@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/react/shared-ts/src/utils/routerAbEcdsaDerivation.js

@@ -1,1334 +0,0 @@
-import { base64UrlDecode, base64UrlEncode } from "./base64.js";
-import { requireRecord } from "./validation.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
-import "./encoders.js";
-import { normalizeRuntimePolicyScope } from "../threshold/signingRootScope.js";
-import { requireRouterAbX25519PublicKey } from "./routerAbPublicKeyset.js";
-import { parseEcdsaActiveStateId, parseRootShareEpoch, parseThresholdEcdsaSessionId } from "./domainIds.js";
-import { parseCorrelationId, parseDigestB64u } from "./canonicalPrimitives.js";
-import { parseEcdsaServerGeneration } from "./ecdsaCapabilityActivation.js";
-import { canonicalRouterAbMpcMaterialActivationRefBytes, canonicalRouterAbNormalSigningAuthorizationBytes, parseRouterAbMpcMaterialActivationRef, parseRouterAbNormalSigningAuthorization, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "./routerAbNormalSigningIdentity.js";
-import { EVM_ECDSA_MPC_OPERATION_KINDS, parseEcdsaAuthorizationSessionId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../authorization/capabilityKinds.js";
-import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../device-linking/activeWalletSession.js";
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, parseWalletAuthAuthority } from "./walletAuthAuthority.js";
-//#region ../shared-ts/src/utils/routerAbEcdsaDerivation.ts
-/**
-* The longest an ECDSA presignature ceremony may run. The Gateway authorizes a
-* pool fill only when the requested ceremony deadline is within this limit.
-*/
-const ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS = 5 * 6e4;
-const ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1 = "router_ab_ecdsa_derivation_normal_signing_v1";
-const ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH = "/router-ab/ecdsa-derivation/export";
-const ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH = "/router-ab/ecdsa-derivation/presignature-pool/fill/init";
-const ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH = "/router-ab/ecdsa-derivation/presignature-pool/fill/step";
-const ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH = "/router-ab/ecdsa-derivation/session/activate";
-const ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH = "/router-ab/ecdsa-derivation/operation-step-up";
-const ROUTER_AB_ECDSA_OPERATION_STEP_UP_CHALLENGE_DOMAIN_V1 = "router-ab-ecdsa-operation-step-up/challenge/v1";
-const ECDSA_DERIVATION_CONTEXT_DOMAIN_TAG_V1 = "router-ab-ecdsa-derivation/context/v1";
-const ECDSA_DERIVATION_CONTEXT_BINDING_DOMAIN_V1 = "router-ab-ecdsa-derivation/role-local/context-binding/v1";
-const ECDSA_DERIVATION_SCHEME_ID_V1 = "router-ab-ecdsa-derivation-v1";
-const ECDSA_DERIVATION_CURVE_V1 = "secp256k1";
-const ECDSA_DERIVATION_CONTEXT_FIELD_BYTES_V1 = 1;
-const ECDSA_DERIVATION_PARTICIPANT_IDS_V1 = [1, 2];
-const ROUTER_AB_ECDSA_DERIVATION_PUBLIC_IDENTITY_VERSION_V1 = "router-ab-ecdsa-derivation/public-identity/v1";
-const ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_SCOPE_VERSION_V1 = "router-ab-ecdsa-derivation/normal-signing-scope/v1";
-const ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_REQUEST_VERSION_V1 = "router-ab-ecdsa-derivation/normal-signing-request/v1";
-const ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_FINALIZE_REQUEST_VERSION_V1 = "router-ab-ecdsa-derivation/normal-signing-finalize-request/v1";
-const ROUTER_AB_ECDSA_DERIVATION_CLIENT_RERANDOMIZATION_COMMITMENT_DOMAIN_V1 = "router-ab-ecdsa-derivation/client-rerandomization-commitment/v1";
-function requireExportShareAuthorizationKind(value, label) {
-	if (value === "reusable_wallet_session" || value === "verified_step_up") return value;
-	throw new Error(`${label} must be reusable_wallet_session or verified_step_up`);
-}
-function parseRouterAbEcdsaOperationStepUpExportTopologyV1(value) {
-	const topology = requireRecord(value, "operationStepUpAuthorizationResponse.export_topology");
-	requireExactKeys(topology, "operationStepUpAuthorizationResponse.export_topology", [
-		"signer_set",
-		"deriver_recipient_keys",
-		"router_id"
-	]);
-	const signerSet = parsePostRegistrationSignerSet(topology.signer_set, "operationStepUpAuthorizationResponse.export_topology.signer_set");
-	const deriverRecipientKeys = parseRegistrationRecipientKeys(topology.deriver_recipient_keys, "operationStepUpAuthorizationResponse.export_topology.deriver_recipient_keys");
-	if (deriverRecipientKeys.deriver_a.key_epoch !== signerSet.signer_a.key_epoch || deriverRecipientKeys.deriver_b.key_epoch !== signerSet.signer_b.key_epoch) throw new Error("operationStepUpAuthorizationResponse.export_topology recipient key epochs do not match signer_set");
-	return {
-		signer_set: signerSet,
-		deriver_recipient_keys: deriverRecipientKeys,
-		router_id: requireAsciiNonEmptyString(topology.router_id, "operationStepUpAuthorizationResponse.export_topology.router_id")
-	};
-}
-function parseRouterAbEcdsaOperationStepUpAuthorizationResponseV1(value) {
-	const response = requireRecord(value, "operationStepUpAuthorizationResponse");
-	const operationKind = requireEcdsaOperationStepUpKind(response.operation_kind);
-	requireExactKeys(response, "operationStepUpAuthorizationResponse", [
-		"ok",
-		"kind",
-		"authorization",
-		"expires_at_ms",
-		"operation_kind",
-		...operationKind === "evm.export_key" ? ["export_topology"] : []
-	]);
-	if (response.ok !== true || response.kind !== "verified_step_up") throw new Error("operationStepUpAuthorizationResponse is invalid");
-	const authorization = requireRecord(response.authorization, "operationStepUpAuthorizationResponse.authorization");
-	requireExactKeys(authorization, "operationStepUpAuthorizationResponse.authorization", [
-		"kind",
-		"evidence_set_digest",
-		"unseal"
-	]);
-	if (authorization.kind !== "operation_step_up") throw new Error("operationStepUpAuthorizationResponse.authorization.kind is invalid");
-	const expiresAtMs = requirePositiveUnixMs(response.expires_at_ms, "operationStepUpAuthorizationResponse.expires_at_ms");
-	if (expiresAtMs <= Date.now()) throw new Error("operationStepUpAuthorizationResponse.expires_at_ms is expired");
-	const unseal = requireRecord(authorization.unseal, "operationStepUpAuthorizationResponse.authorization.unseal");
-	const unsealKind = requireAsciiNonEmptyString(unseal.kind, "operationStepUpAuthorizationResponse.authorization.unseal.kind");
-	let parsedUnseal;
-	switch (unsealKind) {
-		case "not_requested":
-			requireExactKeys(unseal, "operationStepUpAuthorizationResponse.authorization.unseal", ["kind"]);
-			parsedUnseal = { kind: "not_requested" };
-			break;
-		case "email_otp_grant":
-			requireExactKeys(unseal, "operationStepUpAuthorizationResponse.authorization.unseal", [
-				"kind",
-				"grant",
-				"challenge_id"
-			]);
-			parsedUnseal = {
-				kind: "email_otp_grant",
-				grant: requireAsciiNonEmptyString(unseal.grant, "operationStepUpAuthorizationResponse.authorization.unseal.grant"),
-				challenge_id: requireAsciiNonEmptyString(unseal.challenge_id, "operationStepUpAuthorizationResponse.authorization.unseal.challenge_id")
-			};
-			break;
-		default: throw new Error("operationStepUpAuthorizationResponse.authorization.unseal.kind is invalid");
-	}
-	const base = {
-		ok: true,
-		kind: "verified_step_up",
-		authorization: {
-			kind: "operation_step_up",
-			evidence_set_digest: parseDigestB64u(authorization.evidence_set_digest),
-			unseal: parsedUnseal
-		},
-		expires_at_ms: expiresAtMs
-	};
-	if (operationKind === "evm.sign_transaction") return {
-		...base,
-		operation_kind: "evm.sign_transaction"
-	};
-	return {
-		...base,
-		operation_kind: "evm.export_key",
-		export_topology: parseRouterAbEcdsaOperationStepUpExportTopologyV1(response.export_topology)
-	};
-}
-async function computeRouterAbEcdsaOperationStepUpChallengeB64u(value) {
-	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-		domain: ROUTER_AB_ECDSA_OPERATION_STEP_UP_CHALLENGE_DOMAIN_V1,
-		operation: parseRouterAbEcdsaOperationStepUpPreparationV1(value)
-	})));
-}
-function requireExactKeys(record, label, allowedKeys) {
-	const allowed = new Set(allowedKeys);
-	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is not a supported field`);
-}
-function requireAsciiNonEmptyString(value, label) {
-	if (typeof value !== "string") throw new Error(`${label} must be a string`);
-	const parsed = value.trim();
-	if (!parsed) throw new Error(`${label} is required`);
-	if (!/^[\x20-\x7e]+$/.test(parsed)) throw new Error(`${label} must be printable ASCII`);
-	return parsed;
-}
-function requireRootShareEpoch(value, label) {
-	const parsed = parseRootShareEpoch(requireAsciiNonEmptyString(value, label));
-	if (!parsed.ok) throw new Error(`${label} is invalid`);
-	return parsed.value;
-}
-function requireThresholdEcdsaSessionId(value, label) {
-	const parsed = parseThresholdEcdsaSessionId(requireAsciiNonEmptyString(value, label));
-	if (!parsed.ok) throw new Error(`${label} is invalid`);
-	return parsed.value;
-}
-function requireEcdsaAuthorizationSessionId(value, label) {
-	const parsed = parseEcdsaAuthorizationSessionId(value);
-	if (!parsed.ok) throw new Error(`${label} is invalid`);
-	return parsed.value;
-}
-function requireWalletSessionAuthorizationId(value, label) {
-	const parsed = parseWalletSessionAuthorizationId(value);
-	if (!parsed.ok) throw new Error(`${label} is invalid`);
-	return parsed.value;
-}
-function requireWalletSessionId(value, label) {
-	const parsed = parseWalletSessionId(value);
