@seams/wallet-server 0.5.0

package/dist/esm/core/signingLanes/ed25519ServerRetirement.js

@@ -0,0 +1,71 @@
+import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseEd25519ServerRetirementReceiptV1 } from "../../shared-ts/src/signing-lanes/rotationParsers.js";
+import { computeEd25519ServerRetirementReceiptDigestV1 } from "../../shared-ts/src/signing-lanes/rotationDigests.js";
+import "../../shared-ts/src/signing-lanes/index.js";
+//#region src/core/signingLanes/ed25519ServerRetirement.ts
+function buildEd25519ServerRetirementRequestV1(input) {
+	assertIdentityMatchesCommand(input.binding.identity, input.command);
+	return {
+		identity: input.binding.identity,
+		revocationEpoch: input.command.expectedRevocationEpoch,
+		retirementReason: retirementReasonForCommand(input.command.reason),
+		retirementCorrelationId: input.command.retirementCorrelationId,
+		retirementRequestDigestB64u: parseDigestB64u(input.command.retirementRequestDigestB64u),
+		retirementEffectBindingDigestB64u: parseDigestB64u(input.command.retirementEffectBindingDigestB64u)
+	};
+}
+async function parseAndVerifyEd25519ServerRetirementEffectV1(input) {
+	const label = input.label ?? "ed25519LaneRetireEffect";
+	const envelope = exactEffectEnvelope(input.raw, label);
+	const outcome = parseOutcome(envelope.outcome, `${label}.outcome`);
+	const receipt = parseEd25519ServerRetirementReceiptV1(envelope.receipt, `${label}.receipt`);
+	assertReceiptMatchesRequest(receipt, input.request);
+	const canonicalDigest = await computeEd25519ServerRetirementReceiptDigestV1(receipt);
+	if (receipt.receiptDigestB64u !== canonicalDigest) throw new Error(`${label}.receipt.receiptDigestB64u does not match its canonical digest`);
+	return {
+		outcome,
+		receipt,
+		retirementEffectBindingDigestB64u: input.request.retirementEffectBindingDigestB64u,
+		retirementReceiptDigestB64u: canonicalDigest
+	};
+}
+function assertEd25519ServerRetirementReceiptMatchesRequestV1(receipt, request) {
+	assertReceiptMatchesRequest(receipt, request);
+}
+function assertIdentityMatchesCommand(identity, command) {
+	if (identity.keyFamily !== "ed25519" || identity.walletId !== command.walletId || identity.walletKeyId !== command.walletKeyId || identity.targetLaneId !== command.laneId || identity.targetLaneShareEpoch !== command.laneShareEpoch) throw new Error("Ed25519 retirement binding identity does not match the authorized command");
+}
+function assertReceiptMatchesRequest(receipt, request) {
+	if (!identitiesEqual(receipt.identity, request.identity) || receipt.revocationEpoch !== request.revocationEpoch || receipt.retirementReason !== request.retirementReason || receipt.retirementCorrelationId !== request.retirementCorrelationId || receipt.retirementRequestDigestB64u !== request.retirementRequestDigestB64u) throw new Error("Ed25519 retirement receipt does not match the admitted lane binding");
+}
+function identitiesEqual(left, right) {
+	return left.operationId === right.operationId && left.enrollmentId === right.enrollmentId && left.walletId === right.walletId && left.walletKeyId === right.walletKeyId && left.targetLaneId === right.targetLaneId && left.targetLaneShareEpoch === right.targetLaneShareEpoch && left.targetMaterialActivationId === right.targetMaterialActivationId && left.keyFamily === right.keyFamily && left.holderParticipantBindingDigestB64u === right.holderParticipantBindingDigestB64u && left.signingWorkerParticipantBindingDigestB64u === right.signingWorkerParticipantBindingDigestB64u && left.holderRecipientKeyDigestB64u === right.holderRecipientKeyDigestB64u && left.serverRecipientKeyDigestB64u === right.serverRecipientKeyDigestB64u && left.transcriptHashB64u === right.transcriptHashB64u && left.protocolCommitReceiptDigestB64u === right.protocolCommitReceiptDigestB64u;
+}
+function retirementReasonForCommand(reason) {
+	switch (reason) {
+		case "user_revoked":
+		case "policy_revoked": return "lane_revoked";
+		case "device_compromise": return "device_compromise";
+		case "agent_compromise": return "agent_compromise";
+		case "rotation": return "rotation";
+	}
+}
+function exactEffectEnvelope(value, label) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} must be an object`);
+	const fields = ["outcome", "receipt"];
+	const allowed = new Set(fields);
+	for (const key of Object.keys(value)) if (!allowed.has(key)) throw new Error(`${label}.${key} is unsupported`);
+	for (const field of fields) if (!Object.hasOwn(value, field)) throw new Error(`${label}.${field} is required`);
+	return {
+		outcome: Reflect.get(value, "outcome"),
+		receipt: Reflect.get(value, "receipt")
+	};
+}
+function parseOutcome(value, label) {
+	if (value === "applied" || value === "replayed") return value;
+	throw new Error(`${label} is invalid`);
+}
+//#endregion
+export { assertEd25519ServerRetirementReceiptMatchesRequestV1, buildEd25519ServerRetirementRequestV1, parseAndVerifyEd25519ServerRetirementEffectV1 };
+
+//# sourceMappingURL=ed25519ServerRetirement.js.map

