@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/core/authService/storeRegistry.js

@@ -1,102 +0,0 @@
-import { createWalletStore } from "../WalletStore.js";
-import { createWebAuthnCredentialBindingStore } from "../WebAuthnCredentialBindingStore.js";
-import { createNearPublicKeyStore } from "../NearPublicKeyStore.js";
-import { createEmailOtpRateLimiter } from "./rateLimits.js";
-import { createEmailOtpAuthStateStore, createEmailOtpChallengeStore, createEmailOtpGrantStore, createEmailOtpRegistrationAttemptStore, createEmailOtpUnlockChallengeStore, createEmailOtpWalletEnrollmentStore } from "../EmailOtpStores.js";
-import { createIdentityStore } from "../IdentityStore.js";
-import { createWalletAuthMethodStore } from "../WalletAuthMethodStore.js";
-import { createWebAuthnAuthenticatorStore } from "../WebAuthnAuthenticatorStore.js";
-import { createWebAuthnLoginChallengeStore } from "../WebAuthnLoginChallengeStore.js";
-import { createWebAuthnSyncChallengeStore } from "../WebAuthnSyncChallengeStore.js";
-//#region src/core/authService/storeRegistry.ts
-function createStoreFactoryInput(input) {
-	return {
-		config: input.config.thresholdStore || null,
-		logger: input.logger,
-		isNode: input.isNode()
-	};
-}
-var AuthServiceStoreRegistry = class {
-	constructor(input) {
-		this.input = input;
-		this.webAuthnAuthenticatorStore = null;
-		this.webAuthnLoginChallengeStore = null;
-		this.webAuthnCredentialBindingStore = null;
-		this.webAuthnSyncChallengeStore = null;
-		this.emailOtpChallengeStore = null;
-		this.emailOtpGrantStore = null;
-		this.emailOtpWalletEnrollmentStore = null;
-		this.emailOtpAuthStateStore = null;
-		this.emailOtpUnlockChallengeStore = null;
-		this.emailOtpRegistrationAttemptStore = null;
-		this.emailOtpRateLimiter = null;
-		this.nearPublicKeyStore = null;
-		this.identityStore = null;
-		this.walletStore = null;
-		this.walletAuthMethodStore = null;
-	}
-	getWebAuthnAuthenticatorStore() {
-		this.webAuthnAuthenticatorStore ??= createWebAuthnAuthenticatorStore(createStoreFactoryInput(this.input));
-		return this.webAuthnAuthenticatorStore;
-	}
-	getWebAuthnLoginChallengeStore() {
-		this.webAuthnLoginChallengeStore ??= createWebAuthnLoginChallengeStore(createStoreFactoryInput(this.input));
-		return this.webAuthnLoginChallengeStore;
-	}
-	getWebAuthnCredentialBindingStore() {
-		this.webAuthnCredentialBindingStore ??= createWebAuthnCredentialBindingStore(createStoreFactoryInput(this.input));
-		return this.webAuthnCredentialBindingStore;
-	}
-	getWebAuthnSyncChallengeStore() {
-		this.webAuthnSyncChallengeStore ??= createWebAuthnSyncChallengeStore(createStoreFactoryInput(this.input));
-		return this.webAuthnSyncChallengeStore;
-	}
-	getWalletStore() {
-		this.walletStore ??= createWalletStore(createStoreFactoryInput(this.input));
-		return this.walletStore;
-	}
-	getWalletAuthMethodStore() {
-		this.walletAuthMethodStore ??= createWalletAuthMethodStore(createStoreFactoryInput(this.input));
-		return this.walletAuthMethodStore;
-	}
-	getEmailOtpChallengeStore() {
-		this.emailOtpChallengeStore ??= createEmailOtpChallengeStore(createStoreFactoryInput(this.input));
-		return this.emailOtpChallengeStore;
-	}
-	getEmailOtpGrantStore() {
-		this.emailOtpGrantStore ??= createEmailOtpGrantStore(createStoreFactoryInput(this.input));
-		return this.emailOtpGrantStore;
-	}
-	getEmailOtpWalletEnrollmentStore() {
-		this.emailOtpWalletEnrollmentStore ??= createEmailOtpWalletEnrollmentStore(createStoreFactoryInput(this.input));
-		return this.emailOtpWalletEnrollmentStore;
-	}
-	getEmailOtpAuthStateStore() {
-		this.emailOtpAuthStateStore ??= createEmailOtpAuthStateStore(createStoreFactoryInput(this.input));
-		return this.emailOtpAuthStateStore;
-	}
-	getEmailOtpUnlockChallengeStore() {
-		this.emailOtpUnlockChallengeStore ??= createEmailOtpUnlockChallengeStore(createStoreFactoryInput(this.input));
-		return this.emailOtpUnlockChallengeStore;
-	}
-	getEmailOtpRegistrationAttemptStore() {
-		this.emailOtpRegistrationAttemptStore ??= createEmailOtpRegistrationAttemptStore(createStoreFactoryInput(this.input));
-		return this.emailOtpRegistrationAttemptStore;
-	}
-	getEmailOtpRateLimiter() {
-		this.emailOtpRateLimiter ??= createEmailOtpRateLimiter({ thresholdStore: this.input.config.thresholdStore });
-		return this.emailOtpRateLimiter;
-	}
-	getIdentityStore() {
-		this.identityStore ??= createIdentityStore(createStoreFactoryInput(this.input));
-		return this.identityStore;
-	}
-	getNearPublicKeyStore() {
-		this.nearPublicKeyStore ??= createNearPublicKeyStore(createStoreFactoryInput(this.input));
-		return this.nearPublicKeyStore;
-	}
-};
-//#endregion
-export { AuthServiceStoreRegistry };
-
-//# sourceMappingURL=storeRegistry.js.map