-	if (!parsed.ok) throw new Error(`${label} is invalid`);
-	return parsed.value;
-}
-function requireMpcWalletSigningQuotaId(value, label) {
-	const parsed = parseMpcWalletSigningQuotaId(value);
-	if (!parsed.ok) throw new Error(`${label} is invalid`);
-	return parsed.value;
-}
-function requirePositiveUnixMs(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
-	return value;
-}
-function requirePositiveCounter(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe-integer counter`);
-	return value;
-}
-function requireU32(value, label) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${label} must be a finite number`);
-	const parsed = Math.floor(value);
-	if (parsed !== value || parsed < 0 || parsed > 4294967295) throw new Error(`${label} must be a u32 integer`);
-	return parsed;
-}
-function requireByte(value, label) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${label} must be a finite number`);
-	const parsed = Math.floor(value);
-	if (parsed !== value || parsed < 0 || parsed > 255) throw new Error(`${label} must be a byte`);
-	return parsed;
-}
-function requireBase64UrlFixed(value, label, byteLength) {
-	const parsed = requireAsciiNonEmptyString(value, label);
-	if (!/^[A-Za-z0-9_-]+$/.test(parsed)) throw new Error(`${label} must be unpadded base64url`);
-	let decoded;
-	try {
-		decoded = base64UrlDecode(parsed);
-	} catch {
-		throw new Error(`${label} must be valid base64url`);
-	}
-	if (decoded.length !== byteLength) throw new Error(`${label} must decode to ${byteLength} bytes`);
-	return parsed;
-}
-function requireCompressedSecp256k1PublicKey(value, label) {
-	const parsed = requireBase64UrlFixed(value, label, 33);
-	const decoded = base64UrlDecode(parsed);
-	if (decoded[0] !== 2 && decoded[0] !== 3) throw new Error(`${label} must be a compressed secp256k1 public key`);
-	return parsed;
-}
-function requireBase64UrlNonEmpty(value, label) {
-	const parsed = requireAsciiNonEmptyString(value, label);
-	if (!/^[A-Za-z0-9_-]+$/.test(parsed)) throw new Error(`${label} must be unpadded base64url`);
-	let decoded;
-	try {
-		decoded = base64UrlDecode(parsed);
-	} catch {
-		throw new Error(`${label} must be valid base64url`);
-	}
-	if (decoded.length === 0) throw new Error(`${label} must decode to non-empty bytes`);
-	return parsed;
-}
-function requireX25519PublicKey(value, label) {
-	const parsed = requireAsciiNonEmptyString(value, label);
-	if (!/^x25519:[0-9a-f]{64}$/.test(parsed)) throw new Error(`${label} must use x25519:<64 lowercase hex chars> encoding`);
-	return parsed;
-}
-function requireUint8ArrayFixed(value, label, byteLength) {
-	if (!(value instanceof Uint8Array)) throw new Error(`${label} must be a Uint8Array`);
-	if (value.length !== byteLength) throw new Error(`${label} must contain ${byteLength} bytes`);
-	return value;
-}
-function requireSignatureScheme(value, label) {
-	const parsed = requireAsciiNonEmptyString(value, label);
-	if (parsed !== "ecdsa_secp256k1_recoverable_v1") throw new Error(`${label} must be ecdsa_secp256k1_recoverable_v1`);
-	return parsed;
-}
-function parsePublicDigest32(value, label) {
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, ["bytes"]);
-	if (!Array.isArray(record.bytes)) throw new Error(`${label}.bytes must be an array`);
-	if (record.bytes.length !== 32) throw new Error(`${label}.bytes must contain 32 bytes`);
-	return { bytes: record.bytes.map((entry, index) => requireByte(entry, `${label}.bytes[${index}]`)) };
-}
-function parseStableKeyContext(value) {
-	const record = requireRecord(value, "scope.context");
-	requireExactKeys(record, "scope.context", ["application_binding_digest_b64u"]);
-	const digest = base64UrlDecode(requireAsciiNonEmptyString(record.application_binding_digest_b64u, "scope.context.application_binding_digest_b64u"));
-	if (digest.length !== 32) throw new Error("scope.context.application_binding_digest_b64u must decode to 32 bytes");
-	return { application_binding_digest_b64u: base64UrlEncode(digest) };
-}
-function parsePublicIdentity(value) {
-	const record = requireRecord(value, "scope.public_identity");
-	requireExactKeys(record, "scope.public_identity", [
-		"context_binding_b64u",
-		"derivation_client_share_public_key33_b64u",
-		"server_public_key33_b64u",
-		"threshold_public_key33_b64u",
-		"ethereum_address20_b64u",
-		"client_share_retry_counter",
-		"server_share_retry_counter"
-	]);
-	return {
-		context_binding_b64u: requireBase64UrlFixed(record.context_binding_b64u, "scope.public_identity.context_binding_b64u", 32),
-		derivation_client_share_public_key33_b64u: requireCompressedSecp256k1PublicKey(record.derivation_client_share_public_key33_b64u, "scope.public_identity.derivation_client_share_public_key33_b64u"),
-		server_public_key33_b64u: requireCompressedSecp256k1PublicKey(record.server_public_key33_b64u, "scope.public_identity.server_public_key33_b64u"),
-		threshold_public_key33_b64u: requireCompressedSecp256k1PublicKey(record.threshold_public_key33_b64u, "scope.public_identity.threshold_public_key33_b64u"),
-		ethereum_address20_b64u: requireBase64UrlFixed(record.ethereum_address20_b64u, "scope.public_identity.ethereum_address20_b64u", 20),
-		client_share_retry_counter: requireU32(record.client_share_retry_counter, "scope.public_identity.client_share_retry_counter"),
-		server_share_retry_counter: requireU32(record.server_share_retry_counter, "scope.public_identity.server_share_retry_counter")
-	};
-}
-function parseServerIdentity(value) {
-	return parseServerIdentityWithLabel(value, "scope.signing_worker");
-}
-function parseServerIdentityWithLabel(value, label) {
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"server_id",
-		"key_epoch",
-		"recipient_encryption_key"
-	]);
-	return {
-		server_id: requireAsciiNonEmptyString(record.server_id, `${label}.server_id`),
-		key_epoch: requireAsciiNonEmptyString(record.key_epoch, `${label}.key_epoch`),
-		recipient_encryption_key: requireRouterAbX25519PublicKey(record.recipient_encryption_key, `${label}.recipient_encryption_key`)
-	};
-}
-function parsePostRegistrationSignerIdentity(value, label, expectedRole) {
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"role",
-		"signer_id",
-		"key_epoch"
-	]);
-	if (requireAsciiNonEmptyString(record.role, `${label}.role`) !== expectedRole) throw new Error(`${label}.role must be ${expectedRole}`);
-	return {
-		role: expectedRole,
-		signer_id: requireAsciiNonEmptyString(record.signer_id, `${label}.signer_id`),
-		key_epoch: requireAsciiNonEmptyString(record.key_epoch, `${label}.key_epoch`)
-	};
-}
-function parsePostRegistrationSignerSet(value, label) {
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"signer_set_id",
-		"policy",
-		"signer_a",
-		"signer_b",
-		"selected_server"
-	]);
-	const policy = requireAsciiNonEmptyString(record.policy, `${label}.policy`);
-	if (policy !== "all_2") throw new Error(`${label}.policy must be all_2`);
-	const signerA = parsePostRegistrationSignerIdentity(record.signer_a, `${label}.signer_a`, "signer_a");
-	const signerB = parsePostRegistrationSignerIdentity(record.signer_b, `${label}.signer_b`, "signer_b");
-	if (signerA.signer_id === signerB.signer_id) throw new Error(`${label} requires distinct signer ids`);
-	return {
-		signer_set_id: requireAsciiNonEmptyString(record.signer_set_id, `${label}.signer_set_id`),
-		policy,
-		signer_a: signerA,
-		signer_b: signerB,
-		selected_server: parseServerIdentityWithLabel(record.selected_server, `${label}.selected_server`)
-	};
-}
-function parseRegistrationLifecycle(value) {
-	const label = "registration.lifecycle";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"lifecycle_id",
-		"work_kind",
-		"primitive_request_kind",
-		"root_share_epoch",
-		"account_id",
-		"session_id",
-		"signer_set_id",
-		"selected_server_id"
-	]);
-	if (record.work_kind !== "registration_prepare") throw new Error(`${label}.work_kind must be registration_prepare`);
-	if (record.primitive_request_kind !== "registration") throw new Error(`${label}.primitive_request_kind must be registration`);
-	return {
-		lifecycle_id: requireAsciiNonEmptyString(record.lifecycle_id, `${label}.lifecycle_id`),
-		work_kind: "registration_prepare",
-		primitive_request_kind: "registration",
-		root_share_epoch: requireRootShareEpoch(record.root_share_epoch, `${label}.root_share_epoch`),
-		account_id: requireAsciiNonEmptyString(record.account_id, `${label}.account_id`),
-		session_id: requireAsciiNonEmptyString(record.session_id, `${label}.session_id`),
-		signer_set_id: requireAsciiNonEmptyString(record.signer_set_id, `${label}.signer_set_id`),
-		selected_server_id: requireAsciiNonEmptyString(record.selected_server_id, `${label}.selected_server_id`)
-	};
-}
-function parseRegistrationRecipientKey(value, label, role) {
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"role",
-		"key_epoch",
-		"public_key"
-	]);
-	if (record.role !== role) throw new Error(`${label}.role must be ${role}`);
-	return {
-		role,
-		key_epoch: requireAsciiNonEmptyString(record.key_epoch, `${label}.key_epoch`),
-		public_key: requireRouterAbX25519PublicKey(record.public_key, `${label}.public_key`)
-	};
-}
-function parseRegistrationRecipientKeys(value, label = "registration.deriver_recipient_keys") {
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, ["deriver_a", "deriver_b"]);
-	return {
-		deriver_a: parseRegistrationRecipientKey(record.deriver_a, `${label}.deriver_a`, "signer_a"),
-		deriver_b: parseRegistrationRecipientKey(record.deriver_b, `${label}.deriver_b`, "signer_b")
-	};
-}
-function parseRouterAbEcdsaRegistrationRequestFactsV1(value) {
