@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/core/rpcClients/relayer/passkeyCustodyEnvelope.js

@@ -1,218 +0,0 @@
-import { buildBearerAuthorizationHeader, buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
-import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
-import "../../../shared-ts/src/passkey-custody/index.js";
-//#region src/core/rpcClients/relayer/passkeyCustodyEnvelope.ts
-/**
-* Fetching a wallet's custody envelope from a device that has none.
-*
-* The server route answers with a distinct status per failure, and this keeps
-* them distinct. Collapsing them into one error is the tempting shape and the
-* wrong one: "this credential no longer opens the wallet" is something the
-* user can act on, "no envelope exists here" means they should register, and a
-* digest mismatch is an incident. A single `throw` makes all three read as
-* "unlock failed", which is how a recoverable state becomes a support ticket.
-*
-* The response is ciphertext. Opening it needs the PRF-derived KEK, which
-* exists only inside the signing worker — nothing here can read what it
-* fetches, and that is why the envelope may cross the network at all.
-*/
-const PASSKEY_CUSTODY_ENVELOPE_PATH = "/wallets/custody/envelope";
-async function fetchPasskeyCustodyEnvelope(args) {
-	const url = `${normalizeRelayerBaseUrl(args.relayUrl)}${PASSKEY_CUSTODY_ENVELOPE_PATH}`;
-	const doFetch = args.fetchImpl || fetch;
-	let response;
-	try {
-		response = await doFetch(url, buildRelayerJsonPostRequestInit({ body: {
-			locator: args.locator,
-			challengeId: args.challengeId,
-			expectedOrigin: args.expectedOrigin,
-			webauthnAuthentication: args.webauthnAuthentication
-		} }));
-	} catch (error) {
-		return {
-			kind: "transport_failed",
-			message: error instanceof Error ? error.message : "custody envelope request failed"
-		};
-	}
-	const bodyUnknown = await response.json().catch(() => void 0);
-	if (response.status === 200 && responseDeclaresSuccess(bodyUnknown)) try {
-		return {
-			kind: "active",
-			envelope: decodePasskeyCustodyEnvelopeResponse(bodyUnknown).envelope
-		};
-	} catch {
-		return {
-			kind: "corrupt",
-			message: "custody envelope response was incomplete"
-		};
-	}
-	const failure = decodeFailureResponse(bodyUnknown, "custody envelope response");
-	const code = failure.code ?? "";
-	const message = failure.message ?? "";
-	switch (response.status) {
-		case 404: return {
-			kind: "missing",
-			message: message || "no custody envelope for this credential"
-		};
-		case 409: return {
-			kind: "retired",
-			message: message || "this envelope was superseded"
-		};
-		case 401:
-		case 403: return {
-			kind: "credential_rejected",
-			message: message || "this credential does not open the wallet"
-		};
-		case 500:
-			if (code === "envelope_digest_mismatch") return {
-				kind: "corrupt",
-				message: message || "stored custody envelope failed its digest"
-			};
-			return {
-				kind: "transport_failed",
-				message: message || `custody envelope request failed (HTTP ${response.status})`
-			};
-		default: return {
-			kind: "request_rejected",
-			message: message || `custody envelope request rejected (HTTP ${response.status})`
-		};
-	}
-}
-async function upgradeWalletCustodyEnvelopeOwnership(args) {
-	const url = `${normalizeRelayerBaseUrl(args.relayUrl)}/wallets/${encodeURIComponent(args.walletId)}/custody/envelope/ownership`;
-	const doFetch = args.fetchImpl || fetch;
-	let response;
-	try {
-		response = await doFetch(url, buildRelayerJsonPostRequestInit({
-			body: { envelope: args.envelope },
-			headers: buildBearerAuthorizationHeader({
-				token: args.walletSessionToken,
-				missingMessage: "custody envelope upgrade needs an active Wallet Session"
-			})
-		}));
-	} catch (error) {
-		return {
-			kind: "transport_failed",
-			message: error instanceof Error ? error.message : "custody envelope upgrade failed"
