@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js

@@ -1,15 +1,14 @@
-import { parseEcdsaActiveStateId, parseRootShareEpoch, parseThresholdEcdsaSessionId } from "./domainIds.js";
-import { EVM_ECDSA_MPC_OPERATION_KINDS, parseEcdsaAuthorizationSessionId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../authorization/capabilityKinds.js";
 import { requireRecord } from "./validation.js";
+import { parseEcdsaActiveStateId, parseRootShareEpoch } from "./domainIds.js";
+import { EVM_ECDSA_MPC_OPERATION_KINDS } from "../authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
 import { parseCorrelationId, parseDigestB64u } from "./canonicalPrimitives.js";
-import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../device-linking/activeWalletSession.js";
-import { normalizeRuntimePolicyScope } from "../threshold/signingRootScope.js";
-import { canonicalRouterAbMpcMaterialActivationRefBytes, canonicalRouterAbNormalSigningAuthorizationBytes, parseRouterAbMpcMaterialActivationRef, parseRouterAbNormalSigningAuthorization, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "./routerAbNormalSigningIdentity.js";
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, parseWalletAuthAuthority } from "./walletAuthAuthority.js";
+import "../device-linking/activeWalletSession.js";
 import { requireRouterAbX25519PublicKey } from "./routerAbPublicKeyset.js";
+import { canonicalRouterAbMpcMaterialActivationRefBytes, canonicalRouterAbNormalSigningAuthorizationBytes, parseRouterAbMpcMaterialActivationRef, parseRouterAbNormalSigningAuthorization } from "./routerAbNormalSigningIdentity.js";
 import { parseEcdsaServerGeneration } from "./ecdsaCapabilityActivation.js";
+import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, parseWalletAuthAuthority } from "./walletAuthAuthority.js";
 //#region ../shared-ts/src/utils/routerAbEcdsaDerivation.ts
 /**
 * The longest an ECDSA presignature ceremony may run. The Gateway authorizes a
@@ -17,10 +16,8 @@ import { parseEcdsaServerGeneration } from "./ecdsaCapabilityActivation.js";
 */
 const ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS = 5 * 6e4;
 const ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1 = "router_ab_ecdsa_derivation_normal_signing_v1";
-const ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH = "/router-ab/ecdsa-derivation/export";
 const ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH = "/router-ab/ecdsa-derivation/presignature-pool/fill/init";
 const ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH = "/router-ab/ecdsa-derivation/presignature-pool/fill/step";
-const ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH = "/router-ab/ecdsa-derivation/session/activate";
 const ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH = "/router-ab/ecdsa-derivation/operation-step-up";
 const ROUTER_AB_ECDSA_OPERATION_STEP_UP_CHALLENGE_DOMAIN_V1 = "router-ab-ecdsa-operation-step-up/challenge/v1";
 const ECDSA_DERIVATION_CONTEXT_DOMAIN_TAG_V1 = "router-ab-ecdsa-derivation/context/v1";
@@ -34,10 +31,6 @@ const ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_SCOPE_VERSION_V1 = "router-ab-ec
 const ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_REQUEST_VERSION_V1 = "router-ab-ecdsa-derivation/normal-signing-request/v1";
 const ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_FINALIZE_REQUEST_VERSION_V1 = "router-ab-ecdsa-derivation/normal-signing-finalize-request/v1";
 const ROUTER_AB_ECDSA_DERIVATION_CLIENT_RERANDOMIZATION_COMMITMENT_DOMAIN_V1 = "router-ab-ecdsa-derivation/client-rerandomization-commitment/v1";
-function requireExportShareAuthorizationKind(value, label) {
-	if (value === "reusable_wallet_session" || value === "verified_step_up") return value;
-	throw new Error(`${label} must be reusable_wallet_session or verified_step_up`);
-}
 function parseRouterAbEcdsaOperationStepUpExportTopologyV1(value) {
 	const topology = requireRecord(value, "operationStepUpAuthorizationResponse.export_topology");
 	requireExactKeys(topology, "operationStepUpAuthorizationResponse.export_topology", [
@@ -139,39 +132,10 @@ function requireRootShareEpoch(value, label) {
 	if (!parsed.ok) throw new Error(`${label} is invalid`);
