@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/shared-ts/src/signing-lanes/rotationDigests.js

@@ -1,358 +0,0 @@
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { sha256Bytes } from "../utils/digests.js";
-import { parseDigestB64u, sha256DigestB64u } from "../utils/canonicalPrimitives.js";
-import { concat, lp32, text, u32, u64 } from "../utils/digestEncoding.js";
-import { isProvisionedLaneProtocolSourceV1 } from "./rotation.js";
-import { ownerLaneParticipantContinuityCanonicalBytesV1 } from "./ownerContinuity.js";
-//#region ../shared-ts/src/signing-lanes/rotationDigests.ts
-const ENROLLMENT_MANIFEST_DOMAIN = "seams/rotatable-signing-lanes/enrollment-manifest/v1";
-const AGGREGATE_ACTIVATION_DOMAIN = "seams/rotatable-signing-lanes/aggregate-activation-receipt/v1";
-const AGGREGATE_REVOCATION_DOMAIN = "seams/rotatable-signing-lanes/aggregate-revocation-receipt/v1";
-const ED25519_JOB_TRANSCRIPT_DOMAIN = "seams/rotatable-signing-lanes/ed25519-job/v1";
-const ED25519_SESSION_DOMAIN = "seams/rotatable-signing-lanes/ed25519-session/v1";
-const PROTOCOL_COMMIT_RECEIPT_DOMAIN = "seams/rotatable-signing-lanes/protocol-commit-receipt/v1";
-const HOLDER_DELIVERY_RECEIPT_DOMAIN = "seams/rotatable-signing-lanes/holder-delivery-receipt/v1";
-const SERVER_ACTIVATION_RECEIPT_DOMAIN = "seams/rotatable-signing-lanes/server-activation-receipt/v1";
-const ECDSA_RETIREMENT_RECEIPT_DOMAIN = "seams/rotatable-signing-lanes/ecdsa-retirement-receipt/v1";
-const ED25519_RETIREMENT_RECEIPT_DOMAIN = "seams/rotatable-signing-lanes/ed25519-retirement-receipt/v1";
-const TEXT_ENCODER = new TextEncoder();
-function digest(value, label) {
-	try {
-		return lp32(base64UrlDecode(parseDigestB64u(value)), label);
-	} catch (error) {
-		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
-	}
-}
-function recordDomain(domain) {
-	return text(domain, "domain");
-}
-function activation(value) {
-	return concat([
-		text(value.kind, "materialActivation.kind"),
-		text(value.activationId, "materialActivation.activationId"),
-		text(value.capability, "materialActivation.capability"),
-		text(value.materialOwner, "materialActivation.materialOwner"),
-		text(value.keyBinding, "materialActivation.keyBinding"),
-		text(value.lifecycleBinding, "materialActivation.lifecycleBinding"),
-		text(value.signingWorker, "materialActivation.signingWorker")
-	]);
-}
-function activationField(value, label) {
-	return lp32(activation(value), label);
-}
-function encodeAuthorization(value) {
-	if (value.kind === "linked_device_enrollment") return concat([
-		text(value.kind, "authorization.kind"),
-		text(value.authorizedOperationId, "authorization.authorizedOperationId"),
-		text(value.linkedDeviceEnrollmentId, "authorization.linkedDeviceEnrollmentId"),
-		digest(value.linkedDevicePermissionDigestB64u, "authorization.linkedDevicePermissionDigestB64u")
-	]);
-	return concat([
-		text(value.kind, "authorization.kind"),
-		text(value.authorizedOperationId, "authorization.authorizedOperationId"),
-		digest(value.ownerLaneRefreshDigestB64u, "authorization.ownerLaneRefreshDigestB64u")
-	]);
-}
-function encodeSource(value) {
-	const common = [
-		text(value.laneId, "source.laneId"),
-		text(value.laneKind, "source.laneKind"),
-		text(value.laneShareEpoch, "source.laneShareEpoch"),
-		u64(value.revocationEpoch, "source.revocationEpoch"),
-		text(value.sourceKind, "source.sourceKind")
-	];
-	if (value.ownerParticipantContinuity !== void 0) return concat([
-		...common,
-		ownerLaneParticipantContinuityCanonicalBytesV1(value.ownerParticipantContinuity),
-		digest(value.participantBindingDigestB64u, "source.participantBindingDigestB64u"),
-		activationField(value.materialActivation, "source.materialActivation")
-	]);
-	if (!isProvisionedLaneProtocolSourceV1(value)) throw new Error("provisioned lane source participant identities are required");
-	return concat([
-		...common,
-		text(value.holderParticipantId, "source.holderParticipantId"),
-		text(value.signingWorkerParticipantId, "source.signingWorkerParticipantId"),
-		text(value.signingWorkerRecipientKeyId, "source.signingWorkerRecipientKeyId"),
