@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/router/cloudflare/signingLanes/cloudflareLaneCurveExecution.js

@@ -1,597 +0,0 @@
-import { buildMpcMaterialActivationRef, mpcMaterialActivationRefsEqual, parseMpcSigningWorkerRef } from "../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u, sha256DigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
-import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseEcdsaLifecycleId } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
-import { parseLaneProtocolCommitReceiptV1, parseLaneServerActivationReceiptV1, parseRevokeSigningLaneV1 } from "../../../shared-ts/src/signing-lanes/rotationParsers.js";
-import { encodeLaneProtocolCommitReceiptV1 } from "../../../shared-ts/src/signing-lanes/rotationDigests.js";
-import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
-import { buildEcdsaServerRetirementRequestV1, parseAndVerifyEcdsaServerRetirementEffectV1 } from "../../../core/signingLanes/ecdsaServerRetirement.js";
-import { buildEd25519ServerRetirementRequestV1, parseAndVerifyEd25519ServerRetirementEffectV1 } from "../../../core/signingLanes/ed25519ServerRetirement.js";
-//#region src/router/cloudflare/signingLanes/cloudflareLaneCurveExecution.ts
-const CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_EXECUTE_PATH_V1 = "/router-ab/internal/signing-worker/ecdsa-additive-lane/execute";
-const CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_ACTIVATE_PATH_V1 = "/router-ab/internal/signing-worker/ecdsa-additive-lane/activate";
-const CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_LANE_ACTIVATE_PATH_V1 = "/router-ab/internal/signing-worker/ed25519-yao-lane/activate";
-const CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_RETIRE_PATH_V1 = "/router-ab/internal/signing-worker/ecdsa-additive-lane/retire";
-const CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_LANE_RETIRE_PATH_V1 = "/router-ab/internal/signing-worker/ed25519-yao-lane/retire";
-var LaneLifecycleStoreEd25519LanePrivateBindingResolverV1 = class {
-	constructor(lifecycleStore) {
-		this.lifecycleStore = lifecycleStore;
-	}
-	async resolveRetirementBindingV1(input) {
-		const product = await this.lifecycleStore.getProductEpoch({
-			walletId: input.command.walletId,
-			walletKeyId: input.command.walletKeyId,
-			laneId: input.command.laneId,
-			laneShareEpoch: input.command.laneShareEpoch
-		});
-		if (product === null || product.keyFamily !== "ed25519" || product.state !== "active" && product.state !== "revocation_pending" && product.state !== "revoked" || !retirementProductMatchesCommandV1(product, input.command)) throw new Error("Ed25519 retirement source product is not the exact active epoch");
-		const protocol = await this.lifecycleStore.getProtocol(product.operationId);
-		if (protocol === null || protocol.value.lifecycle.state !== "active" || protocol.value.job.keyFamily !== "ed25519") throw new Error("Ed25519 retirement protocol is not active");
-		return { identity: ed25519IdentityFromActiveProductV1(product, protocol.value.lifecycle) };
-	}
-};
-var LaneLifecycleStoreEcdsaLanePrivateBindingResolverV1 = class {
-	constructor(lifecycleStore, walletRegistration) {
-		this.lifecycleStore = lifecycleStore;
-		this.walletRegistration = walletRegistration;
-	}
-	async resolveSourceMaterialV1(input) {
-		const product = await this.lifecycleStore.getProductEpoch({
-			walletId: input.job.walletId,
-			walletKeyId: input.job.walletKeyId,
-			laneId: input.job.source.laneId,
-			laneShareEpoch: input.job.source.laneShareEpoch
-		});
-		if (input.job.source.sourceKind === "owner_registration") {
-			if (product !== null) throw new Error("ECDSA registration-backed source conflicts with a lane product epoch");
-			const signer = await resolveOwnerEcdsaSourceSignerV1({
-				walletRegistration: this.walletRegistration,
-				job: input.job
-			});
-			return {
-				kind: "registration_activation",
-				lookup: {
-					accountId: input.job.walletId,
-					materialActivationId: input.job.source.materialActivation.activationId,
-					signingWorkerId: String(input.job.source.ownerParticipantContinuity.signingWorkerId)
-				},
-				sourceDerivation: {