package/dist/esm/core/authService/thresholdStoreSummary.js

@@ -1,32 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { coerceThresholdNodeRole } from "../ThresholdService/config.js";
-//#region src/core/authService/thresholdStoreSummary.ts
-function thresholdStoreKind(cfg) {
-	if ("kind" in cfg) switch (cfg.kind) {
-		case "upstash-redis-rest": return "upstash";
-		case "redis-tcp": return "redis";
-		case "cloudflare-do": return "cloudflare-do";
-		case "in-memory": return "in-memory";
-	}
-	const upstashUrl = normalizeOptionalTrimmedString(cfg.UPSTASH_REDIS_REST_URL);
-	const upstashToken = normalizeOptionalTrimmedString(cfg.UPSTASH_REDIS_REST_TOKEN);
-	const redisUrl = normalizeOptionalTrimmedString(cfg.REDIS_URL);
-	if (upstashUrl || upstashToken) return "upstash";
-	if (redisUrl) return "redis";
-	return "in-memory";
-}
-function summarizeThresholdStoreConfig(cfg) {
-	if (!cfg) return "thresholdStore: not configured";
-	const nodeRole = coerceThresholdNodeRole(cfg.THRESHOLD_NODE_ROLE);
-	const store = thresholdStoreKind(cfg);
-	return [
-		`thresholdStore: configured`,
-		`nodeRole=${nodeRole}`,
-		`store=${store}`
-	].join(" ");
-}
-//#endregion
-export { summarizeThresholdStoreConfig };
-
-//# sourceMappingURL=thresholdStoreSummary.js.map

package/dist/esm/core/authService/webauthnAuthority.js

@@ -1,17 +0,0 @@
-import { parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
-//#region src/core/authService/webauthnAuthority.ts
-function requireWebAuthnRpId(value, fieldName) {
-	const parsed = parseWebAuthnRpId(value);
-	if (!parsed.ok) throw new Error(`${fieldName}: ${parsed.error.message}`);
-	return parsed.value;
-}
-function passkeyThresholdEd25519AuthorityScope(rpId) {
-	return {
-		kind: "passkey_rp",
-		rpId
-	};
-}
-//#endregion
-export { passkeyThresholdEd25519AuthorityScope, requireWebAuthnRpId };
-
-//# sourceMappingURL=webauthnAuthority.js.map

