@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/runtime/walletPlacementRoutes.js

@@ -0,0 +1,339 @@
+import { parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
+import { isPlainObject, requireCanonicalString } from "../../../shared-ts/src/utils/validation.js";
+import { sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_RELOCATION_OPERATION } from "../../../shared-ts/src/utils/emailOtpDomain.js";
+import { readWalletRelocationOwner } from "../d1/wallet/d1WalletRelocationOwner.js";
+import { D1WalletRelocationChallenges } from "../d1/wallet/d1WalletRelocationChallenges.js";
+import { walletRelocationEmailOtpBinding } from "../d1/wallet/d1WalletRelocationEmailOtp.js";
+import { D1WalletRelocationApprovals } from "../d1/wallet/d1WalletRelocationApprovals.js";
+import { WalletRelocationOwnerRequest } from "../d1/wallet/d1WalletRelocationOwnerRequest.js";
+import { WalletRelocationReadAccess } from "../d1/wallet/d1WalletRelocationReadAccess.js";
+//#region src/router/cloudflare/runtime/walletPlacementRoutes.ts
+const BASE_PATH = "/wallet/placement/v1";
+var WalletPlacementRoutes = class {
+	constructor(options) {
+		this.options = options;
+		this.kind = "fetch_route_extension";
+		this.id = "wallet_placement";
+		this.routes = [
+			{
+				id: "wallet_relocation_challenge",
+				surface: "relay",
+				method: "POST",
+				path: `${BASE_PATH}/relocations/challenge`,
+				auth: {
+					plane: "public",
+					rationale: "The handler requires an authenticated full-owner Wallet Session."
+				},
+				metering: { kind: "none" },
+				summary: "Issue a fresh owner relocation challenge"
+			},
+			{
+				id: "wallet_relocation_post",
+				surface: "relay",
+				method: "POST",
+				path: `${BASE_PATH}/relocations`,
+				auth: {
+					plane: "public",
+					rationale: "The handler authenticates an owner or bounded move-read credential before exact replay."
+				},
+				metering: { kind: "none" },
+				summary: "Admit or replay an exact wallet relocation"
+			},
+			{
+				id: "wallet_placement_get",
+				surface: "relay",
+				method: "GET",
+				path: BASE_PATH,
+				auth: {
+					plane: "public",
+					rationale: "The handler authenticates the full-owner Wallet Session."
+				},
+				metering: { kind: "none" },
+				summary: "Read wallet placement"
+			},
+			{
+				id: "wallet_relocation_get",
+				surface: "relay",
+				method: "GET",
+				path: `${BASE_PATH}/relocations/:moveId`,
+				auth: {
+					plane: "public",
+					rationale: "The handler authenticates a full owner or bounded move-read credential."
+				},
+				metering: { kind: "none" },
+				summary: "Read wallet relocation progress"
+			}
+		];
+	}
+	async handleFetchRoute(input) {
+		return this.handle(input.request);
+	}
+	async handle(request) {
+		if (request.method === "POST" && new URL(request.url).pathname === `${BASE_PATH}/relocations/challenge`) return this.challenge(request);
+		if (request.method === "POST" && new URL(request.url).pathname === `${BASE_PATH}/relocations`) return this.relocate(request);
+		if (request.method !== "GET") return failure("method_not_allowed", 405);
+		const url = new URL(request.url);
+		const wallet = parseWalletId(url.searchParams.get("walletId"));
+		if (!wallet.ok || url.searchParams.getAll("walletId").length !== 1) return failure("invalid_input", 400);
+		let moveId;
+		if (url.pathname === BASE_PATH) moveId = null;
+		else {
+			const match = /^\/wallet\/placement\/v1\/relocations\/(wmove_[A-Za-z0-9_-]{43})$/u.exec(url.pathname);
+			if (!match) return failure("not_found", 404);
+			moveId = match[1];
+		}
+		const nowMs = Date.now();
+		if (!await WalletRelocationOwnerRequest.authenticate({
+			request,
+			walletId: wallet.value,
+			tenantId: this.options.tenantId,
+			scope: this.options.scope,
+			allowedOrigins: this.options.allowedOrigins,
+			authorizationSessions: this.options.authorizationSessions,