package/dist/esm/core/signingLanes/index.js

@@ -0,0 +1,8 @@
+import { LaneLifecycleApplicationService } from "./LaneLifecycleApplicationService.js";
+import { projectActiveOwnerWalletExecutionLane, resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority } from "./WalletExecutionLaneProjection.js";
+import { assertEcdsaServerRetirementReceiptMatchesExpectationV1, buildEcdsaServerRetirementRequestV1, parseAndVerifyEcdsaServerRetirementEffectV1 } from "./ecdsaServerRetirement.js";
+import { LaneEnrollmentActivation } from "./LaneEnrollmentActivation.js";
+import { LaneEnrollmentRevocation } from "./LaneEnrollmentRevocation.js";
+import { LaneAggregateRevocationApplicationService } from "./LaneAggregateRevocationApplicationService.js";
+import { assertNonEmptyVersion, protocolCasResultToAdmissionResult } from "./LaneLifecycleStore.js";
+export { LaneAggregateRevocationApplicationService, LaneEnrollmentActivation, LaneEnrollmentRevocation, LaneLifecycleApplicationService, assertEcdsaServerRetirementReceiptMatchesExpectationV1, assertNonEmptyVersion, buildEcdsaServerRetirementRequestV1, parseAndVerifyEcdsaServerRetirementEffectV1, projectActiveOwnerWalletExecutionLane, protocolCasResultToAdmissionResult, resolveActiveOwnerWalletExecutionLane, resolveWalletAuthMethodIdForAuthority };

