@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/SeamsWeb/operations/registration/pendingEcdsaRegistrationRecoveryUnlock.js

@@ -1,247 +0,0 @@
-import { parseThresholdEcdsaSessionId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletSessionMintId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { joinNormalizedUrl } from "../../../shared-ts/src/utils/normalize.js";
-import { requireNonEmptyString, requireRecord } from "../../../shared-ts/src/utils/validation.js";
-import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
-import { WalletSessionStatusReadScope } from "../../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
-import { SIGNING_SESSION_SEAL_GROUP_ID } from "../../../shared-ts/src/utils/signingSessionSeal.js";
-import { WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../shared-ts/src/utils/emailOtpDomain.js";
-import { thresholdEcdsaChainTargetKey, toWalletId } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
-import { DEFAULT_THRESHOLD_SESSION_POLICY } from "../../../core/signingEngine/threshold/sessionPolicy.js";
-import { joinCustodyJsonFromEstablishedCommitPayload } from "../../../core/signingEngine/walletCustody/registrationCeremony.js";
-import { parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { buildFreshEmailOtpRoutePlan } from "../../../core/signingEngine/session/emailOtp/routePlan.js";
-import { unlockEmailOtpWallet } from "../../../core/signingEngine/session/emailOtp/walletUnlock.js";
-import { generateSessionId } from "../../../core/signingEngine/session/passkey/prfCache.js";
-import { requireEcdsaProjection } from "./pendingEcdsaRegistrationRecoveryValidation.js";
-import { verifyPasskeyWalletUnlock } from "../../../core/rpcClients/near/rpcCalls.js";
-import { passkeyCredentialIdB64uFromAuthentication, requirePasskeyPrfFirstB64u } from "../authMethods/passkey/ecdsaBootstrap.js";
-//#region src/SeamsWeb/operations/registration/pendingEcdsaRegistrationRecoveryUnlock.ts
-function requireParsedThresholdSessionId(value) {
-	const parsed = parseThresholdEcdsaSessionId(value);
-	if (!parsed.ok) throw new Error("ECDSA registration recovery could not create a session id");
-	return parsed.value;
-}
-function requireParsedWalletSessionMintId(value) {
-	const parsed = parseWalletSessionMintId(value);
-	if (!parsed.ok) throw new Error("ECDSA registration recovery could not create a Wallet Session mint id");
-	return parsed.value;
-}
-function buildEcdsaUnlockPolicy(args) {
-	return parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1({
-		kind: "router_ab_ecdsa_post_registration_session_activation_policy_v1",
-		key_handle: args.keyHandle,
-		session_policy: {
-			threshold_session_id: requireParsedThresholdSessionId(generateSessionId("threshold-ecdsa-registration-recovery")),
-			wallet_session_mint_id: requireParsedWalletSessionMintId(generateSessionId("wallet-session-mint")),
-			ttl_ms: DEFAULT_THRESHOLD_SESSION_POLICY.ttlMs,
-			remaining_uses: DEFAULT_THRESHOLD_SESSION_POLICY.remainingUses,
-			runtime_policy_scope: args.runtimePolicyScope
-		}
-	});
-}
-async function requestPasskeyUnlockChallenge(args) {
-	const response = await fetch(joinNormalizedUrl(args.relayerUrl, "/wallet/unlock/challenge"), {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({
-			unlockBackend: "passkey",
-			userId: args.walletId,
-			rpId: args.rpId
-		})
-	});
-	const body = requireRecord(await response.json().catch(() => ({})), "Passkey unlock challenge response");
-	if (!response.ok || body.ok !== true) throw new Error(typeof body.message === "string" && body.message ? body.message : `wallet/unlock/challenge failed (HTTP ${response.status})`);
-	return {
-		challengeId: requireNonEmptyString(body.challengeId, "Passkey unlock challenge ID"),
-		challengeB64u: requireNonEmptyString(body.challengeB64u, "Passkey unlock challenge")
-	};
-}
-function isAuthenticatorTransport(value) {
-	return value === "ble" || value === "hybrid" || value === "internal" || value === "nfc" || value === "usb";