-		digest(value.participantBindingDigestB64u, "source.participantBindingDigestB64u"),
-		activationField(value.materialActivation, "source.materialActivation")
-	]);
-}
-function encodeEd25519YaoLaneJobTranscriptV1(value) {
-	const target = value.target.operation === "create_lane" ? concat([
-		text(value.target.operation, "target.operation"),
-		text(value.target.laneKind, "target.laneKind"),
-		text(value.target.expectedTargetState, "target.expectedTargetState")
-	]) : concat([
-		text(value.target.operation, "target.operation"),
-		text(value.target.laneKind, "target.laneKind"),
-		text(value.target.expectedTargetState, "target.expectedTargetState"),
-		activation(value.target.priorMaterialActivation)
-	]);
-	const authorization = value.authorization.kind === "linked_device_enrollment" ? concat([
-		text(value.authorization.kind, "authorization.kind"),
-		text(value.authorization.authorizedOperationId, "authorization.authorizedOperationId"),
-		text(value.authorization.linkedDeviceEnrollmentId, "authorization.linkedDeviceEnrollmentId"),
-		text(value.authorization.linkedDevicePermissionDigestB64u, "authorization.linkedDevicePermissionDigestB64u")
-	]) : concat([
-		text(value.authorization.kind, "authorization.kind"),
-		text(value.authorization.authorizedOperationId, "authorization.authorizedOperationId"),
-		text(value.authorization.ownerLaneRefreshDigestB64u, "authorization.ownerLaneRefreshDigestB64u")
-	]);
-	return concat([
-		recordDomain(ED25519_JOB_TRANSCRIPT_DOMAIN),
-		text(value.kind, "kind"),
-		text(value.yaoRequestKind, "yaoRequestKind"),
-		text(value.operationId, "operationId"),
-		text(value.enrollmentId, "enrollmentId"),
-		text(value.idempotencyKey, "idempotencyKey"),
-		text(value.walletId, "walletId"),
-		text(value.walletKeyId, "walletKeyId"),
-		encodeSource(value.source),
-		target,
-		text(value.target.laneId, "target.laneId"),
-		text(value.target.laneShareEpoch, "target.laneShareEpoch"),
-		text(value.targetMaterialActivationId, "targetMaterialActivationId"),
-		text(value.targetHolder.participantId, "targetHolder.participantId"),
-		text(value.targetHolder.participantBindingDigestB64u, "targetHolder.participantBindingDigestB64u"),
-		text(value.targetHolder.custodyBindingId, "targetHolder.custodyBindingId"),
-		text(value.targetHolder.custodyBindingDigestB64u, "targetHolder.custodyBindingDigestB64u"),
-		text(value.targetHolder.hpkePublicKeyB64u, "targetHolder.hpkePublicKeyB64u"),
-		text(value.targetHolder.hpkePublicKeyDigestB64u, "targetHolder.hpkePublicKeyDigestB64u"),
-		text(value.targetSigningWorker.participantId, "targetSigningWorker.participantId"),
-		text(value.targetSigningWorker.participantBindingDigestB64u, "targetSigningWorker.participantBindingDigestB64u"),
-		text(value.targetSigningWorker.recipientKeyId, "targetSigningWorker.recipientKeyId"),
-		text(value.targetSigningWorker.hpkePublicKeyB64u, "targetSigningWorker.hpkePublicKeyB64u"),
-		text(value.targetSigningWorker.hpkePublicKeyDigestB64u, "targetSigningWorker.hpkePublicKeyDigestB64u"),
-		authorization,
-		text(value.registeredPublicKeyB64u, "registeredPublicKeyB64u"),
-		u64(value.keyCreationSignerSlot, "keyCreationSignerSlot"),
-		text(value.stableContextBindingB64u, "stableContextBindingB64u"),
-		text(value.nearEd25519SigningKeyId, "nearEd25519SigningKeyId"),
-		text(value.yaoSuiteId, "yaoSuiteId"),
-		text(value.circuitDigestB64u, "circuitDigestB64u"),
-		text(value.protocolVersion, "protocolVersion"),
-		u64(value.expiresAtMs, "expiresAtMs")
-	]);
-}
-async function computeEd25519YaoLaneSessionDigestV1(value) {
-	const jobDigest = await sha256Bytes(encodeEd25519YaoLaneJobTranscriptV1(value));
-	return base64UrlEncode(await sha256Bytes(concat([TEXT_ENCODER.encode(ED25519_SESSION_DOMAIN), jobDigest])));
-}
-function encodeManifestChild(value) {
-	return concat([
-		text(value.operationId, "child.operationId"),
-		text(value.walletKeyId, "child.walletKeyId"),
-		text(value.keyFamily, "child.keyFamily"),
-		text(value.sourceLaneId, "child.sourceLaneId"),
