@seams/wallet-server 0.5.0

package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.js

@@ -0,0 +1,360 @@
+import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
+import "../../../shared-ts/src/utils/validation.js";
+import { signingRootScopeFromRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
+import { parseRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { normalizeThresholdEd25519ParticipantIds } from "../../../shared-ts/src/threshold/participants.js";
+import { WALLET_SESSION_FAILURE_CODES } from "../../../shared-ts/src/utils/walletSessionFailure.js";
+import { startRouterAbEcdsaPresignSession, stepRouterAbEcdsaPresignSession } from "./ecdsaDerivationPresignBridge.js";
+import { parseEcdsaKeyHandle } from "../../keyMaterialBrands.js";
+//#region src/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.ts
+const PRESIGN_SESSION_ID_PREFIX = "ecdsa-presign-v2";
+function presignSessionExpiresAtMs(presignSessionId) {
+	const [prefix, expiresAtRaw] = presignSessionId.split(":", 3);
+	if (prefix !== PRESIGN_SESSION_ID_PREFIX) return null;
+	const expiresAtMs = Number(expiresAtRaw);
+	return Number.isSafeInteger(expiresAtMs) && expiresAtMs > 0 ? expiresAtMs : null;
+}
+function signingRootMetadataFromRuntimePolicyScope(scope) {
+	try {
+		return signingRootScopeFromRuntimePolicyScope(scope);
+	} catch {
+		return null;
+	}
+}
+function errorMessage(error) {
+	return String(error && typeof error === "object" && "message" in error ? error.message : error || "");
+}
+function requireExactPoolFillKeys(record, expectedKeys) {
+	const expected = new Set(expectedKeys);
+	for (const key of Object.keys(record)) if (!expected.has(key)) return {
+		ok: false,
+		code: "invalid_body",
+		message: `poolFill.${key} is not a supported field`
+	};
+	return {
+		ok: true,
+		value: null
+	};
+}
+function parseRouterAbEcdsaDerivationPoolFillRequest(value) {
+	if (value === void 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "poolFill is required for Router A/B ECDSA derivation presign refill"
+	};
+	if (!value || typeof value !== "object" || Array.isArray(value)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "poolFill must be an object"
+	};
+	const record = value;
+	const kind = normalizeOptionalTrimmedString(record.kind);
+	if (kind !== "router_ab_ecdsa_derivation_signing_worker_pool") return {
+		ok: false,
+		code: "invalid_body",
+		message: "poolFill.kind must be router_ab_ecdsa_derivation_signing_worker_pool"
+	};
+	const exactKeys = requireExactPoolFillKeys(record, [
+		"kind",
+		"scope",
+		"expiresAtMs"
+	]);
+	if (!exactKeys.ok) return exactKeys;
+	let scope;
+	try {
+		scope = parseRouterAbEcdsaDerivationNormalSigningScopeV1(record.scope);
+	} catch (error) {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: `poolFill.scope is invalid: ${errorMessage(error)}`
+		};
+	}
+	const expiresAtMs = record.expiresAtMs;
+	if (typeof expiresAtMs !== "number" || !Number.isFinite(expiresAtMs)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "poolFill.expiresAtMs must be a finite number"
+	};
+	const expiresAtMsInt = Math.floor(expiresAtMs);
+	if (expiresAtMsInt !== expiresAtMs || expiresAtMsInt <= 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "poolFill.expiresAtMs must be a positive integer timestamp"
+	};
+	return {
+		ok: true,
+		value: {
+			kind,
+			routerAbEcdsaDerivation: {
+				scope,
+				expiresAtMs: expiresAtMsInt
+			}
+		}
+	};
+}
+function parseRouterAbEcdsaDerivationPoolFillInitRequest(request) {
+	const keyHandle = normalizeOptionalTrimmedString(request.keyHandle);
+	if (normalizeOptionalTrimmedString(request.ecdsaThresholdKeyId)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "keyHandle is required for Router A/B ECDSA derivation pool-fill init"