-					applicationBindingDigestB64u: signer.walletKey.publicCapability.context.application_binding_digest_b64u,
-					clientShareRetryCounter: signer.walletKey.publicCapability.public_identity.client_share_retry_counter
-				}
-			};
-		}
-		if (product === null) throw new Error("ECDSA lane-backed source product epoch is missing");
-		if (product.state !== "active" || product.keyFamily !== "ecdsa_secp256k1" || product.holderParticipant.participantId !== input.job.source.holderParticipantId || product.signingWorkerParticipant.participantId !== input.job.source.signingWorkerParticipantId || product.signingWorkerParticipant.recipientKeyId !== input.job.source.signingWorkerRecipientKeyId || !mpcMaterialActivationRefsEqual(product.materialActivation, input.job.source.materialActivation)) throw new Error("ECDSA source product epoch does not match the admitted job");
-		const protocol = await this.lifecycleStore.getProtocol(product.operationId);
-		if (protocol === null || protocol.value.lifecycle.state !== "active") throw new Error("ECDSA source product protocol is not active");
-		const identity = identityFromActiveProductV1(product, protocol.value.lifecycle);
-		return {
-			kind: "lane_material",
-			lookup: {
-				identity,
-				admittedLaneIdentityDigestB64u: await digestSigningWorkerLaneIdentityV1(identity)
-			}
-		};
-	}
-	async resolveActivationBindingV1(input) {
-		const receipt = parseLaneProtocolCommitReceiptV1(input.protocolCommitReceipt);
-		return {
-			identity: await identityFromProtocolReceiptV1(input.job, receipt),
-			targetMaterialActivation: buildMpcMaterialActivationRef({
-				activationId: input.job.targetMaterialActivationId,
-				capability: input.job.source.materialActivation.capability,
-				materialOwner: input.job.source.materialActivation.materialOwner,
-				keyBinding: input.job.source.materialActivation.keyBinding,
-				lifecycleBinding: input.job.source.materialActivation.lifecycleBinding,
-				signingWorker: targetSigningWorkerRefV1(input.job)
-			})
-		};
-	}
-	async resolveRetirementBindingV1(input) {
-		const product = await this.lifecycleStore.getProductEpoch({
-			walletId: input.command.walletId,
-			walletKeyId: input.command.walletKeyId,
-			laneId: input.command.laneId,
-			laneShareEpoch: input.command.laneShareEpoch
-		});
-		if (product === null || product.keyFamily !== "ecdsa_secp256k1" || product.state !== "active" && product.state !== "revocation_pending" && product.state !== "revoked" || !retirementProductMatchesCommandV1(product, input.command)) throw new Error("ECDSA retirement source product is not the exact active epoch");
-		const protocol = await this.lifecycleStore.getProtocol(product.operationId);
-		if (protocol === null || protocol.value.lifecycle.state !== "active" || protocol.value.job.keyFamily !== "ecdsa_secp256k1") throw new Error("ECDSA retirement protocol is not active");
-		const job = protocol.value.job;
-		return {
-			identity: identityFromActiveProductV1(product, protocol.value.lifecycle),
-			manifest: {
-				manifestId: job.targetCapability.manifestId,
-				manifestRevision: job.targetCapability.manifestRevision
-			},
-			materialActivation: product.materialActivation,
-			serverGeneration: job.sourceCapability.serverGeneration,
-			lifecycleId: parseEcdsaLifecycleId(product.materialActivation.lifecycleBinding)
-		};
-	}
-};
-function targetSigningWorkerRefV1(job) {
-	const parsed = parseMpcSigningWorkerRef(job.targetSigningWorker.participantId);
-	if (!parsed.ok) throw new Error(`ECDSA target SigningWorker is invalid: ${parsed.error.message}`);
-	return parsed.value;
-}
-async function resolveOwnerEcdsaSourceSignerV1(input) {
-	const signers = await input.walletRegistration.listWalletEcdsaCustodyContinuity({ walletId: input.job.walletId });
-	const expectedMaterialActivation = routerAbMpcMaterialActivationRefToWire(input.job.source.materialActivation);
-	const matching = matchingOwnerEcdsaSourceSignersV1({
-		signers,
-		job: input.job,
-		expectedMaterialActivation
-	});
-	const first = matching[0];
-	if (!first) throw new Error("authoritative ECDSA registration source signer is unavailable");