-		text(value.sourceLaneShareEpoch, "child.sourceLaneShareEpoch"),
-		u64(value.sourceRevocationEpoch, "child.sourceRevocationEpoch"),
-		activationField(value.sourceMaterialActivation, "child.sourceMaterialActivation"),
-		text(value.targetLaneId, "child.targetLaneId"),
-		text(value.targetLaneShareEpoch, "child.targetLaneShareEpoch"),
-		text(value.targetMaterialActivationId, "child.targetMaterialActivationId"),
-		digest(value.holderParticipantBindingDigestB64u, "child.holderParticipantBindingDigestB64u"),
-		digest(value.signingWorkerParticipantBindingDigestB64u, "child.signingWorkerParticipantBindingDigestB64u")
-	]);
-}
-function encodeLaneEnrollmentManifestV1(value) {
-	const children = value.orderedChildren.map(encodeManifestChild);
-	return concat([
-		recordDomain(ENROLLMENT_MANIFEST_DOMAIN),
-		text(value.enrollmentId, "enrollmentId"),
-		text(value.walletId, "walletId"),
-		lp32(encodeAuthorization(value.authorization), "authorization"),
-		u64(value.createdAtMs, "createdAtMs"),
-		u64(value.expiresAtMs, "expiresAtMs"),
-		u32(children.length, "orderedChildren"),
-		...children.map((child) => lp32(child, "orderedChildren.item"))
-	]);
-}
-async function computeLaneEnrollmentManifestDigestV1(value) {
-	return base64UrlEncode(await sha256Bytes(encodeLaneEnrollmentManifestV1(value)));
-}
-function encodeActivationChild(value) {
-	return concat([
-		text(value.operationId, "child.operationId"),
-		text(value.walletKeyId, "child.walletKeyId"),
-		text(value.targetLaneId, "child.targetLaneId"),
-		text(value.targetLaneShareEpoch, "child.targetLaneShareEpoch"),
-		activationField(value.targetMaterialActivation, "child.targetMaterialActivation"),
-		digest(value.protocolCommitReceiptDigestB64u, "child.protocolCommitReceiptDigestB64u"),
-		digest(value.holderDeliveryReceiptDigestB64u, "child.holderDeliveryReceiptDigestB64u"),
-		digest(value.serverActivationReceiptDigestB64u, "child.serverActivationReceiptDigestB64u")
-	]);
-}
-function encodeAggregateLaneActivationReceiptV1(value) {
-	const children = value.orderedChildReceipts.map(encodeActivationChild);
-	return concat([
-		recordDomain(AGGREGATE_ACTIVATION_DOMAIN),
-		text(value.enrollmentId, "enrollmentId"),
-		text(value.walletId, "walletId"),
-		digest(value.manifestDigestB64u, "manifestDigestB64u"),
-		u64(value.activatedAtMs, "activatedAtMs"),
-		u32(children.length, "orderedChildReceipts"),
-		...children.map((child) => lp32(child, "orderedChildReceipts.item"))
-	]);
-}
-async function computeAggregateLaneActivationReceiptDigestV1(value) {
-	return base64UrlEncode(await sha256Bytes(encodeAggregateLaneActivationReceiptV1(value)));
-}
-function encodeRevocationChild(value) {
-	return concat([
-		text(value.operationId, "child.operationId"),
-		text(value.walletKeyId, "child.walletKeyId"),
-		text(value.targetLaneId, "child.targetLaneId"),
-		text(value.targetLaneShareEpoch, "child.targetLaneShareEpoch"),
-		activationField(value.targetMaterialActivation, "child.targetMaterialActivation"),
-		u64(value.revocationEpoch, "child.revocationEpoch"),
-		digest(value.retirementReceiptDigestB64u, "child.retirementReceiptDigestB64u")
-	]);
-}
-function encodeAggregateLaneRevocationReceiptV1(value) {
-	const children = value.orderedChildReceipts.map(encodeRevocationChild);
-	return concat([
-		recordDomain(AGGREGATE_REVOCATION_DOMAIN),
-		text(value.enrollmentId, "enrollmentId"),
-		text(value.walletId, "walletId"),
-		digest(value.manifestDigestB64u, "manifestDigestB64u"),
-		u64(value.revokedAtMs, "revokedAtMs"),
-		u32(children.length, "orderedChildReceipts"),
-		...children.map((child) => lp32(child, "orderedChildReceipts.item"))
-	]);
-}
-async function computeAggregateLaneRevocationReceiptDigestV1(value) {
-	return base64UrlEncode(await sha256Bytes(encodeAggregateLaneRevocationReceiptV1(value)));
-}
-function encodeRevokeSigningLaneV1(value) {
-	return concat([
-		recordDomain("seams/rotatable-signing-lanes/revoke-signing-lane/v1"),
-		text(value.walletId, "walletId"),
-		text(value.walletKeyId, "walletKeyId"),
-		text(value.laneId, "laneId"),
-		text(value.laneShareEpoch, "laneShareEpoch"),