+	};
+	if (!keyHandle) return {
+		ok: false,
+		code: "invalid_body",
+		message: "keyHandle is required for Router A/B ECDSA derivation pool-fill init"
+	};
+	const countRaw = request.count;
+	const count = Math.max(1, Math.floor(Number(countRaw ?? 1)));
+	if (count !== 1) return {
+		ok: false,
+		code: "unsupported",
+		message: "Router A/B ECDSA derivation pool-fill init supports only count=1"
+	};
+	const poolFill = parseRouterAbEcdsaDerivationPoolFillRequest(request.poolFill);
+	if (!poolFill.ok) return poolFill;
+	return {
+		ok: true,
+		value: {
+			keySelector: {
+				kind: "key_handle",
+				keyHandle
+			},
+			count,
+			poolFill: poolFill.value
+		}
+	};
+}
+function parseRouterAbEcdsaDerivationPoolFillStepRequest(request) {
+	const presignSessionId = normalizeOptionalTrimmedString(request.presignSessionId);
+	if (!presignSessionId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "presignSessionId is required"
+	};
+	const stageRaw = normalizeOptionalTrimmedString(request.stage);
+	if (stageRaw !== "triples" && stageRaw !== "presign") return {
+		ok: false,
+		code: "invalid_body",
+		message: "stage must be \"triples\" or \"presign\""
+	};
+	const msgsRaw = request.outgoingMessagesB64u;
+	return {
+		ok: true,
+		value: {
+			presignSessionId,
+			stage: stageRaw,
+			outgoingMessagesB64u: Array.isArray(msgsRaw) ? msgsRaw.map((v) => normalizeOptionalTrimmedString(v)).filter((v) => Boolean(v)) : []
+		}
+	};
+}
+function sameParticipantIds(a, b) {
+	if (a.length !== b.length) return false;
+	for (let i = 0; i < a.length; i += 1) if (a[i] !== b[i]) return false;
+	return true;
+}
+var RouterAbEcdsaDerivationPoolFillHandlers = class {
+	constructor(input) {
+		this.nodeRole = input.nodeRole;
+		this.participantIds2p = input.participantIds2p;
+		this.ensureReady = input.ensureReady;
+		this.createPoolFillSessionId = input.createPoolFillSessionId;
+		this.signingWorkerTransport = input.signingWorkerTransport;
+	}
+	async startStrictPresignSession(input) {
+		const transport = this.signingWorkerTransport;
+		const scope = input.poolFill.routerAbEcdsaDerivation.scope;
+		const trustedScope = input.binding.routerAbEcdsaDerivationNormalSigning.scope;
+		if (!sameRouterAbEcdsaDerivationNormalSigningScopeV1(scope, trustedScope)) return {
+			ok: false,
+			code: WALLET_SESSION_FAILURE_CODES.scopeMismatch,
+			message: "poolFill.scope does not match Wallet Session normal-signing scope"
+		};
+		if (scope.wallet_id !== input.walletId || scope.signing_root_id !== input.signingRoot.signingRootId || scope.signing_root_version !== input.signingRoot.signingRootVersion || input.keySelector.keyHandle !== input.binding.keyHandle) return {
+			ok: false,
+			code: WALLET_SESSION_FAILURE_CODES.scopeMismatch,
+			message: "poolFill scope does not match Wallet Session binding"
+		};
+		const nowMs = Date.now();
+		const expiresAtMs = Math.min(input.poolFill.routerAbEcdsaDerivation.expiresAtMs, input.binding.thresholdExpiresAtMs, nowMs + 5 * 6e4);
+		if (expiresAtMs <= nowMs) return {
+			ok: false,
+			code: WALLET_SESSION_FAILURE_CODES.expired,
+			message: "Wallet Session expired"
+		};
+		const participantIds = normalizeThresholdEd25519ParticipantIds(input.binding.participantIds);
+		if (!participantIds || !sameParticipantIds(participantIds, this.participantIds2p)) return {
+			ok: false,
+			code: WALLET_SESSION_FAILURE_CODES.scopeMismatch,
+			message: "Wallet Session participantIds do not match the ECDSA signer set"
+		};
+		const presignSessionId = this.createPoolFillSessionId(expiresAtMs);
+		const started = await startRouterAbEcdsaPresignSession({
+			signingWorkerBaseUrl: transport.signingWorkerBaseUrl,
+			scope,
+			presignSessionId,
+			expiresAtMs,
+			auth: transport.auth,