-		};
-	}
-	const bodyUnknown = await response.json().catch(() => void 0);
-	if (response.status === 200) try {
-		const body = decodeOwnershipUpgradeResponse(bodyUnknown);
-		if (body.kind === "already_owned") return body;
-		const envelopeRevision = Number(body.envelopeRevision);
-		if (!Number.isSafeInteger(envelopeRevision) || envelopeRevision <= 0) throw new Error("invalid envelope revision");
-		return { kind: "upgraded" };
-	} catch {
-		return {
-			kind: "rejected",
-			message: "custody envelope upgrade returned an invalid response"
-		};
-	}
-	return {
-		kind: "rejected",
-		message: decodeFailureResponse(bodyUnknown, "custody envelope upgrade response").message || `custody envelope upgrade rejected (HTTP ${response.status})`
-	};
-}
-function decodePasskeyCustodyEnvelopeResponse(value) {
-	const response = requireExactResponseObject(value, [
-		"ok",
-		"envelope",
-		"storeVersion"
-	], "custody envelope response");
-	if (readResponseField(response, "ok") !== true) throw new Error("custody envelope response did not succeed");
-	const storeVersion = readResponseString(response, "storeVersion");
-	if (!storeVersion) throw new Error("custody envelope response is missing its store version");
-	return {
-		envelope: parsePasskeyCustodyEnvelopeRecord(readResponseField(response, "envelope"), "custody envelope response.envelope"),
-		storeVersion
-	};
-}
-function decodeOwnershipUpgradeResponse(value) {
-	const response = requireJsonObject(value, "custody envelope upgrade response");
-	const upgraded = readResponseField(response, "upgraded");
-	if (upgraded === true) {
-		requireExactResponseObject(response, [
-			"ok",
-			"upgraded",
-			"envelopeRevision"
-		], "custody envelope upgrade response");
-		if (readResponseField(response, "ok") !== true) throw new Error("custody envelope upgrade response did not succeed");
-		return {
-			kind: "upgraded",
-			envelopeRevision: readResponseField(response, "envelopeRevision")
-		};
-	}
-	if (upgraded === false) {
-		requireExactResponseObject(response, ["ok", "upgraded"], "custody envelope upgrade response");
-		if (readResponseField(response, "ok") !== true) throw new Error("custody envelope upgrade response did not succeed");
-		return { kind: "already_owned" };
-	}
-	throw new Error("custody envelope upgrade response has an invalid branch");
-}
-function decodeFailureResponse(value, label) {
-	try {
-		const response = requireJsonObject(value, label);
-		const keys = Object.keys(response);
-		if (!keys.includes("ok") || !hasAllowedResponseFields(keys, [
-			"ok",
-			"code",
-			"message"
-		])) throw new Error(`${label} has an unexpected response shape`);
-		if (readResponseField(response, "ok") !== false) throw new Error(`${label} is not a failure`);
-		return {
-			code: responseStringOrNull(response, "code"),
-			message: responseStringOrNull(response, "message")
-		};
-	} catch {
-		return {
-			code: null,
-			message: null
-		};
-	}
-}
-function responseDeclaresSuccess(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-	const prototype = Object.getPrototypeOf(value);
-	if (prototype !== Object.prototype && prototype !== null) return false;
-	const descriptor = Object.getOwnPropertyDescriptor(value, "ok");
-	return Boolean(descriptor && "value" in descriptor && descriptor.value === true);
-}
-function requireJsonObject(value, label) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} must be a JSON object`);
-	const prototype = Object.getPrototypeOf(value);
-	if (prototype !== Object.prototype && prototype !== null) throw new Error(`${label} must be a plain JSON object`);
-	return value;
-}
-function requireExactResponseObject(value, fields, label) {
-	const response = requireJsonObject(value, label);
-	const keys = Object.keys(response);
-	if (keys.length !== fields.length || !hasExactResponseFields(keys, fields)) throw new Error(`${label} has an unexpected response shape`);