-		u64(value.expectedRevocationEpoch, "expectedRevocationEpoch"),
-		text(value.reason, "reason"),
-		text(value.retirementCorrelationId, "retirementCorrelationId"),
-		digest(value.retirementRequestDigestB64u, "retirementRequestDigestB64u"),
-		digest(value.retirementEffectBindingDigestB64u, "retirementEffectBindingDigestB64u"),
-		u64(value.requestedAtMs, "requestedAtMs")
-	]);
-}
-async function computeRevokeSigningLaneDigestV1(value) {
-	return base64UrlEncode(await sha256Bytes(encodeRevokeSigningLaneV1(value)));
-}
-function encodeLaneProtocolCommitReceiptV1(value) {
-	return concat([
-		recordDomain(PROTOCOL_COMMIT_RECEIPT_DOMAIN),
-		text(value.operationId, "operationId"),
-		text(value.enrollmentId, "enrollmentId"),
-		text(value.walletId, "walletId"),
-		text(value.walletKeyId, "walletKeyId"),
-		text(value.sourceLaneId, "sourceLaneId"),
-		text(value.sourceLaneShareEpoch, "sourceLaneShareEpoch"),
-		u64(value.sourceRevocationEpoch, "sourceRevocationEpoch"),
-		activationField(value.sourceMaterialActivation, "sourceMaterialActivation"),
-		text(value.targetLaneId, "targetLaneId"),
-		text(value.targetLaneShareEpoch, "targetLaneShareEpoch"),
-		text(value.targetMaterialActivationId, "targetMaterialActivationId"),
-		text(value.keyFamily, "keyFamily"),
-		digest(value.publicIdentityDigestB64u, "publicIdentityDigestB64u"),
-		text(value.targetHolderPublicCommitmentB64u, "targetHolderPublicCommitmentB64u"),
-		text(value.targetServerPublicCommitmentB64u, "targetServerPublicCommitmentB64u"),
-		digest(value.targetHolderCiphertextDigestSetB64u, "targetHolderCiphertextDigestSetB64u"),
-		digest(value.targetServerCiphertextDigestSetB64u, "targetServerCiphertextDigestSetB64u"),
-		digest(value.holderRecipientKeyDigestB64u, "holderRecipientKeyDigestB64u"),
-		digest(value.serverRecipientKeyDigestB64u, "serverRecipientKeyDigestB64u"),
-		digest(value.transcriptHashB64u, "transcriptHashB64u"),
-		u64(value.committedAtMs, "committedAtMs")
-	]);
-}
-function encodeLaneHolderDeliveryReceiptV1(value) {
-	return concat([
-		recordDomain(HOLDER_DELIVERY_RECEIPT_DOMAIN),
-		text(value.operationId, "operationId"),
-		text(value.enrollmentId, "enrollmentId"),
-		text(value.targetLaneId, "targetLaneId"),
-		text(value.targetLaneShareEpoch, "targetLaneShareEpoch"),
-		text(value.targetMaterialActivationId, "targetMaterialActivationId"),
-		digest(value.holderParticipantBindingDigestB64u, "holderParticipantBindingDigestB64u"),
-		digest(value.holderRecipientKeyDigestB64u, "holderRecipientKeyDigestB64u"),
-		digest(value.holderCiphertextDigestSetB64u, "holderCiphertextDigestSetB64u"),
-		digest(value.sealedHolderRecordDigestB64u, "sealedHolderRecordDigestB64u"),
-		digest(value.transcriptHashB64u, "transcriptHashB64u"),
-		u64(value.acknowledgedAtMs, "acknowledgedAtMs")
-	]);
-}
-function encodeLaneServerActivationReceiptV1(value) {
-	return concat([
-		recordDomain(SERVER_ACTIVATION_RECEIPT_DOMAIN),
-		text(value.operationId, "operationId"),
-		text(value.enrollmentId, "enrollmentId"),
-		text(value.targetLaneId, "targetLaneId"),
-		text(value.targetLaneShareEpoch, "targetLaneShareEpoch"),
-		activationField(value.targetMaterialActivation, "targetMaterialActivation"),
-		digest(value.signingWorkerParticipantBindingDigestB64u, "signingWorkerParticipantBindingDigestB64u"),
-		digest(value.serverCiphertextDigestSetB64u, "serverCiphertextDigestSetB64u"),
-		digest(value.transcriptHashB64u, "transcriptHashB64u"),
-		u64(value.activatedAtMs, "activatedAtMs")
-	]);
-}
-function encodeEcdsaServerRetirementReceiptCanonicalPayloadV1(value) {
-	return concat([
-		recordDomain(ECDSA_RETIREMENT_RECEIPT_DOMAIN),
-		text(value.kind, "kind"),
-		text(value.manifest.manifestId, "manifest.manifestId"),
-		u64(value.manifest.manifestRevision, "manifest.manifestRevision"),
-		activationField(value.materialActivation, "materialActivation"),
-		text(value.walletKeyId, "walletKeyId"),
-		text(value.laneId, "laneId"),
-		text(value.laneShareEpoch, "laneShareEpoch"),
-		u64(value.revocationEpoch, "revocationEpoch"),
-		text(value.retirementReason, "retirementReason"),