package/dist/esm/core/defaultConfigsServer.js

@@ -1,9 +0,0 @@
-//#region src/core/defaultConfigsServer.ts
-const THRESHOLD_NODE_ROLE_COORDINATOR = "coordinator";
-const THRESHOLD_NODE_ROLE_DEFAULT = THRESHOLD_NODE_ROLE_COORDINATOR;
-const THRESHOLD_DO_OBJECT_NAME_DEFAULT = "threshold-store";
-const THRESHOLD_PREFIX_DEFAULT = "w3a";
-//#endregion
-export { THRESHOLD_DO_OBJECT_NAME_DEFAULT, THRESHOLD_NODE_ROLE_COORDINATOR, THRESHOLD_NODE_ROLE_DEFAULT, THRESHOLD_PREFIX_DEFAULT };
-
-//# sourceMappingURL=defaultConfigsServer.js.map

package/dist/esm/core/hostedAccountIds.js

@@ -1,225 +0,0 @@
-import { parseWalletId } from "../shared-ts/src/utils/domainIds.js";
-import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import { isValidAccountId } from "../shared-ts/src/utils/near.js";
-import "../shared-ts/src/utils/validation.js";
-//#region src/core/hostedAccountIds.ts
-const DOMAIN = "near_account_slug_v1";
-const ADJECTIVES = [
-	"amber",
-	"arctic",
-	"autumn",
-	"brisk",
-	"calm",
-	"cedar",
-	"clear",
-	"cobalt",
-	"coral",
-	"cosmic",
-	"crisp",
-	"dawn",
-	"deep",
-	"ember",
-	"fair",
-	"fresh",
-	"frost",
-	"gentle",
-	"golden",
-	"green",
-	"hidden",
-	"high",
-	"ivory",
-	"jade",
-	"keen",
-	"kind",
-	"lunar",
-	"maple",
-	"misty",
-	"neon",
-	"nimble",
-	"noble",
-	"opal",
-	"quiet",
-	"rapid",
-	"river",
-	"sage",
-	"silver",
-	"solar",
-	"spruce",
-	"steady",
-	"stone",
-	"sunny",
-	"swift",
-	"tidal",
-	"true",
-	"urban",
-	"velvet",
-	"vivid",
-	"warm",
-	"wild",
-	"winter",
-	"wise",
-	"young",
-	"zen",
-	"azure",
-	"bright",
-	"cloud",
-	"distant",
-	"glad",
-	"honest",
-	"loyal",
-	"prime",
-	"zesty"
-];
-const NOUNS = [
-	"anchor",
-	"ash",
-	"bay",
-	"beacon",
-	"birch",
-	"brook",
-	"canyon",
-	"cliff",
-	"comet",
-	"cove",
-	"delta",
-	"dune",
-	"field",
-	"flare",
-	"forest",
-	"grove",
-	"harbor",
-	"hill",
-	"isle",
-	"lagoon",
-	"lake",
-	"leaf",
-	"light",
-	"meadow",
-	"mesa",
-	"moon",
-	"nova",
-	"oasis",
-	"orchid",
-	"peak",
-	"pine",
-	"plain",
-	"reef",
-	"ridge",
-	"river",
-	"rock",
-	"shell",
-	"shore",
-	"sky",
-	"spark",
-	"spring",
-	"star",
-	"stone",
-	"summit",
-	"sun",
-	"thicket",
-	"trail",
-	"vale",
-	"valley",
-	"wave",
-	"willow",
-	"wind",
-	"wood",
-	"zephyr",
-	"atlas",
-	"bridge",
-	"garden",
-	"haven",
-	"lantern",
-	"maple",
-	"signal",
-	"silver",
-	"tempo",
-	"vista"
-];
-function requireNonEmpty(label, value) {
-	const normalized = normalizeOptionalTrimmedString(value);
-	if (!normalized) throw new Error(`${label} is required`);
-	return normalized;
-}
-function bytesToUint32(bytes, offset) {
-	return (bytes[offset] || 0) * 16777216 + ((bytes[offset + 1] || 0) << 16) + ((bytes[offset + 2] || 0) << 8) + (bytes[offset + 3] || 0) >>> 0;
-}
-function bytesToBase36(bytes) {
-	let value = 0n;
-	for (const byte of bytes.slice(8, 16)) value = (value << 8n) + BigInt(byte);
-	return value.toString(36);
-}
-function parseHostedHmacReadableRelayerWalletId(input) {
-	const walletId = parseWalletId(input.walletId);
-	if (!walletId.ok) return {
-		ok: false,
