@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/react/core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestRecords.js

@@ -1,848 +0,0 @@
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { requireArray, requireRecord } from "../../../shared-ts/src/utils/validation.js";
-import { alphabetizeStringify, sha256Bytes } from "../../../shared-ts/src/utils/digests.js";
-import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { mpcMaterialActivationRefsEqual, parseCapabilityInstanceRef, parseMpcMaterialOwnerRef } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseCorrelationId, parseDigestB64u, parseIsoTimestamp } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { parseCanonicalEcdsaServerActivationRequest, parseEcdsaCapabilityManifestId, parseEcdsaCapabilityManifestRevision, parseEcdsaCiphertextB64u, parseEcdsaCiphertextDigest, parseEcdsaIv12B64u, parseEcdsaMaterialSealingKeyId, parseEcdsaPendingCiphertextDigest, parseEcdsaServerGeneration, parseEvmFamilyEcdsaSignerId } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
-import { parseWalletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { parseRouterAbEcdsaRegistrationActivationReceiptV1, requireRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { thresholdEcdsaChainTargetFromRequest } from "../../signingEngine/interfaces/ecdsaChainTarget.js";
-import { buildVerifiedEcdsaPublicFacts, toEvmFamilyEcdsaKeyHandle, toParticipantId } from "../../signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
-import { SEAMS_WALLET_STORES } from "../schemaNames.js";
-import { parseEcdsaKeyHandle, parseEcdsaRelayerKeyId } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
-import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRoleLocalBindingDigest, parseEcdsaRoleLocalDurableMaterialRef, parseEcdsaThresholdKeyId } from "../../signingEngine/session/keyMaterialBrands.js";
-import { buildEcdsaRoleLocalPublicFacts } from "../../signingEngine/session/persistence/ecdsaRoleLocalRecords.js";
-import { buildActiveEcdsaCapabilityManifest, buildDurableEcdsaMaterialBinding, buildEcdsaActivationBinding, buildEcdsaCapabilityScope, buildEcdsaManifestIdentity, buildEcdsaRoleLocalMaterialBinding, buildEcdsaServerActivationCommit, buildEncryptedEcdsaPendingCandidate, buildExactEcdsaManifestExpectation, buildExactEcdsaServerGenerationExpectation, buildNoCurrentEcdsaManifestExpectation, buildNoCurrentEcdsaServerGenerationExpectation, buildPreparedEcdsaActivationCandidate, buildPreparedEcdsaActivationJournal, buildPreparedEvmFamilySigner, buildReplacedEcdsaCapabilityManifest, buildServerCommittedEcdsaActivationJournal, buildValidatedEncryptedEcdsaReadyMaterial, unwrapDomainId } from "../../signingEngine/session/material/ecdsaCapabilityManifest.js";
-//#region src/core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestRecords.ts
-const MANIFEST_RECORD_VERSION = "ecdsa_capability_manifest_v3";
-const POINTER_RECORD_VERSION = "ecdsa_current_capability_manifest_v2";
-const MATERIAL_RECORD_VERSION = "ecdsa_role_local_material_v2";
-const JOURNAL_RECORD_VERSION = "ecdsa_activation_commit_journal_v1";
-const SEALING_KEY_RECORD_VERSION = "ecdsa_material_sealing_key_v1";
-const MANIFEST_STORE = SEAMS_WALLET_STORES.ecdsaCapabilityManifests;
-const POINTER_STORE = SEAMS_WALLET_STORES.ecdsaCurrentCapabilityManifests;
-const MATERIAL_STORE = SEAMS_WALLET_STORES.ecdsaRoleLocalMaterial;
-const JOURNAL_STORE = SEAMS_WALLET_STORES.ecdsaActivationCommitJournals;
-const SEALING_KEY_STORE = SEAMS_WALLET_STORES.ecdsaMaterialSealingKeys;
-const PRESIGNATURE_STORE = SEAMS_WALLET_STORES.ecdsaClientPresignatures;
-function requireExactKeys(record, label, expectedKeys) {
-	const actual = Object.keys(record).sort();
-	const expected = [...expectedKeys].sort();
-	if (actual.length !== expected.length || actual.some((field, index) => field !== expected[index])) throw new Error(`${label} has unexpected fields`);
-}
-function normalizeSelector(selector) {
-	const authority = parseWalletAuthAuthorityRef(selector.authority);
-	if (!authority) throw new Error("ECDSA capability selector authority is invalid");
-	return {
-		capability: unwrapDomainId(parseCapabilityInstanceRef(selector.capability)),
-		authority
-	};
-}
-function selectorFromSigner(signer) {
-	return {
-		capability: signer.capability,
-		authority: signer.authority
-	};
-}
-function selectorFromJournal(journal) {
-	return selectorFromSigner(journal.candidate.activationBinding.signer);
-}
-function selectorFromManifest(manifest) {
-	return selectorFromSigner(manifest.signer);
-}
-function selectorKey(selector) {
-	return [
-		String(selector.capability),
-		String(selector.authority.walletId),
-		String(selector.authority.authorityDigest)
-	];
-}
-function selectorColumns(selector) {
-	return {
-		capability_ref: selector.capability,
-		wallet_id: selector.authority.walletId,
-		authority_digest: selector.authority.authorityDigest,
-		wallet_auth_method_id: selector.authority.walletAuthMethodId
-	};
-}
-function authorityFromColumns(record) {
-	return parseWalletAuthAuthorityRef({
-		kind: "wallet_auth_authority_ref",
-		walletId: record.wallet_id,
-		authorityDigest: record.authority_digest,
-		walletAuthMethodId: record.wallet_auth_method_id
-	});
-}
-function walletAuthAuthorityRefsMatch(left, right) {
-	return left.kind === right.kind && left.walletId === right.walletId && left.authorityDigest === right.authorityDigest && left.walletAuthMethodId === right.walletAuthMethodId;
-}
-function selectorsMatch(left, right) {