+			fetchImpl: transport.fetchImpl
+		});
+		if (!started.ok) return {
+			ok: false,
+			code: started.code,
+			message: started.message
+		};
+		if (started.value.kind !== "continue") return {
+			ok: false,
+			code: "internal",
+			message: "SigningWorker ECDSA presign init returned terminal progress"
+		};
+		return {
+			ok: true,
+			presignSessionId,
+			materialExpiresAtMs: expiresAtMs,
+			stage: started.value.stage,
+			outgoingMessagesB64u: started.value.outgoingMessagesB64u
+		};
+	}
+	async stepStrictPresignSession(input) {
+		const transport = this.signingWorkerTransport;
+		const scope = input.binding.routerAbEcdsaDerivationNormalSigning.scope;
+		const stepped = await stepRouterAbEcdsaPresignSession({
+			signingWorkerBaseUrl: transport.signingWorkerBaseUrl,
+			scope,
+			presignSessionId: input.presignSessionId,
+			requestedStage: input.requestedStage,
+			outgoingMessagesB64u: input.outgoingMessagesB64u,
+			expiresAtMs: input.binding.thresholdExpiresAtMs,
+			auth: transport.auth,
+			fetchImpl: transport.fetchImpl
+		});
+		if (!stepped.ok) return {
+			ok: false,
+			code: "stale_session_state",
+			message: `SigningWorker ECDSA presign session is unavailable; restart pool fill: ${stepped.message}`
+		};
+		if (stepped.value.presignSessionId !== input.presignSessionId) return {
+			ok: false,
+			code: "internal",
+			message: "SigningWorker ECDSA presign response session mismatch"
+		};
+		if (stepped.value.kind === "complete") return {
+			ok: true,
+			stage: "done",
+			event: "presign_done",
+			outgoingMessagesB64u: [],
+			presignatureId: stepped.value.serverPresignatureId,
+			bigRB64u: stepped.value.serverBigR33B64u
+		};
+		return {
+			ok: true,
+			stage: stepped.value.stage,
+			event: stepped.value.event,
+			outgoingMessagesB64u: stepped.value.outgoingMessagesB64u
+		};
+	}
+	async routerAbEcdsaDerivationPresignaturePoolFillInit(input) {
+		if (this.nodeRole !== "coordinator") return {
+			ok: false,
+			code: "not_found",
+			message: "Router A/B ECDSA derivation pool-fill endpoints are not enabled on this server (set THRESHOLD_NODE_ROLE=coordinator)"
+		};
+		await this.ensureReady();
+		const parsedRequest = parseRouterAbEcdsaDerivationPoolFillInitRequest(input.request);
+		if (!parsedRequest.ok) return parsedRequest;
+		const { keySelector, poolFill } = parsedRequest.value;
+		const binding = input.binding;
+		const walletId = normalizeOptionalTrimmedString(binding?.walletId);
+		if (!walletId) return {
+			ok: false,
+			code: WALLET_SESSION_FAILURE_CODES.invalid,
+			message: "Missing walletId in exact Wallet Session binding"
+		};
+		const tokenRelayerKeyId = normalizeOptionalTrimmedString(binding?.relayerKeyId);
+		let tokenKeyHandle;
+		try {
+			tokenKeyHandle = parseEcdsaKeyHandle(binding?.keyHandle);
+		} catch {
+			return {
+				ok: false,
+				code: WALLET_SESSION_FAILURE_CODES.invalid,
+				message: "Invalid exact Wallet Session binding"
+			};
+		}
+		if (!tokenRelayerKeyId) return {
+			ok: false,
+			code: WALLET_SESSION_FAILURE_CODES.invalid,
+			message: "Invalid exact Wallet Session binding"
+		};
+		const tokenSigningRoot = signingRootMetadataFromRuntimePolicyScope(binding.runtimePolicyScope);
+		if (!tokenSigningRoot) return {
+			ok: false,
+			code: WALLET_SESSION_FAILURE_CODES.invalid,
+			message: "Exact Wallet Session binding is missing signing-root scope"
+		};
+		return this.startStrictPresignSession({
+			binding,
+			keySelector,
+			poolFill,
+			walletId,
+			keyHandle: tokenKeyHandle,
+			relayerKeyId: tokenRelayerKeyId,
+			signingRoot: tokenSigningRoot
+		});
+	}
+	async routerAbEcdsaDerivationPresignaturePoolFillStep(input) {
+		if (this.nodeRole !== "coordinator") return {
+			ok: false,
+			code: "not_found",
