@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/SeamsWeb/operations/registration/registrationEd25519Yao.js

@@ -1,166 +0,0 @@
-import { parseThresholdEd25519SessionId } from "../../../shared-ts/src/utils/domainIds.js";
-import { toAccountId } from "../../../core/types/accountIds.js";
-import { parseNearEd25519SigningKeyId } from "../../../shared-ts/src/utils/registrationIds.js";
-import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { RouterAbEd25519YaoHttpActivationTransportV1 } from "../../../core/signingEngine/threshold/ed25519/yaoClient.js";
-import { buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { emailOtpAuthContextProviderUserId } from "../../../core/signingEngine/session/identity/laneIdentity.js";
-import { buildRouterAbEd25519SigningWalletSession } from "../../../core/signingEngine/session/routerAbSigningWalletSession.js";
-import { buildEmailOtpRouterAbEd25519WalletSessionState } from "../../../core/signingEngine/session/warmCapabilities/routerAbEd25519WalletSessionState.js";
-import { buildPasskeyEd25519RestoreMetadata } from "../../../core/signingEngine/session/passkey/ed25519YaoSealedSession.js";
-import { assertNever, recordNearRegistrationSessionTiming } from "./registrationTiming.js";
-import { sameRuntimePolicyScope } from "./registrationStrictEcdsa.js";
-//#region src/SeamsWeb/operations/registration/registrationEd25519Yao.ts
-function passkeyWalletAuthAuthorityFromCredential(args) {
-	return buildPasskeyWalletAuthAuthority({
-		walletId: args.walletId,
-		rpId: args.rpId,
-		credentialIdB64u: String(args.credential.rawId || args.credential.id || "").trim()
-	});
-}
-async function requireEmailOtpRegistrationEnrollmentMaterial(input) {
-	if (!input.material) throw new Error(`Email OTP registration ${input.operation} is missing enrollment material`);
-	return await input.material;
-}
-function registrationEd25519MaterialFacts(args) {
-	const admission = args.deferredNear.admissionRequest;
-	const thresholdSessionId = parseThresholdEd25519SessionId(admission.scope.threshold_session_id);
-	if (!thresholdSessionId.ok) throw new Error("Ed25519 registration threshold-session identity is invalid");
-	const participantIds = admission.participant_ids;
-	const finalizedRuntimePolicyScope = normalizeRuntimePolicyScope(args.finalized.runtimePolicyScope);
-	if (admission.application_binding.wallet_id !== args.walletId || admission.application_binding.near_ed25519_signing_key_id !== args.finalized.nearEd25519SigningKeyId || admission.application_binding.key_creation_signer_slot !== args.finalized.signerSlot || participantIds[0] !== args.finalized.participantIds[0] || participantIds[1] !== args.finalized.participantIds[1] || !sameRuntimePolicyScope(finalizedRuntimePolicyScope, args.expectedRuntimePolicyScope) || admission.application_binding.signing_root_id !== `${finalizedRuntimePolicyScope.projectId}:${finalizedRuntimePolicyScope.envId}` || admission.scope.root_share_epoch !== finalizedRuntimePolicyScope.signingRootVersion || admission.scope.signing_worker_id !== args.finalized.routerAbNormalSigning.signingWorkerId || args.finalized.relayerKeyId !== args.finalized.routerAbNormalSigning.signingWorkerId) throw new Error("Ed25519 registration material changed the admitted signer identity");
-	return {
-		identity: {
-			walletId: String(args.walletId),
-			nearAccountId: args.finalized.nearAccountId,
-			nearEd25519SigningKeyId: args.finalized.nearEd25519SigningKeyId,
-			thresholdSessionId: thresholdSessionId.value,
-			signerSlot: args.finalized.signerSlot,
-			signingRootId: admission.application_binding.signing_root_id,
-			signingRootVersion: admission.scope.root_share_epoch,
-			signingWorkerId: admission.scope.signing_worker_id
-		},
-		stableServerScope: {
-			relayerKeyId: args.finalized.relayerKeyId,
-			participantIds: args.finalized.participantIds,
-			runtimePolicyScope: finalizedRuntimePolicyScope,
-			routerAbNormalSigning: args.finalized.routerAbNormalSigning
-		}
-	};
-}
-function registrationEstablishedEd25519Session(session) {
-	switch (session.tokens.kind) {
-		case "near_ed25519":