 	return parsed.value;
 }
-function requireThresholdEcdsaSessionId(value, label) {
-	const parsed = parseThresholdEcdsaSessionId(requireAsciiNonEmptyString(value, label));
-	if (!parsed.ok) throw new Error(`${label} is invalid`);
-	return parsed.value;
-}
-function requireEcdsaAuthorizationSessionId(value, label) {
-	const parsed = parseEcdsaAuthorizationSessionId(value);
-	if (!parsed.ok) throw new Error(`${label} is invalid`);
-	return parsed.value;
-}
-function requireWalletSessionAuthorizationId(value, label) {
-	const parsed = parseWalletSessionAuthorizationId(value);
-	if (!parsed.ok) throw new Error(`${label} is invalid`);
-	return parsed.value;
-}
-function requireWalletSessionId(value, label) {
-	const parsed = parseWalletSessionId(value);
-	if (!parsed.ok) throw new Error(`${label} is invalid`);
-	return parsed.value;
-}
-function requireMpcWalletSigningQuotaId(value, label) {
-	const parsed = parseMpcWalletSigningQuotaId(value);
-	if (!parsed.ok) throw new Error(`${label} is invalid`);
-	return parsed.value;
-}
 function requirePositiveUnixMs(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
 	return value;
 }
-function requirePositiveCounter(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe-integer counter`);
-	return value;
-}
 function requireU32(value, label) {
 	if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${label} must be a finite number`);
 	const parsed = Math.floor(value);
@@ -202,23 +166,6 @@ function requireCompressedSecp256k1PublicKey(value, label) {
 	if (decoded[0] !== 2 && decoded[0] !== 3) throw new Error(`${label} must be a compressed secp256k1 public key`);
 	return parsed;
 }
-function requireBase64UrlNonEmpty(value, label) {
-	const parsed = requireAsciiNonEmptyString(value, label);
-	if (!/^[A-Za-z0-9_-]+$/.test(parsed)) throw new Error(`${label} must be unpadded base64url`);
-	let decoded;
-	try {
-		decoded = base64UrlDecode(parsed);
-	} catch {
-		throw new Error(`${label} must be valid base64url`);
-	}
-	if (decoded.length === 0) throw new Error(`${label} must decode to non-empty bytes`);
-	return parsed;
-}
-function requireX25519PublicKey(value, label) {
-	const parsed = requireAsciiNonEmptyString(value, label);
-	if (!/^x25519:[0-9a-f]{64}$/.test(parsed)) throw new Error(`${label} must use x25519:<64 lowercase hex chars> encoding`);
-	return parsed;
-}
 function requireUint8ArrayFixed(value, label, byteLength) {
 	if (!(value instanceof Uint8Array)) throw new Error(`${label} must be a Uint8Array`);
 	if (value.length !== byteLength) throw new Error(`${label} must contain ${byteLength} bytes`);
@@ -316,32 +263,6 @@ function parsePostRegistrationSignerSet(value, label) {
 		selected_server: parseServerIdentityWithLabel(record.selected_server, `${label}.selected_server`)
 	};
 }
-function parseRegistrationLifecycle(value) {
-	const label = "registration.lifecycle";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"lifecycle_id",
-		"work_kind",
-		"primitive_request_kind",
-		"root_share_epoch",
-		"account_id",
-		"session_id",
-		"signer_set_id",
-		"selected_server_id"
-	]);
-	if (record.work_kind !== "registration_prepare") throw new Error(`${label}.work_kind must be registration_prepare`);
-	if (record.primitive_request_kind !== "registration") throw new Error(`${label}.primitive_request_kind must be registration`);
-	return {
-		lifecycle_id: requireAsciiNonEmptyString(record.lifecycle_id, `${label}.lifecycle_id`),
-		work_kind: "registration_prepare",
-		primitive_request_kind: "registration",
-		root_share_epoch: requireRootShareEpoch(record.root_share_epoch, `${label}.root_share_epoch`),
-		account_id: requireAsciiNonEmptyString(record.account_id, `${label}.account_id`),
-		session_id: requireAsciiNonEmptyString(record.session_id, `${label}.session_id`),
-		signer_set_id: requireAsciiNonEmptyString(record.signer_set_id, `${label}.signer_set_id`),
-		selected_server_id: requireAsciiNonEmptyString(record.selected_server_id, `${label}.selected_server_id`)
-	};
-}
 function parseRegistrationRecipientKey(value, label, role) {
 	const record = requireRecord(value, label);
 	requireExactKeys(record, label, [
