@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/runtime/walletRelocationEcdsa.js

@@ -0,0 +1,212 @@
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { walletObjectIdentityHeaders, walletRelocationObjectIdentity } from "./walletObjectAddresses.js";
+import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
+import { authorizeRuntimeSource } from "./walletRelocationSource.js";
+//#region src/router/cloudflare/runtime/walletRelocationEcdsa.ts
+const TRANSFER_BATCH_SEGMENTS = 8;
+function ecdsaRuntimeOperation(operation) {
+	switch (operation) {
+		case "ecdsa-freeze": return "freeze";
+		case "ecdsa-export": return "export";
+		case "ecdsa-import": return "import";
+		case "ecdsa-status": return "status";
+		case "ecdsa-verify": return "verify";
+		case "ecdsa-activate": return "activate";
+		case "ecdsa-cleanup": return "cleanup";
+		default: return null;
+	}
+}
+async function forwardEcdsaRelocation(input, operation, router, credential, directory) {
+	const fieldCount = operation === "export" || operation === "import" ? 3 : 2;
+	if (!isPlainObject(input) || Object.keys(input).length !== fieldCount || !isPlainObject(input.wallet) || !isPlainObject(input.attempt)) return failure("invalid_input", 400);
+	const envelope = {
+		wallet: input.wallet,
+		attempt: input.attempt
+	};
+	try {
+		if (operation === "freeze") {
+			const authorization = await authorizeRuntimeSource(input, "ecdsa-freeze", directory);
+			if (!authorization.ok) return failure(authorization.code, authorization.code === "source_command_denied" ? 409 : 503);
+			const source = JSON.parse(authorization.body);
+			if (!isPlainObject(source)) return failure("source_command_unavailable", 503);
+			let response = await postRole(router, "pool/freeze", source, credential, authorization.identity);
+			let raw = await response.clone().json();
+			for (let step = 1; step < TRANSFER_BATCH_SEGMENTS && response.ok && isPlainObject(raw) && Object.keys(raw).length === 1 && (raw.state === "invalidating" || raw.state === "sealing"); step += 1) {
+				response = await postRole(router, "pool/freeze", source, credential, authorization.identity);
+				raw = await response.clone().json();
+			}
+			if (!response.ok) return response;
+			if (isPlainObject(raw)) {
+				if (Object.keys(raw).length === 1 && (raw.state === "invalidating" || raw.state === "sealing")) return response;
+				if (Object.keys(raw).length === 3 && raw.state === "draining" && safeCount(raw.pending_effects) && safeCount(raw.pending_linked_sessions)) return response;
+			}
+			if (!isPlainObject(raw) || Object.keys(raw).length !== 2 || raw.state !== "frozen") return failure("source_receipt_unavailable", 503);
+			const receipt = parseReceipt(raw.receipt, envelope);
+			if (!receipt || !sameFields(receipt.scope, source.scope) || !sameFields(receipt.request, source.request)) return failure("source_receipt_unavailable", 503);
+			if (!await persistReceipt(directory, "relocation-ecdsa-receipt", envelope, receipt)) return failure("source_receipt_unavailable", 503);
+			return response;
+		}
+		const request = operation === "export" ? {
+			operation,
+			segmentIndex: input.segmentIndex
+		} : { operation };
+		const authorized = await postDirectory(directory, "relocation-ecdsa-transfer", {
+			...envelope,
+			request
+		});
+		if (!authorized.ok) return failure("source_command_denied", 409);
+		const result = await authorized.json();
+		const commandFields = operation === "export" ? 4 : operation === "status" || operation === "import" ? 3 : 2;
+		if (!isPlainObject(result) || Object.keys(result).length !== 2 || result.ok !== true || !isPlainObject(result.command) || result.command.kind !== operation || Object.keys(result.command).length !== commandFields) return failure("source_command_unavailable", 503);
+		const command = result.command;
+		const receipt = parseReceipt(operation === "cleanup" ? command.activation : command.receipt, envelope);
+		if (!receipt) return failure("source_command_unavailable", 503);
+		const identity = walletRelocationObjectIdentity(envelope.wallet, receipt.request.source_generation + (operation === "export" || operation === "cleanup" ? 0 : 1));
