@seams/wallet 0.6.2 → 0.7.3

package/dist/esm/sdk/ecdsaPresignLifecycle-Bfx2AQKb.js

@@ -0,0 +1,1983 @@
+import { D as parseWalletAuthorityId, E as parseWalletAuthorityBindingDigest, M as parseWebAuthnRpId, O as parseWalletId, T as parseWalletAuthMethodId, a as parseEcdsaActiveStateId, d as parseLinkedDeviceId, h as parseMpcMaterialActivationRef, j as parseWebAuthnCredentialIdB64u, k as parseWalletKeyId, l as parseLinkDeviceSessionId, r as mpcMaterialActivationRefsEqual, s as parseEmailOtpProviderUserId, u as parseLinkedDeviceEnrollmentId, w as parseVerifiedEmailAddress, x as parseThresholdEcdsaSessionId, y as parseRootShareEpoch } from "./domainIds-lcrFg6Sa.js";
+import { _ as requireRecord, i as coerceNonEmptyString } from "./validation-gat4LEKm.js";
+import { i as base64UrlEncode, r as base64UrlDecode } from "./base64-Clm8C-e9.js";
+import { D as parseUnixMs, F as exactRecord, I as rejectUnknownFields, M as parseDelegatedWalletAuthorityV1, h as normalizeRuntimePolicyScope, v as deriveEvmFamilySigningKeySlotId } from "./sessionPolicy-DO-MkL65.js";
+import { d as parseMpcWalletSigningQuotaId, g as parseWalletSessionMintId, h as parseWalletSessionId, l as parseDeviceId, m as parseWalletSessionAuthorizationId, n as EVM_ECDSA_MPC_OPERATION_KINDS, u as parseEcdsaAuthorizationSessionId } from "./capabilityKinds-hvYqa6S_.js";
+import { f as alphabetizeStringify, m as sha256BytesUtf8 } from "./chains-BMh3btVo.js";
+import { n as parseCorrelationId, r as parseDigestB64u } from "./canonicalPrimitives-BTHWz80v.js";
+//#region ../shared-ts/src/utils/wireSchema.ts
+/** One of the given strings. */
+function wireLiteral(...literals) {
+	const parse = (raw, label) => {
+		if (!literals.includes(raw)) throw new Error(`${label} is invalid`);
+		return raw;
+	};
+	return Object.assign(parse, { literals });
+}
+/**
+* An object with exactly the fields of `shape`, all required, returned in the shape's order.
+* Checks run in this order: exact keys, then literals (they say which record this is), then
+* the other fields in declaration order, then `refine`'s cross-field rules.
+*/
+function wireObject(shape, refine) {
+	const keys = Object.keys(shape);
+	const order = [...keys.filter((key) => "literals" in shape[key]), ...keys.filter((key) => !("literals" in shape[key]))];
+	const parse = (raw, label) => {
+		const record = exactRecord(raw, keys, label);
+		const parsed = /* @__PURE__ */ new Map();
+		for (const key of order) parsed.set(key, shape[key](record[key], `${label}.${key}`));
+		const value = Object.fromEntries(keys.map((key) => [key, parsed.get(key)]));
+		refine?.(value, label);
+		return value;
+	};
+	return Object.assign(parse, { shape });
+}
+/** One of `variants`, chosen by the literal each declares for field `tag`. */
+function wireUnion(tag, variants) {
+	const byTag = /* @__PURE__ */ new Map();
+	for (const variant of variants) for (const literal of variant.shape[tag].literals) byTag.set(literal, variant);
+	return (raw, label) => {
+		const record = requireRecord(raw, label);
+		const variant = byTag.get(record[tag]);
+		if (!variant) throw new Error(`${label}.${tag} is invalid`);
+		return variant(record, label);
+	};
+}
+/** `null`, or a value `parse` accepts. */
+function wireNullable(parse) {
+	return (raw, label) => raw === null ? null : parse(raw, label);
+}
+/** Adapts a parser that returns a result, putting the field's label before its error. */
+function wireResult(parse) {
+	return (raw, label) => {
+		const result = parse(raw);
+		if (result.ok) return result.value;
+		throw new Error(`${label} ${result.error.message}`);
+	};
+}
+/** Adapts a parser that throws, putting the field's label before its error. */
+function wireLabeled(parse) {
+	return (raw, label) => {
+		try {
+			return parse(raw);
+		} catch (error) {
+			throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
+		}
+	};
+}
+//#endregion
+//#region ../shared-ts/src/device-linking/wireFields.ts
+const sessionId = /* @__PURE__ */ wireResult(parseLinkDeviceSessionId);
+const walletId = /* @__PURE__ */ wireResult(parseWalletId);
+const enrollmentId = /* @__PURE__ */ wireResult(parseLinkedDeviceEnrollmentId);
+const linkedDeviceId = /* @__PURE__ */ wireResult(parseLinkedDeviceId);
+const authorizationDeviceId = /* @__PURE__ */ wireResult(parseDeviceId);
+const walletKeyId = /* @__PURE__ */ wireResult(parseWalletKeyId);
+const walletSessionId = /* @__PURE__ */ wireResult(parseWalletSessionId);
+const walletSessionAuthorizationId = /* @__PURE__ */ wireResult(parseWalletSessionAuthorizationId);
+const walletAuthMethodId = /* @__PURE__ */ wireResult(parseWalletAuthMethodId);
+const walletAuthorityId = /* @__PURE__ */ wireResult(parseWalletAuthorityId);
+const credentialId = /* @__PURE__ */ wireResult(parseWebAuthnCredentialIdB64u);
+const rpId = /* @__PURE__ */ wireResult(parseWebAuthnRpId);
+const quotaId = /* @__PURE__ */ wireResult(parseMpcWalletSigningQuotaId);
+const materialActivation = /* @__PURE__ */ wireResult(parseMpcMaterialActivationRef);
+const digest = /* @__PURE__ */ wireLabeled(parseDigestB64u);
+const nullableToken = /* @__PURE__ */ wireNullable(parseNonEmptyToken);
+function keyLabeled(parse) {
+	return (raw, label) => parse(raw, label.slice(label.lastIndexOf(".") + 1));
+}
+function parseUnixTime(raw, label) {
+	try {
+		return parseUnixMs(raw, label);
+	} catch (error) {
+		throw new Error(error instanceof Error ? error.message : `${label} is invalid`);
+	}
+}
+function parseNonEmptyToken(raw, label) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw) throw new Error(`${label} must be a non-empty canonical string`);
+	for (const character of raw) {
+		const code = character.charCodeAt(0);
+		if (/\s/.test(character) || code <= 31 || code === 127) throw new Error(`${label} must not contain whitespace or control characters`);
+	}
+	return raw;
+}
+function parseNonNegativeSafeInteger(raw, label) {
+	if (!Number.isSafeInteger(raw) || Number(raw) < 0) throw new Error(`${label} must be a non-negative safe integer`);
+	return Number(raw);
+}
+function parseDelegatedWalletAuthority(raw, label) {
+	const result = parseDelegatedWalletAuthorityV1(raw);
+	if (!result.ok) throw new Error(`${label}: ${result.error.message}`);
+	return result.value;
+}
+function parseTargetEmail(raw, label) {
+	const parsed = parseVerifiedEmailAddress(raw);
+	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
+	return parsed.value;
+}
+//#endregion
+//#region ../shared-ts/src/device-linking/activeWalletSession.ts
+function activeWalletSessionV1RecordsEqual(left, right) {
+	if (left.kind !== right.kind || left.walletId !== right.walletId || left.authorityId !== right.authorityId || left.authMethodId !== right.authMethodId || left.authorizationId !== right.authorizationId || left.quotaId !== right.quotaId || left.authorityDigestB64u !== right.authorityDigestB64u || left.authorityRevocationEpoch !== right.authorityRevocationEpoch || left.issuedAtMs !== right.issuedAtMs || left.expiresAtMs !== right.expiresAtMs || left.capabilitySubjects.length !== right.capabilitySubjects.length) return false;
+	for (let index = 0; index < left.capabilitySubjects.length; index += 1) {
+		const leftSubject = left.capabilitySubjects[index];
+		const rightSubject = right.capabilitySubjects[index];
+		if (!leftSubject || !rightSubject || !walletCapabilitySubjectsEqual(leftSubject, rightSubject)) return false;
+	}
+	return true;
+}
+function walletCapabilitySubjectsEqual(left, right) {
+	switch (left.kind) {
+		case "link_devices":
+		case "revoke_devices": return right.kind === left.kind;
+		case "sign":
+		case "export_keys": return right.kind === left.kind && right.keyFamily === left.keyFamily && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
+		default: return false;
+	}
+}
+function walletSessionPreservesCapabilities(previous, next) {
+	for (const subject of previous.capabilitySubjects) {
+		let retained = false;
+		for (const candidate of next.capabilitySubjects) if (walletCapabilitySubjectsEqual(subject, candidate)) {
+			retained = true;
+			break;
+		}
+		if (!retained) return false;
+	}
+	return true;
+}
+function walletSessionOperationCredentialV1() {
+	return wireObject({
+		kind: wireLiteral("opaque_wallet_session_operation_credential_v1"),
+		token: (raw, label) => {
+			if (typeof raw !== "string" || raw.length > 8192) throw new Error(`${label} is invalid`);
+			return raw;
+		},
+		walletSessionId: keyLabeled(walletSessionId)
+	}, (credential, label) => {
+		if (!/^wst_[A-Za-z0-9_-]{43}$/.test(credential.token)) throw new Error(`${label} opaque token is invalid`);
+	});
+}
+function parseWalletSessionOperationCredentialV1(raw) {
+	return walletSessionOperationCredentialV1()(raw, "WalletSessionOperationCredentialV1");
+}
+function capabilitySubjectKey(subject) {
+	return subject.kind === "sign" || subject.kind === "export_keys" ? `${subject.kind}:${subject.keyFamily}:${subject.materialActivation.activationId}` : subject.kind;
+}
+function activeWalletSessionV1() {
+	return wireObject({
+		kind: wireLiteral("active_wallet_session_v1"),
+		walletId: keyLabeled(walletId),
+		authorityId: keyLabeled(walletAuthorityId),
+		authMethodId: keyLabeled(walletAuthMethodId),
+		authorizationId: keyLabeled(walletSessionAuthorizationId),
+		quotaId: keyLabeled(quotaId),
+		authorityDigestB64u: keyLabeled(digest),
+		authorityRevocationEpoch: keyLabeled(parseNonNegativeSafeInteger),
+		capabilitySubjects: (raw, label) => {
+			if (!Array.isArray(raw) || raw.length === 0) throw new Error(`${label} must be non-empty`);
+			const subjects = [];
+			for (const [index, subject] of raw.entries()) subjects.push(parseWalletCapabilitySubjectV1(subject, `capabilitySubjects[${index}]`));
+			const first = subjects[0];
+			if (!first) throw new Error(`${label} must be non-empty`);
+			return [first, ...subjects.slice(1)];
+		},
+		issuedAtMs: keyLabeled(parseUnixTime),
+		expiresAtMs: keyLabeled(parseUnixTime)
+	}, (session, label) => {
+		const keys = session.capabilitySubjects.map(capabilitySubjectKey);
+		if (new Set(keys).size !== keys.length) throw new Error(`${label} capability subjects repeat`);
+	});
+}
+function parseActiveWalletSessionV1(raw) {
+	return activeWalletSessionV1()(raw, "ActiveWalletSessionV1");
+}
+function parseWalletCapabilitySubjectV1(raw, label) {
+	const record = requireRecord(raw, label);
+	if (record.kind === "link_devices" || record.kind === "revoke_devices") {
+		rejectUnknownFields(record, ["kind"], label);
+		return { kind: record.kind };
+	}
+	if (record.kind !== "sign" && record.kind !== "export_keys") throw new Error(`${label}.kind is invalid`);
+	rejectUnknownFields(record, [
+		"kind",
+		"keyFamily",
+		"materialActivation"
+	], label);
+	if (record.keyFamily !== "ed25519" && record.keyFamily !== "ecdsa_secp256k1") throw new Error(`${label}.keyFamily is invalid`);
+	return {
+		kind: record.kind,
+		keyFamily: record.keyFamily,
+		materialActivation: materialActivation(record.materialActivation, `${label}.materialActivation`)
+	};
+}
+//#endregion
+//#region ../shared-ts/src/utils/routerAbPublicKeyset.ts
+function requireRouterAbX25519PublicKey(value, label) {
+	const publicKey = coerceNonEmptyString(value, label);
+	if (!/^x25519:[0-9a-f]{64}$/.test(publicKey)) throw new Error(`${label} must use x25519:<64 lowercase hex chars> encoding`);
+	return publicKey;
+}
+//#endregion
+//#region ../shared-ts/src/utils/routerAbNormalSigningIdentity.ts
+function requireExactFields(record, expectedFields, label) {
+	const actualFields = Object.keys(record).sort();
+	const expected = [...expectedFields].sort();
+	if (actualFields.length !== expected.length || actualFields.some((field, index) => field !== expected[index])) throw new Error(`${label} has invalid fields`);
+}
+function requireAsciiString(value, label) {
+	if (typeof value !== "string" || value.trim() !== value || !value) throw new Error(`${label} is required`);
+	if (!/^[\x20-\x7e]+$/.test(value)) throw new Error(`${label} must be printable ASCII`);
+	return value;
+}
+function parseRouterAbNormalSigningAuthorization(value) {
+	const authorization = requireRecord(value, "authorization");
+	switch (authorization.kind) {
+		case "reusable_wallet_session":
+			requireExactFields(authorization, ["kind", "wallet_session_id"], "authorization");
+			return {
+				kind: "reusable_wallet_session",
+				wallet_session_id: requireAsciiString(authorization.wallet_session_id, "authorization.wallet_session_id")
+			};
+		case "operation_step_up":
+			requireExactFields(authorization, ["kind"], "authorization");
+			return { kind: "operation_step_up" };
+		default: throw new Error("authorization.kind is not supported");
+	}
+}
+function parseRouterAbMpcMaterialActivationRef(value) {
+	const activation = requireRecord(value, "material_activation");
+	requireExactFields(activation, [
+		"kind",
+		"activation_id",
+		"capability",
+		"material_owner",
+		"key_binding",
+		"lifecycle_binding",
+		"signing_worker"
+	], "material_activation");
+	if (activation.kind !== "mpc_material_activation_ref") throw new Error("material_activation.kind is not supported");
+	return {
+		kind: "mpc_material_activation_ref",
+		activation_id: requireAsciiString(activation.activation_id, "material_activation.activation_id"),
+		capability: requireAsciiString(activation.capability, "material_activation.capability"),
+		material_owner: requireAsciiString(activation.material_owner, "material_activation.material_owner"),
+		key_binding: requireAsciiString(activation.key_binding, "material_activation.key_binding"),
+		lifecycle_binding: requireAsciiString(activation.lifecycle_binding, "material_activation.lifecycle_binding"),
+		signing_worker: requireAsciiString(activation.signing_worker, "material_activation.signing_worker")
+	};
+}
+function routerAbMpcMaterialActivationRefToWire(input) {
+	return parseRouterAbMpcMaterialActivationRef({
+		kind: input.kind,
+		activation_id: input.activationId,
+		capability: input.capability,
+		material_owner: input.materialOwner,
+		key_binding: input.keyBinding,
+		lifecycle_binding: input.lifecycleBinding,
+		signing_worker: input.signingWorker
+	});
+}
+function routerAbMpcMaterialActivationRefFromWire(value) {
+	const wire = parseRouterAbMpcMaterialActivationRef(value);
+	const parsed = parseMpcMaterialActivationRef({
+		kind: wire.kind,
+		activationId: wire.activation_id,
+		capability: wire.capability,
+		materialOwner: wire.material_owner,
+		keyBinding: wire.key_binding,
+		lifecycleBinding: wire.lifecycle_binding,
+		signingWorker: wire.signing_worker