-	const firstContext = first.walletKey.publicCapability.context.application_binding_digest_b64u;
-	const firstClientRetry = first.walletKey.publicCapability.public_identity.client_share_retry_counter;
-	for (const signer of matching.slice(1)) if (signer.walletKey.publicCapability.context.application_binding_digest_b64u !== firstContext || signer.walletKey.publicCapability.public_identity.client_share_retry_counter !== firstClientRetry) throw new Error("authoritative ECDSA registration source signer records conflict");
-	return first;
-}
-function matchingOwnerEcdsaSourceSignersV1(input) {
-	const matching = [];
-	for (const signer of input.signers) {
-		if (signer.walletId !== input.job.walletId || signer.walletKey.ecdsaThresholdKeyId !== String(input.job.sourceCapability.ecdsaThresholdKeyId) || signer.walletKey.relayerKeyId !== String(input.job.sourceCapability.relayerKeyId) || signer.walletKey.derivationClientSharePublicKey33B64u !== input.job.sourceHolderVerifyingShare33B64u || signer.walletKey.relayerVerifyingShareB64u !== input.job.sourceServerVerifyingShare33B64u || !sameRouterAbMpcMaterialActivationRef(signer.walletKey.publicCapability.material_activation, input.expectedMaterialActivation)) continue;
-		matching.push(signer);
-	}
-	return matching;
-}
-var CloudflareSigningWorkerEcdsaRetirementTransportV1 = class {
-	constructor(options) {
-		this.options = options;
-		this.internalServiceAuth = requiredText(options.internalServiceAuth, "internalServiceAuth");
-	}
-	async retireServerMaterialV1(input) {
-		if (input.curve === "ed25519_yao") {
-			const binding = await this.options.ed25519BindingResolver.resolveRetirementBindingV1({ command: input.command });
-			const request = buildEd25519ServerRetirementRequestV1({
-				command: input.command,
-				binding
-			});
-			const effect = await parseAndVerifyEd25519ServerRetirementEffectV1({
-				raw: await postSigningWorkerJsonV1({
-					binding: this.options.signingWorker,
-					internalServiceAuth: this.internalServiceAuth,
-					path: CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_LANE_RETIRE_PATH_V1,
-					body: request
-				}),
-				request
-			});
-			return {
-				kind: "signing_worker_lane_retirement_projection_v1",
-				outcome: effect.outcome,
-				command: input.command,
-				retirementEffectBindingDigestB64u: effect.retirementEffectBindingDigestB64u,
-				retirementReceipt: effect.receipt
-			};
-		}
-		const binding = await this.options.bindingResolver.resolveRetirementBindingV1({ command: input.command });
-		const request = buildEcdsaServerRetirementRequestV1({
-			command: input.command,
-			binding
-		});
-		const effect = await parseAndVerifyEcdsaServerRetirementEffectV1({
-			raw: await postSigningWorkerJsonV1({
-				binding: this.options.signingWorker,
-				internalServiceAuth: this.internalServiceAuth,
-				path: CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_RETIRE_PATH_V1,
-				body: request
-			}),
-			expectation: {
-				manifest: binding.manifest,
-				materialActivation: binding.materialActivation,
-				walletKeyId: input.command.walletKeyId,
-				laneId: input.command.laneId,
-				laneShareEpoch: input.command.laneShareEpoch,
-				revocationEpoch: input.command.expectedRevocationEpoch,
-				retirementReason: request.retirementReason,
-				retirementCorrelationId: request.retirementCorrelationId,
-				retirementRequestDigestB64u: request.retirementRequestDigestB64u,
-				serverGeneration: binding.serverGeneration,
-				lifecycleId: binding.lifecycleId,
-				retirementEffectBindingDigestB64u: request.retirementEffectBindingDigestB64u
-			}
-		});
-		return {
-			kind: "signing_worker_lane_retirement_projection_v1",
-			outcome: effect.outcome,
-			command: input.command,
-			retirementEffectBindingDigestB64u: effect.retirementEffectBindingDigestB64u,
-			retirementReceipt: effect.receipt
-		};
-	}
-};
-var CloudflareSigningWorkerEcdsaLaneTransportV1 = class {
-	constructor(options) {
-		this.options = options;
-		this.internalServiceAuth = requiredText(options.internalServiceAuth, "internalServiceAuth");
-	}
-	async commitEcdsaProtocolV1(input) {
-		const sourceMaterial = await this.options.bindingResolver.resolveSourceMaterialV1({ job: input.job });