-	const leftKey = selectorKey(left);
-	const rightKey = selectorKey(right);
-	return leftKey[0] === rightKey[0] && leftKey[1] === rightKey[1] && leftKey[2] === rightKey[2];
-}
-function orderedNumberValuesMatch(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-function runtimePolicyScopesMatch(left, right) {
-	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
-function ecdsaChainTargetsMatch(left, right) {
-	if (left.kind !== right.kind) return false;
-	switch (left.kind) {
-		case "evm": return right.kind === "evm" && left.namespace === right.namespace && left.chainId === right.chainId && left.networkSlug === right.networkSlug;
-		case "tempo": return right.kind === "tempo" && left.chainId === right.chainId && left.networkSlug === right.networkSlug;
-		default: return assertNever(left);
-	}
-}
-function ecdsaCapabilityScopesMatch(left, right) {
-	return left.kind === right.kind && left.targetMemberships.length === right.targetMemberships.length && left.targetMemberships.every((target, index) => ecdsaChainTargetsMatch(target, right.targetMemberships[index]));
-}
-function ecdsaRoleLocalMaterialBindingsMatch(left, right) {
-	return left.kind === right.kind && left.keyHandle === right.keyHandle && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.clientVerifyingPublicKey33B64u === right.clientVerifyingPublicKey33B64u && orderedNumberValuesMatch(left.participantIds, right.participantIds) && left.relayerKeyId === right.relayerKeyId;
-}
-function ecdsaRoleLocalPublicFactsMatch(left, right) {
-	return left.walletId === right.walletId && ecdsaChainTargetsMatch(left.chainTarget, right.chainTarget) && left.keyHandle === right.keyHandle && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.clientParticipantId === right.clientParticipantId && left.relayerParticipantId === right.relayerParticipantId && orderedNumberValuesMatch(left.participantIds, right.participantIds) && left.contextBinding32B64u === right.contextBinding32B64u && left.derivationClientSharePublicKey33B64u === right.derivationClientSharePublicKey33B64u && left.relayerPublicKey33B64u === right.relayerPublicKey33B64u && left.groupPublicKey33B64u === right.groupPublicKey33B64u && left.ethereumAddress === right.ethereumAddress && sameRouterAbEcdsaDerivationPublicCapabilityV1(left.publicCapability, right.publicCapability);
-}
-function ecdsaRegisteredPublicFactsMatch(left, right) {
-	return left.kind === right.kind && left.keyHandle === right.keyHandle && left.publicKeyB64u === right.publicKeyB64u && orderedNumberValuesMatch(left.participantIds, right.participantIds) && left.thresholdOwnerAddress === right.thresholdOwnerAddress;
-}
-function ecdsaManifestIdentitiesMatch(left, right) {
-	return left.manifestId === right.manifestId && left.manifestRevision === right.manifestRevision;
-}
-function ecdsaManifestRevisionExpectationsMatch(left, right) {
-	if (left.kind !== right.kind) return false;
-	switch (left.kind) {
-		case "no_current_manifest": return true;
-		case "exact_manifest": return right.kind === "exact_manifest" && left.manifestId === right.manifestId && left.manifestRevision === right.manifestRevision;
-		default: return assertNever(left);
-	}
-}
-function ecdsaServerGenerationExpectationsMatch(left, right) {
-	if (left.kind !== right.kind) return false;
-	switch (left.kind) {
-		case "no_current_generation": return true;
-		case "exact_generation": return right.kind === "exact_generation" && left.serverGeneration === right.serverGeneration;
-		default: return assertNever(left);
-	}
-}
-function ecdsaEvmFamilySignersMatch(left, right) {
-	return left.kind === right.kind && left.capability === right.capability && left.signerId === right.signerId && left.walletId === right.walletId && walletAuthAuthorityRefsMatch(left.authority, right.authority) && ecdsaCapabilityScopesMatch(left.scope, right.scope) && left.materialOwner === right.materialOwner && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion;
-}
-function ecdsaRegisteredEvmFamilySignersMatch(left, right) {
-	return ecdsaEvmFamilySignersMatch(left, right) && ecdsaRegisteredPublicFactsMatch(left.registeredPublicFacts, right.registeredPublicFacts);
-}
-function ecdsaEncryptedPendingCandidatesMatch(left, right) {
-	return left.kind === right.kind && left.sealingKeyId === right.sealingKeyId && left.iv12B64u === right.iv12B64u && left.ciphertextB64u === right.ciphertextB64u && left.ciphertextDigest === right.ciphertextDigest;
-}
-function ecdsaActivationBindingsMatch(left, right) {
-	return left.kind === right.kind && ecdsaManifestIdentitiesMatch(left.targetManifest, right.targetManifest) && ecdsaEvmFamilySignersMatch(left.signer, right.signer) && ecdsaRoleLocalMaterialBindingsMatch(left.roleLocalBinding, right.roleLocalBinding) && left.bindingDigest === right.bindingDigest && left.durableMaterialRef === right.durableMaterialRef;
-}
-function ecdsaServerActivationCommitsMatch(left, right) {
-	return left.kind === right.kind && left.correlationId === right.correlationId && left.activationRequestDigest === right.activationRequestDigest && left.serverGeneration === right.serverGeneration && ecdsaServerActivationReceiptsMatch(left.serverActivationReceipt, right.serverActivationReceipt);
-}
-function ecdsaServerActivationReceiptsMatch(left, right) {
-	return left.kind === right.kind && left.lifecycleId === right.lifecycleId && left.activationDigest === right.activationDigest && left.activatedAt === right.activatedAt && sameRouterAbEcdsaRegistrationActivationReceiptV1(left.protocolReceipt, right.protocolReceipt);