-		text(value.retirementCorrelationId, "retirementCorrelationId"),
-		digest(value.retirementRequestDigestB64u, "retirementRequestDigestB64u"),
-		text(value.serverGeneration, "serverGeneration"),
-		text(value.lifecycleId, "lifecycleId"),
-		text(value.retiredAt, "retiredAt")
-	]);
-}
-async function computeEcdsaServerRetirementReceiptDigestV1(value) {
-	return sha256DigestB64u(encodeEcdsaServerRetirementReceiptCanonicalPayloadV1(value));
-}
-function encodeSigningWorkerLaneMaterialIdentityV1(value) {
-	return concat([
-		text(value.operationId, "identity.operationId"),
-		text(value.enrollmentId, "identity.enrollmentId"),
-		text(value.walletId, "identity.walletId"),
-		text(value.walletKeyId, "identity.walletKeyId"),
-		text(value.targetLaneId, "identity.targetLaneId"),
-		text(value.targetLaneShareEpoch, "identity.targetLaneShareEpoch"),
-		text(value.targetMaterialActivationId, "identity.targetMaterialActivationId"),
-		text(value.keyFamily, "identity.keyFamily"),
-		digest(value.holderParticipantBindingDigestB64u, "identity.holderParticipantBindingDigestB64u"),
-		digest(value.signingWorkerParticipantBindingDigestB64u, "identity.signingWorkerParticipantBindingDigestB64u"),
-		digest(value.holderRecipientKeyDigestB64u, "identity.holderRecipientKeyDigestB64u"),
-		digest(value.serverRecipientKeyDigestB64u, "identity.serverRecipientKeyDigestB64u"),
-		digest(value.transcriptHashB64u, "identity.transcriptHashB64u"),
-		digest(value.protocolCommitReceiptDigestB64u, "identity.protocolCommitReceiptDigestB64u")
-	]);
-}
-function encodeEd25519ServerRetirementReceiptCanonicalPayloadV1(value) {
-	return concat([
-		recordDomain(ED25519_RETIREMENT_RECEIPT_DOMAIN),
-		text(value.kind, "kind"),
-		encodeSigningWorkerLaneMaterialIdentityV1(value.identity),
-		u64(value.revocationEpoch, "revocationEpoch"),
-		text(value.retirementReason, "retirementReason"),
-		text(value.retirementCorrelationId, "retirementCorrelationId"),
-		digest(value.retirementRequestDigestB64u, "retirementRequestDigestB64u"),
-		u64(value.retiredAtMs, "retiredAtMs")
-	]);
-}
-async function computeEd25519ServerRetirementReceiptDigestV1(value) {
-	return sha256DigestB64u(encodeEd25519ServerRetirementReceiptCanonicalPayloadV1(value));
-}
-//#endregion
-export { computeAggregateLaneActivationReceiptDigestV1, computeAggregateLaneRevocationReceiptDigestV1, computeEcdsaServerRetirementReceiptDigestV1, computeEd25519ServerRetirementReceiptDigestV1, computeEd25519YaoLaneSessionDigestV1, computeLaneEnrollmentManifestDigestV1, computeRevokeSigningLaneDigestV1, encodeLaneHolderDeliveryReceiptV1, encodeLaneProtocolCommitReceiptV1, encodeLaneServerActivationReceiptV1 };
-
-//# sourceMappingURL=rotationDigests.js.map

package/dist/esm/shared-ts/src/signing-lanes/rotationLifecycle.js

@@ -1,313 +0,0 @@
-//#region ../shared-ts/src/signing-lanes/rotationLifecycle.ts
-function requireForwardTime(previous, next, label) {
-	if (!Number.isSafeInteger(next) || next < previous) throw new Error(`${label} must be a safe timestamp at or after ${previous}`);
-}
-function transitionLaneProtocolLifecycleV1(current, transition) {
-	switch (current.state) {
-		case "preparing":
-			if (transition.action === "await_protocol_commitment") {
-				requireForwardTime(current.startedAtMs, transition.atMs, "await_protocol_commitment.atMs");
-				return {
-					state: "awaiting_protocol_commitment",
-					startedAtMs: current.startedAtMs
-				};
-			}
-			if (transition.action === "abort_precommit") {
-				requireForwardTime(current.startedAtMs, transition.abortedAtMs, "abort_precommit.abortedAtMs");
-				return {
-					state: "aborted_precommit",
-					startedAtMs: current.startedAtMs,
-					abortedAtMs: transition.abortedAtMs,
-					abortReason: transition.abortReason
-				};
-			}
-			break;
-		case "awaiting_protocol_commitment":
-			if (transition.action === "record_commit") {
-				requireForwardTime(current.startedAtMs, transition.committedAtMs, "record_commit.committedAtMs");
-				return {
-					state: "committed_awaiting_holder_delivery",
-					startedAtMs: current.startedAtMs,
