@dynamic-labs-wallet/forward-mpc-shared 0.7.0 → 0.7.1

package/dist/index.d.cts

@@ -108,6 +108,18 @@ declare const TraceContextCodec: io_ts.UnionC<[io_ts.PartialC<{
  */
 declare const OptionalStringCodec: io_ts.UnionC<[io_ts.StringC, io_ts.UndefinedC]>;
 
+/**
+ * Creates an io-ts codec that validates an integer is within [min, max].
+ * Rejects non-integer numbers, NaN, and Infinity.
+ */
+declare function BoundedIntCodec(name: string, min: number, max: number): Type<number, number, unknown>;
+
+/**
+ * Validates a relay domain: must be a well-formed domain (via DomainCodec)
+ * AND must not resolve to a private/loopback/link-local address.
+ */
+declare const RelayDomainCodec: Type<string, string, unknown>;
+
 /**
  * ReceiveKey Response Runtime Data
  */
@@ -191,9 +203,6 @@ interface ReceiveKeyRequestWire {
     environmentId?: string;
     traceContext?: TraceContext;
 }
-/**
- * ReceiveKey V1 Request Schema
- */
 declare const ReceiveKeyRequestSchema: io_ts.Type<any, any, unknown>;
 type ReceiveKeyRequest = TypeOf<typeof ReceiveKeyRequestSchema>;
 /**
@@ -267,6 +276,8 @@ declare const KeygenV1ResponseMessage: {
     }>;
 };
 
+/** Upper bound for MPC party count — generous ceiling above any real ceremony. */
+declare const MAX_KEYGEN_PARTIES = 10;
 /**
  * Keygen Request Runtime Data
  * Supports ECDSA and BIP340 algorithms only
@@ -1599,4 +1610,4 @@ declare class SigningAlgorithmRegistry {
 }
 declare const signingAlgorithmRegistry: SigningAlgorithmRegistry;
 
