@tatchi-xyz/sdk 0.20.0 → 0.31.0

package/dist/esm/server/core/ThresholdService/ThresholdSigningService.js

@@ -0,0 +1,976 @@
+import { toOptionalTrimmedString } from "../../sdk/src/utils/validation.js";
+import { base64Decode, base64UrlEncode } from "../../sdk/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../sdk/src/utils/digests.js";
+import { normalizeThresholdEd25519ParticipantId, normalizeThresholdEd25519ParticipantIds } from "../../sdk/src/threshold/participants.js";
+import { coerceThresholdEd25519ShareMode, coerceThresholdNodeRole, parseThresholdCoordinatorSharedSecretBytes, parseThresholdEd25519ParticipantIds2p, parseThresholdRelayerCosignerThreshold, parseThresholdRelayerCosigners, validateThresholdEd25519MasterSecretB64u } from "./config.js";
+import { ThresholdEd25519KeygenStrategyV1 } from "./keygenStrategy.js";
+import { bytesEqual32, ensureRelayerKeyIsActiveAccessKey, extractAuthorizeSigningPublicKey, isObject, normalizeByteArray32, verifyThresholdEd25519AuthorizeSigningPayload, verifyThresholdEd25519AuthorizeSigningPayloadSigningDigestOnly } from "./validation.js";
+import { ThresholdEd25519SigningHandlers } from "./signingHandlers.js";
+import { resolveThresholdEd25519RelayerKeyMaterial, shouldUseDerivedRelayerShares } from "./relayerKeyMaterial.js";
+import { threshold_ed25519_compute_delegate_signing_digest, threshold_ed25519_compute_near_tx_signing_digests, threshold_ed25519_compute_nep413_signing_digest } from "../../../wasm_signer_worker/pkg/wasm_signer_worker.js";
+
+//#region src/server/core/ThresholdService/ThresholdSigningService.ts
+function parseThresholdEd25519KeygenRequest(request) {
+	const rec = request || {};
+	const nearAccountId = toOptionalTrimmedString(rec.nearAccountId);
+	if (!nearAccountId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "nearAccountId is required"
+	};
+	const clientVerifyingShareB64u = toOptionalTrimmedString(rec.clientVerifyingShareB64u);
+	if (!clientVerifyingShareB64u) return {
+		ok: false,
+		code: "invalid_body",
+		message: "clientVerifyingShareB64u is required"
+	};
+	if (Object.prototype.hasOwnProperty.call(rec, "registrationTxHash")) {
+		const registrationTxHash = toOptionalTrimmedString(rec.registrationTxHash);
+		if (!registrationTxHash) return {
+			ok: false,
+			code: "invalid_body",
+			message: "registrationTxHash is required"
+		};
+		return {
+			ok: true,
+			value: {
+				kind: "registration_tx",
+				nearAccountId,
+				clientVerifyingShareB64u,
+				registrationTxHash
+			}
+		};
+	}
+	const vrfData = rec.vrf_data;
+	const vrfUserId = toOptionalTrimmedString(vrfData?.user_id);
+	if (!vrfUserId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "vrf_data.user_id is required"
+	};
+	if (vrfUserId !== nearAccountId) return {
+		ok: false,
+		code: "unauthorized",
+		message: "nearAccountId must match vrf_data.user_id"
+	};
+	const rpId = toOptionalTrimmedString(vrfData?.rp_id);
+	if (!rpId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "vrf_data.rp_id is required"
+	};
+	const intentDigest32 = normalizeByteArray32(vrfData?.intent_digest_32);
+	if (!intentDigest32) return {
+		ok: false,
+		code: "invalid_body",
+		message: "vrf_data.intent_digest_32 (32 bytes) is required for threshold keygen"
+	};
+	return {
+		ok: true,
+		value: {
+			kind: "webauthn",
+			nearAccountId,
+			clientVerifyingShareB64u,
+			rpId,
+			intentDigest32
+		}
+	};
+}
+function parseThresholdEd25519AuthorizeRequest(request) {
+	const rec = request || {};
+	const relayerKeyId = toOptionalTrimmedString(rec.relayerKeyId);
+	if (!relayerKeyId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "relayerKeyId is required"
+	};
+	const purpose = toOptionalTrimmedString(rec.purpose);
+	if (!purpose) return {
+		ok: false,
+		code: "invalid_body",
+		message: "purpose is required"
+	};
+	const vrfData = rec.vrf_data;
+	const userId = toOptionalTrimmedString(vrfData?.user_id);
+	if (!userId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "vrf_data.user_id is required"
+	};
+	const rpId = toOptionalTrimmedString(vrfData?.rp_id);
+	if (!rpId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "vrf_data.rp_id is required"
+	};
+	const clientVerifyingShareB64u = toOptionalTrimmedString(rec.clientVerifyingShareB64u);
+	if (!clientVerifyingShareB64u) return {
+		ok: false,
+		code: "invalid_body",
+		message: "clientVerifyingShareB64u is required"
+	};
+	const intentDigest32 = normalizeByteArray32(vrfData?.intent_digest_32);
+	if (!intentDigest32) return {
+		ok: false,
+		code: "invalid_body",
+		message: "vrf_data.intent_digest_32 (32 bytes) is required for threshold authorization"
+	};