-		const holderPackage = parseJsonRecord(input.holderPackage.ecdsaEncryptedMaterialEnvelopeJson, "holderPackage.ecdsaEncryptedMaterialEnvelopeJson");
-		const encryptedDelta = parseJsonRecord(input.encryptedDeltaPackageJson, "encryptedDeltaPackageJson");
-		const effect = exactRecord(await postSigningWorkerJsonV1({
-			binding: this.options.signingWorker,
-			internalServiceAuth: this.internalServiceAuth,
-			path: CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_EXECUTE_PATH_V1,
-			body: {
-				job: input.job,
-				holderRound: input.holderRound,
-				holderPackage,
-				encryptedDelta,
-				sourceMaterial: sourceMaterialWireV1(sourceMaterial)
-			}
-		}), ["outcome", "receipt"], "ecdsaLaneExecuteEffect");
-		return {
-			kind: "signing_worker_lane_protocol_commit_projection_v1",
-			outcome: parseMutationOutcome(Reflect.get(effect, "outcome"), "ecdsaLaneExecuteEffect.outcome"),
-			receipt: parseLaneProtocolCommitReceiptV1(Reflect.get(effect, "receipt"))
-		};
-	}
-	async activateServerMaterialV1(input) {
-		const binding = input.curve === "ecdsa_additive" ? await this.options.bindingResolver.resolveActivationBindingV1({
-			job: input.job,
-			protocolCommitReceipt: input.protocolCommitReceipt
-		}) : await buildEd25519ActivationBindingV1({
-			job: input.job,
-			protocolCommitReceipt: input.protocolCommitReceipt
-		});
-		const effect = exactRecord(await postSigningWorkerJsonV1({
-			binding: this.options.signingWorker,
-			internalServiceAuth: this.internalServiceAuth,
-			path: input.curve === "ecdsa_additive" ? CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_ACTIVATE_PATH_V1 : CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_LANE_ACTIVATE_PATH_V1,
-			body: {
-				identity: binding.identity,
-				targetMaterialActivation: binding.targetMaterialActivation,
-				holderDeliveryReceipt: input.holderDeliveryReceipt
-			}
-		}), ["outcome", "receipt"], input.curve === "ecdsa_additive" ? "ecdsaLaneActivateEffect" : "ed25519LaneActivateEffect");
-		return {
-			kind: "signing_worker_lane_server_activation_projection_v1",
-			outcome: parseMutationOutcome(Reflect.get(effect, "outcome"), input.curve === "ecdsa_additive" ? "ecdsaLaneActivateEffect.outcome" : "ed25519LaneActivateEffect.outcome"),
-			receipt: parseLaneServerActivationReceiptV1(Reflect.get(effect, "receipt"))
-		};
-	}
-	async retireServerMaterialV1(input) {
-		return await this.options.retirementTransport.retireServerMaterialV1(input);
-	}
-};
-function sourceMaterialWireV1(source) {
-	switch (source.kind) {
-		case "lane_material": return source;
-		case "registration_activation": return {
-			kind: source.kind,
-			lookup: {
-				account_id: source.lookup.accountId,
-				material_activation_id: source.lookup.materialActivationId,
-				signing_worker_id: source.lookup.signingWorkerId
-			},
-			sourceDerivation: {
-				application_binding_digest_b64u: source.sourceDerivation.applicationBindingDigestB64u,
-				client_share_retry_counter: source.sourceDerivation.clientShareRetryCounter
-			}
-		};
-	}
-}
-function createCloudflareLaneCurveExecutionPortsV1(options) {
-	return {
-		ed25519: {
-			async executeProtocolCommitV1(input) {
-				return parseLaneProtocolCommitReceiptV1((await options.ed25519Transport.executeProtocolCommitV1(input)).receipt);
-			},
-			async executeServerActivationV1(input) {
-				const projection = await options.signingWorker.activateServerMaterialV1({
-					curve: "ed25519_yao",
-					...input
-				});
-				requireProjection(projection, "signing_worker_lane_server_activation_projection_v1");
-				return parseLaneServerActivationReceiptV1(projection.receipt);
-			},
-			async executeServerRetirementV1(input) {
-				return retirementExecution(await options.signingWorker.retireServerMaterialV1({
-					curve: "ed25519_yao",
-					command: input.command
-				}));
-			}
-		},
-		ecdsa: {
-			async executeProtocolCommitV1(input) {
-				const projection = await options.signingWorker.commitEcdsaProtocolV1(input);
-				requireProjection(projection, "signing_worker_lane_protocol_commit_projection_v1");
-				return parseLaneProtocolCommitReceiptV1(projection.receipt);