+		if ((operation === "export" || operation === "status" || operation === "import") && command.chunk_bytes !== 4096) return failure("source_command_unavailable", 503);
+		if (operation === "export") {
+			if (!safeCount(input.segmentIndex) || input.segmentIndex > 4294967295 || command.segment_index !== input.segmentIndex) return failure("source_command_unavailable", 503);
+			const chunks = [];
+			let segmentIndex = input.segmentIndex;
+			for (let step = 0; step < TRANSFER_BATCH_SEGMENTS; step += 1) {
+				const response = await postRole(router, "ecdsa/export", {
+					receipt,
+					segment_index: segmentIndex,
+					chunk_bytes: 4096
+				}, credential, identity);
+				if (!response.ok) return response;
+				const chunk = parseChunk(await response.json(), receipt);
+				if (!chunk || chunk.segment_index !== segmentIndex || chunks.length > 0 && chunk.segment_count !== chunks[0].segment_count) return failure("source_receipt_unavailable", 503);
+				chunks.push(chunk);
+				segmentIndex += 1;
+				if (segmentIndex === chunk.segment_count) break;
+			}
+			return Response.json({ chunks });
+		}
+		if (operation === "import") {
+			if (!Array.isArray(input.chunks) || input.chunks.length === 0 || input.chunks.length > TRANSFER_BATCH_SEGMENTS) return failure("invalid_input", 400);
+			const chunks = [];
+			for (const raw of input.chunks) {
+				const chunk = parseChunk(raw, receipt);
+				const previous = chunks.at(-1);
+				if (!chunk || previous && (chunk.segment_index !== previous.segment_index + 1 || chunk.segment_count !== previous.segment_count)) return failure("invalid_input", 400);
+				chunks.push(chunk);
+			}
+			let response = failure("invalid_input", 400);
+			for (const chunk of chunks) {
+				response = await postRole(router, "ecdsa/transfer", {
+					kind: "import",
+					chunk
+				}, credential, identity);
+				if (!response.ok) return response;
+				const accepted = await response.clone().json();
+				if (!isPlainObject(accepted) || accepted.kind !== "imported" || accepted.segment_index !== chunk.segment_index || typeof accepted.input_digest_hex !== "string" || !/^[a-f0-9]{64}$/u.test(accepted.input_digest_hex)) return failure("source_receipt_unavailable", 503);
+			}
+			return response;
+		}
+		if (operation === "cleanup") return await postRole(router, "ecdsa/transfer", {
+			kind: "cleanup",
+			activation: receipt
+		}, credential, identity);
+		if (operation === "status") return await postRole(router, "ecdsa/transfer", {
+			kind: "status",
+			receipt,
+			chunk_bytes: 4096
+		}, credential, identity);
+		const response = await postRole(router, "ecdsa/transfer", {
+			kind: operation,
+			receipt
+		}, credential, identity);
+		if (operation !== "activate" || !response.ok) return response;
+		const activated = await response.clone().json();
+		if (!isPlainObject(activated) || Object.keys(activated).length !== 2 || activated.kind !== "activated" || !sameFields(receipt, activated.receipt) || !await persistReceipt(directory, "relocation-ecdsa-activation", envelope, receipt)) return failure("activation_receipt_unavailable", 503);
+		return response;
+	} catch {
+		return failure("source_command_unavailable", 503);
+	}
+}
+function parseChunk(raw, receipt) {
+	if (!isPlainObject(raw) || Object.keys(raw).length !== 5 || !sameFields(raw.receipt, receipt) || raw.chunk_bytes !== 4096 || !safeCount(raw.segment_index) || !safeCount(raw.segment_count) || raw.segment_count === 0 || raw.segment_count > 4294967295 || raw.segment_index >= raw.segment_count || typeof raw.data_b64u !== "string" || raw.data_b64u.length === 0 || raw.data_b64u.length > 5462 || !/^[A-Za-z0-9_-]+$/u.test(raw.data_b64u)) return null;
+	return {
+		receipt,
+		chunk_bytes: 4096,
+		segment_index: raw.segment_index,
+		segment_count: raw.segment_count,
+		data_b64u: raw.data_b64u
+	};
+}
+function parseReceipt(raw, envelope) {
