@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/react/core/rpcClients/relayer/routerAbNormalSigning.js

@@ -1,812 +0,0 @@
-import { base64Decode, base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { coerceNonEmptyString } from "../../../shared-ts/src/utils/validation.js";
-import { alphabetizeStringify } from "../../../shared-ts/src/utils/digests.js";
-import { parseRouterAbMpcMaterialActivationRef, parseRouterAbNormalSigningAuthorization } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreRequestV1, parseRouterAbEcdsaOperationStepUpPreparationV1, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { buildBearerAuthorizationHeader, buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
-import { WalletSessionQuotaAdmissionError } from "../../signingEngine/session/operationState/authorizationAdmission.js";
-import { walletSessionFailureErrorFromPayload } from "../../signingEngine/session/lifecycle/walletSessionFailure.js";
-//#region src/core/rpcClients/relayer/routerAbNormalSigning.ts
-const INTENT_VERSION_V2 = "router-ab-protocol/ed25519-normal-signing/intent/v2";
-const PAYLOAD_VERSION_V2 = "router-ab-protocol/ed25519-normal-signing/payload/v2";
-const NEP413_PREFIX = 2147484061;
-var RouterAbSigningRequestError = class extends Error {
-	constructor(args) {
-		super(`Router A/B signing ${args.path} returned HTTP ${args.status}: ${args.message || args.code}`);
-		this.name = "RouterAbSigningRequestError";
-		this.code = args.code;
-		this.path = args.path;
-		this.status = args.status;
-	}
-};
-function routerAbNormalSigningAdmissionErrorFromPayload(args) {
-	const code = String(args.code || "").trim();
-	const detail = `Router A/B signing ${args.path} returned HTTP ${args.status}: ${args.message || code || "unknown admission failure"}`;
-	if (args.authorizationDecision?.kind === "step_up_required") return new WalletSessionQuotaAdmissionError({
-		kind: "exhausted",
-		source: "server_prepare",
-		detail
-	}, args.authorizationDecision);
-	switch (code) {
-		case "wallet_budget_exhausted": return new WalletSessionQuotaAdmissionError({
-			kind: "exhausted",
-			source: "server_prepare",
-			detail
-		}, args.authorizationDecision);
-		case "wallet_budget_in_flight":
-		case "wallet_budget_reserved": return new WalletSessionQuotaAdmissionError({
-			kind: "in_flight",
-			source: "server_prepare",
-			detail,
-			retryAfterMs: 150
-		});
-		default: return null;
-	}
-}
-function requirePositiveInteger(value, label) {
-	const parsed = Math.floor(Number(value));
-	if (!Number.isSafeInteger(parsed) || parsed <= 0) throw new Error(`${label} must be a positive integer`);
-	return parsed;
-}
-function requireByteArray(value, label, byteLength) {
-	if (!Array.isArray(value)) throw new Error(`${label} must be a byte array`);
-	const bytes = value.map((entry) => Number(entry));
-	if (!bytes.every((entry) => Number.isInteger(entry) && entry >= 0 && entry <= 255)) throw new Error(`${label} must contain bytes`);
-	if (byteLength !== void 0 && bytes.length !== byteLength) throw new Error(`${label} must contain ${byteLength} bytes`);
-	return bytes;
-}
-function requireDigestB64u(value, label) {
-	const normalized = coerceNonEmptyString(value, label);
-	if (base64UrlDecode(normalized).length !== 32) throw new Error(`${label} must decode to 32 bytes`);
-	return normalized;
-}
-function requireBase64UrlNonEmpty(value, label) {
-	const normalized = coerceNonEmptyString(value, label);
-	if (base64UrlDecode(normalized).length === 0) throw new Error(`${label} must decode to non-empty bytes`);
-	return normalized;
-}
-function normalizeNonceToB64u(value, label) {
-	const normalized = coerceNonEmptyString(value, label);
-	let bytes;
-	try {
-		bytes = base64Decode(normalized);
-	} catch {
-		bytes = base64UrlDecode(normalized);
-	}
-	if (bytes.length !== 32) throw new Error(`${label} must decode to 32 bytes`);
-	return base64UrlEncode(bytes);
-}
-function routerAbDigest32Wire(bytes) {
-	return { bytes: [...requireByteArray([...bytes], "digest bytes", 32)] };
-}
-function routerAbCanonicalWireBytesToB64u(value, label) {
-	return base64UrlEncode(Uint8Array.from(requireByteArray(value.bytes, label)));
-}
-async function routerAbNormalSigningActionFingerprint(value) {
-	return base64UrlEncode(await sha256Bytes(new TextEncoder().encode(alphabetizeStringify(value))));
-}
-function routerAbEd25519Nep413CanonicalMessageB64uV2(args) {
-	const message = coerceNonEmptyString(args.message, "nep413.message");
-	const recipient = coerceNonEmptyString(args.recipient, "nep413.recipient");
-	const nonce = base64UrlDecode(normalizeNonceToB64u(args.nonce, "nep413.nonce"));
-	const callbackUrl = args.callbackUrl == null ? void 0 : coerceNonEmptyString(args.callbackUrl, "callbackUrl");
-	const out = [];
-	pushU32Le(out, NEP413_PREFIX);
-	pushBorshString(out, message);
-	pushBorshString(out, recipient);