-			},
-			async executeServerActivationV1(input) {
-				const projection = await options.signingWorker.activateServerMaterialV1({
-					curve: "ecdsa_additive",
-					...input
-				});
-				requireProjection(projection, "signing_worker_lane_server_activation_projection_v1");
-				return parseLaneServerActivationReceiptV1(projection.receipt);
-			},
-			async executeServerRetirementV1(input) {
-				return retirementExecution(await options.signingWorker.retireServerMaterialV1({
-					curve: "ecdsa_additive",
-					command: input.command
-				}));
-			}
-		}
-	};
-}
-function retirementExecution(projection) {
-	requireProjection(projection, "signing_worker_lane_retirement_projection_v1");
-	const command = parseRevokeSigningLaneV1(projection.command);
-	if (typeof projection.retirementEffectBindingDigestB64u !== "string" || projection.retirementEffectBindingDigestB64u.length === 0) throw new Error("SigningWorker lane retirement effect binding digest is invalid");
-	return {
-		kind: "lane_lifecycle_retirement_execution_v1",
-		command,
-		retirementEffectBindingDigestB64u: parseDigestB64u(projection.retirementEffectBindingDigestB64u),
-		retirementReceipt: projection.retirementReceipt
-	};
-}
-function requireProjection(projection, expectedKind) {
-	if (projection.kind !== expectedKind) throw new Error("SigningWorker lane material projection kind is invalid");
-	if (projection.outcome !== "applied" && projection.outcome !== "replayed") throw new Error("SigningWorker lane material projection outcome is invalid");
-}
-function requiredText(value, label) {
-	const normalized = value.trim();
-	if (normalized.length === 0) throw new Error(`${label} is required`);
-	return normalized;
-}
-function requiredTextValue(value, label) {
-	if (typeof value !== "string") throw new Error(`${label} must be a string`);
-	return requiredText(value, label);
-}
-/**
-* Resolves one exact active child product before a normal-signing request is
-* forwarded to SigningWorker. The resolver deliberately requires immutable
-* lane coordinates and the full activation reference; activation IDs alone
-* cannot select a private lane artifact.
-*/
-var LaneLifecycleStoreNormalSigningLaneMaterialResolverV1 = class {
-	constructor(lifecycleStore) {
-		this.lifecycleStore = lifecycleStore;
-	}
-	async resolveV1(input) {
-		const product = await this.lifecycleStore.getProductEpoch(input.lookup);
-		if (product === null || product.state !== "active" || product.keyFamily !== input.keyFamily || !mpcMaterialActivationRefsEqual(product.materialActivation, input.materialActivation) || product.targetMaterialActivationId !== input.materialActivation.activationId) throw new Error("normal-signing lane product is not the exact active child");
-		const enrollment = await this.lifecycleStore.getEnrollment(product.enrollmentId);
-		if (enrollment === null || enrollment.value.lifecycle.state !== "active" || enrollment.value.lifecycle.manifestDigestB64u !== product.aggregateManifestDigestB64u) throw new Error("normal-signing lane enrollment is not active for the child product");
-		const protocol = await this.lifecycleStore.getProtocol(product.operationId);
-		if (protocol === null || protocol.value.lifecycle.state !== "active" || protocol.value.job.keyFamily !== product.keyFamily) throw new Error("normal-signing lane protocol is not active for the child product");
-		assertActiveLaneProtocolMatchesProductV1(product, protocol.value.job);
-		const identity = signingWorkerIdentityFromActiveProductV1(product, protocol.value.lifecycle);
-		return {
-			product,
-			source: {
-				kind: "rotatable_lane",
-				lookup: {
-					identity,
-					admittedLaneIdentityDigestB64u: await digestSigningWorkerLaneIdentityV1(identity)
-				},
-				group_public_key: groupPublicKeyFromLaneJobV1(protocol.value.job)
-			}
-		};
-	}
-};
-function assertActiveLaneProtocolMatchesProductV1(product, job) {