+			nowMs
+		})) {
+			if (!moveId) return failure("unauthorized", 401);
+			const approval = await new D1WalletRelocationApprovals(this.options.database, this.options.scope).find(wallet.value, moveId);
+			if (!approval) return failure("unauthorized", 401);
+			if (!await WalletRelocationReadAccess.authenticate({
+				request,
+				binding: approval.binding,
+				database: this.options.database,
+				scope: this.options.scope,
+				allowedOrigins: this.options.allowedOrigins,
+				nowMs
+			})) return failure("unauthorized", 401);
+		}
+		const walletKey = this.walletKey(wallet.value);
+		const path = moveId === null ? "placement-status" : "relocation-status";
+		const body = moveId === null ? { wallet: walletKey } : {
+			wallet: walletKey,
+			moveId
+		};
+		return this.dispatch(path, body);
+	}
+	async challenge(request) {
+		const intent = parseRelocationIntent(await request.json().catch(invalidBody), "challenge");
+		if (!intent || intent.kind !== "challenge") return failure("invalid_input", 400);
+		const nowMs = Date.now();
+		const owner = await WalletRelocationOwnerRequest.authenticate({
+			request,
+			walletId: intent.walletId,
+			tenantId: this.options.tenantId,
+			scope: this.options.scope,
+			allowedOrigins: this.options.allowedOrigins,
+			authorizationSessions: this.options.authorizationSessions,
+			nowMs
+		});
+		if (!owner) return failure("unauthorized", 401);
+		const resolved = await this.dispatch("relocation-request", {
+			wallet: this.walletKey(intent.walletId),
+			moveId: intent.moveId,
+			destinationRegion: intent.destinationRegion,
+			expectedGeneration: intent.expectedGeneration,
+			authorityId: owner.authorityId
+		});
+		if (!resolved.ok) return resolved;
+		const body = await resolved.clone().json().catch(invalidBody);
+		if (!isPlainObject(body)) return failure("invalid_directory_response", 502);
+		if (body.kind === "unchanged") return resolved;
+		if (body.kind !== "resolved" || typeof body.requestDigest !== "string" || !/^[a-f0-9]{64}$/u.test(body.requestDigest) || body.sourceGeneration !== intent.expectedGeneration || body.destinationRegion !== intent.destinationRegion) return failure("invalid_directory_response", 502);
+		const binding = owner.bindMove({
+			moveId: intent.moveId,
+			requestDigestHex: body.requestDigest,
+			sourceGeneration: intent.expectedGeneration,
+			destinationRegion: intent.destinationRegion
+		});
+		const activeOwner = await readWalletRelocationOwner(this.options.database, this.options.scope, binding);
+		if (!activeOwner) return failure("unauthorized", 401);
+		const factorExpiresAtMs = activeOwner.method.kind === "email_otp" ? this.options.emailOtp.issuer.challengeExpiresAt(nowMs) : owner.credentialExpiresAtMs;
+		const challenge = await new D1WalletRelocationChallenges(this.options.database, this.options.scope).issue(binding, nowMs, factorExpiresAtMs);
+		if (challenge.state !== "issued" || challenge.expiresAtMs <= Date.now()) return failure("relocation_challenge_expired_or_consumed", 409);
+		let factor;
+		if (activeOwner.method.kind === "email_otp") {
+			const enrollment = await this.options.emailOtp.verifier.readEnrollmentForWallet(binding.walletId);
+			if (!enrollment || enrollment.orgId !== this.options.scope.orgId || await sha256HexUtf8(enrollment.verifiedEmail) !== activeOwner.method.emailHashHex) return failure("unauthorized", 401);
+			const issued = await this.options.emailOtp.issuer.create({
+				action: WALLET_EMAIL_OTP_ACTIONS.relocation,
+				operation: WALLET_EMAIL_OTP_RELOCATION_OPERATION,
+				userId: enrollment.providerUserId,
+				walletId: binding.walletId,
+				orgId: this.options.scope.orgId,
+				otpChannel: EMAIL_OTP_CHANNEL,
+				requestOrigin: binding.origin,
+				ownerProofBindingDigest: await walletRelocationEmailOtpBinding(this.options.scope, binding, challenge.challengeB64u),
+				expiresAtMs: challenge.expiresAtMs