-}
-function exactPasskeyAllowCredential(credentialIdB64u, transports) {
-	return {
-		id: credentialIdB64u,
-		type: "public-key",
-		transports: transports.filter(isAuthenticatorTransport)
-	};
-}
-function assertIssuedEcdsaSessionMatchesRegistration(args) {
-	const walletSession = args.session.session.wallet_session;
-	if (walletSession.walletId !== args.pending.walletId || walletSession.authMethodId !== args.pending.walletAuthMethodId || walletSession.authorityId !== args.response.foundingAuthority.authorityId || walletSession.expiresAtMs !== args.session.session.expires_at_ms || walletSession.authorizationId !== args.session.session.authorization_id || walletSession.quotaId !== args.session.session.quota_id || args.session.session.remaining_uses <= 0 || args.session.session.expires_at_ms <= Date.now() || args.session.session.wallet_session_id !== args.session.session.operation_credential.walletSessionId || !sameRouterAbEcdsaDerivationPublicCapabilityV1(args.session.public_capability, args.walletKey.publicCapability)) throw new Error("ECDSA registration unlock did not issue the exact Wallet Session");
-}
-function assertCustodyContinuityMatchesRegistration(args) {
-	if (args.signers.length !== args.walletKeys.length) throw new Error("ECDSA registration unlock returned incomplete custody continuity");
-	const remainingTargets = /* @__PURE__ */ new Map();
-	for (const walletKey of args.walletKeys) {
-		const target = thresholdEcdsaChainTargetKey(walletKey.chainTarget);
-		if (remainingTargets.has(target)) throw new Error("ECDSA registration has duplicate custody targets");
-		remainingTargets.set(target, walletKey);
-	}
-	for (const signer of args.signers) {
-		const target = thresholdEcdsaChainTargetKey(signer.chainTarget);
-		const walletKey = remainingTargets.get(target);
-		if (!walletKey) throw new Error("ECDSA registration unlock returned an unknown target");
-		remainingTargets.delete(target);
-		if (signer.walletKey.walletId !== args.pending.walletId || signer.walletKey.keyHandle !== walletKey.keyHandle || signer.walletKey.ecdsaThresholdKeyId !== walletKey.ecdsaThresholdKeyId || signer.walletKey.signingRootId !== walletKey.signingRootId || signer.walletKey.signingRootVersion !== walletKey.signingRootVersion || signer.walletKey.relayerKeyId !== walletKey.relayerKeyId || signer.walletKey.contextBinding32B64u !== walletKey.contextBinding32B64u || signer.walletKey.derivationClientSharePublicKey33B64u !== walletKey.derivationClientSharePublicKey33B64u || !sameRouterAbEcdsaDerivationPublicCapabilityV1(signer.walletKey.publicCapability, walletKey.publicCapability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(signer.activationReceipt, args.response.ecdsa.activation)) throw new Error("ECDSA registration unlock returned different custody continuity");
-	}
-}
-function zeroizeArrayBuffer(buffer) {
-	new Uint8Array(buffer).fill(0);
-}
-async function unlockWithPasskey(args) {
-	if (args.pending.auth.kind !== "passkey") throw new Error("ECDSA registration passkey unlock has a different pending factor");
-	const primaryKey = args.walletKeys[0];
-	if (!primaryKey) throw new Error("ECDSA registration unlock has no primary wallet key");
-	const expectedOrigin = args.exactMethod.expectedOrigin.trim();
-	if (!expectedOrigin) throw new Error("ECDSA registration passkey unlock requires an origin");
-	const challenge = await requestPasskeyUnlockChallenge({
-		relayerUrl: args.relayerUrl,
-		walletId: String(args.pending.walletId),
-		rpId: args.pending.auth.rpId
-	});
-	const credential = await args.signingSurface.getAuthenticationCredentialsSerialized({
-		subjectId: String(args.pending.walletId),
-		challengeB64u: challenge.challengeB64u,
-		allowCredentials: [exactPasskeyAllowCredential(args.pending.auth.credentialIdB64u, args.pending.auth.transports)],
-		includeSecondPrfOutput: true
-	});
-	if (passkeyCredentialIdB64uFromAuthentication(credential) !== args.pending.auth.credentialIdB64u) throw new Error("ECDSA registration unlock returned a different Passkey credential");