+	});
+	if (!parsed.ok) throw new Error(`material_activation is invalid: ${parsed.error.message}`);
+	return parsed.value;
+}
+function asciiBytes$1(value) {
+	return new TextEncoder().encode(value);
+}
+function appendLen32(out, value) {
+	const bytes = asciiBytes$1(value);
+	const length = bytes.length >>> 0;
+	out.push(length >>> 24 & 255, length >>> 16 & 255, length >>> 8 & 255, length & 255);
+	out.push(...bytes);
+}
+function canonicalRouterAbNormalSigningAuthorizationBytes(value) {
+	const authorization = parseRouterAbNormalSigningAuthorization(value);
+	const out = [];
+	appendLen32(out, authorization.kind);
+	switch (authorization.kind) {
+		case "reusable_wallet_session":
+			appendLen32(out, authorization.wallet_session_id);
+			break;
+		case "operation_step_up": break;
+	}
+	return new Uint8Array(out);
+}
+function canonicalRouterAbMpcMaterialActivationRefBytes(value) {
+	const activation = parseRouterAbMpcMaterialActivationRef(value);
+	const out = [];
+	appendLen32(out, activation.kind);
+	appendLen32(out, activation.activation_id);
+	appendLen32(out, activation.capability);
+	appendLen32(out, activation.material_owner);
+	appendLen32(out, activation.key_binding);
+	appendLen32(out, activation.lifecycle_binding);
+	appendLen32(out, activation.signing_worker);
+	return new Uint8Array(out);
+}
+function sameRouterAbMpcMaterialActivationRef(left, right) {
+	return left.kind === right.kind && left.activation_id === right.activation_id && left.capability === right.capability && left.material_owner === right.material_owner && left.key_binding === right.key_binding && left.lifecycle_binding === right.lifecycle_binding && left.signing_worker === right.signing_worker;
+}
+//#endregion
+//#region ../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.ts
+const THRESHOLD_SECP256K1_ECDSA_2P_V1_SCHEME_ID = "threshold-secp256k1-ecdsa-2p-v1";
+function ecdsaClientRootPublicKey33B64uFromString(value) {
+	const normalized = value.trim();
+	const bytes = base64UrlDecode(normalized);
+	if (bytes.length !== 33 || base64UrlEncode(bytes) !== normalized) throw new Error("ECDSA client root public key must be canonical base64url for 33 bytes");
+	return normalized;
+}
+function requireSdkBindingFactString(value, field) {
+	const normalized = String(value ?? "").trim();
+	if (!normalized) throw new Error(`${field} is required`);
+	return normalized;
+}
+function parseSdkEcdsaDerivationThresholdKeyId(value) {
+	return requireSdkBindingFactString(value, "ecdsaThresholdKeyId");
+}
+function parseSdkEcdsaDerivationSigningRootId(value) {
+	return requireSdkBindingFactString(value, "signingRootId");
+}
+function parseSdkEcdsaDerivationSigningRootVersion(value) {
+	return requireSdkBindingFactString(value, "signingRootVersion");
+}
+async function computeEcdsaDerivationRoleLocalRelayerKeyId(input) {
+	const evmFamilySigningKeySlotId = deriveEvmFamilySigningKeySlotId(input);
+	return `ederivation-relayer-${base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		version: "threshold_ecdsa_derivation_relayer_key_id_v1",
+		schemeId: THRESHOLD_SECP256K1_ECDSA_2P_V1_SCHEME_ID,
+		walletId: input.walletId,
+		evmFamilySigningKeySlotId
+	})))}`;
+}
+//#endregion
+//#region ../shared-ts/src/utils/ecdsaCapabilityActivation.ts
+function parseNonEmptyString(value, label) {
+	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error(`${label} must be a non-empty canonical string`);
+	return value;
+}
+function parseCanonicalBase64Url(value, label, byteLength) {
+	if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(`${label} must be unpadded base64url`);
+	let bytes;
+	try {
+		bytes = base64UrlDecode(value);
+	} catch {
+		throw new Error(`${label} must be valid base64url`);
+	}
+	if (bytes.length === 0 || byteLength !== null && bytes.length !== byteLength || base64UrlEncode(bytes) !== value) throw new Error(`${label} has an invalid canonical byte length`);
+	return value;
+}
+function parseEvmFamilyEcdsaSignerId(value) {
+	return parseNonEmptyString(value, "ECDSA signer id");
+}
+function parseEcdsaServerGeneration(value) {
+	return parseNonEmptyString(value, "ECDSA server generation");
+}
+function parseEcdsaCapabilityManifestId(value) {
+	return parseNonEmptyString(value, "ECDSA manifest id");
+}
+function parseEcdsaCapabilityManifestRevision(value) {
+	if (!Number.isSafeInteger(value) || Number(value) < 1) throw new Error("ECDSA manifest revision must be a positive safe integer");
+	return value;
+}
+function parseEcdsaCiphertextDigest(value) {
+	return parseCanonicalBase64Url(value, "ECDSA ciphertext digest", 32);
+}
+function parseEcdsaPendingCiphertextDigest(value) {
+	return parseCanonicalBase64Url(value, "ECDSA pending ciphertext digest", 32);
+}
+function parseEcdsaActivationDigest(value) {
+	return parseCanonicalBase64Url(value, "ECDSA activation digest", 32);
+}
+function parseEcdsaLifecycleId(value) {
+	return parseNonEmptyString(value, "ECDSA lifecycle id");
+}
+function parseEcdsaMaterialSealingKeyId(value) {
+	return parseNonEmptyString(value, "ECDSA material sealing key id");
+}
+function parseEcdsaIv12B64u(value) {
+	return parseCanonicalBase64Url(value, "ECDSA AES-GCM IV", 12);
+}
+function parseEcdsaCiphertextB64u(value) {
+	return parseCanonicalBase64Url(value, "ECDSA ciphertext", null);
+}
+function parseCanonicalEcdsaServerActivationRequest(value) {
+	if (typeof value !== "string" || value.trim() !== value) throw new Error("ECDSA server activation request must be canonical JSON");
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		throw new Error("ECDSA server activation request must be canonical JSON");
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed) || alphabetizeStringify(parsed) !== value) throw new Error("ECDSA server activation request must be a canonical JSON object");
+	return value;
+}
+//#endregion
+//#region ../shared-ts/src/utils/walletAuthAuthority.ts
+const WALLET_AUTHORITY_BINDING_DIGEST_DOMAIN = "seams:wallet-authority-binding:v1|";
+function isPasskeyWalletAuthAuthority(authority) {
+	return authority.factor.kind === "passkey";
+}
+function isEmailOtpWalletAuthAuthority(authority) {
+	return authority.factor.kind === "email_otp";
+}
+function walletAuthAuthoritiesMatch(left, right) {
+	if (left.walletId !== right.walletId || left.bindingId !== right.bindingId) return false;
+	if (isPasskeyWalletAuthAuthority(left)) {
+		if (!isPasskeyWalletAuthAuthority(right)) return false;
+		return left.factor.credentialIdB64u === right.factor.credentialIdB64u && left.verifier.rpId === right.verifier.rpId;
+	}
+	if (isEmailOtpWalletAuthAuthority(left)) {
+		if (!isEmailOtpWalletAuthAuthority(right)) return false;
+		return left.factor.provider === right.factor.provider && left.factor.providerUserId === right.factor.providerUserId && left.verifier.emailHashHex === right.verifier.emailHashHex;
+	}
+	return false;
+}
+function parseWalletAuthAuthorityRef(raw) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const record = raw;
+	const fields = Object.keys(record);
+	if (fields.length !== 4 || !fields.every((field) => [
+		"kind",
+		"walletId",
+		"authorityDigest",
+		"walletAuthMethodId"
+	].includes(field)) || record.kind !== "wallet_auth_authority_ref") return null;
+	const walletId = parseWalletId(record.walletId);
+	const authorityDigest = parseWalletAuthorityBindingDigest(record.authorityDigest);
+	const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
+	if (!walletId.ok || !authorityDigest.ok || !walletAuthMethodId.ok) return null;
+	return {
+		kind: "wallet_auth_authority_ref",
+		walletId: walletId.value,
+		authorityDigest: authorityDigest.value,
+		walletAuthMethodId: walletAuthMethodId.value
+	};
+}
+function parseEmailOtpProvider(raw) {
+	const provider = String(raw || "").trim().toLowerCase();
+	if (provider === "google" || provider === "email") return provider;
+	return null;
+}
+function requireParsed(parsed, message) {
+	if (parsed.ok) return parsed.value;
+	throw new Error(message);
+}
+function hasOwnField(obj, field) {
+	return Object.prototype.hasOwnProperty.call(obj, field);
+}
+function hasAnyOwnField(obj, fields) {
+	for (const field of fields) if (hasOwnField(obj, field)) return true;
+	return false;
+}
+function buildPasskeyWalletAuthAuthority(args) {
+	const walletId = requireParsed(parseWalletId(args.walletId), "Passkey wallet auth authority requires walletId");
+	const rpId = requireParsed(parseWebAuthnRpId(args.rpId), "Passkey wallet auth authority requires rpId");
+	const credentialIdB64u = requireParsed(parseWebAuthnCredentialIdB64u(args.credentialIdB64u), "Passkey wallet auth authority requires credentialIdB64u");
+	const bindingId = requireParsed(parseWalletAuthMethodId(`passkey:${rpId}:${credentialIdB64u}`), "Passkey wallet auth authority requires bindingId");
+	return {
+		walletId,
+		factor: {
+			kind: "passkey",
+			credentialIdB64u
+		},
+		verifier: {
+			kind: "webauthn",
+			rpId
+		},
+		bindingId
+	};
+}
+function buildEmailOtpFactorIdentity(args) {
+	const provider = parseEmailOtpProvider(args.provider);
+	if (!provider) throw new Error("Email OTP factor identity requires provider");
+	return {
+		kind: "email_otp",
+		provider,
+		providerUserId: requireParsed(parseEmailOtpProviderUserId(args.providerUserId), "Email OTP factor identity requires providerUserId")
+	};
+}
+function buildEmailOtpWalletAuthAuthority(args) {
+	const walletId = requireParsed(parseWalletId(args.walletId), "Email OTP wallet auth authority requires walletId");
+	const factor = buildEmailOtpFactorIdentity(args);
+	const emailHashHex = String(args.emailHashHex || "").trim();
+	if (!emailHashHex) throw new Error("Email OTP wallet auth authority requires emailHashHex");
+	const bindingId = requireParsed(parseWalletAuthMethodId(`email_otp:${walletId}:${emailHashHex}`), "Email OTP wallet auth authority requires bindingId");
+	return {
+		walletId,
+		factor,
+		verifier: {
+			kind: "email_otp_wallet_auth_method",
+			emailHashHex
+		},
+		bindingId
+	};
+}
+function emailOtpWalletAuthAuthorityProvider(authority) {
+	return authority.factor.provider;
+}
+function emailOtpWalletAuthAuthorityProviderUserId(authority) {
+	return authority.factor.providerUserId;
+}
+function emailOtpWalletAuthAuthorityEmailHashHex(authority) {
+	return authority.verifier.emailHashHex;
+}
+function parsePasskeyWalletAuthAuthorityObject(obj) {
+	const factor = obj.factor;
+	if (!factor || typeof factor !== "object" || Array.isArray(factor)) return null;
+	const verifier = obj.verifier;
+	if (!verifier || typeof verifier !== "object" || Array.isArray(verifier)) return null;
+	const factorObj = factor;
+	const verifierObj = verifier;
+	const factorKind = String(factorObj.kind || "").trim().toLowerCase();
+	const verifierKind = String(verifierObj.kind || "").trim().toLowerCase();
+	if (factorKind !== "passkey" || verifierKind !== "webauthn") return null;
+	try {
+		if (hasAnyOwnField(obj, [
+			"kind",
+			"rpId",
+			"credentialIdB64u",
+			"provider",
+			"providerUserId"
+		])) return null;
+		const walletId = parseWalletId(obj.walletId);
+		const rpId = parseWebAuthnRpId(verifierObj.rpId);
+		const credentialIdB64u = parseWebAuthnCredentialIdB64u(factorObj.credentialIdB64u);
+		const bindingId = parseWalletAuthMethodId(obj.bindingId);
+		if (!walletId.ok || !rpId.ok || !credentialIdB64u.ok || !bindingId.ok) return null;
+		return {
+			walletId: walletId.value,
+			factor: {
+				kind: "passkey",
+				credentialIdB64u: credentialIdB64u.value
+			},
+			verifier: {
+				kind: "webauthn",
+				rpId: rpId.value
+			},
+			bindingId: bindingId.value
+		};
+	} catch {
+		return null;
+	}
+}
+function parseEmailOtpWalletAuthAuthorityObject(obj) {
+	const factor = obj.factor;
+	if (!factor || typeof factor !== "object" || Array.isArray(factor)) return null;
+	const verifier = obj.verifier;
+	if (!verifier || typeof verifier !== "object" || Array.isArray(verifier)) return null;
+	const factorObj = factor;
+	const verifierObj = verifier;
+	const factorKind = String(factorObj.kind || "").trim().toLowerCase();
+	const verifierKind = String(verifierObj.kind || "").trim().toLowerCase();
+	if (factorKind !== "email_otp" || verifierKind !== "email_otp_wallet_auth_method") return null;
+	try {
+		if (hasAnyOwnField(obj, [
+			"kind",
+			"rpId",
+			"credentialIdB64u",
+			"provider",
+			"providerUserId"
+		])) return null;
+		const walletId = parseWalletId(obj.walletId);
+		const provider = parseEmailOtpProvider(factorObj.provider);
+		const providerUserId = parseEmailOtpProviderUserId(factorObj.providerUserId);
+		const emailHashHex = String(verifierObj.emailHashHex || "").trim();
+		const bindingId = parseWalletAuthMethodId(obj.bindingId);
+		if (!walletId.ok || !provider || !providerUserId.ok || !emailHashHex || !bindingId.ok) return null;
+		return {
+			walletId: walletId.value,
+			factor: {
+				kind: "email_otp",
+				provider,
+				providerUserId: providerUserId.value
+			},
+			verifier: {
+				kind: "email_otp_wallet_auth_method",
+				emailHashHex
+			},
+			bindingId: bindingId.value
+		};
+	} catch {
+		return null;
+	}
+}
+function parseWalletAuthAuthority(raw) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const obj = raw;
+	return parsePasskeyWalletAuthAuthorityObject(obj) || parseEmailOtpWalletAuthAuthorityObject(obj);
+}
+function parseEmailOtpWalletAuthAuthority(raw) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+	return parseEmailOtpWalletAuthAuthorityObject(raw);
+}
+function parsePasskeyWalletAuthAuthority(raw) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+	return parsePasskeyWalletAuthAuthorityObject(raw);
+}
+function canonicalWalletAuthorityBindingDigestInput(args) {
+	return `${WALLET_AUTHORITY_BINDING_DIGEST_DOMAIN}${alphabetizeStringify(args.authority)}`;
+}
+async function walletAuthorityBindingDigest(args) {
+	return requireParsed(parseWalletAuthorityBindingDigest(base64UrlEncode(await sha256BytesUtf8(canonicalWalletAuthorityBindingDigestInput(args)))), "Wallet authority binding digest must be non-empty");
+}
+async function walletAuthAuthorityRef(args) {
+	return {
+		kind: "wallet_auth_authority_ref",
+		walletId: args.authority.walletId,
+		authorityDigest: await walletAuthorityBindingDigest({ authority: args.authority }),
+		walletAuthMethodId: args.authority.bindingId
+	};
+}
+//#endregion
+//#region ../shared-ts/src/utils/routerAbEcdsaDerivation.ts
+/**
+* The longest an ECDSA presignature ceremony may run. The Gateway authorizes a
+* pool fill only when the requested ceremony deadline is within this limit.