+			});
+			if (!issued.ok) return Response.json(issued, {
+				status: 503,
+				headers: { "Cache-Control": "no-store" }
+			});
+			factor = {
+				kind: "email_otp",
+				challengeId: issued.challenge.challengeId,
+				delivery: issued.delivery
+			};
+		} else factor = { kind: "passkey" };
+		return Response.json({
+			kind: "challenge",
+			factor,
+			moveId: binding.moveId,
+			walletId: binding.walletId,
+			destinationRegion: binding.destinationRegion,
+			expectedGeneration: binding.sourceGeneration,
+			requestDigest: binding.requestDigestHex,
+			challengeB64u: challenge.challengeB64u,
+			expiresAtMs: challenge.expiresAtMs
+		}, { headers: { "Cache-Control": "no-store" } });
+	}
+	async relocate(request) {
+		const intent = parseRelocationIntent(await request.json().catch(invalidBody), "admission");
+		if (!intent || intent.kind !== "admission") return failure("invalid_input", 400);
+		const nowMs = Date.now();
+		const owner = await WalletRelocationOwnerRequest.authenticate({
+			request,
+			walletId: intent.walletId,
+			tenantId: this.options.tenantId,
+			scope: this.options.scope,
+			allowedOrigins: this.options.allowedOrigins,
+			authorizationSessions: this.options.authorizationSessions,
+			nowMs
+		});
+		const approvals = new D1WalletRelocationApprovals(this.options.database, this.options.scope);
+		let approval = await approvals.find(intent.walletId, intent.moveId);
+		if (!owner) {
+			if (!approval) return failure("unauthorized", 401);
+			if (!await WalletRelocationReadAccess.authenticate({
+				request,
+				binding: approval.binding,
+				database: this.options.database,
+				scope: this.options.scope,
+				allowedOrigins: this.options.allowedOrigins,
+				nowMs
+			})) return failure("unauthorized", 401);
+		}
+		if (!approval) {
+			if (!owner) return failure("unauthorized", 401);
+			if (intent.sourceProof === null) return failure("owner_approval_required", 409);
+			const challenge = await new D1WalletRelocationChallenges(this.options.database, this.options.scope).find(intent.walletId, intent.moveId);
+			if (!challenge) return failure("relocation_challenge_required", 409);
+			if (challenge.binding.destinationRegion !== intent.destinationRegion || challenge.binding.sourceGeneration !== intent.expectedGeneration) return failure("request_conflict", 409);
+			if (owner.bindMove(challenge.binding).encoded() !== challenge.binding.encoded()) return failure("unauthorized", 401);
+			const proof = parseSourceProof(intent.sourceProof);
+			if (!proof) return failure("invalid_source_proof", 400);
+			let result;
+			switch (proof.kind) {
+				case "passkey":
+					result = await approvals.approvePasskey({
+						owner,
+						binding: challenge.binding,
+						credential: proof.credential,
+						nowMs
+					});
+					break;
+				case "email_otp":
+					result = await approvals.approveEmailOtp({
+						owner,
+						binding: challenge.binding,
+						challengeId: proof.challengeId,
+						otpCode: proof.otpCode,
+						nowMs,
+						verifier: this.options.emailOtp.verifier,
+						emailOtpChallenges: this.options.emailOtp.emailOtpChallenges
+					});
+					break;
+				default: return assertNever(proof);
+			}
+			if (result.kind === "denied") return failure("source_proof_denied", 403);
+			approval = result.approval;
+		}
+		if (intent.destinationRegion !== approval.binding.destinationRegion || intent.expectedGeneration !== approval.binding.sourceGeneration) return failure("request_conflict", 409);
+		return this.dispatch("relocation-admit", {
+			wallet: this.walletKey(intent.walletId),
+			moveId: intent.moveId,
+			requestDigest: approval.binding.requestDigestHex,
+			destinationRegion: approval.binding.destinationRegion,
+			expectedGeneration: approval.binding.sourceGeneration,
+			authorityId: approval.binding.authorityId
+		});
+	}
+	walletKey(walletId) {
+		return {