+	if (!isPlainObject(raw) || Object.keys(raw).length !== 4 || !isPlainObject(raw.scope) || Object.keys(raw.scope).length !== 4 || !isPlainObject(raw.request) || Object.keys(raw.request).length !== 3 || typeof raw.scope.org_id !== "string" || raw.scope.org_id !== envelope.wallet.organizationId || typeof raw.scope.project_id !== "string" || raw.scope.project_id !== envelope.wallet.projectId || typeof raw.scope.project_environment_id !== "string" || raw.scope.project_environment_id !== envelope.wallet.environmentId || typeof raw.scope.wallet_id !== "string" || raw.scope.wallet_id !== envelope.wallet.walletId || typeof raw.request.move_id !== "string" || raw.request.move_id !== envelope.attempt.moveId || !safeCount(raw.request.source_generation) || raw.request.source_generation === 0 || !safeCount(raw.request.invalidated_at_ms) || raw.request.invalidated_at_ms === 0 || !safeCount(raw.record_count) || typeof raw.wallet_records_digest_hex !== "string" || !/^[a-f0-9]{64}$/u.test(raw.wallet_records_digest_hex)) return null;
+	return {
+		scope: {
+			org_id: raw.scope.org_id,
+			project_id: raw.scope.project_id,
+			project_environment_id: raw.scope.project_environment_id,
+			wallet_id: raw.scope.wallet_id
+		},
+		request: {
+			move_id: raw.request.move_id,
+			source_generation: raw.request.source_generation,
+			invalidated_at_ms: raw.request.invalidated_at_ms
+		},
+		record_count: raw.record_count,
+		wallet_records_digest_hex: raw.wallet_records_digest_hex
+	};
+}
+function safeCount(raw) {
+	return typeof raw === "number" && Number.isSafeInteger(raw) && raw >= 0;
+}
+function sameFields(left, right) {
+	if (!isPlainObject(left) || !isPlainObject(right)) return left === right;
+	if (Object.keys(left).length !== Object.keys(right).length) return false;
+	for (const key of Object.keys(left)) if (!sameFields(left[key], right[key])) return false;
+	return true;
+}
+async function persistReceipt(directory, endpoint, envelope, receipt) {
+	const response = await postDirectory(directory, endpoint, {
+		...envelope,
+		receipt
+	});
+	if (!response.ok) return false;
+	const result = await response.json();
+	return isPlainObject(result) && Object.keys(result).length === 2 && result.ok === true && sameFields(receipt, result.receipt);
+}
+function postDirectory(directory, endpoint, body) {
+	const version = directory.CF_VERSION_METADATA.id;
+	if (typeof version !== "string" || !version) throw new Error("Runtime version is unavailable");
+	return directory.WALLET_CONSOLE.fetch(new Request(`https://wallet-placement.internal/internal/wallet-placement/v1/${endpoint}`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			"x-seams-writer-role": "walletRuntime",
+			"x-seams-writer-version": version,
+			"x-seams-writer-account": directory.SEAMS_D1_HOME_ACCOUNT_ID,
+			"x-seams-writer-database": directory.SEAMS_D1_HOME_DATABASE_ID
+		},
+		body: JSON.stringify(body)
+	}));
+}
+function postRole(router, path, command, credential, identity) {
+	return router.fetch(new Request(`https://mpc-router.router-ab.internal/router-ab/signing-worker/wallet/${path}`, {
+		method: "POST",
+		redirect: "manual",
+		headers: {
+			"content-type": "application/json",
+			[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: credential,
+			...walletObjectIdentityHeaders(identity)
+		},
+		body: JSON.stringify(command)
+	}));
+}
+function failure(code, status) {
+	return Response.json({
+		ok: false,
+		code
+	}, {
+		status,
+		headers: { "Cache-Control": "no-store" }
+	});
+}
+//#endregion
+export { ecdsaRuntimeOperation, forwardEcdsaRelocation };
+
+//# sourceMappingURL=walletRelocationEcdsa.js.map

package/dist/esm/router/cloudflare/runtime/walletRelocationEd25519.js

@@ -0,0 +1,172 @@
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { walletObjectIdentityHeaders, walletRelocationObjectIdentity } from "./walletObjectAddresses.js";
+import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
+import { authorizeRuntimeSource } from "./walletRelocationSource.js";
+//#region src/router/cloudflare/runtime/walletRelocationEd25519.ts
+function ed25519RuntimeOperation(operation) {
+	switch (operation) {
+		case "ed25519-capture": return "capture";
+		case "ed25519-export": return "export";
+		case "ed25519-import": return "import";
+		case "ed25519-status": return "status";
+		case "ed25519-verify": return "verify";
+		case "ed25519-activate": return "activate";
+		case "ed25519-cleanup": return "cleanup";
+		default: return null;