-	const prfFirstB64u = requirePasskeyPrfFirstB64u(credential, "ECDSA registration recovery");
-	const verified = await verifyPasskeyWalletUnlock(args.relayerUrl, {
-		type: "passkey_assertion",
-		challengeId: challenge.challengeId,
-		walletId: String(args.pending.walletId),
-		webauthn_authentication: credential,
-		ed25519SessionRequest: { kind: "not_requested" },
-		expected_origin: expectedOrigin,
-		ecdsaSessionPolicy: buildEcdsaUnlockPolicy({
-			keyHandle: primaryKey.keyHandle,
-			runtimePolicyScope: requireEcdsaProjection(args.response).ecdsa.runtimePolicyScope
-		})
-	}, new WalletSessionStatusReadScope());
-	if (!verified.success) throw new Error(verified.error || "Passkey ECDSA registration unlock failed");
-	if (verified.ecdsaSession.kind !== "router_ab_ecdsa_post_registration_session_activated_v1" || !verified.ecdsaCustody || !verified.walletCustody) throw new Error("Passkey ECDSA registration unlock did not issue exact session custody");
-	assertIssuedEcdsaSessionMatchesRegistration({
-		pending: args.pending,
-		response: args.response,
-		session: verified.ecdsaSession,
-		walletKey: primaryKey
-	});
-	assertCustodyContinuityMatchesRegistration({
-		pending: args.pending,
-		response: args.response,
-		walletKeys: args.walletKeys,
-		signers: verified.ecdsaCustody.signers
-	});
-	const factorSecret = Uint8Array.from(base64UrlDecode(prfFirstB64u)).buffer;
-	try {
-		const rejoined = await args.signingSurface.rejoinWalletCustodyEvmFamilyKeySet({
-			walletId: String(args.pending.walletId),
-			custodyJson: joinCustodyJsonFromEstablishedCommitPayload(args.pending.localMaterial.custodyCommit),
-			factorSecret,
-			evmFamilySigningKeySlotId: primaryKey.evmFamilySigningKeySlotId,
-			applicationBindingDigestB64u: args.response.ecdsa.bootstrap.applicationBindingDigestB64u,
-			registeredClientRootPublicKey33B64u: primaryKey.derivationClientSharePublicKey33B64u,
-			relayerPublicIdentityJson: JSON.stringify({
-				relayerKeyId: primaryKey.relayerKeyId,
-				relayerPublicKey33B64u: primaryKey.relayerVerifyingShareB64u,
-				groupPublicKey33B64u: primaryKey.thresholdEcdsaPublicKeyB64u,
-				ethereumAddress: primaryKey.thresholdOwnerAddress,
-				relayerShareRetryCounter: primaryKey.relayerShareRetryCounter
-			})
-		});
-		return {
-			session: verified.ecdsaSession,
-			readyStateBlobB64u: rejoined.readyStateBlobB64u,
-			publicFacts: rejoined.publicFacts
-		};
-	} finally {
-		zeroizeArrayBuffer(factorSecret);
-	}
-}
-async function unlockWithEmailOtp(args) {
-	if (args.pending.auth.kind !== "email_otp") throw new Error("ECDSA registration Email OTP unlock has a different pending factor");
-	const primaryKey = args.walletKeys[0];
-	if (!primaryKey) throw new Error("ECDSA registration unlock has no primary wallet key");
-	const runtimePolicyScope = requireEcdsaProjection(args.response).ecdsa.runtimePolicyScope;
-	const verified = await unlockEmailOtpWallet({
-		walletSession: {
-			walletId: toWalletId(args.pending.walletId),
-			walletSessionUserId: String(args.pending.walletId)
-		},
-		authoritySelector: {
-			kind: "wallet_auth_method",
-			walletAuthMethodId: args.pending.walletAuthMethodId
-		},
-		relayUrl: args.relayerUrl,
-		groupId: SIGNING_SESSION_SEAL_GROUP_ID,
-		routePlan: buildFreshEmailOtpRoutePlan({
-			freshRouteFamily: "login",
-			operation: WALLET_EMAIL_OTP_UNLOCK_OPERATION
-		}),
-		workerCtx: args.signingSurface.getSignerWorkerContext(),
-		verification: {
-			kind: "otp",
-			challengeId: args.exactMethod.challengeId,
-			otpCode: args.exactMethod.otpCode
-		},
-		runtimePolicyScope,
-		ecdsaSessionHandleBinding: {
-			keyHandle: primaryKey.keyHandle,
-			authSubjectId: args.pending.auth.providerSubject,
-			operation: "wallet_unlock",
-			chainTarget: primaryKey.chainTarget
-		},
-		ecdsaSessionPolicy: buildEcdsaUnlockPolicy({
-			keyHandle: primaryKey.keyHandle,
-			runtimePolicyScope
-		})
-	});