+			namespace: this.options.scope.namespace,
+			organizationId: this.options.scope.orgId,
+			projectId: this.options.scope.projectId,
+			environmentId: this.options.scope.envId,
+			walletId
+		};
+	}
+	async dispatch(path, body) {
+		const response = await this.options.directory.fetch(new Request(`https://wallet-placement.internal/internal/wallet-placement/v1/${path}`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify(body)
+		}));
+		const headers = new Headers(response.headers);
+		headers.set("Cache-Control", "no-store");
+		return new Response(response.body, {
+			status: response.status,
+			headers
+		});
+	}
+};
+function failure(code, status) {
+	return Response.json({
+		ok: false,
+		code
+	}, {
+		status,
+		headers: { "Cache-Control": "no-store" }
+	});
+}
+function invalidBody() {
+	return null;
+}
+function parseRelocationIntent(raw, purpose) {
+	if (!isPlainObject(raw) || Object.keys(raw).length !== (purpose === "challenge" ? 4 : 5)) return null;
+	if (purpose === "admission" && !Object.hasOwn(raw, "sourceProof")) return null;
+	const wallet = parseWalletId(raw.walletId);
+	if (!wallet.ok || typeof raw.moveId !== "string" || !/^wmove_[A-Za-z0-9_-]{43}$/u.test(raw.moveId) || typeof raw.expectedGeneration !== "number" || !Number.isSafeInteger(raw.expectedGeneration) || raw.expectedGeneration <= 0 || raw.destinationRegion !== "US" && raw.destinationRegion !== "WEUR" && raw.destinationRegion !== "APAC" && raw.destinationRegion !== "OC") return null;
+	const intent = {
+		walletId: wallet.value,
+		moveId: raw.moveId,
+		destinationRegion: raw.destinationRegion,
+		expectedGeneration: raw.expectedGeneration
+	};
+	return purpose === "challenge" ? {
+		...intent,
+		kind: "challenge"
+	} : {
+		...intent,
+		kind: "admission",
+		sourceProof: raw.sourceProof
+	};
+}
+function parseSourceProof(raw) {
+	if (!isPlainObject(raw)) return null;
+	if (raw.kind === "passkey" && Object.keys(raw).length === 2 && Object.hasOwn(raw, "credential")) return {
+		kind: "passkey",
+		credential: raw.credential
+	};
+	if (raw.kind !== "email_otp" || Object.keys(raw).length !== 3) return null;
+	try {
+		return {
+			kind: "email_otp",
+			challengeId: requireCanonicalString(raw.challengeId, "OTP challenge"),
+			otpCode: requireCanonicalString(raw.otpCode, "OTP code")
+		};
+	} catch {
+		return null;
+	}
+}
+function assertNever(value) {
+	throw new Error(`Unexpected relocation proof: ${String(value)}`);
+}
+//#endregion
+export { WalletPlacementRoutes };
+
+//# sourceMappingURL=walletPlacementRoutes.js.map

package/dist/esm/router/cloudflare/runtime/walletRelocationDeriver.js

@@ -0,0 +1,244 @@
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { walletObjectIdentityHeaders, walletRelocationObjectIdentity } from "./walletObjectAddresses.js";
+import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
+//#region src/router/cloudflare/runtime/walletRelocationDeriver.ts
+function deriverRuntimeOperation(value) {
+	let role;
+	if (value.startsWith("deriver-a-")) role = "deriver-a";
+	else if (value.startsWith("deriver-b-")) role = "deriver-b";
+	else return null;
+	const operation = value.slice(role.length + 1);
+	switch (operation) {
+		case "fence":
+		case "capture":
+		case "export":
+		case "import":
+		case "status":
+		case "verify":
+		case "activate":
+		case "cleanup": return {
+			role,
+			operation
+		};
+		default: return null;
+	}
+}
+async function forwardDeriverRelocation(input, role, operation, binding, credential, directory) {
+	const fields = operation === "export" || operation === "import" ? 3 : 2;
+	if (!isPlainObject(input) || Object.keys(input).length !== fields || !isPlainObject(input.wallet) || !isPlainObject(input.attempt)) return failure("invalid_input", 400);
+	if (operation === "export" && !count(input.segmentIndex)) return failure("invalid_input", 400);
+	const envelope = {
+		wallet: input.wallet,
