@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/shared-ts/src/utils/registrationSignerPlan.js

@@ -0,0 +1,429 @@
+import { alphabetizeStringify } from "./digests.js";
+import { parseNamedNearAccountId } from "./near.js";
+import { inspectRawObject, trimString } from "./registrationAuthMethodInput.js";
+//#region ../shared-ts/src/utils/registrationSignerPlan.ts
+function normalizePositiveInteger(raw, fallback) {
+	const value = typeof raw === "number" ? raw : Number(raw);
+	return Number.isFinite(value) && value >= 1 ? Math.floor(value) : fallback;
+}
+function collectPositiveParticipantIds(raw) {
+	if (!Array.isArray(raw)) return [];
+	const participantIds = [];
+	for (const id of raw) {
+		const numericId = Number(id);
+		if (Number.isInteger(numericId) && numericId > 0) participantIds.push(numericId);
+	}
+	return participantIds;
+}
+function normalizeUnknownArray(raw) {
+	return Array.isArray(raw) ? raw : [];
+}
+function normalizeRegistrationNearAccountProvisioning(raw) {
+	const record = inspectRawObject(raw);
+	if (!record || !("kind" in record)) return null;
+	switch (trimString(record.kind)) {
+		case "implicit_account":
+			if (Object.prototype.hasOwnProperty.call(record, "requestedAccountId") || Object.prototype.hasOwnProperty.call(record, "sponsor")) return null;
+			return {
+				kind: "implicit_account",
+				accountIdSource: "ed25519_public_key"
+			};
+		case "sponsored_named_account": {
+			if (Object.prototype.hasOwnProperty.call(record, "accountIdSource") || !("requestedAccountId" in record)) return null;
+			const parsed = parseNamedNearAccountId(record.requestedAccountId);
+			if (!parsed.ok) return null;
+			return {
+				kind: "sponsored_named_account",
+				requestedAccountId: parsed.value,
+				sponsor: "relayer"
+			};
+		}
+		default: return null;
+	}
+}
+function normalizeRegistrationEcdsaSpec(value) {
+	if (!value) return null;
+	if (!("participantIds" in value) || !("chainTargets" in value)) return null;
+	const participantIds = collectPositiveParticipantIds(value.participantIds);
+	const chainTargets = normalizeUnknownArray(value.chainTargets);
+	if (participantIds.length === 0 || chainTargets.length === 0) return null;
+	return {
+		participantIds,
+		chainTargets
+	};
+}
+const REGISTRATION_NEAR_ED25519_KEY_PURPOSE = "near_tx";
+const NEAR_ED25519_YAO_KEY_VERSION_V1 = "router-ab-ed25519-yao-v1";
+function registrationSignerBranchKeyFromString(value) {
+	const normalized = trimString(value);
+	if (!normalized) throw new Error("registration signer branch key is required");
+	return normalized;
+}
+function registrationNearEd25519BranchKey(signerSlot) {
+	return registrationSignerBranchKeyFromString(`near_ed25519:slot:${signerSlot}`);
+}
+function registrationEvmFamilyEcdsaTargetKey(target) {
+	return alphabetizeStringify(target);
+}
+function registrationEvmFamilyEcdsaBranchKey(chainTargets) {
+	return registrationSignerBranchKeyFromString(`evm_family_ecdsa:${chainTargets.map(registrationEvmFamilyEcdsaTargetKey).join("|")}`);
+}
+function registrationSignerPlanFromRequests(signers) {
+	return registrationSignerPlanFromBranches(signers.map(registrationSignerPlanBranchFromRequest));
+}
+function registrationSignerPlanFromBranches(branches) {
+	if (branches.length === 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signer set must include at least one signer"
+	};
+	const nearSlots = /* @__PURE__ */ new Set();
+	const ecdsaTargetKeys = /* @__PURE__ */ new Set();
+	const branchKeys = /* @__PURE__ */ new Set();
+	for (const branch of branches) {
+		const duplicate = findRegistrationSignerPlanDuplicate({
+			branch,
+			nearSlots,
+			ecdsaTargetKeys,
+			branchKeys
+		});
+		if (duplicate) return duplicate;
+	}
+	return {
+		ok: true,
+		value: {
+			kind: "signer_set",
+			branches
+		}
+	};
+}
+function registrationSignerPlanBranchFromRequest(signer) {
+	switch (signer.kind) {
+		case "near_ed25519": return {
+			kind: "near_ed25519",
+			branchKey: registrationNearEd25519BranchKey(signer.signerSlot),
+			accountProvisioning: signer.accountProvisioning,
+			signerSlot: signer.signerSlot,
+			participantIds: signer.participantIds,
