejects a mismatch
+* before claiming the activation. Both sides import this one builder so the
+* encoding cannot drift. Unlike the registration command there is no
+* `idempotencyKey` member: add-signer finalize owns idempotency on its own
+* route, and the activate claim is keyed by these coordinates alone.
+*/
+const WALLET_ADD_SIGNER_ECDSA_ACTIVATE_OPERATION = "wallet_add_signer_activate_v2";
+function buildCanonicalWalletAddSignerEcdsaActivationRequest(input) {
+	return parseCanonicalEcdsaServerActivationRequest(alphabetizeStringify({
+		operation: WALLET_ADD_SIGNER_ECDSA_ACTIVATE_OPERATION,
+		addSignerCeremonyId: input.addSignerCeremonyId,
+		activationCorrelationId: input.activationCorrelationId,
+		publicFacts: input.publicFacts
+	}));
+}
+async function computeWalletAddSignerEcdsaActivationRequestDigestB64u(input) {
+	return base64UrlEncode(await sha256BytesUtf8(String(buildCanonicalWalletAddSignerEcdsaActivationRequest(input))));
+}
+//#endregion
+export { computeWalletAddSignerEcdsaActivationRequestDigestB64u };
+
+//# sourceMappingURL=walletAddSignerActivation.js.map