-}
-function ecdsaActivationCommandsMatch(left, right) {
-	return left.kind === right.kind && left.correlationId === right.correlationId && ecdsaServerGenerationExpectationsMatch(left.expectedGeneration, right.expectedGeneration) && left.requestDigest === right.requestDigest && left.canonicalRequest === right.canonicalRequest;
-}
-function ecdsaPreparedActivationCandidatesMatch(left, right) {
-	return left.kind === right.kind && ecdsaActivationBindingsMatch(left.activationBinding, right.activationBinding) && ecdsaEncryptedPendingCandidatesMatch(left.encryptedPending, right.encryptedPending);
-}
-function ecdsaActivationCommitJournalsMatch(left, right) {
-	if (left.kind !== right.kind) return false;
-	if (!(left.journalId === right.journalId && ecdsaManifestRevisionExpectationsMatch(left.expectedManifest, right.expectedManifest) && ecdsaActivationCommandsMatch(left.activationCommand, right.activationCommand) && ecdsaPreparedActivationCandidatesMatch(left.candidate, right.candidate) && left.createdAt === right.createdAt)) return false;
-	switch (left.kind) {
-		case "activation_prepared": return true;
-		case "server_activation_committed": return right.kind === "server_activation_committed" && ecdsaServerActivationCommitsMatch(left.serverActivation, right.serverActivation);
-		default: return assertNever(left);
-	}
-}
-function ecdsaDurableMaterialBindingsMatch(left, right) {
-	return left.kind === right.kind && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation) && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.routerAbEcdsaDerivationNormalSigning, right.routerAbEcdsaDerivationNormalSigning) && ecdsaRoleLocalPublicFactsMatch(left.roleLocalPublicFacts, right.roleLocalPublicFacts) && ecdsaRoleLocalMaterialBindingsMatch(left.roleLocalBinding, right.roleLocalBinding) && left.durableMaterialRef === right.durableMaterialRef && left.bindingDigest === right.bindingDigest && left.lifecycleId === right.lifecycleId && left.ciphertextDigest === right.ciphertextDigest && left.activationDigest === right.activationDigest && left.activatedAt === right.activatedAt && runtimePolicyScopesMatch(left.runtimePolicyScope, right.runtimePolicyScope);
-}
-function ecdsaActiveMaterialActivationsMatch(left, right) {
-	return left.kind === right.kind && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation) && ecdsaServerActivationCommitsMatch(left.serverActivation, right.serverActivation) && left.retention === right.retention;
-}
-function ecdsaActiveCapabilityManifestsMatch(left, right) {
-	return left.kind === right.kind && ecdsaManifestIdentitiesMatch(left.identity, right.identity) && ecdsaRegisteredEvmFamilySignersMatch(left.signer, right.signer) && ecdsaActiveMaterialActivationsMatch(left.activation, right.activation) && ecdsaDurableMaterialBindingsMatch(left.durableMaterial, right.durableMaterial) && left.committedAt === right.committedAt;
-}
-function serverActivationRecordMatches(expected, record) {
-	try {
-		const receipt = requireRecord(record.serverActivationReceipt, "ECDSA server activation receipt");
-		return record.kind === expected.kind && parseCorrelationId(record.correlationId) === expected.correlationId && parseDigestB64u(record.activationRequestDigest) === expected.activationRequestDigest && parseEcdsaServerGeneration(record.serverGeneration) === expected.serverGeneration && receipt.kind === expected.serverActivationReceipt.kind && receipt.lifecycleId === String(expected.serverActivationReceipt.lifecycleId) && receipt.activationDigest === String(expected.serverActivationReceipt.activationDigest) && parseIsoTimestamp(receipt.activatedAt) === expected.serverActivationReceipt.activatedAt && sameRouterAbEcdsaRegistrationActivationReceiptV1(parseRouterAbEcdsaRegistrationActivationReceiptV1(receipt.protocolReceipt), expected.serverActivationReceipt.protocolReceipt);
-	} catch {
-		return false;
-	}
-}
-function buildPreparedJournalFromEncryptedCandidate(input) {
-	const candidate = buildPreparedEcdsaActivationCandidate({
-		activationBinding: input.preparation.activationBinding,
-		encryptedPending: input.encryptedPending
-	});
-	return buildPreparedJournalForExpectations({
-		...input.preparation,
-		candidate
-	});
-}
-function buildPreparedJournalForExpectations(input) {
-	const common = {
-		journalId: input.journalId,
-		candidate: input.candidate,
-		requestDigest: input.requestDigest,
-		canonicalRequest: input.canonicalRequest,
-		createdAt: input.createdAt
-	};
-	switch (input.expectedManifest.kind) {
-		case "no_current_manifest":
-			if (input.expectedGeneration.kind !== "no_current_generation") throw new Error("Initial ECDSA activation cannot expect a server generation");
-			return buildPreparedEcdsaActivationJournal({
-				...common,
-				expectedManifest: input.expectedManifest,
-				expectedGeneration: input.expectedGeneration
-			});
-		case "exact_manifest":
-			if (input.expectedGeneration.kind !== "exact_generation") throw new Error("Replacement ECDSA activation requires an exact server generation");
-			return buildPreparedEcdsaActivationJournal({
-				...common,
-				expectedManifest: input.expectedManifest,
-				expectedGeneration: input.expectedGeneration
-			});
-		default: return assertNever(input.expectedManifest);
-	}
-}
-function decodeCanonicalStateBlob(value, label) {
-	if (typeof value !== "string" || value.length === 0 || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(`${label} must be non-empty unpadded base64url`);