+			keyPurpose: REGISTRATION_NEAR_ED25519_KEY_PURPOSE,
+			keyVersion: NEAR_ED25519_YAO_KEY_VERSION_V1,
+			derivationVersion: signer.derivationVersion
+		};
+		case "evm_family_ecdsa": return {
+			kind: "evm_family_ecdsa",
+			branchKey: registrationEvmFamilyEcdsaBranchKey(signer.chainTargets),
+			participantIds: signer.participantIds,
+			chainTargets: signer.chainTargets
+		};
+		default: return assertNeverRegistrationSignerRequest(signer);
+	}
+}
+function findRegistrationSignerPlanDuplicate(input) {
+	switch (input.branch.kind) {
+		case "near_ed25519":
+			if (input.nearSlots.has(input.branch.signerSlot)) return {
+				ok: false,
+				code: "invalid_body",
+				message: "duplicate near_ed25519 signer slot is invalid"
+			};
+			input.nearSlots.add(input.branch.signerSlot);
+			break;
+		case "evm_family_ecdsa":
+			{
+				const duplicateTarget = findDuplicateRegistrationEcdsaTarget(input.branch, input.ecdsaTargetKeys);
+				if (duplicateTarget) return duplicateTarget;
+			}
+			break;
+		default: return assertNeverRegistrationSignerPlanBranch(input.branch);
+	}
+	return findDuplicateRegistrationSignerBranch(input.branch, input.branchKeys);
+}
+function findDuplicateRegistrationSignerBranch(branch, branchKeys) {
+	const branchKey = String(branch.branchKey);
+	if (branchKeys.has(branchKey)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "duplicate signer branch is invalid"
+	};
+	branchKeys.add(branchKey);
+	return null;
+}
+function findDuplicateRegistrationEcdsaTarget(branch, ecdsaTargetKeys) {
+	for (const target of branch.chainTargets) {
+		const targetKey = registrationEvmFamilyEcdsaTargetKey(target);
+		if (ecdsaTargetKeys.has(targetKey)) return {
+			ok: false,
+			code: "invalid_body",
+			message: "duplicate evm_family_ecdsa chain target is invalid"
+		};
+		ecdsaTargetKeys.add(targetKey);
+	}
+	return null;
+}
+function normalizeRegistrationSignerRequest(raw) {
+	const record = inspectRawObject(raw);
+	if (!record) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signer set entry must be an object"
+	};
+	if (!("kind" in record)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "unsupported registration signer kind"
+	};
+	switch (trimString(record.kind)) {
+		case "near_ed25519": return normalizeRegistrationNearEd25519SignerRequest(record);
+		case "evm_family_ecdsa": return normalizeRegistrationEvmFamilyEcdsaSignerRequest(record);
+		default: return {
+			ok: false,
+			code: "invalid_body",
+			message: "unsupported registration signer kind"
+		};
+	}
+}
+function normalizeRegistrationNearEd25519SignerRequest(raw) {
+	if (Object.prototype.hasOwnProperty.call(raw, "keyPurpose") || Object.prototype.hasOwnProperty.call(raw, "keyVersion")) return {
+		ok: false,
+		code: "invalid_body",
+		message: "near_ed25519 signer spec cannot include protocol key fields"
+	};
+	if (Object.prototype.hasOwnProperty.call(raw, "nearAccountId") || Object.prototype.hasOwnProperty.call(raw, "createNearAccount")) return {
+		ok: false,
+		code: "invalid_body",
+		message: "near_ed25519 signer spec is invalid"
+	};
+	const accountProvisioning = normalizeRegistrationNearAccountProvisioning("accountProvisioning" in raw ? raw.accountProvisioning : void 0);
+	const signerSlot = normalizePositiveInteger("signerSlot" in raw ? raw.signerSlot : void 0, 0);
+	const derivationVersion = Number("derivationVersion" in raw ? raw.derivationVersion : void 0);
+	const participantIds = collectPositiveParticipantIds("participantIds" in raw ? raw.participantIds : void 0);
+	if (!accountProvisioning || signerSlot < 1 || participantIds.length === 0 || derivationVersion !== 1) return {
+		ok: false,
+		code: "invalid_body",
+		message: "near_ed25519 signer spec is invalid"
+	};
+	return {
+		ok: true,
+		value: {
+			kind: "near_ed25519",
+			accountProvisioning,
+			signerSlot,
+			participantIds,
+			derivationVersion
+		}
+	};
+}
+function normalizeRegistrationEvmFamilyEcdsaSignerRequest(raw) {
+	const ecdsa = normalizeRegistrationEcdsaSpec(raw);
+	if (!ecdsa) return {
+		ok: false,
+		code: "invalid_body",
+		message: "evm_family_ecdsa signer spec is invalid"
+	};
+	return {
+		ok: true,
+		value: {
+			kind: "evm_family_ecdsa",