-export { AES_256_GCM_KEY_SIZE, AES_256_GCM_NONCE_SIZE, AES_256_GCM_TAG_SIZE, ALGORITHMS, ALL_MESSAGE_CLASSES, ALL_MESSAGE_KEYS, ALL_SIGNING_ALGORITHM_NAMES, ALL_SIGNING_ALGORITHM_SCHEMA, type AllMessageTypes, type AllSigningAlgorithmSchemas, BIP340SigningAlgorithm, BaseMessage, BaseSigningAlgorithm, type BaseWebSocketMessage, type ConnectionAckRequest, type ConnectionAckRequestData, ConnectionAckRequestSchema, type ConnectionAckRequestWire, type ConnectionAckResponse, type ConnectionAckResponseData, ConnectionAckResponseSchema, type ConnectionAckResponseWire, ConnectionAckV1RequestMessage, ConnectionAckV1ResponseMessage, type DecryptPayloadOptions, type DecryptedSecretShare, EcdsaSigningAlgorithm, Ed25519SigningAlgorithm, type EncryptPayloadOptions, type EncryptedPayload, EncryptedPayloadCodec, EncryptionPurpose, type ErrorResponse, HKDF_SALT_SIZE, type HandshakeRequest, type HandshakeRequestData, HandshakeRequestSchema, type HandshakeRequestWire, type HandshakeResponse, type HandshakeResponseData, HandshakeResponseSchema, type HandshakeResponseWire, HandshakeV1RequestMessage, HandshakeV1ResponseMessage, type HashAlgorithm, type IMessage, type ISigningAlgorithm, type KeygenRequest, type KeygenRequestData, KeygenRequestSchema, type KeygenRequestWire, type KeygenResponse, type KeygenResponseData, KeygenResponseSchema, type KeygenResponseWire, KeygenV1RequestMessage, KeygenV1ResponseMessage, MessageRegistry, OptionalStringCodec, type ReceiveKeyRequest, type ReceiveKeyRequestData, ReceiveKeyRequestSchema, type ReceiveKeyRequestWire, type ReceiveKeyResponse, type ReceiveKeyResponseData, ReceiveKeyResponseSchema, type ReceiveKeyResponseWire, ReceiveKeyV1RequestMessage, ReceiveKeyV1ResponseMessage, SIGNING_ALGORITHM_CLASSES, SIGNING_ALGORITHM_INSTANCES, type SecretShareData, type SignMessageRequest, type SignMessageRequestData, SignMessageRequestSchema, type SignMessageRequestWire, type SignMessageResponse, type SignMessageResponseData, SignMessageResponseSchema, type SignMessageResponseWire, SignMessageV1RequestMessage, SignMessageV1ResponseMessage, SignatureAlgoSchema, type SigningAlgorithmName, type SigningAlgorithmSchemaFor, type AllSigningAlgorithmSchemas as SigningAlgorithmSchemas, type TraceContext, TraceContextCodec, Uint32ArrayCodec, Uint8ArrayCodec, WebSocketCloseCode, type WebSocketConnectionInfo, type WebSocketError, WebSocketErrorType, assertDefined, assertNotNull, createKeyDerivationInfo, createKeygenResultFromSecretShare, decapsulateMlKem768, decryptKeygenResult, decryptPayload, deriveAESKey, encapsulateMlKem768, encryptKeygenInit, encryptKeyshare, encryptPayload, fromDynamicSigningAlgorithm, generateMlKem768Keypair, getAllSupportedMessages, getDefined, getMessageClass, isValidMessageType, isValidSigningAlgorithm, messageRegistry, parseMessageKey, signingAlgorithmRegistry, toDynamicSigningAlgorithm };
+export { AES_256_GCM_KEY_SIZE, AES_256_GCM_NONCE_SIZE, AES_256_GCM_TAG_SIZE, ALGORITHMS, ALL_MESSAGE_CLASSES, ALL_MESSAGE_KEYS, ALL_SIGNING_ALGORITHM_NAMES, ALL_SIGNING_ALGORITHM_SCHEMA, type AllMessageTypes, type AllSigningAlgorithmSchemas, BIP340SigningAlgorithm, BaseMessage, BaseSigningAlgorithm, type BaseWebSocketMessage, BoundedIntCodec, type ConnectionAckRequest, type ConnectionAckRequestData, ConnectionAckRequestSchema, type ConnectionAckRequestWire, type ConnectionAckResponse, type ConnectionAckResponseData, ConnectionAckResponseSchema, type ConnectionAckResponseWire, ConnectionAckV1RequestMessage, ConnectionAckV1ResponseMessage, type DecryptPayloadOptions, type DecryptedSecretShare, EcdsaSigningAlgorithm, Ed25519SigningAlgorithm, type EncryptPayloadOptions, type EncryptedPayload, EncryptedPayloadCodec, EncryptionPurpose, type ErrorResponse, HKDF_SALT_SIZE, type HandshakeRequest, type HandshakeRequestData, HandshakeRequestSchema, type HandshakeRequestWire, type HandshakeResponse, type HandshakeResponseData, HandshakeResponseSchema, type HandshakeResponseWire, HandshakeV1RequestMessage, HandshakeV1ResponseMessage, type HashAlgorithm, type IMessage, type ISigningAlgorithm, type KeygenRequest, type KeygenRequestData, KeygenRequestSchema, type KeygenRequestWire, type KeygenResponse, type KeygenResponseData, KeygenResponseSchema, type KeygenResponseWire, KeygenV1RequestMessage, KeygenV1ResponseMessage, MAX_KEYGEN_PARTIES, MessageRegistry, OptionalStringCodec, type ReceiveKeyRequest, type ReceiveKeyRequestData, ReceiveKeyRequestSchema, type ReceiveKeyRequestWire, type ReceiveKeyResponse, type ReceiveKeyResponseData, ReceiveKeyResponseSchema, type ReceiveKeyResponseWire, ReceiveKeyV1RequestMessage, ReceiveKeyV1ResponseMessage, RelayDomainCodec, SIGNING_ALGORITHM_CLASSES, SIGNING_ALGORITHM_INSTANCES, type SecretShareData, type SignMessageRequest, type SignMessageRequestData, SignMessageRequestSchema, type SignMessageRequestWire, type SignMessageResponse, type SignMessageResponseData, SignMessageResponseSchema, type SignMessageResponseWire, SignMessageV1RequestMessage, SignMessageV1ResponseMessage, SignatureAlgoSchema, type SigningAlgorithmName, type SigningAlgorithmSchemaFor, type AllSigningAlgorithmSchemas as SigningAlgorithmSchemas, type TraceContext, TraceContextCodec, Uint32ArrayCodec, Uint8ArrayCodec, WebSocketCloseCode, type WebSocketConnectionInfo, type WebSocketError, WebSocketErrorType, assertDefined, assertNotNull, createKeyDerivationInfo, createKeygenResultFromSecretShare, decapsulateMlKem768, decryptKeygenResult, decryptPayload, deriveAESKey, encapsulateMlKem768, encryptKeygenInit, encryptKeyshare, encryptPayload, fromDynamicSigningAlgorithm, generateMlKem768Keypair, getAllSupportedMessages, getDefined, getMessageClass, isValidMessageType, isValidSigningAlgorithm, messageRegistry, parseMessageKey, signingAlgorithmRegistry, toDynamicSigningAlgorithm };