@@ -364,162 +285,6 @@ function parseRegistrationRecipientKeys(value, label = "registration.deriver_rec
 		deriver_b: parseRegistrationRecipientKey(record.deriver_b, `${label}.deriver_b`, "signer_b")
 	};
 }
-function parseRouterAbEcdsaRegistrationRequestFactsV1(value) {
-	const label = "registration";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"registration_purpose",
-		"context",
-		"lifecycle",
-		"signer_set",
-		"router_id",
-		"client_id",
-		"replay_nonce",
-		"expires_at_ms",
-		"deriver_recipient_keys"
-	]);
-	if (record.registration_purpose !== "wallet_registration" && record.registration_purpose !== "wallet_add_signer") throw new Error(`${label}.registration_purpose is invalid`);
-	const lifecycle = parseRegistrationLifecycle(record.lifecycle);
-	const signerSet = parsePostRegistrationSignerSet(record.signer_set, `${label}.signer_set`);
-	if (lifecycle.signer_set_id !== signerSet.signer_set_id) throw new Error(`${label}.lifecycle signer set does not match signer_set`);
-	if (lifecycle.selected_server_id !== signerSet.selected_server.server_id) throw new Error(`${label}.lifecycle selected server does not match signer_set`);
-	const recipientKeys = parseRegistrationRecipientKeys(record.deriver_recipient_keys);
-	if (recipientKeys.deriver_a.key_epoch !== signerSet.signer_a.key_epoch) throw new Error(`${label}.deriver_a recipient key epoch does not match signer_set`);
-	if (recipientKeys.deriver_b.key_epoch !== signerSet.signer_b.key_epoch) throw new Error(`${label}.deriver_b recipient key epoch does not match signer_set`);
-	return {
-		registration_purpose: record.registration_purpose,
-		context: parseStableKeyContext(record.context),
-		lifecycle,
-		signer_set: signerSet,
-		router_id: requireAsciiNonEmptyString(record.router_id, `${label}.router_id`),
-		client_id: requireAsciiNonEmptyString(record.client_id, `${label}.client_id`),
-		replay_nonce: requireAsciiNonEmptyString(record.replay_nonce, `${label}.replay_nonce`),
-		expires_at_ms: requirePositiveUnixMs(record.expires_at_ms, `${label}.expires_at_ms`),
-		deriver_recipient_keys: recipientKeys
-	};
-}
-function parseRouterAbEcdsaClientProofBundleV1(value, label) {
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"kind",
-		"transcriptDigestB64u",
-		"payloadB64u"
-	]);
-	if (record.kind !== "recipient_proof_bundle") throw new Error(`${label}.kind must be recipient_proof_bundle`);
-	return {
-		kind: "recipient_proof_bundle",
-		transcriptDigestB64u: requireBase64UrlFixed(record.transcriptDigestB64u, `${label}.transcriptDigestB64u`, 32),
-		payloadB64u: requireBase64UrlNonEmpty(record.payloadB64u, `${label}.payloadB64u`)
-	};
-}
-function parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(value) {
-	const label = "registrationForwarded";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, ["result", "response"]);
-	if (record.result !== "forwarded") throw new Error(`${label}.result must be forwarded`);
-	return {
-		result: "forwarded",
-		response: parseRouterAbEcdsaStrictProofResponseV1(record.response, `${label}.response`)
-	};
-}
-function parseRouterAbEcdsaExplicitExportForwardedResponseV1(value) {
-	return parseRouterAbEcdsaExplicitExportForwardedResponseWithV1(value, parseRouterAbEcdsaSigningWorkerExportShareEnvelopeV1);
-}
-function parseRouterAbEcdsaExplicitExportForwardedResponseWithV1(value, parseEnvelope) {
-	const label = "explicitExportForwarded";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"result",
-		"response",
-		"signing_worker_export"
-	]);
-	if (record.result !== "forwarded") throw new Error(`${label}.result must be forwarded`);
-	return {
-		result: "forwarded",
-		response: parseRouterAbEcdsaStrictProofResponseV1(record.response, `${label}.response`),
-		signing_worker_export: parseEnvelope(record.signing_worker_export)
-	};
-}
-function parseRouterAbEcdsaSigningWorkerExportShareEnvelopeV1(value) {
-	return parseRouterAbEcdsaSigningWorkerExportShareEnvelopeWithV1(value, parseRouterAbMpcMaterialActivationRef);
-}
-function parseRouterAbEcdsaSigningWorkerExportShareBindingWithV1(value, parseMaterialActivation, label) {
-	const binding = requireRecord(value, label);
-	requireExactKeys(binding, label, [