+		attempt: input.attempt
+	};
+	const journalRole = role === "deriver-a" ? "deriverA" : "deriverB";
+	try {
+		const contextResponse = await postRole(binding, role, "relocation-context", { kind: "cipher" }, credential, null);
+		if (!contextResponse.ok) return failure("source_command_unavailable", 503);
+		const context = await contextResponse.json();
+		if (!isPlainObject(context) || Object.keys(context).length !== 2 || context.kind !== "deriver_cipher_context" || !digest(context.digest_hex)) return failure("source_command_unavailable", 503);
+		const freezing = operation === "fence" || operation === "capture";
+		const request = operation === "export" ? {
+			operation,
+			segmentIndex: input.segmentIndex
+		} : { operation };
+		const authorization = await postDirectory(directory, freezing ? "relocation-deriver-source" : "relocation-deriver-transfer", freezing ? {
+			wallet: envelope.wallet,
+			attempt: envelope.attempt,
+			role: journalRole,
+			cipherContextDigest: context.digest_hex
+		} : {
+			wallet: envelope.wallet,
+			attempt: envelope.attempt,
+			role: journalRole,
+			request
+		});
+		if (!authorization.ok) return failure("source_command_denied", 409);
+		const result = await authorization.json();
+		if (!isPlainObject(result) || Object.keys(result).length !== 2 || result.ok !== true || !isPlainObject(result.command)) return failure("source_command_unavailable", 503);
+		const authorized = result.command;
+		let source;
+		let body;
+		if (freezing) {
+			source = parseSource(authorized, envelope, context.digest_hex);
+			if (!source) return failure("source_command_unavailable", 503);
+			body = operation === "fence" ? source : {
+				operation: "capture",
+				source
+			};
+		} else if (operation === "cleanup") {
+			const activation = parseActivation(authorized.activation, role, envelope, context.digest_hex);
+			if (!activation || Object.keys(authorized).length !== 2 || authorized.operation !== "cleanup") return failure("source_command_unavailable", 503);
+			return await postRole(binding, role, "snapshot", {
+				operation: "cleanup",
+				activation
+			}, credential, walletRelocationObjectIdentity(envelope.wallet, activation.source.source.source_generation));
+		} else if (operation === "export") {
+			source = parseSource(authorized.source, envelope, context.digest_hex);
+			if (!source || Object.keys(authorized).length !== 3 || authorized.operation !== "export" || authorized.segment_index !== input.segmentIndex) return failure("source_command_unavailable", 503);
+			body = {
+				operation: "export",
+				source,
+				segment_index: input.segmentIndex
+			};
+		} else {
+			const receipt = parseReceipt(authorized.receipt, role, envelope, context.digest_hex);
+			if (!receipt || Object.keys(authorized).length !== 2 || authorized.operation !== operation) return failure("source_command_unavailable", 503);
+			source = receipt.source;
+			if (operation === "activate") return await confirmActivation(await postRole(binding, role, "snapshot", {
+				operation: "activate",
+				receipt
+			}, credential, walletRelocationObjectIdentity(envelope.wallet, receipt.source.destination_generation)), receipt, role, envelope, context.digest_hex, directory);
+			if (operation === "import") {
+				const segment = parseSegment(input.segment, receipt);
+				if (!segment) return failure("invalid_input", 400);
+				body = {
+					operation: "import",
+					receipt,
+					segment
+				};
+			} else body = {
+				operation,
+				receipt
+			};
+		}
+		let response = await postRole(binding, role, operation === "fence" ? "fence-relocation" : "snapshot", body, credential, walletRelocationObjectIdentity(envelope.wallet, source.source_generation + (operation === "fence" || operation === "capture" || operation === "export" ? 0 : 1)));
+		if (operation !== "capture" || !response.ok) return response;