+			participantIds: ecdsa.participantIds,
+			chainTargets: ecdsa.chainTargets
+		}
+	};
+}
+function normalizeRegistrationSignerSetPlan(raw) {
+	if (!("signers" in raw) || !Array.isArray(raw.signers)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signerSelection.signers must be an array"
+	};
+	const signers = [];
+	for (const rawSigner of raw.signers) {
+		const signer = normalizeRegistrationSignerRequest(rawSigner);
+		if (!signer.ok) return signer;
+		signers.push(signer.value);
+	}
+	return registrationSignerPlanFromRequests(signers);
+}
+function normalizeRegistrationSignerPlan(raw) {
+	const record = inspectRawObject(raw);
+	if (!record) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signerSelection must be an object"
+	};
+	if (!("kind" in record)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signerSelection.kind must be signer_set"
+	};
+	if (trimString(record.kind) === "signer_set") return normalizeRegistrationSignerSetPlan(record);
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: "signerSelection.kind must be signer_set"
+	};
+}
+function registrationSignerPlanFromSelection(selection) {
+	return registrationSignerPlanFromRequests(selection.signers);
+}
+function findRegistrationSignerPlanNearEd25519Branch(plan) {
+	for (const branch of plan.branches) if (branch.kind === "near_ed25519") return branch;
+	return null;
+}
+function findRegistrationSignerPlanEvmFamilyEcdsaBranch(plan) {
+	for (const branch of plan.branches) if (branch.kind === "evm_family_ecdsa") return branch;
+	return null;
+}
+function registrationSignerSetSelectionFromPlan(plan, options = {}) {
+	const signers = [];
+	for (const branch of plan.branches) {
+		const signer = registrationSignerRequestFromPlanBranchForSelection(branch, options);
+		if (!signer.ok) return signer;
+		signers.push(signer.value);
+	}
+	return {
+		ok: true,
+		value: {
+			kind: "signer_set",
+			signers
+		}
+	};
+}
+function registrationSignerRequestFromPlanBranchForSelection(branch, options) {
+	switch (branch.kind) {
+		case "near_ed25519": return {
+			ok: true,
+			value: registrationNearEd25519RequestFromPlanBranch(branch)
+		};
+		case "evm_family_ecdsa": return registrationEvmFamilyEcdsaRequestFromPlanBranch(branch, options);
+		default: return assertNeverRegistrationSignerPlanBranch(branch);
+	}
+}
+function registrationNearEd25519RequestFromPlanBranch(branch) {
+	return {
+		kind: "near_ed25519",
+		accountProvisioning: branch.accountProvisioning,
+		signerSlot: branch.signerSlot,
+		participantIds: [...branch.participantIds],
+		derivationVersion: branch.derivationVersion
+	};
+}
+function registrationEvmFamilyEcdsaRequestFromPlanBranch(branch, options) {
+	const chainTargets = registrationEcdsaChainTargetsFromPlanBranch(branch, options);
+	if (!chainTargets) return {
+		ok: false,
+		code: "invalid_body",
+		message: "registration ECDSA chainTargets are invalid"
+	};
+	return {
+		ok: true,
+		value: {
+			kind: "evm_family_ecdsa",
+			participantIds: [...branch.participantIds],
+			chainTargets
+		}
+	};
+}
+function registrationEcdsaChainTargetsFromPlanBranch(branch, options) {
+	if (!options.normalizeEcdsaChainTarget) return [...branch.chainTargets];
+	const chainTargets = [];
+	for (const target of branch.chainTargets) {
+		const normalized = options.normalizeEcdsaChainTarget(target);
+		if (!normalized) return null;
+		chainTargets.push(normalized);
+	}
+	return chainTargets;
+}
+function assertNeverRegistrationSignerRequest(value) {
+	throw new Error(`Unsupported registration signer request: ${String(value)}`);
+}
+function assertNeverRegistrationSignerPlanBranch(value) {
+	throw new Error(`Unsupported registration signer plan branch: ${String(value)}`);
+}
+function normalizeAddSignerSelection(raw, options) {
+	const record = inspectRawObject(raw);
+	if (!record) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signerSelection must be an object"
+	};
+	if (!("mode" in record)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "unsupported add-signer mode"
+	};
+	const mode = trimString(record.mode);
+	if (mode === "ecdsa") return normalizeAddSignerEcdsaSelection("ecdsa" in record ? record.ecdsa : void 0, options);