package/dist/esm/core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js

@@ -0,0 +1,305 @@
+import { hasWhitespaceOrControlCharacters, mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef } from "../../shared-ts/src/utils/domainIds.js";
+import { parseExactAdministeredSignerManifestV1 } from "../../shared-ts/src/device-linking/delegatedActivationPlan.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1 } from "../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
+//#region src/core/signingMaterial/ordinaryInactiveSignerMaterialReservation.ts
+function validateOrdinaryInactiveSignerMaterialDeactivationRequestV1(request) {
+	if (!Number.isSafeInteger(request.requestedAtMs) || request.requestedAtMs < 0) throw new Error("ordinary signer material deactivation time is invalid");
+	const materialActivation = parseMpcMaterialActivationRef(request.materialActivation);
+	if (!materialActivation.ok) throw new Error(`ordinary signer material deactivation ref: ${materialActivation.error.message}`);
+	switch (request.keyFamily) {
+		case "ed25519":
+		case "ecdsa_secp256k1": return;
+		default: return assertNever(request);
+	}
+}
+function parseOrdinaryEd25519SignerMaterialDeactivationResultV1(request, raw) {
+	return parseOrdinarySignerMaterialDeactivationResultV1(request, raw, "ed25519", "ordinary_ed25519_signer_material_deactivation_v1");
+}
+function parseOrdinaryEcdsaSignerMaterialDeactivationResultV1(request, raw) {
+	return parseOrdinarySignerMaterialDeactivationResultV1(request, raw, "ecdsa_secp256k1", "ordinary_ecdsa_signer_material_deactivation_v1");
+}
+function parseOrdinarySignerMaterialDeactivationResultV1(request, raw, expectedFamily, expectedKind) {
+	const result = exactRecord(raw, [
+		"kind",
+		"keyFamily",
+		"state",
+		"materialActivation",
+		"serverMaterialReservationId",
+		"revokedAtMs"
+	], `ordinary ${expectedFamily} signer material deactivation`);
+	if (result.kind !== expectedKind || result.keyFamily !== expectedFamily || result.state !== "revoked") throw new Error(`ordinary ${expectedFamily} deactivation returned the wrong terminal state`);
+	const materialActivation = parseWorkerMaterialActivationV1(result.materialActivation);
+	assertMaterialActivationMatchesV1(request.materialActivation, materialActivation);
+	if (typeof result.revokedAtMs !== "number" || !Number.isSafeInteger(result.revokedAtMs) || result.revokedAtMs < 0) throw new Error(`ordinary ${expectedFamily} deactivation timestamp is invalid`);
+	return {
+		kind: expectedKind,
+		keyFamily: expectedFamily,
+		state: "revoked",
+		materialActivation,
+		serverMaterialReservationId: parseServerMaterialReservationIdV1(result.serverMaterialReservationId),
+		revokedAtMs: result.revokedAtMs
+	};
+}
+var OrdinaryInactiveSignerMaterialReservationServiceV1 = class {
+	constructor(worker) {
+		this.worker = worker;
+	}
+	async reserveOrdinaryInactiveSignerMaterialV1(request) {
+		validateOrdinaryInactiveSignerMaterialReservationRequestV1(request);
+		switch (request.kind) {
+			case "ordinary_ed25519_signer_material_reservation_request_v1": return this.reserveEd25519V1(request);
+			case "ordinary_ecdsa_signer_material_reservation_request_v1": return this.reserveEcdsaV1(request);
+			default: return assertNever(request);
+		}
+	}
+	async reserveEd25519V1(request) {
+		const reservation = await this.worker.reserveInactiveEd25519SignerMaterialV1(request);
+		return {
+			kind: "ordinary_ed25519_signer_material_reservation_v1",
+			keyFamily: "ed25519",
+			state: "inactive",
+			signer: request.signer,
+			materialActivation: request.plannedActivationRef,
+			activationReceipt: reservation.activationReceipt,
+			participantIds: reservation.participantIds,
+			targetBinding: request.preparation.targetBinding,
+			applicationBinding: request.preparation.applicationBinding,
+			clientMaterial: reservation.clientMaterial,
+			serverMaterial: reservation.serverMaterial
+		};
+	}
+	async reserveEcdsaV1(request) {
+		const reservation = await this.worker.reserveInactiveEcdsaSignerMaterialV1(request);
+		return {
+			kind: "ordinary_ecdsa_signer_material_reservation_v1",
+			keyFamily: "ecdsa_secp256k1",
+			state: "inactive",
+			signer: request.signer,
+			materialActivation: request.plannedActivationRef,
+			activationReceipt: reservation.activationReceipt,
+			clientMaterial: reservation.clientMaterial,
+			serverMaterial: reservation.serverMaterial
+		};
+	}
+};
+function validateOrdinaryInactiveSignerMaterialReservationRequestV1(request) {
+	switch (request.kind) {
+		case "ordinary_ed25519_signer_material_reservation_request_v1": {
+			if (request.preparation.kind !== "ordinary_ed25519_signer_material_reservation_preparation_v1") throw new Error("ordinary Ed25519 reservation preparation kind is invalid");