-	const label = "registration";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"registration_purpose",
-		"context",
-		"lifecycle",
-		"signer_set",
-		"router_id",
-		"client_id",
-		"replay_nonce",
-		"expires_at_ms",
-		"deriver_recipient_keys"
-	]);
-	if (record.registration_purpose !== "wallet_registration" && record.registration_purpose !== "wallet_add_signer") throw new Error(`${label}.registration_purpose is invalid`);
-	const lifecycle = parseRegistrationLifecycle(record.lifecycle);
-	const signerSet = parsePostRegistrationSignerSet(record.signer_set, `${label}.signer_set`);
-	if (lifecycle.signer_set_id !== signerSet.signer_set_id) throw new Error(`${label}.lifecycle signer set does not match signer_set`);
-	if (lifecycle.selected_server_id !== signerSet.selected_server.server_id) throw new Error(`${label}.lifecycle selected server does not match signer_set`);
-	const recipientKeys = parseRegistrationRecipientKeys(record.deriver_recipient_keys);
-	if (recipientKeys.deriver_a.key_epoch !== signerSet.signer_a.key_epoch) throw new Error(`${label}.deriver_a recipient key epoch does not match signer_set`);
-	if (recipientKeys.deriver_b.key_epoch !== signerSet.signer_b.key_epoch) throw new Error(`${label}.deriver_b recipient key epoch does not match signer_set`);
-	return {
-		registration_purpose: record.registration_purpose,
-		context: parseStableKeyContext(record.context),
-		lifecycle,
-		signer_set: signerSet,
-		router_id: requireAsciiNonEmptyString(record.router_id, `${label}.router_id`),
-		client_id: requireAsciiNonEmptyString(record.client_id, `${label}.client_id`),
-		replay_nonce: requireAsciiNonEmptyString(record.replay_nonce, `${label}.replay_nonce`),
-		expires_at_ms: requirePositiveUnixMs(record.expires_at_ms, `${label}.expires_at_ms`),
-		deriver_recipient_keys: recipientKeys
-	};
-}
-function parseRouterAbEcdsaClientProofBundleV1(value, label) {
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"kind",
-		"transcriptDigestB64u",
-		"payloadB64u"
-	]);
-	if (record.kind !== "recipient_proof_bundle") throw new Error(`${label}.kind must be recipient_proof_bundle`);
-	return {
-		kind: "recipient_proof_bundle",
-		transcriptDigestB64u: requireBase64UrlFixed(record.transcriptDigestB64u, `${label}.transcriptDigestB64u`, 32),
-		payloadB64u: requireBase64UrlNonEmpty(record.payloadB64u, `${label}.payloadB64u`)
-	};
-}
-function parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(value) {
-	const label = "registrationForwarded";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, ["result", "response"]);
-	if (record.result !== "forwarded") throw new Error(`${label}.result must be forwarded`);
-	return {
-		result: "forwarded",
-		response: parseRouterAbEcdsaStrictProofResponseV1(record.response, `${label}.response`)
-	};
-}
-function parseRouterAbEcdsaExplicitExportForwardedResponseV1(value) {
-	return parseRouterAbEcdsaExplicitExportForwardedResponseWithV1(value, parseRouterAbEcdsaSigningWorkerExportShareEnvelopeV1);
-}
-function parseRouterAbEcdsaExplicitExportForwardedResponseWithV1(value, parseEnvelope) {
-	const label = "explicitExportForwarded";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"result",
-		"response",
-		"signing_worker_export"
-	]);
-	if (record.result !== "forwarded") throw new Error(`${label}.result must be forwarded`);
-	return {
-		result: "forwarded",
-		response: parseRouterAbEcdsaStrictProofResponseV1(record.response, `${label}.response`),
-		signing_worker_export: parseEnvelope(record.signing_worker_export)
-	};
-}
-function parseRouterAbEcdsaSigningWorkerExportShareEnvelopeV1(value) {
-	return parseRouterAbEcdsaSigningWorkerExportShareEnvelopeWithV1(value, parseRouterAbMpcMaterialActivationRef);
-}
-function parseRouterAbEcdsaSigningWorkerExportShareBindingWithV1(value, parseMaterialActivation, label) {
-	const binding = requireRecord(value, label);
-	requireExactKeys(binding, label, [
-		"wallet_id",
-		"key_handle",
-		"ecdsa_threshold_key_id",
-		"signing_root_id",
-		"signing_root_version",
-		"activation_epoch",
-		"signing_worker_id",
-		"context_binding_b64u",
-		"threshold_public_key33_b64u",
-		"export_request_digest_b64u",
-		"export_authorization_digest_b64u",
-		"export_nonce",
-		"authorization_kind",
-		"authorization_id",
-		"material_activation",
-		"lifecycle_id",
-		"recipient_identity",
-		"recipient_public_key",
-		"expires_at_ms"
-	]);
-	const materialActivation = parseMaterialActivation(binding.material_activation);
-	if (materialActivation.material_owner !== binding.wallet_id || materialActivation.signing_worker !== binding.signing_worker_id) throw new Error(`${label}.material_activation is not bound to wallet and worker`);
-	return {
-		wallet_id: requireAsciiNonEmptyString(binding.wallet_id, `${label}.wallet_id`),
-		key_handle: requireAsciiNonEmptyString(binding.key_handle, `${label}.key_handle`),
-		ecdsa_threshold_key_id: requireAsciiNonEmptyString(binding.ecdsa_threshold_key_id, `${label}.ecdsa_threshold_key_id`),
-		signing_root_id: requireAsciiNonEmptyString(binding.signing_root_id, `${label}.signing_root_id`),
-		signing_root_version: requireAsciiNonEmptyString(binding.signing_root_version, `${label}.signing_root_version`),
-		activation_epoch: requireRootShareEpoch(binding.activation_epoch, `${label}.activation_epoch`),
-		signing_worker_id: requireAsciiNonEmptyString(binding.signing_worker_id, `${label}.signing_worker_id`),
-		context_binding_b64u: requireBase64UrlFixed(binding.context_binding_b64u, `${label}.context_binding_b64u`, 32),
-		threshold_public_key33_b64u: requireCompressedSecp256k1PublicKey(binding.threshold_public_key33_b64u, `${label}.threshold_public_key33_b64u`),
-		export_request_digest_b64u: requireBase64UrlFixed(binding.export_request_digest_b64u, `${label}.export_request_digest_b64u`, 32),
-		export_authorization_digest_b64u: requireBase64UrlFixed(binding.export_authorization_digest_b64u, `${label}.export_authorization_digest_b64u`, 32),
-		export_nonce: requireAsciiNonEmptyString(binding.export_nonce, `${label}.export_nonce`),
-		authorization_kind: requireExportShareAuthorizationKind(binding.authorization_kind, `${label}.authorization_kind`),
-		authorization_id: requireAsciiNonEmptyString(binding.authorization_id, `${label}.authorization_id`),
-		material_activation: materialActivation,
-		lifecycle_id: requireAsciiNonEmptyString(binding.lifecycle_id, `${label}.lifecycle_id`),
-		recipient_identity: requireAsciiNonEmptyString(binding.recipient_identity, `${label}.recipient_identity`),
-		recipient_public_key: requireX25519PublicKey(binding.recipient_public_key, `${label}.recipient_public_key`),
-		expires_at_ms: requirePositiveUnixMs(binding.expires_at_ms, `${label}.expires_at_ms`)
-	};
-}
-function parseRouterAbEcdsaSigningWorkerExportShareEnvelopeWithV1(value, parseMaterialActivation) {
-	const label = "signingWorkerExportShare";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"version",
-		"algorithm",
-		"binding",
-		"ciphertext_and_tag"
-	]);
-	if (record.version !== "router-ab-ecdsa-derivation/signing-worker-export-share-envelope/v1") throw new Error(`${label}.version is invalid`);
-	if (record.algorithm !== "hpke_x25519_hkdf_sha256_aes256gcm_v1") throw new Error(`${label}.algorithm is invalid`);
-	if (!Array.isArray(record.ciphertext_and_tag) || record.ciphertext_and_tag.length <= 48) throw new Error(`${label}.ciphertext_and_tag is invalid`);
-	return {
-		version: "router-ab-ecdsa-derivation/signing-worker-export-share-envelope/v1",
-		algorithm: "hpke_x25519_hkdf_sha256_aes256gcm_v1",
-		binding: parseRouterAbEcdsaSigningWorkerExportShareBindingWithV1(record.binding, parseMaterialActivation, `${label}.binding`),
-		ciphertext_and_tag: record.ciphertext_and_tag.map((entry, index) => requireByte(entry, `${label}.ciphertext_and_tag[${index}]`))
-	};
-}
-function parseRouterAbEcdsaStrictProofResponseV1(value, label) {
-	const response = requireRecord(value, label);
-	requireExactKeys(response, label, ["bundles"]);
-	const bundlesLabel = `${label}.bundles`;
-	const bundles = requireRecord(response.bundles, bundlesLabel);
-	requireExactKeys(bundles, bundlesLabel, ["signerA", "signerB"]);
-	return { bundles: {
-		signerA: parseRouterAbEcdsaClientProofBundleV1(bundles.signerA, `${bundlesLabel}.signerA`),
-		signerB: parseRouterAbEcdsaClientProofBundleV1(bundles.signerB, `${bundlesLabel}.signerB`)
-	} };
-}
-function parseRouterAbEcdsaVerifiedClientActivationFactsV1(value) {
-	const label = "registrationActivation.publicFacts";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"registrationRequestDigestB64u",
-		"proofTranscriptDigestB64u",
-		"contextBinding32B64u",
-		"derivationClientSharePublicKey33B64u",
-		"clientShareRetryCounter",
-		"participantId"
-	]);
-	if (record.participantId !== 1) throw new Error(`${label}.participantId must be 1`);
-	return {
-		registrationRequestDigestB64u: requireBase64UrlFixed(record.registrationRequestDigestB64u, `${label}.registrationRequestDigestB64u`, 32),
-		proofTranscriptDigestB64u: requireBase64UrlFixed(record.proofTranscriptDigestB64u, `${label}.proofTranscriptDigestB64u`, 32),
-		contextBinding32B64u: requireBase64UrlFixed(record.contextBinding32B64u, `${label}.contextBinding32B64u`, 32),
-		derivationClientSharePublicKey33B64u: requireCompressedSecp256k1PublicKey(record.derivationClientSharePublicKey33B64u, `${label}.derivationClientSharePublicKey33B64u`),
-		clientShareRetryCounter: requireU32(record.clientShareRetryCounter, `${label}.clientShareRetryCounter`),
-		participantId: 1
-	};
-}
-function parseRouterAbEcdsaRegistrationActivationReceiptV1(value) {
