@seams/wallet-server 0.15.6 → 0.18.0

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.js

@@ -18,12 +18,11 @@ function resolveTraceContext(request) {
 	};
 }
 var InMemoryRouterAbEd25519YaoRegistrationStateV1 = class {
-	constructor() {
-		this.states = /* @__PURE__ */ new Map();
-		this.lifecycleSessions = /* @__PURE__ */ new Map();
-		this.admissionClaims = /* @__PURE__ */ new Map();
-		this.dispatchRoots = /* @__PURE__ */ new Map();
-	}
+	states = /* @__PURE__ */ new Map();
+	lifecycleSessions = /* @__PURE__ */ new Map();
+	admissionClaims = /* @__PURE__ */ new Map();
+	/** The tenant root each admitted lifecycle dispatches to, pinned at admission. */
+	dispatchRoots = /* @__PURE__ */ new Map();
 };
 function registrationSessionKey(receipt) {
 	return bytesToHex(receipt.binding.session_id);
@@ -140,12 +139,12 @@ function routeFailureResponse(result) {
 	}, { status: result.status });
 }
 var RouterAbEd25519YaoRegistrationRouteExtension = class {
+	kind = "fetch_route_extension";
+	id = "router_ab_ed25519_yao_registration";
+	routes = ROUTER_AB_ED25519_YAO_REGISTRATION_ROUTES;
 	constructor(service, authorization) {
 		this.service = service;
 		this.authorization = authorization;
-		this.kind = "fetch_route_extension";
-		this.id = "router_ab_ed25519_yao_registration";
-		this.routes = ROUTER_AB_ED25519_YAO_REGISTRATION_ROUTES;
 	}
 	async handleFetchRoute(input) {
 		if (input.method !== "POST") return json({
@@ -218,6 +217,9 @@ function createRouterAbEd25519YaoRegistrationModule(input) {
 	});
 }
 var InMemoryRouterAbEd25519YaoRegistrationService = class {
+	states;
+	lifecycleSessions;
+	admissionClaims;
 	constructor(backend, state = new InMemoryRouterAbEd25519YaoRegistrationStateV1()) {
 		this.backend = backend;
 		this.states = state.states;

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js

@@ -218,11 +218,10 @@ function findAuthorityByLifecycleId(authorities, lifecycleId) {
 	return null;
 }
 var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1 = class {
-	constructor() {
-		this.authorities = [];
-	}
+	authorities = [];
 };
 var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
+	authorities;
 	constructor(state = new InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1()) {
 		this.authorities = state.authorities;
 	}

package/dist/esm/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.js

@@ -1,9 +1,7 @@
 //#region src/router/domains/signingOperations/routerAbNormalSigningAdmissionCore.ts
 var InMemoryRouterAbNormalSigningAdmissionStore = class {
-	constructor() {
-		this.projectPolicies = /* @__PURE__ */ new Map();
-		this.abuseDecisions = /* @__PURE__ */ new Map();
-	}
+	projectPolicies = /* @__PURE__ */ new Map();
+	abuseDecisions = /* @__PURE__ */ new Map();
 	setProjectPolicy(scope, decision) {
 		this.projectPolicies.set(runtimePolicyScopeKey(scope), decision);
 	}

package/dist/esm/router/domains/walletRegistration/registrationSessionSeal.js

@@ -2,10 +2,10 @@ import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 //#region src/router/domains/walletRegistration/registrationSessionSeal.ts
 /** Holds one request's computation until registration can publish its response. */
 var RegistrationPreparedSessionSeal = class {
+	prepared = null;
 	constructor(request, service) {
 		this.request = request;
 		this.service = service;
-		this.prepared = null;
 	}
 	async prepare(session) {
 		await this.finish(session);