-	const bytes = base64UrlDecode(value);
-	if (bytes.length === 0 || base64UrlEncode(bytes) !== value) {
-		bytes.fill(0);
-		throw new Error(`${label} must be canonical base64url`);
-	}
-	return bytes;
-}
-function additionalData(projection) {
-	return new TextEncoder().encode(alphabetizeStringify(projection));
-}
-async function generateMaterialSealingKey() {
-	return await crypto.subtle.generateKey({
-		name: "AES-GCM",
-		length: 256
-	}, false, ["encrypt", "decrypt"]);
-}
-async function encryptStateBlob(input) {
-	const plaintext = decodeCanonicalStateBlob(input.stateBlobB64u, "ECDSA state blob");
-	const iv12 = crypto.getRandomValues(new Uint8Array(12));
-	const aad = additionalData(input.aadProjection);
-	try {
-		const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
-			name: "AES-GCM",
-			iv: iv12,
-			additionalData: aad
-		}, input.key, plaintext));
-		try {
-			return {
-				iv12B64u: parseEcdsaIv12B64u(base64UrlEncode(iv12)),
-				ciphertextB64u: parseEcdsaCiphertextB64u(base64UrlEncode(ciphertext)),
-				digestB64u: base64UrlEncode(await sha256Bytes(ciphertext))
-			};
-		} finally {
-			ciphertext.fill(0);
-		}
-	} finally {
-		plaintext.fill(0);
-		aad.fill(0);
-	}
-}
-async function ciphertextDigestB64u(ciphertextB64u) {
-	const ciphertext = base64UrlDecode(ciphertextB64u);
-	try {
-		return base64UrlEncode(await sha256Bytes(ciphertext));
-	} finally {
-		ciphertext.fill(0);
-	}
-}
-async function decryptStateBlob(input) {
-	const iv12 = base64UrlDecode(input.iv12B64u);
-	const ciphertext = base64UrlDecode(input.ciphertextB64u);
-	const aad = additionalData(input.aadProjection);
-	let plaintext = null;
-	try {
-		plaintext = new Uint8Array(await crypto.subtle.decrypt({
-			name: "AES-GCM",
-			iv: iv12,
-			additionalData: aad
-		}, input.key, ciphertext));
-		if (plaintext.length === 0) throw new Error("decrypted ECDSA state blob must not be empty");
-		return base64UrlEncode(plaintext);
-	} finally {
-		iv12.fill(0);
-		ciphertext.fill(0);
-		aad.fill(0);
-		plaintext?.fill(0);
-	}
-}
-function parseManifestIdentity(value) {
-	const record = requireRecord(value, "ECDSA manifest identity");
-	requireExactKeys(record, "ECDSA manifest identity", ["manifestId", "manifestRevision"]);
-	return buildEcdsaManifestIdentity({
-		manifestId: parseEcdsaCapabilityManifestId(record.manifestId),
-		manifestRevision: parseEcdsaCapabilityManifestRevision(record.manifestRevision)
-	});
-}
-function parseManifestExpectation(value) {
-	const record = requireRecord(value, "ECDSA manifest expectation");
-	switch (record.kind) {
-		case "no_current_manifest":
-			requireExactKeys(record, "ECDSA no-current manifest expectation", ["kind"]);
-			return buildNoCurrentEcdsaManifestExpectation();
-		case "exact_manifest":
-			requireExactKeys(record, "ECDSA exact manifest expectation", [
-				"kind",
-				"manifestId",
-				"manifestRevision"
-			]);
-			return buildExactEcdsaManifestExpectation(buildEcdsaManifestIdentity({
-				manifestId: parseEcdsaCapabilityManifestId(record.manifestId),
-				manifestRevision: parseEcdsaCapabilityManifestRevision(record.manifestRevision)
-			}));
-		default: throw new Error("ECDSA manifest expectation kind is invalid");
-	}
-}
-function parseChainTarget(value) {
-	const record = requireRecord(value, "ECDSA capability target");
-	switch (record.kind) {
-		case "evm":
-			requireExactKeys(record, "ECDSA EVM capability target", [
-				"kind",
-				"namespace",
-				"chainId",
-				"networkSlug"
-			]);
-			return thresholdEcdsaChainTargetFromRequest({
-				kind: record.kind,
-				namespace: record.namespace,
-				chainId: record.chainId,
-				networkSlug: record.networkSlug
-			});
-		case "tempo":
-			requireExactKeys(record, "ECDSA Tempo capability target", [
-				"kind",
-				"chainId",
-				"networkSlug"
-			]);
-			return thresholdEcdsaChainTargetFromRequest({
-				kind: record.kind,
-				chainId: record.chainId,
-				networkSlug: record.networkSlug
-			});
-		default: throw new Error("ECDSA capability target kind is invalid");
-	}
-}
-function parseCapabilityScope(value) {
-	const record = requireRecord(value, "ECDSA capability scope");
-	requireExactKeys(record, "ECDSA capability scope", ["kind", "targetMemberships"]);
-	if (record.kind !== "evm_family") throw new Error("ECDSA capability scope kind is invalid");
-	const targetValues = requireArray(record.targetMemberships, "ECDSA capability target memberships");
-	const targets = [];
-	for (const targetValue of targetValues) targets.push(parseChainTarget(targetValue));
-	const [first, ...rest] = targets;
-	if (!first) throw new Error("ECDSA capability scope requires at least one target");
-	return buildEcdsaCapabilityScope({ targetMemberships: [first, ...rest] });
-}
-function parseRoleLocalBinding(value) {
-	const record = requireRecord(value, "ECDSA role-local material binding");
-	requireExactKeys(record, "ECDSA role-local material binding", [
-		"kind",
-		"keyHandle",
-		"ecdsaThresholdKeyId",
-		"clientVerifyingPublicKey33B64u",
-		"participantIds",
-		"relayerKeyId"
-	]);
-	if (record.kind !== "ecdsa_role_local_material_binding") throw new Error("ECDSA role-local material binding kind is invalid");
-	const participantValues = requireArray(record.participantIds, "ECDSA role-local participant ids");
-	const participantIds = [];
-	for (const participantValue of participantValues) participantIds.push(toParticipantId(participantValue));
-	const [firstParticipantId, ...remainingParticipantIds] = participantIds;