+	const signingDigest32 = normalizeByteArray32(rec.signing_digest_32);
+	if (!signingDigest32) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signing_digest_32 (32 bytes) is required for threshold authorization"
+	};
+	return {
+		ok: true,
+		value: {
+			relayerKeyId,
+			clientVerifyingShareB64u,
+			purpose,
+			userId,
+			rpId,
+			intentDigest32,
+			signingDigest32,
+			signingPayload: rec.signingPayload
+		}
+	};
+}
+function parseThresholdEd25519AuthorizeWithSessionRequest(request) {
+	const rec = request || {};
+	const relayerKeyId = toOptionalTrimmedString(rec.relayerKeyId);
+	if (!relayerKeyId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "relayerKeyId is required"
+	};
+	const clientVerifyingShareB64u = toOptionalTrimmedString(rec.clientVerifyingShareB64u);
+	if (!clientVerifyingShareB64u) return {
+		ok: false,
+		code: "invalid_body",
+		message: "clientVerifyingShareB64u is required"
+	};
+	const purpose = toOptionalTrimmedString(rec.purpose);
+	if (!purpose) return {
+		ok: false,
+		code: "invalid_body",
+		message: "purpose is required"
+	};
+	const signingDigest32 = normalizeByteArray32(rec.signing_digest_32);
+	if (!signingDigest32) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signing_digest_32 (32 bytes) is required for threshold authorization"
+	};
+	return {
+		ok: true,
+		value: {
+			relayerKeyId,
+			clientVerifyingShareB64u,
+			purpose,
+			signingDigest32,
+			signingPayload: rec.signingPayload
+		}
+	};
+}
+function parseThresholdEd25519SessionRequest(request, participantIds2p) {
+	const rec = request || {};
+	const relayerKeyId = toOptionalTrimmedString(rec.relayerKeyId);
+	if (!relayerKeyId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "relayerKeyId is required"
+	};
+	const clientVerifyingShareB64u = toOptionalTrimmedString(rec.clientVerifyingShareB64u);
+	if (!clientVerifyingShareB64u) return {
+		ok: false,
+		code: "invalid_body",
+		message: "clientVerifyingShareB64u is required"
+	};
+	const policyRaw = rec.sessionPolicy;
+	if (!isObject(policyRaw)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionPolicy (object) is required"
+	};
+	const version = toOptionalTrimmedString(policyRaw.version);
+	if (version !== "threshold_session_v1") return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionPolicy.version must be threshold_session_v1"
+	};
+	const nearAccountId = toOptionalTrimmedString(policyRaw.nearAccountId);
+	const rpId = toOptionalTrimmedString(policyRaw.rpId);
+	const sessionId = toOptionalTrimmedString(policyRaw.sessionId);
+	const policyRelayerKeyId = toOptionalTrimmedString(policyRaw.relayerKeyId);
+	const ttlMsRaw = Number(policyRaw.ttlMs);
+	const remainingUsesRaw = Number(policyRaw.remainingUses);
+	if (!nearAccountId || !rpId || !sessionId || !policyRelayerKeyId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionPolicy{nearAccountId,rpId,relayerKeyId,sessionId} are required"
+	};
+	if (policyRelayerKeyId !== relayerKeyId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionPolicy.relayerKeyId must match relayerKeyId"
+	};
+	const policyHasParticipantIds = Object.prototype.hasOwnProperty.call(policyRaw, "participantIds");
+	const policyParticipantIds = normalizeThresholdEd25519ParticipantIds(policyRaw.participantIds);
+	if (policyHasParticipantIds && !policyParticipantIds) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionPolicy.participantIds must be a non-empty array of positive integers"
+	};
+	if (policyParticipantIds) {
+		if (policyParticipantIds.length < 2) return {
+			ok: false,
+			code: "invalid_body",
+			message: "sessionPolicy.participantIds must contain at least 2 participant ids"
+		};
+		for (const id of participantIds2p) if (!policyParticipantIds.includes(id)) return {
+			ok: false,
+			code: "unauthorized",
+			message: `sessionPolicy.participantIds must include server signer set (expected to include participantIds=[${participantIds2p.join(",")}])`
+		};
+	}
+	if (!Number.isFinite(ttlMsRaw) || ttlMsRaw <= 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionPolicy.ttlMs must be a positive number"
+	};
+	if (!Number.isFinite(remainingUsesRaw) || remainingUsesRaw <= 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionPolicy.remainingUses must be a positive number"
+	};
+	const vrfData = rec.vrf_data;
+	const userId = toOptionalTrimmedString(vrfData?.user_id);
+	if (!userId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "vrf_data.user_id is required"
+	};
+	if (userId !== nearAccountId) return {
+		ok: false,
+		code: "unauthorized",
+		message: "sessionPolicy.nearAccountId must match vrf_data.user_id"
+	};
+	const vrfRpId = toOptionalTrimmedString(vrfData?.rp_id);