package/dist/esm/router/framework/http.js

@@ -7,7 +7,7 @@ import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "../../shared-ts/src/utils/routerAb
 import { WALLET_MANAGEMENT_PROTOCOL_HEADER } from "../../shared-ts/src/utils/walletManagementProtocol.js";
 //#region src/router/framework/http.ts
 const CORS_ALLOW_METHODS = "GET,POST,PUT,PATCH,DELETE,OPTIONS";
-const CORS_PREFLIGHT_MAX_AGE_SECONDS = 600;
+const CORS_PREFLIGHT_MAX_AGE_SECONDS = 7200;
 const CORS_ALLOW_HEADERS = [
 	"Content-Type",
 	WALLET_MANAGEMENT_PROTOCOL_HEADER,

package/dist/esm/router/framework/ror/staticProvider.js

@@ -2,6 +2,7 @@ import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/nor
 import { sanitizeRorOrigins } from "./normalize.js";
 //#region src/router/framework/ror/staticProvider.ts
 var StaticRorOriginsProvider = class {
+	byRpId;
 	constructor(input) {
 		this.byRpId = /* @__PURE__ */ new Map();
 		const byRpId = input?.byRpId || {};

package/dist/esm/router/ror.js

@@ -156,6 +156,7 @@ function resolveRorRpId(input) {
 //#endregion
 //#region src/router/framework/ror/staticProvider.ts
 var StaticRorOriginsProvider = class {
+	byRpId;
 	constructor(input) {
 		this.byRpId = /* @__PURE__ */ new Map();
 		const byRpId = input?.byRpId || {};

package/dist/esm/shared-ts/src/authorization/delegatedAuthority.js

@@ -14,9 +14,9 @@ const DELEGATED_WALLET_PERMISSION_VALUE_SET = new Set([
 ]);
 const canonicalPermissionSetBrand = Symbol("canonicalPermissionSetBrand");
 var CanonicalDelegatedWalletPermissionSetProof = class CanonicalDelegatedWalletPermissionSetProof extends Array {
+	[canonicalPermissionSetBrand] = true;
 	constructor(permissions) {
 		super(...permissions);
-		this[canonicalPermissionSetBrand] = true;
 		Object.freeze(this);
 	}
 	static create(permissions) {

package/dist/esm/shared-ts/src/authorization/operationFingerprint.js

@@ -4,6 +4,12 @@ import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 //#region ../shared-ts/src/authorization/operationFingerprint.ts
 const CAPABILITY_OPERATION_FINGERPRINT_DOMAIN_V1 = "seams:authorization:capability-operation-fingerprint:v1";
 var CapabilityOperationEnvelopeProof = class {
+	tenantId;
+	principalId;
+	capabilityId;
+	operationId;
+	operation;
+	digests;
 	retainProof() {
 		return true;
 	}