package/dist/index.d.ts

@@ -108,6 +108,18 @@ declare const TraceContextCodec: io_ts.UnionC<[io_ts.PartialC<{
  */
 declare const OptionalStringCodec: io_ts.UnionC<[io_ts.StringC, io_ts.UndefinedC]>;
 
+/**
+ * Creates an io-ts codec that validates an integer is within [min, max].
+ * Rejects non-integer numbers, NaN, and Infinity.
+ */
+declare function BoundedIntCodec(name: string, min: number, max: number): Type<number, number, unknown>;
+
+/**
+ * Validates a relay domain: must be a well-formed domain (via DomainCodec)
+ * AND must not resolve to a private/loopback/link-local address.
+ */
+declare const RelayDomainCodec: Type<string, string, unknown>;
+
 /**
  * ReceiveKey Response Runtime Data
  */
@@ -191,9 +203,6 @@ interface ReceiveKeyRequestWire {
     environmentId?: string;
     traceContext?: TraceContext;
 }
-/**
- * ReceiveKey V1 Request Schema
- */
 declare const ReceiveKeyRequestSchema: io_ts.Type<any, any, unknown>;
 type ReceiveKeyRequest = TypeOf<typeof ReceiveKeyRequestSchema>;
 /**
@@ -267,6 +276,8 @@ declare const KeygenV1ResponseMessage: {
     }>;
 };
 
+/** Upper bound for MPC party count — generous ceiling above any real ceremony. */
+declare const MAX_KEYGEN_PARTIES = 10;
 /**
  * Keygen Request Runtime Data
  * Supports ECDSA and BIP340 algorithms only
@@ -1599,4 +1610,4 @@ declare class SigningAlgorithmRegistry {
 }
 declare const signingAlgorithmRegistry: SigningAlgorithmRegistry;
 