+	if (!vrfRpId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "vrf_data.rp_id is required"
+	};
+	if (vrfRpId !== rpId) return {
+		ok: false,
+		code: "unauthorized",
+		message: "sessionPolicy.rpId must match vrf_data.rp_id"
+	};
+	const sessionPolicyDigest32 = normalizeByteArray32(vrfData?.session_policy_digest_32);
+	if (!sessionPolicyDigest32) return {
+		ok: false,
+		code: "invalid_body",
+		message: "vrf_data.session_policy_digest_32 (32 bytes) is required for threshold sessions"
+	};
+	return {
+		ok: true,
+		value: {
+			relayerKeyId,
+			clientVerifyingShareB64u,
+			nearAccountId,
+			rpId,
+			sessionId,
+			ttlMsRaw,
+			remainingUsesRaw,
+			policyParticipantIds: policyParticipantIds || null,
+			sessionPolicyDigest32
+		}
+	};
+}
+var ThresholdSigningService = class {
+	logger;
+	keyStore;
+	sessionStore;
+	authSessionStore;
+	clientParticipantId;
+	relayerParticipantId;
+	participantIds2p;
+	shareMode;
+	relayerMasterSecretB64u;
+	useDerivedRelayerShares;
+	keygenStrategy;
+	signingHandlers;
+	ensureReady;
+	ensureSignerWasm;
+	verifyAuthenticationResponse;
+	viewAccessKeyList;
+	txStatus;
+	webAuthnContractId;
+	constructor(input) {
+		this.logger = input.logger;
+		this.keyStore = input.keyStore;
+		this.sessionStore = input.sessionStore;
+		this.authSessionStore = input.authSessionStore;
+		const cfg = isObject(input.config) ? input.config : {};
+		const nodeRole = coerceThresholdNodeRole(cfg.THRESHOLD_NODE_ROLE);
+		const coordinatorSharedSecretBytes = parseThresholdCoordinatorSharedSecretBytes(cfg.THRESHOLD_COORDINATOR_SHARED_SECRET_B64U);
+		const relayerCosigners = parseThresholdRelayerCosigners(cfg.THRESHOLD_ED25519_RELAYER_COSIGNERS) || [];
+		const relayerCosignerThreshold = parseThresholdRelayerCosignerThreshold(cfg.THRESHOLD_ED25519_RELAYER_COSIGNER_T);
+		const relayerCosignerIdRaw = cfg.THRESHOLD_ED25519_RELAYER_COSIGNER_ID;
+		const relayerCosignerId = relayerCosignerIdRaw === void 0 ? null : normalizeThresholdEd25519ParticipantId(relayerCosignerIdRaw);
+		if (nodeRole === "cosigner" && !relayerCosignerId) throw new Error("THRESHOLD_ED25519_RELAYER_COSIGNER_ID is required when THRESHOLD_NODE_ROLE=cosigner");
+		const ids = parseThresholdEd25519ParticipantIds2p({
+			THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID: cfg.THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID,
+			THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID: cfg.THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID
+		});
+		this.clientParticipantId = ids.clientParticipantId;
+		this.relayerParticipantId = ids.relayerParticipantId;
+		this.participantIds2p = ids.participantIds2p;
+		this.shareMode = coerceThresholdEd25519ShareMode(cfg.THRESHOLD_ED25519_SHARE_MODE);
+		this.relayerMasterSecretB64u = validateThresholdEd25519MasterSecretB64u(cfg.THRESHOLD_ED25519_MASTER_SECRET_B64U);
+		if (this.shareMode === "derived" && !this.relayerMasterSecretB64u) throw new Error("threshold-ed25519 derived share mode requires THRESHOLD_ED25519_MASTER_SECRET_B64U");
+		this.useDerivedRelayerShares = shouldUseDerivedRelayerShares({
+			shareMode: this.shareMode,
+			relayerMasterSecretB64u: this.relayerMasterSecretB64u
+		});
+		this.ensureReady = input.ensureReady;
+		this.ensureSignerWasm = input.ensureSignerWasm;
+		this.verifyAuthenticationResponse = input.verifyAuthenticationResponse;
+		this.viewAccessKeyList = input.viewAccessKeyList;
+		this.txStatus = input.txStatus;
+		this.webAuthnContractId = input.webAuthnContractId;
+		this.keygenStrategy = new ThresholdEd25519KeygenStrategyV1({
+			useDerivedShares: this.useDerivedRelayerShares,
+			relayerMasterSecretB64u: this.relayerMasterSecretB64u,
+			clientParticipantId: this.clientParticipantId,
+			relayerParticipantId: this.relayerParticipantId,
+			ensureSignerWasm: this.ensureSignerWasm
+		});
+		this.signingHandlers = new ThresholdEd25519SigningHandlers({
+			logger: this.logger,
+			nodeRole,
+			relayerCosigners,
+			relayerCosignerThreshold,
+			relayerCosignerId,
+			coordinatorSharedSecretBytes,
+			clientParticipantId: this.clientParticipantId,
+			relayerParticipantId: this.relayerParticipantId,
+			participantIds2p: this.participantIds2p,
+			sessionStore: this.sessionStore,
+			ensureReady: this.ensureReady,
+			ensureSignerWasm: this.ensureSignerWasm,
+			viewAccessKeyList: this.viewAccessKeyList,
+			resolveRelayerKeyMaterial: (args) => this.resolveRelayerKeyMaterial(args)
+		});
+	}
+	async resolveRelayerKeyMaterial(input) {
+		return await resolveThresholdEd25519RelayerKeyMaterial({
+			...input,
+			shareMode: this.shareMode,
+			relayerMasterSecretB64u: this.relayerMasterSecretB64u,