-	if (verified.operation !== "wallet_unlock") throw new Error("Email OTP ECDSA registration unlock returned the wrong operation");
-	assertIssuedEcdsaSessionMatchesRegistration({
-		pending: args.pending,
-		response: args.response,
-		session: verified.ecdsaSession,
-		walletKey: primaryKey
-	});
-	assertCustodyContinuityMatchesRegistration({
-		pending: args.pending,
-		response: args.response,
-		walletKeys: args.walletKeys,
-		signers: verified.ecdsaCustody.continuity.signers
-	});
-	return {
-		session: verified.ecdsaSession,
-		readyStateBlobB64u: verified.ecdsaCustody.readyStateBlobB64u,
-		publicFacts: verified.ecdsaCustody.publicFacts
-	};
-}
-async function unlockPendingEcdsaRegistration(args) {
-	switch (args.exactMethod.kind) {
-		case "passkey": return await unlockWithPasskey({
-			relayerUrl: args.relayerUrl,
-			pending: args.pending,
-			response: args.response,
-			walletKeys: args.walletKeys,
-			exactMethod: args.exactMethod,
-			signingSurface: args.signingSurface
-		});
-		case "email_otp": return await unlockWithEmailOtp({
-			relayerUrl: args.relayerUrl,
-			pending: args.pending,
-			response: args.response,
-			walletKeys: args.walletKeys,
-			exactMethod: args.exactMethod,
-			signingSurface: args.signingSurface
-		});
-		default:
-			args.exactMethod;
-			throw new Error(`Unsupported pending registration unlock method: ${String(args.exactMethod)}`);
-	}
-}
-//#endregion
-export { unlockPendingEcdsaRegistration };
-
-//# sourceMappingURL=pendingEcdsaRegistrationRecoveryUnlock.js.map

package/dist/esm/SeamsWeb/operations/registration/pendingEcdsaRegistrationRecoveryValidation.js

@@ -1,134 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseEmailOtpWalletAuthAuthority } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { assertPendingWalletRegistrationIdentity } from "../../../core/indexedDB/pendingWalletRegistrationCommit.js";
-import { assertSharedRegistrationEvmFamilyWalletKeyMaterial } from "./registrationStrictEcdsa.js";
-//#region src/SeamsWeb/operations/registration/pendingEcdsaRegistrationRecoveryValidation.ts
-function isEcdsaRegistrationCommit(pending) {
-	if (pending.operation !== "registration_activate" || pending.signerPlanKind !== "evm_family_ecdsa") return false;
-	const families = pending.localMaterial.keyFamilies;
-	return families.length === 1 && families[0] === "ecdsa_secp256k1";
-}
-function isMixedEcdsaRegistrationCommit(pending) {
-	if (pending.operation !== "registration_activate" || pending.signerPlanKind !== "near_ed25519_and_evm_family_ecdsa") return false;
-	const families = pending.localMaterial.keyFamilies;
-	return families.length === 1 && families[0] === "ecdsa_secp256k1";
-}
-function requireEcdsaProjection(response) {
-	const tokens = response.registrationEstablishedSession.session.tokens;
-	if (tokens.kind === "evm_family_ecdsa" || tokens.kind === "near_ed25519_and_evm_family_ecdsa") return tokens;
-	throw new Error("pending ECDSA activation returned no ECDSA projection");
-}
-function samePendingEcdsaProjection(pending, response, walletKey) {
-	const session = response.registrationEstablishedSession.session;
-	const projection = requireEcdsaProjection(response);
-	return response.walletId === pending.walletId && response.custodyKeyManifestDigestB64u === pending.localMaterial.custodyCommit.keyManifestDigestB64u && response.walletCustody?.status === "committed" && session.walletId === pending.walletId && session.walletSession.walletId === pending.walletId && session.walletSession.authMethodId === pending.walletAuthMethodId && session.tokens.kind === "evm_family_ecdsa" && projection.ecdsa.keyHandle === walletKey.keyHandle && projection.ecdsa.thresholdSessionId === response.ecdsa.bootstrap.thresholdSessionId && session.expiresAtMs === response.ecdsa.bootstrap.expiresAtMs && session.remainingUses === response.ecdsa.bootstrap.remainingUses;
-}
-function samePendingEcdsaClientActivationFacts(activation, walletKey, expected) {
-	const identity = activation.ecdsa_activation.public_identity;
-	return sameRouterAbEcdsaVerifiedClientActivationFactsV1({