-export { AES_256_GCM_KEY_SIZE, AES_256_GCM_NONCE_SIZE, AES_256_GCM_TAG_SIZE, ALGORITHMS, ALL_MESSAGE_CLASSES, ALL_MESSAGE_KEYS, ALL_SIGNING_ALGORITHM_NAMES, ALL_SIGNING_ALGORITHM_SCHEMA, type AllMessageTypes, type AllSigningAlgorithmSchemas, BIP340SigningAlgorithm, BaseMessage, BaseSigningAlgorithm, type BaseWebSocketMessage, type ConnectionAckRequest, type ConnectionAckRequestData, ConnectionAckRequestSchema, type ConnectionAckRequestWire, type ConnectionAckResponse, type ConnectionAckResponseData, ConnectionAckResponseSchema, type ConnectionAckResponseWire, ConnectionAckV1RequestMessage, ConnectionAckV1ResponseMessage, type DecryptPayloadOptions, type DecryptedSecretShare, EcdsaSigningAlgorithm, Ed25519SigningAlgorithm, type EncryptPayloadOptions, type EncryptedPayload, EncryptedPayloadCodec, EncryptionPurpose, type ErrorResponse, HKDF_SALT_SIZE, type HandshakeRequest, type HandshakeRequestData, HandshakeRequestSchema, type HandshakeRequestWire, type HandshakeResponse, type HandshakeResponseData, HandshakeResponseSchema, type HandshakeResponseWire, HandshakeV1RequestMessage, HandshakeV1ResponseMessage, type HashAlgorithm, type IMessage, type ISigningAlgorithm, type KeygenRequest, type KeygenRequestData, KeygenRequestSchema, type KeygenRequestWire, type KeygenResponse, type KeygenResponseData, KeygenResponseSchema, type KeygenResponseWire, KeygenV1RequestMessage, KeygenV1ResponseMessage, MessageRegistry, OptionalStringCodec, type ReceiveKeyRequest, type ReceiveKeyRequestData, ReceiveKeyRequestSchema, type ReceiveKeyRequestWire, type ReceiveKeyResponse, type ReceiveKeyResponseData, ReceiveKeyResponseSchema, type ReceiveKeyResponseWire, ReceiveKeyV1RequestMessage, ReceiveKeyV1ResponseMessage, SIGNING_ALGORITHM_CLASSES, SIGNING_ALGORITHM_INSTANCES, type SecretShareData, type SignMessageRequest, type SignMessageRequestData, SignMessageRequestSchema, type SignMessageRequestWire, type SignMessageResponse, type SignMessageResponseData, SignMessageResponseSchema, type SignMessageResponseWire, SignMessageV1RequestMessage, SignMessageV1ResponseMessage, SignatureAlgoSchema, type SigningAlgorithmName, type SigningAlgorithmSchemaFor, type AllSigningAlgorithmSchemas as SigningAlgorithmSchemas, type TraceContext, TraceContextCodec, Uint32ArrayCodec, Uint8ArrayCodec, WebSocketCloseCode, type WebSocketConnectionInfo, type WebSocketError, WebSocketErrorType, assertDefined, assertNotNull, createKeyDerivationInfo, createKeygenResultFromSecretShare, decapsulateMlKem768, decryptKeygenResult, decryptPayload, deriveAESKey, encapsulateMlKem768, encryptKeygenInit, encryptKeyshare, encryptPayload, fromDynamicSigningAlgorithm, generateMlKem768Keypair, getAllSupportedMessages, getDefined, getMessageClass, isValidMessageType, isValidSigningAlgorithm, messageRegistry, parseMessageKey, signingAlgorithmRegistry, toDynamicSigningAlgorithm };
+export { AES_256_GCM_KEY_SIZE, AES_256_GCM_NONCE_SIZE, AES_256_GCM_TAG_SIZE, ALGORITHMS, ALL_MESSAGE_CLASSES, ALL_MESSAGE_KEYS, ALL_SIGNING_ALGORITHM_NAMES, ALL_SIGNING_ALGORITHM_SCHEMA, type AllMessageTypes, type AllSigningAlgorithmSchemas, BIP340SigningAlgorithm, BaseMessage, BaseSigningAlgorithm, type BaseWebSocketMessage, BoundedIntCodec, type ConnectionAckRequest, type ConnectionAckRequestData, ConnectionAckRequestSchema, type ConnectionAckRequestWire, type ConnectionAckResponse, type ConnectionAckResponseData, ConnectionAckResponseSchema, type ConnectionAckResponseWire, ConnectionAckV1RequestMessage, ConnectionAckV1ResponseMessage, type DecryptPayloadOptions, type DecryptedSecretShare, EcdsaSigningAlgorithm, Ed25519SigningAlgorithm, type EncryptPayloadOptions, type EncryptedPayload, EncryptedPayloadCodec, EncryptionPurpose, type ErrorResponse, HKDF_SALT_SIZE, type HandshakeRequest, type HandshakeRequestData, HandshakeRequestSchema, type HandshakeRequestWire, type HandshakeResponse, type HandshakeResponseData, HandshakeResponseSchema, type HandshakeResponseWire, HandshakeV1RequestMessage, HandshakeV1ResponseMessage, type HashAlgorithm, type IMessage, type ISigningAlgorithm, type KeygenRequest, type KeygenRequestData, KeygenRequestSchema, type KeygenRequestWire, type KeygenResponse, type KeygenResponseData, KeygenResponseSchema, type KeygenResponseWire, KeygenV1RequestMessage, KeygenV1ResponseMessage, MAX_KEYGEN_PARTIES, MessageRegistry, OptionalStringCodec, type ReceiveKeyRequest, type ReceiveKeyRequestData, ReceiveKeyRequestSchema, type ReceiveKeyRequestWire, type ReceiveKeyResponse, type ReceiveKeyResponseData, ReceiveKeyResponseSchema, type ReceiveKeyResponseWire, ReceiveKeyV1RequestMessage, ReceiveKeyV1ResponseMessage, RelayDomainCodec, SIGNING_ALGORITHM_CLASSES, SIGNING_ALGORITHM_INSTANCES, type SecretShareData, type SignMessageRequest, type SignMessageRequestData, SignMessageRequestSchema, type SignMessageRequestWire, type SignMessageResponse, type SignMessageResponseData, SignMessageResponseSchema, type SignMessageResponseWire, SignMessageV1RequestMessage, SignMessageV1ResponseMessage, SignatureAlgoSchema, type SigningAlgorithmName, type SigningAlgorithmSchemaFor, type AllSigningAlgorithmSchemas as SigningAlgorithmSchemas, type TraceContext, TraceContextCodec, Uint32ArrayCodec, Uint8ArrayCodec, WebSocketCloseCode, type WebSocketConnectionInfo, type WebSocketError, WebSocketErrorType, assertDefined, assertNotNull, createKeyDerivationInfo, createKeygenResultFromSecretShare, decapsulateMlKem768, decryptKeygenResult, decryptPayload, deriveAESKey, encapsulateMlKem768, encryptKeygenInit, encryptKeyshare, encryptPayload, fromDynamicSigningAlgorithm, generateMlKem768Keypair, getAllSupportedMessages, getDefined, getMessageClass, isValidMessageType, isValidSigningAlgorithm, messageRegistry, parseMessageKey, signingAlgorithmRegistry, toDynamicSigningAlgorithm };