+*/
+const ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS = 5 * 6e4;
+const ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1 = "router_ab_ecdsa_derivation_normal_signing_v1";
+const ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH = "/router-ab/ecdsa-derivation/export";
+const ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH = "/router-ab/ecdsa-derivation/presignature-pool/fill/init";
+const ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH = "/router-ab/ecdsa-derivation/presignature-pool/fill/step";
+const ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH = "/router-ab/ecdsa-derivation/session/activate";
+const ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH = "/router-ab/ecdsa-derivation/operation-step-up";
+const ROUTER_AB_ECDSA_OPERATION_STEP_UP_CHALLENGE_DOMAIN_V1 = "router-ab-ecdsa-operation-step-up/challenge/v1";
+const ECDSA_DERIVATION_CONTEXT_DOMAIN_TAG_V1 = "router-ab-ecdsa-derivation/context/v1";
+const ECDSA_DERIVATION_CONTEXT_BINDING_DOMAIN_V1 = "router-ab-ecdsa-derivation/role-local/context-binding/v1";
+const ECDSA_DERIVATION_SCHEME_ID_V1 = "router-ab-ecdsa-derivation-v1";
+const ECDSA_DERIVATION_CURVE_V1 = "secp256k1";
+const ECDSA_DERIVATION_CONTEXT_FIELD_BYTES_V1 = 1;
+const ECDSA_DERIVATION_PARTICIPANT_IDS_V1 = [1, 2];
+const ROUTER_AB_ECDSA_DERIVATION_PUBLIC_IDENTITY_VERSION_V1 = "router-ab-ecdsa-derivation/public-identity/v1";
+const ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_SCOPE_VERSION_V1 = "router-ab-ecdsa-derivation/normal-signing-scope/v1";
+const ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_REQUEST_VERSION_V1 = "router-ab-ecdsa-derivation/normal-signing-request/v1";
+const ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_FINALIZE_REQUEST_VERSION_V1 = "router-ab-ecdsa-derivation/normal-signing-finalize-request/v1";
+const ROUTER_AB_ECDSA_DERIVATION_CLIENT_RERANDOMIZATION_COMMITMENT_DOMAIN_V1 = "router-ab-ecdsa-derivation/client-rerandomization-commitment/v1";
+function requireExportShareAuthorizationKind(value, label) {
+	if (value === "reusable_wallet_session" || value === "verified_step_up") return value;
+	throw new Error(`${label} must be reusable_wallet_session or verified_step_up`);
+}
+function parseRouterAbEcdsaOperationStepUpExportTopologyV1(value) {
+	const topology = requireRecord(value, "operationStepUpAuthorizationResponse.export_topology");
+	requireExactKeys(topology, "operationStepUpAuthorizationResponse.export_topology", [
+		"signer_set",
+		"deriver_recipient_keys",
+		"router_id"
+	]);
+	const signerSet = parsePostRegistrationSignerSet(topology.signer_set, "operationStepUpAuthorizationResponse.export_topology.signer_set");
+	const deriverRecipientKeys = parseRegistrationRecipientKeys(topology.deriver_recipient_keys, "operationStepUpAuthorizationResponse.export_topology.deriver_recipient_keys");
+	if (deriverRecipientKeys.deriver_a.key_epoch !== signerSet.signer_a.key_epoch || deriverRecipientKeys.deriver_b.key_epoch !== signerSet.signer_b.key_epoch) throw new Error("operationStepUpAuthorizationResponse.export_topology recipient key epochs do not match signer_set");
+	return {
+		signer_set: signerSet,
+		deriver_recipient_keys: deriverRecipientKeys,
+		router_id: requireAsciiNonEmptyString(topology.router_id, "operationStepUpAuthorizationResponse.export_topology.router_id")
+	};
+}
+function parseRouterAbEcdsaOperationStepUpAuthorizationResponseV1(value) {
+	const response = requireRecord(value, "operationStepUpAuthorizationResponse");
+	const operationKind = requireEcdsaOperationStepUpKind(response.operation_kind);
+	requireExactKeys(response, "operationStepUpAuthorizationResponse", [
+		"ok",
+		"kind",
+		"authorization",
+		"expires_at_ms",
+		"operation_kind",
+		...operationKind === "evm.export_key" ? ["export_topology"] : []
+	]);
+	if (response.ok !== true || response.kind !== "verified_step_up") throw new Error("operationStepUpAuthorizationResponse is invalid");
+	const authorization = requireRecord(response.authorization, "operationStepUpAuthorizationResponse.authorization");
+	requireExactKeys(authorization, "operationStepUpAuthorizationResponse.authorization", [
+		"kind",
+		"evidence_set_digest",
+		"unseal"
+	]);
+	if (authorization.kind !== "operation_step_up") throw new Error("operationStepUpAuthorizationResponse.authorization.kind is invalid");
+	const expiresAtMs = requirePositiveUnixMs(response.expires_at_ms, "operationStepUpAuthorizationResponse.expires_at_ms");
+	if (expiresAtMs <= Date.now()) throw new Error("operationStepUpAuthorizationResponse.expires_at_ms is expired");
+	const unseal = requireRecord(authorization.unseal, "operationStepUpAuthorizationResponse.authorization.unseal");
+	const unsealKind = requireAsciiNonEmptyString(unseal.kind, "operationStepUpAuthorizationResponse.authorization.unseal.kind");
+	let parsedUnseal;
+	switch (unsealKind) {
+		case "not_requested":
+			requireExactKeys(unseal, "operationStepUpAuthorizationResponse.authorization.unseal", ["kind"]);
+			parsedUnseal = { kind: "not_requested" };
+			break;
+		case "email_otp_grant":
+			requireExactKeys(unseal, "operationStepUpAuthorizationResponse.authorization.unseal", [
+				"kind",
+				"grant",
+				"challenge_id"
+			]);
+			parsedUnseal = {
+				kind: "email_otp_grant",
+				grant: requireAsciiNonEmptyString(unseal.grant, "operationStepUpAuthorizationResponse.authorization.unseal.grant"),
+				challenge_id: requireAsciiNonEmptyString(unseal.challenge_id, "operationStepUpAuthorizationResponse.authorization.unseal.challenge_id")
+			};
+			break;
+		default: throw new Error("operationStepUpAuthorizationResponse.authorization.unseal.kind is invalid");
+	}
+	const base = {
+		ok: true,
+		kind: "verified_step_up",
+		authorization: {
+			kind: "operation_step_up",
+			evidence_set_digest: parseDigestB64u(authorization.evidence_set_digest),
+			unseal: parsedUnseal
+		},
+		expires_at_ms: expiresAtMs
+	};
+	if (operationKind === "evm.sign_transaction") return {
+		...base,
+		operation_kind: "evm.sign_transaction"
+	};
+	return {
+		...base,
+		operation_kind: "evm.export_key",
+		export_topology: parseRouterAbEcdsaOperationStepUpExportTopologyV1(response.export_topology)
+	};
+}
+async function computeRouterAbEcdsaOperationStepUpChallengeB64u(value) {
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		domain: ROUTER_AB_ECDSA_OPERATION_STEP_UP_CHALLENGE_DOMAIN_V1,
+		operation: parseRouterAbEcdsaOperationStepUpPreparationV1(value)
+	})));
+}
+function requireExactKeys(record, label, allowedKeys) {
+	const allowed = new Set(allowedKeys);
+	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is not a supported field`);
+}
+function requireAsciiNonEmptyString(value, label) {
+	if (typeof value !== "string") throw new Error(`${label} must be a string`);
+	const parsed = value.trim();
+	if (!parsed) throw new Error(`${label} is required`);
+	if (!/^[\x20-\x7e]+$/.test(parsed)) throw new Error(`${label} must be printable ASCII`);
+	return parsed;
+}
+function requireRootShareEpoch(value, label) {
+	const parsed = parseRootShareEpoch(requireAsciiNonEmptyString(value, label));
+	if (!parsed.ok) throw new Error(`${label} is invalid`);
+	return parsed.value;
+}
+function requireThresholdEcdsaSessionId(value, label) {
+	const parsed = parseThresholdEcdsaSessionId(requireAsciiNonEmptyString(value, label));
+	if (!parsed.ok) throw new Error(`${label} is invalid`);
+	return parsed.value;
+}
+function requireEcdsaAuthorizationSessionId(value, label) {
+	const parsed = parseEcdsaAuthorizationSessionId(value);
+	if (!parsed.ok) throw new Error(`${label} is invalid`);
+	return parsed.value;
+}
+function requireWalletSessionAuthorizationId(value, label) {
+	const parsed = parseWalletSessionAuthorizationId(value);
+	if (!parsed.ok) throw new Error(`${label} is invalid`);
+	return parsed.value;
+}
+function requireWalletSessionId(value, label) {
+	const parsed = parseWalletSessionId(value);
+	if (!parsed.ok) throw new Error(`${label} is invalid`);
+	return parsed.value;
+}
+function requireMpcWalletSigningQuotaId(value, label) {
+	const parsed = parseMpcWalletSigningQuotaId(value);
+	if (!parsed.ok) throw new Error(`${label} is invalid`);
+	return parsed.value;
+}
+function requirePositiveUnixMs(value, label) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
+	return value;
+}
+function requirePositiveCounter(value, label) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe-integer counter`);
+	return value;
+}
+function requireU32(value, label) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${label} must be a finite number`);
+	const parsed = Math.floor(value);
+	if (parsed !== value || parsed < 0 || parsed > 4294967295) throw new Error(`${label} must be a u32 integer`);
+	return parsed;
+}
+function requireByte(value, label) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${label} must be a finite number`);
+	const parsed = Math.floor(value);
+	if (parsed !== value || parsed < 0 || parsed > 255) throw new Error(`${label} must be a byte`);
+	return parsed;
+}
+function requireBase64UrlFixed(value, label, byteLength) {
+	const parsed = requireAsciiNonEmptyString(value, label);
+	if (!/^[A-Za-z0-9_-]+$/.test(parsed)) throw new Error(`${label} must be unpadded base64url`);
+	let decoded;
+	try {
+		decoded = base64UrlDecode(parsed);
+	} catch {
+		throw new Error(`${label} must be valid base64url`);
+	}
+	if (decoded.length !== byteLength) throw new Error(`${label} must decode to ${byteLength} bytes`);
+	return parsed;
+}
+function requireCompressedSecp256k1PublicKey(value, label) {
+	const parsed = requireBase64UrlFixed(value, label, 33);
+	const decoded = base64UrlDecode(parsed);
+	if (decoded[0] !== 2 && decoded[0] !== 3) throw new Error(`${label} must be a compressed secp256k1 public key`);
+	return parsed;
+}
+function requireBase64UrlNonEmpty(value, label) {
+	const parsed = requireAsciiNonEmptyString(value, label);
+	if (!/^[A-Za-z0-9_-]+$/.test(parsed)) throw new Error(`${label} must be unpadded base64url`);
+	let decoded;
+	try {
+		decoded = base64UrlDecode(parsed);
+	} catch {
+		throw new Error(`${label} must be valid base64url`);
+	}
+	if (decoded.length === 0) throw new Error(`${label} must decode to non-empty bytes`);
+	return parsed;
+}
+function requireX25519PublicKey(value, label) {
+	const parsed = requireAsciiNonEmptyString(value, label);
+	if (!/^x25519:[0-9a-f]{64}$/.test(parsed)) throw new Error(`${label} must use x25519:<64 lowercase hex chars> encoding`);
+	return parsed;
+}
+function requireUint8ArrayFixed(value, label, byteLength) {
+	if (!(value instanceof Uint8Array)) throw new Error(`${label} must be a Uint8Array`);
+	if (value.length !== byteLength) throw new Error(`${label} must contain ${byteLength} bytes`);
+	return value;
+}
+function requireSignatureScheme(value, label) {
+	const parsed = requireAsciiNonEmptyString(value, label);
+	if (parsed !== "ecdsa_secp256k1_recoverable_v1") throw new Error(`${label} must be ecdsa_secp256k1_recoverable_v1`);
+	return parsed;
+}
+function parsePublicDigest32(value, label) {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, ["bytes"]);
+	if (!Array.isArray(record.bytes)) throw new Error(`${label}.bytes must be an array`);
+	if (record.bytes.length !== 32) throw new Error(`${label}.bytes must contain 32 bytes`);
+	return { bytes: record.bytes.map((entry, index) => requireByte(entry, `${label}.bytes[${index}]`)) };
+}
+function parseStableKeyContext(value) {
+	const record = requireRecord(value, "scope.context");
+	requireExactKeys(record, "scope.context", ["application_binding_digest_b64u"]);
+	const digest = base64UrlDecode(requireAsciiNonEmptyString(record.application_binding_digest_b64u, "scope.context.application_binding_digest_b64u"));
+	if (digest.length !== 32) throw new Error("scope.context.application_binding_digest_b64u must decode to 32 bytes");
+	return { application_binding_digest_b64u: base64UrlEncode(digest) };
+}
+function parsePublicIdentity(value) {
+	const record = requireRecord(value, "scope.public_identity");
+	requireExactKeys(record, "scope.public_identity", [
+		"context_binding_b64u",
+		"derivation_client_share_public_key33_b64u",
+		"server_public_key33_b64u",
+		"threshold_public_key33_b64u",
+		"ethereum_address20_b64u",
+		"client_share_retry_counter",
+		"server_share_retry_counter"
+	]);
+	return {
+		context_binding_b64u: requireBase64UrlFixed(record.context_binding_b64u, "scope.public_identity.context_binding_b64u", 32),
+		derivation_client_share_public_key33_b64u: requireCompressedSecp256k1PublicKey(record.derivation_client_share_public_key33_b64u, "scope.public_identity.derivation_client_share_public_key33_b64u"),
+		server_public_key33_b64u: requireCompressedSecp256k1PublicKey(record.server_public_key33_b64u, "scope.public_identity.server_public_key33_b64u"),
+		threshold_public_key33_b64u: requireCompressedSecp256k1PublicKey(record.threshold_public_key33_b64u, "scope.public_identity.threshold_public_key33_b64u"),
+		ethereum_address20_b64u: requireBase64UrlFixed(record.ethereum_address20_b64u, "scope.public_identity.ethereum_address20_b64u", 20),
+		client_share_retry_counter: requireU32(record.client_share_retry_counter, "scope.public_identity.client_share_retry_counter"),