-		code: "invalid_wallet_id"
-	};
-	const walletIdValue = String(walletId.value);
-	const relayerAccount = normalizeOptionalTrimmedString(input.relayerAccount);
-	if (!relayerAccount || !isValidAccountId(relayerAccount)) return {
-		ok: false,
-		code: "invalid_relayer_account"
-	};
-	if (!isValidAccountId(walletIdValue)) return {
-		ok: false,
-		code: "not_near_account"
-	};
-	if (!walletIdValue.endsWith(`.${relayerAccount}`)) return {
-		ok: false,
-		code: "not_relayer_subaccount"
-	};
-	const slug = walletIdValue.slice(0, -(relayerAccount.length + 1));
-	if (!/^[a-z]+-[a-z]+-[a-z0-9]{10}$/.test(slug)) return {
-		ok: false,
-		code: "not_hmac_readable"
-	};
-	return {
-		ok: true,
-		value: walletId.value
-	};
-}
-function isHostedHmacReadableRelayerWalletId(input) {
-	return parseHostedHmacReadableRelayerWalletId(input).ok;
-}
-async function hmacSha256(secret, context) {
-	if (typeof crypto === "undefined" || !crypto.subtle) throw new Error("WebCrypto (crypto.subtle) is unavailable in this runtime");
-	const encoder = new TextEncoder();
-	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-	const mac = await crypto.subtle.sign("HMAC", key, encoder.encode(context));
-	return new Uint8Array(mac);
-}
-async function deriveHostedNearAccountId(input) {
-	const secret = requireNonEmpty("ACCOUNT_ID_DERIVATION_SECRET", input.accountIdDerivationSecret);
-	const relayerAccount = requireNonEmpty("relayerAccount", input.relayerAccount);
-	if (!isValidAccountId(relayerAccount)) throw new Error("Hosted account ID generation requires a valid relayerAccount");
-	const projectId = requireNonEmpty("projectId", input.projectId);
-	const envId = requireNonEmpty("envId", input.envId);
-	const authProvider = requireNonEmpty("authProvider", input.authProvider);
-	const providerSubject = normalizeOptionalTrimmedString(input.providerSubject);
-	const verifiedEmail = normalizeOptionalTrimmedString(input.verifiedEmail);
-	const walletIdDerivationNonce = normalizeOptionalTrimmedString(input.walletIdDerivationNonce);
-	const identity = providerSubject || verifiedEmail;
-	if (!identity) throw new Error("Hosted account ID generation requires providerSubject or verifiedEmail");
-	const collisionCounter = Math.max(0, Math.floor(Number(input.collisionCounter) || 0));
-	const contextParts = [
-		DOMAIN,
-		projectId,
-		envId,
-		authProvider,
-		identity
-	];
-	if (walletIdDerivationNonce) contextParts.push(`nonce:${walletIdDerivationNonce}`);
-	if (collisionCounter > 0) contextParts.push(`collision:${collisionCounter}`);
-	const seed = await hmacSha256(secret, contextParts.join("\0"));
-	const walletId = `${ADJECTIVES[bytesToUint32(seed, 0) % ADJECTIVES.length]}-${NOUNS[bytesToUint32(seed, 4) % NOUNS.length]}-${bytesToBase36(seed).padStart(10, "0").slice(0, 10)}.${relayerAccount}`;
-	if (!isValidAccountId(walletId)) throw new Error("Generated hosted NEAR account ID is invalid");
-	return walletId;
-}
-//#endregion
-export { deriveHostedNearAccountId, isHostedHmacReadableRelayerWalletId };
-
-//# sourceMappingURL=hostedAccountIds.js.map