package/dist/esm/shared-ts/src/device-linking/sourceContribution.js

@@ -5,7 +5,7 @@ import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../utils/routerAbNormalSigningIdentity.js";
-import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, sameRouterAbEd25519YaoByteSequence } from "../utils/routerAbEd25519Yao.js";
+import { parseRouterAbEd25519YaoActivationBindingV1, parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, sameRouterAbEd25519YaoByteSequence } from "../utils/routerAbEd25519Yao.js";
 import { parseSdkEcdsaDerivationThresholdKeyId } from "../threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { requireRouterAbEcdsaDerivationNormalSigningStateV1 } from "../utils/routerAbEcdsaDerivation.js";
 //#region ../shared-ts/src/device-linking/sourceContribution.ts
@@ -108,7 +108,7 @@ function parseEd25519SourceContributionPreparation(record) {
 		"sourceRegisteredPublicKeyB64u"
 	], "linked-device Ed25519 source contribution preparation");
 	if (record.kind !== "linked_device_ed25519_source_contribution_preparation_v1") throw new Error("linked-device Ed25519 source contribution preparation kind is invalid");
-	const sourceBinding = parseRegistrationBinding(record.sourceBinding, "sourceBinding");
+	const sourceBinding = parseRouterAbEd25519YaoActivationBindingV1(record.sourceBinding);
 	const targetAdmissionResult = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(record.targetAdmission);
 	if (!targetAdmissionResult.ok) throw new Error(`targetAdmission ${targetAdmissionResult.message}`);
 	const targetAdmission = targetAdmissionResult.value;
@@ -187,7 +187,7 @@ function parseEd25519Contribution(record) {
 	], "linked-device Ed25519 source contribution");
 	if (record.kind !== "linked_device_ed25519_source_contribution_v1") throw new Error("linked-device Ed25519 source contribution kind is invalid");
 	if (record.keyFamily !== "ed25519") throw new Error("linked-device Ed25519 source contribution family is invalid");
-	const sourceBinding = parseRegistrationBinding(record.sourceBinding, "sourceBinding");
+	const sourceBinding = parseRouterAbEd25519YaoActivationBindingV1(record.sourceBinding);
 	const targetMaterialActivation = parseActivation(record.targetMaterialActivation, "source contribution targetMaterialActivation");
 	const targetBinding = parseRegistrationBinding(record.targetBinding, "targetBinding");
 	const activationReceipt = parseRouterAbEd25519YaoActivationPublicReceiptV1(record.activationReceipt);
@@ -464,7 +464,7 @@ function parseLinkedDeviceEcdsaEncryptedSourceContributionV1(raw, label) {
 	};
 }
 function parseRegistrationBinding(raw, label) {
-	const binding = parseRouterAbEd25519YaoCeremonyBindingV1(raw);
+	const binding = parseRouterAbEd25519YaoActivationBindingV1(raw);
 	if (binding.operation !== "registration") throw new Error(`${label} must use the registration operation`);
 	return binding;
 }
@@ -478,7 +478,7 @@ function assertSourceBindingContext(binding, linkSessionId, label) {
 	if (binding.session_id.length !== 32 || String(linkSessionId).length === 0) throw new Error(`${label} link binding is invalid`);
 }
 function sameEdStableIdentity(left, right) {
-	return left.operation === right.operation && left.stable_key_context_binding.every((value, index) => value === right.stable_key_context_binding[index]) && left.material_activation.capability === right.material_activation.capability && left.material_activation.material_owner === right.material_activation.material_owner && left.material_activation.key_binding === right.material_activation.key_binding && left.material_activation.lifecycle_binding === right.material_activation.lifecycle_binding && left.material_activation.signing_worker === right.material_activation.signing_worker && left.lifecycle.root_share_epoch === right.lifecycle.root_share_epoch && left.lifecycle.account_id === right.lifecycle.account_id && left.lifecycle.signer_set_id === right.lifecycle.signer_set_id && left.lifecycle.selected_server_id === right.lifecycle.selected_server_id;
+	return left.stable_key_context_binding.every((value, index) => value === right.stable_key_context_binding[index]) && left.material_activation.capability === right.material_activation.capability && left.material_activation.material_owner === right.material_activation.material_owner && left.material_activation.key_binding === right.material_activation.key_binding && left.material_activation.lifecycle_binding === right.material_activation.lifecycle_binding && left.material_activation.signing_worker === right.material_activation.signing_worker && left.lifecycle.root_share_epoch === right.lifecycle.root_share_epoch && left.lifecycle.account_id === right.lifecycle.account_id && left.lifecycle.signer_set_id === right.lifecycle.signer_set_id && left.lifecycle.selected_server_id === right.lifecycle.selected_server_id;
 }
 function sameEcdsaSourceSigner(left, right) {
 	return mpcMaterialActivationRefsEqual(left.activation, right.activation) && left.clientPublicKey33B64u === right.clientPublicKey33B64u && left.relayerPublicKey33B64u === right.relayerPublicKey33B64u && left.thresholdPublicKey33B64u === right.thresholdPublicKey33B64u && left.thresholdEthereumAddress20B64u === right.thresholdEthereumAddress20B64u;

package/dist/esm/shared-ts/src/near/nearClient.js

@@ -14,6 +14,11 @@ var RpcCallType = /* @__PURE__ */ function(RpcCallType) {
 const DEFAULT_SEND_WAIT_UNTIL = "EXECUTED_OPTIMISTIC";
 /** The wallet narrows the transaction, signature and nonce lease types. */
 var SignedTransaction = class SignedTransaction {
+	transaction;
+	signature;
+	borsh_bytes;
+	nonceLease;
+	serverDispatch;
 	constructor(data) {
 		this.transaction = data.transaction;
 		this.signature = data.signature;
@@ -61,6 +66,7 @@ function encodeSignedTransactionBase64(signed) {
 	throw new Error("Invalid signed transaction payload: cannot serialize to base64");
 }
 var NearJsonRpcClient = class NearJsonRpcClient {
+	rpcUrls;
 	constructor(rpcUrl) {
 		this.rpcUrls = NearJsonRpcClient.normalizeRpcUrls(rpcUrl);
 	}