+		server_share_retry_counter: requireU32(record.server_share_retry_counter, "scope.public_identity.server_share_retry_counter")
+	};
+}
+function parseServerIdentity(value) {
+	return parseServerIdentityWithLabel(value, "scope.signing_worker");
+}
+function parseServerIdentityWithLabel(value, label) {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"server_id",
+		"key_epoch",
+		"recipient_encryption_key"
+	]);
+	return {
+		server_id: requireAsciiNonEmptyString(record.server_id, `${label}.server_id`),
+		key_epoch: requireAsciiNonEmptyString(record.key_epoch, `${label}.key_epoch`),
+		recipient_encryption_key: requireRouterAbX25519PublicKey(record.recipient_encryption_key, `${label}.recipient_encryption_key`)
+	};
+}
+function parsePostRegistrationSignerIdentity(value, label, expectedRole) {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"role",
+		"signer_id",
+		"key_epoch"
+	]);
+	if (requireAsciiNonEmptyString(record.role, `${label}.role`) !== expectedRole) throw new Error(`${label}.role must be ${expectedRole}`);
+	return {
+		role: expectedRole,
+		signer_id: requireAsciiNonEmptyString(record.signer_id, `${label}.signer_id`),
+		key_epoch: requireAsciiNonEmptyString(record.key_epoch, `${label}.key_epoch`)
+	};
+}
+function parsePostRegistrationSignerSet(value, label) {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"signer_set_id",
+		"policy",
+		"signer_a",
+		"signer_b",
+		"selected_server"
+	]);
+	const policy = requireAsciiNonEmptyString(record.policy, `${label}.policy`);
+	if (policy !== "all_2") throw new Error(`${label}.policy must be all_2`);
+	const signerA = parsePostRegistrationSignerIdentity(record.signer_a, `${label}.signer_a`, "signer_a");
+	const signerB = parsePostRegistrationSignerIdentity(record.signer_b, `${label}.signer_b`, "signer_b");
+	if (signerA.signer_id === signerB.signer_id) throw new Error(`${label} requires distinct signer ids`);
+	return {
+		signer_set_id: requireAsciiNonEmptyString(record.signer_set_id, `${label}.signer_set_id`),
+		policy,
+		signer_a: signerA,
+		signer_b: signerB,
+		selected_server: parseServerIdentityWithLabel(record.selected_server, `${label}.selected_server`)
+	};
+}
+function parseRegistrationLifecycle(value) {
+	const label = "registration.lifecycle";
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"lifecycle_id",
+		"work_kind",
+		"primitive_request_kind",
+		"root_share_epoch",
+		"account_id",
+		"session_id",
+		"signer_set_id",
+		"selected_server_id"
+	]);
+	if (record.work_kind !== "registration_prepare") throw new Error(`${label}.work_kind must be registration_prepare`);
+	if (record.primitive_request_kind !== "registration") throw new Error(`${label}.primitive_request_kind must be registration`);
+	return {
+		lifecycle_id: requireAsciiNonEmptyString(record.lifecycle_id, `${label}.lifecycle_id`),
+		work_kind: "registration_prepare",
+		primitive_request_kind: "registration",
+		root_share_epoch: requireRootShareEpoch(record.root_share_epoch, `${label}.root_share_epoch`),
+		account_id: requireAsciiNonEmptyString(record.account_id, `${label}.account_id`),
+		session_id: requireAsciiNonEmptyString(record.session_id, `${label}.session_id`),
+		signer_set_id: requireAsciiNonEmptyString(record.signer_set_id, `${label}.signer_set_id`),
+		selected_server_id: requireAsciiNonEmptyString(record.selected_server_id, `${label}.selected_server_id`)
+	};
+}
+function parseRegistrationRecipientKey(value, label, role) {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"role",
+		"key_epoch",
+		"public_key"
+	]);
+	if (record.role !== role) throw new Error(`${label}.role must be ${role}`);
+	return {
+		role,
+		key_epoch: requireAsciiNonEmptyString(record.key_epoch, `${label}.key_epoch`),
+		public_key: requireRouterAbX25519PublicKey(record.public_key, `${label}.public_key`)
+	};
+}
+function parseRegistrationRecipientKeys(value, label = "registration.deriver_recipient_keys") {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, ["deriver_a", "deriver_b"]);
+	return {
+		deriver_a: parseRegistrationRecipientKey(record.deriver_a, `${label}.deriver_a`, "signer_a"),
+		deriver_b: parseRegistrationRecipientKey(record.deriver_b, `${label}.deriver_b`, "signer_b")
+	};
+}
+function parseRouterAbEcdsaRegistrationRequestFactsV1(value) {
+	const label = "registration";
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"registration_purpose",
+		"context",
+		"lifecycle",
+		"signer_set",
+		"router_id",
+		"client_id",
+		"replay_nonce",
+		"expires_at_ms",
+		"deriver_recipient_keys"
+	]);
+	if (record.registration_purpose !== "wallet_registration" && record.registration_purpose !== "wallet_add_signer") throw new Error(`${label}.registration_purpose is invalid`);
+	const lifecycle = parseRegistrationLifecycle(record.lifecycle);
+	const signerSet = parsePostRegistrationSignerSet(record.signer_set, `${label}.signer_set`);
+	if (lifecycle.signer_set_id !== signerSet.signer_set_id) throw new Error(`${label}.lifecycle signer set does not match signer_set`);
+	if (lifecycle.selected_server_id !== signerSet.selected_server.server_id) throw new Error(`${label}.lifecycle selected server does not match signer_set`);
+	const recipientKeys = parseRegistrationRecipientKeys(record.deriver_recipient_keys);
+	if (recipientKeys.deriver_a.key_epoch !== signerSet.signer_a.key_epoch) throw new Error(`${label}.deriver_a recipient key epoch does not match signer_set`);
+	if (recipientKeys.deriver_b.key_epoch !== signerSet.signer_b.key_epoch) throw new Error(`${label}.deriver_b recipient key epoch does not match signer_set`);
+	return {
+		registration_purpose: record.registration_purpose,
+		context: parseStableKeyContext(record.context),
+		lifecycle,
+		signer_set: signerSet,
+		router_id: requireAsciiNonEmptyString(record.router_id, `${label}.router_id`),
+		client_id: requireAsciiNonEmptyString(record.client_id, `${label}.client_id`),
+		replay_nonce: requireAsciiNonEmptyString(record.replay_nonce, `${label}.replay_nonce`),
+		expires_at_ms: requirePositiveUnixMs(record.expires_at_ms, `${label}.expires_at_ms`),
+		deriver_recipient_keys: recipientKeys
+	};
+}
+function parseRouterAbEcdsaClientProofBundleV1(value, label) {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"kind",
+		"transcriptDigestB64u",
+		"payloadB64u"
+	]);
+	if (record.kind !== "recipient_proof_bundle") throw new Error(`${label}.kind must be recipient_proof_bundle`);
+	return {
+		kind: "recipient_proof_bundle",
+		transcriptDigestB64u: requireBase64UrlFixed(record.transcriptDigestB64u, `${label}.transcriptDigestB64u`, 32),
+		payloadB64u: requireBase64UrlNonEmpty(record.payloadB64u, `${label}.payloadB64u`)
+	};
+}
+function parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(value) {
+	const label = "registrationForwarded";
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, ["result", "response"]);
+	if (record.result !== "forwarded") throw new Error(`${label}.result must be forwarded`);
+	return {
+		result: "forwarded",
+		response: parseRouterAbEcdsaStrictProofResponseV1(record.response, `${label}.response`)
+	};
+}
+function parseRouterAbEcdsaExplicitExportForwardedResponseV1(value) {
+	return parseRouterAbEcdsaExplicitExportForwardedResponseWithV1(value, parseRouterAbEcdsaSigningWorkerExportShareEnvelopeV1);
+}
+function parseRouterAbEcdsaExplicitExportForwardedResponseWithV1(value, parseEnvelope) {
+	const label = "explicitExportForwarded";
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"result",
+		"response",
+		"signing_worker_export"
+	]);
+	if (record.result !== "forwarded") throw new Error(`${label}.result must be forwarded`);
+	return {
+		result: "forwarded",
+		response: parseRouterAbEcdsaStrictProofResponseV1(record.response, `${label}.response`),
+		signing_worker_export: parseEnvelope(record.signing_worker_export)
+	};
+}
+function parseRouterAbEcdsaSigningWorkerExportShareEnvelopeV1(value) {
+	return parseRouterAbEcdsaSigningWorkerExportShareEnvelopeWithV1(value, parseRouterAbMpcMaterialActivationRef);
+}
+function parseRouterAbEcdsaSigningWorkerExportShareBindingWithV1(value, parseMaterialActivation, label) {
+	const binding = requireRecord(value, label);
+	requireExactKeys(binding, label, [
+		"wallet_id",
+		"key_handle",
+		"ecdsa_threshold_key_id",
+		"signing_root_id",
+		"signing_root_version",
+		"activation_epoch",
+		"signing_worker_id",
+		"context_binding_b64u",
+		"threshold_public_key33_b64u",
+		"export_request_digest_b64u",
+		"export_authorization_digest_b64u",
+		"export_nonce",
+		"authorization_kind",
+		"authorization_id",
+		"material_activation",
+		"lifecycle_id",
+		"recipient_identity",
+		"recipient_public_key",
+		"expires_at_ms"
+	]);
+	const materialActivation = parseMaterialActivation(binding.material_activation);
+	if (materialActivation.material_owner !== binding.wallet_id || materialActivation.signing_worker !== binding.signing_worker_id) throw new Error(`${label}.material_activation is not bound to wallet and worker`);
+	return {
+		wallet_id: requireAsciiNonEmptyString(binding.wallet_id, `${label}.wallet_id`),
+		key_handle: requireAsciiNonEmptyString(binding.key_handle, `${label}.key_handle`),
+		ecdsa_threshold_key_id: requireAsciiNonEmptyString(binding.ecdsa_threshold_key_id, `${label}.ecdsa_threshold_key_id`),
+		signing_root_id: requireAsciiNonEmptyString(binding.signing_root_id, `${label}.signing_root_id`),
+		signing_root_version: requireAsciiNonEmptyString(binding.signing_root_version, `${label}.signing_root_version`),
+		activation_epoch: requireRootShareEpoch(binding.activation_epoch, `${label}.activation_epoch`),
+		signing_worker_id: requireAsciiNonEmptyString(binding.signing_worker_id, `${label}.signing_worker_id`),
+		context_binding_b64u: requireBase64UrlFixed(binding.context_binding_b64u, `${label}.context_binding_b64u`, 32),
+		threshold_public_key33_b64u: requireCompressedSecp256k1PublicKey(binding.threshold_public_key33_b64u, `${label}.threshold_public_key33_b64u`),
+		export_request_digest_b64u: requireBase64UrlFixed(binding.export_request_digest_b64u, `${label}.export_request_digest_b64u`, 32),
+		export_authorization_digest_b64u: requireBase64UrlFixed(binding.export_authorization_digest_b64u, `${label}.export_authorization_digest_b64u`, 32),
+		export_nonce: requireAsciiNonEmptyString(binding.export_nonce, `${label}.export_nonce`),
+		authorization_kind: requireExportShareAuthorizationKind(binding.authorization_kind, `${label}.authorization_kind`),
+		authorization_id: requireAsciiNonEmptyString(binding.authorization_id, `${label}.authorization_id`),
+		material_activation: materialActivation,
+		lifecycle_id: requireAsciiNonEmptyString(binding.lifecycle_id, `${label}.lifecycle_id`),
+		recipient_identity: requireAsciiNonEmptyString(binding.recipient_identity, `${label}.recipient_identity`),
+		recipient_public_key: requireX25519PublicKey(binding.recipient_public_key, `${label}.recipient_public_key`),
+		expires_at_ms: requirePositiveUnixMs(binding.expires_at_ms, `${label}.expires_at_ms`)
+	};
+}
+function parseRouterAbEcdsaSigningWorkerExportShareEnvelopeWithV1(value, parseMaterialActivation) {
+	const label = "signingWorkerExportShare";
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"version",
+		"algorithm",
+		"binding",
+		"ciphertext_and_tag"
+	]);
+	if (record.version !== "router-ab-ecdsa-derivation/signing-worker-export-share-envelope/v1") throw new Error(`${label}.version is invalid`);
+	if (record.algorithm !== "hpke_x25519_hkdf_sha256_aes256gcm_v1") throw new Error(`${label}.algorithm is invalid`);
+	if (!Array.isArray(record.ciphertext_and_tag) || record.ciphertext_and_tag.length <= 48) throw new Error(`${label}.ciphertext_and_tag is invalid`);
+	return {
+		version: "router-ab-ecdsa-derivation/signing-worker-export-share-envelope/v1",
+		algorithm: "hpke_x25519_hkdf_sha256_aes256gcm_v1",
+		binding: parseRouterAbEcdsaSigningWorkerExportShareBindingWithV1(record.binding, parseMaterialActivation, `${label}.binding`),
+		ciphertext_and_tag: record.ciphertext_and_tag.map((entry, index) => requireByte(entry, `${label}.ciphertext_and_tag[${index}]`))
+	};
+}
+function parseRouterAbEcdsaStrictProofResponseV1(value, label) {
+	const response = requireRecord(value, label);
+	requireExactKeys(response, label, ["bundles"]);
+	const bundlesLabel = `${label}.bundles`;
+	const bundles = requireRecord(response.bundles, bundlesLabel);
+	requireExactKeys(bundles, bundlesLabel, ["signerA", "signerB"]);
+	return { bundles: {
+		signerA: parseRouterAbEcdsaClientProofBundleV1(bundles.signerA, `${bundlesLabel}.signerA`),
+		signerB: parseRouterAbEcdsaClientProofBundleV1(bundles.signerB, `${bundlesLabel}.signerB`)
+	} };
+}
+function parseRouterAbEcdsaVerifiedClientActivationFactsV1(value) {
+	const label = "registrationActivation.publicFacts";
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"registrationRequestDigestB64u",
+		"proofTranscriptDigestB64u",
+		"contextBinding32B64u",
+		"derivationClientSharePublicKey33B64u",
+		"clientShareRetryCounter",
+		"participantId"
+	]);
+	if (record.participantId !== 1) throw new Error(`${label}.participantId must be 1`);
+	return {
+		registrationRequestDigestB64u: requireBase64UrlFixed(record.registrationRequestDigestB64u, `${label}.registrationRequestDigestB64u`, 32),
+		proofTranscriptDigestB64u: requireBase64UrlFixed(record.proofTranscriptDigestB64u, `${label}.proofTranscriptDigestB64u`, 32),