+	if (mode === "ed25519") return normalizeAddSignerEd25519Selection("ed25519" in record ? record.ed25519 : void 0);
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: "unsupported add-signer mode"
+	};
+}
+function normalizeAddSignerEcdsaSelection(raw, options) {
+	const ecdsaRecord = inspectRawObject(raw);
+	const participantIds = collectPositiveParticipantIds(ecdsaRecord && "participantIds" in ecdsaRecord ? ecdsaRecord.participantIds : void 0);
+	const chainTargets = normalizeAddSignerEcdsaChainTargets(ecdsaRecord && "chainTargets" in ecdsaRecord ? ecdsaRecord.chainTargets : void 0, options);
+	if (participantIds.length === 0 || chainTargets.length === 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ecdsa add-signer spec is invalid"
+	};
+	return {
+		ok: true,
+		value: {
+			mode: "ecdsa",
+			ecdsa: {
+				chainTargets,
+				participantIds
+			}
+		}
+	};
+}
+function normalizeAddSignerEcdsaChainTargets(raw, options) {
+	if (!Array.isArray(raw)) return [];
+	const chainTargets = [];
+	for (const target of raw) {
+		const normalized = options.normalizeEcdsaChainTarget(target);
+		if (!normalized) return [];
+		chainTargets.push(normalized);
+	}
+	return chainTargets;
+}
+function normalizeAddSignerEd25519Selection(raw) {
+	const ed25519Record = inspectRawObject(raw);
+	const ed25519Mode = trimString(ed25519Record && "mode" in ed25519Record ? ed25519Record.mode : void 0);
+	const signerSlot = normalizePositiveInteger(ed25519Record && "signerSlot" in ed25519Record ? ed25519Record.signerSlot : void 0, 1);
+	const keyPurpose = trimString(ed25519Record && "keyPurpose" in ed25519Record ? ed25519Record.keyPurpose : void 0);
+	const keyVersion = trimString(ed25519Record && "keyVersion" in ed25519Record ? ed25519Record.keyVersion : void 0);
+	const derivationVersion = normalizePositiveInteger(ed25519Record && "derivationVersion" in ed25519Record ? ed25519Record.derivationVersion : void 0, 0);
+	const participantIds = collectPositiveParticipantIds(ed25519Record && "participantIds" in ed25519Record ? ed25519Record.participantIds : void 0);
+	if (!keyPurpose || !keyVersion || !derivationVersion || participantIds.length === 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ed25519 add-signer spec is invalid"
+	};
+	if (ed25519Mode === "create_implicit_near_account") return {
+		ok: true,
+		value: {
+			mode: "ed25519",
+			ed25519: {
+				mode: ed25519Mode,
+				signerSlot,
+				participantIds,
+				keyPurpose,
+				keyVersion,
+				derivationVersion
+			}
+		}
+	};
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: "unsupported add-signer mode"
+	};
+}
+//#endregion
+export { findRegistrationSignerPlanEvmFamilyEcdsaBranch, findRegistrationSignerPlanNearEd25519Branch, normalizeAddSignerSelection, normalizeRegistrationSignerPlan, registrationNearEd25519BranchKey, registrationSignerBranchKeyFromString, registrationSignerPlanFromSelection, registrationSignerSetSelectionFromPlan };
+
+//# sourceMappingURL=registrationSignerPlan.js.map

package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js

@@ -1,17 +1,22 @@
 import { parseEcdsaActiveStateId, parseRootShareEpoch, parseThresholdEcdsaSessionId } from "./domainIds.js";
 import { EVM_ECDSA_MPC_OPERATION_KINDS, parseEcdsaAuthorizationSessionId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "./base64.js";
-import { parseCorrelationId } from "./canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
+import { parseCorrelationId } from "./canonicalPrimitives.js";
 import "./encoders.js";
+import { requireRecord } from "./validation.js";
+import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../device-linking/activeWalletSession.js";
 import { requireRouterAbX25519PublicKey } from "./routerAbPublicKeyset.js";
 import { canonicalRouterAbMpcMaterialActivationRefBytes, canonicalRouterAbNormalSigningAuthorizationBytes, parseRouterAbMpcMaterialActivationRef, parseRouterAbNormalSigningAuthorization, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "./routerAbNormalSigningIdentity.js";
-import "../threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeRuntimePolicyScope } from "../threshold/signingRootScope.js";