+	}
+}
+async function forwardEd25519Snapshot(input, operation, router, credential, directory) {
+	const fieldCount = operation === "export" || operation === "import" ? 3 : 2;
+	if (!isPlainObject(input) || Object.keys(input).length !== fieldCount || !isPlainObject(input.wallet) || !isPlainObject(input.attempt)) return failure("invalid_input", 400);
+	const envelope = {
+		wallet: input.wallet,
+		attempt: input.attempt
+	};
+	try {
+		if (operation === "capture") {
+			const authorization = await authorizeRuntimeSource(input, "ed25519-capture", directory);
+			if (!authorization.ok) return failure(authorization.code, authorization.code === "source_command_denied" ? 409 : 503);
+			const command = JSON.parse(authorization.body);
+			if (!isPlainObject(command)) return failure("source_command_unavailable", 503);
+			const response = await postSnapshot(router, command, credential, authorization.identity);
+			if (!response.ok) return response;
+			const raw = await response.clone().json();
+			if (isPlainObject(raw) && Object.keys(raw).length === 1 && raw.state === "capturing") return response;
+			if (!isPlainObject(raw) || Object.keys(raw).length !== 2 || raw.state !== "frozen") return failure("source_receipt_unavailable", 503);
+			const receipt = parseReceipt(raw.receipt, envelope);
+			if (!receipt || !sameFields(receipt.source, command.source)) return failure("source_receipt_unavailable", 503);
+			const recorded = await postDirectory(directory, "relocation-ed25519-receipt", {
+				...envelope,
+				receipt
+			});
+			if (!recorded.ok) return failure("source_receipt_unavailable", 503);
+			const result = await recorded.json();
+			if (!isPlainObject(result) || Object.keys(result).length !== 2 || result.ok !== true || !sameFields(receipt, result.receipt)) return failure("source_receipt_unavailable", 503);
+			return response;
+		}
+		const request = operation === "export" ? {
+			operation,
+			segmentIndex: input.segmentIndex
+		} : { operation };
+		const authorized = await postDirectory(directory, "relocation-ed25519-transfer", {
+			...envelope,
+			request
+		});
+		if (!authorized.ok) return failure("source_command_denied", 409);
+		const result = await authorized.json();
+		if (!isPlainObject(result) || Object.keys(result).length !== 2 || result.ok !== true || !isPlainObject(result.command) || result.command.command !== operation || Object.keys(result.command).length !== (operation === "export" ? 3 : 2)) return failure("source_command_unavailable", 503);
+		const receipt = parseReceipt(operation === "cleanup" ? result.command.activation : result.command.receipt, envelope);
+		if (!receipt) return failure("source_command_unavailable", 503);
+		const identity = walletRelocationObjectIdentity(envelope.wallet, receipt.source.request.source_generation + (operation === "export" || operation === "cleanup" ? 0 : 1));
+		if (operation === "cleanup") return await postSnapshot(router, {
+			command: "cleanup",
+			activation: receipt
+		}, credential, identity);
+		if (operation === "activate") {
+			const response = await postSnapshot(router, {
+				command: "activate",
+				receipt
+			}, credential, identity);
+			if (!response.ok) return response;
+			const activated = await response.clone().json();
+			if (!isPlainObject(activated) || Object.keys(activated).length !== 2 || activated.state !== "activated" || !sameFields(receipt, activated.receipt)) return failure("activation_receipt_unavailable", 503);
+			const recorded = await postDirectory(directory, "relocation-ed25519-activation", {
+				...envelope,
+				receipt
+			});
+			if (!recorded.ok) return failure("activation_receipt_unavailable", 503);
+			const confirmed = await recorded.json();
+			if (!isPlainObject(confirmed) || Object.keys(confirmed).length !== 2 || confirmed.ok !== true || !sameFields(receipt, confirmed.receipt)) return failure("activation_receipt_unavailable", 503);
+			return response;
+		}
+		if (operation === "export") {
+			if (!count(input.segmentIndex) || input.segmentIndex >= receipt.segment_count || result.command.segment_index !== input.segmentIndex) return failure("source_command_unavailable", 503);