package/dist/esm/core/routerAbSigning/createRouterAbSigningRuntimes.js

@@ -1,84 +0,0 @@
-import { isObject } from "../../shared-ts/src/utils/validation.js";
-import { coerceLogger } from "../logger.js";
-import { RouterAbEcdsaPresignRuntime, parseRouterAbEcdsaPresignRuntimeConfig } from "./RouterAbEcdsaPresignRuntime.js";
-import { createEcdsaWalletSessionStore, createEd25519WalletSessionStore } from "../ThresholdService/stores/WalletSessionStore.js";
-import { RouterAbNormalSigningRuntime, parseRouterAbNormalSigningRuntimeConfig, requireRouterAbConfiguredSigningWorkerPrivateTransport } from "./RouterAbNormalSigningRuntime.js";
-//#region src/core/routerAbSigning/createRouterAbSigningRuntimes.ts
-async function ensureRouterAbSigningRuntimeReady() {
-	await this.getRelayerAccount();
-}
-function isNodeEnvironment() {
-	const processObject = globalThis.process;
-	const isNode = Boolean(processObject?.versions?.node);
-	const isCloudflareWorker = typeof globalThis.WebSocketPair !== "undefined" || typeof navigator !== "undefined" && String(navigator.userAgent || "").includes("Cloudflare-Workers");
-	return isNode && !isCloudflareWorker;
-}
-function thresholdStoreConfigFromEnvironment(environment) {
-	if (!environment) return null;
-	return {
-		UPSTASH_REDIS_REST_URL: environment.UPSTASH_REDIS_REST_URL,
-		UPSTASH_REDIS_REST_TOKEN: environment.UPSTASH_REDIS_REST_TOKEN,
-		REDIS_URL: environment.REDIS_URL,
-		THRESHOLD_PREFIX: environment.THRESHOLD_PREFIX,
-		THRESHOLD_ED25519_KEYSTORE_PREFIX: environment.THRESHOLD_ED25519_KEYSTORE_PREFIX,
-		THRESHOLD_ED25519_WALLET_SESSION_PREFIX: environment.THRESHOLD_ED25519_WALLET_SESSION_PREFIX,
-		THRESHOLD_WALLET_SIGNING_BUDGET_SESSION_PREFIX: environment.THRESHOLD_WALLET_SIGNING_BUDGET_SESSION_PREFIX,
-		THRESHOLD_ECDSA_KEYSTORE_PREFIX: environment.THRESHOLD_ECDSA_KEYSTORE_PREFIX,
-		THRESHOLD_ECDSA_SESSION_PREFIX: environment.THRESHOLD_ECDSA_SESSION_PREFIX,
-		THRESHOLD_ECDSA_WALLET_SESSION_PREFIX: environment.THRESHOLD_ECDSA_WALLET_SESSION_PREFIX,
-		THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID: environment.THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID,
-		THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID: environment.THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID,
-		THRESHOLD_NODE_ROLE: environment.THRESHOLD_NODE_ROLE,
-		THRESHOLD_COORDINATOR_INSTANCE_ID: environment.THRESHOLD_COORDINATOR_INSTANCE_ID,
-		THRESHOLD_COORDINATOR_PEERS: environment.THRESHOLD_COORDINATOR_PEERS,
-		ROUTER_AB_NORMAL_SIGNING_WORKER_ID: environment.ROUTER_AB_NORMAL_SIGNING_WORKER_ID,
-		ROUTER_AB_SIGNING_WORKER_URL: environment.ROUTER_AB_SIGNING_WORKER_URL,
-		ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET: environment.ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET
-	};
-}
-function resolveThresholdStoreConfig(input) {
-	if (isObject(input.environmentConfig) && isObject(input.explicitConfig)) return {
-		...input.environmentConfig,
-		...input.explicitConfig
-	};
-	return input.explicitConfig ?? input.environmentConfig;
-}
-function createRouterAbSigningRuntimes(input) {
-	const logger = coerceLogger(input.logger);
-	const isNode = input.isNode ?? isNodeEnvironment();
-	const environment = isNode ? globalThis.process?.env : void 0;
-	const config = resolveThresholdStoreConfig({
-		explicitConfig: input.thresholdStore,
-		environmentConfig: thresholdStoreConfigFromEnvironment(environment)
-	});
-	const configRecord = isObject(config) ? config : {};
-	const ed25519WalletSessionStore = createEd25519WalletSessionStore({
-		config,
-		logger,
-		isNode
-	});
-	const ecdsaWalletSessionStore = createEcdsaWalletSessionStore({
-		config,
-		logger,
-		isNode
-	});
-	const ensureReady = ensureRouterAbSigningRuntimeReady.bind(input.authService);
-	const normalSigningConfig = parseRouterAbNormalSigningRuntimeConfig(configRecord);
-	const signingWorkerTransport = requireRouterAbConfiguredSigningWorkerPrivateTransport(normalSigningConfig.signingWorkerTransport);
-	return {
-		normalSigning: new RouterAbNormalSigningRuntime({
-			walletSessionStore: ed25519WalletSessionStore,
-			ecdsaWalletSessionStore,
-			config: normalSigningConfig
-		}),
-		ecdsaPresign: new RouterAbEcdsaPresignRuntime({
-			config: parseRouterAbEcdsaPresignRuntimeConfig(configRecord),
-			signingWorkerTransport,
-			ensureReady
-		})
-	};
-}
-//#endregion
-export { createRouterAbSigningRuntimes };
-
-//# sourceMappingURL=createRouterAbSigningRuntimes.js.map