-		"wallet_id",
-		"key_handle",
-		"ecdsa_threshold_key_id",
-		"signing_root_id",
-		"signing_root_version",
-		"activation_epoch",
-		"signing_worker_id",
-		"context_binding_b64u",
-		"threshold_public_key33_b64u",
-		"export_request_digest_b64u",
-		"export_authorization_digest_b64u",
-		"export_nonce",
-		"authorization_kind",
-		"authorization_id",
-		"material_activation",
-		"lifecycle_id",
-		"recipient_identity",
-		"recipient_public_key",
-		"expires_at_ms"
-	]);
-	const materialActivation = parseMaterialActivation(binding.material_activation);
-	if (materialActivation.material_owner !== binding.wallet_id || materialActivation.signing_worker !== binding.signing_worker_id) throw new Error(`${label}.material_activation is not bound to wallet and worker`);
-	return {
-		wallet_id: requireAsciiNonEmptyString(binding.wallet_id, `${label}.wallet_id`),
-		key_handle: requireAsciiNonEmptyString(binding.key_handle, `${label}.key_handle`),
-		ecdsa_threshold_key_id: requireAsciiNonEmptyString(binding.ecdsa_threshold_key_id, `${label}.ecdsa_threshold_key_id`),
-		signing_root_id: requireAsciiNonEmptyString(binding.signing_root_id, `${label}.signing_root_id`),
-		signing_root_version: requireAsciiNonEmptyString(binding.signing_root_version, `${label}.signing_root_version`),
-		activation_epoch: requireRootShareEpoch(binding.activation_epoch, `${label}.activation_epoch`),
-		signing_worker_id: requireAsciiNonEmptyString(binding.signing_worker_id, `${label}.signing_worker_id`),
-		context_binding_b64u: requireBase64UrlFixed(binding.context_binding_b64u, `${label}.context_binding_b64u`, 32),
-		threshold_public_key33_b64u: requireCompressedSecp256k1PublicKey(binding.threshold_public_key33_b64u, `${label}.threshold_public_key33_b64u`),
-		export_request_digest_b64u: requireBase64UrlFixed(binding.export_request_digest_b64u, `${label}.export_request_digest_b64u`, 32),
-		export_authorization_digest_b64u: requireBase64UrlFixed(binding.export_authorization_digest_b64u, `${label}.export_authorization_digest_b64u`, 32),
-		export_nonce: requireAsciiNonEmptyString(binding.export_nonce, `${label}.export_nonce`),
-		authorization_kind: requireExportShareAuthorizationKind(binding.authorization_kind, `${label}.authorization_kind`),
-		authorization_id: requireAsciiNonEmptyString(binding.authorization_id, `${label}.authorization_id`),
-		material_activation: materialActivation,
-		lifecycle_id: requireAsciiNonEmptyString(binding.lifecycle_id, `${label}.lifecycle_id`),
-		recipient_identity: requireAsciiNonEmptyString(binding.recipient_identity, `${label}.recipient_identity`),
-		recipient_public_key: requireX25519PublicKey(binding.recipient_public_key, `${label}.recipient_public_key`),
-		expires_at_ms: requirePositiveUnixMs(binding.expires_at_ms, `${label}.expires_at_ms`)
-	};
-}
-function parseRouterAbEcdsaSigningWorkerExportShareEnvelopeWithV1(value, parseMaterialActivation) {
-	const label = "signingWorkerExportShare";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"version",
-		"algorithm",
-		"binding",
-		"ciphertext_and_tag"
-	]);
-	if (record.version !== "router-ab-ecdsa-derivation/signing-worker-export-share-envelope/v1") throw new Error(`${label}.version is invalid`);
-	if (record.algorithm !== "hpke_x25519_hkdf_sha256_aes256gcm_v1") throw new Error(`${label}.algorithm is invalid`);
-	if (!Array.isArray(record.ciphertext_and_tag) || record.ciphertext_and_tag.length <= 48) throw new Error(`${label}.ciphertext_and_tag is invalid`);
-	return {
-		version: "router-ab-ecdsa-derivation/signing-worker-export-share-envelope/v1",
-		algorithm: "hpke_x25519_hkdf_sha256_aes256gcm_v1",
-		binding: parseRouterAbEcdsaSigningWorkerExportShareBindingWithV1(record.binding, parseMaterialActivation, `${label}.binding`),
-		ciphertext_and_tag: record.ciphertext_and_tag.map((entry, index) => requireByte(entry, `${label}.ciphertext_and_tag[${index}]`))
-	};
-}
-function parseRouterAbEcdsaStrictProofResponseV1(value, label) {
-	const response = requireRecord(value, label);
-	requireExactKeys(response, label, ["bundles"]);
-	const bundlesLabel = `${label}.bundles`;
-	const bundles = requireRecord(response.bundles, bundlesLabel);