+		contextBinding32B64u: requireBase64UrlFixed(record.contextBinding32B64u, `${label}.contextBinding32B64u`, 32),
+		derivationClientSharePublicKey33B64u: requireCompressedSecp256k1PublicKey(record.derivationClientSharePublicKey33B64u, `${label}.derivationClientSharePublicKey33B64u`),
+		clientShareRetryCounter: requireU32(record.clientShareRetryCounter, `${label}.clientShareRetryCounter`),
+		participantId: 1
+	};
+}
+function parseRouterAbEcdsaRegistrationActivationReceiptV1(value) {
+	const label = "registrationActivationReceipt";
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"activation_correlation_id",
+		"activation_request_digest",
+		"server_generation",
+		"ecdsa_activation",
+		"lifecycle_id",
+		"transcript_digest"
+	]);
+	const activationLabel = `${label}.ecdsa_activation`;
+	const activation = requireRecord(record.ecdsa_activation, activationLabel);
+	requireExactKeys(activation, activationLabel, [
+		"context",
+		"public_identity",
+		"signing_worker",
+		"material_activation",
+		"activation_epoch",
+		"activation_digest_b64u",
+		"activated_at_ms"
+	]);
+	const signingWorker = parseServerIdentityWithLabel(activation.signing_worker, `${activationLabel}.signing_worker`);
+	const materialActivation = parseRouterAbMpcMaterialActivationRef(activation.material_activation);
+	if (materialActivation.signing_worker !== signingWorker.server_id) throw new Error(`${activationLabel}.material_activation.signing_worker does not match signing_worker`);
+	const activationDigestB64u = requireBase64UrlFixed(activation.activation_digest_b64u, `${activationLabel}.activation_digest_b64u`, 32);
+	const transcriptDigest = parsePublicDigest32(record.transcript_digest, `${label}.transcript_digest`);
+	return {
+		activation_correlation_id: parseCorrelationId(record.activation_correlation_id),
+		activation_request_digest: parsePublicDigest32(record.activation_request_digest, `${label}.activation_request_digest`),
+		server_generation: parseEcdsaServerGeneration(record.server_generation),
+		ecdsa_activation: {
+			context: parseStableKeyContext(activation.context),
+			public_identity: parsePublicIdentity(activation.public_identity),
+			signing_worker: signingWorker,
+			material_activation: materialActivation,
+			activation_epoch: requireRootShareEpoch(activation.activation_epoch, `${activationLabel}.activation_epoch`),
+			activation_digest_b64u: activationDigestB64u,
+			activated_at_ms: requirePositiveUnixMs(activation.activated_at_ms, `${activationLabel}.activated_at_ms`)
+		},
+		lifecycle_id: requireAsciiNonEmptyString(record.lifecycle_id, `${label}.lifecycle_id`),
+		transcript_digest: transcriptDigest
+	};
+}
+function parseRouterAbEcdsaRegistrationPublicActivationReceiptV1(value) {
+	return parseRouterAbEcdsaRegistrationActivationReceiptV1(value);
+}
+function sameRouterAbServerIdentityV1(left, right) {
+	return left.server_id === right.server_id && left.key_epoch === right.key_epoch && left.recipient_encryption_key === right.recipient_encryption_key;
+}
+function sameRouterAbEcdsaVerifiedClientActivationFactsV1(left, right) {
+	return left.registrationRequestDigestB64u === right.registrationRequestDigestB64u && left.proofTranscriptDigestB64u === right.proofTranscriptDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && left.derivationClientSharePublicKey33B64u === right.derivationClientSharePublicKey33B64u && left.clientShareRetryCounter === right.clientShareRetryCounter && left.participantId === right.participantId;
+}
+function sameRegistrationSignerSet(left, right) {
+	return left.signer_set_id === right.signer_set_id && left.policy === right.policy && left.signer_a.role === right.signer_a.role && left.signer_a.signer_id === right.signer_a.signer_id && left.signer_a.key_epoch === right.signer_a.key_epoch && left.signer_b.role === right.signer_b.role && left.signer_b.signer_id === right.signer_b.signer_id && left.signer_b.key_epoch === right.signer_b.key_epoch && sameRouterAbServerIdentityV1(left.selected_server, right.selected_server);
+}
+function parseRouterAbEcdsaDerivationPublicCapabilityV1(value) {
+	const label = "ecdsaPublicCapability";
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"kind",
+		"context",
+		"public_identity",
+		"material_activation",
+		"signer_set",
+		"deriver_recipient_keys",
+		"router_id",
+		"client_id",
+		"activation_epoch",
+		"registration_request_digest_b64u",
+		"proof_transcript_digest_b64u"
+	]);
+	if (record.kind !== "router_ab_ecdsa_derivation_public_capability_v1") throw new Error(`${label}.kind is invalid`);
+	const signerSet = parsePostRegistrationSignerSet(record.signer_set, `${label}.signer_set`);
+	const recipientKeys = parseRegistrationRecipientKeys(record.deriver_recipient_keys, `${label}.deriver_recipient_keys`);
+	if (recipientKeys.deriver_a.key_epoch !== signerSet.signer_a.key_epoch || recipientKeys.deriver_b.key_epoch !== signerSet.signer_b.key_epoch) throw new Error(`${label} Deriver recipient key epochs do not match signer_set`);
+	return {
+		kind: "router_ab_ecdsa_derivation_public_capability_v1",
+		context: parseStableKeyContext(record.context),
+		public_identity: parsePublicIdentity(record.public_identity),
+		material_activation: parseRouterAbMpcMaterialActivationRef(record.material_activation),
+		signer_set: signerSet,
+		deriver_recipient_keys: recipientKeys,
+		router_id: requireAsciiNonEmptyString(record.router_id, `${label}.router_id`),
+		client_id: requireAsciiNonEmptyString(record.client_id, `${label}.client_id`),
+		activation_epoch: requireRootShareEpoch(record.activation_epoch, `${label}.activation_epoch`),
+		registration_request_digest_b64u: requireBase64UrlFixed(record.registration_request_digest_b64u, `${label}.registration_request_digest_b64u`, 32),
+		proof_transcript_digest_b64u: requireBase64UrlFixed(record.proof_transcript_digest_b64u, `${label}.proof_transcript_digest_b64u`, 32)
+	};
+}
+function parsePostRegistrationSessionPolicy(value) {
+	const label = "postRegistrationSessionActivation.session_policy";
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"threshold_session_id",
+		"wallet_session_mint_id",
+		"ttl_ms",
+		"remaining_uses",
+		"runtime_policy_scope"
+	]);
+	return {
+		threshold_session_id: requireThresholdEcdsaSessionId(record.threshold_session_id, `${label}.threshold_session_id`),
+		wallet_session_mint_id: requireWalletSessionMintId(record.wallet_session_mint_id, `${label}.wallet_session_mint_id`),
+		ttl_ms: requirePositiveCounter(record.ttl_ms, `${label}.ttl_ms`),
+		remaining_uses: requirePositiveCounter(record.remaining_uses, `${label}.remaining_uses`),
+		runtime_policy_scope: normalizeRuntimePolicyScope(record.runtime_policy_scope)
+	};
+}
+function parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1(value) {
+	const label = "postRegistrationSessionActivationPolicy";
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"kind",
+		"key_handle",
+		"session_policy"
+	]);
+	if (record.kind !== "router_ab_ecdsa_post_registration_session_activation_policy_v1") throw new Error(`${label}.kind is invalid`);
+	return {
+		kind: "router_ab_ecdsa_post_registration_session_activation_policy_v1",
+		key_handle: requireAsciiNonEmptyString(record.key_handle, `${label}.key_handle`),
+		session_policy: parsePostRegistrationSessionPolicy(record.session_policy)
+	};
+}
+function requireWalletSessionMintId(value, label) {
+	const parsed = parseWalletSessionMintId(value);
+	if (!parsed.ok) throw new Error(`${label} is invalid`);
+	return parsed.value;
+}
+function sameRouterAbEcdsaDerivationPublicIdentityV1(left, right) {
+	return left.context_binding_b64u === right.context_binding_b64u && left.derivation_client_share_public_key33_b64u === right.derivation_client_share_public_key33_b64u && left.server_public_key33_b64u === right.server_public_key33_b64u && left.threshold_public_key33_b64u === right.threshold_public_key33_b64u && left.ethereum_address20_b64u === right.ethereum_address20_b64u && left.client_share_retry_counter === right.client_share_retry_counter && left.server_share_retry_counter === right.server_share_retry_counter;
+}
+function activeWalletSessionMatchesEcdsaCapability(session, capability) {
+	for (const subject of session.capabilitySubjects) {
+		if (subject.kind !== "sign" || subject.keyFamily !== "ecdsa_secp256k1") continue;
+		return sameRouterAbMpcMaterialActivationRef(capability.material_activation, routerAbMpcMaterialActivationRefToWire(subject.materialActivation));
+	}
+	return false;
+}
+function parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1(value) {
+	const label = "postRegistrationSessionActivation";
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"kind",
+		"public_capability",
+		"session_policy"
+	]);
+	if (record.kind !== "router_ab_ecdsa_post_registration_session_activation_v1") throw new Error(`${label}.kind is invalid`);
+	return {
+		kind: "router_ab_ecdsa_post_registration_session_activation_v1",
+		public_capability: parseRouterAbEcdsaDerivationPublicCapabilityV1(record.public_capability),
+		session_policy: parsePostRegistrationSessionPolicy(record.session_policy)
+	};
+}
+function parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1(value) {
+	const label = "postRegistrationSessionActivated";
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"kind",
+		"public_capability",
+		"session",
+		"normal_signing"
+	]);
+	if (record.kind !== "router_ab_ecdsa_post_registration_session_activated_v1") throw new Error(`${label}.kind is invalid`);
+	const publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(record.public_capability);
+	const sessionRecord = requireRecord(record.session, `${label}.session`);
+	requireExactKeys(sessionRecord, `${label}.session`, [
+		"authorization_session_id",
+		"authorization_id",
+		"threshold_session_id",
+		"wallet_session_id",
+		"quota_id",
+		"expires_at_ms",
+		"remaining_uses",
+		"wallet_session",
+		"operation_credential"
+	]);
+	const normalSigning = requireRouterAbEcdsaDerivationNormalSigningStateV1(record.normal_signing);
+	const authorizationId = requireWalletSessionAuthorizationId(sessionRecord.authorization_id, `${label}.session.authorization_id`);
+	const walletSessionId = requireWalletSessionId(sessionRecord.wallet_session_id, `${label}.session.wallet_session_id`);
+	const expiresAtMs = requirePositiveUnixMs(sessionRecord.expires_at_ms, `${label}.session.expires_at_ms`);
+	const walletSession = parseActiveWalletSessionV1(sessionRecord.wallet_session);
+	const operationCredential = parseWalletSessionOperationCredentialV1(sessionRecord.operation_credential);
+	if (!sameRouterAbEcdsaDerivationPublicIdentityV1(publicCapability.public_identity, normalSigning.scope.public_identity) || publicCapability.context.application_binding_digest_b64u !== normalSigning.scope.context.application_binding_digest_b64u || normalSigning.scope.activation_epoch !== publicCapability.activation_epoch || !sameRouterAbServerIdentityV1(normalSigning.scope.signing_worker, publicCapability.signer_set.selected_server) || walletSession.authorizationId !== authorizationId || walletSession.walletId !== publicCapability.client_id || walletSession.expiresAtMs !== expiresAtMs || !activeWalletSessionMatchesEcdsaCapability(walletSession, publicCapability) || operationCredential.walletSessionId !== walletSessionId) throw new Error(`${label} exact Wallet Session does not match the activated capability`);
+	return {
+		kind: "router_ab_ecdsa_post_registration_session_activated_v1",
+		public_capability: publicCapability,
+		session: {
+			authorization_session_id: requireEcdsaAuthorizationSessionId(sessionRecord.authorization_session_id, `${label}.session.authorization_session_id`),
+			authorization_id: authorizationId,
+			threshold_session_id: requireThresholdEcdsaSessionId(sessionRecord.threshold_session_id, `${label}.session.threshold_session_id`),
+			wallet_session_id: walletSessionId,
+			quota_id: requireMpcWalletSigningQuotaId(sessionRecord.quota_id, `${label}.session.quota_id`),
+			expires_at_ms: expiresAtMs,
+			remaining_uses: requirePositiveCounter(sessionRecord.remaining_uses, `${label}.session.remaining_uses`),
+			wallet_session: walletSession,
+			operation_credential: operationCredential
+		},
+		normal_signing: normalSigning
+	};
+}
+function parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1(value) {
+	const label = "credentialFreeSessionActivated";
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"kind",
+		"public_capability",
+		"session",
+		"normal_signing"
+	]);
+	if (record.kind !== "router_ab_ecdsa_credential_free_session_activated_v1") throw new Error(`${label}.kind is invalid`);
+	const publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(record.public_capability);
+	const sessionRecord = requireRecord(record.session, `${label}.session`);
+	requireExactKeys(sessionRecord, `${label}.session`, [
+		"authorization_session_id",
+		"authorization_id",
+		"threshold_session_id",
+		"wallet_session_id",
+		"quota_id",
+		"expires_at_ms",
+		"remaining_uses"
+	]);
+	const normalSigning = requireRouterAbEcdsaDerivationNormalSigningStateV1(record.normal_signing);