-		case "near_ed25519_and_evm_family_ecdsa": return session.tokens.ed25519;
-		case "evm_family_ecdsa": throw new Error("Registration-established session is missing Ed25519 authorization");
-		default: return assertNever(session.tokens);
-	}
-}
-async function buildRegistrationEmailOtpEd25519SessionState(args) {
-	const token = registrationEstablishedEd25519Session(args.registrationEstablishedSession);
-	if (token.nearAccountId !== String(args.nearAccountId) || token.nearEd25519SigningKeyId !== String(args.nearEd25519SigningKeyId) || token.thresholdSessionId !== String(args.thresholdSessionId) || !sameRuntimePolicyScope(token.runtimePolicyScope, args.runtimePolicyScope)) throw new Error("Registration-established Email OTP Ed25519 session changed signer identity");
-	const signingRoot = signingRootScopeFromRuntimePolicyScope(token.runtimePolicyScope);
-	const signingRootVersion = signingRoot.signingRootVersion;
-	if (!signingRootVersion) throw new Error("Registration-established Ed25519 session is missing a signing-root version");
-	const signingWalletSession = buildRouterAbEd25519SigningWalletSession({
-		walletId: String(args.walletId),
-		nearAccountId: String(args.nearAccountId),
-		nearEd25519SigningKeyId: String(args.nearEd25519SigningKeyId),
-		walletSessionId: String(args.registrationEstablishedSession.walletSessionId),
-		authorizationId: String(args.registrationEstablishedSession.authorizationId),
-		quotaId: String(args.registrationEstablishedSession.quotaId),
-		thresholdSessionId: token.thresholdSessionId,
-		remainingUses: args.registrationEstablishedSession.remainingUses,
-		expiresAtMs: args.registrationEstablishedSession.expiresAtMs,
-		runtimePolicyScope: token.runtimePolicyScope,
-		signingRootId: signingRoot.signingRootId,
-		signingRootVersion,
-		routerAbNormalSigning: token.routerAbNormalSigning,
-		walletSessionToken: args.registrationEstablishedSession.operationCredential.token,
-		nowMs: Date.now()
-	});
-	if (!signingWalletSession.ok) throw new Error(`Registration-established Email OTP Ed25519 session is unusable (${signingWalletSession.reason})`);
-	const authority = await walletAuthAuthorityRef({ authority: args.emailOtpAuthContext.authority });
-	return buildEmailOtpRouterAbEd25519WalletSessionState({
-		walletId: args.walletId,
-		nearAccountId: toAccountId(args.nearAccountId),
-		nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(args.nearEd25519SigningKeyId),
-		providerSubjectId: emailOtpAuthContextProviderUserId(args.emailOtpAuthContext),
-		signerSlot: args.signerSlot,
-		relayerUrl: args.relayerUrl,
-		authority,
-		signingWalletSession: signingWalletSession.value
-	});
-}
-function requirePasskeyRegistrationIntent(intent) {
-	if (intent.authMethod.kind !== "passkey") throw new Error("Ed25519 Yao registration requires a passkey registration intent");
-	return {
-		version: intent.version,
-		walletId: intent.walletId,
-		authMethod: intent.authMethod,
-		signerSelection: intent.signerSelection,
-		foundingWalletAuthMethodId: intent.foundingWalletAuthMethodId,
-		...intent.runtimePolicyScope ? { runtimePolicyScope: intent.runtimePolicyScope } : {},
-		nonceB64u: intent.nonceB64u
-	};
-}
-function requireEd25519YaoRegistrationPublicResultMatches(args) {
-	if (args.finalized.authMethod.kind !== "passkey" || args.finalized.rpId !== args.expectedRpId) throw new Error("Ed25519 Yao finalize returned a different passkey authority");
-	if (args.finalized.walletId !== args.expectedWalletId) throw new Error("Ed25519 Yao finalize returned a different wallet");
-	if (args.finalized.ed25519.publicKey !== args.clientPublicKey || args.finalized.ed25519.nearEd25519SigningKeyId !== args.finalized.resolvedAccount.nearEd25519SigningKeyId || args.finalized.ed25519.nearAccountId !== args.finalized.resolvedAccount.nearAccountId) throw new Error("Ed25519 Yao finalize returned mismatched signer identity");
-	return {
-		rpId: args.finalized.rpId,
-		credentialIdB64u: args.finalized.authMethod.credentialIdB64u
-	};
-}
-function requireEmailOtpEd25519YaoRegistrationPublicResultMatches(args) {