-	if (!firstParticipantId) throw new Error("ECDSA role-local material requires at least one participant");
-	return buildEcdsaRoleLocalMaterialBinding({
-		keyHandle: parseEcdsaKeyHandle(record.keyHandle),
-		ecdsaThresholdKeyId: parseEcdsaThresholdKeyId(record.ecdsaThresholdKeyId),
-		clientVerifyingPublicKey33B64u: parseEcdsaClientVerifyingPublicKey33B64u(record.clientVerifyingPublicKey33B64u),
-		participantIds: [firstParticipantId, ...remainingParticipantIds],
-		relayerKeyId: parseEcdsaRelayerKeyId(record.relayerKeyId)
-	});
-}
-function parsePreparedSigner(value) {
-	const record = requireRecord(value, "prepared ECDSA signer");
-	requireExactKeys(record, "prepared ECDSA signer", [
-		"kind",
-		"capability",
-		"signerId",
-		"walletId",
-		"authority",
-		"scope",
-		"materialOwner",
-		"signingRootId",
-		"signingRootVersion"
-	]);
-	if (record.kind !== "prepared_evm_family_signer") throw new Error("prepared ECDSA signer kind is invalid");
-	const authority = parseWalletAuthAuthorityRef(record.authority);
-	if (!authority) throw new Error("prepared ECDSA signer authority is invalid");
-	if (String(record.walletId) !== String(authority.walletId)) throw new Error("prepared ECDSA signer wallet does not match its authority");
-	return buildPreparedEvmFamilySigner({
-		capability: unwrapDomainId(parseCapabilityInstanceRef(record.capability)),
-		signerId: parseEvmFamilyEcdsaSignerId(record.signerId),
-		authority,
-		scope: parseCapabilityScope(record.scope),
-		materialOwner: unwrapDomainId(parseMpcMaterialOwnerRef(record.materialOwner)),
-		signingRootId: parseSdkEcdsaDerivationSigningRootId(record.signingRootId),
-		signingRootVersion: parseSdkEcdsaDerivationSigningRootVersion(record.signingRootVersion)
-	});
-}
-function parseEncryptedPendingCandidate(value) {
-	const record = requireRecord(value, "encrypted ECDSA pending candidate");
-	requireExactKeys(record, "encrypted ECDSA pending candidate", [
-		"kind",
-		"sealingKeyId",
-		"iv12B64u",
-		"ciphertextB64u",
-		"ciphertextDigest"
-	]);
-	if (record.kind !== "encrypted_ecdsa_pending_candidate") throw new Error("encrypted ECDSA pending candidate kind is invalid");
-	return buildEncryptedEcdsaPendingCandidate({
-		sealingKeyId: parseEcdsaMaterialSealingKeyId(record.sealingKeyId),
-		iv12B64u: parseEcdsaIv12B64u(record.iv12B64u),
-		ciphertextB64u: parseEcdsaCiphertextB64u(record.ciphertextB64u),
-		ciphertextDigest: parseEcdsaPendingCiphertextDigest(record.ciphertextDigest)
-	});
-}
-function parseActivationBinding(value) {
-	const record = requireRecord(value, "ECDSA activation binding");
-	requireExactKeys(record, "ECDSA activation binding", [
-		"kind",
-		"targetManifest",
-		"signer",
-		"roleLocalBinding",
-		"bindingDigest",
-		"durableMaterialRef"
-	]);
-	if (record.kind !== "ecdsa_activation_binding") throw new Error("ECDSA activation binding kind is invalid");
-	return buildEcdsaActivationBinding({
-		targetManifest: parseManifestIdentity(record.targetManifest),
-		signer: parsePreparedSigner(record.signer),
-		roleLocalBinding: parseRoleLocalBinding(record.roleLocalBinding),
-		bindingDigest: parseEcdsaRoleLocalBindingDigest(record.bindingDigest),
-		durableMaterialRef: parseEcdsaRoleLocalDurableMaterialRef(record.durableMaterialRef)
-	});
-}
-function parsePreparedCandidate(value) {
-	const record = requireRecord(value, "prepared ECDSA activation candidate");
-	requireExactKeys(record, "prepared ECDSA activation candidate", [
-		"kind",
-		"activationBinding",
-		"encryptedPending"
-	]);
-	if (record.kind !== "prepared_ecdsa_activation_candidate") throw new Error("prepared ECDSA activation candidate kind is invalid");
-	return buildPreparedEcdsaActivationCandidate({
-		activationBinding: parseActivationBinding(record.activationBinding),
-		encryptedPending: parseEncryptedPendingCandidate(record.encryptedPending)
-	});
-}
-function parseExpectedServerGeneration(value) {
-	const record = requireRecord(value, "ECDSA server generation expectation");
-	switch (record.kind) {
-		case "no_current_generation":
-			requireExactKeys(record, "ECDSA no-current server generation expectation", ["kind"]);
-			return buildNoCurrentEcdsaServerGenerationExpectation();
-		case "exact_generation":
-			requireExactKeys(record, "ECDSA exact server generation expectation", ["kind", "serverGeneration"]);
-			return buildExactEcdsaServerGenerationExpectation(parseEcdsaServerGeneration(record.serverGeneration));
-		default: throw new Error("ECDSA server generation expectation kind is invalid");
-	}
-}
-function parsePreparedJournal(value) {
-	const record = requireRecord(value, "prepared ECDSA activation journal");
-	requireExactKeys(record, "prepared ECDSA activation journal", [
-		"kind",
-		"journalId",
-		"expectedManifest",
-		"activationCommand",
-		"candidate",
-		"createdAt"
-	]);
-	if (record.kind !== "activation_prepared") throw new Error("prepared ECDSA activation journal kind is invalid");
-	const command = requireRecord(record.activationCommand, "ECDSA activation command");
-	requireExactKeys(command, "ECDSA activation command", [
-		"kind",
-		"correlationId",
-		"expectedGeneration",
-		"requestDigest",
-		"canonicalRequest"
-	]);
-	if (command.kind !== "ecdsa_server_activation_command") throw new Error("ECDSA activation command kind is invalid");
-	const journalId = parseCorrelationId(record.journalId);
-	if (parseCorrelationId(command.correlationId) !== journalId) throw new Error("ECDSA activation command correlation does not match its journal");