-		registrationRequestDigestB64u: walletKey.publicCapability.registration_request_digest_b64u,
-		proofTranscriptDigestB64u: base64UrlEncode(Uint8Array.from(activation.transcript_digest.bytes)),
-		contextBinding32B64u: identity.context_binding_b64u,
-		derivationClientSharePublicKey33B64u: identity.derivation_client_share_public_key33_b64u,
-		clientShareRetryCounter: identity.client_share_retry_counter,
-		participantId: 1
-	}, expected);
-}
-function samePendingEcdsaBootstrapPublicIdentity(actual, expected) {
-	return actual.derivationClientSharePublicKey33B64u === expected.derivationClientSharePublicKey33B64u && actual.relayerPublicKey33B64u === expected.relayerVerifyingShareB64u && actual.groupPublicKey33B64u === expected.thresholdEcdsaPublicKeyB64u && actual.ethereumAddress === expected.thresholdOwnerAddress.toLowerCase();
-}
-function samePendingEcdsaActivationPublicIdentity(actual, expected) {
-	return actual.server_public_key33_b64u === expected.relayerVerifyingShareB64u && actual.threshold_public_key33_b64u === expected.thresholdEcdsaPublicKeyB64u && ethereumAddressFromActivationIdentity(actual.ethereum_address20_b64u) === expected.thresholdOwnerAddress && actual.server_share_retry_counter === expected.relayerShareRetryCounter;
-}
-function samePendingEcdsaBootstrapKeyIdentity(bootstrap, walletKey) {
-	return bootstrap.walletId === walletKey.walletId && bootstrap.keyHandle === walletKey.keyHandle && bootstrap.ecdsaThresholdKeyId === walletKey.ecdsaThresholdKeyId && bootstrap.evmFamilySigningKeySlotId === walletKey.evmFamilySigningKeySlotId && bootstrap.signingRootId === walletKey.signingRootId && bootstrap.signingRootVersion === walletKey.signingRootVersion && bootstrap.thresholdEcdsaPublicKeyB64u === walletKey.thresholdEcdsaPublicKeyB64u && bootstrap.ethereumAddress.toLowerCase() === walletKey.thresholdOwnerAddress.toLowerCase() && bootstrap.relayerKeyId === walletKey.relayerKeyId && bootstrap.relayerVerifyingShareB64u === walletKey.relayerVerifyingShareB64u && bootstrap.clientShareRetryCounter === walletKey.clientShareRetryCounter && bootstrap.relayerShareRetryCounter === walletKey.relayerShareRetryCounter;
-}
-function pendingEcdsaActivateRequest(relayerUrl, pending) {
-	const common = {
-		relayerUrl,
-		registrationCeremonyId: pending.registrationCeremonyId,
-		signedSetup: pending.signedSetup,
-		idempotencyKey: pending.idempotencyKey,
-		walletCustodyCommit: pending.localMaterial.custodyCommit,
-		...pending.auth.kind === "email_otp" ? { emailOtpEnrollment: pending.auth.enrollment } : {}
-	};
-	const ecdsa = {
-		activationCorrelationId: pending.localMaterial.ecdsa.activationJournalId,
-		activationRequestDigestB64u: pending.localMaterial.ecdsa.activationRequestDigestB64u,
-		clientActivation: pending.localMaterial.ecdsa.clientActivation
-	};
-	return {
-		...common,
-		signerPlanKind: pending.signerPlanKind,
-		ecdsa
-	};
-}
-function requireResponseWalletKeys(response) {
-	const first = response.ecdsa.walletKeys[0];
-	if (!first) throw new Error("pending ECDSA activation returned no wallet keys");
-	assertSharedRegistrationEvmFamilyWalletKeyMaterial(response.ecdsa.walletKeys);
-	return [first, ...response.ecdsa.walletKeys.slice(1)];
-}
-function ethereumAddressFromActivationIdentity(value) {
-	const bytes = base64UrlDecode(value);
-	if (bytes.length !== 20) throw new Error("pending ECDSA activation returned an invalid address");
-	let hex = "0x";
-	for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
-	return hex;
-}
-function assertProjectionMatchesPending(pending, response, walletKey) {
-	if (!samePendingEcdsaProjection(pending, response, walletKey)) throw new Error("pending ECDSA activation projection mismatch");
-	assertPendingWalletRegistrationIdentity(pending, {
-		operation: pending.operation,
-		walletId: response.walletId,
-		walletAuthMethodId: response.foundingAuthMethod.walletAuthMethodId,
-		authority: response.authority
-	});
-}
-function isCommittedEcdsaRegistrationResponse(response) {