-					committedAtMs: transition.committedAtMs,
-					transcriptHashB64u: transition.transcriptHashB64u,
-					protocolCommitReceiptDigestB64u: transition.protocolCommitReceiptDigestB64u
-				};
-			}
-			if (transition.action === "abort_precommit") {
-				requireForwardTime(current.startedAtMs, transition.abortedAtMs, "abort_precommit.abortedAtMs");
-				return {
-					state: "aborted_precommit",
-					startedAtMs: current.startedAtMs,
-					abortedAtMs: transition.abortedAtMs,
-					abortReason: transition.abortReason
-				};
-			}
-			break;
-		case "committed_awaiting_holder_delivery":
-			if (transition.action === "record_holder_delivery") {
-				requireForwardTime(current.committedAtMs, transition.holderReceiptAtMs, "record_holder_delivery.holderReceiptAtMs");
-				return {
-					state: "awaiting_server_activation",
-					startedAtMs: current.startedAtMs,
-					committedAtMs: current.committedAtMs,
-					transcriptHashB64u: current.transcriptHashB64u,
-					protocolCommitReceiptDigestB64u: current.protocolCommitReceiptDigestB64u,
-					holderDeliveryReceiptDigestB64u: transition.holderDeliveryReceiptDigestB64u,
-					holderReceiptAtMs: transition.holderReceiptAtMs
-				};
-			}
-			if (transition.action === "require_completion") return {
-				state: "committed_completion_required",
-				startedAtMs: current.startedAtMs,
-				committedAtMs: current.committedAtMs,
-				transcriptHashB64u: current.transcriptHashB64u,
-				protocolCommitReceiptDigestB64u: current.protocolCommitReceiptDigestB64u,
-				recoveryReason: transition.recoveryReason
-			};
-			break;
-		case "awaiting_server_activation":
-			if (transition.action === "record_server_activation") {
-				requireForwardTime(current.holderReceiptAtMs, transition.serverActivatedAtMs, "record_server_activation.serverActivatedAtMs");
-				return {
-					state: "ready_for_parent_visibility",
-					startedAtMs: current.startedAtMs,
-					committedAtMs: current.committedAtMs,
-					transcriptHashB64u: current.transcriptHashB64u,
-					protocolCommitReceiptDigestB64u: current.protocolCommitReceiptDigestB64u,
-					holderDeliveryReceiptDigestB64u: current.holderDeliveryReceiptDigestB64u,
-					holderReceiptAtMs: current.holderReceiptAtMs,
-					serverActivationReceiptDigestB64u: transition.serverActivationReceiptDigestB64u,
-					serverActivatedAtMs: transition.serverActivatedAtMs
-				};
-			}
-			break;
-		case "ready_for_parent_visibility":
-			if (transition.action === "activate") {
-				requireForwardTime(current.serverActivatedAtMs, transition.activatedAtMs, "activate.activatedAtMs");
-				return {
-					state: "active",
-					transcriptHashB64u: current.transcriptHashB64u,
-					protocolCommitReceiptDigestB64u: current.protocolCommitReceiptDigestB64u,
-					holderDeliveryReceiptDigestB64u: current.holderDeliveryReceiptDigestB64u,
-					serverActivationReceiptDigestB64u: current.serverActivationReceiptDigestB64u,
-					aggregateActivationReceiptDigestB64u: transition.aggregateActivationReceiptDigestB64u,
-					activatedAtMs: transition.activatedAtMs
-				};
-			}
-			break;
-		case "committed_completion_required":
-			if (transition.action === "resume_completion") {
-				requireForwardTime(current.committedAtMs, transition.atMs, "resume_completion.atMs");
-				return {
-					state: "committed_awaiting_holder_delivery",
-					startedAtMs: current.startedAtMs,
-					committedAtMs: current.committedAtMs,
-					transcriptHashB64u: current.transcriptHashB64u,
-					protocolCommitReceiptDigestB64u: current.protocolCommitReceiptDigestB64u
-				};
-			}
-			break;
-		case "active":
-		case "aborted_precommit": break;
-	}
-	throw new Error(`invalid lane protocol lifecycle transition: ${current.state} -> ${transition.action}`);
-}
-function transitionLaneEnrollmentLifecycleV1(current, transition) {
-	switch (current.state) {
-		case "preparing":
-			if (transition.action === "mark_committed_completion_required") {
-				requireForwardTime(current.startedAtMs, transition.markedAtMs, "markedAtMs");
-				if (transition.committedChildOperationIds.length === 0) throw new Error("committed children must be non-empty");