-	requireExactKeys(bundles, bundlesLabel, ["signerA", "signerB"]);
-	return { bundles: {
-		signerA: parseRouterAbEcdsaClientProofBundleV1(bundles.signerA, `${bundlesLabel}.signerA`),
-		signerB: parseRouterAbEcdsaClientProofBundleV1(bundles.signerB, `${bundlesLabel}.signerB`)
-	} };
-}
 function parseRouterAbEcdsaVerifiedClientActivationFactsV1(value) {
 	const label = "registrationActivation.publicFacts";
 	const record = requireRecord(value, label);
@@ -585,18 +350,9 @@ function parseRouterAbEcdsaRegistrationActivationReceiptV1(value) {
 		transcript_digest: transcriptDigest
 	};
 }
-function parseRouterAbEcdsaRegistrationPublicActivationReceiptV1(value) {
-	return parseRouterAbEcdsaRegistrationActivationReceiptV1(value);
-}
 function sameRouterAbServerIdentityV1(left, right) {
 	return left.server_id === right.server_id && left.key_epoch === right.key_epoch && left.recipient_encryption_key === right.recipient_encryption_key;
 }
-function sameRouterAbEcdsaVerifiedClientActivationFactsV1(left, right) {
-	return left.registrationRequestDigestB64u === right.registrationRequestDigestB64u && left.proofTranscriptDigestB64u === right.proofTranscriptDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && left.derivationClientSharePublicKey33B64u === right.derivationClientSharePublicKey33B64u && left.clientShareRetryCounter === right.clientShareRetryCounter && left.participantId === right.participantId;
-}
-function sameRegistrationSignerSet(left, right) {
-	return left.signer_set_id === right.signer_set_id && left.policy === right.policy && left.signer_a.role === right.signer_a.role && left.signer_a.signer_id === right.signer_a.signer_id && left.signer_a.key_epoch === right.signer_a.key_epoch && left.signer_b.role === right.signer_b.role && left.signer_b.signer_id === right.signer_b.signer_id && left.signer_b.key_epoch === right.signer_b.key_epoch && sameRouterAbServerIdentityV1(left.selected_server, right.selected_server);
-}
 function parseRouterAbEcdsaDerivationPublicCapabilityV1(value) {
 	const label = "ecdsaPublicCapability";
 	const record = requireRecord(value, label);
@@ -631,179 +387,15 @@ function parseRouterAbEcdsaDerivationPublicCapabilityV1(value) {
 		proof_transcript_digest_b64u: requireBase64UrlFixed(record.proof_transcript_digest_b64u, `${label}.proof_transcript_digest_b64u`, 32)
 	};
 }
-function parsePostRegistrationSessionPolicy(value) {
-	const label = "postRegistrationSessionActivation.session_policy";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"threshold_session_id",
-		"wallet_session_mint_id",
-		"ttl_ms",
-		"remaining_uses",
-		"runtime_policy_scope"
-	]);
-	return {
-		threshold_session_id: requireThresholdEcdsaSessionId(record.threshold_session_id, `${label}.threshold_session_id`),
-		wallet_session_mint_id: requireWalletSessionMintId(record.wallet_session_mint_id, `${label}.wallet_session_mint_id`),
-		ttl_ms: requirePositiveCounter(record.ttl_ms, `${label}.ttl_ms`),
-		remaining_uses: requirePositiveCounter(record.remaining_uses, `${label}.remaining_uses`),
-		runtime_policy_scope: normalizeRuntimePolicyScope(record.runtime_policy_scope)
-	};
-}
-function parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1(value) {
-	const label = "postRegistrationSessionActivationPolicy";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"kind",
-		"key_handle",
-		"session_policy"
-	]);
-	if (record.kind !== "router_ab_ecdsa_post_registration_session_activation_policy_v1") throw new Error(`${label}.kind is invalid`);
-	return {
-		kind: "router_ab_ecdsa_post_registration_session_activation_policy_v1",
-		key_handle: requireAsciiNonEmptyString(record.key_handle, `${label}.key_handle`),
-		session_policy: parsePostRegistrationSessionPolicy(record.session_policy)
-	};
-}
-function requireWalletSessionMintId(value, label) {
-	const parsed = parseWalletSessionMintId(value);
-	if (!parsed.ok) throw new Error(`${label} is invalid`);
-	return parsed.value;
-}
 function sameRouterAbEcdsaDerivationPublicIdentityV1(left, right) {