package/dist/index.js

@@ -1,5 +1,5 @@
 import { either } from 'fp-ts';
-import { Type, failure, success, type, partial, number, string, union, undefined as _undefined, intersection, literal, identity, unknown, array } from 'io-ts';
+import { Type, failure, success, type, partial, number, string, union, undefined as _undefined, identity, intersection, literal, unknown, array } from 'io-ts';
 import { hexToBytes, bytesToHex, randomBytes } from '@noble/hashes/utils.js';
 import { SigningAlgorithm } from '@dynamic-labs-wallet/primitives';
 import { ml_kem768 } from '@noble/post-quantum/ml-kem.js';
@@ -98,6 +98,57 @@ var OptionalStringCodec = union([
   string,
   _undefined
 ]);
+function BoundedIntCodec(name, min, max) {
+  return new Type(name, (u) => typeof u === "number" && Number.isInteger(u) && u >= min && u <= max, (u, c) => {
+    if (typeof u !== "number") {
+      return failure(u, c, `${name}: expected a number`);
+    }
+    if (!Number.isInteger(u)) {
+      return failure(u, c, `${name}: expected an integer`);
+    }
+    if (u < min || u > max) {
+      return failure(u, c, `${name}: value ${u} out of range [${min}, ${max}]`);
+    }
+    return success(u);
+  }, (a) => a);
+}
+__name(BoundedIntCodec, "BoundedIntCodec");
+var DomainCodec = new Type("DomainCodec", (u) => typeof u === "string", (u, c) => {
+  if (typeof u !== "string") {
+    return failure(u, c, "Value must be a string");
+  }
+  const domainPattern = /^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*(?::\d{1,5})?$/;
+  if (!domainPattern.test(u)) {
+    return failure(u, c, "Invalid domain format");
+  }
+  return success(u);
+}, identity);
+
+// src/codecs/RelayDomainCodec.ts
+var BLOCKED_PATTERNS = [
+  /^localhost(:\d+)?$/i,
+  /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}(:\d+)?$/,
+  /^0\.0\.0\.0(:\d+)?$/,
+  /^10\.\d{1,3}\.\d{1,3}\.\d{1,3}(:\d+)?$/,
+  /^172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}(:\d+)?$/,
+  /^192\.168\.\d{1,3}\.\d{1,3}(:\d+)?$/,
+  /^169\.254\.\d{1,3}\.\d{1,3}(:\d+)?$/,
+  /^\[::1\](:\d+)?$/,
+  /^\[fd[0-9a-f]{2}:/i,
+  /^\[fe80:/i,
+  /^instance-data\.ec2\.internal(:\d+)?$/i
+];
+var RelayDomainCodec = new Type("RelayDomainCodec", (u) => typeof u === "string", (u, c) => {
+  const base = DomainCodec.decode(u);
+  if (base._tag === "Left") return base;
+  const domain = base.right;
+  for (const pattern of BLOCKED_PATTERNS) {
+    if (pattern.test(domain)) {
+      return failure(u, c, "Relay domain must not be a private, loopback, or link-local address");
+    }
+  }
+  return success(domain);
+}, identity);
 function buildMessageSchema(messageType, version, additionalFields = {}, ...additionalSchemas) {
   const schema = type({
     type: literal(messageType),
@@ -435,16 +486,6 @@ var WebSocketCloseCode = {
   /** Abnormal closure — no close frame (network drop, etc.). */
   ABNORMAL: 1006
 };
-var DomainCodec = new Type("DomainCodec", (u) => typeof u === "string", (u, c) => {
-  if (typeof u !== "string") {
-    return failure(u, c, "Value must be a string");
-  }
-  const domainPattern = /^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*(?::\d{1,5})?$/;
-  if (!domainPattern.test(u)) {
-    return failure(u, c, "Invalid domain format");
-  }
-  return success(u);
-}, identity);
 var Uint8ArrayOrHexCodec = new Type(
   "Uint8ArrayOrHex",
   (u) => u instanceof Uint8Array,
@@ -477,7 +518,7 @@ var Uint8ArrayOrHexCodec = new Type(
 