+	if (!sameRouterAbEcdsaDerivationPublicIdentityV1(publicCapability.public_identity, normalSigning.scope.public_identity) || publicCapability.context.application_binding_digest_b64u !== normalSigning.scope.context.application_binding_digest_b64u || normalSigning.scope.activation_epoch !== publicCapability.activation_epoch || !sameRouterAbServerIdentityV1(normalSigning.scope.signing_worker, publicCapability.signer_set.selected_server)) throw new Error(`${label} normal-signing state does not match public capability`);
+	return {
+		kind: "router_ab_ecdsa_credential_free_session_activated_v1",
+		public_capability: publicCapability,
+		session: {
+			authorization_session_id: requireEcdsaAuthorizationSessionId(sessionRecord.authorization_session_id, `${label}.session.authorization_session_id`),
+			authorization_id: requireWalletSessionAuthorizationId(sessionRecord.authorization_id, `${label}.session.authorization_id`),
+			threshold_session_id: requireThresholdEcdsaSessionId(sessionRecord.threshold_session_id, `${label}.session.threshold_session_id`),
+			wallet_session_id: requireWalletSessionId(sessionRecord.wallet_session_id, `${label}.session.wallet_session_id`),
+			quota_id: requireMpcWalletSigningQuotaId(sessionRecord.quota_id, `${label}.session.quota_id`),
+			expires_at_ms: requirePositiveUnixMs(sessionRecord.expires_at_ms, `${label}.session.expires_at_ms`),
+			remaining_uses: requirePositiveCounter(sessionRecord.remaining_uses, `${label}.session.remaining_uses`)
+		},
+		normal_signing: normalSigning
+	};
+}
+function publicDigest32FromBase64Url(value, label = "signing_digest_b64u") {
+	return { bytes: Array.from(base64UrlDecode(requireBase64UrlFixed(value, label, 32))) };
+}
+function samePublicDigest32(left, right) {
+	return left.bytes.length === 32 && right.bytes.length === 32 && left.bytes.every((b, i) => b === right.bytes[i]);
+}
+function sameRouterAbPublicDigest32V1Wire(left, right) {
+	return left.bytes.length === right.bytes.length && left.bytes.every((b, i) => b === right.bytes[i]);
+}
+function sameRegistrationRecipientKeys(left, right) {
+	return left.deriver_a.role === right.deriver_a.role && left.deriver_a.key_epoch === right.deriver_a.key_epoch && left.deriver_a.public_key === right.deriver_a.public_key && left.deriver_b.role === right.deriver_b.role && left.deriver_b.key_epoch === right.deriver_b.key_epoch && left.deriver_b.public_key === right.deriver_b.public_key;
+}
+function sameRouterAbEcdsaRegistrationActivationReceiptV1(left, right) {
+	const leftActivation = left.ecdsa_activation;
+	const rightActivation = right.ecdsa_activation;
+	return left.activation_correlation_id === right.activation_correlation_id && sameRouterAbPublicDigest32V1Wire(left.activation_request_digest, right.activation_request_digest) && left.server_generation === right.server_generation && left.lifecycle_id === right.lifecycle_id && sameRouterAbPublicDigest32V1Wire(left.transcript_digest, right.transcript_digest) && leftActivation.context.application_binding_digest_b64u === rightActivation.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(leftActivation.public_identity, rightActivation.public_identity) && sameRouterAbServerIdentityV1(leftActivation.signing_worker, rightActivation.signing_worker) && sameRouterAbMpcMaterialActivationRef(leftActivation.material_activation, rightActivation.material_activation) && leftActivation.activation_epoch === rightActivation.activation_epoch && leftActivation.activation_digest_b64u === rightActivation.activation_digest_b64u && leftActivation.activated_at_ms === rightActivation.activated_at_ms;
+}
+function sameRouterAbEcdsaDerivationNormalSigningStateV1(left, right) {
+	const leftScope = left.scope;
+	const rightScope = right.scope;
+	return left.kind === right.kind && leftScope.wallet_id === rightScope.wallet_id && leftScope.ecdsa_threshold_key_id === rightScope.ecdsa_threshold_key_id && leftScope.signing_root_id === rightScope.signing_root_id && leftScope.signing_root_version === rightScope.signing_root_version && leftScope.context.application_binding_digest_b64u === rightScope.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(leftScope.public_identity, rightScope.public_identity) && sameRouterAbMpcMaterialActivationRef(leftScope.material_activation, rightScope.material_activation) && sameRouterAbServerIdentityV1(leftScope.signing_worker, rightScope.signing_worker) && leftScope.activation_epoch === rightScope.activation_epoch;
+}
+function sameRouterAbEcdsaDerivationPublicCapabilityV1(left, right) {
+	return left.kind === right.kind && left.context.application_binding_digest_b64u === right.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(left.public_identity, right.public_identity) && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation) && sameRegistrationSignerSet(left.signer_set, right.signer_set) && sameRegistrationRecipientKeys(left.deriver_recipient_keys, right.deriver_recipient_keys) && left.router_id === right.router_id && left.client_id === right.client_id && left.activation_epoch === right.activation_epoch && left.registration_request_digest_b64u === right.registration_request_digest_b64u && left.proof_transcript_digest_b64u === right.proof_transcript_digest_b64u;
+}
+function asciiBytes(value) {
+	return new TextEncoder().encode(requireAsciiNonEmptyString(value, "canonical string"));
+}
+function concatBytes(parts) {
+	const length = parts.reduce((sum, part) => sum + part.length, 0);
+	const out = new Uint8Array(length);
+	let offset = 0;
+	for (const part of parts) {
+		out.set(part, offset);
+		offset += part.length;
+	}
+	return out;
+}
+function pushBytes(out, bytes) {
+	for (const byte of bytes) out.push(byte);
+}
+function pushOperationDigests(out, digests) {
+	pushBytes(out, base64UrlDecode(digests.lane_digest_b64u));
+	pushBytes(out, base64UrlDecode(digests.intent_digest_b64u));
+	pushBytes(out, base64UrlDecode(digests.display_digest_b64u));
+}
+function pushU16(out, value) {
+	if (!Number.isInteger(value) || value < 0 || value > 65535) throw new Error("canonical u16 must be an integer between 0 and 65535");
+	out.push(value >>> 8 & 255, value & 255);
+}
+function pushU32(out, value) {
+	if (!Number.isInteger(value) || value < 0 || value > 4294967295) throw new Error("canonical u32 must be an integer between 0 and 4294967295");
+	out.push(value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255);
+}
+function pushU64(out, value) {
+	if (!Number.isSafeInteger(value) || value < 0) throw new Error("canonical u64 must be a non-negative safe integer");
+	const remaining = BigInt(value);
+	for (let shift = 56; shift >= 0; shift -= 8) out.push(Number(remaining >> BigInt(shift) & 255n));
+}
+function pushLen32(out, bytes) {
+	pushU32(out, bytes.length);
+	pushBytes(out, bytes);
+}
+function pushAsciiU16(out, value) {
+	const bytes = asciiBytes(value);
+	pushU16(out, bytes.length);
+	pushBytes(out, bytes);
+}
+function pushServerIdentity(out, server) {
+	pushLen32(out, asciiBytes(server.server_id));
+	pushLen32(out, asciiBytes(server.key_epoch));
+	pushLen32(out, asciiBytes(server.recipient_encryption_key));
+}
+async function sha256Bytes(input) {
+	const subtle = globalThis.crypto?.subtle;
+	if (!subtle) throw new Error("crypto.subtle is required for Router A/B ECDSA derivation request digest binding");
+	const buffer = new ArrayBuffer(input.byteLength);
+	new Uint8Array(buffer).set(input);
+	return new Uint8Array(await subtle.digest("SHA-256", buffer));
+}
+async function routerAbEcdsaRerandomizationClientCommitmentV1(contribution32) {
+	const contribution = requireUint8ArrayFixed(contribution32, "clientRerandomizationContribution32", 32);
+	return await sha256Bytes(concatBytes([asciiBytes(ROUTER_AB_ECDSA_DERIVATION_CLIENT_RERANDOMIZATION_COMMITMENT_DOMAIN_V1), contribution]));
+}
+function canonicalStableKeyContextBytes(context) {
+	const parsed = parseStableKeyContext(context);
+	const out = [];
+	pushBytes(out, asciiBytes(ECDSA_DERIVATION_CONTEXT_DOMAIN_TAG_V1));
+	pushAsciiU16(out, ECDSA_DERIVATION_SCHEME_ID_V1);
+	pushAsciiU16(out, ECDSA_DERIVATION_CURVE_V1);
+	pushBytes(out, base64UrlDecode(parsed.application_binding_digest_b64u));
+	out.push(ECDSA_DERIVATION_PARTICIPANT_IDS_V1.length);
+	for (const participantId of ECDSA_DERIVATION_PARTICIPANT_IDS_V1) pushU16(out, participantId);
+	return new Uint8Array(out);
+}
+function contextBindingFrame(contextBytes) {
+	const out = [];
+	pushBytes(out, asciiBytes(ECDSA_DERIVATION_CONTEXT_BINDING_DOMAIN_V1));
+	out.push(1);
+	out.push(ECDSA_DERIVATION_CONTEXT_FIELD_BYTES_V1);
+	pushU16(out, contextBytes.length);
+	pushBytes(out, contextBytes);
+	return new Uint8Array(out);
+}
+async function routerAbEcdsaDerivationContextBindingDigestV1(context) {
+	return publicDigest32FromCanonicalBytes(contextBindingFrame(canonicalStableKeyContextBytes(context)));
+}
+function canonicalPublicIdentityBytes(publicIdentity) {
+	const parsed = parsePublicIdentity(publicIdentity);
+	const out = [];
+	pushLen32(out, asciiBytes(ROUTER_AB_ECDSA_DERIVATION_PUBLIC_IDENTITY_VERSION_V1));
+	pushLen32(out, asciiBytes(parsed.context_binding_b64u));
+	pushLen32(out, asciiBytes(parsed.derivation_client_share_public_key33_b64u));
+	pushLen32(out, asciiBytes(parsed.server_public_key33_b64u));
+	pushLen32(out, asciiBytes(parsed.threshold_public_key33_b64u));
+	pushLen32(out, asciiBytes(parsed.ethereum_address20_b64u));
+	pushU32(out, parsed.client_share_retry_counter);
+	pushU32(out, parsed.server_share_retry_counter);
+	return new Uint8Array(out);
+}
+function canonicalNormalSigningScopeBytes(scope) {
+	const parsed = parseRouterAbEcdsaDerivationNormalSigningScopeV1(scope);
+	const out = [];
+	pushLen32(out, asciiBytes(ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_SCOPE_VERSION_V1));
+	pushLen32(out, asciiBytes(parsed.wallet_id));
+	pushLen32(out, asciiBytes(parsed.ecdsa_threshold_key_id));
+	pushLen32(out, asciiBytes(parsed.signing_root_id));
+	pushLen32(out, asciiBytes(parsed.signing_root_version));
+	pushLen32(out, canonicalStableKeyContextBytes(parsed.context));
+	pushLen32(out, canonicalPublicIdentityBytes(parsed.public_identity));
+	out.push(...canonicalRouterAbMpcMaterialActivationRefBytes(parsed.material_activation));
+	pushServerIdentity(out, parsed.signing_worker);
+	pushLen32(out, asciiBytes(parsed.activation_epoch));
+	return new Uint8Array(out);
+}
+function routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1(scope) {
+	return canonicalNormalSigningScopeBytes(scope);
+}
+function sameCanonicalBytes(left, right) {
+	return left.length === right.length && left.every((byte, index) => byte === right[index]);
+}
+function sameRouterAbEcdsaDerivationNormalSigningScopeV1(left, right) {
+	try {
+		return sameCanonicalBytes(routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1(left), routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1(right));
+	} catch {
+		return false;
+	}
+}
+async function publicDigest32FromCanonicalBytes(bytes) {
+	return { bytes: Array.from(await sha256Bytes(bytes)) };
+}
+async function verifyRouterAbEcdsaDerivationNormalSigningScopeContextBindingV1(scope) {
+	const parsed = parseRouterAbEcdsaDerivationNormalSigningScopeV1(scope);
+	const expected = await routerAbEcdsaDerivationContextBindingDigestV1(parsed.context);
+	if (!samePublicDigest32(publicDigest32FromBase64Url(parsed.public_identity.context_binding_b64u, "scope.public_identity.context_binding_b64u"), expected)) throw new Error("scope.public_identity.context_binding_b64u does not match scope.context");
+	return parsed;
+}
+function routerAbEcdsaDerivationEvmDigestSigningRequestCanonicalBytesV1(request) {
+	const parsed = parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(request);
+	const out = [];
+	pushLen32(out, asciiBytes(ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_REQUEST_VERSION_V1));
+	pushLen32(out, canonicalNormalSigningScopeBytes(parsed.scope));
+	pushLen32(out, asciiBytes(parsed.request_id));
+	pushLen32(out, asciiBytes(parsed.operation_id));
+	pushOperationDigests(out, parsed.operation_digests);
+	out.push(...canonicalRouterAbNormalSigningAuthorizationBytes(parsed.authorization));
+	out.push(...canonicalRouterAbMpcMaterialActivationRefBytes(parsed.material_activation));
+	pushLen32(out, asciiBytes(parsed.client_presignature_id));
+	pushU64(out, parsed.expires_at_ms);
+	pushBytes(out, base64UrlDecode(parsed.signing_digest_b64u));
+	pushLen32(out, base64UrlDecode(parsed.client_rerandomization_commitment32_b64u));
+	return new Uint8Array(out);
+}
+async function routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1(request) {
+	const parsed = parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(request);
+	await verifyRouterAbEcdsaDerivationNormalSigningScopeContextBindingV1(parsed.scope);
+	return publicDigest32FromCanonicalBytes(routerAbEcdsaDerivationEvmDigestSigningRequestCanonicalBytesV1(parsed));
+}
+function routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestCanonicalBytesV1(request) {
+	const parsed = parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1(request);
+	const out = [];
+	pushLen32(out, asciiBytes(ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_FINALIZE_REQUEST_VERSION_V1));
+	pushLen32(out, canonicalNormalSigningScopeBytes(parsed.scope));
+	pushLen32(out, asciiBytes(parsed.request_id));
+	pushLen32(out, asciiBytes(parsed.operation_id));
+	pushOperationDigests(out, parsed.operation_digests);