-	if (args.finalized.authMethod.kind !== "email_otp" || args.finalized.authMethod.registrationAuthorityId !== args.expectedRegistrationAuthorityId) throw new Error("Ed25519 Yao finalize returned a different Email OTP authority");
-	if (args.finalized.walletId !== args.expectedWalletId) throw new Error("Ed25519 Yao finalize returned a different wallet");
-	if (args.finalized.ed25519.publicKey !== args.clientPublicKey || args.finalized.ed25519.nearEd25519SigningKeyId !== args.finalized.resolvedAccount.nearEd25519SigningKeyId || args.finalized.ed25519.nearAccountId !== args.finalized.resolvedAccount.nearAccountId) throw new Error("Ed25519 Yao finalize returned mismatched signer identity");
-}
-async function admitDeferredNearRegistration(work, transportConfig) {
-	const response = await new RouterAbEd25519YaoHttpActivationTransportV1(transportConfig).send({
-		kind: "admit",
-		path: ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1,
-		body: work.admissionRequest
-	});
-	if (!response.ok) throw new Error(response.message);
-	const receipt = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(response.value);
-	if (!receipt.ok) throw new Error(receipt.message);
-	return receipt.value;
-}
-function buildRegistrationPasskeyEd25519SessionHydration(args) {
-	const ed25519 = registrationEstablishedEd25519Session(args.session);
-	return {
-		thresholdSessionId: String(ed25519.thresholdSessionId),
-		prfFirstB64u: args.prfFirstB64u,
-		expiresAtMs: args.session.expiresAtMs,
-		remainingUses: args.session.remainingUses,
-		diagnostics: { recordDuration: recordNearRegistrationSessionTiming.bind(void 0, args.ceremonyId) },
-		...args.preparedServerSeal ? { preparedServerSeal: args.preparedServerSeal } : {},
-		transport: {
-			curve: "ed25519",
-			authMethod: "passkey",
-			walletId: args.walletId,
-			relayerUrl: args.relayerUrl,
-			walletSessionToken: args.session.operationCredential.token,
-			ed25519Restore: buildPasskeyEd25519RestoreMetadata({
-				rpId: args.restore.rpId,
-				nearAccountId: args.restore.nearAccountId,
-				nearEd25519SigningKeyId: args.restore.nearEd25519SigningKeyId,
-				relayerKeyId: args.restore.relayerKeyId,
-				participantIds: args.restore.participantIds,
-				runtimePolicyScope: ed25519.runtimePolicyScope,
-				signerSlot: args.restore.signerSlot,
-				routerAbNormalSigning: ed25519.routerAbNormalSigning,
-				credentialIdB64u: args.restore.credentialIdB64u,
-				materialActivation: args.restore.materialActivation
-			})
-		}
-	};
-}
-//#endregion
-export { admitDeferredNearRegistration, buildRegistrationEmailOtpEd25519SessionState, buildRegistrationPasskeyEd25519SessionHydration, passkeyWalletAuthAuthorityFromCredential, registrationEd25519MaterialFacts, requireEd25519YaoRegistrationPublicResultMatches, requireEmailOtpEd25519YaoRegistrationPublicResultMatches, requireEmailOtpRegistrationEnrollmentMaterial, requirePasskeyRegistrationIntent };
-
-//# sourceMappingURL=registrationEd25519Yao.js.map

package/dist/esm/SeamsWeb/operations/registration/registrationSignerSet.js

@@ -1,60 +0,0 @@
-import { parseNamedNearAccountId } from "../../../shared-ts/src/utils/near.js";
-import { THRESHOLD_ED25519_2P_PARTICIPANT_IDS } from "../../../shared-ts/src/threshold/participants.js";
-import { implicitNearAccountProvisioning, sponsoredNamedNearAccountProvisioning } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
-import { listThresholdEcdsaProvisionTargets } from "../session/thresholdEcdsaProvisioning.js";
-import { THRESHOLD_SECP256K1_ECDSA_2P_PARTICIPANT_IDS_V1 } from "../../../shared-ts/src/threshold/secp256k1.js";
-//#region src/SeamsWeb/operations/registration/registrationSignerSet.ts
-function buildNearWalletRegistrationSignerSetSelection(args) {
-	const ed25519 = {
-		kind: "near_ed25519",
-		accountProvisioning: args.accountProvisioning ?? implicitNearAccountProvisioning(),
-		signerSlot: 1,
-		participantIds: [...THRESHOLD_ED25519_2P_PARTICIPANT_IDS],
-		derivationVersion: 1
-	};
-	const ecdsaChainTargets = args.ecdsaChainTargets ?? listThresholdEcdsaProvisionTargets({