-	return response;
-}
-function hasExactResponseFields(keys, fields) {
-	for (const field of fields) if (!keys.includes(field)) return false;
-	return true;
-}
-function hasAllowedResponseFields(keys, fields) {
-	for (const key of keys) if (!fields.includes(key)) return false;
-	return true;
-}
-function readResponseField(value, field) {
-	const descriptor = Object.getOwnPropertyDescriptor(value, field);
-	if (!descriptor || !("value" in descriptor)) throw new Error(`response field ${field} is missing`);
-	return descriptor.value;
-}
-function readResponseString(value, field) {
-	const raw = readResponseField(value, field);
-	return typeof raw === "string" ? raw.trim() : "";
-}
-function responseStringOrNull(value, field) {
-	const descriptor = Object.getOwnPropertyDescriptor(value, field);
-	if (!descriptor || !("value" in descriptor)) return null;
-	return (typeof descriptor.value === "string" ? descriptor.value.trim() : "") || null;
-}
-//#endregion
-export { fetchPasskeyCustodyEnvelope, upgradeWalletCustodyEnvelopeOwnership };
-
-//# sourceMappingURL=passkeyCustodyEnvelope.js.map

package/dist/esm/core/rpcClients/relayer/sealedRefreshCapabilities.js

@@ -1,148 +0,0 @@
-import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID } from "../../../shared-ts/src/utils/signingSessionSeal.js";
-import { __isWalletIframeHostMode } from "../../browser/walletIframe/host-mode.js";
-//#region src/core/rpcClients/relayer/sealedRefreshCapabilities.ts
-const DEFAULT_TIMEOUT_MS = 8e3;
-const parityCheckByConfigKey = /* @__PURE__ */ new Map();
-function decodePlainObject(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) return null;
-	return new Map(Object.entries(value));
-}
-function readOptionalNonEmptyString(fields, field) {
-	const value = fields.get(field);
-	if (typeof value !== "string") return void 0;
-	return value.trim() || void 0;
-}
-function normalizeMode(value) {
-	if (typeof value !== "string") return null;
-	const mode = value.trim().toLowerCase();
-	if (mode === "none") return "none";
-	if (mode === "sealed_refresh_v1") return "sealed_refresh_v1";
-	return null;
-}
-function normalizeSigningSessionSealCapabilities(value) {
-	const fields = decodePlainObject(value);
-	if (!fields) return null;
-	const mode = normalizeMode(fields.get("mode"));
-	if (!mode) return null;
-	if (mode === "none") return { mode: "none" };
-	const protocol = decodePlainObject(fields.get("protocol"));
-	const algorithm = protocol ? readOptionalNonEmptyString(protocol, "algorithm") : void 0;
-	const groupId = protocol ? readOptionalNonEmptyString(protocol, "groupId") : void 0;
-	const currentKeyVersion = readOptionalNonEmptyString(fields, "currentKeyVersion");
-	if (algorithm !== "shamir3pass-v2" || groupId !== "rfc2409-group2" || !currentKeyVersion) return null;
-	return {
-		mode: "sealed_refresh_v1",
-		protocol: {
-			algorithm: SIGNING_SESSION_SEAL_ALG,
-			groupId: SIGNING_SESSION_SEAL_GROUP_ID
-		},
-		currentKeyVersion
-	};
-}
-function parseWellKnownSigningSessionSealCapabilities(payload) {
-	const root = decodePlainObject(payload);
-	if (!root) return { mode: "none" };
-	const fromCapabilities = normalizeSigningSessionSealCapabilities(decodePlainObject(root.get("capabilities"))?.get("signingSessionSeal"));
-	if (fromCapabilities) return fromCapabilities;
-	return { mode: "none" };
-}
-function shouldEnforceSealedRefreshParity(configs) {
-	if (configs.signing.sessionPersistenceMode !== "sealed_refresh_v1") return false;
-	return !(configs.wallet.mode === "iframe" && !__isWalletIframeHostMode());
-}
-function buildParityConfigKey(configs) {
-	return [
-		String(configs.network.relayer.url || "").trim(),
-		String(configs.signing.sessionPersistenceMode || "").trim().toLowerCase(),
-		SIGNING_SESSION_SEAL_ALG,
-		SIGNING_SESSION_SEAL_GROUP_ID,
-		__isWalletIframeHostMode() ? "wallet-host" : "app",