-	const expectedManifest = parseManifestExpectation(record.expectedManifest);
-	const expectedGeneration = parseExpectedServerGeneration(command.expectedGeneration);
-	const common = {
-		journalId,
-		candidate: parsePreparedCandidate(record.candidate),
-		requestDigest: parseDigestB64u(command.requestDigest),
-		canonicalRequest: parseCanonicalEcdsaServerActivationRequest(command.canonicalRequest),
-		createdAt: parseIsoTimestamp(record.createdAt)
-	};
-	switch (expectedManifest.kind) {
-		case "no_current_manifest":
-			if (expectedGeneration.kind !== "no_current_generation") throw new Error("initial ECDSA journal has an exact server generation");
-			return buildPreparedEcdsaActivationJournal({
-				...common,
-				expectedManifest,
-				expectedGeneration
-			});
-		case "exact_manifest":
-			if (expectedGeneration.kind !== "exact_generation") throw new Error("replacement ECDSA journal is missing its exact server generation");
-			return buildPreparedEcdsaActivationJournal({
-				...common,
-				expectedManifest,
-				expectedGeneration
-			});
-	}
-	return assertNever(expectedManifest);
-}
-function preparedJournalValueFromCommitted(record) {
-	return {
-		kind: "activation_prepared",
-		journalId: record.journalId,
-		expectedManifest: record.expectedManifest,
-		activationCommand: record.activationCommand,
-		candidate: record.candidate,
-		createdAt: record.createdAt
-	};
-}
-function preparedJournalProjection(journal) {
-	if (journal.kind === "activation_prepared") return journal;
-	return buildPreparedJournalForExpectations({
-		journalId: journal.journalId,
-		expectedManifest: journal.expectedManifest,
-		expectedGeneration: journal.activationCommand.expectedGeneration,
-		candidate: journal.candidate,
-		requestDigest: journal.activationCommand.requestDigest,
-		canonicalRequest: journal.activationCommand.canonicalRequest,
-		createdAt: journal.createdAt
-	});
-}
-function parseCommittedJournal(value) {
-	const record = requireRecord(value, "server-committed ECDSA activation journal");
-	requireExactKeys(record, "server-committed ECDSA activation journal", [
-		"kind",
-		"journalId",
-		"expectedManifest",
-		"activationCommand",
-		"candidate",
-		"createdAt",
-		"serverActivation"
-	]);
-	if (record.kind !== "server_activation_committed") throw new Error("server-committed ECDSA activation journal kind is invalid");
-	const preparedJournal = parsePreparedJournal(preparedJournalValueFromCommitted(record));
-	const serverActivation = parseServerActivationRecord(record.serverActivation);
-	const committed = buildServerCommittedEcdsaActivationJournal({
-		preparedJournal,
-		serverCommit: serverActivation.serverCommit
-	});
-	if (!serverActivationRecordMatches(committed.serverActivation, serverActivation.record)) throw new Error("ECDSA server activation commit fields are inconsistent");
-	return committed;
-}
-function parseServerActivationRecord(value) {
-	const record = requireRecord(value, "ECDSA server activation commit");
-	requireExactKeys(record, "ECDSA server activation commit", [
-		"kind",
-		"correlationId",
-		"activationRequestDigest",
-		"serverGeneration",
-		"serverActivationReceipt"
-	]);
-	if (record.kind !== "ecdsa_server_activation_commit") throw new Error("ECDSA server activation commit kind is invalid");
-	const receipt = requireRecord(record.serverActivationReceipt, "ECDSA server activation receipt");
-	requireExactKeys(receipt, "ECDSA server activation receipt", [
-		"kind",
-		"lifecycleId",
-		"activationDigest",
-		"activatedAt",
-		"protocolReceipt"
-	]);
-	if (receipt.kind !== "ecdsa_server_activation_receipt") throw new Error("ECDSA server activation receipt kind is invalid");
-	return {
-		record,
-		serverCommit: {
-			correlationId: parseCorrelationId(record.correlationId),
-			activationRequestDigest: parseDigestB64u(record.activationRequestDigest),
-			serverGeneration: parseEcdsaServerGeneration(record.serverGeneration),
-			protocolReceipt: receipt.protocolReceipt
-		}
-	};
-}
-function parseJournal(value) {
-	const record = requireRecord(value, "ECDSA activation journal");
-	switch (record.kind) {
-		case "activation_prepared": return parsePreparedJournal(record);
-		case "server_activation_committed": return parseCommittedJournal(record);
-		default: throw new Error("ECDSA activation journal kind is invalid");
-	}
-}
-function parseRegisteredPublicFacts(value) {
-	const record = requireRecord(value, "registered ECDSA public facts");
-	requireExactKeys(record, "registered ECDSA public facts", [
-		"kind",
-		"keyHandle",
-		"publicKeyB64u",
-		"participantIds",
-		"thresholdOwnerAddress"
-	]);
-	if (record.kind !== "verified_ecdsa_public_facts") throw new Error("registered ECDSA public facts kind is invalid");
-	return buildVerifiedEcdsaPublicFacts({
-		keyHandle: toEvmFamilyEcdsaKeyHandle(record.keyHandle),
-		publicKeyB64u: record.publicKeyB64u,
-		participantIds: requireArray(record.participantIds, "registered ECDSA participant ids"),
-		thresholdOwnerAddress: record.thresholdOwnerAddress
-	});
-}
-function parseActiveProof(value) {
-	const record = requireRecord(value, "active ECDSA manifest proof");
-	requireExactKeys(record, "active ECDSA manifest proof", [
-		"activation_binding",
-		"server_activation",
-		"registered_public_facts",
-		"role_local_public_facts",
-		"router_ab_ecdsa_derivation_normal_signing",
-		"runtime_policy_scope",
-		"ciphertext_digest",
-		"committed_at"
-	]);