 // src/messages/SignMessageV1Request.ts
 var SignMessageRequestSchema = buildMessageSchema("signMessage", 1, {
-  relayDomain: DomainCodec,
+  relayDomain: RelayDomainCodec,
   keyshare: EncryptedPayloadCodec,
   message: Uint8ArrayOrHexCodec,
   roomUuid: string,
@@ -565,11 +606,14 @@ var ConnectionAckV1ResponseMessage = createSimpleMessage({
   version: 1,
   schema: ConnectionAckResponseSchema
 });
+var MAX_KEYGEN_PARTIES = 10;
+var NumPartiesCodec = BoundedIntCodec("numParties", 2, MAX_KEYGEN_PARTIES);
+var ThresholdCodec = BoundedIntCodec("threshold", 1, MAX_KEYGEN_PARTIES);
 var BaseKeygenParamsCodec = type({
-  relayDomain: DomainCodec,
+  relayDomain: RelayDomainCodec,
   roomUuid: string,
-  numParties: number,
-  threshold: number,
+  numParties: NumPartiesCodec,
+  threshold: ThresholdCodec,
   keygenInit: EncryptedPayloadCodec,
   keygenIds: array(string),
   userId: OptionalStringCodec,
@@ -589,10 +633,10 @@ var KeygenAlgoParamsCodec = union([
   BIP340KeygenParamsCodec
 ]);
 var KeygenRequestSchema = buildMessageSchema("keygen", 1, {
-  relayDomain: DomainCodec,
+  relayDomain: RelayDomainCodec,
   roomUuid: string,
-  numParties: number,
-  threshold: number,
+  numParties: NumPartiesCodec,
+  threshold: ThresholdCodec,
   keygenInit: EncryptedPayloadCodec,
   keygenIds: array(string),
   userId: OptionalStringCodec,
@@ -642,12 +686,14 @@ var KeygenV1ResponseMessage = createStandardMessage({
     error: decoded.error
   }))
 });
+var NumPartiesCodec2 = BoundedIntCodec("numParties", 2, MAX_KEYGEN_PARTIES);
+var ThresholdCodec2 = BoundedIntCodec("threshold", 1, MAX_KEYGEN_PARTIES);
 var ReceiveKeyRequestSchema = buildMessageSchema("receiveKey", 1, {
-  relayDomain: DomainCodec,
+  relayDomain: RelayDomainCodec,
   signingAlgo: literal("ed25519"),
   roomUuid: string,
-  numParties: number,
-  threshold: number,
+  numParties: NumPartiesCodec2,
+  threshold: ThresholdCodec2,
   keygenInit: EncryptedPayloadCodec,
   keygenIds: array(string),
   userId: OptionalStringCodec,
@@ -1019,6 +1065,6 @@ var SigningAlgorithmRegistry = class SigningAlgorithmRegistry2 {
 };
 var signingAlgorithmRegistry = new SigningAlgorithmRegistry();
 