+			message: "Router A/B ECDSA derivation pool-fill endpoints are not enabled on this server (set THRESHOLD_NODE_ROLE=coordinator)"
+		};
+		await this.ensureReady();
+		const parsedRequest = parseRouterAbEcdsaDerivationPoolFillStepRequest(input.request);
+		if (!parsedRequest.ok) return parsedRequest;
+		const { presignSessionId, stage: requestedStage, outgoingMessagesB64u } = parsedRequest.value;
+		const binding = input.binding;
+		const expiresAtMs = presignSessionExpiresAtMs(presignSessionId);
+		const walletId = normalizeOptionalTrimmedString(binding.walletId);
+		try {
+			parseEcdsaKeyHandle(binding.keyHandle);
+		} catch {
+			return {
+				ok: false,
+				code: WALLET_SESSION_FAILURE_CODES.invalid,
+				message: "Invalid exact Wallet Session binding"
+			};
+		}
+		const relayerKeyId = normalizeOptionalTrimmedString(binding.relayerKeyId);
+		const participantIds = normalizeThresholdEd25519ParticipantIds(binding.participantIds);
+		const scope = binding.routerAbEcdsaDerivationNormalSigning.scope;
+		if (!walletId || !relayerKeyId || !participantIds || !expiresAtMs) return {
+			ok: false,
+			code: WALLET_SESSION_FAILURE_CODES.invalid,
+			message: "Invalid exact Wallet Session binding"
+		};
+		if (scope.wallet_id !== walletId || !sameParticipantIds(participantIds, this.participantIds2p)) return {
+			ok: false,
+			code: WALLET_SESSION_FAILURE_CODES.scopeMismatch,
+			message: "Wallet Session normal-signing scope does not match presign binding"
+		};
+		if (Date.now() > expiresAtMs || expiresAtMs > binding.thresholdExpiresAtMs) return {
+			ok: false,
+			code: WALLET_SESSION_FAILURE_CODES.expired,
+			message: "Wallet Session expired"
+		};
+		return await this.stepStrictPresignSession({
+			binding: {
+				...binding,
+				thresholdExpiresAtMs: expiresAtMs
+			},
+			presignSessionId,
+			requestedStage,
+			outgoingMessagesB64u
+		});
+	}
+};
+//#endregion
+export { RouterAbEcdsaDerivationPoolFillHandlers };
+
+//# sourceMappingURL=ecdsaDerivationPoolFillHandlers.js.map

package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPoolFillLiveSession.js

@@ -0,0 +1,282 @@
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import "../../../shared-ts/src/utils/encoders.js";
+import { sha256BytesSync } from "../evmCryptoWasm.js";
+import { safeErrorMessage } from "../../../shared-ts/src/utils/errors.js";
+import { SigningWorkerPresignSession } from "../../../wasm/router_ab_ecdsa_signing_worker/pkg/router_ab_ecdsa_signing_worker.js";
+import { ensureRouterAbEcdsaSigningWorkerWasm } from "../routerAbEcdsaSigningWorkerWasm.js";
+//#region src/core/ThresholdService/routerAb/ecdsaDerivationPoolFillLiveSession.ts
+function normalizeWasmPresignStage(rawStage) {
+	if (rawStage === "triples_done") return "triples_done";
+	if (rawStage === "presign") return "presign";
+	if (rawStage === "done") return "done";
+	return "triples";
+}
+function pollWasmPresignSession(session) {
+	const polled = session.poll();
+	const outgoingMessages = Array.isArray(polled?.outgoing) ? polled.outgoing : [];
+	return {
+		stage: normalizeWasmPresignStage(String(polled?.stage || session.stage() || "triples")),
+		event: polled?.event === "triples_done" || polled?.event === "presign_done" ? polled.event : "none",
+		outgoingMessagesB64u: outgoingMessages.map((msg) => base64UrlEncode(msg))
+	};
+}
+function freePresignSession(session) {
+	try {
+		session.free();
+	} catch {}
+}
+function takePresignatureFromSession(session) {
+	const presig97 = session.take_presignature_97();
+	if (presig97.length !== 97) return {
+		ok: false,
+		code: "internal",
+		message: `Invalid presignature bytes (expected 97, got ${presig97.length})`
+	};
+	const bigR33 = presig97.slice(0, 33);
+	const kShare32 = presig97.slice(33, 65);