+	out.push(...canonicalRouterAbNormalSigningAuthorizationBytes(parsed.authorization));
+	out.push(...canonicalRouterAbMpcMaterialActivationRefBytes(parsed.material_activation));
+	pushU64(out, parsed.expires_at_ms);
+	pushBytes(out, base64UrlDecode(parsed.signing_digest_b64u));
+	pushLen32(out, asciiBytes(parsed.server_presignature_id));
+	pushLen32(out, base64UrlDecode(parsed.client_signature_share32_b64u));
+	pushLen32(out, base64UrlDecode(parsed.client_rerandomization_contribution32_b64u));
+	return new Uint8Array(out);
+}
+async function routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1(request) {
+	const parsed = parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1(request);
+	await verifyRouterAbEcdsaDerivationNormalSigningScopeContextBindingV1(parsed.scope);
+	return publicDigest32FromCanonicalBytes(routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestCanonicalBytesV1(parsed));
+}
+function parseRouterAbEcdsaDerivationNormalSigningScopeV1(value) {
+	const record = requireRecord(value, "scope");
+	requireExactKeys(record, "scope", [
+		"wallet_id",
+		"ecdsa_threshold_key_id",
+		"signing_root_id",
+		"signing_root_version",
+		"context",
+		"public_identity",
+		"material_activation",
+		"signing_worker",
+		"activation_epoch"
+	]);
+	return {
+		wallet_id: requireAsciiNonEmptyString(record.wallet_id, "scope.wallet_id"),
+		ecdsa_threshold_key_id: requireAsciiNonEmptyString(record.ecdsa_threshold_key_id, "scope.ecdsa_threshold_key_id"),
+		signing_root_id: requireAsciiNonEmptyString(record.signing_root_id, "scope.signing_root_id"),
+		signing_root_version: requireAsciiNonEmptyString(record.signing_root_version, "scope.signing_root_version"),
+		context: parseStableKeyContext(record.context),
+		public_identity: parsePublicIdentity(record.public_identity),
+		material_activation: parseRouterAbMpcMaterialActivationRef(record.material_activation),
+		signing_worker: parseServerIdentity(record.signing_worker),
+		activation_epoch: requireRootShareEpoch(record.activation_epoch, "scope.activation_epoch")
+	};
+}
+function parseRouterAbEcdsaDerivationNormalSigningStateV1(value) {
+	if (value === void 0 || value === null) return null;
+	const record = requireRecord(value, "routerAbEcdsaDerivationNormalSigning");
+	requireExactKeys(record, "routerAbEcdsaDerivationNormalSigning", ["kind", "scope"]);
+	if (requireAsciiNonEmptyString(record.kind, "routerAbEcdsaDerivationNormalSigning.kind") !== "router_ab_ecdsa_derivation_normal_signing_v1") throw new Error("routerAbEcdsaDerivationNormalSigning.kind is not supported");
+	return {
+		kind: ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1,
+		scope: parseRouterAbEcdsaDerivationNormalSigningScopeV1(record.scope)
+	};
+}
+function requireRouterAbEcdsaDerivationNormalSigningStateV1(value) {
+	const parsed = parseRouterAbEcdsaDerivationNormalSigningStateV1(value);
+	if (!parsed) throw new Error("Router A/B ECDSA derivation normal-signing state is required");
+	return parsed;
+}
+function buildRouterAbEcdsaDerivationActiveStateIdV1(input) {
+	const parsed = parseEcdsaActiveStateId([
+		requireAsciiNonEmptyString(input.ecdsaThresholdKeyId, "ecdsaThresholdKeyId"),
+		requireAsciiNonEmptyString(input.signingRootId, "signingRootId"),
+		requireAsciiNonEmptyString(input.signingRootVersion, "signingRootVersion"),
+		requireRootShareEpoch(input.activationEpoch, "activationEpoch")
+	].join(":"));
+	if (!parsed.ok) throw new Error(`activeStateId ${parsed.error.message}`);
+	return parsed.value;
+}
+function routerAbEcdsaDerivationActiveStateId(state) {
+	return buildRouterAbEcdsaDerivationActiveStateIdV1({
+		ecdsaThresholdKeyId: state.scope.ecdsa_threshold_key_id,
+		signingRootId: state.scope.signing_root_id,
+		signingRootVersion: state.scope.signing_root_version,
+		activationEpoch: state.scope.activation_epoch
+	});
+}
+function parseRouterAbEcdsaDerivationOperationDigestsV1(value, label) {
+	const record = requireRecord(value, label);
+	requireExactKeys(record, label, [
+		"lane_digest_b64u",
+		"intent_digest_b64u",
+		"display_digest_b64u"
+	]);
+	return {
+		lane_digest_b64u: requireBase64UrlFixed(record.lane_digest_b64u, `${label}.lane_digest_b64u`, 32),
+		intent_digest_b64u: requireBase64UrlFixed(record.intent_digest_b64u, `${label}.intent_digest_b64u`, 32),
+		display_digest_b64u: requireBase64UrlFixed(record.display_digest_b64u, `${label}.display_digest_b64u`, 32)
+	};
+}
+function buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input) {
+	return parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1({
+		scope: input.scope,
+		request_id: input.requestId,
+		operation_id: input.operationId,
+		operation_digests: input.operationDigests,
+		authorization: input.authorization,
+		material_activation: input.materialActivation,
+		client_presignature_id: input.clientPresignatureId,
+		expires_at_ms: input.expiresAtMs,
+		signing_digest_b64u: base64UrlEncode(requireUint8ArrayFixed(input.signingDigest32, "signingDigest32", 32)),
+		client_rerandomization_commitment32_b64u: base64UrlEncode(requireUint8ArrayFixed(input.clientRerandomizationCommitment32, "clientRerandomizationCommitment32", 32))
+	});
+}
+function parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(value) {
+	const record = requireRecord(value, "ecdsaSigningRequest");
+	requireExactKeys(record, "ecdsaSigningRequest", [
+		"scope",
+		"request_id",
+		"operation_id",
+		"operation_digests",
+		"authorization",
+		"material_activation",
+		"client_presignature_id",
+		"expires_at_ms",
+		"signing_digest_b64u",
+		"client_rerandomization_commitment32_b64u"
+	]);
+	const parsed = {
+		scope: parseRouterAbEcdsaDerivationNormalSigningScopeV1(record.scope),
+		request_id: requireAsciiNonEmptyString(record.request_id, "ecdsaSigningRequest.request_id"),
+		operation_id: requireAsciiNonEmptyString(record.operation_id, "ecdsaSigningRequest.operation_id"),
+		operation_digests: parseRouterAbEcdsaDerivationOperationDigestsV1(record.operation_digests, "ecdsaSigningRequest.operation_digests"),
+		authorization: parseRouterAbNormalSigningAuthorization(record.authorization),
+		material_activation: parseRouterAbMpcMaterialActivationRef(record.material_activation),
+		client_presignature_id: requireAsciiNonEmptyString(record.client_presignature_id, "ecdsaSigningRequest.client_presignature_id"),
+		expires_at_ms: requirePositiveUnixMs(record.expires_at_ms, "ecdsaSigningRequest.expires_at_ms"),
+		signing_digest_b64u: requireBase64UrlFixed(record.signing_digest_b64u, "ecdsaSigningRequest.signing_digest_b64u", 32),
+		client_rerandomization_commitment32_b64u: requireBase64UrlFixed(record.client_rerandomization_commitment32_b64u, "ecdsaSigningRequest.client_rerandomization_commitment32_b64u", 32)
+	};
+	if (parsed.operation_digests.intent_digest_b64u !== parsed.signing_digest_b64u) throw new Error("ecdsaSigningRequest intent digest must equal the admitted signing digest");
+	return parsed;
+}
+function parseRouterAbEcdsaOperationStepUpWebAuthnCredentialV1(value) {
+	const credential = requireRecord(value, "webauthn_authentication");
+	requireExactKeys(credential, "webauthn_authentication", [
+		"id",
+		"rawId",
+		"type",
+		"authenticatorAttachment",
+		"response",
+		"clientExtensionResults"
+	]);
+	const response = requireRecord(credential.response, "webauthn_authentication.response");
+	requireExactKeys(response, "webauthn_authentication.response", [
+		"clientDataJSON",
+		"authenticatorData",
+		"signature",
+		"userHandle"
+	]);
+	const authenticatorAttachment = credential.authenticatorAttachment === null ? null : requireAsciiNonEmptyString(credential.authenticatorAttachment, "webauthn_authentication.authenticatorAttachment");
+	const userHandle = response.userHandle === null ? null : requireAsciiNonEmptyString(response.userHandle, "webauthn_authentication.response.userHandle");
+	return {
+		id: requireAsciiNonEmptyString(credential.id, "webauthn_authentication.id"),
+		rawId: requireAsciiNonEmptyString(credential.rawId, "webauthn_authentication.rawId"),
+		type: requireAsciiNonEmptyString(credential.type, "webauthn_authentication.type"),
+		authenticatorAttachment,
+		response: {
+			clientDataJSON: requireAsciiNonEmptyString(response.clientDataJSON, "webauthn_authentication.response.clientDataJSON"),
+			authenticatorData: requireAsciiNonEmptyString(response.authenticatorData, "webauthn_authentication.response.authenticatorData"),
+			signature: requireAsciiNonEmptyString(response.signature, "webauthn_authentication.response.signature"),
+			userHandle
+		},
+		clientExtensionResults: credential.clientExtensionResults
+	};
+}
+function parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1(value) {
+	const request = requireRecord(value, "operationStepUpAuthorizationRequest");
+	requireExactKeys(request, "operationStepUpAuthorizationRequest", [
+		"kind",
+		"operation",
+		"proof"
+	]);
+	if (request.kind !== "router_ab_ecdsa_operation_step_up_v1") throw new Error("operationStepUpAuthorizationRequest.kind must be router_ab_ecdsa_operation_step_up_v1");
+	const operation = parseRouterAbEcdsaOperationStepUpPreparationV1(request.operation);
+	const proof = requireRecord(request.proof, "operationStepUpAuthorizationRequest.proof");
+	const authority = parseWalletAuthAuthority(proof.authority);
+	let parsedProof;
+	switch (proof.kind) {
+		case "passkey":
+			requireExactKeys(proof, "operationStepUpAuthorizationRequest.proof", [
+				"kind",
+				"authority",
+				"webauthn_authentication"
+			]);
+			if (!authority || !isPasskeyWalletAuthAuthority(authority)) throw new Error("operationStepUpAuthorizationRequest.proof requires an exact passkey authority");
+			parsedProof = {
+				kind: "passkey",
+				authority,
+				webauthn_authentication: parseRouterAbEcdsaOperationStepUpWebAuthnCredentialV1(proof.webauthn_authentication)
+			};
+			break;
+		case "email_otp":
+			requireExactKeys(proof, "operationStepUpAuthorizationRequest.proof", [
+				"kind",
+				"authority",
+				"challenge_id",
+				"otp_code"
+			]);
+			if (!authority || !isEmailOtpWalletAuthAuthority(authority)) throw new Error("operationStepUpAuthorizationRequest.proof requires an exact Email OTP authority");
+			parsedProof = {
+				kind: "email_otp",
+				authority,
+				challenge_id: requireAsciiNonEmptyString(proof.challenge_id, "operationStepUpAuthorizationRequest.proof.challenge_id"),
+				otp_code: requireAsciiNonEmptyString(proof.otp_code, "operationStepUpAuthorizationRequest.proof.otp_code")
+			};
+			break;
+		default: throw new Error("operationStepUpAuthorizationRequest.proof.kind is invalid");
+	}
+	return {
+		kind: "router_ab_ecdsa_operation_step_up_v1",
+		operation,
+		proof: parsedProof
+	};
+}
+function parseRouterAbEcdsaOperationStepUpPreparationV1(value) {
+	const operation = requireRecord(value, "ecdsaOperationStepUpPreparation");
+	requireExactKeys(operation, "operationStepUpGrantRequest.operation", [
+		"wallet_id",
+		"operation_kind",
+		"operation_id",
+		"operation_digests",
+		"material_activation",
+		"normal_signing_scope",
+		"signing_worker_id",
+		"key_handle",
+		"relayer_key_id",
+		"participant_ids",
+		"expires_at_ms"
+	]);
+	if (!Array.isArray(operation.participant_ids) || operation.participant_ids.length !== 2 || !operation.participant_ids.every((participantId) => Number.isSafeInteger(participantId) && participantId > 0)) throw new Error("operationStepUpGrantRequest.operation.participant_ids must contain two positive integers");
+	return {
+		wallet_id: requireAsciiNonEmptyString(operation.wallet_id, "operationStepUpGrantRequest.operation.wallet_id"),
+		operation_kind: requireEcdsaOperationStepUpKind(operation.operation_kind),
+		operation_id: requireAsciiNonEmptyString(operation.operation_id, "operationStepUpGrantRequest.operation.operation_id"),
+		operation_digests: parseRouterAbEcdsaDerivationOperationDigestsV1(operation.operation_digests, "operationStepUpGrantRequest.operation.operation_digests"),
+		material_activation: parseRouterAbMpcMaterialActivationRef(operation.material_activation),
+		normal_signing_scope: parseRouterAbEcdsaDerivationNormalSigningScopeV1(operation.normal_signing_scope),
+		signing_worker_id: requireAsciiNonEmptyString(operation.signing_worker_id, "operationStepUpGrantRequest.operation.signing_worker_id"),
+		key_handle: requireAsciiNonEmptyString(operation.key_handle, "operationStepUpGrantRequest.operation.key_handle"),
+		relayer_key_id: requireAsciiNonEmptyString(operation.relayer_key_id, "operationStepUpGrantRequest.operation.relayer_key_id"),
+		participant_ids: [Number(operation.participant_ids[0]), Number(operation.participant_ids[1])],
+		expires_at_ms: requirePositiveUnixMs(operation.expires_at_ms, "operationStepUpGrantRequest.operation.expires_at_ms")
+	};
+}
+function requireEcdsaOperationStepUpKind(value) {
+	switch (value) {
+		case EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction:
+		case EVM_ECDSA_MPC_OPERATION_KINDS.exportKey: return value;
+		default: throw new Error("operationStepUpGrantRequest.operation.operation_kind must be evm.sign_transaction or evm.export_key");
+	}
+}
+function buildRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input) {
+	return parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1({
+		scope: input.scope,
+		request_id: input.requestId,