-	if (job.operationId !== product.operationId || job.enrollmentId !== product.enrollmentId || job.walletId !== product.walletId || job.walletKeyId !== product.walletKeyId || job.target.laneId !== product.laneId || job.target.laneShareEpoch !== product.laneShareEpoch || job.targetMaterialActivationId !== product.targetMaterialActivationId || job.target.laneKind !== product.laneKind || job.keyFamily !== product.keyFamily || job.targetHolder.participantId !== product.holderParticipant.participantId || job.targetHolder.participantBindingDigestB64u !== product.holderParticipant.participantBindingDigestB64u || job.targetHolder.hpkePublicKeyDigestB64u !== product.holderParticipant.hpkePublicKeyDigestB64u || job.targetSigningWorker.participantId !== product.signingWorkerParticipant.participantId || job.targetSigningWorker.participantBindingDigestB64u !== product.signingWorkerParticipant.participantBindingDigestB64u || job.targetSigningWorker.recipientKeyId !== product.signingWorkerParticipant.recipientKeyId || job.targetSigningWorker.hpkePublicKeyDigestB64u !== product.signingWorkerParticipant.hpkePublicKeyDigestB64u) throw new Error("normal-signing lane protocol does not match the active child product");
-}
-function signingWorkerIdentityFromActiveProductV1(product, lifecycle) {
-	return product.keyFamily === "ed25519" ? ed25519IdentityFromActiveProductV1(product, lifecycle) : identityFromActiveProductV1(product, lifecycle);
-}
-function groupPublicKeyFromLaneJobV1(job) {
-	if (job.keyFamily === "ecdsa_secp256k1") return requiredText(job.thresholdPublicKey33B64u, "ECDSA lane threshold public key");
-	const registeredPublicKey = base64UrlDecode(job.registeredPublicKeyB64u);
-	if (registeredPublicKey.length !== 32) throw new Error("Ed25519 lane registered public key must be 32 bytes");
-	return `ed25519:${base58Encode(registeredPublicKey)}`;
-}
-function identityFromActiveProductV1(product, lifecycle) {
-	if (product.keyFamily !== "ecdsa_secp256k1") throw new Error("ECDSA source product has the wrong key family");
-	return {
-		operationId: product.operationId,
-		enrollmentId: product.enrollmentId,
-		walletId: product.walletId,
-		walletKeyId: product.walletKeyId,
-		targetLaneId: product.laneId,
-		targetLaneShareEpoch: product.laneShareEpoch,
-		targetMaterialActivationId: product.targetMaterialActivationId,
-		keyFamily: "ecdsa_secp256k1",
-		holderParticipantBindingDigestB64u: product.holderParticipant.participantBindingDigestB64u,
-		signingWorkerParticipantBindingDigestB64u: product.signingWorkerParticipant.participantBindingDigestB64u,
-		holderRecipientKeyDigestB64u: product.holderParticipant.hpkePublicKeyDigestB64u,
-		serverRecipientKeyDigestB64u: product.signingWorkerParticipant.hpkePublicKeyDigestB64u,
-		transcriptHashB64u: parseDigestB64u(lifecycle.transcriptHashB64u),
-		protocolCommitReceiptDigestB64u: parseDigestB64u(lifecycle.protocolCommitReceiptDigestB64u)
-	};
-}
-function ed25519IdentityFromActiveProductV1(product, lifecycle) {
-	if (product.keyFamily !== "ed25519") throw new Error("Ed25519 source product has the wrong key family");
-	return {
-		operationId: product.operationId,
-		enrollmentId: product.enrollmentId,
-		walletId: product.walletId,
-		walletKeyId: product.walletKeyId,
-		targetLaneId: product.laneId,
-		targetLaneShareEpoch: product.laneShareEpoch,
-		targetMaterialActivationId: product.targetMaterialActivationId,
-		keyFamily: "ed25519",
-		holderParticipantBindingDigestB64u: product.holderParticipant.participantBindingDigestB64u,
-		signingWorkerParticipantBindingDigestB64u: product.signingWorkerParticipant.participantBindingDigestB64u,
-		holderRecipientKeyDigestB64u: product.holderParticipant.hpkePublicKeyDigestB64u,
-		serverRecipientKeyDigestB64u: product.signingWorkerParticipant.hpkePublicKeyDigestB64u,
-		transcriptHashB64u: parseDigestB64u(lifecycle.transcriptHashB64u),
-		protocolCommitReceiptDigestB64u: parseDigestB64u(lifecycle.protocolCommitReceiptDigestB64u)
-	};
-}
-function retirementProductMatchesCommandV1(product, command) {
-	if (product.state === "active") return product.revocationEpoch === command.expectedRevocationEpoch;
-	return product.revocationEpoch === command.expectedRevocationEpoch + 1 && product.retirementEffectBindingDigestB64u === command.retirementEffectBindingDigestB64u;
-}
-async function identityFromProtocolReceiptV1(job, receipt) {