-	pushBytes(out, nonce);
-	if (callbackUrl) {
-		out.push(1);
-		pushBorshString(out, callbackUrl);
-	} else out.push(0);
-	return base64UrlEncode(Uint8Array.from(out));
-}
-async function buildRouterAbEd25519NearTransactionPrepareRequestV2(args) {
-	const request = {
-		scope: parseScope(args.scope, "scope"),
-		expires_at_ms: requirePositiveInteger(args.expiresAtMs, "expiresAtMs"),
-		display_digest: routerAbDigest32Wire(base64UrlDecode(requireDigestB64u(args.displayDigestB64u, "displayDigestB64u"))),
-		intent: {
-			kind: "near_transaction_v1",
-			operation_id: coerceNonEmptyString(args.operationId, "operationId"),
-			operation_fingerprint: coerceNonEmptyString(args.operationFingerprint, "operationFingerprint"),
-			near_account_id: coerceNonEmptyString(args.nearAccountId, "nearAccountId"),
-			near_network_id: args.nearNetworkId,
-			transactions: args.transactions.map((transaction, index) => ({
-				receiver_id: coerceNonEmptyString(transaction.receiverId, `transactions[${index}].receiverId`),
-				action_fingerprint: coerceNonEmptyString(transaction.actionFingerprint, `transactions[${index}].actionFingerprint`)
-			})),
-			unsigned_transaction_borsh_b64u: requireBase64UrlNonEmpty(args.unsignedTransactionBorshB64u, "unsignedTransactionBorshB64u")
-		},
-		signing_payload: {
-			kind: "near_unsigned_transaction_borsh_v1",
-			unsigned_transaction_borsh_b64u: requireBase64UrlNonEmpty(args.unsignedTransactionBorshB64u, "unsignedTransactionBorshB64u"),
-			expected_signing_digest_b64u: requireDigestB64u(args.expectedSigningDigestB64u, "expectedSigningDigestB64u")
-		}
-	};
-	return {
-		request,
-		admissionMaterial: await deriveRouterAbNormalSigningAdmissionMaterialV2(request)
-	};
-}
-async function buildRouterAbEd25519Nep413PrepareRequestV2(args) {
-	const nonceB64u = normalizeNonceToB64u(args.nonce, "nonce");
-	const callbackUrl = args.callbackUrl == null ? void 0 : coerceNonEmptyString(args.callbackUrl, "callbackUrl");
-	const canonicalMessageB64u = routerAbEd25519Nep413CanonicalMessageB64uV2({
-		message: args.message,
-		recipient: args.recipient,
-		nonce: nonceB64u,
-		...callbackUrl ? { callbackUrl } : {}
-	});
-	const request = {
-		scope: parseScope(args.scope, "scope"),
-		expires_at_ms: requirePositiveInteger(args.expiresAtMs, "expiresAtMs"),
-		display_digest: routerAbDigest32Wire(base64UrlDecode(requireDigestB64u(args.displayDigestB64u, "displayDigestB64u"))),
-		intent: {
-			kind: "nep413_v1",
-			operation_id: coerceNonEmptyString(args.operationId, "operationId"),
-			operation_fingerprint: coerceNonEmptyString(args.operationFingerprint, "operationFingerprint"),
-			near_account_id: coerceNonEmptyString(args.nearAccountId, "nearAccountId"),
-			near_network_id: args.nearNetworkId,
-			recipient: coerceNonEmptyString(args.recipient, "recipient"),
-			message: coerceNonEmptyString(args.message, "message"),
-			nonce_b64u: nonceB64u,
-			...callbackUrl ? { callback_url: callbackUrl } : {}
-		},
-		signing_payload: {
-			kind: "nep413_message_v1",
-			canonical_message_b64u: canonicalMessageB64u,
-			expected_signing_digest_b64u: requireDigestB64u(args.expectedSigningDigestB64u, "expectedSigningDigestB64u")
-		}
-	};
-	return {
-		request,
-		admissionMaterial: await deriveRouterAbNormalSigningAdmissionMaterialV2(request)
-	};
-}
-async function buildRouterAbEd25519DelegateActionPrepareRequestV2(args) {
-	const canonicalDelegateBorshB64u = requireBase64UrlNonEmpty(args.delegate.canonicalDelegateBorshB64u, "canonicalDelegateBorshB64u");
-	const request = {
-		scope: parseScope(args.scope, "scope"),
-		expires_at_ms: requirePositiveInteger(args.expiresAtMs, "expiresAtMs"),
-		display_digest: routerAbDigest32Wire(base64UrlDecode(requireDigestB64u(args.displayDigestB64u, "displayDigestB64u"))),
-		intent: {
-			kind: "near_delegate_action_v1",
-			operation_id: coerceNonEmptyString(args.operationId, "operationId"),
-			operation_fingerprint: coerceNonEmptyString(args.operationFingerprint, "operationFingerprint"),
-			near_account_id: coerceNonEmptyString(args.nearAccountId, "nearAccountId"),
-			near_network_id: args.nearNetworkId,
-			delegate: {
-				sender_id: coerceNonEmptyString(args.delegate.senderId, "delegate.senderId"),
-				receiver_id: coerceNonEmptyString(args.delegate.receiverId, "delegate.receiverId"),
-				public_key: coerceNonEmptyString(args.delegate.publicKey, "delegate.publicKey"),
-				nonce: coerceNonEmptyString(args.delegate.nonce, "delegate.nonce"),
-				max_block_height: coerceNonEmptyString(args.delegate.maxBlockHeight, "delegate.maxBlockHeight"),
-				action_fingerprint: coerceNonEmptyString(args.delegate.actionFingerprint, "delegate.actionFingerprint"),
-				canonical_delegate_borsh_b64u: canonicalDelegateBorshB64u
-			}
-		},
-		signing_payload: {
-			kind: "near_delegate_action_v1",
-			canonical_delegate_borsh_b64u: canonicalDelegateBorshB64u,