-	const label = "registrationActivationReceipt";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"activation_correlation_id",
-		"activation_request_digest",
-		"server_generation",
-		"ecdsa_activation",
-		"lifecycle_id",
-		"transcript_digest"
-	]);
-	const activationLabel = `${label}.ecdsa_activation`;
-	const activation = requireRecord(record.ecdsa_activation, activationLabel);
-	requireExactKeys(activation, activationLabel, [
-		"context",
-		"public_identity",
-		"signing_worker",
-		"material_activation",
-		"activation_epoch",
-		"activation_digest_b64u",
-		"activated_at_ms"
-	]);
-	const signingWorker = parseServerIdentityWithLabel(activation.signing_worker, `${activationLabel}.signing_worker`);
-	const materialActivation = parseRouterAbMpcMaterialActivationRef(activation.material_activation);
-	if (materialActivation.signing_worker !== signingWorker.server_id) throw new Error(`${activationLabel}.material_activation.signing_worker does not match signing_worker`);
-	const activationDigestB64u = requireBase64UrlFixed(activation.activation_digest_b64u, `${activationLabel}.activation_digest_b64u`, 32);
-	const transcriptDigest = parsePublicDigest32(record.transcript_digest, `${label}.transcript_digest`);
-	return {
-		activation_correlation_id: parseCorrelationId(record.activation_correlation_id),
-		activation_request_digest: parsePublicDigest32(record.activation_request_digest, `${label}.activation_request_digest`),
-		server_generation: parseEcdsaServerGeneration(record.server_generation),
-		ecdsa_activation: {
-			context: parseStableKeyContext(activation.context),
-			public_identity: parsePublicIdentity(activation.public_identity),
-			signing_worker: signingWorker,
-			material_activation: materialActivation,
-			activation_epoch: requireRootShareEpoch(activation.activation_epoch, `${activationLabel}.activation_epoch`),
-			activation_digest_b64u: activationDigestB64u,
-			activated_at_ms: requirePositiveUnixMs(activation.activated_at_ms, `${activationLabel}.activated_at_ms`)
-		},
-		lifecycle_id: requireAsciiNonEmptyString(record.lifecycle_id, `${label}.lifecycle_id`),
-		transcript_digest: transcriptDigest
-	};
-}
-function parseRouterAbEcdsaRegistrationPublicActivationReceiptV1(value) {
-	return parseRouterAbEcdsaRegistrationActivationReceiptV1(value);
-}
-function sameRouterAbServerIdentityV1(left, right) {
-	return left.server_id === right.server_id && left.key_epoch === right.key_epoch && left.recipient_encryption_key === right.recipient_encryption_key;
-}
-function sameRouterAbEcdsaVerifiedClientActivationFactsV1(left, right) {
-	return left.registrationRequestDigestB64u === right.registrationRequestDigestB64u && left.proofTranscriptDigestB64u === right.proofTranscriptDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && left.derivationClientSharePublicKey33B64u === right.derivationClientSharePublicKey33B64u && left.clientShareRetryCounter === right.clientShareRetryCounter && left.participantId === right.participantId;
-}
-function sameRegistrationSignerSet(left, right) {
-	return left.signer_set_id === right.signer_set_id && left.policy === right.policy && left.signer_a.role === right.signer_a.role && left.signer_a.signer_id === right.signer_a.signer_id && left.signer_a.key_epoch === right.signer_a.key_epoch && left.signer_b.role === right.signer_b.role && left.signer_b.signer_id === right.signer_b.signer_id && left.signer_b.key_epoch === right.signer_b.key_epoch && sameRouterAbServerIdentityV1(left.selected_server, right.selected_server);
-}
-function parseRouterAbEcdsaDerivationPublicCapabilityV1(value) {
-	const label = "ecdsaPublicCapability";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"kind",
-		"context",
-		"public_identity",
-		"material_activation",
-		"signer_set",
-		"deriver_recipient_keys",
-		"router_id",
-		"client_id",
-		"activation_epoch",
-		"registration_request_digest_b64u",
-		"proof_transcript_digest_b64u"
-	]);
-	if (record.kind !== "router_ab_ecdsa_derivation_public_capability_v1") throw new Error(`${label}.kind is invalid`);
-	const signerSet = parsePostRegistrationSignerSet(record.signer_set, `${label}.signer_set`);
-	const recipientKeys = parseRegistrationRecipientKeys(record.deriver_recipient_keys, `${label}.deriver_recipient_keys`);
-	if (recipientKeys.deriver_a.key_epoch !== signerSet.signer_a.key_epoch || recipientKeys.deriver_b.key_epoch !== signerSet.signer_b.key_epoch) throw new Error(`${label} Deriver recipient key epochs do not match signer_set`);
-	return {
-		kind: "router_ab_ecdsa_derivation_public_capability_v1",
-		context: parseStableKeyContext(record.context),
-		public_identity: parsePublicIdentity(record.public_identity),
-		material_activation: parseRouterAbMpcMaterialActivationRef(record.material_activation),
-		signer_set: signerSet,
-		deriver_recipient_keys: recipientKeys,
-		router_id: requireAsciiNonEmptyString(record.router_id, `${label}.router_id`),
-		client_id: requireAsciiNonEmptyString(record.client_id, `${label}.client_id`),
-		activation_epoch: requireRootShareEpoch(record.activation_epoch, `${label}.activation_epoch`),
-		registration_request_digest_b64u: requireBase64UrlFixed(record.registration_request_digest_b64u, `${label}.registration_request_digest_b64u`, 32),
-		proof_transcript_digest_b64u: requireBase64UrlFixed(record.proof_transcript_digest_b64u, `${label}.proof_transcript_digest_b64u`, 32)
-	};
-}
-function parsePostRegistrationSessionPolicy(value) {
-	const label = "postRegistrationSessionActivation.session_policy";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"threshold_session_id",
-		"wallet_session_mint_id",
-		"ttl_ms",
-		"remaining_uses",
-		"runtime_policy_scope"
-	]);
-	return {
-		threshold_session_id: requireThresholdEcdsaSessionId(record.threshold_session_id, `${label}.threshold_session_id`),
-		wallet_session_mint_id: requireWalletSessionMintId(record.wallet_session_mint_id, `${label}.wallet_session_mint_id`),
-		ttl_ms: requirePositiveCounter(record.ttl_ms, `${label}.ttl_ms`),
-		remaining_uses: requirePositiveCounter(record.remaining_uses, `${label}.remaining_uses`),
-		runtime_policy_scope: normalizeRuntimePolicyScope(record.runtime_policy_scope)
-	};
-}
-function parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1(value) {
-	const label = "postRegistrationSessionActivationPolicy";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"kind",
-		"key_handle",
-		"session_policy"
-	]);
-	if (record.kind !== "router_ab_ecdsa_post_registration_session_activation_policy_v1") throw new Error(`${label}.kind is invalid`);
-	return {
-		kind: "router_ab_ecdsa_post_registration_session_activation_policy_v1",
-		key_handle: requireAsciiNonEmptyString(record.key_handle, `${label}.key_handle`),
-		session_policy: parsePostRegistrationSessionPolicy(record.session_policy)
-	};
-}
-function requireWalletSessionMintId(value, label) {
-	const parsed = parseWalletSessionMintId(value);
-	if (!parsed.ok) throw new Error(`${label} is invalid`);
-	return parsed.value;
-}
-function sameRouterAbEcdsaDerivationPublicIdentityV1(left, right) {
-	return left.context_binding_b64u === right.context_binding_b64u && left.derivation_client_share_public_key33_b64u === right.derivation_client_share_public_key33_b64u && left.server_public_key33_b64u === right.server_public_key33_b64u && left.threshold_public_key33_b64u === right.threshold_public_key33_b64u && left.ethereum_address20_b64u === right.ethereum_address20_b64u && left.client_share_retry_counter === right.client_share_retry_counter && left.server_share_retry_counter === right.server_share_retry_counter;
-}
-function activeWalletSessionMatchesEcdsaCapability(session, capability) {
-	for (const subject of session.capabilitySubjects) {
-		if (subject.kind !== "sign" || subject.keyFamily !== "ecdsa_secp256k1") continue;
-		return sameRouterAbMpcMaterialActivationRef(capability.material_activation, routerAbMpcMaterialActivationRefToWire(subject.materialActivation));
-	}
-	return false;
-}
-function parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1(value) {
-	const label = "postRegistrationSessionActivation";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"kind",
-		"public_capability",
-		"session_policy"
-	]);
-	if (record.kind !== "router_ab_ecdsa_post_registration_session_activation_v1") throw new Error(`${label}.kind is invalid`);
-	return {
-		kind: "router_ab_ecdsa_post_registration_session_activation_v1",
-		public_capability: parseRouterAbEcdsaDerivationPublicCapabilityV1(record.public_capability),
-		session_policy: parsePostRegistrationSessionPolicy(record.session_policy)
-	};
-}
-function parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1(value) {
-	const label = "postRegistrationSessionActivated";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"kind",
-		"public_capability",
-		"session",
-		"normal_signing"
-	]);
-	if (record.kind !== "router_ab_ecdsa_post_registration_session_activated_v1") throw new Error(`${label}.kind is invalid`);
-	const publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(record.public_capability);
-	const sessionRecord = requireRecord(record.session, `${label}.session`);
-	requireExactKeys(sessionRecord, `${label}.session`, [
-		"authorization_session_id",
-		"authorization_id",
-		"threshold_session_id",
-		"wallet_session_id",
-		"quota_id",
-		"expires_at_ms",
-		"remaining_uses",
-		"wallet_session",
-		"operation_credential"
-	]);
-	const normalSigning = requireRouterAbEcdsaDerivationNormalSigningStateV1(record.normal_signing);
-	const authorizationId = requireWalletSessionAuthorizationId(sessionRecord.authorization_id, `${label}.session.authorization_id`);