 	return left.context_binding_b64u === right.context_binding_b64u && left.derivation_client_share_public_key33_b64u === right.derivation_client_share_public_key33_b64u && left.server_public_key33_b64u === right.server_public_key33_b64u && left.threshold_public_key33_b64u === right.threshold_public_key33_b64u && left.ethereum_address20_b64u === right.ethereum_address20_b64u && left.client_share_retry_counter === right.client_share_retry_counter && left.server_share_retry_counter === right.server_share_retry_counter;
 }
-function activeWalletSessionMatchesEcdsaCapability(session, capability) {
-	for (const subject of session.capabilitySubjects) {
-		if (subject.kind !== "sign" || subject.keyFamily !== "ecdsa_secp256k1") continue;
-		return sameRouterAbMpcMaterialActivationRef(capability.material_activation, routerAbMpcMaterialActivationRefToWire(subject.materialActivation));
-	}
-	return false;
-}
-function parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1(value) {
-	const label = "postRegistrationSessionActivation";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"kind",
-		"public_capability",
-		"session_policy"
-	]);
-	if (record.kind !== "router_ab_ecdsa_post_registration_session_activation_v1") throw new Error(`${label}.kind is invalid`);
-	return {
-		kind: "router_ab_ecdsa_post_registration_session_activation_v1",
-		public_capability: parseRouterAbEcdsaDerivationPublicCapabilityV1(record.public_capability),
-		session_policy: parsePostRegistrationSessionPolicy(record.session_policy)
-	};
-}
-function parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1(value) {
-	const label = "postRegistrationSessionActivated";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"kind",
-		"public_capability",
-		"session",
-		"normal_signing"
-	]);
-	if (record.kind !== "router_ab_ecdsa_post_registration_session_activated_v1") throw new Error(`${label}.kind is invalid`);
-	const publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(record.public_capability);
-	const sessionRecord = requireRecord(record.session, `${label}.session`);
-	requireExactKeys(sessionRecord, `${label}.session`, [
-		"authorization_session_id",
-		"authorization_id",
-		"threshold_session_id",
-		"wallet_session_id",
-		"quota_id",
-		"expires_at_ms",
-		"remaining_uses",
-		"wallet_session",
-		"operation_credential"
-	]);
-	const normalSigning = requireRouterAbEcdsaDerivationNormalSigningStateV1(record.normal_signing);
-	const authorizationId = requireWalletSessionAuthorizationId(sessionRecord.authorization_id, `${label}.session.authorization_id`);
-	const walletSessionId = requireWalletSessionId(sessionRecord.wallet_session_id, `${label}.session.wallet_session_id`);
-	const expiresAtMs = requirePositiveUnixMs(sessionRecord.expires_at_ms, `${label}.session.expires_at_ms`);
-	const walletSession = parseActiveWalletSessionV1(sessionRecord.wallet_session);
-	const operationCredential = parseWalletSessionOperationCredentialV1(sessionRecord.operation_credential);
-	if (!sameRouterAbEcdsaDerivationPublicIdentityV1(publicCapability.public_identity, normalSigning.scope.public_identity) || publicCapability.context.application_binding_digest_b64u !== normalSigning.scope.context.application_binding_digest_b64u || normalSigning.scope.activation_epoch !== publicCapability.activation_epoch || !sameRouterAbServerIdentityV1(normalSigning.scope.signing_worker, publicCapability.signer_set.selected_server) || walletSession.authorizationId !== authorizationId || walletSession.walletId !== publicCapability.client_id || walletSession.expiresAtMs !== expiresAtMs || !activeWalletSessionMatchesEcdsaCapability(walletSession, publicCapability) || operationCredential.walletSessionId !== walletSessionId) throw new Error(`${label} exact Wallet Session does not match the activated capability`);
-	return {
-		kind: "router_ab_ecdsa_post_registration_session_activated_v1",
-		public_capability: publicCapability,
-		session: {
-			authorization_session_id: requireEcdsaAuthorizationSessionId(sessionRecord.authorization_session_id, `${label}.session.authorization_session_id`),
-			authorization_id: authorizationId,
-			threshold_session_id: requireThresholdEcdsaSessionId(sessionRecord.threshold_session_id, `${label}.session.threshold_session_id`),
-			wallet_session_id: walletSessionId,