+			assertMaterialActivationMatchesV1(request.plannedActivationRef, request.preparation.sourceContribution.targetMaterialActivation);
+			const targetBinding = parseRouterAbEd25519YaoCeremonyBindingV1(request.preparation.targetBinding);
+			if (targetBinding.operation !== "registration") throw new Error("ordinary Ed25519 target binding must use registration");
+			assertMaterialActivationMatchesV1(request.plannedActivationRef, routerAbMpcMaterialActivationRefFromWire(targetBinding.material_activation));
+			if (request.preparation.sourceContribution.sourceBinding.operation !== "registration") throw new Error("ordinary Ed25519 source contribution must use registration");
+			parseRouterAbEd25519YaoParticipantIdsV1(request.preparation.sourceContribution.participantIds);
+			return;
+		}
+		case "ordinary_ecdsa_signer_material_reservation_request_v1":
+			if (request.preparation.kind !== "ordinary_ecdsa_signer_material_reservation_preparation_v1") throw new Error("ordinary ECDSA reservation preparation kind is invalid");
+			assertMaterialActivationMatchesV1(request.plannedActivationRef, request.preparation.sourceContribution.binding.target.activation);
+			parseLinkedDeviceEcdsaSourceDerivationV1(request.preparation.sourceDerivation);
+			parseLinkedDeviceEcdsaSourceContributionPackageV1(request.preparation.sourceContribution);
+			return;
+		default: return assertNever(request);
+	}
+}
+function createOrdinaryInactiveSignerMaterialReservationServiceV1(input) {
+	return new OrdinaryInactiveSignerMaterialReservationServiceV1(input.worker);
+}
+function parseOrdinaryEd25519SignerMaterialWorkerReservationV1(request, raw) {
+	const reservation = exactRecord(raw, [
+		"kind",
+		"keyFamily",
+		"state",
+		"signer",
+		"materialActivation",
+		"participantIds",
+		"activationReceipt",
+		"clientMaterial",
+		"serverMaterialReservationId"
+	], "ordinary Ed25519 worker reservation");
+	if (reservation.kind !== "ordinary_ed25519_signer_material_worker_reservation_v1" || reservation.keyFamily !== "ed25519" || reservation.state !== "inactive") throw new Error("ordinary Ed25519 worker returned the wrong reservation family");
+	const signer = parseEd25519SignerV1(reservation.signer, request.signer);
+	const materialActivation = parseWorkerMaterialActivationV1(reservation.materialActivation);
+	assertEd25519SignerMatchesV1(request.signer, signer);
+	assertMaterialActivationMatchesV1(request.plannedActivationRef, materialActivation);
+	const participantIds = parseRouterAbEd25519YaoParticipantIdsV1(reservation.participantIds);
+	if (participantIds[0] !== request.preparation.sourceContribution.participantIds[0] || participantIds[1] !== request.preparation.sourceContribution.participantIds[1]) throw new Error("ordinary Ed25519 worker reservation participant ids do not match the request");
+	const activationReceipt = parseRouterAbEd25519YaoActivationPublicReceiptV1(reservation.activationReceipt);
+	assertMaterialActivationMatchesV1(request.plannedActivationRef, routerAbMpcMaterialActivationRefFromWire(activationReceipt.material_activation));
+	const clientMaterial = parseEd25519ClientMaterialV1(reservation.clientMaterial);
+	if (!sameBytes(activationReceipt.transcript, clientMaterial.deriver_a_client_package.transcript) || !sameBytes(activationReceipt.transcript, clientMaterial.deriver_b_client_package.transcript)) throw new Error("ordinary Ed25519 worker receipt transcript does not match client packages");
+	return {
+		kind: "ordinary_ed25519_signer_material_worker_reservation_v1",
+		keyFamily: "ed25519",
+		state: "inactive",
+		signer,
+		materialActivation,
+		activationReceipt,
+		participantIds,
+		clientMaterial,
+		serverMaterial: buildServerMaterialV1(reservation.serverMaterialReservationId)
+	};
+}
+function parseOrdinaryEcdsaSignerMaterialWorkerReservationV1(request, raw) {
+	const reservation = exactRecord(raw, [
+		"kind",
+		"keyFamily",
+		"state",
+		"signer",
+		"materialActivation",
+		"activationReceipt",
+		"clientMaterial",
+		"serverMaterial"
+	], "ordinary ECDSA worker reservation");
+	if (reservation.kind !== "ordinary_ecdsa_signer_material_worker_reservation_v1" || reservation.keyFamily !== "ecdsa_secp256k1" || reservation.state !== "inactive") throw new Error("ordinary ECDSA worker returned the wrong reservation family");
+	const signer = parseEcdsaSignerV1(reservation.signer, request.signer);
+	const materialActivation = parseWorkerMaterialActivationV1(reservation.materialActivation);
+	assertEcdsaSignerMatchesV1(request.signer, signer);
+	assertMaterialActivationMatchesV1(request.plannedActivationRef, materialActivation);