-	const activationBinding = parseActivationBinding(record.activation_binding);
-	const serverActivationRecord = parseServerActivationRecord(record.server_activation);
-	const serverActivation = buildEcdsaServerActivationCommit({
-		activationBinding,
-		serverCommit: serverActivationRecord.serverCommit
-	});
-	if (!serverActivationRecordMatches(serverActivation, serverActivationRecord.record)) throw new Error("ECDSA server activation commit fields are inconsistent");
-	const durableMaterial = buildDurableEcdsaMaterialBinding({
-		activationBinding,
-		serverActivation,
-		routerAbEcdsaDerivationNormalSigning: requireRouterAbEcdsaDerivationNormalSigningStateV1(record.router_ab_ecdsa_derivation_normal_signing),
-		roleLocalPublicFacts: buildEcdsaRoleLocalPublicFacts(record.role_local_public_facts),
-		ciphertextDigest: parseEcdsaCiphertextDigest(record.ciphertext_digest),
-		runtimePolicyScope: normalizeRuntimePolicyScope(record.runtime_policy_scope)
-	});
-	const committedAt = parseIsoTimestamp(record.committed_at);
-	return {
-		activationBinding,
-		serverActivation,
-		durableMaterial,
-		activeManifest: buildActiveEcdsaCapabilityManifest({
-			activationBinding,
-			serverActivation,
-			registeredPublicFacts: parseRegisteredPublicFacts(record.registered_public_facts),
-			durableMaterial,
-			committedAt
-		}),
-		committedAt
-	};
-}
-function parseManifestRow(value) {
-	const record = requireRecord(value, "ECDSA capability manifest row");
-	const commonKeys = [
-		"record_version",
-		"manifest_id",
-		"manifest_revision",
-		"capability_ref",
-		"wallet_id",
-		"authority_digest",
-		"wallet_auth_method_id",
-		"manifest_state",
-		"active_proof"
-	];
-	switch (record.manifest_state) {
-		case "active": {
-			requireExactKeys(record, "active ECDSA capability manifest row", commonKeys);
-			const activeProof = parseActiveProof(record.active_proof);
-			const selector = selectorFromManifest(activeProof.activeManifest);
-			assertManifestRowCommon(record, activeProof.activeManifest, selector);
-			return {
-				state: "active",
-				selector,
-				manifest: activeProof.activeManifest,
-				activeProof
-			};
-		}
-		case "replaced": {
-			requireExactKeys(record, "replaced ECDSA capability manifest row", [...commonKeys, "replacement_proof"]);
-			const activeProof = parseActiveProof(record.active_proof);
-			const replacementProof = parseActiveProof(record.replacement_proof);
-			const manifest = buildReplacedEcdsaCapabilityManifest({
-				activeManifest: activeProof.activeManifest,
-				replacementManifest: replacementProof.activeManifest
-			});
-			const selector = selectorFromManifest(activeProof.activeManifest);
-			assertManifestRowCommon(record, activeProof.activeManifest, selector);
-			return {
-				state: "replaced",
-				selector,
-				manifest,
-				activeProof,
-				replacementProof
-			};
-		}
-		default: throw new Error("ECDSA capability manifest row state is invalid");
-	}
-}
-function assertManifestRowCommon(record, manifest, selector) {
-	if (record.record_version !== "ecdsa_capability_manifest_v3" || parseEcdsaCapabilityManifestId(record.manifest_id) !== manifest.identity.manifestId || parseEcdsaCapabilityManifestRevision(record.manifest_revision) !== manifest.identity.manifestRevision || String(record.capability_ref) !== String(selector.capability) || String(record.wallet_id) !== String(selector.authority.walletId) || String(record.authority_digest) !== String(selector.authority.authorityDigest)) throw new Error("ECDSA capability manifest row identity is inconsistent");
-}
-function storedPointerRow(manifest) {
-	return {
-		record_version: POINTER_RECORD_VERSION,
-		...selectorColumns(selectorFromManifest(manifest)),
-		manifest_id: manifest.identity.manifestId,
-		manifest_revision: manifest.identity.manifestRevision
-	};
-}
-function parsePointerRow(value) {
-	const record = requireRecord(value, "current ECDSA capability pointer");
-	requireExactKeys(record, "current ECDSA capability pointer", [
-		"record_version",
-		"capability_ref",
-		"wallet_id",
-		"authority_digest",
-		"wallet_auth_method_id",
-		"manifest_id",
-		"manifest_revision"
-	]);
-	if (record.record_version !== POINTER_RECORD_VERSION) throw new Error("current ECDSA capability pointer version is invalid");
-	const authority = authorityFromColumns(record);
-	if (!authority) throw new Error("current ECDSA capability pointer authority is invalid");
-	return {
-		selector: {
-			capability: unwrapDomainId(parseCapabilityInstanceRef(record.capability_ref)),
-			authority
-		},
-		manifestId: parseEcdsaCapabilityManifestId(record.manifest_id),
-		manifestRevision: parseEcdsaCapabilityManifestRevision(record.manifest_revision)
-	};
-}
-function storedMaterialRow(material, manifest) {
-	return {
-		record_version: MATERIAL_RECORD_VERSION,
-		durable_material_ref: material.binding.durableMaterialRef,
-		binding_digest: material.binding.bindingDigest,
-		...selectorColumns(selectorFromManifest(manifest)),
-		sealing_key_id: material.sealingKeyId,
-		iv: material.iv12B64u,
-		ciphertext: material.ciphertextB64u
-	};
-}
-function parseMaterialLocator(value) {
-	const record = requireRecord(value, "ECDSA role-local material row");
-	requireExactKeys(record, "ECDSA role-local material row", [
-		"record_version",
-		"durable_material_ref",
-		"binding_digest",
-		"capability_ref",
-		"wallet_id",
-		"authority_digest",
-		"wallet_auth_method_id",
-		"sealing_key_id",
-		"iv",
-		"ciphertext"
-	]);