-	const walletSessionId = requireWalletSessionId(sessionRecord.wallet_session_id, `${label}.session.wallet_session_id`);
-	const expiresAtMs = requirePositiveUnixMs(sessionRecord.expires_at_ms, `${label}.session.expires_at_ms`);
-	const walletSession = parseActiveWalletSessionV1(sessionRecord.wallet_session);
-	const operationCredential = parseWalletSessionOperationCredentialV1(sessionRecord.operation_credential);
-	if (!sameRouterAbEcdsaDerivationPublicIdentityV1(publicCapability.public_identity, normalSigning.scope.public_identity) || publicCapability.context.application_binding_digest_b64u !== normalSigning.scope.context.application_binding_digest_b64u || normalSigning.scope.activation_epoch !== publicCapability.activation_epoch || !sameRouterAbServerIdentityV1(normalSigning.scope.signing_worker, publicCapability.signer_set.selected_server) || walletSession.authorizationId !== authorizationId || walletSession.walletId !== publicCapability.client_id || walletSession.expiresAtMs !== expiresAtMs || !activeWalletSessionMatchesEcdsaCapability(walletSession, publicCapability) || operationCredential.walletSessionId !== walletSessionId) throw new Error(`${label} exact Wallet Session does not match the activated capability`);
-	return {
-		kind: "router_ab_ecdsa_post_registration_session_activated_v1",
-		public_capability: publicCapability,
-		session: {
-			authorization_session_id: requireEcdsaAuthorizationSessionId(sessionRecord.authorization_session_id, `${label}.session.authorization_session_id`),
-			authorization_id: authorizationId,
-			threshold_session_id: requireThresholdEcdsaSessionId(sessionRecord.threshold_session_id, `${label}.session.threshold_session_id`),
-			wallet_session_id: walletSessionId,
-			quota_id: requireMpcWalletSigningQuotaId(sessionRecord.quota_id, `${label}.session.quota_id`),
-			expires_at_ms: expiresAtMs,
-			remaining_uses: requirePositiveCounter(sessionRecord.remaining_uses, `${label}.session.remaining_uses`),
-			wallet_session: walletSession,
-			operation_credential: operationCredential
-		},
-		normal_signing: normalSigning
-	};
-}
-function parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1(value) {
-	const label = "credentialFreeSessionActivated";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"kind",
-		"public_capability",
-		"session",
-		"normal_signing"
-	]);
-	if (record.kind !== "router_ab_ecdsa_credential_free_session_activated_v1") throw new Error(`${label}.kind is invalid`);
-	const publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(record.public_capability);
-	const sessionRecord = requireRecord(record.session, `${label}.session`);
-	requireExactKeys(sessionRecord, `${label}.session`, [
-		"authorization_session_id",
-		"authorization_id",
-		"threshold_session_id",
-		"wallet_session_id",
-		"quota_id",
-		"expires_at_ms",
-		"remaining_uses"
-	]);
-	const normalSigning = requireRouterAbEcdsaDerivationNormalSigningStateV1(record.normal_signing);
-	if (!sameRouterAbEcdsaDerivationPublicIdentityV1(publicCapability.public_identity, normalSigning.scope.public_identity) || publicCapability.context.application_binding_digest_b64u !== normalSigning.scope.context.application_binding_digest_b64u || normalSigning.scope.activation_epoch !== publicCapability.activation_epoch || !sameRouterAbServerIdentityV1(normalSigning.scope.signing_worker, publicCapability.signer_set.selected_server)) throw new Error(`${label} normal-signing state does not match public capability`);
-	return {
-		kind: "router_ab_ecdsa_credential_free_session_activated_v1",
-		public_capability: publicCapability,
-		session: {
-			authorization_session_id: requireEcdsaAuthorizationSessionId(sessionRecord.authorization_session_id, `${label}.session.authorization_session_id`),
-			authorization_id: requireWalletSessionAuthorizationId(sessionRecord.authorization_id, `${label}.session.authorization_id`),
-			threshold_session_id: requireThresholdEcdsaSessionId(sessionRecord.threshold_session_id, `${label}.session.threshold_session_id`),
-			wallet_session_id: requireWalletSessionId(sessionRecord.wallet_session_id, `${label}.session.wallet_session_id`),
-			quota_id: requireMpcWalletSigningQuotaId(sessionRecord.quota_id, `${label}.session.quota_id`),
-			expires_at_ms: requirePositiveUnixMs(sessionRecord.expires_at_ms, `${label}.session.expires_at_ms`),
-			remaining_uses: requirePositiveCounter(sessionRecord.remaining_uses, `${label}.session.remaining_uses`)
-		},
-		normal_signing: normalSigning
-	};
-}
-function publicDigest32FromBase64Url(value, label = "signing_digest_b64u") {
-	return { bytes: Array.from(base64UrlDecode(requireBase64UrlFixed(value, label, 32))) };
-}
-function samePublicDigest32(left, right) {
-	return left.bytes.length === 32 && right.bytes.length === 32 && left.bytes.every((b, i) => b === right.bytes[i]);
-}
-function sameRouterAbPublicDigest32V1Wire(left, right) {
-	return left.bytes.length === right.bytes.length && left.bytes.every((b, i) => b === right.bytes[i]);
-}
-function sameRegistrationRecipientKeys(left, right) {
-	return left.deriver_a.role === right.deriver_a.role && left.deriver_a.key_epoch === right.deriver_a.key_epoch && left.deriver_a.public_key === right.deriver_a.public_key && left.deriver_b.role === right.deriver_b.role && left.deriver_b.key_epoch === right.deriver_b.key_epoch && left.deriver_b.public_key === right.deriver_b.public_key;
-}
-function sameRouterAbEcdsaRegistrationActivationReceiptV1(left, right) {
-	const leftActivation = left.ecdsa_activation;
-	const rightActivation = right.ecdsa_activation;
-	return left.activation_correlation_id === right.activation_correlation_id && sameRouterAbPublicDigest32V1Wire(left.activation_request_digest, right.activation_request_digest) && left.server_generation === right.server_generation && left.lifecycle_id === right.lifecycle_id && sameRouterAbPublicDigest32V1Wire(left.transcript_digest, right.transcript_digest) && leftActivation.context.application_binding_digest_b64u === rightActivation.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(leftActivation.public_identity, rightActivation.public_identity) && sameRouterAbServerIdentityV1(leftActivation.signing_worker, rightActivation.signing_worker) && sameRouterAbMpcMaterialActivationRef(leftActivation.material_activation, rightActivation.material_activation) && leftActivation.activation_epoch === rightActivation.activation_epoch && leftActivation.activation_digest_b64u === rightActivation.activation_digest_b64u && leftActivation.activated_at_ms === rightActivation.activated_at_ms;
-}
-function sameRouterAbEcdsaDerivationNormalSigningStateV1(left, right) {
-	const leftScope = left.scope;
-	const rightScope = right.scope;
-	return left.kind === right.kind && leftScope.wallet_id === rightScope.wallet_id && leftScope.ecdsa_threshold_key_id === rightScope.ecdsa_threshold_key_id && leftScope.signing_root_id === rightScope.signing_root_id && leftScope.signing_root_version === rightScope.signing_root_version && leftScope.context.application_binding_digest_b64u === rightScope.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(leftScope.public_identity, rightScope.public_identity) && sameRouterAbMpcMaterialActivationRef(leftScope.material_activation, rightScope.material_activation) && sameRouterAbServerIdentityV1(leftScope.signing_worker, rightScope.signing_worker) && leftScope.activation_epoch === rightScope.activation_epoch;
-}
-function sameRouterAbEcdsaDerivationPublicCapabilityV1(left, right) {
-	return left.kind === right.kind && left.context.application_binding_digest_b64u === right.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(left.public_identity, right.public_identity) && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation) && sameRegistrationSignerSet(left.signer_set, right.signer_set) && sameRegistrationRecipientKeys(left.deriver_recipient_keys, right.deriver_recipient_keys) && left.router_id === right.router_id && left.client_id === right.client_id && left.activation_epoch === right.activation_epoch && left.registration_request_digest_b64u === right.registration_request_digest_b64u && left.proof_transcript_digest_b64u === right.proof_transcript_digest_b64u;
-}
-function asciiBytes(value) {
-	return new TextEncoder().encode(requireAsciiNonEmptyString(value, "canonical string"));
-}
-function concatBytes(parts) {
-	const length = parts.reduce((sum, part) => sum + part.length, 0);
-	const out = new Uint8Array(length);
-	let offset = 0;
-	for (const part of parts) {
-		out.set(part, offset);
-		offset += part.length;
-	}
-	return out;
-}
-function pushBytes(out, bytes) {
-	for (const byte of bytes) out.push(byte);
-}
-function pushOperationDigests(out, digests) {
-	pushBytes(out, base64UrlDecode(digests.lane_digest_b64u));
-	pushBytes(out, base64UrlDecode(digests.intent_digest_b64u));
-	pushBytes(out, base64UrlDecode(digests.display_digest_b64u));
-}
-function pushU16(out, value) {
-	if (!Number.isInteger(value) || value < 0 || value > 65535) throw new Error("canonical u16 must be an integer between 0 and 65535");
-	out.push(value >>> 8 & 255, value & 255);
-}
-function pushU32(out, value) {
-	if (!Number.isInteger(value) || value < 0 || value > 4294967295) throw new Error("canonical u32 must be an integer between 0 and 4294967295");
-	out.push(value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255);
-}
-function pushU64(out, value) {
-	if (!Number.isSafeInteger(value) || value < 0) throw new Error("canonical u64 must be a non-negative safe integer");
-	const remaining = BigInt(value);