-			expected_signing_digest_b64u: requireDigestB64u(args.expectedSigningDigestB64u, "expectedSigningDigestB64u")
-		}
-	};
-	return {
-		request,
-		admissionMaterial: await deriveRouterAbNormalSigningAdmissionMaterialV2(request)
-	};
-}
-function buildRouterAbEd25519NormalSigningFinalizeRequestV2(args) {
-	const scope = parseScope(args.scope, "scope");
-	const base = {
-		scope,
-		expires_at_ms: requirePositiveInteger(args.expiresAtMs, "expiresAtMs"),
-		prepare_binding: {
-			server_round1_handle: coerceNonEmptyString(args.prepareResponse.server_round1_handle, "server_round1_handle"),
-			round1_binding_digest: parseDigest32(args.prepareResponse.round1_binding_digest, "round1_binding_digest"),
-			intent_digest: parseDigest32(args.admissionMaterial.intentDigest, "intent_digest"),
-			signing_payload_digest: parseDigest32(args.admissionMaterial.signingPayloadDigest, "signing_payload_digest")
-		},
-		protocol: {
-			kind: "ed25519_two_party_frost_finalize_v1",
-			client_commitments: parseCommitments(args.clientCommitments, "clientCommitments"),
-			server_commitments: parseCommitments(args.prepareResponse.server_commitments, "serverCommitments"),
-			client_verifying_share_b64u: coerceNonEmptyString(args.clientVerifyingShareB64u, "clientVerifyingShareB64u"),
-			server_verifying_share_b64u: coerceNonEmptyString(args.prepareResponse.server_verifying_share_b64u, "serverVerifyingShareB64u"),
-			client_signature_share_b64u: coerceNonEmptyString(args.clientSignatureShareB64u, "clientSignatureShareB64u")
-		}
-	};
-	if (scope.authorization.kind === "reusable_wallet_session" && args.prepareResponse.scope.authorization.kind === "reusable_wallet_session") return {
-		...base,
-		scope: {
-			...scope,
-			authorization: scope.authorization
-		},
-		authorized_operation: parseReusableWalletSessionAuthorizedOperation(args.prepareResponse.authorized_operation, "authorized_operation")
-	};
-	if (scope.authorization.kind === "operation_step_up" && args.prepareResponse.scope.authorization.kind === "operation_step_up") return {
-		...base,
-		scope: {
-			...scope,
-			authorization: scope.authorization
-		},
-		authorized_operation: parseVerifiedStepUpAuthorizedOperation(args.prepareResponse.authorized_operation, "authorized_operation")
-	};
-	throw new Error("Router A/B normal-signing authorization changed after prepare");
-}
-async function deriveRouterAbNormalSigningAdmissionMaterialV2(request) {
-	const intentDigest = routerAbDigest32Wire(await sha256Bytes(canonicalIntentBytes(request.intent)));
-	const signingPayloadDigest = routerAbDigest32Wire(await sha256Bytes(canonicalSigningPayloadBytes(request.signing_payload)));
-	const admittedSigningDigest = routerAbDigest32Wire(await sha256Bytes(signingPayloadPreimageBytes(request.signing_payload)));
-	const expected = base64UrlDecode(expectedSigningDigestB64u(request.signing_payload));
-	if (!sameBytes(admittedSigningDigest.bytes, expected)) throw new Error("Router A/B normal-signing expected signing digest drift");
-	return {
-		intentDigest,
-		signingPayloadDigest,
-		admittedSigningDigest
-	};
-}
-function requireExactFields(record, expectedFields, label) {
-	const actualFields = Object.keys(record).sort();
-	const expected = [...expectedFields].sort();
-	if (actualFields.length !== expected.length || actualFields.some((field, index) => field !== expected[index])) throw new Error(`${label} has invalid fields`);
-}
-function parseScope(value, label) {
-	const record = value && typeof value === "object" ? value : null;
-	if (!record) throw new Error(`${label} must be an object`);
-	requireExactFields(record, [
-		"request_id",
-		"account_id",
-		"authorization",
-		"material_activation",
-		"signing_worker_id"
-	], label);
-	const scope = {
-		request_id: coerceNonEmptyString(record.request_id, `${label}.request_id`),
-		account_id: coerceNonEmptyString(record.account_id, `${label}.account_id`),
-		authorization: parseRouterAbNormalSigningAuthorization(record.authorization),
-		material_activation: parseRouterAbMpcMaterialActivationRef(record.material_activation),
-		signing_worker_id: coerceNonEmptyString(record.signing_worker_id, `${label}.signing_worker_id`)
-	};
-	if (scope.material_activation.signing_worker !== scope.signing_worker_id) throw new Error(`${label} material activation SigningWorker mismatch`);
-	return scope;
-}
-function parseDigest32(value, label) {
-	const record = value && typeof value === "object" ? value : null;
-	if (!record) throw new Error(`${label} must be an object`);
-	return { bytes: requireByteArray(record.bytes, `${label}.bytes`, 32) };
-}
-function parseCanonicalWireBytes(value, label) {
-	const record = value && typeof value === "object" ? value : null;
-	if (!record) throw new Error(`${label} must be an object`);
-	const bytes = requireByteArray(record.bytes, `${label}.bytes`);