-		signerOptions: args.options.signerOptions ?? args.configs.signing.thresholdEcdsa.provisioningDefaults,
-		chains: args.configs.network.chains
-	}).map((target) => target.chainTarget);
-	if (!ecdsaChainTargets.length) return {
-		kind: "signer_set",
-		signers: [ed25519]
-	};
-	return {
-		kind: "signer_set",
-		signers: [ed25519, {
-			kind: "evm_family_ecdsa",
-			chainTargets: [...ecdsaChainTargets],
-			participantIds: [...THRESHOLD_SECP256K1_ECDSA_2P_PARTICIPANT_IDS_V1]
-		}]
-	};
-}
-function sponsoredNamedRegistrationProvisioningFromAccountId(nearAccountId) {
-	const parsed = parseNamedNearAccountId(nearAccountId);
-	if (!parsed.ok) throw new Error(parsed.message);
-	return sponsoredNamedNearAccountProvisioning(parsed.value);
-}
-function relayerNamedSubaccountProvisioningFromWalletId(args) {
-	const walletId = String(args.walletId || "").trim();
-	const relayerAccountId = String(args.relayerAccountId || "").trim();
-	if (!walletId) throw new Error("Relayer named NEAR registration requires walletId");
-	if (!relayerAccountId) throw new Error("Relayer named NEAR registration requires relayer accountId");
-	return sponsoredNamedRegistrationProvisioningFromAccountId(`${walletId}.${relayerAccountId}`);
-}
-function resolvePasskeyRegistrationAccountProvisioning(args) {
-	const preference = args.preference ?? args.configs.registration.nearAccountProvisioning;
-	switch (preference.kind) {
-		case "implicit_account": return implicitNearAccountProvisioning();
-		case "relayer_named_subaccount":
-			if (args.wallet.kind !== "provided") throw new Error("Relayer named NEAR registration requires a provided walletId");
-			return relayerNamedSubaccountProvisioningFromWalletId({
-				walletId: args.wallet.walletId,
-				relayerAccountId: args.configs.network.relayer.accountId
-			});
-		default: return preference;
-	}
-}
-//#endregion
-export { buildNearWalletRegistrationSignerSetSelection, resolvePasskeyRegistrationAccountProvisioning };
-
-//# sourceMappingURL=registrationSignerSet.js.map

package/dist/esm/SeamsWeb/operations/registration/registrationStrictEcdsa.js

@@ -1,343 +0,0 @@
-import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
-import { parseCorrelationId, parseDigestB64u, parseIsoTimestamp } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { thresholdEcdsaChainTargetKey } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
-import { requireEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
-import "../../../shared-ts/src/signing-lanes/index.js";
-import { toParticipantId } from "../../../core/signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
-import { isRegistrationBenchmarkDiagnosticsEnabled } from "../../../core/signingEngine/walletCustody/ceremonyDriver.js";
-import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
-import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { parseEcdsaRelayerKeyId } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
-import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRoleLocalBindingDigest, parseEcdsaThresholdKeyId } from "../../../core/signingEngine/session/keyMaterialBrands.js";
-import { parseRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { activateWalletAddSignerEcdsa, parseWalletRegistrationEcdsaDerivationRespond, respondWalletAddSignerEcdsa } from "../../../core/rpcClients/relayer/walletRegistration.js";
-import { assertNever } from "./registrationTiming.js";
-import { buildCanonicalWalletAddSignerEcdsaActivationRequest, computeWalletAddSignerEcdsaActivationRequestDigestB64u } from "../../../shared-ts/src/utils/walletAddSignerActivation.js";
-import { joinCustodyWireFromEnvelopeRecord } from "../../../core/signingEngine/walletCustody/joinCustodyWire.js";
-//#region src/SeamsWeb/operations/registration/registrationStrictEcdsa.ts
-/**
-* Strict Router A/B ECDSA family registration: the ceremony, its activation
-* commit, and the wallet-key assertions that guard it.
-*
-* Moved verbatim out of `registration.ts`. This module drives one protocol; it
-* does not decide which protocols a registration runs, which is why the
-* three-route orchestration stayed behind.