-	for (let shift = 56; shift >= 0; shift -= 8) out.push(Number(remaining >> BigInt(shift) & 255n));
-}
-function pushLen32(out, bytes) {
-	pushU32(out, bytes.length);
-	pushBytes(out, bytes);
-}
-function pushAsciiU16(out, value) {
-	const bytes = asciiBytes(value);
-	pushU16(out, bytes.length);
-	pushBytes(out, bytes);
-}
-function pushServerIdentity(out, server) {
-	pushLen32(out, asciiBytes(server.server_id));
-	pushLen32(out, asciiBytes(server.key_epoch));
-	pushLen32(out, asciiBytes(server.recipient_encryption_key));
-}
-async function sha256Bytes(input) {
-	const subtle = globalThis.crypto?.subtle;
-	if (!subtle) throw new Error("crypto.subtle is required for Router A/B ECDSA derivation request digest binding");
-	const buffer = new ArrayBuffer(input.byteLength);
-	new Uint8Array(buffer).set(input);
-	return new Uint8Array(await subtle.digest("SHA-256", buffer));
-}
-async function routerAbEcdsaRerandomizationClientCommitmentV1(contribution32) {
-	const contribution = requireUint8ArrayFixed(contribution32, "clientRerandomizationContribution32", 32);
-	return await sha256Bytes(concatBytes([asciiBytes(ROUTER_AB_ECDSA_DERIVATION_CLIENT_RERANDOMIZATION_COMMITMENT_DOMAIN_V1), contribution]));
-}
-function canonicalStableKeyContextBytes(context) {
-	const parsed = parseStableKeyContext(context);
-	const out = [];
-	pushBytes(out, asciiBytes(ECDSA_DERIVATION_CONTEXT_DOMAIN_TAG_V1));
-	pushAsciiU16(out, ECDSA_DERIVATION_SCHEME_ID_V1);
-	pushAsciiU16(out, ECDSA_DERIVATION_CURVE_V1);
-	pushBytes(out, base64UrlDecode(parsed.application_binding_digest_b64u));
-	out.push(ECDSA_DERIVATION_PARTICIPANT_IDS_V1.length);
-	for (const participantId of ECDSA_DERIVATION_PARTICIPANT_IDS_V1) pushU16(out, participantId);
-	return new Uint8Array(out);
-}
-function contextBindingFrame(contextBytes) {
-	const out = [];
-	pushBytes(out, asciiBytes(ECDSA_DERIVATION_CONTEXT_BINDING_DOMAIN_V1));
-	out.push(1);
-	out.push(ECDSA_DERIVATION_CONTEXT_FIELD_BYTES_V1);
-	pushU16(out, contextBytes.length);
-	pushBytes(out, contextBytes);
-	return new Uint8Array(out);
-}
-async function routerAbEcdsaDerivationContextBindingDigestV1(context) {
-	return publicDigest32FromCanonicalBytes(contextBindingFrame(canonicalStableKeyContextBytes(context)));
-}
-function canonicalPublicIdentityBytes(publicIdentity) {
-	const parsed = parsePublicIdentity(publicIdentity);
-	const out = [];
-	pushLen32(out, asciiBytes(ROUTER_AB_ECDSA_DERIVATION_PUBLIC_IDENTITY_VERSION_V1));
-	pushLen32(out, asciiBytes(parsed.context_binding_b64u));
-	pushLen32(out, asciiBytes(parsed.derivation_client_share_public_key33_b64u));
-	pushLen32(out, asciiBytes(parsed.server_public_key33_b64u));
-	pushLen32(out, asciiBytes(parsed.threshold_public_key33_b64u));
-	pushLen32(out, asciiBytes(parsed.ethereum_address20_b64u));
-	pushU32(out, parsed.client_share_retry_counter);
-	pushU32(out, parsed.server_share_retry_counter);
-	return new Uint8Array(out);
-}
-function canonicalNormalSigningScopeBytes(scope) {
-	const parsed = parseRouterAbEcdsaDerivationNormalSigningScopeV1(scope);
-	const out = [];
-	pushLen32(out, asciiBytes(ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_SCOPE_VERSION_V1));
-	pushLen32(out, asciiBytes(parsed.wallet_id));
-	pushLen32(out, asciiBytes(parsed.ecdsa_threshold_key_id));
-	pushLen32(out, asciiBytes(parsed.signing_root_id));
-	pushLen32(out, asciiBytes(parsed.signing_root_version));
-	pushLen32(out, canonicalStableKeyContextBytes(parsed.context));
-	pushLen32(out, canonicalPublicIdentityBytes(parsed.public_identity));
-	out.push(...canonicalRouterAbMpcMaterialActivationRefBytes(parsed.material_activation));
-	pushServerIdentity(out, parsed.signing_worker);
-	pushLen32(out, asciiBytes(parsed.activation_epoch));
-	return new Uint8Array(out);
-}
-function routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1(scope) {
-	return canonicalNormalSigningScopeBytes(scope);
-}
-function sameCanonicalBytes(left, right) {
-	return left.length === right.length && left.every((byte, index) => byte === right[index]);
-}
-function sameRouterAbEcdsaDerivationNormalSigningScopeV1(left, right) {
-	try {
-		return sameCanonicalBytes(routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1(left), routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1(right));
-	} catch {
-		return false;
-	}
-}
-async function publicDigest32FromCanonicalBytes(bytes) {
-	return { bytes: Array.from(await sha256Bytes(bytes)) };
-}
-async function verifyRouterAbEcdsaDerivationNormalSigningScopeContextBindingV1(scope) {
-	const parsed = parseRouterAbEcdsaDerivationNormalSigningScopeV1(scope);
-	const expected = await routerAbEcdsaDerivationContextBindingDigestV1(parsed.context);
-	if (!samePublicDigest32(publicDigest32FromBase64Url(parsed.public_identity.context_binding_b64u, "scope.public_identity.context_binding_b64u"), expected)) throw new Error("scope.public_identity.context_binding_b64u does not match scope.context");
-	return parsed;
-}
-function routerAbEcdsaDerivationEvmDigestSigningRequestCanonicalBytesV1(request) {
-	const parsed = parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(request);
-	const out = [];
-	pushLen32(out, asciiBytes(ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_REQUEST_VERSION_V1));
-	pushLen32(out, canonicalNormalSigningScopeBytes(parsed.scope));
-	pushLen32(out, asciiBytes(parsed.request_id));
-	pushLen32(out, asciiBytes(parsed.operation_id));
-	pushOperationDigests(out, parsed.operation_digests);
-	out.push(...canonicalRouterAbNormalSigningAuthorizationBytes(parsed.authorization));
-	out.push(...canonicalRouterAbMpcMaterialActivationRefBytes(parsed.material_activation));
-	pushLen32(out, asciiBytes(parsed.client_presignature_id));
-	pushU64(out, parsed.expires_at_ms);
-	pushBytes(out, base64UrlDecode(parsed.signing_digest_b64u));
-	pushLen32(out, base64UrlDecode(parsed.client_rerandomization_commitment32_b64u));
-	return new Uint8Array(out);
-}
-async function routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1(request) {
-	const parsed = parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(request);
-	await verifyRouterAbEcdsaDerivationNormalSigningScopeContextBindingV1(parsed.scope);
-	return publicDigest32FromCanonicalBytes(routerAbEcdsaDerivationEvmDigestSigningRequestCanonicalBytesV1(parsed));
-}
-function routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestCanonicalBytesV1(request) {
-	const parsed = parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1(request);
-	const out = [];
-	pushLen32(out, asciiBytes(ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_FINALIZE_REQUEST_VERSION_V1));
-	pushLen32(out, canonicalNormalSigningScopeBytes(parsed.scope));
-	pushLen32(out, asciiBytes(parsed.request_id));
-	pushLen32(out, asciiBytes(parsed.operation_id));
-	pushOperationDigests(out, parsed.operation_digests);
-	out.push(...canonicalRouterAbNormalSigningAuthorizationBytes(parsed.authorization));
-	out.push(...canonicalRouterAbMpcMaterialActivationRefBytes(parsed.material_activation));
-	pushU64(out, parsed.expires_at_ms);
-	pushBytes(out, base64UrlDecode(parsed.signing_digest_b64u));
-	pushLen32(out, asciiBytes(parsed.server_presignature_id));
-	pushLen32(out, base64UrlDecode(parsed.client_signature_share32_b64u));
-	pushLen32(out, base64UrlDecode(parsed.client_rerandomization_contribution32_b64u));
-	return new Uint8Array(out);
-}
-async function routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1(request) {
-	const parsed = parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1(request);
-	await verifyRouterAbEcdsaDerivationNormalSigningScopeContextBindingV1(parsed.scope);
-	return publicDigest32FromCanonicalBytes(routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestCanonicalBytesV1(parsed));
-}
-function parseRouterAbEcdsaDerivationNormalSigningScopeV1(value) {
-	const record = requireRecord(value, "scope");
-	requireExactKeys(record, "scope", [
-		"wallet_id",
-		"ecdsa_threshold_key_id",
-		"signing_root_id",
-		"signing_root_version",
-		"context",
-		"public_identity",
-		"material_activation",
-		"signing_worker",
-		"activation_epoch"
-	]);
-	return {
-		wallet_id: requireAsciiNonEmptyString(record.wallet_id, "scope.wallet_id"),
-		ecdsa_threshold_key_id: requireAsciiNonEmptyString(record.ecdsa_threshold_key_id, "scope.ecdsa_threshold_key_id"),
-		signing_root_id: requireAsciiNonEmptyString(record.signing_root_id, "scope.signing_root_id"),
-		signing_root_version: requireAsciiNonEmptyString(record.signing_root_version, "scope.signing_root_version"),
-		context: parseStableKeyContext(record.context),
-		public_identity: parsePublicIdentity(record.public_identity),
-		material_activation: parseRouterAbMpcMaterialActivationRef(record.material_activation),
-		signing_worker: parseServerIdentity(record.signing_worker),
-		activation_epoch: requireRootShareEpoch(record.activation_epoch, "scope.activation_epoch")
-	};
-}
-function parseRouterAbEcdsaDerivationNormalSigningStateV1(value) {
-	if (value === void 0 || value === null) return null;
-	const record = requireRecord(value, "routerAbEcdsaDerivationNormalSigning");
-	requireExactKeys(record, "routerAbEcdsaDerivationNormalSigning", ["kind", "scope"]);
-	if (requireAsciiNonEmptyString(record.kind, "routerAbEcdsaDerivationNormalSigning.kind") !== "router_ab_ecdsa_derivation_normal_signing_v1") throw new Error("routerAbEcdsaDerivationNormalSigning.kind is not supported");
-	return {
-		kind: ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1,
-		scope: parseRouterAbEcdsaDerivationNormalSigningScopeV1(record.scope)
-	};
-}