+		let captured = await response.clone().json();
+		for (let step = 1; step < 8 && isPlainObject(captured) && Object.keys(captured).length === 2 && captured.kind === "capturing" && count(captured.segment_count); step += 1) {
+			response = await postRole(binding, role, "snapshot", body, credential, walletRelocationObjectIdentity(envelope.wallet, source.source_generation));
+			if (!response.ok) return response;
+			captured = await response.clone().json();
+		}
+		if (isPlainObject(captured) && Object.keys(captured).length === 2 && captured.kind === "capturing" && count(captured.segment_count)) return response;
+		if (!isPlainObject(captured) || Object.keys(captured).length !== 2 || captured.kind !== "frozen") return failure("source_receipt_unavailable", 503);
+		const receipt = parseReceipt(captured.receipt, role, envelope, context.digest_hex);
+		if (!receipt || JSON.stringify(receipt.source) !== JSON.stringify(source)) return failure("source_receipt_unavailable", 503);
+		const stored = await postDirectory(directory, "relocation-deriver-receipt", {
+			wallet: envelope.wallet,
+			attempt: envelope.attempt,
+			role: journalRole,
+			receipt
+		});
+		if (!stored.ok) return failure("source_receipt_unavailable", 503);
+		const acknowledgement = await stored.json();
+		if (!isPlainObject(acknowledgement) || Object.keys(acknowledgement).length !== 2 || acknowledgement.ok !== true) return failure("source_receipt_unavailable", 503);
+		const confirmed = parseReceipt(acknowledgement.receipt, role, envelope, context.digest_hex);
+		if (!confirmed || JSON.stringify(confirmed) !== JSON.stringify(receipt)) return failure("source_receipt_unavailable", 503);
+		return response;
+	} catch {
+		return failure("source_command_unavailable", 503);
+	}
+}
+function parseSource(raw, envelope, contextDigest) {
+	if (!isPlainObject(raw) || Object.keys(raw).length !== 6 || !isPlainObject(raw.owner) || Object.keys(raw.owner).length !== 4 || typeof raw.owner.org_id !== "string" || raw.owner.org_id !== envelope.wallet.organizationId || typeof raw.owner.project_id !== "string" || raw.owner.project_id !== envelope.wallet.projectId || typeof raw.owner.env_id !== "string" || raw.owner.env_id !== envelope.wallet.environmentId || typeof raw.owner.wallet_id !== "string" || raw.owner.wallet_id !== envelope.wallet.walletId || typeof raw.move_id !== "string" || raw.move_id !== envelope.attempt.moveId || raw.cipher_context_digest_hex !== contextDigest || !digest(raw.request_digest_hex) || typeof raw.source_generation !== "number" || !Number.isSafeInteger(raw.source_generation) || raw.source_generation < 1 || raw.source_generation >= Number.MAX_SAFE_INTEGER || raw.destination_generation !== raw.source_generation + 1) return null;
+	return {
+		owner: {
+			org_id: raw.owner.org_id,
+			project_id: raw.owner.project_id,
+			env_id: raw.owner.env_id,
+			wallet_id: raw.owner.wallet_id
+		},
+		move_id: raw.move_id,
+		request_digest_hex: raw.request_digest_hex,
+		cipher_context_digest_hex: contextDigest,
+		source_generation: raw.source_generation,
+		destination_generation: raw.source_generation + 1
+	};
+}
+function parseReceipt(raw, role, envelope, contextDigest) {
+	if (!isPlainObject(raw) || Object.keys(raw).length !== 5 || typeof raw.source_object !== "string" || !raw.source_object.startsWith(`${role}-wallet-`) || !digest(raw.source_object.slice(`${role}-wallet-`.length)) || !count(raw.record_count) || !count(raw.segment_count) || raw.record_count > raw.segment_count || raw.record_count === 0 !== (raw.segment_count === 0) || !digest(raw.digest_hex)) return null;
+	const source = parseSource(raw.source, envelope, contextDigest);
+	if (!source) return null;
+	return {
+		source,
+		source_object: raw.source_object,
+		record_count: raw.record_count,
+		segment_count: raw.segment_count,
+		digest_hex: raw.digest_hex
+	};
+}
+function parseSegment(raw, receipt) {