+			keyStore: this.keyStore,
+			keygenStrategy: this.keygenStrategy
+		});
+	}
+	clampSessionPolicy(input) {
+		const ttlMs = Math.max(0, Math.floor(Number(input.ttlMs) || 0));
+		const remainingUses = Math.max(0, Math.floor(Number(input.remainingUses) || 0));
+		const MAX_TTL_MS = 10 * 6e4;
+		const MAX_USES = 20;
+		return {
+			ttlMs: Math.min(ttlMs, MAX_TTL_MS),
+			remainingUses: Math.min(remainingUses, MAX_USES)
+		};
+	}
+	async computeSessionPolicyDigest32(policy) {
+		const json = alphabetizeStringify(policy);
+		return await sha256BytesUtf8(json);
+	}
+	async putAuthSessionRecord(input) {
+		await this.authSessionStore.putSession(input.sessionId, input.record, {
+			ttlMs: input.ttlMs,
+			remainingUses: input.remainingUses
+		});
+	}
+	createThresholdEd25519MpcSessionId() {
+		const id = typeof globalThis.crypto?.randomUUID === "function" ? globalThis.crypto.randomUUID() : `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+		return `mpc-${id}`;
+	}
+	createThresholdEd25519SigningSessionId() {
+		const id = typeof globalThis.crypto?.randomUUID === "function" ? globalThis.crypto.randomUUID() : `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+		return `sign-${id}`;
+	}
+	getTxSuccessValueBase64(outcome) {
+		const status = outcome?.status;
+		if (!status || typeof status !== "object") return null;
+		if (!("SuccessValue" in status)) return null;
+		const value = status.SuccessValue;
+		return typeof value === "string" && value.length > 0 ? value : null;
+	}
+	parseTxSuccessValueJson(outcome) {
+		const successValueB64 = this.getTxSuccessValueBase64(outcome);
+		if (!successValueB64) return null;
+		const bytes = base64Decode(successValueB64);
+		const text = new TextDecoder().decode(bytes);
+		if (!text.trim()) return null;
+		return JSON.parse(text);
+	}
+	validateLinkDeviceRegistrationTx(outcome, expectedNearAccountId) {
+		const txUnknown = outcome?.transaction;
+		if (!txUnknown || typeof txUnknown !== "object") return {
+			ok: false,
+			code: "unauthorized",
+			message: "Registration transaction missing transaction metadata"
+		};
+		let rpId = null;
+		const tx = txUnknown;
+		const signerId = toOptionalTrimmedString(tx.signer_id ?? tx.signerId);
+		if (signerId && signerId !== expectedNearAccountId) return {
+			ok: false,
+			code: "unauthorized",
+			message: "Registration transaction signer_id mismatch"
+		};
+		const receiverId = toOptionalTrimmedString(tx.receiver_id ?? tx.receiverId);
+		if (receiverId && receiverId !== this.webAuthnContractId) return {
+			ok: false,
+			code: "unauthorized",
+			message: "Registration transaction receiver_id mismatch"
+		};
+		const actions = Array.isArray(tx.actions) ? tx.actions : [];
+		const fnCalls = actions.map((action) => action && typeof action === "object" ? action.FunctionCall ?? action.function_call ?? null : null).filter((v) => Boolean(v && typeof v === "object"));
+		const linkDeviceCall = fnCalls.find((fc) => toOptionalTrimmedString(fc.method_name ?? fc.methodName) === "link_device_register_user");
+		if (!linkDeviceCall) return {
+			ok: false,
+			code: "unauthorized",
+			message: "Registration transaction is not link_device_register_user"
+		};
+		const argsB64 = toOptionalTrimmedString(linkDeviceCall.args);
+		if (argsB64) try {
+			const argsText = new TextDecoder().decode(base64Decode(argsB64));
+			const parsedArgs = JSON.parse(argsText);
+			if (parsedArgs && typeof parsedArgs === "object") {
+				const vrf = parsedArgs.vrf_data;
+				if (vrf && typeof vrf === "object") {
+					const userId = toOptionalTrimmedString(vrf.user_id ?? vrf.userId);
+					if (userId && userId !== expectedNearAccountId) return {
+						ok: false,
+						code: "unauthorized",
+						message: "Registration transaction vrf_data.user_id mismatch"
+					};
+					rpId = toOptionalTrimmedString(vrf.rp_id ?? vrf.rpId) || rpId;
+				}
+			}
+		} catch {}
+		const successJson = this.parseTxSuccessValueJson(outcome);
+		if (!successJson || typeof successJson !== "object") return {
+			ok: false,
+			code: "unauthorized",
+			message: "Registration transaction missing JSON SuccessValue"
+		};
+		const verified = successJson.verified;
+		if (verified !== true) return {
+			ok: false,
+			code: "not_verified",
+			message: "Registration transaction did not verify on-chain"
+		};
+		return {
+			ok: true,
+			...rpId ? { rpId } : {}
+		};
+	}
+	/**
+	* Registration helper (no WebAuthn verification):
+	* compute a threshold group key from the client's verifying share and return the relayer share
+	* material. Callers should persist the relayer share only after the on-chain AddKey is confirmed.