+		operation_id: input.operationId,
+		operation_digests: input.operationDigests,
+		authorization: input.authorization,
+		material_activation: input.materialActivation,
+		expires_at_ms: input.expiresAtMs,
+		signing_digest_b64u: base64UrlEncode(requireUint8ArrayFixed(input.signingDigest32, "signingDigest32", 32)),
+		server_presignature_id: input.serverPresignatureId,
+		client_signature_share32_b64u: base64UrlEncode(requireUint8ArrayFixed(input.clientSignatureShare32, "clientSignatureShare32", 32)),
+		client_rerandomization_contribution32_b64u: base64UrlEncode(requireUint8ArrayFixed(input.clientRerandomizationContribution32, "clientRerandomizationContribution32", 32))
+	});
+}
+function parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1(value) {
+	const record = requireRecord(value, "ecdsaFinalizeCoreRequest");
+	requireExactKeys(record, "ecdsaFinalizeCoreRequest", [
+		"scope",
+		"request_id",
+		"operation_id",
+		"operation_digests",
+		"authorization",
+		"material_activation",
+		"expires_at_ms",
+		"signing_digest_b64u",
+		"server_presignature_id",
+		"client_signature_share32_b64u",
+		"client_rerandomization_contribution32_b64u"
+	]);
+	return parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestFields(record);
+}
+function parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestFields(record) {
+	const parsed = {
+		scope: parseRouterAbEcdsaDerivationNormalSigningScopeV1(record.scope),
+		request_id: requireAsciiNonEmptyString(record.request_id, "ecdsaFinalizeRequest.request_id"),
+		operation_id: requireAsciiNonEmptyString(record.operation_id, "ecdsaFinalizeRequest.operation_id"),
+		operation_digests: parseRouterAbEcdsaDerivationOperationDigestsV1(record.operation_digests, "ecdsaFinalizeRequest.operation_digests"),
+		authorization: parseRouterAbNormalSigningAuthorization(record.authorization),
+		material_activation: parseRouterAbMpcMaterialActivationRef(record.material_activation),
+		expires_at_ms: requirePositiveUnixMs(record.expires_at_ms, "ecdsaFinalizeRequest.expires_at_ms"),
+		signing_digest_b64u: requireBase64UrlFixed(record.signing_digest_b64u, "ecdsaFinalizeRequest.signing_digest_b64u", 32),
+		server_presignature_id: requireAsciiNonEmptyString(record.server_presignature_id, "ecdsaFinalizeRequest.server_presignature_id"),
+		client_signature_share32_b64u: requireBase64UrlFixed(record.client_signature_share32_b64u, "ecdsaFinalizeRequest.client_signature_share32_b64u", 32),
+		client_rerandomization_contribution32_b64u: requireBase64UrlFixed(record.client_rerandomization_contribution32_b64u, "ecdsaFinalizeRequest.client_rerandomization_contribution32_b64u", 32)
+	};
+	if (parsed.operation_digests.intent_digest_b64u !== parsed.signing_digest_b64u) throw new Error("ecdsaFinalizeRequest intent digest must equal the admitted signing digest");
+	return parsed;
+}
+function parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseV1(value) {
+	const record = requireRecord(value, "ecdsaPrepareResponse");
+	requireExactKeys(record, "ecdsaPrepareResponse", [
+		"scope",
+		"request_id",
+		"request_digest",
+		"signing_digest",
+		"server_presignature_id",
+		"server_big_r33_b64u",
+		"signing_worker_rerandomization_contribution32_b64u",
+		"signature_scheme",
+		"prepared_at_ms",
+		"expires_at_ms"
+	]);
+	return {
+		scope: parseRouterAbEcdsaDerivationNormalSigningScopeV1(record.scope),
+		request_id: requireAsciiNonEmptyString(record.request_id, "ecdsaPrepareResponse.request_id"),
+		request_digest: parsePublicDigest32(record.request_digest, "ecdsaPrepareResponse.request_digest"),
+		signing_digest: parsePublicDigest32(record.signing_digest, "ecdsaPrepareResponse.signing_digest"),
+		server_presignature_id: requireAsciiNonEmptyString(record.server_presignature_id, "ecdsaPrepareResponse.server_presignature_id"),
+		server_big_r33_b64u: requireBase64UrlFixed(record.server_big_r33_b64u, "ecdsaPrepareResponse.server_big_r33_b64u", 33),
+		signing_worker_rerandomization_contribution32_b64u: requireBase64UrlFixed(record.signing_worker_rerandomization_contribution32_b64u, "ecdsaPrepareResponse.signing_worker_rerandomization_contribution32_b64u", 32),
+		signature_scheme: requireSignatureScheme(record.signature_scheme, "ecdsaPrepareResponse.signature_scheme"),
+		prepared_at_ms: requirePositiveUnixMs(record.prepared_at_ms, "ecdsaPrepareResponse.prepared_at_ms"),
+		expires_at_ms: requirePositiveUnixMs(record.expires_at_ms, "ecdsaPrepareResponse.expires_at_ms")
+	};
+}
+async function parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1(request, value) {
+	const parsedRequest = parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(request);
+	const response = parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseV1(value);
+	if (!sameRouterAbEcdsaDerivationNormalSigningScopeV1(response.scope, parsedRequest.scope)) throw new Error("ecdsaPrepareResponse.scope does not match request");
+	if (response.request_id !== parsedRequest.request_id) throw new Error("ecdsaPrepareResponse.request_id does not match request");
+	if (response.server_presignature_id !== parsedRequest.client_presignature_id) throw new Error("ecdsaPrepareResponse.server_presignature_id does not match request");
+	if (!samePublicDigest32(response.signing_digest, publicDigest32FromBase64Url(parsedRequest.signing_digest_b64u))) throw new Error("ecdsaPrepareResponse.signing_digest does not match request");
+	if (response.expires_at_ms !== parsedRequest.expires_at_ms) throw new Error("ecdsaPrepareResponse.expires_at_ms does not match request");
+	if (!samePublicDigest32(response.request_digest, await routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1(parsedRequest))) throw new Error("ecdsaPrepareResponse.request_digest does not match request");
+	return response;
+}
+function parseRouterAbEcdsaDerivationEvmDigestSigningResponseV1(value) {
+	const record = requireRecord(value, "ecdsaSigningResponse");
+	requireExactKeys(record, "ecdsaSigningResponse", [
+		"scope",
+		"request_id",
+		"request_digest",
+		"signing_digest",
+		"signature_scheme",
+		"signature65_b64u"
+	]);
+	return {
+		scope: parseRouterAbEcdsaDerivationNormalSigningScopeV1(record.scope),
+		request_id: requireAsciiNonEmptyString(record.request_id, "ecdsaSigningResponse.request_id"),
+		request_digest: parsePublicDigest32(record.request_digest, "ecdsaSigningResponse.request_digest"),
+		signing_digest: parsePublicDigest32(record.signing_digest, "ecdsaSigningResponse.signing_digest"),
+		signature_scheme: requireSignatureScheme(record.signature_scheme, "ecdsaSigningResponse.signature_scheme"),
+		signature65_b64u: requireBase64UrlFixed(record.signature65_b64u, "ecdsaSigningResponse.signature65_b64u", 65)
+	};
+}
+async function parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreRequestV1(request, value) {
+	const parsedRequest = parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1(request);
+	const response = parseRouterAbEcdsaDerivationEvmDigestSigningResponseV1(value);
+	if (!sameRouterAbEcdsaDerivationNormalSigningScopeV1(response.scope, parsedRequest.scope)) throw new Error("ecdsaSigningResponse.scope does not match request");
+	if (response.request_id !== parsedRequest.request_id) throw new Error("ecdsaSigningResponse.request_id does not match request");
+	if (!samePublicDigest32(response.signing_digest, publicDigest32FromBase64Url(parsedRequest.signing_digest_b64u))) throw new Error("ecdsaSigningResponse.signing_digest does not match request");
+	if (!samePublicDigest32(response.request_digest, await routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1(parsedRequest))) throw new Error("ecdsaSigningResponse.request_digest does not match request");
+	return response;
+}
+//#endregion
+//#region ../shared-ts/src/utils/authenticatorOptions.ts
+let UserVerificationPolicy = /* @__PURE__ */ function(UserVerificationPolicy) {
+	UserVerificationPolicy["Required"] = "required";
+	UserVerificationPolicy["Preferred"] = "preferred";
+	UserVerificationPolicy["Discouraged"] = "discouraged";
+	return UserVerificationPolicy;
+}({});
+function cloneAuthenticatorOptions(options) {
+	const multiple = options.originPolicy?.multiple;
+	return {
+		userVerification: options.userVerification,
+		originPolicy: {
+			single: options.originPolicy?.single,
+			all_subdomains: options.originPolicy?.all_subdomains,
+			multiple: Array.isArray(multiple) ? [...multiple] : void 0
+		}
+	};
+}
+//#endregion
+//#region src/core/signingEngine/workerManager/ecdsaPresignLifecycle.ts
+const MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS = 2160 * 60 * 6e4;
+//#endregion
+export { parseEmailOtpWalletAuthAuthority as $, wireLiteral as $t, parseRouterAbEcdsaVerifiedClientActivationFactsV1 as A, parseActiveWalletSessionV1 as At, sameRouterAbEcdsaDerivationNormalSigningStateV1 as B, parseDelegatedWalletAuthority as Bt, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1 as C, parseRouterAbMpcMaterialActivationRef as Ct, parseRouterAbEcdsaRegistrationPublicActivationReceiptV1 as D, sameRouterAbMpcMaterialActivationRef as Dt, parseRouterAbEcdsaRegistrationActivationReceiptV1 as E, routerAbMpcMaterialActivationRefToWire as Et, routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1 as F, digest as Ft, sameRouterAbServerIdentityV1 as G, rpId as Gt, sameRouterAbEcdsaDerivationPublicIdentityV1 as H, parseNonNegativeSafeInteger as Ht, routerAbEcdsaRerandomizationClientCommitmentV1 as I, enrollmentId as It, emailOtpWalletAuthAuthorityEmailHashHex as J, walletAuthorityId as Jt, buildEmailOtpWalletAuthAuthority as K, sessionId as Kt, sameRegistrationRecipientKeys as L, keyLabeled as Lt, routerAbEcdsaDerivationActiveStateId as M, walletSessionPreservesCapabilities as Mt, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1 as N, authorizationDeviceId as Nt, parseRouterAbEcdsaRegistrationRequestFactsV1 as O, requireRouterAbX25519PublicKey as Ot, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1 as P, credentialId as Pt, isPasskeyWalletAuthAuthority as Q, walletSessionId as Qt, sameRegistrationSignerSet as R, linkedDeviceId as Rt, parseRouterAbEcdsaOperationStepUpPreparationV1 as S, canonicalRouterAbMpcMaterialActivationRefBytes as St, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1 as T, routerAbMpcMaterialActivationRefFromWire as Tt, sameRouterAbEcdsaRegistrationActivationReceiptV1 as U, parseTargetEmail as Ut, sameRouterAbEcdsaDerivationPublicCapabilityV1 as V, parseNonEmptyToken as Vt, sameRouterAbEcdsaVerifiedClientActivationFactsV1 as W, parseUnixTime as Wt, emailOtpWalletAuthAuthorityProviderUserId as X, walletKeyId as Xt, emailOtpWalletAuthAuthorityProvider as Y, walletId as Yt, isEmailOtpWalletAuthAuthority as Z, walletSessionAuthorizationId as Zt, parseRouterAbEcdsaDerivationNormalSigningStateV1 as _, computeEcdsaDerivationRoleLocalRelayerKeyId as _t, ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH as a, parseCanonicalEcdsaServerActivationRequest as at, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1 as b, parseSdkEcdsaDerivationSigningRootVersion as bt, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH as c, parseEcdsaCapabilityManifestRevision as ct, buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1 as d, parseEcdsaIv12B64u as dt, wireNullable as en, parsePasskeyWalletAuthAuthority as et, computeRouterAbEcdsaOperationStepUpChallengeB64u as f, parseEcdsaLifecycleId as ft, parseRouterAbEcdsaDerivationNormalSigningScopeV1 as g, parseEvmFamilyEcdsaSignerId as gt, parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreRequestV1 as h, parseEcdsaServerGeneration as ht, ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH as i, walletAuthAuthorityRef as it, requireRouterAbEcdsaDerivationNormalSigningStateV1 as j, parseWalletSessionOperationCredentialV1 as jt, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1 as k, activeWalletSessionV1RecordsEqual as kt, ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS as l, parseEcdsaCiphertextB64u as lt, parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1 as m, parseEcdsaPendingCiphertextDigest as mt, UserVerificationPolicy as n, wireResult as nn, parseWalletAuthAuthorityRef as nt, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH as o, parseEcdsaActivationDigest as ot, parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1 as p, parseEcdsaMaterialSealingKeyId as pt, buildPasskeyWalletAuthAuthority as q, walletAuthMethodId as qt, cloneAuthenticatorOptions as r, wireUnion as rn, walletAuthAuthoritiesMatch as rt, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH as s, parseEcdsaCapabilityManifestId as st, MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS as t, wireObject as tn, parseWalletAuthAuthority as tt, buildRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1 as u, parseEcdsaCiphertextDigest as ut, parseRouterAbEcdsaDerivationPublicCapabilityV1 as v, ecdsaClientRootPublicKey33B64uFromString as vt, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1 as w, parseRouterAbNormalSigningAuthorization as wt, parseRouterAbEcdsaOperationStepUpAuthorizationResponseV1 as x, parseSdkEcdsaDerivationThresholdKeyId as xt, parseRouterAbEcdsaExplicitExportForwardedResponseV1 as y, parseSdkEcdsaDerivationSigningRootId as yt, sameRouterAbEcdsaDerivationNormalSigningScopeV1 as z, nullableToken as zt };