 import { parseEcdsaServerGeneration } from "./ecdsaCapabilityActivation.js";
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, parseWalletAuthAuthority } from "./walletAuthAuthority.js";
-import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../device-linking/parsers.js";
 //#region ../shared-ts/src/utils/routerAbEcdsaDerivation.ts
+/**
+* The longest an ECDSA presignature ceremony may run. The Gateway authorizes a
+* pool fill only when the requested ceremony deadline is within this limit.
+*/
+const ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS = 5 * 6e4;
 const ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1 = "router_ab_ecdsa_derivation_normal_signing_v1";
 const ROUTER_AB_ECDSA_DERIVATION_HEALTH_PATH = "/router-ab/ecdsa-derivation/healthz";
 const ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH = "/router-ab/ecdsa-derivation/export";
@@ -49,40 +54,14 @@ function projectRouterAbEcdsaDerivationExplicitExportRequestToProtocolV1(request
 		}
 	}
 }
-function parseRouterAbEcdsaPrepareSourceV1(value, request) {
+function parseRouterAbEcdsaPrepareSourceV1(value) {
 	if (value === void 0) return { kind: "available_pool" };
 	const source = requireRecord(value, "presign_source");
 	if (source.kind === "available_pool") {
 		requireExactKeys(source, "presign_source", ["kind"]);
 		return { kind: "available_pool" };
 	}
-	requireExactKeys(source, "presign_source", ["kind", "batch"]);
-	if (source.kind !== "final_presign_batch") throw new Error("Invalid prepare source");
-	const batch = requireRecord(source.batch, "presign_source.batch");
-	requireExactKeys(batch, "presign_source.batch", [
-		"scope",
-		"presign_session_id",
-		"requested_stage",
-		"outgoing_messages_b64u",
-		"ceremony_expires_at_ms",
-		"material_expires_at_ms"
-	]);
-	const scope = parseRouterAbEcdsaDerivationNormalSigningScopeV1(batch.scope);
-	const ceremonyExpiry = requirePositiveUnixMs(batch.ceremony_expires_at_ms, "ceremony_expires_at_ms");
-	const materialExpiry = requirePositiveUnixMs(batch.material_expires_at_ms, "material_expires_at_ms");
-	const messages = batch.outgoing_messages_b64u;
-	if (batch.requested_stage !== "presign" || !Array.isArray(messages) || messages.length !== 2 || !sameRouterAbEcdsaDerivationNormalSigningScopeV1(scope, request.scope) || request.expires_at_ms > materialExpiry || ceremonyExpiry > materialExpiry) throw new Error("Final presign batch does not match signing request");
-	return {
-		kind: "final_presign_batch",
-		batch: {
-			scope,
-			presign_session_id: requireAsciiNonEmptyString(batch.presign_session_id, "presign_session_id"),
-			requested_stage: "presign",
-			outgoing_messages_b64u: [requireBase64UrlNonEmpty(messages[0], "terminal message 1"), requireBase64UrlNonEmpty(messages[1], "terminal message 2")],
-			ceremony_expires_at_ms: ceremonyExpiry,
-			material_expires_at_ms: materialExpiry
-		}
-	};
+	throw new Error("Unsupported signing prepare source");
 }
 async function computeRouterAbEcdsaOperationStepUpChallengeB64u(value) {
 	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
@@ -90,10 +69,6 @@ async function computeRouterAbEcdsaOperationStepUpChallengeB64u(value) {
 		operation: parseRouterAbEcdsaOperationStepUpPreparationV1(value)
 	})));
 }
-function requireRecord(value, label) {
-	if (value && typeof value === "object" && !Array.isArray(value)) return value;
-	throw new Error(`${label} must be an object`);
-}
 function requireExactKeys(record, label, allowedKeys) {
 	const allowed = new Set(allowedKeys);
 	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is not a supported field`);
@@ -155,10 +130,6 @@ function requireU32(value, label) {
 	if (parsed !== value || parsed < 0 || parsed > 4294967295) throw new Error(`${label} must be a u32 integer`);
 	return parsed;
 }
-function requireBoolean(value, label) {
-	if (typeof value !== "boolean") throw new Error(`${label} must be a boolean`);
-	return value;
-}
 function requireByte(value, label) {
 	if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${label} must be a finite number`);
 	const parsed = Math.floor(value);
@@ -1588,103 +1559,7 @@ function parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(value) {