package/dist/esm/core/signingLanes/LaneAggregateRevocationApplicationService.js

@@ -1,86 +0,0 @@
-import { parseRevokeLaneEnrollmentV1 } from "../../shared-ts/src/signing-lanes/rotationParsers.js";
-import { computeLaneEnrollmentManifestDigestV1 } from "../../shared-ts/src/signing-lanes/rotationDigests.js";
-//#region src/core/signingLanes/LaneAggregateRevocationApplicationService.ts
-var LaneAggregateRevocationApplicationService = class {
-	constructor(options) {
-		this.options = options;
-	}
-	/**
-	* Establish the enrollment lifecycle fence before management revokes any
-	* child authorization. The full aggregate path calls the same durable fence
-	* again, so retries remain idempotent.
-	*/
-	async fenceLaneEnrollmentV1(input) {
-		const command = parseRevokeLaneEnrollmentV1(input);
-		const admission = await this.options.lifecycleStore.getEnrollment(command.enrollmentId);
-		if (!admission) return { kind: "conflict" };
-		const manifestDigest = await computeLaneEnrollmentManifestDigestV1(admission.value.manifest);
-		if (admission.value.manifest.walletId !== command.walletId || manifestDigest !== command.manifestDigestB64u) return { kind: "conflict" };
-		const fenced = await this.options.lifecycleStore.fenceEnrollmentRevocation(command);
-		return fenced.outcome === "conflict" ? { kind: "conflict" } : { kind: fenced.outcome };
-	}
-	async revokeLaneEnrollmentV1(input) {
-		const command = parseRevokeLaneEnrollmentV1(input.command);
-		const admission = await this.options.lifecycleStore.getEnrollment(command.enrollmentId);
-		if (!admission) throw new Error("lane enrollment revocation target is missing");
-		const manifestDigest = await computeLaneEnrollmentManifestDigestV1(admission.value.manifest);
-		if (admission.value.manifest.walletId !== command.walletId || manifestDigest !== command.manifestDigestB64u) throw new Error("lane enrollment revocation differs from its admitted manifest");
-		if (input.orderedChildren.length !== admission.value.manifest.orderedChildren.length) throw new Error("lane enrollment revocation child count differs from its manifest");
-		const fenced = await this.options.lifecycleStore.fenceEnrollmentRevocation(command);
-		if (fenced.outcome === "conflict") throw new Error(`lane enrollment revocation fence conflicted at version ${fenced.actualVersion}`);
-		const productsByOperation = indexProducts(await this.options.lifecycleStore.listEnrollmentProductEpochs(command.enrollmentId));
-		for (let index = 0; index < admission.value.manifest.orderedChildren.length; index += 1) {
-			const manifestChild = admission.value.manifest.orderedChildren[index];
-			const childRequest = input.orderedChildren[index];
-			if (!manifestChild || !childRequest) throw new Error("lane enrollment revocation child ordering is incomplete");
-			const product = productsByOperation.get(String(manifestChild.operationId));
-			if (!product) throw new Error(`lane enrollment revocation product is missing ${String(manifestChild.operationId)}`);
-			assertAggregateChildMatches(command, manifestChild, product, childRequest);