+	const activationReceipt = parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1(reservation.activationReceipt);
+	assertMaterialActivationMatchesV1(request.plannedActivationRef, activationReceipt.binding.target.activation);
+	if (activationReceipt.sourceDerivation.applicationBindingDigestB64u !== request.preparation.sourceDerivation.applicationBindingDigestB64u || activationReceipt.sourceDerivation.clientShareRetryCounter !== request.preparation.sourceDerivation.clientShareRetryCounter || activationReceipt.sourceDerivation.ecdsaThresholdKeyId !== request.preparation.sourceDerivation.ecdsaThresholdKeyId) throw new Error("ordinary ECDSA worker source derivation does not match the request");
+	if (!sameEcdsaSourceContributionBinding(activationReceipt.binding, request.preparation.sourceContribution.binding)) throw new Error("ordinary ECDSA worker source binding does not match the request");
+	if (activationReceipt.thresholdPublicKey33B64u !== request.signer.thresholdPublicKey33B64u) throw new Error("ordinary ECDSA worker target threshold public key does not match the signer");
+	const clientMaterial = parseEcdsaClientMaterialV1(reservation.clientMaterial);
+	if (clientMaterial.encryptedTargetClientShare.recipientPublicKeyB64u !== activationReceipt.binding.target.clientRecipientPublicKeyB64u) throw new Error("ordinary ECDSA client share recipient does not match the receipt");
+	const serverMaterial = parseEcdsaServerMaterialV1(reservation.serverMaterial);
+	if (serverMaterial.encryptedTargetServerShare.recipientPublicKeyB64u !== activationReceipt.binding.target.signingWorkerRecipientPublicKeyB64u) throw new Error("ordinary ECDSA server share recipient does not match the receipt");
+	return {
+		kind: "ordinary_ecdsa_signer_material_worker_reservation_v1",
+		keyFamily: "ecdsa_secp256k1",
+		state: "inactive",
+		signer,
+		materialActivation,
+		activationReceipt,
+		clientMaterial,
+		serverMaterial
+	};
+}
+function parseEd25519SignerV1(raw, expected) {
+	const manifest = parseExactAdministeredSignerManifestV1({
+		kind: "exact_administered_signer_manifest_v1",
+		keyFamilies: ["ed25519"],
+		signers: [raw]
+	});
+	if (!isEd25519Manifest(manifest)) throw new Error("ordinary Ed25519 worker reservation signer has the wrong family");
+	assertEd25519SignerMatchesV1(expected, manifest.signers[0]);
+	return manifest.signers[0];
+}
+function parseEcdsaSignerV1(raw, expected) {
+	const manifest = parseExactAdministeredSignerManifestV1({
+		kind: "exact_administered_signer_manifest_v1",
+		keyFamilies: ["ecdsa_secp256k1"],
+		signers: [raw]
+	});
+	if (!isEcdsaManifest(manifest)) throw new Error("ordinary ECDSA worker reservation signer has the wrong family");
+	assertEcdsaSignerMatchesV1(expected, manifest.signers[0]);
+	return manifest.signers[0];
+}
+function parseWorkerMaterialActivationV1(raw) {
+	const parsed = parseMpcMaterialActivationRef(raw);
+	if (!parsed.ok) throw new Error(`worker material activation: ${parsed.error.message}`);
+	return parsed.value;
+}
+function parseEd25519ClientMaterialV1(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"deriver_a_client_package",
+		"deriver_b_client_package"
+	], "ordinary Ed25519 client material");
+	if (record.kind !== "ordinary_ed25519_client_material_v1") throw new Error("ordinary Ed25519 client material kind is invalid");
+	return {
+		kind: "ordinary_ed25519_client_material_v1",
+		deriver_a_client_package: parseEd25519ClientPackageV1(record.deriver_a_client_package, "deriver_a_client_package", "deriver_a"),
+		deriver_b_client_package: parseEd25519ClientPackageV1(record.deriver_b_client_package, "deriver_b_client_package", "deriver_b")
+	};
+}
+function parseEcdsaClientMaterialV1(raw) {
+	const record = exactRecord(raw, ["kind", "encryptedTargetClientShare"], "ordinary ECDSA client material");
+	if (record.kind !== "ordinary_ecdsa_client_material_v1") throw new Error("ordinary ECDSA client material kind is invalid");
+	return {
+		kind: "ordinary_ecdsa_client_material_v1",
+		encryptedTargetClientShare: parseLinkedDeviceEcdsaEncryptedSourceContributionV1(record.encryptedTargetClientShare, "ordinary ECDSA encrypted target client share")
+	};
+}
+function parseEcdsaServerMaterialV1(raw) {
+	const record = exactRecord(raw, [
+		"kind",
+		"reservationId",
+		"encryptedTargetServerShare"
+	], "ordinary ECDSA server material");
+	if (record.kind !== "ordinary_ecdsa_inactive_server_material_v1") throw new Error("ordinary ECDSA server material kind is invalid");
+	return {
+		kind: "ordinary_ecdsa_inactive_server_material_v1",
+		reservationId: parseServerMaterialReservationIdV1(record.reservationId),