-function requireRouterAbEcdsaDerivationNormalSigningStateV1(value) {
-	const parsed = parseRouterAbEcdsaDerivationNormalSigningStateV1(value);
-	if (!parsed) throw new Error("Router A/B ECDSA derivation normal-signing state is required");
-	return parsed;
-}
-function buildRouterAbEcdsaDerivationActiveStateIdV1(input) {
-	const parsed = parseEcdsaActiveStateId([
-		requireAsciiNonEmptyString(input.ecdsaThresholdKeyId, "ecdsaThresholdKeyId"),
-		requireAsciiNonEmptyString(input.signingRootId, "signingRootId"),
-		requireAsciiNonEmptyString(input.signingRootVersion, "signingRootVersion"),
-		requireRootShareEpoch(input.activationEpoch, "activationEpoch")
-	].join(":"));
-	if (!parsed.ok) throw new Error(`activeStateId ${parsed.error.message}`);
-	return parsed.value;
-}
-function routerAbEcdsaDerivationActiveStateId(state) {
-	return buildRouterAbEcdsaDerivationActiveStateIdV1({
-		ecdsaThresholdKeyId: state.scope.ecdsa_threshold_key_id,
-		signingRootId: state.scope.signing_root_id,
-		signingRootVersion: state.scope.signing_root_version,
-		activationEpoch: state.scope.activation_epoch
-	});
-}
-function parseRouterAbEcdsaDerivationOperationDigestsV1(value, label) {
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"lane_digest_b64u",
-		"intent_digest_b64u",
-		"display_digest_b64u"
-	]);
-	return {
-		lane_digest_b64u: requireBase64UrlFixed(record.lane_digest_b64u, `${label}.lane_digest_b64u`, 32),
-		intent_digest_b64u: requireBase64UrlFixed(record.intent_digest_b64u, `${label}.intent_digest_b64u`, 32),
-		display_digest_b64u: requireBase64UrlFixed(record.display_digest_b64u, `${label}.display_digest_b64u`, 32)
-	};
-}
-function buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input) {
-	return parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1({
-		scope: input.scope,
-		request_id: input.requestId,
-		operation_id: input.operationId,
-		operation_digests: input.operationDigests,
-		authorization: input.authorization,
-		material_activation: input.materialActivation,
-		client_presignature_id: input.clientPresignatureId,
-		expires_at_ms: input.expiresAtMs,
-		signing_digest_b64u: base64UrlEncode(requireUint8ArrayFixed(input.signingDigest32, "signingDigest32", 32)),
-		client_rerandomization_commitment32_b64u: base64UrlEncode(requireUint8ArrayFixed(input.clientRerandomizationCommitment32, "clientRerandomizationCommitment32", 32))
-	});
-}
-function parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(value) {
-	const record = requireRecord(value, "ecdsaSigningRequest");
-	requireExactKeys(record, "ecdsaSigningRequest", [
-		"scope",
-		"request_id",
-		"operation_id",
-		"operation_digests",
-		"authorization",
-		"material_activation",
-		"client_presignature_id",
-		"expires_at_ms",
-		"signing_digest_b64u",
-		"client_rerandomization_commitment32_b64u"
-	]);
-	const parsed = {
-		scope: parseRouterAbEcdsaDerivationNormalSigningScopeV1(record.scope),
-		request_id: requireAsciiNonEmptyString(record.request_id, "ecdsaSigningRequest.request_id"),
-		operation_id: requireAsciiNonEmptyString(record.operation_id, "ecdsaSigningRequest.operation_id"),
-		operation_digests: parseRouterAbEcdsaDerivationOperationDigestsV1(record.operation_digests, "ecdsaSigningRequest.operation_digests"),
-		authorization: parseRouterAbNormalSigningAuthorization(record.authorization),
-		material_activation: parseRouterAbMpcMaterialActivationRef(record.material_activation),
-		client_presignature_id: requireAsciiNonEmptyString(record.client_presignature_id, "ecdsaSigningRequest.client_presignature_id"),
-		expires_at_ms: requirePositiveUnixMs(record.expires_at_ms, "ecdsaSigningRequest.expires_at_ms"),
-		signing_digest_b64u: requireBase64UrlFixed(record.signing_digest_b64u, "ecdsaSigningRequest.signing_digest_b64u", 32),
-		client_rerandomization_commitment32_b64u: requireBase64UrlFixed(record.client_rerandomization_commitment32_b64u, "ecdsaSigningRequest.client_rerandomization_commitment32_b64u", 32)
-	};
-	if (parsed.operation_digests.intent_digest_b64u !== parsed.signing_digest_b64u) throw new Error("ecdsaSigningRequest intent digest must equal the admitted signing digest");
-	return parsed;
-}
-function parseRouterAbEcdsaOperationStepUpWebAuthnCredentialV1(value) {
-	const credential = requireRecord(value, "webauthn_authentication");
-	requireExactKeys(credential, "webauthn_authentication", [
-		"id",
-		"rawId",
-		"type",
-		"authenticatorAttachment",
-		"response",
-		"clientExtensionResults"
-	]);
-	const response = requireRecord(credential.response, "webauthn_authentication.response");
-	requireExactKeys(response, "webauthn_authentication.response", [
-		"clientDataJSON",
-		"authenticatorData",
-		"signature",
-		"userHandle"
-	]);
-	const authenticatorAttachment = credential.authenticatorAttachment === null ? null : requireAsciiNonEmptyString(credential.authenticatorAttachment, "webauthn_authentication.authenticatorAttachment");
-	const userHandle = response.userHandle === null ? null : requireAsciiNonEmptyString(response.userHandle, "webauthn_authentication.response.userHandle");
-	return {
-		id: requireAsciiNonEmptyString(credential.id, "webauthn_authentication.id"),
-		rawId: requireAsciiNonEmptyString(credential.rawId, "webauthn_authentication.rawId"),
-		type: requireAsciiNonEmptyString(credential.type, "webauthn_authentication.type"),
-		authenticatorAttachment,
-		response: {
-			clientDataJSON: requireAsciiNonEmptyString(response.clientDataJSON, "webauthn_authentication.response.clientDataJSON"),
-			authenticatorData: requireAsciiNonEmptyString(response.authenticatorData, "webauthn_authentication.response.authenticatorData"),
-			signature: requireAsciiNonEmptyString(response.signature, "webauthn_authentication.response.signature"),
-			userHandle
-		},
-		clientExtensionResults: credential.clientExtensionResults
-	};
-}
-function parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1(value) {
-	const request = requireRecord(value, "operationStepUpAuthorizationRequest");
-	requireExactKeys(request, "operationStepUpAuthorizationRequest", [
-		"kind",
-		"operation",
-		"proof"
-	]);
-	if (request.kind !== "router_ab_ecdsa_operation_step_up_v1") throw new Error("operationStepUpAuthorizationRequest.kind must be router_ab_ecdsa_operation_step_up_v1");
-	const operation = parseRouterAbEcdsaOperationStepUpPreparationV1(request.operation);
-	const proof = requireRecord(request.proof, "operationStepUpAuthorizationRequest.proof");
-	const authority = parseWalletAuthAuthority(proof.authority);
-	let parsedProof;
-	switch (proof.kind) {
-		case "passkey":
-			requireExactKeys(proof, "operationStepUpAuthorizationRequest.proof", [
-				"kind",
-				"authority",
-				"webauthn_authentication"
-			]);
-			if (!authority || !isPasskeyWalletAuthAuthority(authority)) throw new Error("operationStepUpAuthorizationRequest.proof requires an exact passkey authority");
-			parsedProof = {
-				kind: "passkey",
-				authority,
-				webauthn_authentication: parseRouterAbEcdsaOperationStepUpWebAuthnCredentialV1(proof.webauthn_authentication)
-			};
-			break;
-		case "email_otp":
-			requireExactKeys(proof, "operationStepUpAuthorizationRequest.proof", [
-				"kind",
-				"authority",
-				"challenge_id",
-				"otp_code"
-			]);
-			if (!authority || !isEmailOtpWalletAuthAuthority(authority)) throw new Error("operationStepUpAuthorizationRequest.proof requires an exact Email OTP authority");
-			parsedProof = {
-				kind: "email_otp",
-				authority,
-				challenge_id: requireAsciiNonEmptyString(proof.challenge_id, "operationStepUpAuthorizationRequest.proof.challenge_id"),
-				otp_code: requireAsciiNonEmptyString(proof.otp_code, "operationStepUpAuthorizationRequest.proof.otp_code")
-			};
-			break;
-		default: throw new Error("operationStepUpAuthorizationRequest.proof.kind is invalid");
-	}
-	return {
-		kind: "router_ab_ecdsa_operation_step_up_v1",
-		operation,
-		proof: parsedProof
-	};
-}
-function parseRouterAbEcdsaOperationStepUpPreparationV1(value) {
-	const operation = requireRecord(value, "ecdsaOperationStepUpPreparation");
-	requireExactKeys(operation, "operationStepUpGrantRequest.operation", [
-		"wallet_id",
-		"operation_kind",
-		"operation_id",
-		"operation_digests",
-		"material_activation",
-		"normal_signing_scope",
-		"signing_worker_id",
-		"key_handle",
-		"relayer_key_id",
-		"participant_ids",
-		"expires_at_ms"
-	]);
-	if (!Array.isArray(operation.participant_ids) || operation.participant_ids.length !== 2 || !operation.participant_ids.every((participantId) => Number.isSafeInteger(participantId) && participantId > 0)) throw new Error("operationStepUpGrantRequest.operation.participant_ids must contain two positive integers");
-	return {
-		wallet_id: requireAsciiNonEmptyString(operation.wallet_id, "operationStepUpGrantRequest.operation.wallet_id"),
-		operation_kind: requireEcdsaOperationStepUpKind(operation.operation_kind),
-		operation_id: requireAsciiNonEmptyString(operation.operation_id, "operationStepUpGrantRequest.operation.operation_id"),
-		operation_digests: parseRouterAbEcdsaDerivationOperationDigestsV1(operation.operation_digests, "operationStepUpGrantRequest.operation.operation_digests"),
-		material_activation: parseRouterAbMpcMaterialActivationRef(operation.material_activation),
-		normal_signing_scope: parseRouterAbEcdsaDerivationNormalSigningScopeV1(operation.normal_signing_scope),
-		signing_worker_id: requireAsciiNonEmptyString(operation.signing_worker_id, "operationStepUpGrantRequest.operation.signing_worker_id"),
-		key_handle: requireAsciiNonEmptyString(operation.key_handle, "operationStepUpGrantRequest.operation.key_handle"),