+			return await postSnapshot(router, {
+				command: "export",
+				receipt,
+				segment_index: input.segmentIndex
+			}, credential, identity);
+		}
+		if (operation === "import") return await postSnapshot(router, {
+			command: "import",
+			receipt,
+			segment: input.segment
+		}, credential, identity);
+		return await postSnapshot(router, {
+			command: operation,
+			receipt
+		}, credential, identity);
+	} catch {
+		return failure("source_command_unavailable", 503);
+	}
+}
+function parseReceipt(raw, envelope) {
+	if (!isPlainObject(raw) || Object.keys(raw).length !== 4 || !isPlainObject(raw.source) || Object.keys(raw.source).length !== 2 || !isPlainObject(raw.source.scope) || Object.keys(raw.source.scope).length !== 4 || !isPlainObject(raw.source.request) || Object.keys(raw.source.request).length !== 3 || typeof raw.source.scope.org_id !== "string" || raw.source.scope.org_id !== envelope.wallet.organizationId || typeof raw.source.scope.project_id !== "string" || raw.source.scope.project_id !== envelope.wallet.projectId || typeof raw.source.scope.project_environment_id !== "string" || raw.source.scope.project_environment_id !== envelope.wallet.environmentId || typeof raw.source.scope.wallet_id !== "string" || raw.source.scope.wallet_id !== envelope.wallet.walletId || typeof raw.source.request.move_id !== "string" || raw.source.request.move_id !== envelope.attempt.moveId || typeof raw.source.request.source_generation !== "number" || !Number.isSafeInteger(raw.source.request.source_generation) || raw.source.request.source_generation < 1 || typeof raw.source.request.invalidated_at_ms !== "number" || !Number.isSafeInteger(raw.source.request.invalidated_at_ms) || raw.source.request.invalidated_at_ms <= 0 || !count(raw.record_count) || !count(raw.segment_count) || raw.record_count > raw.segment_count || raw.record_count === 0 !== (raw.segment_count === 0) || typeof raw.digest_hex !== "string" || !/^[a-f0-9]{64}$/u.test(raw.digest_hex)) return null;
+	return {
+		source: {
+			scope: {
+				org_id: raw.source.scope.org_id,
+				project_id: raw.source.scope.project_id,
+				project_environment_id: raw.source.scope.project_environment_id,
+				wallet_id: raw.source.scope.wallet_id
+			},
+			request: {
+				move_id: raw.source.request.move_id,
+				source_generation: raw.source.request.source_generation,
+				invalidated_at_ms: raw.source.request.invalidated_at_ms
+			}
+		},
+		record_count: raw.record_count,
+		segment_count: raw.segment_count,
+		digest_hex: raw.digest_hex
+	};
+}
+function count(raw) {
+	return typeof raw === "number" && Number.isInteger(raw) && raw >= 0 && raw <= 4294967295;
+}
+function sameFields(left, right) {
+	if (!isPlainObject(left) || !isPlainObject(right)) return left === right;
+	if (Object.keys(left).length !== Object.keys(right).length) return false;
+	for (const key of Object.keys(left)) if (!sameFields(left[key], right[key])) return false;
+	return true;
+}
+function postDirectory(directory, endpoint, body) {
+	const version = directory.CF_VERSION_METADATA.id;
+	if (typeof version !== "string" || !version) throw new Error("Runtime version is unavailable");
+	return directory.WALLET_CONSOLE.fetch(new Request(`https://wallet-placement.internal/internal/wallet-placement/v1/${endpoint}`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			"x-seams-writer-role": "walletRuntime",
+			"x-seams-writer-version": version,
+			"x-seams-writer-account": directory.SEAMS_D1_HOME_ACCOUNT_ID,
+			"x-seams-writer-database": directory.SEAMS_D1_HOME_DATABASE_ID
+		},
+		body: JSON.stringify(body)
+	}));
+}
+function postSnapshot(router, command, credential, identity) {
+	return router.fetch(new Request("https://mpc-router.router-ab.internal/router-ab/signing-worker/wallet/ed25519/snapshot", {
+		method: "POST",
+		redirect: "manual",
+		headers: {
+			"content-type": "application/json",
+			[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: credential,
+			...walletObjectIdentityHeaders(identity)
+		},
+		body: JSON.stringify(command)
+	}));
+}
+function failure(code, status) {
+	return Response.json({
+		ok: false,
+		code
+	}, {
+		status,
+		headers: { "Cache-Control": "no-store" }