-export { AES_256_GCM_KEY_SIZE, AES_256_GCM_NONCE_SIZE, AES_256_GCM_TAG_SIZE, ALGORITHMS, ALL_MESSAGE_CLASSES, ALL_MESSAGE_KEYS, ALL_SIGNING_ALGORITHM_NAMES, ALL_SIGNING_ALGORITHM_SCHEMA, BIP340SigningAlgorithm, BaseMessage, BaseSigningAlgorithm, ConnectionAckRequestSchema, ConnectionAckResponseSchema, ConnectionAckV1RequestMessage, ConnectionAckV1ResponseMessage, EcdsaSigningAlgorithm, Ed25519SigningAlgorithm, EncryptedPayloadCodec, EncryptionPurpose, HKDF_SALT_SIZE, HandshakeRequestSchema, HandshakeResponseSchema, HandshakeV1RequestMessage, HandshakeV1ResponseMessage, KeygenRequestSchema, KeygenResponseSchema, KeygenV1RequestMessage, KeygenV1ResponseMessage, MessageRegistry, OptionalStringCodec, ReceiveKeyRequestSchema, ReceiveKeyResponseSchema, ReceiveKeyV1RequestMessage, ReceiveKeyV1ResponseMessage, SIGNING_ALGORITHM_CLASSES, SIGNING_ALGORITHM_INSTANCES, SignMessageRequestSchema, SignMessageResponseSchema, SignMessageV1RequestMessage, SignMessageV1ResponseMessage, SignatureAlgoSchema, TraceContextCodec, Uint32ArrayCodec, Uint8ArrayCodec, WebSocketCloseCode, WebSocketErrorType, assertDefined, assertNotNull, createKeyDerivationInfo, createKeygenResultFromSecretShare, decapsulateMlKem768, decryptKeygenResult, decryptPayload, deriveAESKey, encapsulateMlKem768, encryptKeygenInit, encryptKeyshare, encryptPayload, fromDynamicSigningAlgorithm, generateMlKem768Keypair, getAllSupportedMessages, getDefined, getMessageClass, isValidMessageType, isValidSigningAlgorithm, messageRegistry, parseMessageKey, signingAlgorithmRegistry, toDynamicSigningAlgorithm };
+export { AES_256_GCM_KEY_SIZE, AES_256_GCM_NONCE_SIZE, AES_256_GCM_TAG_SIZE, ALGORITHMS, ALL_MESSAGE_CLASSES, ALL_MESSAGE_KEYS, ALL_SIGNING_ALGORITHM_NAMES, ALL_SIGNING_ALGORITHM_SCHEMA, BIP340SigningAlgorithm, BaseMessage, BaseSigningAlgorithm, BoundedIntCodec, ConnectionAckRequestSchema, ConnectionAckResponseSchema, ConnectionAckV1RequestMessage, ConnectionAckV1ResponseMessage, EcdsaSigningAlgorithm, Ed25519SigningAlgorithm, EncryptedPayloadCodec, EncryptionPurpose, HKDF_SALT_SIZE, HandshakeRequestSchema, HandshakeResponseSchema, HandshakeV1RequestMessage, HandshakeV1ResponseMessage, KeygenRequestSchema, KeygenResponseSchema, KeygenV1RequestMessage, KeygenV1ResponseMessage, MAX_KEYGEN_PARTIES, MessageRegistry, OptionalStringCodec, ReceiveKeyRequestSchema, ReceiveKeyResponseSchema, ReceiveKeyV1RequestMessage, ReceiveKeyV1ResponseMessage, RelayDomainCodec, SIGNING_ALGORITHM_CLASSES, SIGNING_ALGORITHM_INSTANCES, SignMessageRequestSchema, SignMessageResponseSchema, SignMessageV1RequestMessage, SignMessageV1ResponseMessage, SignatureAlgoSchema, TraceContextCodec, Uint32ArrayCodec, Uint8ArrayCodec, WebSocketCloseCode, WebSocketErrorType, assertDefined, assertNotNull, createKeyDerivationInfo, createKeygenResultFromSecretShare, decapsulateMlKem768, decryptKeygenResult, decryptPayload, deriveAESKey, encapsulateMlKem768, encryptKeygenInit, encryptKeyshare, encryptPayload, fromDynamicSigningAlgorithm, generateMlKem768Keypair, getAllSupportedMessages, getDefined, getMessageClass, isValidMessageType, isValidSigningAlgorithm, messageRegistry, parseMessageKey, signingAlgorithmRegistry, toDynamicSigningAlgorithm };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map