-		configs.wallet.mode
-	].join("|");
-}
-function normalizeTimeoutMs(value, fallback) {
-	const parsed = Number(value);
-	if (!Number.isFinite(parsed) || parsed <= 0) return fallback;
-	return Math.max(250, Math.floor(parsed));
-}
-function createErrorWithCode(message, code) {
-	const error = new Error(message);
-	error.code = code;
-	return error;
-}
-function withTimeout(input) {
-	if (input.signal?.aborted) throw createErrorWithCode("Parity check aborted", "sealed_refresh_parity_aborted");
-	const controller = new AbortController();
-	const timeoutId = setTimeout(() => controller.abort("timeout"), input.timeoutMs);
-	const onAbort = () => {
-		try {
-			controller.abort(input.signal?.reason);
-		} catch {}
-	};
-	input.signal?.addEventListener("abort", onAbort, { once: true });
-	return input.task(controller.signal).finally(() => {
-		clearTimeout(timeoutId);
-		input.signal?.removeEventListener("abort", onAbort);
-	}).catch((error) => {
-		const message = error instanceof Error ? error.message : String(error || "Unknown error");
-		if (controller.signal.aborted) throw createErrorWithCode(`[sealed-refresh-parity] Failed to fetch relayer well-known capabilities: ${message}`, "sealed_refresh_parity_fetch_failed");
-		throw error;
-	});
-}
-async function fetchRelayerSigningSessionSealCapabilities(args) {
-	const relayerUrl = String(args.relayerUrl || "").trim();
-	if (!relayerUrl) throw createErrorWithCode("[sealed-refresh-parity] Missing relayer URL for capability check", "sealed_refresh_parity_invalid_config");
-	const fetchImpl = args.fetchImpl || fetch.bind(globalThis);
-	const timeoutMs = normalizeTimeoutMs(args.timeoutMs, DEFAULT_TIMEOUT_MS);
-	const wellKnownUrl = `${relayerUrl.replace(/\/+$/, "")}/.well-known/webauthn`;
-	return await withTimeout({
-		timeoutMs,
-		task: async (signal) => {
-			const response = await fetchImpl(wellKnownUrl, {
-				method: "GET",
-				headers: { Accept: "application/json" },
-				signal
-			});
-			if (!response.ok) throw createErrorWithCode(`[sealed-refresh-parity] Well-known endpoint returned HTTP ${response.status}`, "sealed_refresh_parity_http_error");
-			let payload = {};
-			try {
-				payload = await response.json();
-			} catch {
-				throw createErrorWithCode("[sealed-refresh-parity] Well-known response is not valid JSON", "sealed_refresh_parity_invalid_payload");
-			}
-			return parseWellKnownSigningSessionSealCapabilities(payload);
-		}
-	});
-}
-async function verifySealedRefreshStartupParity(args) {
-	if (!shouldEnforceSealedRefreshParity(args.configs)) return;
-	const configKey = buildParityConfigKey(args.configs);
-	const existing = parityCheckByConfigKey.get(configKey);
-	if (existing) {
-		await existing;
-		return;
-	}
-	const task = (async () => {
-		const relayerUrl = String(args.configs.network.relayer.url || "").trim();
-		const clientMode = args.configs.signing.sessionPersistenceMode;
-		const server = await fetchRelayerSigningSessionSealCapabilities({
-			relayerUrl,
-			fetchImpl: args.fetchImpl,
-			timeoutMs: args.timeoutMs
-		});
-		const mismatches = [];
-		if (server.mode !== clientMode) mismatches.push("mode");
-		if (server.mode === "sealed_refresh_v1" && server.protocol.algorithm !== "shamir3pass-v2") mismatches.push("algorithm");
-		if (server.mode === "sealed_refresh_v1" && server.protocol.groupId !== "rfc2409-group2") mismatches.push("groupId");
-		if (mismatches.length > 0) throw createErrorWithCode(`[sealed-refresh-parity] Client/server mismatch for fields: ${mismatches.join(", ")}. client={mode:${clientMode},algorithm:${SIGNING_SESSION_SEAL_ALG},groupId:${SIGNING_SESSION_SEAL_GROUP_ID}} server={mode:${server.mode}${server.mode === "sealed_refresh_v1" ? `,algorithm:${server.protocol.algorithm},groupId:${server.protocol.groupId}` : ""}}`, "sealed_refresh_parity_mismatch");
-	})().catch((error) => {
-		parityCheckByConfigKey.delete(configKey);
-		throw error;