-			quota_id: requireMpcWalletSigningQuotaId(sessionRecord.quota_id, `${label}.session.quota_id`),
-			expires_at_ms: expiresAtMs,
-			remaining_uses: requirePositiveCounter(sessionRecord.remaining_uses, `${label}.session.remaining_uses`),
-			wallet_session: walletSession,
-			operation_credential: operationCredential
-		},
-		normal_signing: normalSigning
-	};
-}
-function parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1(value) {
-	const label = "credentialFreeSessionActivated";
-	const record = requireRecord(value, label);
-	requireExactKeys(record, label, [
-		"kind",
-		"public_capability",
-		"session",
-		"normal_signing"
-	]);
-	if (record.kind !== "router_ab_ecdsa_credential_free_session_activated_v1") throw new Error(`${label}.kind is invalid`);
-	const publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(record.public_capability);
-	const sessionRecord = requireRecord(record.session, `${label}.session`);
-	requireExactKeys(sessionRecord, `${label}.session`, [
-		"authorization_session_id",
-		"authorization_id",
-		"threshold_session_id",
-		"wallet_session_id",
-		"quota_id",
-		"expires_at_ms",
-		"remaining_uses"
-	]);
-	const normalSigning = requireRouterAbEcdsaDerivationNormalSigningStateV1(record.normal_signing);
-	if (!sameRouterAbEcdsaDerivationPublicIdentityV1(publicCapability.public_identity, normalSigning.scope.public_identity) || publicCapability.context.application_binding_digest_b64u !== normalSigning.scope.context.application_binding_digest_b64u || normalSigning.scope.activation_epoch !== publicCapability.activation_epoch || !sameRouterAbServerIdentityV1(normalSigning.scope.signing_worker, publicCapability.signer_set.selected_server)) throw new Error(`${label} normal-signing state does not match public capability`);
-	return {
-		kind: "router_ab_ecdsa_credential_free_session_activated_v1",
-		public_capability: publicCapability,
-		session: {
-			authorization_session_id: requireEcdsaAuthorizationSessionId(sessionRecord.authorization_session_id, `${label}.session.authorization_session_id`),
-			authorization_id: requireWalletSessionAuthorizationId(sessionRecord.authorization_id, `${label}.session.authorization_id`),
-			threshold_session_id: requireThresholdEcdsaSessionId(sessionRecord.threshold_session_id, `${label}.session.threshold_session_id`),
-			wallet_session_id: requireWalletSessionId(sessionRecord.wallet_session_id, `${label}.session.wallet_session_id`),
-			quota_id: requireMpcWalletSigningQuotaId(sessionRecord.quota_id, `${label}.session.quota_id`),
-			expires_at_ms: requirePositiveUnixMs(sessionRecord.expires_at_ms, `${label}.session.expires_at_ms`),
-			remaining_uses: requirePositiveCounter(sessionRecord.remaining_uses, `${label}.session.remaining_uses`)
-		},
-		normal_signing: normalSigning
-	};
-}
 function publicDigest32FromBase64Url(value, label = "signing_digest_b64u") {
 	return { bytes: Array.from(base64UrlDecode(requireBase64UrlFixed(value, label, 32))) };
 }
 function samePublicDigest32(left, right) {
 	return left.bytes.length === 32 && right.bytes.length === 32 && left.bytes.every((b, i) => b === right.bytes[i]);
 }
-function sameRouterAbPublicDigest32V1Wire(left, right) {
-	return left.bytes.length === right.bytes.length && left.bytes.every((b, i) => b === right.bytes[i]);
-}
-function sameRegistrationRecipientKeys(left, right) {
-	return left.deriver_a.role === right.deriver_a.role && left.deriver_a.key_epoch === right.deriver_a.key_epoch && left.deriver_a.public_key === right.deriver_a.public_key && left.deriver_b.role === right.deriver_b.role && left.deriver_b.key_epoch === right.deriver_b.key_epoch && left.deriver_b.public_key === right.deriver_b.public_key;
-}
-function sameRouterAbEcdsaRegistrationActivationReceiptV1(left, right) {
-	const leftActivation = left.ecdsa_activation;
-	const rightActivation = right.ecdsa_activation;