+	});
+}
+//#endregion
+export { ed25519RuntimeOperation, forwardEd25519Snapshot };
+
+//# sourceMappingURL=walletRelocationEd25519.js.map

package/dist/esm/router/cloudflare/runtime/walletRelocationOps.js

@@ -0,0 +1,183 @@
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { walletObjectIdentity, walletObjectIdentityFromWireScope, walletObjectIdentityHeaders, walletRelocationObjectIdentity } from "./walletObjectAddresses.js";
+import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
+import { forwardPresignSource, presignSourceOperation } from "./walletRelocationPresign.js";
+import { authorizeRuntimeSource, recordRuntimeRouterReceipt } from "./walletRelocationSource.js";
+import { ecdsaRuntimeOperation, forwardEcdsaRelocation } from "./walletRelocationEcdsa.js";
+import { ed25519RuntimeOperation, forwardEd25519Snapshot } from "./walletRelocationEd25519.js";
+import { deriverRuntimeOperation, forwardDeriverRelocation } from "./walletRelocationDeriver.js";
+//#region src/router/cloudflare/runtime/walletRelocationOps.ts
+const ORIGIN = "https://wallet-runtime.internal";
+const BASE_PATH = "/internal/wallet-runtime/v1/relocation";
+const OPERATIONS = {
+	"custody-target": "/router-ab/internal/custody-target",
+	"deriver-a-activate": "/router-ab/internal/deriver-a/wallet/snapshot",
+	"deriver-a-cleanup": "/router-ab/internal/deriver-a/wallet/snapshot",
+	"deriver-b-activate": "/router-ab/internal/deriver-b/wallet/snapshot",
+	"deriver-b-cleanup": "/router-ab/internal/deriver-b/wallet/snapshot",
+	"deriver-a-capture": "/router-ab/internal/deriver-a/wallet/snapshot",
+	"deriver-a-export": "/router-ab/internal/deriver-a/wallet/snapshot",
+	"deriver-a-import": "/router-ab/internal/deriver-a/wallet/snapshot",
+	"deriver-a-status": "/router-ab/internal/deriver-a/wallet/snapshot",
+	"deriver-a-verify": "/router-ab/internal/deriver-a/wallet/snapshot",
+	"deriver-b-capture": "/router-ab/internal/deriver-b/wallet/snapshot",
+	"deriver-b-export": "/router-ab/internal/deriver-b/wallet/snapshot",
+	"deriver-b-import": "/router-ab/internal/deriver-b/wallet/snapshot",
+	"deriver-b-status": "/router-ab/internal/deriver-b/wallet/snapshot",
+	"deriver-b-verify": "/router-ab/internal/deriver-b/wallet/snapshot",
+	"deriver-a-fence": "/router-ab/internal/deriver-a/wallet/fence-relocation",
+	"deriver-b-fence": "/router-ab/internal/deriver-b/wallet/fence-relocation",
+	"signing-worker-context": "/router-ab/signing-worker/wallet/relocation-context",
+	"deriver-a-context": "/router-ab/internal/deriver-a/wallet/relocation-context",
+	"deriver-b-context": "/router-ab/internal/deriver-b/wallet/relocation-context",
+	"deriver-b-prepare": "/router-ab/internal/deriver-b/wallet/prepare-relocation",
+	"deriver-a-prepare": "/router-ab/internal/deriver-a/wallet/prepare-relocation",
+	"router-freeze": "/router-ab/router/wallet/freeze",
+	"router-cleanup": "/router-ab/router/wallet/transfer",
+	"router-activate": "/router-ab/router/wallet/transfer",
+	"router-import": "/router-ab/router/wallet/transfer",
+	"router-status": "/router-ab/router/wallet/transfer",
+	"router-verify": "/router-ab/router/wallet/transfer",
+	"router-export": "/router-ab/router/wallet/transfer",
+	"router-transfer": "/router-ab/router/wallet/transfer",
+	"ed25519-activate": "/router-ab/signing-worker/wallet/ed25519/snapshot",
+	"ed25519-cleanup": "/router-ab/signing-worker/wallet/ed25519/snapshot",
+	"ed25519-export": "/router-ab/signing-worker/wallet/ed25519/snapshot",
+	"ed25519-import": "/router-ab/signing-worker/wallet/ed25519/snapshot",
+	"ed25519-status": "/router-ab/signing-worker/wallet/ed25519/snapshot",
+	"ed25519-verify": "/router-ab/signing-worker/wallet/ed25519/snapshot",
+	"ed25519-capture": "/router-ab/signing-worker/wallet/ed25519/snapshot",
+	"ed25519-settle": "/router-ab/signing-worker/wallet/ed25519/settle",
+	"ed25519-snapshot": "/router-ab/signing-worker/wallet/ed25519/snapshot",
+	"ecdsa-import": "/router-ab/signing-worker/wallet/ecdsa/transfer",
+	"ecdsa-status": "/router-ab/signing-worker/wallet/ecdsa/transfer",
+	"ecdsa-verify": "/router-ab/signing-worker/wallet/ecdsa/transfer",
+	"ecdsa-activate": "/router-ab/signing-worker/wallet/ecdsa/transfer",