-*/
-function registrationRouteHeaders(traceContext) {
-	const headers = {};
-	if (isRegistrationBenchmarkDiagnosticsEnabled()) headers["X-Seams-Benchmark-Diagnostics"] = "registration-flow";
-	if (traceContext) headers[ROUTER_AB_TRACE_ID_HEADER_V1] = traceContext.value;
-	return Object.keys(headers).length > 0 ? headers : void 0;
-}
-function ethereumAddressFromAddress20B64u(value) {
-	const bytes = base64UrlDecode(value);
-	if (bytes.length !== 20) throw new Error("ECDSA activation returned an invalid address");
-	let hex = "";
-	for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
-	return `0x${hex}`;
-}
-var RegistrationExactMethodUnlockRequiredError = class extends Error {
-	constructor(projection) {
-		super("Registration response was already committed; exact-method unlock is required");
-		this.code = "wallet_unlock_required";
-		this.next = "unlock_exact_method";
-		this.name = "RegistrationExactMethodUnlockRequiredError";
-		this.projection = projection;
-	}
-};
-function requireIssuedRegistrationEstablishedSession(result) {
-	switch (result.kind) {
-		case "issued": return result.session;
-		case "already_committed": throw new RegistrationExactMethodUnlockRequiredError(result.session);
-		default: return assertNever(result);
-	}
-}
-function assertSharedRegistrationEvmFamilyWalletKeyMaterial(walletKeys) {
-	const first = walletKeys[0];
-	if (!first) return;
-	for (const walletKey of walletKeys.slice(1)) {
-		const mismatch = firstRegistrationEvmFamilyWalletKeyMaterialMismatch(first, walletKey);
-		if (mismatch) throw new Error(`ECDSA registration returned partitioned EVM-family wallet key material: ${mismatch}`);
-	}
-}
-function assertRegistrationWalletKeyCapabilities(args) {
-	for (const walletKey of args.walletKeys) if (!sameRouterAbEcdsaDerivationPublicCapabilityV1(walletKey.publicCapability, args.session.publicCapability)) throw new Error("ECDSA registration wallet key public capability does not match client-verified activation");
-}
-function firstRegistrationEvmFamilyWalletKeyMaterialMismatch(left, right) {
-	if (left.keyScope !== "evm-family" || right.keyScope !== "evm-family") return "keyScope";
-	if (left.walletId !== right.walletId) return "walletId";
-	if (left.evmFamilySigningKeySlotId !== right.evmFamilySigningKeySlotId) return "evmFamilySigningKeySlotId";
-	if (left.keyHandle !== right.keyHandle) return "keyHandle";
-	if (left.ecdsaThresholdKeyId !== right.ecdsaThresholdKeyId) return "ecdsaThresholdKeyId";
-	if (left.signingRootId !== right.signingRootId) return "signingRootId";
-	if (left.signingRootVersion !== right.signingRootVersion) return "signingRootVersion";
-	if (left.thresholdEcdsaPublicKeyB64u !== right.thresholdEcdsaPublicKeyB64u) return "thresholdEcdsaPublicKeyB64u";
-	if (left.thresholdOwnerAddress.trim().toLowerCase() !== right.thresholdOwnerAddress.trim().toLowerCase()) return "thresholdOwnerAddress";
-	if (left.relayerKeyId !== right.relayerKeyId) return "relayerKeyId";
-	if (left.relayerVerifyingShareB64u !== right.relayerVerifyingShareB64u) return "relayerVerifyingShareB64u";
-	if (left.participantIds.join(",") !== right.participantIds.join(",")) return "participantIds";
-	return null;
-}
-function registrationChainTargetListsMatch(left, right) {
-	if (left.length !== right.length) return false;
-	for (let index = 0; index < left.length; index += 1) {
-		const leftTarget = left[index];
-		const rightTarget = right[index];
-		if (!leftTarget || !rightTarget) return false;
-		if (thresholdEcdsaChainTargetKey(leftTarget) !== thresholdEcdsaChainTargetKey(rightTarget)) return false;
-	}
-	return true;
-}
-async function closeStrictEcdsaRegistrationCeremony(args) {
-	try {
-		await args.context.signingEngine.closeRouterAbEcdsaRegistrationCeremony({
-			kind: "close_router_ab_ecdsa_registration_ceremony_v1",
-			ceremonyId: args.ceremonyId
-		});
-	} catch {
-		return;
-	}
-}
-function buildStrictRegistrationClientBootstrap(args) {
-	const prepare = args.prepare;
-	return {
-		formatVersion: prepare.formatVersion,
-		walletId: prepare.walletId,
-		evmFamilySigningKeySlotId: prepare.evmFamilySigningKeySlotId,
-		ecdsaThresholdKeyId: prepare.ecdsaThresholdKeyId,
-		signingRootId: prepare.signingRootId,
-		signingRootVersion: prepare.signingRootVersion,
-		keyScope: prepare.keyScope,
-		relayerKeyId: prepare.relayerKeyId,
-		registrationPreparationId: prepare.registrationPreparationId,
-		requestId: prepare.requestId,
-		thresholdSessionId: prepare.thresholdSessionId,
-		ttlMs: prepare.ttlMs,
-		remainingUses: prepare.remainingUses,
-		participantIds: [...prepare.participantIds],
-		runtimePolicyScope: prepare.runtimePolicyScope,
-		derivationClientSharePublicKey33B64u: args.verified.derivationClientSharePublicKey33B64u,
-		clientShareRetryCounter: args.verified.clientShareRetryCounter,
-		contextBinding32B64u: args.verified.contextBinding32B64u
-	};
-}
-/**
-* The client-computed activation command — the add-signer counterpart of
-* registration's `buildThreeRouteCanonicalActivationCommand`. The digest the
-* server used to hand back from the deleted activate/prepare route is now
-* derived locally from the canonical command, journaled, and asserted against
-* the receipt at finalize.