+	*/
+	async keygenFromClientVerifyingShareForRegistration(input) {
+		try {
+			await this.ensureReady();
+			const nearAccountId = toOptionalTrimmedString(input.nearAccountId);
+			if (!nearAccountId) return {
+				ok: false,
+				code: "invalid_body",
+				message: "nearAccountId is required"
+			};
+			const rpId = toOptionalTrimmedString(input.rpId);
+			if (!rpId) return {
+				ok: false,
+				code: "invalid_body",
+				message: "rpId is required"
+			};
+			const clientVerifyingShareB64u = toOptionalTrimmedString(input.clientVerifyingShareB64u);
+			if (!clientVerifyingShareB64u) return {
+				ok: false,
+				code: "invalid_body",
+				message: "clientVerifyingShareB64u is required"
+			};
+			const keygen = await this.keygenStrategy.keygenFromClientVerifyingShare({
+				nearAccountId,
+				rpId,
+				clientVerifyingShareB64u
+			});
+			if (!keygen.ok) return keygen;
+			const { keyMaterial } = keygen;
+			return {
+				ok: true,
+				clientParticipantId: this.clientParticipantId,
+				relayerParticipantId: this.relayerParticipantId,
+				participantIds: [...this.participantIds2p],
+				relayerKeyId: keyMaterial.relayerKeyId,
+				publicKey: keyMaterial.publicKey,
+				relayerSigningShareB64u: keyMaterial.relayerSigningShareB64u,
+				relayerVerifyingShareB64u: keyMaterial.relayerVerifyingShareB64u
+			};
+		} catch (e) {
+			const msg = String(e && typeof e === "object" && "message" in e ? e.message : e || "Internal error");
+			return {
+				ok: false,
+				code: "internal",
+				message: msg
+			};
+		}
+	}
+	async putRelayerKeyMaterial(input) {
+		if (this.useDerivedRelayerShares) return;
+		const relayerKeyId = toOptionalTrimmedString(input.relayerKeyId);
+		if (!relayerKeyId) throw new Error("Missing relayerKeyId");
+		await this.keyStore.put(relayerKeyId, {
+			publicKey: toOptionalTrimmedString(input.publicKey),
+			relayerSigningShareB64u: toOptionalTrimmedString(input.relayerSigningShareB64u),
+			relayerVerifyingShareB64u: toOptionalTrimmedString(input.relayerVerifyingShareB64u)
+		});
+	}
+	async thresholdEd25519Keygen(request) {
+		try {
+			const parsedRequest = parseThresholdEd25519KeygenRequest(request);
+			if (!parsedRequest.ok) return parsedRequest;
+			await this.ensureReady();
+			if (parsedRequest.value.kind === "registration_tx") {
+				const { nearAccountId: nearAccountId$1, clientVerifyingShareB64u: clientVerifyingShareB64u$1, registrationTxHash } = parsedRequest.value;
+				let outcome;
+				try {
+					outcome = await this.txStatus(registrationTxHash, nearAccountId$1);
+				} catch (e) {
+					const msg = String(e && typeof e === "object" && "message" in e ? e.message : e || "");
+					return {
+						ok: false,
+						code: "invalid_body",
+						message: `Failed to fetch registration transaction: ${msg || "tx_status failed"}`
+					};
+				}
+				const validTx = this.validateLinkDeviceRegistrationTx(outcome, nearAccountId$1);
+				if (!validTx.ok) return validTx;
+				if (this.useDerivedRelayerShares) {
+					const rpId$1 = toOptionalTrimmedString(validTx.rpId);
+					if (!rpId$1) return {
+						ok: false,
+						code: "invalid_body",
+						message: "registrationTxHash keygen requires vrf_data.rp_id in link_device_register_user args"
+					};
+				}
+				const keygen$1 = await this.keygenStrategy.keygenFromClientVerifyingShare({
+					nearAccountId: nearAccountId$1,
+					rpId: toOptionalTrimmedString(validTx.rpId),
+					clientVerifyingShareB64u: clientVerifyingShareB64u$1
+				});
+				if (!keygen$1.ok) return keygen$1;
+				const { keyMaterial: keyMaterial$1 } = keygen$1;
+				const publicKey$1 = keyMaterial$1.publicKey;
+				const relayerKeyId$1 = keyMaterial$1.relayerKeyId;
+				if (!this.useDerivedRelayerShares) await this.keyStore.put(relayerKeyId$1, {
+					publicKey: publicKey$1,
+					relayerSigningShareB64u: keyMaterial$1.relayerSigningShareB64u,
+					relayerVerifyingShareB64u: keyMaterial$1.relayerVerifyingShareB64u
+				});
+				return {
+					ok: true,
+					clientParticipantId: this.clientParticipantId,
+					relayerParticipantId: this.relayerParticipantId,
+					participantIds: [...this.participantIds2p],
+					relayerKeyId: relayerKeyId$1,
+					publicKey: publicKey$1,
+					relayerVerifyingShareB64u: keyMaterial$1.relayerVerifyingShareB64u
+				};
+			}
+			const { nearAccountId, clientVerifyingShareB64u, rpId, intentDigest32 } = parsedRequest.value;
+			const vrfData = request.vrf_data;
+			const webauthnAuthentication = request.webauthn_authentication;