+	"ecdsa-cleanup": "/router-ab/signing-worker/wallet/ecdsa/transfer",
+	"ecdsa-freeze": "/router-ab/signing-worker/wallet/pool/freeze",
+	"ecdsa-export": "/router-ab/signing-worker/wallet/ecdsa/export",
+	"ecdsa-transfer": "/router-ab/signing-worker/wallet/ecdsa/transfer",
+	"presign-preparation-inventory": "/router-ab/signing-worker/wallet/linked-presign-preparation-inventory",
+	"presign-inventory": "/router-ab/signing-worker/wallet/linked-presign-inventory",
+	"presign-fence": "/router-ab/signing-worker/linked-presign-session/fence",
+	"presign-freeze": "/router-ab/signing-worker/linked-presign-session/freeze",
+	"presign-cleanup": "/router-ab/signing-worker/linked-presign-session/transfer",
+	"presign-status": "/router-ab/signing-worker/linked-presign-session/transfer",
+	"presign-import": "/router-ab/signing-worker/linked-presign-session/transfer",
+	"presign-verify": "/router-ab/signing-worker/linked-presign-session/transfer",
+	"presign-export": "/router-ab/signing-worker/linked-presign-session/export",
+	"presign-transfer": "/router-ab/signing-worker/linked-presign-session/transfer"
+};
+async function handleWalletRelocationRequest(request, env) {
+	const url = new URL(request.url);
+	if (url.origin !== ORIGIN || !url.pathname.startsWith(`${BASE_PATH}/`)) return null;
+	if (request.method !== "POST") return failure("method_not_allowed", 405);
+	const operation = url.pathname.slice(39);
+	if (!Object.hasOwn(OPERATIONS, operation) || url.search !== "") return failure("operation_not_found", 404);
+	const path = Reflect.get(OPERATIONS, operation);
+	if (typeof path !== "string") return failure("operation_not_found", 404);
+	if (!(request.headers.get("content-type") || "").toLowerCase().startsWith("application/json")) return failure("unsupported_media_type", 415);
+	const deriverAction = deriverRuntimeOperation(operation);
+	const credential = deriverAction !== null || operation === "deriver-a-prepare" || operation === "deriver-b-prepare" || operation === "deriver-a-context" || operation === "deriver-b-context" ? env.ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET?.trim() : env.ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET?.trim();
+	if (!credential) return failure("relocation_transport_unavailable", 503);
+	const bytes = await request.arrayBuffer();
+	if (bytes.byteLength > 131072) return failure("request_too_large", 413);
+	let input;
+	try {
+		input = JSON.parse(new TextDecoder().decode(bytes));
+	} catch {
+		return failure("invalid_input", 400);
+	}
+	if (deriverAction) {
+		const binding = deriverAction.role === "deriver-a" ? env.DERIVER_A : env.DERIVER_B;
+		return forwardDeriverRelocation(input, deriverAction.role, deriverAction.operation, binding, credential, env);
+	}
+	const ed25519Action = ed25519RuntimeOperation(operation);
+	if (ed25519Action) return forwardEd25519Snapshot(input, ed25519Action, env.MPC_ROUTER, credential, env);
+	const ecdsaAction = ecdsaRuntimeOperation(operation);
+	if (ecdsaAction) return forwardEcdsaRelocation(input, ecdsaAction, env.MPC_ROUTER, credential, env);
+	const presignAction = presignSourceOperation(operation);
+	if (presignAction) return forwardPresignSource(input, presignAction, env.MPC_ROUTER, credential, env);
+	let body = bytes;
+	let identity = null;
+	if (operation === "router-cleanup" || operation === "router-activate" || operation === "router-import" || operation === "router-status" || operation === "router-verify" || operation === "router-export" || operation === "router-freeze" || operation === "ed25519-settle") {
+		const authorized = await authorizeRuntimeSource(input, operation, env);
+		if (!authorized.ok) {
+			let status = 503;
+			if (authorized.code === "invalid_input") status = 400;
+			else if (authorized.code === "source_command_denied") status = 409;
+			return failure(authorized.code, status);
+		}
+		body = authorized.body;
+		identity = authorized.identity;
+	} else if (operation === "router-transfer" && isPlainObject(input) && (input.kind === "export" || input.kind === "status" || input.kind === "verify" || input.kind === "import" || input.kind === "activate" || input.kind === "cleanup")) return failure("source_command_required", 400);