-	});
-	parityCheckByConfigKey.set(configKey, task);
-	await task;
-}
-//#endregion
-export { verifySealedRefreshStartupParity };
-
-//# sourceMappingURL=sealedRefreshCapabilities.js.map

package/dist/esm/core/rpcClients/relayer/thresholdEcdsa.js

@@ -1,235 +0,0 @@
-import { parseRootShareEpoch } from "../../../shared-ts/src/utils/domainIds.js";
-import { buildBearerAuthorizationHeader, buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
-import { toWalletId } from "../../signingEngine/interfaces/ecdsaChainTarget.js";
-import { ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, requireRouterAbEcdsaDerivationNormalSigningStateV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { toEcdsaDerivationThresholdKeyId } from "../../signingEngine/session/identity/emailOtpEcdsaDerivationIdentity.js";
-import { errorMessage } from "../../../shared-ts/src/utils/errors.js";
-//#region src/core/rpcClients/relayer/thresholdEcdsa.ts
-const WRANGLER_WORKER_RESTARTED_MID_REQUEST = "Your worker restarted mid-request";
-function requireThresholdEcdsaRootShareEpoch(value, field) {
-	const parsed = parseRootShareEpoch(value);
-	if (!parsed.ok) throw new Error(`${field} is invalid`);
-	return parsed.value;
-}
-function requireNonEmptyString(value, field) {
-	const text = typeof value === "string" ? value.trim() : "";
-	if (!text) throw new Error(`Missing ${field}`);
-	return text;
-}
-function requireNumber(value, field) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`Missing ${field}`);
-	return value;
-}
-function requireNonNegativeInteger(value, field) {
-	const number = requireNumber(value, field);
-	if (!Number.isSafeInteger(number) || number < 0) throw new Error(`${field} must be a non-negative integer`);
-	return number;
-}
-function requireParticipantIds(value) {
-	if (!Array.isArray(value) || value.length === 0) throw new Error("participantIds must be a non-empty array");
-	return value.map((entry) => {
-		const participantId = Number(entry);
-		if (!Number.isSafeInteger(participantId) || participantId <= 0) throw new Error("participantIds must contain positive integer ids");
-		return participantId;
-	});
-}
-function requireExactJsonObject(value, fields, field) {
-	if (value === null || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) throw new Error(`Missing ${field}`);
-	const expected = new Set(fields);
-	const actual = Object.keys(value);
-	if (actual.length !== expected.size || actual.some((name) => !expected.has(name))) throw new Error(`${field} contains unexpected fields`);
-	return value;
-}
-function readJsonField(value, field, label) {
-	const descriptor = Object.getOwnPropertyDescriptor(value, field);
-	if (!descriptor || !("value" in descriptor)) throw new Error(`Missing ${label}`);
-	return descriptor.value;
-}
-const NON_EXPORT_BOOTSTRAP_RESPONSE_FIELDS = [
-	"formatVersion",
-	"walletId",
-	"evmFamilySigningKeySlotId",
-	"ecdsaThresholdKeyId",
-	"relayerKeyId",
-	"applicationBindingDigestB64u",
-	"contextBinding32B64u",
-	"publicIdentity",
-	"clientShareRetryCounter",
-	"relayerShareRetryCounter",
-	"keyHandle",
-	"signingRootId",
-	"signingRootVersion",
-	"thresholdEcdsaPublicKeyB64u",
-	"ethereumAddress",
-	"relayerVerifyingShareB64u",
-	"participantIds",
-	"thresholdSessionId",
-	"activationEpoch",
-	"expiresAtMs",
-	"expiresAt",
-	"remainingUses",
-	"routerAbEcdsaDerivationNormalSigning"
-];
-function parseEcdsaDerivationRoleLocalPublicIdentity(value) {
-	const record = requireExactJsonObject(value, [
-		"derivationClientSharePublicKey33B64u",
-		"relayerPublicKey33B64u",
-		"groupPublicKey33B64u",
-		"ethereumAddress"
-	], "publicIdentity");
-	return {
-		derivationClientSharePublicKey33B64u: requireNonEmptyString(readJsonField(record, "derivationClientSharePublicKey33B64u", "publicIdentity.derivationClientSharePublicKey33B64u"), "publicIdentity.derivationClientSharePublicKey33B64u"),