-	if (bytes.length === 0) throw new Error(`${label}.bytes must be non-empty`);
-	return { bytes };
-}
-function parseCommitments(value, label) {
-	const record = value && typeof value === "object" ? value : null;
-	if (!record) throw new Error(`${label} must be an object`);
-	return {
-		hiding: coerceNonEmptyString(record.hiding, `${label}.hiding`),
-		binding: coerceNonEmptyString(record.binding, `${label}.binding`)
-	};
-}
-function parseServerIdentity(value, label) {
-	const record = value && typeof value === "object" ? value : null;
-	if (!record) throw new Error(`${label} must be an object`);
-	return {
-		server_id: coerceNonEmptyString(record.server_id, `${label}.server_id`),
-		key_epoch: coerceNonEmptyString(record.key_epoch, `${label}.key_epoch`),
-		recipient_encryption_key: coerceNonEmptyString(record.recipient_encryption_key, `${label}.recipient_encryption_key`)
-	};
-}
-function parseReusableWalletSessionAuthorizedOperation(value, label) {
-	const record = value && typeof value === "object" ? value : null;
-	if (!record) throw new Error(`${label} must be an object`);
-	requireExactFields(record, [
-		"kind",
-		"authorized_operation_id",
-		"operation_id",
-		"capability_kind",
-		"operation_kind",
-		"lane_digest_b64u",
-		"intent_digest_b64u",
-		"display_digest_b64u",
-		"operation_fingerprint_digest"
-	], label);
-	const kind = coerceNonEmptyString(record.kind, `${label}.kind`);
-	if (kind !== "reusable_wallet_session_authorized_operation_v1") throw new Error(`${label}.kind is invalid`);
-	const capabilityKind = coerceNonEmptyString(record.capability_kind, `${label}.capability_kind`);
-	if (capabilityKind !== "near_ed25519_mpc_signing") throw new Error(`${label}.capability_kind is invalid`);
-	const operationKind = coerceNonEmptyString(record.operation_kind, `${label}.operation_kind`);
-	if (operationKind !== "near.sign_transaction" && operationKind !== "near.sign_delegate_action" && operationKind !== "near.sign_nep413_message") throw new Error(`${label}.operation_kind is invalid`);
-	return {
-		kind,
-		authorized_operation_id: coerceNonEmptyString(record.authorized_operation_id, `${label}.authorized_operation_id`),
-		operation_id: coerceNonEmptyString(record.operation_id, `${label}.operation_id`),
-		capability_kind: capabilityKind,
-		operation_kind: operationKind,
-		lane_digest_b64u: requireDigestB64u(record.lane_digest_b64u, `${label}.lane_digest_b64u`),
-		intent_digest_b64u: requireDigestB64u(record.intent_digest_b64u, `${label}.intent_digest_b64u`),
-		display_digest_b64u: requireDigestB64u(record.display_digest_b64u, `${label}.display_digest_b64u`),
-		operation_fingerprint_digest: requireDigestB64u(record.operation_fingerprint_digest, `${label}.operation_fingerprint_digest`)
-	};
-}
-function parseVerifiedStepUpAuthorizedOperation(value, label) {
-	const record = value && typeof value === "object" ? value : null;
-	if (!record) throw new Error(`${label} must be an object`);
-	requireExactFields(record, [
-		"kind",
-		"authorization_session_id",
-		"evidence_set_digest",
-		"authorized_operation_id",
-		"operation_id",
-		"capability_kind",
-		"operation_kind",
-		"lane_digest_b64u",
-		"intent_digest_b64u",
-		"display_digest_b64u",
-		"operation_fingerprint_digest"
-	], label);
-	if (coerceNonEmptyString(record.kind, `${label}.kind`) !== "verified_step_up_authorized_operation_v1") throw new Error(`${label}.kind is invalid`);
-	if (coerceNonEmptyString(record.capability_kind, `${label}.capability_kind`) !== "near_ed25519_mpc_signing") throw new Error(`${label}.capability_kind is invalid`);
-	const operationKind = coerceNonEmptyString(record.operation_kind, `${label}.operation_kind`);
-	if (operationKind !== "near.sign_transaction" && operationKind !== "near.sign_delegate_action" && operationKind !== "near.sign_nep413_message") throw new Error(`${label}.operation_kind is invalid`);
-	return {
-		kind: "verified_step_up_authorized_operation_v1",
-		authorization_session_id: coerceNonEmptyString(record.authorization_session_id, `${label}.authorization_session_id`),
-		evidence_set_digest: requireDigestB64u(record.evidence_set_digest, `${label}.evidence_set_digest`),
-		authorized_operation_id: coerceNonEmptyString(record.authorized_operation_id, `${label}.authorized_operation_id`),
-		operation_id: coerceNonEmptyString(record.operation_id, `${label}.operation_id`),
-		capability_kind: "near_ed25519_mpc_signing",
-		operation_kind: operationKind,
-		lane_digest_b64u: requireDigestB64u(record.lane_digest_b64u, `${label}.lane_digest_b64u`),
-		intent_digest_b64u: requireDigestB64u(record.intent_digest_b64u, `${label}.intent_digest_b64u`),
-		display_digest_b64u: requireDigestB64u(record.display_digest_b64u, `${label}.display_digest_b64u`),
-		operation_fingerprint_digest: requireDigestB64u(record.operation_fingerprint_digest, `${label}.operation_fingerprint_digest`)
-	};
-}
-function parsePrepareResponse(value) {