 	]);
 	return parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestFields(record);
 }
-function parseServerPresignatureShare(value) {
-	const record = requireRecord(value, "presignature");
-	requireExactKeys(record, "presignature", [
-		"serverKeyId",
-		"presignatureId",
-		"bigRB64u",
-		"kShareB64u",
-		"sigmaShareB64u",
-		"createdAtMs"
-	]);
-	return {
-		serverKeyId: requireAsciiNonEmptyString(record.serverKeyId, "presignature.serverKeyId"),
-		presignatureId: requireAsciiNonEmptyString(record.presignatureId, "presignature.presignatureId"),
-		bigRB64u: requireBase64UrlFixed(record.bigRB64u, "presignature.bigRB64u", 33),
-		kShareB64u: requireBase64UrlFixed(record.kShareB64u, "presignature.kShareB64u", 32),
-		sigmaShareB64u: requireBase64UrlFixed(record.sigmaShareB64u, "presignature.sigmaShareB64u", 32),
-		createdAtMs: requirePositiveUnixMs(record.createdAtMs, "presignature.createdAtMs")
-	};
-}
-function parseActiveSigningWorkerState(value) {
-	const record = requireRecord(value, "receipt.active_signing_worker_state");
-	requireExactKeys(record, "receipt.active_signing_worker_state", [
-		"account_id",
-		"material_activation",
-		"account_public_key",
-		"signing_worker",
-		"activation_transcript_digest",
-		"activation_digest",
-		"signing_worker_material_handle",
-		"activated_at_ms"
-	]);
-	return {
-		account_id: requireAsciiNonEmptyString(record.account_id, "receipt.active_signing_worker_state.account_id"),
-		material_activation: parseRouterAbMpcMaterialActivationRef(record.material_activation),
-		account_public_key: requireAsciiNonEmptyString(record.account_public_key, "receipt.active_signing_worker_state.account_public_key"),
-		signing_worker: parseServerIdentityWithLabel(record.signing_worker, "receipt.active_signing_worker_state.signing_worker"),
-		activation_transcript_digest: parsePublicDigest32(record.activation_transcript_digest, "receipt.active_signing_worker_state.activation_transcript_digest"),
-		activation_digest: parsePublicDigest32(record.activation_digest, "receipt.active_signing_worker_state.activation_digest"),
-		signing_worker_material_handle: requireAsciiNonEmptyString(record.signing_worker_material_handle, "receipt.active_signing_worker_state.signing_worker_material_handle"),
-		activated_at_ms: requirePositiveUnixMs(record.activated_at_ms, "receipt.active_signing_worker_state.activated_at_ms")
-	};
-}
-function buildCloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutRequestV1(input) {
-	const scope = parseRouterAbEcdsaDerivationNormalSigningScopeV1(input.scope);
-	const presignature = parseServerPresignatureShare(input.presignature);
-	const expiresAtMs = requirePositiveUnixMs(input.expiresAtMs, "expiresAtMs");
-	return {
-		scope,
-		server_presignature_id: presignature.presignatureId,
-		server_big_r33_b64u: presignature.bigRB64u,
-		server_k_share32_b64u: presignature.kShareB64u,
-		server_sigma_share32_b64u: presignature.sigmaShareB64u,
-		expires_at_ms: expiresAtMs
-	};
-}
-function parseCloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutRequestV1(value) {
-	const record = requireRecord(value, "poolFillRequest");
-	requireExactKeys(record, "poolFillRequest", [
-		"scope",
-		"server_presignature_id",
-		"server_big_r33_b64u",
-		"server_k_share32_b64u",
-		"server_sigma_share32_b64u",
-		"expires_at_ms"
-	]);
-	return {
-		scope: parseRouterAbEcdsaDerivationNormalSigningScopeV1(record.scope),
-		server_presignature_id: requireAsciiNonEmptyString(record.server_presignature_id, "poolFillRequest.server_presignature_id"),
-		server_big_r33_b64u: requireBase64UrlFixed(record.server_big_r33_b64u, "poolFillRequest.server_big_r33_b64u", 33),
-		server_k_share32_b64u: requireBase64UrlFixed(record.server_k_share32_b64u, "poolFillRequest.server_k_share32_b64u", 32),
-		server_sigma_share32_b64u: requireBase64UrlFixed(record.server_sigma_share32_b64u, "poolFillRequest.server_sigma_share32_b64u", 32),
-		expires_at_ms: requirePositiveUnixMs(record.expires_at_ms, "poolFillRequest.expires_at_ms")
-	};
-}
-function parseCloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutReceiptV1(value) {