+	if (!isPlainObject(raw) || Object.keys(raw).length !== 5 || !count(raw.segment_index) || !count(raw.record_index) || !count(raw.part_index) || !count(raw.part_count) || raw.part_count === 0 || raw.part_count > 512 || raw.segment_index >= receipt.segment_count || raw.record_index >= receipt.record_count || raw.part_index >= raw.part_count || typeof raw.data_b64u !== "string" || raw.data_b64u.length === 0 || raw.data_b64u.length > 5462 || !/^[A-Za-z0-9_-]+$/u.test(raw.data_b64u)) return null;
+	return {
+		segment_index: raw.segment_index,
+		record_index: raw.record_index,
+		part_index: raw.part_index,
+		part_count: raw.part_count,
+		data_b64u: raw.data_b64u
+	};
+}
+function digest(raw) {
+	return typeof raw === "string" && /^[a-f0-9]{64}$/u.test(raw);
+}
+function count(raw) {
+	return typeof raw === "number" && Number.isInteger(raw) && raw >= 0 && raw <= 4294967295;
+}
+function postDirectory(directory, endpoint, body) {
+	const version = directory.CF_VERSION_METADATA.id;
+	if (typeof version !== "string" || !version) throw new Error("Runtime version is unavailable");
+	return directory.WALLET_CONSOLE.fetch(new Request(`https://wallet-placement.internal/internal/wallet-placement/v1/${endpoint}`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			"x-seams-writer-role": "walletRuntime",
+			"x-seams-writer-version": version,
+			"x-seams-writer-account": directory.SEAMS_D1_HOME_ACCOUNT_ID,
+			"x-seams-writer-database": directory.SEAMS_D1_HOME_DATABASE_ID
+		},
+		body: JSON.stringify(body)
+	}));
+}
+function postRole(binding, role, operation, body, credential, identity) {
+	return binding.fetch(new Request(`https://${role}.router-ab.internal/router-ab/internal/${role}/wallet/${operation}`, {
+		method: "POST",
+		redirect: "manual",
+		headers: {
+			"content-type": "application/json",
+			[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: credential,
+			...identity === null ? {} : walletObjectIdentityHeaders(identity)
+		},
+		body: JSON.stringify(body)
+	}));
+}
+function failure(code, status) {
+	return Response.json({
+		ok: false,
+		code
+	}, {
+		status,
+		headers: { "Cache-Control": "no-store" }
+	});
+}
+function parseActivation(raw, role, envelope, contextDigest) {
+	if (!isPlainObject(raw) || Object.keys(raw).length !== 2) return null;
+	const source = parseReceipt(raw.source, role, envelope, contextDigest);
+	if (!source || raw.destination_object !== source.source_object) return null;
+	return {
+		source,
+		destination_object: source.source_object
+	};
+}
+async function confirmActivation(response, expected, role, envelope, contextDigest, directory) {
+	if (!response.ok) return response;
+	const raw = await response.clone().json();
+	if (!isPlainObject(raw) || Object.keys(raw).length !== 2 || raw.kind !== "activated") return failure("activation_receipt_unavailable", 503);
+	const receipt = parseActivation(raw.receipt, role, envelope, contextDigest);
+	if (!receipt || JSON.stringify(receipt.source) !== JSON.stringify(expected)) return failure("activation_receipt_unavailable", 503);
+	const stored = await postDirectory(directory, "relocation-deriver-activation", {
+		wallet: envelope.wallet,
+		attempt: envelope.attempt,
+		role: role === "deriver-a" ? "deriverA" : "deriverB",
+		receipt
+	});
+	if (!stored.ok) return failure("activation_receipt_unavailable", 503);
+	const result = await stored.json();
+	if (!isPlainObject(result) || Object.keys(result).length !== 2 || result.ok !== true) return failure("activation_receipt_unavailable", 503);
+	const confirmed = parseActivation(result.receipt, role, envelope, contextDigest);
+	if (!confirmed || JSON.stringify(confirmed) !== JSON.stringify(receipt)) return failure("activation_receipt_unavailable", 503);
+	return response;
+}
+//#endregion
+export { deriverRuntimeOperation, forwardDeriverRelocation };
+
+//# sourceMappingURL=walletRelocationDeriver.js.map