-		relayer_key_id: requireAsciiNonEmptyString(operation.relayer_key_id, "operationStepUpGrantRequest.operation.relayer_key_id"),
-		participant_ids: [Number(operation.participant_ids[0]), Number(operation.participant_ids[1])],
-		expires_at_ms: requirePositiveUnixMs(operation.expires_at_ms, "operationStepUpGrantRequest.operation.expires_at_ms")
-	};
-}
-function requireEcdsaOperationStepUpKind(value) {
-	switch (value) {
-		case EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction:
-		case EVM_ECDSA_MPC_OPERATION_KINDS.exportKey: return value;
-		default: throw new Error("operationStepUpGrantRequest.operation.operation_kind must be evm.sign_transaction or evm.export_key");
-	}
-}
-function buildRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input) {
-	return parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1({
-		scope: input.scope,
-		request_id: input.requestId,
-		operation_id: input.operationId,
-		operation_digests: input.operationDigests,
-		authorization: input.authorization,
-		material_activation: input.materialActivation,
-		expires_at_ms: input.expiresAtMs,
-		signing_digest_b64u: base64UrlEncode(requireUint8ArrayFixed(input.signingDigest32, "signingDigest32", 32)),
-		server_presignature_id: input.serverPresignatureId,
-		client_signature_share32_b64u: base64UrlEncode(requireUint8ArrayFixed(input.clientSignatureShare32, "clientSignatureShare32", 32)),
-		client_rerandomization_contribution32_b64u: base64UrlEncode(requireUint8ArrayFixed(input.clientRerandomizationContribution32, "clientRerandomizationContribution32", 32))
-	});
-}
-function parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1(value) {
-	const record = requireRecord(value, "ecdsaFinalizeCoreRequest");
-	requireExactKeys(record, "ecdsaFinalizeCoreRequest", [
-		"scope",
-		"request_id",
-		"operation_id",
-		"operation_digests",
-		"authorization",
-		"material_activation",
-		"expires_at_ms",
-		"signing_digest_b64u",
-		"server_presignature_id",
-		"client_signature_share32_b64u",
-		"client_rerandomization_contribution32_b64u"
-	]);
-	return parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestFields(record);
-}
-function parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestFields(record) {
-	const parsed = {
-		scope: parseRouterAbEcdsaDerivationNormalSigningScopeV1(record.scope),
-		request_id: requireAsciiNonEmptyString(record.request_id, "ecdsaFinalizeRequest.request_id"),
-		operation_id: requireAsciiNonEmptyString(record.operation_id, "ecdsaFinalizeRequest.operation_id"),
-		operation_digests: parseRouterAbEcdsaDerivationOperationDigestsV1(record.operation_digests, "ecdsaFinalizeRequest.operation_digests"),
-		authorization: parseRouterAbNormalSigningAuthorization(record.authorization),
-		material_activation: parseRouterAbMpcMaterialActivationRef(record.material_activation),
-		expires_at_ms: requirePositiveUnixMs(record.expires_at_ms, "ecdsaFinalizeRequest.expires_at_ms"),
-		signing_digest_b64u: requireBase64UrlFixed(record.signing_digest_b64u, "ecdsaFinalizeRequest.signing_digest_b64u", 32),
-		server_presignature_id: requireAsciiNonEmptyString(record.server_presignature_id, "ecdsaFinalizeRequest.server_presignature_id"),
-		client_signature_share32_b64u: requireBase64UrlFixed(record.client_signature_share32_b64u, "ecdsaFinalizeRequest.client_signature_share32_b64u", 32),
-		client_rerandomization_contribution32_b64u: requireBase64UrlFixed(record.client_rerandomization_contribution32_b64u, "ecdsaFinalizeRequest.client_rerandomization_contribution32_b64u", 32)
-	};
-	if (parsed.operation_digests.intent_digest_b64u !== parsed.signing_digest_b64u) throw new Error("ecdsaFinalizeRequest intent digest must equal the admitted signing digest");
-	return parsed;
-}
-function parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseV1(value) {
-	const record = requireRecord(value, "ecdsaPrepareResponse");
-	requireExactKeys(record, "ecdsaPrepareResponse", [
-		"scope",
-		"request_id",
-		"request_digest",
-		"signing_digest",
-		"server_presignature_id",
-		"server_big_r33_b64u",
-		"signing_worker_rerandomization_contribution32_b64u",
-		"signature_scheme",
-		"prepared_at_ms",
-		"expires_at_ms"
-	]);
-	return {
-		scope: parseRouterAbEcdsaDerivationNormalSigningScopeV1(record.scope),
-		request_id: requireAsciiNonEmptyString(record.request_id, "ecdsaPrepareResponse.request_id"),
-		request_digest: parsePublicDigest32(record.request_digest, "ecdsaPrepareResponse.request_digest"),
-		signing_digest: parsePublicDigest32(record.signing_digest, "ecdsaPrepareResponse.signing_digest"),
-		server_presignature_id: requireAsciiNonEmptyString(record.server_presignature_id, "ecdsaPrepareResponse.server_presignature_id"),
-		server_big_r33_b64u: requireBase64UrlFixed(record.server_big_r33_b64u, "ecdsaPrepareResponse.server_big_r33_b64u", 33),
-		signing_worker_rerandomization_contribution32_b64u: requireBase64UrlFixed(record.signing_worker_rerandomization_contribution32_b64u, "ecdsaPrepareResponse.signing_worker_rerandomization_contribution32_b64u", 32),
-		signature_scheme: requireSignatureScheme(record.signature_scheme, "ecdsaPrepareResponse.signature_scheme"),
-		prepared_at_ms: requirePositiveUnixMs(record.prepared_at_ms, "ecdsaPrepareResponse.prepared_at_ms"),
-		expires_at_ms: requirePositiveUnixMs(record.expires_at_ms, "ecdsaPrepareResponse.expires_at_ms")
-	};
-}
-async function parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1(request, value) {
-	const parsedRequest = parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(request);
-	const response = parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseV1(value);
-	if (!sameRouterAbEcdsaDerivationNormalSigningScopeV1(response.scope, parsedRequest.scope)) throw new Error("ecdsaPrepareResponse.scope does not match request");
-	if (response.request_id !== parsedRequest.request_id) throw new Error("ecdsaPrepareResponse.request_id does not match request");
-	if (response.server_presignature_id !== parsedRequest.client_presignature_id) throw new Error("ecdsaPrepareResponse.server_presignature_id does not match request");
-	if (!samePublicDigest32(response.signing_digest, publicDigest32FromBase64Url(parsedRequest.signing_digest_b64u))) throw new Error("ecdsaPrepareResponse.signing_digest does not match request");
-	if (response.expires_at_ms !== parsedRequest.expires_at_ms) throw new Error("ecdsaPrepareResponse.expires_at_ms does not match request");
-	if (!samePublicDigest32(response.request_digest, await routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1(parsedRequest))) throw new Error("ecdsaPrepareResponse.request_digest does not match request");
-	return response;
-}
-function parseRouterAbEcdsaDerivationEvmDigestSigningResponseV1(value) {
-	const record = requireRecord(value, "ecdsaSigningResponse");
-	requireExactKeys(record, "ecdsaSigningResponse", [
-		"scope",
-		"request_id",
-		"request_digest",
-		"signing_digest",
-		"signature_scheme",
-		"signature65_b64u"
-	]);
-	return {
-		scope: parseRouterAbEcdsaDerivationNormalSigningScopeV1(record.scope),
-		request_id: requireAsciiNonEmptyString(record.request_id, "ecdsaSigningResponse.request_id"),
-		request_digest: parsePublicDigest32(record.request_digest, "ecdsaSigningResponse.request_digest"),
-		signing_digest: parsePublicDigest32(record.signing_digest, "ecdsaSigningResponse.signing_digest"),
-		signature_scheme: requireSignatureScheme(record.signature_scheme, "ecdsaSigningResponse.signature_scheme"),
-		signature65_b64u: requireBase64UrlFixed(record.signature65_b64u, "ecdsaSigningResponse.signature65_b64u", 65)
-	};
-}
-async function parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreRequestV1(request, value) {
-	const parsedRequest = parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1(request);
-	const response = parseRouterAbEcdsaDerivationEvmDigestSigningResponseV1(value);
-	if (!sameRouterAbEcdsaDerivationNormalSigningScopeV1(response.scope, parsedRequest.scope)) throw new Error("ecdsaSigningResponse.scope does not match request");
-	if (response.request_id !== parsedRequest.request_id) throw new Error("ecdsaSigningResponse.request_id does not match request");
-	if (!samePublicDigest32(response.signing_digest, publicDigest32FromBase64Url(parsedRequest.signing_digest_b64u))) throw new Error("ecdsaSigningResponse.signing_digest does not match request");
-	if (!samePublicDigest32(response.request_digest, await routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1(parsedRequest))) throw new Error("ecdsaSigningResponse.request_digest does not match request");
-	return response;
-}
-//#endregion
-export { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreRequestV1, parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaExplicitExportForwardedResponseV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaOperationStepUpAuthorizationResponseV1, parseRouterAbEcdsaOperationStepUpPreparationV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaRegistrationPublicActivationReceiptV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaSigningWorkerExportShareEnvelopeV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1, requireRouterAbEcdsaDerivationNormalSigningStateV1, routerAbEcdsaDerivationActiveStateId, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1, routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1, routerAbEcdsaRerandomizationClientCommitmentV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire, sameRouterAbServerIdentityV1 };
-
-//# sourceMappingURL=routerAbEcdsaDerivation.js.map