-		relayerPublicKey33B64u: requireNonEmptyString(readJsonField(record, "relayerPublicKey33B64u", "publicIdentity.relayerPublicKey33B64u"), "publicIdentity.relayerPublicKey33B64u"),
-		groupPublicKey33B64u: requireNonEmptyString(readJsonField(record, "groupPublicKey33B64u", "publicIdentity.groupPublicKey33B64u"), "publicIdentity.groupPublicKey33B64u"),
-		ethereumAddress: requireNonEmptyString(readJsonField(record, "ethereumAddress", "publicIdentity.ethereumAddress"), "publicIdentity.ethereumAddress")
-	};
-}
-function parseThresholdEcdsaDerivationRoleLocalBootstrapValue(value) {
-	const record = requireExactJsonObject(value, NON_EXPORT_BOOTSTRAP_RESPONSE_FIELDS, "value");
-	if (readJsonField(record, "formatVersion", "value.formatVersion") !== "ecdsa-derivation-role-local") throw new Error("value.formatVersion is invalid");
-	const walletId = toWalletId(readJsonField(record, "walletId", "value.walletId"));
-	const evmFamilySigningKeySlotId = requireNonEmptyString(readJsonField(record, "evmFamilySigningKeySlotId", "value.evmFamilySigningKeySlotId"), "evmFamilySigningKeySlotId");
-	const ecdsaThresholdKeyId = toEcdsaDerivationThresholdKeyId(readJsonField(record, "ecdsaThresholdKeyId", "value.ecdsaThresholdKeyId"));
-	const relayerKeyId = requireNonEmptyString(readJsonField(record, "relayerKeyId", "value.relayerKeyId"), "relayerKeyId");
-	const applicationBindingDigestB64u = requireNonEmptyString(readJsonField(record, "applicationBindingDigestB64u", "value.applicationBindingDigestB64u"), "applicationBindingDigestB64u");
-	const contextBinding32B64u = requireNonEmptyString(readJsonField(record, "contextBinding32B64u", "value.contextBinding32B64u"), "contextBinding32B64u");
-	const publicIdentity = parseEcdsaDerivationRoleLocalPublicIdentity(readJsonField(record, "publicIdentity", "value.publicIdentity"));
-	const clientShareRetryCounter = requireNonNegativeInteger(readJsonField(record, "clientShareRetryCounter", "value.clientShareRetryCounter"), "clientShareRetryCounter");
-	const relayerShareRetryCounter = requireNonNegativeInteger(readJsonField(record, "relayerShareRetryCounter", "value.relayerShareRetryCounter"), "relayerShareRetryCounter");
-	const keyHandle = requireNonEmptyString(readJsonField(record, "keyHandle", "value.keyHandle"), "keyHandle");
-	const signingRootId = requireNonEmptyString(readJsonField(record, "signingRootId", "value.signingRootId"), "signingRootId");
-	const signingRootVersion = requireNonEmptyString(readJsonField(record, "signingRootVersion", "value.signingRootVersion"), "signingRootVersion");
-	const participantIds = requireParticipantIds(readJsonField(record, "participantIds", "value.participantIds"));
-	const thresholdSessionId = requireNonEmptyString(readJsonField(record, "thresholdSessionId", "value.thresholdSessionId"), "thresholdSessionId");
-	const activationEpoch = requireThresholdEcdsaRootShareEpoch(readJsonField(record, "activationEpoch", "value.activationEpoch"), "activationEpoch");
-	const expiresAtMs = requireNumber(readJsonField(record, "expiresAtMs", "value.expiresAtMs"), "expiresAtMs");
-	const routerAbEcdsaDerivationNormalSigning = requireRouterAbEcdsaDerivationNormalSigningStateV1(readJsonField(record, "routerAbEcdsaDerivationNormalSigning", "value.routerAbEcdsaDerivationNormalSigning"));
-	return {
-		formatVersion: "ecdsa-derivation-role-local",
-		walletId,
-		evmFamilySigningKeySlotId,
-		ecdsaThresholdKeyId,
-		relayerKeyId,
-		applicationBindingDigestB64u,
-		contextBinding32B64u,
-		publicIdentity,
-		clientShareRetryCounter,
-		relayerShareRetryCounter,
-		keyHandle,
-		signingRootId,
-		signingRootVersion,
-		thresholdEcdsaPublicKeyB64u: requireNonEmptyString(readJsonField(record, "thresholdEcdsaPublicKeyB64u", "value.thresholdEcdsaPublicKeyB64u"), "thresholdEcdsaPublicKeyB64u"),
-		ethereumAddress: requireNonEmptyString(readJsonField(record, "ethereumAddress", "value.ethereumAddress"), "ethereumAddress"),