-	const record = requireRecord(value, "receipt");
-	requireExactKeys(record, "receipt", [
-		"active_signing_worker_state",
-		"server_presignature_id",
-		"server_big_r33_b64u",
-		"stored"
-	]);
-	return {
-		active_signing_worker_state: parseActiveSigningWorkerState(record.active_signing_worker_state),
-		server_presignature_id: requireAsciiNonEmptyString(record.server_presignature_id, "receipt.server_presignature_id"),
-		server_big_r33_b64u: requireBase64UrlFixed(record.server_big_r33_b64u, "receipt.server_big_r33_b64u", 33),
-		stored: requireBoolean(record.stored, "receipt.stored")
-	};
-}
-function parseCloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutReceiptForRequestV1(request, value) {
-	const parsedRequest = parseCloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutRequestV1(request);
-	const receipt = parseCloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutReceiptV1(value);
-	if (receipt.server_presignature_id !== parsedRequest.server_presignature_id) throw new Error("receipt.server_presignature_id does not match pool-fill request");
-	if (receipt.server_big_r33_b64u !== parsedRequest.server_big_r33_b64u) throw new Error("receipt.server_big_r33_b64u does not match pool-fill request");
-	return receipt;
-}
 //#endregion
-export { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_HEALTH_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, buildCloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutRequestV1, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationPublicCapabilityV1, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseCloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutReceiptForRequestV1, parseCloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutRequestV1, parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1, parseRouterAbEcdsaDerivationActivationRefreshRequestV1, parseRouterAbEcdsaDerivationActivationRefreshResponseV1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationExplicitExportRequestV1, parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaExplicitExportProtocolForwardedResponseV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaOperationStepUpPreparationV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, parseRouterAbEcdsaPrepareSourceV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaRegistrationActivationRequestV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaRegistrationRequestV1, parseRouterAbEcdsaSigningWorkerProtocolExportShareEnvelopeV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1, projectRouterAbEcdsaDerivationExplicitExportRequestToProtocolV1, requireRouterAbEcdsaDerivationNormalSigningStateV1, routerAbEcdsaDerivationActiveStateId, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaRegistrationRequestFactsV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire, sameRouterAbServerIdentityV1 };
+export { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_HEALTH_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationPublicCapabilityV1, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1, parseRouterAbEcdsaDerivationActivationRefreshRequestV1, parseRouterAbEcdsaDerivationActivationRefreshResponseV1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationExplicitExportRequestV1, parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaExplicitExportProtocolForwardedResponseV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaOperationStepUpPreparationV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, parseRouterAbEcdsaPrepareSourceV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaRegistrationActivationRequestV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaRegistrationRequestV1, parseRouterAbEcdsaSigningWorkerProtocolExportShareEnvelopeV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1, projectRouterAbEcdsaDerivationExplicitExportRequestToProtocolV1, requireRouterAbEcdsaDerivationNormalSigningStateV1, routerAbEcdsaDerivationActiveStateId, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaRegistrationRequestFactsV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire, sameRouterAbServerIdentityV1 };
 
 //# sourceMappingURL=routerAbEcdsaDerivation.js.map