-	const record = value && typeof value === "object" ? value : null;
-	if (!record) throw new Error("Router A/B normal-signing prepare response must be an object");
-	const signatureScheme = coerceNonEmptyString(record.signature_scheme, "signature_scheme");
-	if (signatureScheme !== "ed25519_v1") throw new Error(`Unsupported Router A/B normal-signing signature scheme: ${signatureScheme}`);
-	const scope = parseScope(record.scope, "scope");
-	const base = {
-		scope,
-		signing_payload_digest: parseDigest32(record.signing_payload_digest, "signing_payload_digest"),
-		round1_binding_digest: parseDigest32(record.round1_binding_digest, "round1_binding_digest"),
-		signing_worker: parseServerIdentity(record.signing_worker, "signing_worker"),
-		server_round1_handle: coerceNonEmptyString(record.server_round1_handle, "server_round1_handle"),
-		server_commitments: parseCommitments(record.server_commitments, "server_commitments"),
-		server_verifying_share_b64u: coerceNonEmptyString(record.server_verifying_share_b64u, "server_verifying_share_b64u"),
-		signature_scheme: "ed25519_v1",
-		prepared_at_ms: requirePositiveInteger(record.prepared_at_ms, "prepared_at_ms"),
-		expires_at_ms: requirePositiveInteger(record.expires_at_ms, "expires_at_ms")
-	};
-	switch (scope.authorization.kind) {
-		case "reusable_wallet_session":
-			requireExactFields(record, [
-				"scope",
-				"signing_payload_digest",
-				"round1_binding_digest",
-				"signing_worker",
-				"server_round1_handle",
-				"server_commitments",
-				"server_verifying_share_b64u",
-				"signature_scheme",
-				"prepared_at_ms",
-				"expires_at_ms",
-				"authorized_operation"
-			], "Router A/B reusable Wallet Session prepare response");
-			return {
-				...base,
-				scope: {
-					...scope,
-					authorization: scope.authorization
-				},
-				authorized_operation: parseReusableWalletSessionAuthorizedOperation(record.authorized_operation, "authorized_operation")
-			};
-		case "operation_step_up":
-			requireExactFields(record, [
-				"scope",
-				"signing_payload_digest",
-				"round1_binding_digest",
-				"signing_worker",
-				"server_round1_handle",
-				"server_commitments",
-				"server_verifying_share_b64u",
-				"signature_scheme",
-				"prepared_at_ms",
-				"expires_at_ms",
-				"authorized_operation"
-			], "Router A/B operation step-up prepare response");
-			return {
-				...base,
-				scope: {
-					...scope,
-					authorization: scope.authorization
-				},
-				authorized_operation: parseVerifiedStepUpAuthorizedOperation(record.authorized_operation, "authorized_operation")
-			};
-	}
-}
-function parseNormalSigningResponse(value) {
-	const record = value && typeof value === "object" ? value : null;
-	if (!record) throw new Error("Router A/B normal-signing response must be an object");
-	requireExactFields(record, [
-		"scope",
-		"signing_payload_digest",
-		"signing_worker",
-		"signature_scheme",
-		"signature",
-		"signed_at_ms"
-	], "Router A/B normal-signing response");
-	const signatureScheme = coerceNonEmptyString(record.signature_scheme, "signature_scheme");
-	if (signatureScheme !== "ed25519_v1") throw new Error(`Unsupported Router A/B normal-signing signature scheme: ${signatureScheme}`);
-	return {
-		scope: parseScope(record.scope, "scope"),
-		signing_payload_digest: parseDigest32(record.signing_payload_digest, "signing_payload_digest"),
-		signing_worker: parseServerIdentity(record.signing_worker, "signing_worker"),
-		signature_scheme: "ed25519_v1",
-		signature: parseCanonicalWireBytes(record.signature, "signature"),
-		signed_at_ms: requirePositiveInteger(record.signed_at_ms, "signed_at_ms")
-	};
-}
-function buildRouterAbRequestInit(args) {
-	const bearer = args.credential.kind === "wallet_session_opaque" ? {
-		token: args.credential.walletSessionToken,
-		missingMessage: "walletSessionToken is required"
-	} : null;
-	return buildRelayerJsonPostRequestInit({
-		...bearer ? { headers: buildBearerAuthorizationHeader(bearer) } : {},
-		body: args.body
-	});
-}
-function parseRouterAbSigningErrorPayload(bodyText) {
-	if (!bodyText.trim()) return null;
-	try {
-		const parsed = JSON.parse(bodyText);
-		const record = parsed && typeof parsed === "object" ? parsed : null;
-		if (!record) return null;
-		const code = String(record.code || "").trim();
-		const message = String(record.message || "").trim();
-		if (!code) return null;
-		const authorizationDecision = record.authorization_decision === void 0 ? void 0 : parseRouterAbOwnerOperationAuthorizationDecision(record.authorization_decision);
-		return {
-			code,
-			message,
-			...authorizationDecision ? { authorizationDecision } : {}
-		};
-	} catch {
-		return null;
-	}
-}
-function parseRouterAbOwnerOperationAuthorizationDecision(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Router A/B owner-operation authorization decision is invalid");