-	return left.activation_correlation_id === right.activation_correlation_id && sameRouterAbPublicDigest32V1Wire(left.activation_request_digest, right.activation_request_digest) && left.server_generation === right.server_generation && left.lifecycle_id === right.lifecycle_id && sameRouterAbPublicDigest32V1Wire(left.transcript_digest, right.transcript_digest) && leftActivation.context.application_binding_digest_b64u === rightActivation.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(leftActivation.public_identity, rightActivation.public_identity) && sameRouterAbServerIdentityV1(leftActivation.signing_worker, rightActivation.signing_worker) && sameRouterAbMpcMaterialActivationRef(leftActivation.material_activation, rightActivation.material_activation) && leftActivation.activation_epoch === rightActivation.activation_epoch && leftActivation.activation_digest_b64u === rightActivation.activation_digest_b64u && leftActivation.activated_at_ms === rightActivation.activated_at_ms;
-}
-function sameRouterAbEcdsaDerivationNormalSigningStateV1(left, right) {
-	const leftScope = left.scope;
-	const rightScope = right.scope;
-	return left.kind === right.kind && leftScope.wallet_id === rightScope.wallet_id && leftScope.ecdsa_threshold_key_id === rightScope.ecdsa_threshold_key_id && leftScope.signing_root_id === rightScope.signing_root_id && leftScope.signing_root_version === rightScope.signing_root_version && leftScope.context.application_binding_digest_b64u === rightScope.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(leftScope.public_identity, rightScope.public_identity) && sameRouterAbMpcMaterialActivationRef(leftScope.material_activation, rightScope.material_activation) && sameRouterAbServerIdentityV1(leftScope.signing_worker, rightScope.signing_worker) && leftScope.activation_epoch === rightScope.activation_epoch;
-}
-function sameRouterAbEcdsaDerivationPublicCapabilityV1(left, right) {
-	return left.kind === right.kind && left.context.application_binding_digest_b64u === right.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(left.public_identity, right.public_identity) && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation) && sameRegistrationSignerSet(left.signer_set, right.signer_set) && sameRegistrationRecipientKeys(left.deriver_recipient_keys, right.deriver_recipient_keys) && left.router_id === right.router_id && left.client_id === right.client_id && left.activation_epoch === right.activation_epoch && left.registration_request_digest_b64u === right.registration_request_digest_b64u && left.proof_transcript_digest_b64u === right.proof_transcript_digest_b64u;
-}
 function asciiBytes(value) {
 	return new TextEncoder().encode(requireAsciiNonEmptyString(value, "canonical string"));
 }
@@ -1328,6 +920,6 @@ async function parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreReques
 	return response;
 }
 //#endregion
-export { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreRequestV1, parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaExplicitExportForwardedResponseV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaOperationStepUpAuthorizationResponseV1, parseRouterAbEcdsaOperationStepUpPreparationV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaRegistrationPublicActivationReceiptV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaSigningWorkerExportShareEnvelopeV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1, requireRouterAbEcdsaDerivationNormalSigningStateV1, routerAbEcdsaDerivationActiveStateId, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1, routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1, routerAbEcdsaRerandomizationClientCommitmentV1, sameRegistrationRecipientKeys, sameRegistrationSignerSet, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire, sameRouterAbServerIdentityV1 };
+export { ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreRequestV1, parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaOperationStepUpAuthorizationResponseV1, parseRouterAbEcdsaOperationStepUpPreparationV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1, requireRouterAbEcdsaDerivationNormalSigningStateV1, routerAbEcdsaDerivationActiveStateId, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1, routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1, routerAbEcdsaRerandomizationClientCommitmentV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbServerIdentityV1 };
 
 //# sourceMappingURL=routerAbEcdsaDerivation.js.map