-				return {
-					state: "committed_completion_required",
-					manifestDigestB64u: current.manifestDigestB64u,
-					committedChildOperationIds: transition.committedChildOperationIds,
-					markedAtMs: transition.markedAtMs
-				};
-			}
-			if (transition.action === "cancel_precommit") {
-				requireForwardTime(current.startedAtMs, transition.cancelledAtMs, "cancelledAtMs");
-				return {
-					state: "cancelled_precommit",
-					cancelledAtMs: transition.cancelledAtMs
-				};
-			}
-			break;
-		case "committed_completion_required":
-			if (transition.action === "mark_ready_for_visibility") {
-				requireForwardTime(current.markedAtMs, transition.readyAtMs, "readyAtMs");
-				return {
-					state: "ready_for_visibility",
-					manifestDigestB64u: current.manifestDigestB64u,
-					aggregateReceiptDigestB64u: transition.aggregateReceiptDigestB64u,
-					readyAtMs: transition.readyAtMs
-				};
-			}
-			if (transition.action === "begin_revocation") {
-				requireForwardTime(current.markedAtMs, transition.markedAtMs, "markedAtMs");
-				return {
-					state: "revoking_committed_targets",
-					manifestDigestB64u: current.manifestDigestB64u,
-					reason: transition.reason,
-					markedAtMs: transition.markedAtMs
-				};
-			}
-			break;
-		case "ready_for_visibility":
-			if (transition.action === "activate") {
-				requireForwardTime(current.readyAtMs, transition.activatedAtMs, "activatedAtMs");
-				return {
-					state: "active",
-					manifestDigestB64u: current.manifestDigestB64u,
-					aggregateReceiptDigestB64u: current.aggregateReceiptDigestB64u,
-					activatedAtMs: transition.activatedAtMs
-				};
-			}
-			if (transition.action === "begin_revocation") {
-				requireForwardTime(current.readyAtMs, transition.markedAtMs, "markedAtMs");
-				return {
-					state: "revoking_committed_targets",
-					manifestDigestB64u: current.manifestDigestB64u,
-					reason: transition.reason,
-					markedAtMs: transition.markedAtMs
-				};
-			}
-			break;
-		case "active":
-			if (transition.action === "begin_revocation") {
-				requireForwardTime(current.activatedAtMs, transition.markedAtMs, "markedAtMs");
-				return {
-					state: "revoking_committed_targets",
-					manifestDigestB64u: current.manifestDigestB64u,
-					reason: transition.reason,
-					markedAtMs: transition.markedAtMs
-				};
-			}
-			break;
-		case "revoking_committed_targets":
-			if (transition.action === "revoke") {
-				requireForwardTime(current.markedAtMs, transition.revokedAtMs, "revokedAtMs");
-				return {
-					state: "revoked",
-					manifestDigestB64u: current.manifestDigestB64u,
-					aggregateRevocationReceiptDigestB64u: transition.aggregateRevocationReceiptDigestB64u,
-					revokedAtMs: transition.revokedAtMs
-				};
-			}
-			break;
-		case "cancelled_precommit":
-		case "revoked": break;
-	}
-	throw new Error(`invalid enrollment lifecycle transition: ${current.state} -> ${transition.action}`);
-}
-function activateLaneProductEpochV1(current, args) {
-	requireForwardTime(current.pendingSinceMs, args.activatedAtMs, "activatedAtMs");
-	return {
-		kind: "lane_product_epoch_record_v1",
-		state: "active",
-		walletId: current.walletId,
-		walletKeyId: current.walletKeyId,
-		laneId: current.laneId,
-		laneKind: current.laneKind,
-		laneShareEpoch: current.laneShareEpoch,
-		keyFamily: current.keyFamily,
-		enrollmentId: current.enrollmentId,
-		operationId: current.operationId,
-		targetMaterialActivationId: current.targetMaterialActivationId,
-		materialActivation: current.materialActivation,
-		publicIdentityDigestB64u: current.publicIdentityDigestB64u,
-		holderParticipant: current.holderParticipant,
-		signingWorkerParticipant: current.signingWorkerParticipant,
-		participantSetBindingDigestB64u: current.participantSetBindingDigestB64u,
-		revocationEpoch: current.revocationEpoch,
-		createdAtMs: current.createdAtMs,
-		aggregateManifestDigestB64u: current.aggregateManifestDigestB64u,
-		aggregateActivationReceiptDigestB64u: args.aggregateActivationReceiptDigestB64u,