+	else if ((operation === "ecdsa-transfer" || operation === "presign-transfer") && (!isPlainObject(input) || input.kind !== "prepare")) return failure("source_command_required", 400);
+	else if (operation === "ed25519-snapshot" && isPlainObject(input) && (input.command === "capture" || input.command === "export" || input.command === "import" || input.command === "status" || input.command === "verify" || input.command === "activate" || input.command === "cleanup")) return failure("source_command_required", 400);
+	if ((operation === "deriver-a-prepare" || operation === "deriver-b-prepare" || operation === "deriver-a-context" || operation === "deriver-b-context") && isPlainObject(input) && isPlainObject(input.owner)) identity = walletObjectIdentity(input.owner.wallet_id, operation.endsWith("-prepare") ? input.destination_generation : input.ownership_generation, {
+		orgId: input.owner.org_id,
+		projectId: input.owner.project_id,
+		envId: input.owner.env_id
+	});
+	if (isPlainObject(input)) {
+		if (operation === "router-transfer" && input.kind === "prepare" && isPlainObject(input.request) && isPlainObject(input.request.owner)) {
+			const owner = input.request.owner;
+			identity = walletObjectIdentity(owner.wallet_id, input.request.destination_generation, {
+				orgId: owner.org_id,
+				projectId: owner.project_id,
+				envId: owner.env_id
+			});
+		} else if (operation === "ecdsa-transfer" && input.kind === "prepare" && isPlainObject(input.request)) {
+			const source = walletObjectIdentityFromWireScope(input.scope, input.request.source_generation);
+			identity = walletObjectIdentity(source.walletId, source.ownershipGeneration + 1, source);
+		} else if (operation === "ed25519-snapshot" && input.command === "prepare" && isPlainObject(input.source) && isPlainObject(input.source.request)) {
+			const source = walletObjectIdentityFromWireScope(input.source.scope, input.source.request.source_generation);
+			identity = walletObjectIdentity(source.walletId, source.ownershipGeneration + 1, source);
+		} else if (operation === "presign-transfer" && input.kind === "prepare" && isPlainObject(input.command) && isPlainObject(input.command.request)) {
+			const source = walletObjectIdentityFromWireScope(input.command.wallet_scope, input.command.request.source_generation);
+			identity = walletObjectIdentity(source.walletId, source.ownershipGeneration + 1, source);
+		} else if (operation === "presign-preparation-inventory") identity = walletObjectIdentityFromWireScope(input.scope, input.source_generation);
+	}
+	if (operation === "custody-target" && isPlainObject(input) && input.role !== "presignSessions") {
+		if (!isPlainObject(input.wallet)) return failure("invalid_input", 400);
+		identity = walletRelocationObjectIdentity(input.wallet, input.ownership_generation);
+		body = JSON.stringify({
+			role: input.role,
+			object_name: input.object_name,
+			placement: input.placement
+		});
+	}
+	let transport = env.MPC_ROUTER;
+	let origin = "https://mpc-router.router-ab.internal";
+	if (operation === "deriver-a-prepare" || operation === "deriver-a-context") {
+		transport = env.DERIVER_A;
+		origin = "https://deriver-a.router-ab.internal";
+	} else if (operation === "deriver-b-prepare" || operation === "deriver-b-context") {
+		transport = env.DERIVER_B;
+		origin = "https://deriver-b.router-ab.internal";
+	}
+	const response = await transport.fetch(new Request(`${origin}${path}`, {
+		method: "POST",
+		redirect: "manual",
+		headers: {
+			"content-type": "application/json",
+			...identity === null ? {} : walletObjectIdentityHeaders(identity),
+			[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: credential
+		},
+		body
+	}));
+	if (operation === "router-freeze" || operation === "router-activate") return recordRuntimeRouterReceipt(operation, input, response, env);
+	return response;
+}
+function failure(code, status) {
+	return Response.json({
+		ok: false,
+		code
+	}, {
+		status,
+		headers: { "Cache-Control": "no-store" }
+	});
+}
+//#endregion
+export { handleWalletRelocationRequest };
+
+//# sourceMappingURL=walletRelocationOps.js.map