-			if ((await this.options.laneLifecycle.revokeSigningLaneV1(childRequest)).outcome === "conflict") throw new Error(`lane enrollment child revocation conflicted for ${String(manifestChild.operationId)}`);
-		}
-		return await this.options.enrollmentRevocation.completeLaneEnrollmentRevocationV1({
-			command,
-			expectedVersion: fenced.version
-		});
-	}
-};
-function indexProducts(products) {
-	const indexed = /* @__PURE__ */ new Map();
-	for (const product of products) {
-		const key = String(product.operationId);
-		if (indexed.has(key)) throw new Error("lane enrollment product operation ids are duplicated");
-		indexed.set(key, product);
-	}
-	return indexed;
-}
-function assertAggregateChildMatches(parent, manifest, product, request) {
-	const command = request.command;
-	const expectedCurve = manifest.keyFamily === "ed25519" ? "ed25519_yao" : "ecdsa_additive";
-	if (request.curve !== expectedCurve || command.walletId !== parent.walletId || command.walletKeyId !== manifest.walletKeyId || command.laneId !== manifest.targetLaneId || command.laneShareEpoch !== manifest.targetLaneShareEpoch || command.requestedAtMs !== parent.requestedAtMs || command.reason !== childReason(parent.reason) || product.enrollmentId !== parent.enrollmentId || product.operationId !== manifest.operationId || product.walletId !== parent.walletId || product.walletKeyId !== manifest.walletKeyId || product.keyFamily !== manifest.keyFamily || product.laneId !== manifest.targetLaneId || product.laneShareEpoch !== manifest.targetLaneShareEpoch || product.targetMaterialActivationId !== manifest.targetMaterialActivationId || product.holderParticipant.participantBindingDigestB64u !== manifest.holderParticipantBindingDigestB64u || product.signingWorkerParticipant.participantBindingDigestB64u !== manifest.signingWorkerParticipantBindingDigestB64u || command.expectedRevocationEpoch !== expectedSourceRevocationEpoch(product)) throw new Error("lane enrollment child revocation differs from its admitted product");
-	if ((product.state === "revocation_pending" || product.state === "revoked") && product.retirementEffectBindingDigestB64u !== command.retirementEffectBindingDigestB64u) throw new Error("lane enrollment child revocation changed its authorized effect binding");
-}
-function expectedSourceRevocationEpoch(product) {
-	switch (product.state) {
-		case "pending_visibility":
-		case "active": return product.revocationEpoch;
-		case "revocation_pending":
-		case "revoked":
-			if (product.revocationEpoch < 1) throw new Error("lane enrollment child revocation epoch is invalid");
-			return product.revocationEpoch - 1;
-		case "retired": throw new Error("retired lane products cannot be revoked through an active enrollment");
-	}
-}
-function childReason(reason) {
-	switch (reason) {
-		case "user_revoked": return "user_revoked";
-		case "device_compromise": return "device_compromise";
-		case "agent_compromise": return "agent_compromise";
-		case "cancelled_after_commit":
-		case "expired_after_commit":
-		case "revoked_during_activation": return "policy_revoked";
-	}
-}
-//#endregion
-export { LaneAggregateRevocationApplicationService };
-
-//# sourceMappingURL=LaneAggregateRevocationApplicationService.js.map