-	const record = value;
-	const kind = record.kind;
-	if (kind === "step_up_required") {
-		requireExactRecordFields(record, [
-			"kind",
-			"reason",
-			"step_up"
-		], "owner-operation step-up decision");
-		const reason = record.reason;
-		if (reason !== "wallet_session_missing" && reason !== "wallet_session_expired" && reason !== "wallet_session_exhausted" && reason !== "wallet_session_ended" && reason !== "wallet_session_superseded") throw new Error("owner-operation step-up decision reason is invalid");
-		const stepUp = record.step_up;
-		if (stepUp && typeof stepUp === "object" && !Array.isArray(stepUp) && "operation_digests" in stepUp) return {
-			kind,
-			reason,
-			step_up: parseRouterAbEcdsaOperationStepUpPreparationV1(stepUp)
-		};
-		return {
-			kind,
-			reason,
-			step_up: parseRouterAbEd25519OperationStepUpPreparation(stepUp)
-		};
-	}
-	if (kind === "denied") {
-		requireExactRecordFields(record, ["kind", "denial"], "owner-operation denial decision");
-		if (!record.denial || typeof record.denial !== "object" || Array.isArray(record.denial)) throw new Error("owner-operation denial is invalid");
-		const denial = record.denial;
-		requireExactRecordFields(denial, ["code", "message"], "owner-operation denial");
-		const code = denial.code;
-		if (code !== "invalid_identity" && code !== "invalid_authority" && code !== "invalid_operation" && code !== "inactive_material" && code !== "replayed_step_up" && code !== "authorization_unavailable") throw new Error("owner-operation denial code is invalid");
-		if (typeof denial.message !== "string" || denial.message.trim() !== denial.message) throw new Error("owner-operation denial message is invalid");
-		return {
-			kind,
-			denial: {
-				code,
-				message: denial.message
-			}
-		};
-	}
-	if (kind === "authorized") {
-		requireExactRecordFields(record, [
-			"kind",
-			"operation",
-			"source"
-		], "owner-operation decision");
-		if (!record.operation || typeof record.operation !== "object" || Array.isArray(record.operation)) throw new Error("owner-operation authorized operation is invalid");
-		const operation = record.operation;
-		requireExactRecordFields(operation, [
-			"kind",
-			"operation_id",
-			"authorized_operation_id",
-			"operation_fingerprint_digest"
-		], "owner-operation authorized operation");
-		if (operation.kind !== "authorized_operation" || typeof operation.operation_id !== "string" || typeof operation.authorized_operation_id !== "string" || typeof operation.operation_fingerprint_digest !== "string") throw new Error("owner-operation authorized operation is invalid");
-		if (!record.source || typeof record.source !== "object" || Array.isArray(record.source)) throw new Error("owner-operation authorized source is invalid");
-		const source = record.source;
-		requireExactRecordFields(source, [
-			"kind",
-			"wallet_session_id",
-			"quota_id"
-		], "owner-operation authorized source");
-		if (source.kind !== "reusable_wallet_session" || typeof source.wallet_session_id !== "string" || typeof source.quota_id !== "string") throw new Error("owner-operation authorized source is invalid");
-		return {
-			kind,
-			operation: {
-				kind: "authorized_operation",
-				operation_id: operation.operation_id,
-				authorized_operation_id: operation.authorized_operation_id,
-				operation_fingerprint_digest: operation.operation_fingerprint_digest
-			},
-			source: {
-				kind: "reusable_wallet_session",
-				wallet_session_id: source.wallet_session_id,
-				quota_id: source.quota_id
-			}
-		};
-	}
-	throw new Error("owner-operation authorization decision kind is invalid");
-}
-function parseRouterAbEd25519OperationStepUpPreparation(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Ed25519 operation step-up preparation is invalid");
-	const record = value;
-	requireExactRecordFields(record, [
-		"wallet_id",
-		"operation_kind",
-		"operation_id",
-		"request_id",
-		"account_id",
-		"material_activation",
-		"signing_worker_id",
-		"near_account_id",
-		"signer_slot",
-		"participant_ids",
-		"expires_at_ms"
-	], "Ed25519 owner-operation step-up preparation");
-	const operationKind = record.operation_kind;
-	if (operationKind !== "near.sign_transaction" && operationKind !== "near.sign_delegate_action" && operationKind !== "near.sign_nep413_message") throw new Error("Ed25519 operation step-up kind is invalid");
-	if (typeof record.wallet_id !== "string" || typeof record.operation_id !== "string" || typeof record.request_id !== "string" || typeof record.account_id !== "string" || typeof record.signing_worker_id !== "string" || typeof record.near_account_id !== "string" || !Number.isSafeInteger(record.signer_slot) || !Number.isSafeInteger(record.expires_at_ms) || !Array.isArray(record.participant_ids) || record.participant_ids.length !== 2 || !record.participant_ids.every((participantId) => Number.isSafeInteger(participantId) && Number(participantId) > 0)) throw new Error("Ed25519 operation step-up preparation fields are invalid");