-	if (receipt.operationId !== job.operationId || receipt.enrollmentId !== job.enrollmentId || receipt.walletId !== job.walletId || receipt.walletKeyId !== job.walletKeyId || receipt.targetLaneId !== job.target.laneId || receipt.targetLaneShareEpoch !== job.target.laneShareEpoch || receipt.targetMaterialActivationId !== job.targetMaterialActivationId || receipt.keyFamily !== "ecdsa_secp256k1") throw new Error("ECDSA protocol receipt does not match the admitted job");
-	return {
-		operationId: job.operationId,
-		enrollmentId: job.enrollmentId,
-		walletId: job.walletId,
-		walletKeyId: job.walletKeyId,
-		targetLaneId: job.target.laneId,
-		targetLaneShareEpoch: job.target.laneShareEpoch,
-		targetMaterialActivationId: job.targetMaterialActivationId,
-		keyFamily: "ecdsa_secp256k1",
-		holderParticipantBindingDigestB64u: job.targetHolder.participantBindingDigestB64u,
-		signingWorkerParticipantBindingDigestB64u: job.targetSigningWorker.participantBindingDigestB64u,
-		holderRecipientKeyDigestB64u: job.targetHolder.hpkePublicKeyDigestB64u,
-		serverRecipientKeyDigestB64u: job.targetSigningWorker.hpkePublicKeyDigestB64u,
-		transcriptHashB64u: parseDigestB64u(receipt.transcriptHashB64u),
-		protocolCommitReceiptDigestB64u: await sha256DigestB64u(encodeLaneProtocolCommitReceiptV1(receipt))
-	};
-}
-async function buildEd25519ActivationBindingV1(input) {
-	const receipt = parseLaneProtocolCommitReceiptV1(input.protocolCommitReceipt);
-	if (receipt.operationId !== input.job.operationId || receipt.enrollmentId !== input.job.enrollmentId || receipt.walletId !== input.job.walletId || receipt.walletKeyId !== input.job.walletKeyId || receipt.targetLaneId !== input.job.target.laneId || receipt.targetLaneShareEpoch !== input.job.target.laneShareEpoch || receipt.targetMaterialActivationId !== input.job.targetMaterialActivationId || receipt.keyFamily !== "ed25519") throw new Error("Ed25519 protocol receipt does not match the admitted job");
-	const targetSigningWorker = parseMpcSigningWorkerRef(input.job.targetSigningWorker.participantId);
-	if (!targetSigningWorker.ok) throw new Error(`Ed25519 target SigningWorker is invalid: ${targetSigningWorker.error.message}`);
-	return {
-		identity: {
-			operationId: input.job.operationId,
-			enrollmentId: input.job.enrollmentId,
-			walletId: input.job.walletId,
-			walletKeyId: input.job.walletKeyId,
-			targetLaneId: input.job.target.laneId,
-			targetLaneShareEpoch: input.job.target.laneShareEpoch,
-			targetMaterialActivationId: input.job.targetMaterialActivationId,
-			keyFamily: "ed25519",
-			holderParticipantBindingDigestB64u: input.job.targetHolder.participantBindingDigestB64u,
-			signingWorkerParticipantBindingDigestB64u: input.job.targetSigningWorker.participantBindingDigestB64u,
-			holderRecipientKeyDigestB64u: input.job.targetHolder.hpkePublicKeyDigestB64u,
-			serverRecipientKeyDigestB64u: input.job.targetSigningWorker.hpkePublicKeyDigestB64u,
-			transcriptHashB64u: parseDigestB64u(receipt.transcriptHashB64u),
-			protocolCommitReceiptDigestB64u: await sha256DigestB64u(encodeLaneProtocolCommitReceiptV1(receipt))
-		},
-		targetMaterialActivation: buildMpcMaterialActivationRef({
-			activationId: input.job.targetMaterialActivationId,
-			capability: input.job.source.materialActivation.capability,
-			materialOwner: input.job.source.materialActivation.materialOwner,
-			keyBinding: input.job.source.materialActivation.keyBinding,
-			lifecycleBinding: input.job.source.materialActivation.lifecycleBinding,
-			signingWorker: targetSigningWorker.value
-		})
-	};
-}
-async function digestSigningWorkerLaneIdentityV1(identity) {
-	const encoder = new TextEncoder();
-	const chunks = [encoder.encode("seams/signing-worker/lane-material-identity/v1")];
-	for (const value of [
-		identity.operationId,
-		identity.enrollmentId,
-		identity.walletId,
-		identity.walletKeyId,
-		identity.targetLaneId,
-		identity.targetLaneShareEpoch,
-		identity.targetMaterialActivationId,
-		identity.keyFamily,
-		identity.holderParticipantBindingDigestB64u,
-		identity.signingWorkerParticipantBindingDigestB64u,
-		identity.holderRecipientKeyDigestB64u,
-		identity.serverRecipientKeyDigestB64u,