+			const expectedIntentJson = alphabetizeStringify({
+				kind: "threshold_ed25519_keygen",
+				nearAccountId,
+				rpId,
+				clientVerifyingShareB64u
+			});
+			const expectedIntentDigest32 = await sha256BytesUtf8(expectedIntentJson);
+			if (!bytesEqual32(expectedIntentDigest32, intentDigest32)) return {
+				ok: false,
+				code: "intent_digest_mismatch",
+				message: "vrf_data.intent_digest_32 does not match expected keygen binding"
+			};
+			const verification = await this.verifyAuthenticationResponse({
+				vrf_data: vrfData,
+				webauthn_authentication: webauthnAuthentication
+			});
+			if (!verification.success || !verification.verified) return {
+				ok: false,
+				code: verification.code || "not_verified",
+				message: verification.message || "Authentication verification failed"
+			};
+			const keygen = await this.keygenStrategy.keygenFromClientVerifyingShare({
+				nearAccountId,
+				rpId,
+				clientVerifyingShareB64u
+			});
+			if (!keygen.ok) return keygen;
+			const { keyMaterial } = keygen;
+			const publicKey = keyMaterial.publicKey;
+			const relayerKeyId = keyMaterial.relayerKeyId;
+			if (!this.useDerivedRelayerShares) await this.keyStore.put(relayerKeyId, {
+				publicKey,
+				relayerSigningShareB64u: keyMaterial.relayerSigningShareB64u,
+				relayerVerifyingShareB64u: keyMaterial.relayerVerifyingShareB64u
+			});
+			return {
+				ok: true,
+				clientParticipantId: this.clientParticipantId,
+				relayerParticipantId: this.relayerParticipantId,
+				participantIds: [...this.participantIds2p],
+				relayerKeyId,
+				publicKey,
+				relayerVerifyingShareB64u: keyMaterial.relayerVerifyingShareB64u
+			};
+		} catch (e) {
+			this.logger?.error?.("thresholdEd25519Keygen failed:", e);
+			const msg = String(e && typeof e === "object" && "message" in e ? e.message : e || "Internal error");
+			return {
+				ok: false,
+				code: "internal",
+				message: msg
+			};
+		}
+	}
+	async authorizeThresholdEd25519(request) {
+		try {
+			const parsedRequest = parseThresholdEd25519AuthorizeRequest(request);
+			if (!parsedRequest.ok) return parsedRequest;
+			const { relayerKeyId, clientVerifyingShareB64u, purpose, userId, rpId, intentDigest32, signingDigest32, signingPayload } = parsedRequest.value;
+			await this.ensureReady();
+			const relayerKey = await this.resolveRelayerKeyMaterial({
+				relayerKeyId,
+				nearAccountId: userId,
+				rpId,
+				clientVerifyingShareB64u
+			});
+			if (!relayerKey.ok) return {
+				ok: false,
+				code: relayerKey.code,
+				message: relayerKey.message
+			};
+			const verifyPayload = await verifyThresholdEd25519AuthorizeSigningPayload({
+				purpose,
+				signingPayload,
+				signingDigest32,
+				intentDigest32,
+				userId,
+				ensureSignerWasm: this.ensureSignerWasm,
+				computeNearTxSigningDigests: threshold_ed25519_compute_near_tx_signing_digests,
+				computeDelegateSigningDigest: threshold_ed25519_compute_delegate_signing_digest,
+				computeNep413SigningDigest: threshold_ed25519_compute_nep413_signing_digest
+			});
+			if (!verifyPayload.ok) return {
+				ok: false,
+				code: verifyPayload.code,
+				message: verifyPayload.message
+			};
+			const verification = await this.verifyAuthenticationResponse({
+				vrf_data: request.vrf_data,
+				webauthn_authentication: request.webauthn_authentication
+			});
+			if (!verification.success || !verification.verified) return {
+				ok: false,
+				code: verification.code || "not_verified",
+				message: verification.message || "Authentication verification failed"
+			};
+			const expectedSigningPublicKey = extractAuthorizeSigningPublicKey(purpose, signingPayload);
+			const scope = await ensureRelayerKeyIsActiveAccessKey({
+				nearAccountId: userId,
+				relayerPublicKey: relayerKey.publicKey,
+				...expectedSigningPublicKey ? { expectedSigningPublicKey } : {},
+				viewAccessKeyList: this.viewAccessKeyList
+			});
+			if (!scope.ok) return {
+				ok: false,
+				code: scope.code,
+				message: scope.message
+			};
+			const ttlMs = 6e4;
+			const expiresAtMs = Date.now() + ttlMs;
+			const mpcSessionId = this.createThresholdEd25519MpcSessionId();
+			await this.sessionStore.putMpcSession(mpcSessionId, {
+				expiresAtMs,
+				relayerKeyId,
+				purpose,
+				intentDigestB64u: base64UrlEncode(intentDigest32),
+				signingDigestB64u: base64UrlEncode(signingDigest32),
+				userId,
+				rpId,
+				clientVerifyingShareB64u,
+				participantIds: [...this.participantIds2p]