-*/
-async function buildAddSignerCanonicalActivationCommand(args) {
-	return {
-		canonicalRequest: buildCanonicalWalletAddSignerEcdsaActivationRequest(args),
-		requestDigest: parseDigestB64u(await computeWalletAddSignerEcdsaActivationRequestDigestB64u(args))
-	};
-}
-async function activateAddSignerEcdsaWithReplayReconciliation(args) {
-	try {
-		return await activateWalletAddSignerEcdsa(args);
-	} catch {
-		return await activateWalletAddSignerEcdsa(args);
-	}
-}
-async function measureStrictEcdsaCeremonyStep(args) {
-	if (!args.registrationTiming) return await args.operation();
-	return await args.registrationTiming.measure(args.bucket, args.operation);
-}
-async function runStrictEcdsaFamilyCeremony(args) {
-	const [firstChainTarget, ...remainingChainTargets] = args.started.chainTargets;
-	if (!firstChainTarget) throw new Error("Strict ECDSA ceremony requires at least one EVM-family target");
-	const ceremonyId = args.addSignerCeremonyId;
-	const activationCorrelationId = parseCorrelationId(ceremonyId);
-	try {
-		const created = await measureStrictEcdsaCeremonyStep({
-			registrationTiming: args.registrationTiming,
-			bucket: "ecdsaRegistrationClientCreateMs",
-			operation: args.context.signingEngine.createRouterAbEcdsaRegistrationCeremony.bind(args.context.signingEngine, {
-				kind: "create_router_ab_ecdsa_registration_ceremony_v1",
-				ceremonyId,
-				registration: args.started.strictRegistration
-			})
-		});
-		const forwarded = await measureStrictEcdsaCeremonyStep({
-			registrationTiming: args.registrationTiming,
-			bucket: "ecdsaRegistrationGatewayRespondMs",
-			operation: respondWalletAddSignerEcdsa.bind(void 0, {
-				relayerUrl: args.relayerUrl,
-				walletId: args.walletId,
-				addSignerCeremonyId: ceremonyId,
-				ecdsa: {
-					kind: "router_ab_ecdsa_registration_v1",
-					strictRegistration: created.registrationRequest,
-					requestDigestB64u: created.registrationRequestDigestB64u
-				}
-			})
-		});
-		const verified = await measureStrictEcdsaCeremonyStep({
-			registrationTiming: args.registrationTiming,
-			bucket: "ecdsaRegistrationClientProofVerifyMs",
-			operation: args.context.signingEngine.verifyRouterAbEcdsaRegistrationClientProofs.bind(args.context.signingEngine, {
-				kind: "verify_router_ab_ecdsa_registration_client_proofs_v1",
-				bootstrapOwner: "wallet_custody",
-				ceremonyId,
-				clientProofFinalization: {
-					kind: "finalize_encrypted_client_proof_bundles_v2",
-					bundles: forwarded.ecdsa.strictResult.response.bundles
-				}
-			})
-		});
-		const custodyWire = joinCustodyWireFromEnvelopeRecord(args.custodyEnvelope);
-		if (!custodyWire.ok) throw new Error(custodyWire.reason);
-		const activation = {
-			response: null,
-			journalId: null
-		};
-		const joined = await args.context.signingEngine.joinWalletCustodyEvmFamilyKeySet({
-			walletId: args.walletId,
-			custodyJson: custodyWire.custodyJson,
-			factorSecret: args.factorSecret,
-			evmFamilySigningKeySlotId: args.started.prepare.evmFamilySigningKeySlotId,
-			applicationBindingDigestB64u: verified.applicationBindingDigestB64u,
-			runRelayerRound: async (bootstrap) => {
-				const publicFacts = parseRouterAbEcdsaVerifiedClientActivationFactsV1({
-					registrationRequestDigestB64u: verified.registrationRequestDigestB64u,
-					proofTranscriptDigestB64u: verified.proofTranscriptDigestB64u,
-					contextBinding32B64u: bootstrap.contextBinding32B64u,
-					derivationClientSharePublicKey33B64u: bootstrap.clientSharePublicKey33B64u,
-					clientShareRetryCounter: bootstrap.clientShareRetryCounter,
-					participantId: 1
-				});
-				const activationCommand = await buildAddSignerCanonicalActivationCommand({
-					addSignerCeremonyId: ceremonyId,
-					activationCorrelationId,