-		identity.transcriptHashB64u,
-		identity.protocolCommitReceiptDigestB64u
-	]) {
-		const encoded = encoder.encode(value);
-		chunks.push(u64Length(encoded.length), encoded);
-	}
-	let length = 0;
-	for (const chunk of chunks) length += chunk.length;
-	const bytes = new Uint8Array(length);
-	let offset = 0;
-	for (const chunk of chunks) {
-		bytes.set(chunk, offset);
-		offset += chunk.length;
-	}
-	return sha256DigestB64u(bytes);
-}
-function u64Length(value) {
-	let remaining = BigInt(value);
-	const bytes = new Uint8Array(8);
-	for (let index = 7; index >= 0; index -= 1) {
-		bytes[index] = Number(remaining & 255n);
-		remaining >>= 8n;
-	}
-	return bytes;
-}
-function parseJsonRecord(value, label) {
-	let parsed;
-	try {
-		parsed = JSON.parse(requiredText(value, label));
-	} catch {
-		throw new Error(`${label} must contain valid JSON`);
-	}
-	const record = exactObject(parsed, [
-		"kind",
-		"recipientPublicKeyB64u",
-		"aadDigestB64u",
-		"encappedKeyB64u",
-		"ciphertextB64u"
-	], label);
-	if (Reflect.get(record, "kind") !== "ecdsa_additive_lane_encrypted_payload_v1") throw new Error(`${label}.kind is invalid`);
-	return {
-		kind: "ecdsa_additive_lane_encrypted_payload_v1",
-		recipientPublicKeyB64u: requiredTextValue(Reflect.get(record, "recipientPublicKeyB64u"), `${label}.recipientPublicKeyB64u`),
-		aadDigestB64u: requiredTextValue(Reflect.get(record, "aadDigestB64u"), `${label}.aadDigestB64u`),
-		encappedKeyB64u: requiredTextValue(Reflect.get(record, "encappedKeyB64u"), `${label}.encappedKeyB64u`),
-		ciphertextB64u: requiredTextValue(Reflect.get(record, "ciphertextB64u"), `${label}.ciphertextB64u`)
-	};
-}
-function requireObject(value, label) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-function exactObject(value, fields, label) {
-	const record = requireObject(value, label);
-	const allowed = new Set(fields);
-	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is unsupported`);
-	for (const field of fields) if (!Object.hasOwn(record, field)) throw new Error(`${label}.${field} is required`);
-	return record;
-}
-function exactRecord(value, fields, label) {
-	return exactObject(value, fields, label);
-}
-function parseMutationOutcome(value, label) {
-	if (value === "applied" || value === "replayed") return value;
-	throw new Error(`${label} is invalid`);
-}
-async function postSigningWorkerJsonV1(input) {
-	const response = await input.binding.fetch(new Request(`https://signing-worker.router-ab.internal${input.path}`, {
-		method: "POST",
-		headers: {
-			"content-type": "application/json",
-			[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: input.internalServiceAuth
-		},
-		body: JSON.stringify(input.body)
-	}));
-	const body = await response.text();
-	if (!response.ok) {
-		const detail = boundedSigningWorkerErrorBodyV1(body);
-		throw new Error(detail ? `SigningWorker lane endpoint returned HTTP ${response.status}: ${detail}` : `SigningWorker lane endpoint returned HTTP ${response.status}`);
-	}
-	try {
-		return body.length === 0 ? null : JSON.parse(body);
-	} catch {
-		throw new Error("SigningWorker lane endpoint returned invalid JSON");
-	}
-}
-const SIGNING_WORKER_ERROR_BODY_LIMIT_V1 = 512;
-function boundedSigningWorkerErrorBodyV1(body) {
-	const normalized = body.trim().replace(/\s+/g, " ");
-	if (normalized.length <= SIGNING_WORKER_ERROR_BODY_LIMIT_V1) return normalized;
-	return `${normalized.slice(0, SIGNING_WORKER_ERROR_BODY_LIMIT_V1 - 1)}…`;
-}
-//#endregion
-export { CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_ACTIVATE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_LANE_RETIRE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_LANE_ACTIVATE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_LANE_RETIRE_PATH_V1, CloudflareSigningWorkerEcdsaLaneTransportV1, CloudflareSigningWorkerEcdsaRetirementTransportV1, LaneLifecycleStoreEcdsaLanePrivateBindingResolverV1, LaneLifecycleStoreEd25519LanePrivateBindingResolverV1, LaneLifecycleStoreNormalSigningLaneMaterialResolverV1, createCloudflareLaneCurveExecutionPortsV1, digestSigningWorkerLaneIdentityV1 };
-
-//# sourceMappingURL=cloudflareLaneCurveExecution.js.map