+			}, ttlMs);
+			return {
+				ok: true,
+				mpcSessionId,
+				expiresAt: new Date(expiresAtMs).toISOString()
+			};
+		} catch (e) {
+			const msg = String(e && typeof e === "object" && "message" in e ? e.message : e || "Internal error");
+			return {
+				ok: false,
+				code: "internal",
+				message: msg
+			};
+		}
+	}
+	async thresholdEd25519Session(request) {
+		try {
+			const parsedRequest = parseThresholdEd25519SessionRequest(request, this.participantIds2p);
+			if (!parsedRequest.ok) return parsedRequest;
+			const { relayerKeyId, clientVerifyingShareB64u, nearAccountId, rpId, sessionId, ttlMsRaw, remainingUsesRaw, policyParticipantIds, sessionPolicyDigest32 } = parsedRequest.value;
+			await this.ensureReady();
+			const relayerKey = await this.resolveRelayerKeyMaterial({
+				relayerKeyId,
+				nearAccountId,
+				rpId,
+				clientVerifyingShareB64u
+			});
+			if (!relayerKey.ok) return {
+				ok: false,
+				code: relayerKey.code,
+				message: relayerKey.message
+			};
+			const { ttlMs, remainingUses } = this.clampSessionPolicy({
+				ttlMs: ttlMsRaw,
+				remainingUses: remainingUsesRaw
+			});
+			const participantIds = policyParticipantIds || [...this.participantIds2p];
+			const normalizedPolicy = {
+				version: "threshold_session_v1",
+				nearAccountId,
+				rpId,
+				relayerKeyId,
+				sessionId,
+				...policyParticipantIds ? { participantIds: policyParticipantIds } : {},
+				ttlMs,
+				remainingUses
+			};
+			const expectedPolicyDigest32 = await this.computeSessionPolicyDigest32(normalizedPolicy);
+			if (!bytesEqual32(expectedPolicyDigest32, sessionPolicyDigest32)) return {
+				ok: false,
+				code: "session_policy_digest_mismatch",
+				message: "sessionPolicy does not match vrf_data.session_policy_digest_32"
+			};
+			const existingSession = await this.authSessionStore.getSession(sessionId);
+			if (existingSession) {
+				if (existingSession.userId !== nearAccountId) return {
+					ok: false,
+					code: "unauthorized",
+					message: "threshold sessionId already exists for a different user"
+				};
+				if (existingSession.relayerKeyId !== relayerKeyId) return {
+					ok: false,
+					code: "unauthorized",
+					message: "threshold sessionId already exists for a different relayerKeyId"
+				};
+				if (existingSession.rpId !== rpId) return {
+					ok: false,
+					code: "unauthorized",
+					message: "threshold sessionId already exists for a different rpId"
+				};
+				const sameParticipantIds = existingSession.participantIds.length === participantIds.length && existingSession.participantIds.every((id, i) => id === participantIds[i]);
+				if (!sameParticipantIds) return {
+					ok: false,
+					code: "unauthorized",
+					message: "threshold sessionId already exists for a different participant set"
+				};
+			}
+			const verification = await this.verifyAuthenticationResponse({
+				vrf_data: request.vrf_data,
+				webauthn_authentication: request.webauthn_authentication
+			});
+			if (!verification.success || !verification.verified) return {
+				ok: false,
+				code: verification.code || "not_verified",
+				message: verification.message || "Authentication verification failed"
+			};
+			const scope = await ensureRelayerKeyIsActiveAccessKey({
+				nearAccountId,
+				relayerPublicKey: relayerKey.publicKey,
+				viewAccessKeyList: this.viewAccessKeyList
+			});
+			if (!scope.ok) return {
+				ok: false,
+				code: scope.code,
+				message: scope.message
+			};
+			if (existingSession) return {
+				ok: true,
+				sessionId,
+				expiresAt: new Date(existingSession.expiresAtMs).toISOString()
+			};
+			const expiresAtMs = Date.now() + ttlMs;
+			await this.putAuthSessionRecord({
+				sessionId,
+				record: {
+					expiresAtMs,
+					relayerKeyId,
+					userId: nearAccountId,
+					rpId,
+					participantIds
+				},
+				ttlMs,
+				remainingUses
+			});
+			return {
+				ok: true,
+				sessionId,
+				expiresAt: new Date(expiresAtMs).toISOString(),
+				remainingUses
+			};
+		} catch (e) {
+			const msg = String(e && typeof e === "object" && "message" in e ? e.message : e || "Internal error");
+			return {
+				ok: false,
+				code: "internal",
+				message: msg
+			};
+		}
+	}
+	async authorizeThresholdEd25519WithSession(input) {
+		try {
+			const sessionId = toOptionalTrimmedString(input.sessionId);
+			if (!sessionId) return {
+				ok: false,
+				code: "unauthorized",
+				message: "Missing threshold sessionId"
+			};
+			const userId = toOptionalTrimmedString(input.userId);