-					publicFacts
-				});
-				const expectedActivationRequestDigest = { bytes: Array.from(base64UrlDecode(String(activationCommand.requestDigest))) };
-				const persisted = await args.context.signingEngine.persistInitialCanonicalEcdsaActivation({
-					kind: "persist_initial_canonical_ecdsa_activation_v1",
-					bootstrapOwner: "wallet_custody",
-					ceremonyId,
-					clientActivation: publicFacts,
-					planInput: {
-						authority: args.authority,
-						targetMemberships: [firstChainTarget, ...remainingChainTargets],
-						evmFamilySigningKeySlotId: requireEvmFamilySigningKeySlotId(args.started.prepare.evmFamilySigningKeySlotId, "registration ECDSA signing key slot"),
-						ecdsaThresholdKeyId: parseEcdsaThresholdKeyId(args.started.prepare.ecdsaThresholdKeyId),
-						signingRootId: parseSdkEcdsaDerivationSigningRootId(args.started.prepare.signingRootId),
-						signingRootVersion: parseSdkEcdsaDerivationSigningRootVersion(args.started.prepare.signingRootVersion),
-						runtimePolicyScope: args.started.prepare.runtimePolicyScope,
-						clientVerifyingPublicKey33B64u: parseEcdsaClientVerifyingPublicKey33B64u(bootstrap.clientSharePublicKey33B64u),
-						participantIds: [toParticipantId(args.started.prepare.participantIds[0]), toParticipantId(args.started.prepare.participantIds[1])],
-						relayerKeyId: parseEcdsaRelayerKeyId(args.started.prepare.relayerKeyId),
-						bindingDigest: parseEcdsaRoleLocalBindingDigest(bootstrap.contextBinding32B64u),
-						journalId: activationCorrelationId,
-						requestDigest: activationCommand.requestDigest,
-						canonicalRequest: activationCommand.canonicalRequest,
-						createdAt: parseIsoTimestamp((/* @__PURE__ */ new Date()).toISOString())
-					}
-				});
-				if (!persisted.ok) throw new Error(`Canonical ECDSA activation persistence failed (${persisted.code}): ${persisted.message}`);
-				activation.journalId = persisted.journalId;
-				activation.response = await measureStrictEcdsaCeremonyStep({
-					registrationTiming: args.registrationTiming,
-					bucket: "ecdsaRegistrationGatewayActivateMs",
-					operation: activateAddSignerEcdsaWithReplayReconciliation.bind(void 0, {
-						relayerUrl: args.relayerUrl,
-						walletId: args.walletId,
-						addSignerCeremonyId: ceremonyId,
-						activationCorrelationId,
-						publicFacts,
-						expectedActivationRequestDigest
-					})
-				});
-				const identity = activation.response.ecdsa.activation.ecdsa_activation.public_identity;
-				return JSON.stringify({
-					relayerKeyId: args.started.prepare.relayerKeyId,
-					relayerPublicKey33B64u: identity.server_public_key33_b64u,
-					groupPublicKey33B64u: identity.threshold_public_key33_b64u,
-					ethereumAddress: ethereumAddressFromAddress20B64u(identity.ethereum_address20_b64u),
-					relayerShareRetryCounter: identity.server_share_retry_counter
-				});
-			}
-		});
-		if (!activation.response || !activation.journalId) throw new Error("Add-signer ECDSA custody join did not activate");
-		const activated = activation.response;
-		const journalId = activation.journalId;
-		const clientRootPublicKey33B64u = joined.commitPayload.clientRootPublicKey33B64u;
-		if (!clientRootPublicKey33B64u) throw new Error("Add-signer ECDSA custody join returned no client root public key");
-		const clientBootstrap = buildStrictRegistrationClientBootstrap({
-			prepare: args.started.prepare,
-			verified: joined.clientBootstrap
-		});
-		const bootstrap = parseWalletRegistrationEcdsaDerivationRespond({
-			clientBootstrap,
-			serverBootstrap: activated.ecdsa.bootstrap,
-			activationEpoch: activated.ecdsa.activation.ecdsa_activation.activation_epoch
-		});
-		return {
-			chainTargets: [firstChainTarget, ...remainingChainTargets],
-			clientBootstrap,