-	if (record.record_version !== MATERIAL_RECORD_VERSION) throw new Error("ECDSA role-local material row version is invalid");
-	const authority = authorityFromColumns(record);
-	if (!authority) throw new Error("ECDSA role-local material authority is invalid");
-	return {
-		durableMaterialRef: parseEcdsaRoleLocalDurableMaterialRef(record.durable_material_ref),
-		bindingDigest: parseEcdsaRoleLocalBindingDigest(record.binding_digest),
-		selector: {
-			capability: unwrapDomainId(parseCapabilityInstanceRef(record.capability_ref)),
-			authority
-		}
-	};
-}
-function parseMaterialRow(value, activeProof) {
-	const record = requireRecord(value, "ECDSA role-local material row");
-	const locator = parseMaterialLocator(record);
-	const material = buildValidatedEncryptedEcdsaReadyMaterial({
-		binding: activeProof.durableMaterial,
-		sealingKeyId: parseEcdsaMaterialSealingKeyId(record.sealing_key_id),
-		iv12B64u: parseEcdsaIv12B64u(record.iv),
-		ciphertextB64u: parseEcdsaCiphertextB64u(record.ciphertext)
-	});
-	if (locator.durableMaterialRef !== material.binding.durableMaterialRef || locator.bindingDigest !== material.binding.bindingDigest || !selectorsMatch(locator.selector, selectorFromManifest(activeProof.activeManifest))) throw new Error("ECDSA role-local material row binding is inconsistent");
-	return material;
-}
-function materialMatchesManifest(material, manifest) {
-	return material.binding.durableMaterialRef === manifest.durableMaterial.durableMaterialRef && material.binding.bindingDigest === manifest.durableMaterial.bindingDigest && material.binding.lifecycleId === manifest.durableMaterial.lifecycleId && material.binding.ciphertextDigest === manifest.durableMaterial.ciphertextDigest && material.binding.activationDigest === manifest.durableMaterial.activationDigest && material.binding.activatedAt === manifest.durableMaterial.activatedAt && mpcMaterialActivationRefsEqual(material.binding.materialActivation, manifest.durableMaterial.materialActivation) && ecdsaRoleLocalMaterialBindingsMatch(material.binding.roleLocalBinding, manifest.durableMaterial.roleLocalBinding);
-}
-function storedJournalRow(journal) {
-	return {
-		record_version: JOURNAL_RECORD_VERSION,
-		journal_id: journal.journalId,
-		...selectorColumns(selectorFromJournal(journal)),
-		journal
-	};
-}
-function parseJournalRow(value) {
-	const record = requireRecord(value, "ECDSA activation commit journal row");
-	requireExactKeys(record, "ECDSA activation commit journal row", [
-		"record_version",
-		"journal_id",
-		"capability_ref",
-		"wallet_id",
-		"authority_digest",
-		"wallet_auth_method_id",
-		"journal"
-	]);
-	if (record.record_version !== JOURNAL_RECORD_VERSION) throw new Error("ECDSA activation commit journal row version is invalid");
-	const journal = parseJournal(record.journal);
-	const selector = selectorFromJournal(journal);
-	if (parseCorrelationId(record.journal_id) !== journal.journalId || String(record.capability_ref) !== String(selector.capability) || String(record.wallet_id) !== String(selector.authority.walletId) || String(record.authority_digest) !== String(selector.authority.authorityDigest)) throw new Error("ECDSA activation commit journal row identity is inconsistent");
-	return {
-		journal,
-		selector
-	};
-}
-function isNonExtractableAesGcmKey(value) {
-	if (typeof CryptoKey === "undefined" || !(value instanceof CryptoKey)) return false;
-	if (value.type !== "secret" || value.extractable || value.algorithm.name !== "AES-GCM") return false;
-	return value.usages.includes("encrypt") && value.usages.includes("decrypt");
-}
-function storedSealingKeyRow(keyId, key) {
-	return {
-		record_version: SEALING_KEY_RECORD_VERSION,
-		key_id: keyId,
-		key
-	};
-}
-function parseSealingKeyRow(value) {
-	const record = requireRecord(value, "ECDSA material sealing key row");
-	requireExactKeys(record, "ECDSA material sealing key row", [
-		"record_version",
-		"key_id",
-		"key"
-	]);
-	if (record.record_version !== SEALING_KEY_RECORD_VERSION) throw new Error("ECDSA material sealing key row version is invalid");
-	if (!isNonExtractableAesGcmKey(record.key)) throw new Error("ECDSA material sealing key must be a non-extractable AES-GCM key");
-	return {
-		keyId: parseEcdsaMaterialSealingKeyId(record.key_id),
-		key: record.key
-	};
-}
-function assertNever(value) {
-	throw new Error(`Unexpected ECDSA persistence branch: ${String(value)}`);
-}
-//#endregion
-export { JOURNAL_STORE, MANIFEST_RECORD_VERSION, MANIFEST_STORE, MATERIAL_STORE, POINTER_STORE, PRESIGNATURE_STORE, SEALING_KEY_STORE, additionalData, assertNever, buildPreparedJournalFromEncryptedCandidate, ciphertextDigestB64u, decryptStateBlob, ecdsaActivationCommitJournalsMatch, ecdsaActiveCapabilityManifestsMatch, ecdsaCapabilityScopesMatch, ecdsaDurableMaterialBindingsMatch, ecdsaRegisteredPublicFactsMatch, ecdsaRoleLocalMaterialBindingsMatch, ecdsaRoleLocalPublicFactsMatch, ecdsaServerActivationCommitsMatch, encryptStateBlob, generateMaterialSealingKey, materialMatchesManifest, normalizeSelector, parseActiveProof, parseCommittedJournal, parseJournalRow, parseManifestRow, parseMaterialLocator, parseMaterialRow, parsePointerRow, parseSealingKeyRow, preparedJournalProjection, requireExactKeys, runtimePolicyScopesMatch, selectorColumns, selectorFromJournal, selectorFromManifest, selectorFromSigner, selectorKey, selectorsMatch, storedJournalRow, storedMaterialRow, storedPointerRow, storedSealingKeyRow, walletAuthAuthorityRefsMatch };
-
-//# sourceMappingURL=ecdsaCapabilityManifestRecords.js.map