+		encryptedTargetServerShare: parseLinkedDeviceEcdsaEncryptedSourceContributionV1(record.encryptedTargetServerShare, "ordinary ECDSA encrypted target server share")
+	};
+}
+function sameEcdsaSourceContributionBinding(left, right) {
+	return left.linkSessionId === right.linkSessionId && left.enrollmentId === right.enrollmentId && left.sourceAuthorityId === right.sourceAuthorityId && sameEcdsaSourceSigner(left.source, right.source) && sameEcdsaTarget(left.target, right.target) && left.targetClientPublicKey33B64u === right.targetClientPublicKey33B64u;
+}
+function sameEcdsaSourceSigner(left, right) {
+	return mpcMaterialActivationRefsEqual(left.activation, right.activation) && left.clientPublicKey33B64u === right.clientPublicKey33B64u && left.relayerPublicKey33B64u === right.relayerPublicKey33B64u && left.thresholdPublicKey33B64u === right.thresholdPublicKey33B64u && left.thresholdEthereumAddress20B64u === right.thresholdEthereumAddress20B64u;
+}
+function sameEcdsaTarget(left, right) {
+	return mpcMaterialActivationRefsEqual(left.activation, right.activation) && String(left.targetDeviceId) === String(right.targetDeviceId) && left.targetFactorVerificationDigestB64u === right.targetFactorVerificationDigestB64u && left.clientRecipientPublicKeyB64u === right.clientRecipientPublicKeyB64u && left.signingWorkerRecipientPublicKeyB64u === right.signingWorkerRecipientPublicKeyB64u;
+}
+function sameBytes(left, right) {
+	return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function parseEd25519ClientPackageV1(raw, label, expectedRole) {
+	const parsed = parseRouterAbEd25519YaoEncryptedPackageV1(raw);
+	if (!parsed.ok) throw new Error(`${label} ${parsed.message}`);
+	if (parsed.value.kind !== "activation_client" || parsed.value.deriver !== expectedRole) throw new Error(`${label} must be an activation_client for ${expectedRole}`);
+	return {
+		kind: "activation_client",
+		deriver: expectedRole,
+		session: parsed.value.session,
+		transcript: parsed.value.transcript,
+		encapsulated_key: parsed.value.encapsulated_key,
+		ciphertext: parsed.value.ciphertext
+	};
+}
+function exactRecord(raw, keys, label) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${label} must be an object`);
+	const record = Object.fromEntries(Object.entries(raw));
+	const expected = new Set(keys);
+	const actual = Object.keys(record);
+	if (actual.length !== keys.length || actual.some((key) => !expected.has(key)) || keys.some((key) => !Object.prototype.hasOwnProperty.call(record, key))) throw new Error(`${label} contains unexpected fields`);
+	return record;
+}
+function isEd25519Manifest(manifest) {
+	return manifest.keyFamilies.length === 1 && manifest.keyFamilies[0] === "ed25519";
+}
+function isEcdsaManifest(manifest) {
+	return manifest.keyFamilies.length === 1 && manifest.keyFamilies[0] === "ecdsa_secp256k1";
+}
+function assertEd25519SignerMatchesV1(expected, actual) {
+	if (actual.kind !== expected.kind || actual.keyFamily !== expected.keyFamily || actual.walletId !== expected.walletId || actual.walletKeyId !== expected.walletKeyId || actual.registeredPublicKeyB64u !== expected.registeredPublicKeyB64u) throw new Error("ordinary Ed25519 worker reservation signer does not match the request");
+}
+function assertEcdsaSignerMatchesV1(expected, actual) {
+	if (actual.kind !== expected.kind || actual.keyFamily !== expected.keyFamily || actual.walletId !== expected.walletId || actual.walletKeyId !== expected.walletKeyId || actual.thresholdPublicKey33B64u !== expected.thresholdPublicKey33B64u || actual.evmAddress !== expected.evmAddress) throw new Error("ordinary ECDSA worker reservation signer does not match the request");
+}
+function assertMaterialActivationMatchesV1(expected, actual) {
+	if (!mpcMaterialActivationRefsEqual(expected, actual)) throw new Error("ordinary signer material worker reservation activation ref does not match");
+}
+function buildServerMaterialV1(serverMaterialReservationId) {
+	return {
+		kind: "ordinary_inactive_server_material_v1",
+		reservationId: parseServerMaterialReservationIdV1(serverMaterialReservationId)
+	};
+}
+function parseServerMaterialReservationIdV1(value) {
+	if (typeof value !== "string" || value.length === 0 || value.trim() !== value || hasWhitespaceOrControlCharacters(value)) throw new Error("ordinary signer material worker reservation id is invalid");
+	return value;
+}
+function assertNever(value) {
+	throw new Error(`unsupported ordinary signer material reservation request: ${String(value)}`);
+}
+//#endregion
+export { OrdinaryInactiveSignerMaterialReservationServiceV1, createOrdinaryInactiveSignerMaterialReservationServiceV1, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1 };
+
+//# sourceMappingURL=ordinaryInactiveSignerMaterialReservation.js.map