-		activatedAtMs: args.activatedAtMs
-	};
-}
-function retireFencedLaneProductEpochV1(current, args) {
-	requireForwardTime(current.revocationRequestedAtMs, args.retiredAtMs, "retiredAtMs");
-	if (current.revocationReason !== "rotation") throw new Error("only a rotation fence can retire a refresh predecessor");
-	return {
-		kind: "lane_product_epoch_record_v1",
-		state: "retired",
-		walletId: current.walletId,
-		walletKeyId: current.walletKeyId,
-		laneId: current.laneId,
-		laneKind: current.laneKind,
-		laneShareEpoch: current.laneShareEpoch,
-		keyFamily: current.keyFamily,
-		enrollmentId: current.enrollmentId,
-		operationId: current.operationId,
-		targetMaterialActivationId: current.targetMaterialActivationId,
-		materialActivation: current.materialActivation,
-		publicIdentityDigestB64u: current.publicIdentityDigestB64u,
-		holderParticipant: current.holderParticipant,
-		signingWorkerParticipant: current.signingWorkerParticipant,
-		participantSetBindingDigestB64u: current.participantSetBindingDigestB64u,
-		revocationEpoch: current.revocationEpoch,
-		createdAtMs: current.createdAtMs,
-		retirementReason: "rotation",
-		retirementReceiptDigestB64u: args.retirementReceiptDigestB64u,
-		retiredAtMs: args.retiredAtMs
-	};
-}
-function beginLaneProductEpochRevocationV1(current, args) {
-	requireForwardTime(current.state === "pending_visibility" ? current.pendingSinceMs : current.activatedAtMs, args.revocationRequestedAtMs, "revocationRequestedAtMs");
-	if (!Number.isSafeInteger(args.revocationEpoch) || args.revocationEpoch < 0) throw new Error("revocationEpoch must be a non-negative safe integer");
-	return {
-		kind: "lane_product_epoch_record_v1",
-		state: "revocation_pending",
-		walletId: current.walletId,
-		walletKeyId: current.walletKeyId,
-		laneId: current.laneId,
-		laneKind: current.laneKind,
-		laneShareEpoch: current.laneShareEpoch,
-		keyFamily: current.keyFamily,
-		enrollmentId: current.enrollmentId,
-		operationId: current.operationId,
-		targetMaterialActivationId: current.targetMaterialActivationId,
-		materialActivation: current.materialActivation,
-		publicIdentityDigestB64u: current.publicIdentityDigestB64u,
-		holderParticipant: current.holderParticipant,
-		signingWorkerParticipant: current.signingWorkerParticipant,
-		participantSetBindingDigestB64u: current.participantSetBindingDigestB64u,
-		createdAtMs: current.createdAtMs,
-		revocationEpoch: args.revocationEpoch,
-		revocationReason: args.revocationReason,
-		retirementEffectBindingDigestB64u: args.retirementEffectBindingDigestB64u,
-		revocationRequestedAtMs: args.revocationRequestedAtMs
-	};
-}
-function completeLaneProductEpochRevocationV1(current, args) {
-	requireForwardTime(current.revocationRequestedAtMs, args.revokedAtMs, "revokedAtMs");
-	return {
-		kind: "lane_product_epoch_record_v1",
-		state: "revoked",
-		walletId: current.walletId,
-		walletKeyId: current.walletKeyId,
-		laneId: current.laneId,
-		laneKind: current.laneKind,
-		laneShareEpoch: current.laneShareEpoch,
-		keyFamily: current.keyFamily,
-		enrollmentId: current.enrollmentId,
-		operationId: current.operationId,
-		targetMaterialActivationId: current.targetMaterialActivationId,
-		materialActivation: current.materialActivation,
-		publicIdentityDigestB64u: current.publicIdentityDigestB64u,
-		holderParticipant: current.holderParticipant,
-		signingWorkerParticipant: current.signingWorkerParticipant,
-		participantSetBindingDigestB64u: current.participantSetBindingDigestB64u,
-		createdAtMs: current.createdAtMs,
-		revocationEpoch: current.revocationEpoch,
-		revocationReason: current.revocationReason,
-		retirementEffectBindingDigestB64u: current.retirementEffectBindingDigestB64u,
-		revocationReceiptDigestB64u: args.revocationReceiptDigestB64u,
-		revokedAtMs: args.revokedAtMs
-	};
-}
-//#endregion
-export { activateLaneProductEpochV1, beginLaneProductEpochRevocationV1, completeLaneProductEpochRevocationV1, retireFencedLaneProductEpochV1, transitionLaneEnrollmentLifecycleV1, transitionLaneProtocolLifecycleV1 };
-
-//# sourceMappingURL=rotationLifecycle.js.map