-	const [firstParticipantId, secondParticipantId] = record.participant_ids;
-	const signerSlot = record.signer_slot;
-	const expiresAtMs = record.expires_at_ms;
-	if (typeof firstParticipantId !== "number" || typeof secondParticipantId !== "number" || typeof signerSlot !== "number" || typeof expiresAtMs !== "number") throw new Error("Ed25519 operation step-up participants are invalid");
-	return {
-		wallet_id: record.wallet_id,
-		operation_kind: operationKind,
-		operation_id: record.operation_id,
-		request_id: record.request_id,
-		account_id: record.account_id,
-		material_activation: parseRouterAbMpcMaterialActivationRef(record.material_activation),
-		signing_worker_id: record.signing_worker_id,
-		near_account_id: record.near_account_id,
-		signer_slot: signerSlot,
-		participant_ids: [firstParticipantId, secondParticipantId],
-		expires_at_ms: expiresAtMs
-	};
-}
-function requireExactRecordFields(record, fields, label) {
-	const expected = new Set(fields);
-	for (const key of Object.keys(record)) if (!expected.has(key)) throw new Error(`${label} contains unsupported field ${key}`);
-	for (const field of fields) if (!Object.hasOwn(record, field)) throw new Error(`${label} is missing ${field}`);
-}
-function routerAbSigningHttpError(args) {
-	const payload = parseRouterAbSigningErrorPayload(args.bodyText);
-	if (payload) {
-		const admissionError = routerAbNormalSigningAdmissionErrorFromPayload({
-			code: payload.code,
-			message: payload.message,
-			path: args.path,
-			status: args.status,
-			authorizationDecision: payload.authorizationDecision
-		});
-		if (admissionError) return admissionError;
-		const walletSessionError = walletSessionFailureErrorFromPayload({
-			code: payload.code,
-			message: `Router A/B signing ${args.path} returned HTTP ${args.status}: ${payload.message}`
-		});
-		if (walletSessionError) return walletSessionError;
-		return new RouterAbSigningRequestError({
-			code: payload.code,
-			message: payload.message,
-			path: args.path,
-			status: args.status
-		});
-	}
-	return /* @__PURE__ */ new Error(`Router A/B signing ${args.path} returned HTTP ${args.status}${args.bodyText ? `: ${args.bodyText}` : ""}`);
-}
-async function postRouterAbNormalSigningJson(args) {
-	if (typeof fetch !== "function") throw new Error("fetch is not available for Router A/B normal-signing request");
-	const base = normalizeRelayerBaseUrl(coerceNonEmptyString(args.relayServerUrl, "relayServerUrl"));
-	const response = await fetch(`${base}${args.path}`, {
-		...buildRouterAbRequestInit({
-			credential: args.credential,
-			body: args.body
-		}),
-		signal: args.signal
-	});
-	try {
-		args.onServerTiming?.(response.headers.get("Server-Timing"));
-	} catch {}
-	if (!response.ok) {
-		const errorText = await response.text().catch(() => "");
-		throw routerAbSigningHttpError({
-			path: args.path,
-			status: response.status,
-			bodyText: errorText
-		});
-	}
-	return args.parse(await response.json());
-}
-async function prepareRouterAbNormalSigningV2(args) {
-	return postRouterAbNormalSigningJson({
-		relayServerUrl: args.relayServerUrl,
-		path: "/router-ab/ed25519/sign/prepare",
-		credential: args.credential,
-		body: args.request,
-		parse: parsePrepareResponse
-	});
-}
-async function prepareRouterAbEcdsaDerivationEvmDigestSigningV1(args) {
-	await routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1(args.request);
-	return postRouterAbNormalSigningJson({
-		relayServerUrl: args.relayServerUrl,
-		path: "/router-ab/ecdsa-derivation/sign/prepare",
-		onServerTiming: args.onServerTiming,
-		credential: args.credential,
-		body: args.request,
-		parse: (value) => parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1(args.request, value)
-	});
-}
-async function finalizeRouterAbNormalSigningV2(args) {
-	return postRouterAbNormalSigningJson({
-		relayServerUrl: args.relayServerUrl,
-		path: "/router-ab/ed25519/sign",
-		credential: args.credential,
-		body: args.request,
-		parse: parseNormalSigningResponse
-	});
-}
-async function finalizeRouterAbEcdsaDerivationEvmDigestSigningV1(args) {
-	await routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1(args.request);
-	return postRouterAbNormalSigningJson({
-		relayServerUrl: args.relayServerUrl,
-		path: "/router-ab/ecdsa-derivation/sign",
-		onServerTiming: args.onServerTiming,
-		credential: args.credential,
-		body: args.request,
-		parse: (value) => parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreRequestV1(args.request, value)
-	});
-}
-function canonicalIntentBytes(intent) {
-	const out = [];
-	pushLen32(out, textBytes(INTENT_VERSION_V2));
-	switch (intent.kind) {
-		case "near_transaction_v1":
-			pushLen32(out, textBytes("near_transaction_v1"));