package/dist/esm/core/threeRouteRegistrationContracts.js

@@ -0,0 +1,5 @@
+//#region src/core/threeRouteRegistrationContracts.ts
+/** Public route response after the Gateway mints the Email OTP authentication session. */
+//#endregion
+
+//# sourceMappingURL=threeRouteRegistrationContracts.js.map

package/dist/esm/core/thresholdEcdsaChainTarget.js

@@ -0,0 +1,49 @@
+//#region src/core/thresholdEcdsaChainTarget.ts
+function positiveSafeInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : null;
+}
+function nonEmptyString(value) {
+	return String(value ?? "").trim() || void 0;
+}
+function thresholdEcdsaChainTargetFromValue(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	const kind = String(record.kind || "").trim();
+	const chainId = positiveSafeInteger(record.chainId);
+	if (!chainId) return null;
+	if (kind === "evm") {
+		if (String(record.namespace || "").trim() !== "eip155") return null;
+		const networkSlug = nonEmptyString(record.networkSlug);
+		return {
+			kind: "evm",
+			namespace: "eip155",
+			chainId,
+			...networkSlug ? { networkSlug } : {}
+		};
+	}
+	if (kind === "tempo") {
+		const networkSlug = nonEmptyString(record.networkSlug);
+		return {
+			kind: "tempo",
+			chainId,
+			...networkSlug ? { networkSlug } : {}
+		};
+	}
+	return null;
+}
+function thresholdEcdsaChainTargetKey(target) {
+	return target.kind === "evm" ? `evm:eip155:${target.chainId}` : `tempo:${target.chainId}`;
+}
+function thresholdEcdsaChainTargetsEqual(left, right) {
+	return thresholdEcdsaChainTargetKey(left) === thresholdEcdsaChainTargetKey(right);
+}
+function thresholdEcdsaChainTargetsShareEvmFamilyAddress(left, right) {
+	return isEvmFamilyAddressTarget(left) && isEvmFamilyAddressTarget(right);
+}
+function isEvmFamilyAddressTarget(target) {
+	return target.kind === "evm" || target.kind === "tempo";
+}
+//#endregion
+export { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual, thresholdEcdsaChainTargetsShareEvmFamilyAddress };
+
+//# sourceMappingURL=thresholdEcdsaChainTarget.js.map

package/dist/esm/core/types.js

@@ -0,0 +1,8 @@
+//#region src/core/types.ts
+function registrationPreparationIdFromString(value) {
+	return String(value || "").trim();
+}
+//#endregion
+export { registrationPreparationIdFromString };
+
+//# sourceMappingURL=types.js.map

package/dist/esm/core/utils.js

@@ -0,0 +1,14 @@
+import { isString } from "../shared-ts/src/utils/validation.js";
+//#region src/core/utils.ts
+function formatGasToTGas(gasString) {
+	const gasAmount = BigInt(gasString);
+	return `${(Number(gasAmount) / 0xe8d4a51000).toFixed(0)} TGas`;
+}
+function formatYoctoToNear(yoctoAmount) {
+	const amount = isString(yoctoAmount) ? BigInt(yoctoAmount) : yoctoAmount;
+	return (Number(amount) / 1e24).toFixed(3);
+}
+//#endregion
+export { formatGasToTGas, formatYoctoToNear };
+
+//# sourceMappingURL=utils.js.map