-		relayerVerifyingShareB64u: requireNonEmptyString(readJsonField(record, "relayerVerifyingShareB64u", "value.relayerVerifyingShareB64u"), "relayerVerifyingShareB64u"),
-		participantIds,
-		thresholdSessionId,
-		activationEpoch,
-		expiresAtMs,
-		expiresAt: requireNonEmptyString(readJsonField(record, "expiresAt", "value.expiresAt"), "expiresAt"),
-		remainingUses: requireNumber(readJsonField(record, "remainingUses", "value.remainingUses"), "remainingUses"),
-		routerAbEcdsaDerivationNormalSigning
-	};
-}
-function resolveBearerToken(auth) {
-	if (!auth) return "";
-	if (auth.kind === "opaque_wallet_session_operation_credential_v1") return auth.token;
-	return String(auth.token || "").trim();
-}
-function buildRelayRequestInit(args) {
-	const bearerToken = resolveBearerToken(args.auth);
-	const publishableKeyAuth = String(args.publishableKeyAuth || "").trim();
-	return buildRelayerJsonPostRequestInit({
-		headers: bearerToken ? buildBearerAuthorizationHeader({
-			token: bearerToken,
-			missingMessage: "bearer token is required"
-		}) : publishableKeyAuth ? buildBearerAuthorizationHeader({
-			token: publishableKeyAuth,
-			missingMessage: "publishable key auth is required"
-		}) : void 0,
-		body: args.body
-	});
-}
-function defaultRelayerFailureResponse(status) {
-	return {
-		code: "http_error",
-		message: `HTTP ${status}`
-	};
-}
-function decodeRelayerFailureResponse(value) {
-	try {
-		const record = requireExactJsonObject(value, [
-			"ok",
-			"code",
-			"message"
-		], "relayer failure");
-		if (readJsonField(record, "ok", "relayer failure.ok") !== false) throw new Error("invalid ok");
-		const code = readJsonField(record, "code", "relayer failure.code");
-		const message = readJsonField(record, "message", "relayer failure.message");
-		if (typeof code !== "string" || !code.trim()) throw new Error("invalid code");
-		if (typeof message !== "string" || !message.trim()) throw new Error("invalid message");
-		return {
-			code: code.trim(),
-			message: message.trim()
-		};
-	} catch {
-		return null;
-	}
-}
-async function parseRelayJson(response) {
-	const text = await readResponseText(response);
-	if (isWranglerWorkerRestartedMidRequestResponse(text)) return {
-		ok: false,
-		code: "worker_restarted_mid_request",
-		message: WRANGLER_WORKER_RESTARTED_MID_REQUEST
-	};
-	return parseJsonText(text);
-}
-async function activateRouterAbEcdsaPostRegistrationSession(relayServerUrl, input) {
-	try {
-		const base = normalizeRelayerBaseUrl(relayServerUrl);
-		if (!base) throw new Error("Missing relayServerUrl");
-		const response = await fetch(`${base}${ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH}`, buildRelayRequestInit({
-			auth: input.auth,
-			body: input.request
-		}));
-		const json = await parseRelayJson(response);
-		if (!response.ok) {
-			const failure = decodeRelayerFailureResponse(json) ?? defaultRelayerFailureResponse(response.status);
-			return {
-				ok: false,
-				code: failure.code,
-				message: failure.message
-			};
-		}
-		return {
-			ok: true,
-			value: parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1(json)
-		};
-	} catch (error) {
-		return {
-			ok: false,
-			error: errorMessage(error) || "Router A/B ECDSA session activation failed"
-		};
-	}
-}
-async function readResponseText(response) {
-	try {
-		return await response.text();
-	} catch {
-		return "";
-	}
-}
-function isWranglerWorkerRestartedMidRequestResponse(text) {
-	return text.includes(WRANGLER_WORKER_RESTARTED_MID_REQUEST);
-}
-function parseJsonText(text) {
-	try {
-		return JSON.parse(text || "{}");
-	} catch (error) {
-		throw new Error(`Failed to parse threshold ECDSA relayer response JSON: ${errorMessage(error)}`);
-	}
-}
-//#endregion
-export { activateRouterAbEcdsaPostRegistrationSession, parseThresholdEcdsaDerivationRoleLocalBootstrapValue };
-
-//# sourceMappingURL=thresholdEcdsa.js.map