+	const sigmaShare32 = presig97.slice(65, 97);
+	return {
+		ok: true,
+		value: {
+			presignatureId: computePresignatureIdFromBigRBytes(bigR33),
+			bigRB64u: base64UrlEncode(bigR33),
+			kShareB64u: base64UrlEncode(kShare32),
+			sigmaShareB64u: base64UrlEncode(sigmaShare32)
+		}
+	};
+}
+var InMemoryRouterAbEcdsaDerivationPoolFillLiveSessionOwner = class {
+	constructor() {
+		this.livePresignSessionById = /* @__PURE__ */ new Map();
+		this.presignSessionStepInFlight = /* @__PURE__ */ new Set();
+	}
+	async createSession(input) {
+		await ensureRouterAbEcdsaSigningWorkerWasm();
+		const created = createLiveSessionEntry(input);
+		if (!created.ok) return created;
+		this.deleteEntry(input.presignSessionId);
+		this.livePresignSessionById.set(input.presignSessionId, {
+			session: created.value.session,
+			record: created.value.record
+		});
+		return {
+			ok: true,
+			value: {
+				record: created.value.record,
+				stage: created.value.stage,
+				outgoingMessagesB64u: created.value.outgoingMessagesB64u
+			}
+		};
+	}
+	async stepSession(input) {
+		if (this.presignSessionStepInFlight.has(input.presignSessionId)) return {
+			ok: false,
+			code: "stale_session_state",
+			message: "Presign session step already in progress; retry step"
+		};
+		this.presignSessionStepInFlight.add(input.presignSessionId);
+		try {
+			const entry = this.resolveLiveEntry(input.presignSessionId, input.record);
+			if (!entry.ok) return entry;
+			const prepared = preparePoolFillLiveStep({
+				session: entry.value.session,
+				record: input.record,
+				requestedStage: input.requestedStage,
+				outgoingMessagesB64u: input.outgoingMessagesB64u,
+				thresholdExpiresAtMs: input.thresholdExpiresAtMs
+			});
+			if (prepared.ok && prepared.value.mode === "advance") entry.value.record = prepared.value.nextRecord;
+			return prepared;
+		} finally {
+			this.presignSessionStepInFlight.delete(input.presignSessionId);
+		}
+	}
+	async deleteSession(presignSessionId) {
+		this.deleteEntry(presignSessionId);
+	}
+	deleteEntry(presignSessionId) {
+		const existing = this.livePresignSessionById.get(presignSessionId);
+		if (!existing) return;
+		this.livePresignSessionById.delete(presignSessionId);
+		freePresignSession(existing.session);
+	}
+	resolveLiveEntry(presignSessionId, record) {
+		const existing = this.livePresignSessionById.get(presignSessionId);
+		if (!existing) return staleLiveSession("cache_miss");
+		if (Date.now() > existing.record.expiresAtMs) {
+			this.deleteEntry(presignSessionId);
+			return staleLiveSession("cache_expired");
+		}
+		if (existing.record.version !== record.version) return staleLiveSession("cache_version_mismatch");
+		if (existing.record.stage !== record.stage) return staleLiveSession("cache_stage_mismatch");
+		return {
+			ok: true,
+			value: existing
+		};
+	}
+};
+function createLiveSessionEntry(input) {
+	const relayerThresholdShare32 = decodeFixedB64u(input.relayerThresholdShare32B64u, 32);
+	if (!relayerThresholdShare32.ok) return relayerThresholdShare32;
+	const groupPublicKey33 = decodeFixedB64u(input.groupPublicKey33B64u, 33);
+	if (!groupPublicKey33.ok) return groupPublicKey33;
+	const session = new SigningWorkerPresignSession(relayerThresholdShare32.value, groupPublicKey33.value, input.presignSessionId);
+	const polled = pollWasmPresignSession(session);
+	return {
+		ok: true,
+		value: {
+			session,
+			record: {
+				...input.record,
+				stage: polled.stage
+			},
+			stage: polled.stage,
+			outgoingMessagesB64u: polled.outgoingMessagesB64u
+		}
+	};
+}
+function preparePoolFillLiveStep(input) {
+	const currentStage = normalizeWasmPresignStage(input.session.stage());
+	if (currentStage !== input.record.stage) return {
+		ok: false,
+		code: "internal",