package/dist/esm/delegateAction/index.js

@@ -0,0 +1,136 @@
+import { ActionType, validateActionArgsWasm } from "../shared-ts/src/near/actions.js";
+//#region src/delegateAction/index.ts
+/**
+* Normalize hash input (hex string with or without `0x` prefix) to a 32-byte Uint8Array.
+*/
+function normalizeHashToBytes(hash) {
+	const trimmed = (hash || "").trim().toLowerCase();
+	const hex = trimmed.startsWith("0x") ? trimmed.slice(2) : trimmed;
+	if (!hex || hex.length !== 64 || !/^[0-9a-f]+$/i.test(hex)) throw new Error("invalid_hash_format");
+	const bytes = new Uint8Array(32);
+	for (let i = 0; i < 32; i++) {
+		const byte = hex.slice(i * 2, i * 2 + 2);
+		bytes[i] = parseInt(byte, 16);
+	}
+	return bytes;
+}
+/**
+* Validate delegate nonce and expiry against current chain height.
+* The actual SignedDelegate hashing and signature verification is done in the signer worker;
+* this helper only enforces basic replay/expiry constraints expected of a relayer.
+*/
+async function validateDelegateExpiryAndNonce(params) {
+	const { nearClient, signedDelegate } = params;
+	const delegate = signedDelegate?.delegateAction;
+	if (!delegate) throw new Error("invalid_delegate");
+	const maxBlockHeight = BigInt(delegate.maxBlockHeight);
+	if (maxBlockHeight <= 0n) return;
+	const block = await nearClient.viewBlock({ finality: "final" });
+	const currentHeight = BigInt(block?.header?.height ?? 0);
+	if (currentHeight <= 0n) throw new Error("invalid_block_height");
+	if (currentHeight > maxBlockHeight) throw new Error("delegate_expired");
+}
+/**
+* Enforce a simple policy over the delegate action:
+* - Receiver allowlist
+* - FunctionCall method allowlist
+* - Total attached deposit limit
+*/
+async function enforceDelegatePolicy(input) {
+	const { hash, signedDelegate, policy } = input;
+	if (!policy) return;
+	const delegate = signedDelegate?.delegateAction;
+	if (!delegate) throw new Error("invalid_delegate");
+	const receiverId = String(delegate.receiverId || "");
+	if (policy.allowedReceivers && policy.allowedReceivers.length > 0) {
+		if (!policy.allowedReceivers.includes(receiverId)) throw Object.assign(/* @__PURE__ */ new Error("receiver_not_allowed"), { code: "receiver_not_allowed" });
+	}
+	let totalDeposit = 0n;
+	for (const action of delegate.actions) {
+		if ("functionCall" in action) {
+			const methodName = action.functionCall.methodName;
+			if (policy.allowedMethods && policy.allowedMethods.length > 0) {
+				if (!policy.allowedMethods.includes(methodName)) throw Object.assign(/* @__PURE__ */ new Error("method_not_allowed"), { code: "method_not_allowed" });
+			}
+			const deposit = BigInt(action.functionCall.deposit);
+			totalDeposit += deposit;
+			continue;
+		}
+		totalDeposit += BigInt(action.transfer.deposit);
+	}
+	if (policy.maxTotalDepositYocto) {
+		const limit = BigInt(policy.maxTotalDepositYocto);
+		if (totalDeposit > limit) throw Object.assign(/* @__PURE__ */ new Error("deposit_exceeds_limit"), { code: "deposit_exceeds_limit" });
+	}
+	if (policy.allow) {
+		if (!await policy.allow({
+			hash,
+			delegate,
+			signedDelegate
+		})) throw Object.assign(/* @__PURE__ */ new Error("delegate_rejected"), { code: "delegate_rejected" });
+	}
+}
+/**
+* Build a relayer transaction that wraps the SignedDelegate in a NEP-461
+* SignedDelegate action. The relayer account is the signer and receiver.
+*
+* This helper only builds and sends the outer transaction; it assumes that:
+* - hash/signature/expiry checks have already been performed, and
+* - nonce/replay protection is implemented by the caller if needed.
+*/
+async function executeSignedDelegateWithRelayer(params) {
+	const { nearClient, relayerAccount, relayerPublicKey, hash, signedDelegate, policy, signGasRelayerNearTransaction } = params;
+	try {
+		await validateDelegateExpiryAndNonce({
+			nearClient,
+			signedDelegate
+		});
+		await enforceDelegatePolicy({
+			hash,
+			signedDelegate,
+			policy
+		});
+		const actions = [{
+			action_type: ActionType.SignedDelegate,
+			delegate_action: signedDelegate.delegateAction,
+			signature: signedDelegate.signature
+		}];
+		actions.forEach(validateActionArgsWasm);
+		const block = await nearClient.viewBlock({ finality: "final" });
+		const blockHash = String(block?.header?.hash || "");
+		if (!blockHash) throw new Error("missing_block_hash");
+		let nonce = 0n;
+		try {
+			const ak = await nearClient.viewAccessKey(relayerAccount, relayerPublicKey);
+			nonce = BigInt(ak?.nonce ?? 0);
+		} catch {
+			nonce = 0n;
+		}
+		const nextNonce = (nonce + 1n).toString();
+		const delegateSenderId = String(signedDelegate.delegateAction.senderId).trim();
+		if (!delegateSenderId) throw new Error("missing_delegate_sender_id");
+		const signedTx = await signGasRelayerNearTransaction({
+			receiverId: delegateSenderId,
+			nonce: nextNonce,
+			blockHash,
+			actions
+		});
+		const outcome = await nearClient.sendTransaction(signedTx);
+		return {
+			ok: true,
+			transactionHash: outcome?.transaction?.hash || void 0,
+			outcome
+		};
+	} catch (error) {
+		const code = error?.code || "delegate_execution_failed";
+		return {
+			ok: false,
+			error: error?.message || String(error),
+			code
+		};
+	}
+}
+//#endregion
+export { enforceDelegatePolicy, executeSignedDelegateWithRelayer, normalizeHashToBytes, validateDelegateExpiryAndNonce };
+
+//# sourceMappingURL=index.js.map

package/dist/esm/hosted-wallet-gateway-worker.js

@@ -0,0 +1,18 @@
+import { runRouterAbPrewarmScheduledV1 } from "./router/cloudflare/runtime/routerAbPrewarm.js";
+import "./cloud-host.js";
+import { handleSplitGatewayRequest } from "./hosted-wallet-gateway.js";
+//#region src/hosted-wallet-gateway-worker.ts
+async function fetch(request, env, ctx) {
+	return await handleSplitGatewayRequest(request, env, ctx);
+}
+async function scheduled(event, env, _ctx) {
+	await runRouterAbPrewarmScheduledV1(event, env);
+}
+var hosted_wallet_gateway_worker_default = {
+	fetch,
+	scheduled
+};
+//#endregion
+export { hosted_wallet_gateway_worker_default as default };
+
+//# sourceMappingURL=hosted-wallet-gateway-worker.js.map