-			bootstrap,
-			activatedThresholdSessionId: activated.ecdsa.bootstrap.thresholdSessionId,
-			journalId,
-			activationReceipt: activated.ecdsa.activation,
-			custodyKeySet: {
-				kind: "evm_family_ecdsa_v1",
-				keyManifestDigestB64u: joined.commitPayload.keyManifestDigestB64u,
-				clientRootPublicKey33B64u
-			},
-			custodyLocalMaterial: joined.localMaterial
-		};
-	} catch (error) {
-		await closeStrictEcdsaRegistrationCeremony({
-			context: args.context,
-			ceremonyId
-		});
-		throw error;
-	}
-}
-async function finalizeStrictEcdsaFamilyLocalActivation(args) {
-	const finalized = await args.context.signingEngine.finalizeRouterAbEcdsaRegistrationActivation({
-		kind: "finalize_router_ab_ecdsa_registration_activation_v1",
-		bootstrapOwner: "wallet_custody",
-		journalId: args.pending.journalId,
-		activationReceipt: args.pending.activationReceipt,
-		routerAbEcdsaDerivationNormalSigning: args.pending.bootstrap.routerAbEcdsaDerivationNormalSigning,
-		readyStateBlobB64u: args.pending.custodyLocalMaterial.readyStateBlobB64u,
-		walletCustodyPublicFacts: args.pending.custodyLocalMaterial.publicFacts
-	});
-	return {
-		chainTargets: args.pending.chainTargets,
-		authority: finalized.authority,
-		clientBootstrap: args.pending.clientBootstrap,
-		bootstrap: args.pending.bootstrap,
-		activatedThresholdSessionId: args.pending.activatedThresholdSessionId,
-		roleLocalMaterial: finalized.roleLocalMaterial,
-		materialActivation: finalized.materialActivation,
-		clientPublicFacts: finalized.publicFacts,
-		publicCapability: finalized.publicCapability
-	};
-}
-function registrationEstablishedEcdsaSession(session) {
-	switch (session.tokens.kind) {
-		case "evm_family_ecdsa":
-		case "near_ed25519_and_evm_family_ecdsa": return session.tokens.ecdsa;
-		case "near_ed25519": throw new Error("Registration-established session is missing ECDSA authorization");
-		default: return assertNever(session.tokens);
-	}
-}
-function assertRegistrationEcdsaSessionMatchesWalletKeys(args) {
-	const [firstWalletKey] = args.walletKeys;
-	if (!firstWalletKey) throw new Error("ECDSA registration did not return wallet key material");
-	const token = registrationEstablishedEcdsaSession(args.session.registrationEstablishedSession);
-	if (String(args.session.registrationEstablishedSession.walletId) !== firstWalletKey.walletId || token.thresholdSessionId !== args.session.activatedThresholdSessionId || token.keyHandle !== firstWalletKey.keyHandle || !sameRuntimePolicyScope(token.runtimePolicyScope, args.session.clientBootstrap.runtimePolicyScope) || !sameRouterAbEcdsaDerivationNormalSigningStateV1(token.routerAbEcdsaDerivationNormalSigning, args.session.bootstrap.routerAbEcdsaDerivationNormalSigning)) throw new Error("Registration-established ECDSA session changed the signer identity");
-	for (const walletKey of args.walletKeys) if (walletKey.walletId !== firstWalletKey.walletId || walletKey.keyHandle !== token.keyHandle || walletKey.ecdsaThresholdKeyId !== firstWalletKey.ecdsaThresholdKeyId) throw new Error("ECDSA registration material changed the established session identity");
-}
-function sameRuntimePolicyScope(left, right) {
-	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
-//#endregion
-export { assertRegistrationEcdsaSessionMatchesWalletKeys, assertRegistrationWalletKeyCapabilities, assertSharedRegistrationEvmFamilyWalletKeyMaterial, buildStrictRegistrationClientBootstrap, closeStrictEcdsaRegistrationCeremony, finalizeStrictEcdsaFamilyLocalActivation, measureStrictEcdsaCeremonyStep, registrationChainTargetListsMatch, registrationRouteHeaders, requireIssuedRegistrationEstablishedSession, runStrictEcdsaFamilyCeremony, sameRuntimePolicyScope };
-
-//# sourceMappingURL=registrationStrictEcdsa.js.map