+		message: "presign session stage mismatch"
+	};
+	if (currentStage === "done") {
+		const terminal = takePresignatureFromSession(input.session);
+		if (!terminal.ok) return terminal;
+		return {
+			ok: true,
+			value: {
+				mode: "terminal",
+				presignDone: terminal.value
+			}
+		};
+	}
+	if (currentStage === "triples_done" && input.requestedStage === "triples") return {
+		ok: true,
+		value: {
+			mode: "immediate",
+			response: {
+				ok: true,
+				stage: "triples_done",
+				event: "triples_done",
+				outgoingMessagesB64u: []
+			}
+		}
+	};
+	if (input.requestedStage === "presign" && currentStage === "triples_done") try {
+		input.session.start_presign();
+	} catch {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: "server is not ready for presign"
+		};
+	}
+	else if (input.requestedStage === "presign" && currentStage === "triples") return {
+		ok: false,
+		code: "invalid_body",
+		message: "server is not ready for presign (triples still running)"
+	};
+	else if (input.requestedStage === "triples" && currentStage !== "triples") return {
+		ok: false,
+		code: "invalid_body",
+		message: "stage regression is not allowed"
+	};
+	const decodedIncoming = decodePresignIncomingMessages(input.outgoingMessagesB64u);
+	if (!decodedIncoming.ok) return decodedIncoming;
+	for (const decoded of decodedIncoming.value) try {
+		input.session.message(decoded);
+	} catch (e) {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: `Protocol rejected message: ${safeErrorMessage(e) || "error"}`
+		};
+	}
+	let polled;
+	try {
+		polled = pollWasmPresignSession(input.session);
+	} catch (error) {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: `Protocol failed: ${safeErrorMessage(error) || "error"}`
+		};
+	}
+	const nextExpiresAtMs = Math.min(input.record.expiresAtMs, input.thresholdExpiresAtMs);
+	const nextRecord = {
+		...input.record,
+		stage: polled.stage,
+		version: input.record.version + 1,
+		expiresAtMs: nextExpiresAtMs,
+		updatedAtMs: Date.now()
+	};
+	let presignDone = null;
+	if (polled.event === "presign_done") {
+		const done = takePresignatureFromSession(input.session);
+		if (!done.ok) return done;
+		presignDone = done.value;
+	}
+	return {
+		ok: true,
+		value: {
+			mode: "advance",
+			polled,
+			nextRecord,
+			presignDone
+		}
+	};
+}
+function computePresignatureIdFromBigRBytes(bigR33) {
+	return `presig-${base64UrlEncode(sha256BytesSync(bigR33))}`;
+}
+function decodeFixedB64u(value, expectedLength) {
+	let decoded;
+	try {
+		decoded = base64UrlDecode(value);
+	} catch {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: "pool-fill live-session material must be valid base64url"
+		};
+	}
+	if (decoded.length !== expectedLength) return {
+		ok: false,
+		code: "invalid_body",
+		message: `pool-fill live-session material must decode to ${expectedLength} bytes`
+	};
+	return {
+		ok: true,
+		value: decoded
+	};
+}
+function decodePresignIncomingMessages(outgoingMessagesB64u) {
+	const decoded = [];
+	for (const msgB64u of outgoingMessagesB64u) try {
+		decoded.push(base64UrlDecode(msgB64u));
+	} catch {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: "outgoingMessagesB64u contains invalid base64url"
+		};
+	}
+	return {
+		ok: true,
+		value: decoded
+	};
+}
+function staleLiveSession(reason) {
+	return {
+		ok: false,
+		code: "stale_session_state",
+		message: `Router A/B ECDSA derivation pool-fill live session unavailable (${reason})`
+	};
+}
+//#endregion
+export { InMemoryRouterAbEcdsaDerivationPoolFillLiveSessionOwner, createLiveSessionEntry, freePresignSession, normalizeWasmPresignStage, pollWasmPresignSession, preparePoolFillLiveStep, takePresignatureFromSession };
+
+//# sourceMappingURL=ecdsaDerivationPoolFillLiveSession.js.map