-	return response.ok === true && response.kind === "evm_family_ecdsa" && response.registrationEstablishedSession.kind === "already_committed";
-}
-async function assertAuthMatchesPending(pending, response) {
-	if (pending.auth.kind === "passkey") {
-		if (response.authMethod.kind !== "passkey" || response.rpId !== pending.auth.rpId || response.authMethod.credentialIdB64u !== pending.auth.credentialIdB64u) throw new Error("pending ECDSA activation returned a different Passkey method");
-		return;
-	}
-	if (response.authMethod.kind !== "email_otp" || response.authMethod.registrationAuthorityId !== pending.auth.registrationAuthorityId) throw new Error("pending ECDSA activation returned a different Email OTP method");
-	const authority = parseEmailOtpWalletAuthAuthority(response.authority);
-	const emailHashHex = await sha256HexUtf8(pending.auth.email);
-	if (!authority || authority.factor.providerUserId !== pending.auth.providerSubject || authority.verifier.emailHashHex.toLowerCase() !== emailHashHex.toLowerCase()) throw new Error("pending ECDSA activation returned a different Email OTP identity");
-}
-function assertActivationFacts(pending, response, walletKey) {
-	const activation = response.ecdsa.activation;
-	const receipt = activation.ecdsa_activation;
-	const identity = receipt.public_identity;
-	const client = pending.localMaterial.ecdsa.clientActivation;
-	if (activation.activation_correlation_id !== pending.localMaterial.ecdsa.activationJournalId || base64UrlEncode(Uint8Array.from(activation.activation_request_digest.bytes)) !== pending.localMaterial.ecdsa.activationRequestDigestB64u || !samePendingEcdsaClientActivationFacts(activation, walletKey, client) || !samePendingEcdsaBootstrapPublicIdentity(response.ecdsa.bootstrap.publicIdentity, walletKey) || receipt.context.application_binding_digest_b64u !== response.ecdsa.bootstrap.applicationBindingDigestB64u || !samePendingEcdsaActivationPublicIdentity(identity, walletKey)) throw new Error("pending ECDSA activation facts mismatch");
-	if (!samePendingEcdsaBootstrapKeyIdentity(response.ecdsa.bootstrap, walletKey)) throw new Error("pending ECDSA bootstrap changed committed key identity");
-}
-function assertProjectionEcdsaFacts(response) {
-	const projection = requireEcdsaProjection(response).ecdsa;
-	const receipt = response.ecdsa.activation.ecdsa_activation;
-	if (!mpcMaterialActivationRefsEqual(projection.materialActivation, routerAbMpcMaterialActivationRefFromWire(receipt.material_activation)) || !sameRouterAbEcdsaDerivationNormalSigningStateV1(projection.routerAbEcdsaDerivationNormalSigning, response.ecdsa.bootstrap.routerAbEcdsaDerivationNormalSigning)) throw new Error("pending ECDSA activation facts do not match the committed projection");
-}
-async function requireCommittedEcdsaRegistrationResponse(args) {
-	const response = args.response;
-	if (!isCommittedEcdsaRegistrationResponse(response)) throw new Error(response.ok ? "pending ECDSA activation replay did not return a committed projection" : "pending ECDSA activation replay failed");
-	const walletKey = requireResponseWalletKeys(response)[0];
-	assertProjectionMatchesPending(args.pending, response, walletKey);
-	await assertAuthMatchesPending(args.pending, response);
-	assertActivationFacts(args.pending, response, walletKey);
-	assertProjectionEcdsaFacts(response);
-	if (args.pending.signerPlanKind === "evm_family_ecdsa") {
-		if (response.nearProvisioning !== void 0) throw new Error("ECDSA-only registration unexpectedly has deferred NEAR provisioning");
-	} else if (response.nearProvisioning?.status !== "near_pending") throw new Error("mixed registration did not retain deferred NEAR provisioning");
-	return response;
-}
-//#endregion
-export { isEcdsaRegistrationCommit, isMixedEcdsaRegistrationCommit, pendingEcdsaActivateRequest, requireCommittedEcdsaRegistrationResponse, requireEcdsaProjection, requireResponseWalletKeys };
-
-//# sourceMappingURL=pendingEcdsaRegistrationRecoveryValidation.js.map