-			pushIntentCommon(out, intent);
-			pushU32Be(out, intent.transactions.length);
-			for (const transaction of intent.transactions) {
-				pushLen32(out, textBytes(transaction.receiver_id));
-				pushLen32(out, textBytes(transaction.action_fingerprint));
-			}
-			pushLen32(out, textBytes(intent.unsigned_transaction_borsh_b64u));
-			return Uint8Array.from(out);
-		case "nep413_v1":
-			pushLen32(out, textBytes("nep413_v1"));
-			pushIntentCommon(out, intent);
-			pushLen32(out, textBytes(intent.recipient));
-			pushLen32(out, textBytes(intent.message));
-			pushLen32(out, textBytes(intent.nonce_b64u));
-			pushOptionalString(out, intent.callback_url);
-			return Uint8Array.from(out);
-		case "near_delegate_action_v1":
-			pushLen32(out, textBytes("near_delegate_action_v1"));
-			pushIntentCommon(out, intent);
-			pushLen32(out, textBytes(intent.delegate.sender_id));
-			pushLen32(out, textBytes(intent.delegate.receiver_id));
-			pushLen32(out, textBytes(intent.delegate.public_key));
-			pushLen32(out, textBytes(intent.delegate.nonce));
-			pushLen32(out, textBytes(intent.delegate.max_block_height));
-			pushLen32(out, textBytes(intent.delegate.action_fingerprint));
-			pushLen32(out, textBytes(intent.delegate.canonical_delegate_borsh_b64u));
-			return Uint8Array.from(out);
-	}
-}
-function canonicalSigningPayloadBytes(payload) {
-	const out = [];
-	pushLen32(out, textBytes(PAYLOAD_VERSION_V2));
-	switch (payload.kind) {
-		case "near_unsigned_transaction_borsh_v1":
-			pushLen32(out, textBytes("near_unsigned_transaction_borsh_v1"));
-			pushLen32(out, textBytes(payload.unsigned_transaction_borsh_b64u));
-			pushLen32(out, textBytes(payload.expected_signing_digest_b64u));
-			return Uint8Array.from(out);
-		case "nep413_message_v1":
-			pushLen32(out, textBytes("nep413_message_v1"));
-			pushLen32(out, textBytes(payload.canonical_message_b64u));
-			pushLen32(out, textBytes(payload.expected_signing_digest_b64u));
-			return Uint8Array.from(out);
-		case "near_delegate_action_v1":
-			pushLen32(out, textBytes("near_delegate_action_v1"));
-			pushLen32(out, textBytes(payload.canonical_delegate_borsh_b64u));
-			pushLen32(out, textBytes(payload.expected_signing_digest_b64u));
-			return Uint8Array.from(out);
-	}
-}
-function signingPayloadPreimageBytes(payload) {
-	switch (payload.kind) {
-		case "near_unsigned_transaction_borsh_v1": return base64UrlDecode(payload.unsigned_transaction_borsh_b64u);
-		case "nep413_message_v1": return base64UrlDecode(payload.canonical_message_b64u);
-		case "near_delegate_action_v1": return base64UrlDecode(payload.canonical_delegate_borsh_b64u);
-	}
-}
-function expectedSigningDigestB64u(payload) {
-	switch (payload.kind) {
-		case "near_unsigned_transaction_borsh_v1":
-		case "nep413_message_v1":
-		case "near_delegate_action_v1": return payload.expected_signing_digest_b64u;
-	}
-}
-function pushIntentCommon(out, intent) {
-	pushLen32(out, textBytes(intent.operation_id));
-	pushLen32(out, textBytes(intent.operation_fingerprint));
-	pushLen32(out, textBytes(intent.near_account_id));
-	pushLen32(out, textBytes(intent.near_network_id));
-}
-function pushOptionalString(out, value) {
-	if (value) {
-		out.push(1);
-		pushLen32(out, textBytes(value));
-	} else out.push(0);
-}
-function pushBorshString(out, value) {
-	const bytes = textBytes(value);
-	pushU32Le(out, bytes.length);
-	pushBytes(out, bytes);
-}
-function pushLen32(out, bytes) {
-	pushU32Be(out, bytes.length);
-	pushBytes(out, bytes);
-}
-function pushBytes(out, bytes) {
-	for (const byte of bytes) out.push(byte);
-}
-function pushU32Be(out, value) {
-	out.push(value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255);
-}
-function pushU32Le(out, value) {
-	out.push(value & 255, value >>> 8 & 255, value >>> 16 & 255, value >>> 24 & 255);
-}
-async function sha256Bytes(input) {
-	const subtle = globalThis.crypto?.subtle;
-	if (!subtle) throw new Error("Web Crypto SHA-256 is unavailable for Router A/B normal signing");
-	const bytes = new Uint8Array(input.length);
-	bytes.set(input);
-	return new Uint8Array(await subtle.digest("SHA-256", bytes.buffer));
-}
-function textBytes(value) {
-	return new TextEncoder().encode(value);
-}
-function sameBytes(left, right) {
-	return left.length === right.length && left.every((byte, index) => byte === right[index]);
-}
-//#endregion
-export { RouterAbSigningRequestError, buildRouterAbEd25519DelegateActionPrepareRequestV2, buildRouterAbEd25519NearTransactionPrepareRequestV2, buildRouterAbEd25519Nep413PrepareRequestV2, buildRouterAbEd25519NormalSigningFinalizeRequestV2, finalizeRouterAbEcdsaDerivationEvmDigestSigningV1, finalizeRouterAbNormalSigningV2, prepareRouterAbEcdsaDerivationEvmDigestSigningV1, prepareRouterAbNormalSigningV2, routerAbCanonicalWireBytesToB64u, routerAbNormalSigningActionFingerprint };
-
-//# sourceMappingURL=routerAbNormalSigning.js.map