+			if (!userId) return {
+				ok: false,
+				code: "unauthorized",
+				message: "Missing threshold userId"
+			};
+			const parsedRequest = parseThresholdEd25519AuthorizeWithSessionRequest(input.request);
+			if (!parsedRequest.ok) return parsedRequest;
+			const { relayerKeyId, clientVerifyingShareB64u, purpose, signingDigest32, signingPayload } = parsedRequest.value;
+			await this.ensureReady();
+			const consumed = await this.authSessionStore.consumeUse(sessionId);
+			if (!consumed.ok) return {
+				ok: false,
+				code: consumed.code,
+				message: consumed.message
+			};
+			const sessionRecord = consumed.record;
+			if (sessionRecord.userId !== userId) return {
+				ok: false,
+				code: "unauthorized",
+				message: "threshold session token does not match session record user"
+			};
+			const sessionParticipantIds = normalizeThresholdEd25519ParticipantIds(sessionRecord.participantIds);
+			if (!sessionParticipantIds || sessionParticipantIds.length < 2) return {
+				ok: false,
+				code: "unauthorized",
+				message: "threshold session token is missing a valid participantIds set"
+			};
+			for (const id of this.participantIds2p) if (!sessionParticipantIds.includes(id)) return {
+				ok: false,
+				code: "unauthorized",
+				message: `threshold session token does not include server signer set (expected to include participantIds=[${this.participantIds2p.join(",")}])`
+			};
+			if (relayerKeyId !== sessionRecord.relayerKeyId) return {
+				ok: false,
+				code: "unauthorized",
+				message: "relayerKeyId does not match threshold session scope"
+			};
+			const relayerKey = await this.resolveRelayerKeyMaterial({
+				relayerKeyId,
+				nearAccountId: sessionRecord.userId,
+				rpId: sessionRecord.rpId,
+				clientVerifyingShareB64u
+			});
+			if (!relayerKey.ok) return {
+				ok: false,
+				code: relayerKey.code,
+				message: relayerKey.message
+			};
+			const verifyPayload = await verifyThresholdEd25519AuthorizeSigningPayloadSigningDigestOnly({
+				purpose,
+				signingPayload,
+				signingDigest32,
+				userId: sessionRecord.userId,
+				ensureSignerWasm: this.ensureSignerWasm,
+				computeNearTxSigningDigests: threshold_ed25519_compute_near_tx_signing_digests,
+				computeDelegateSigningDigest: threshold_ed25519_compute_delegate_signing_digest,
+				computeNep413SigningDigest: threshold_ed25519_compute_nep413_signing_digest
+			});
+			if (!verifyPayload.ok) return {
+				ok: false,
+				code: verifyPayload.code,
+				message: verifyPayload.message
+			};
+			const expectedSigningPublicKey = extractAuthorizeSigningPublicKey(purpose, signingPayload);
+			const scope = await ensureRelayerKeyIsActiveAccessKey({
+				nearAccountId: sessionRecord.userId,
+				relayerPublicKey: relayerKey.publicKey,
+				...expectedSigningPublicKey ? { expectedSigningPublicKey } : {},
+				viewAccessKeyList: this.viewAccessKeyList
+			});
+			if (!scope.ok) return {
+				ok: false,
+				code: scope.code,
+				message: scope.message
+			};
+			const ttlMs = 6e4;
+			const expiresAtMs = Date.now() + ttlMs;
+			const mpcSessionId = this.createThresholdEd25519MpcSessionId();
+			await this.sessionStore.putMpcSession(mpcSessionId, {
+				expiresAtMs,
+				relayerKeyId,
+				purpose,
+				intentDigestB64u: base64UrlEncode(verifyPayload.intentDigest32),
+				signingDigestB64u: base64UrlEncode(signingDigest32),
+				userId: sessionRecord.userId,
+				rpId: sessionRecord.rpId,
+				clientVerifyingShareB64u,
+				participantIds: [...sessionRecord.participantIds]
+			}, ttlMs);
+			return {
+				ok: true,
+				mpcSessionId,
+				expiresAt: new Date(expiresAtMs).toISOString()
+			};
+		} catch (e) {
+			const msg = String(e && typeof e === "object" && "message" in e ? e.message : e || "Internal error");
+			return {
+				ok: false,
+				code: "internal",
+				message: msg
+			};
+		}
+	}
+	async thresholdEd25519SignInit(request) {
+		return await this.signingHandlers.thresholdEd25519SignInit(request);
+	}
+	async thresholdEd25519CosignInit(request) {
+		return await this.signingHandlers.thresholdEd25519CosignInit(request);
+	}
+	async thresholdEd25519CosignFinalize(request) {
+		return await this.signingHandlers.thresholdEd25519CosignFinalize(request);
+	}
+	async thresholdEd25519SignFinalize(request) {
+		return await this.signingHandlers.thresholdEd25519SignFinalize(request);
+	}
+};
+
+//#endregion
+export { ThresholdSigningService };
+//# sourceMappingURL=ThresholdSigningService.js.map