package/dist/esm/shared-ts/src/tenant-root/tenantRootIdentity.js

@@ -7,6 +7,11 @@ const TENANT_ROOT_IDENTITY_DOMAIN_V1 = new TextEncoder().encode("seams/tenant-ro
 * incompatible with the trusted identity.
 */
 var TenantRootIdentityProof = class TenantRootIdentityProof {
+	orgId;
+	projectId;
+	envId;
+	signingRootId;
+	signingRootVersion;
 	retainProof() {
 		return true;
 	}

package/dist/esm/shared-ts/src/utils/domainIds.js

@@ -3,6 +3,13 @@ var MpcMaterialActivationReference = class {
 	retainProof() {
 		return true;
 	}
+	kind;
+	activationId;
+	capability;
+	materialOwner;
+	keyBinding;
+	lifecycleBinding;
+	signingWorker;
 	constructor(fields) {
 		this.retainProof();
 		this.kind = "mpc_material_activation_ref";

package/dist/esm/shared-ts/src/utils/routerAbEd25519Yao.js

@@ -247,7 +247,8 @@ function parseExportBinding(value) {
 		authorization_digest: requireBytes32(record.authorization_digest, "export binding.authorization_digest", true)
 	};
 }
-function requireActivationBinding(binding) {
+function parseRouterAbEd25519YaoActivationBindingV1(value) {
+	const binding = parseCeremonyBinding(value);
 	switch (binding.operation) {
 		case "registration":
 			if (binding.lifecycle.work_kind !== REGISTRATION_WORK_KIND || binding.lifecycle.primitive_request_kind !== REGISTRATION_PRIMITIVE_REQUEST_KIND) throw new Error("activation binding has the wrong registration lifecycle kind");
@@ -602,7 +603,7 @@ function parseExportResultValue(value) {
 function parseActivationAdmissionReceiptValue(value) {
 	const record = requireRecord(value, "activation admission receipt");
 	requireExactKeys(record, "activation admission receipt", ["binding", "keyset"]);
-	const binding = requireActivationBinding(parseCeremonyBinding(record.binding));
+	const binding = parseRouterAbEd25519YaoActivationBindingV1(record.binding);
 	const keyset = parseKeyset(record.keyset);
 	switch (binding.operation) {
 		case "registration": return {
@@ -622,7 +623,7 @@ function parseActivationExecuteRequestValue(value) {
 		"deriver_a_input",
 		"deriver_b_input"
 	]);
-	const binding = requireActivationBinding(parseCeremonyBinding(record.binding));
+	const binding = parseRouterAbEd25519YaoActivationBindingV1(record.binding);
 	const deriverAInput = requireActivationInput(binding, parseEncryptedInput(record.deriver_a_input, "deriver_a_input"), "deriver_a", "deriver_a_input");
 	const deriverBInput = requireActivationInput(binding, parseEncryptedInput(record.deriver_b_input, "deriver_b_input"), "deriver_b", "deriver_b_input");
 	if (binding.operation === "registration") {
@@ -648,7 +649,7 @@ function parseActivationResultValue(value) {
 		"deriver_b_client_package",
 		"public_receipt"
 	]);
-	const binding = requireActivationBinding(parseCeremonyBinding(record.binding));
+	const binding = parseRouterAbEd25519YaoActivationBindingV1(record.binding);
 	const receipt = parseRouterAbEd25519YaoActivationPublicReceiptV1(record.public_receipt);
 	if (!sameRouterAbMpcMaterialActivationRef(binding.material_activation, receipt.material_activation)) throw new Error("activation result receipt material does not match the admitted binding");
 	const packageA = parseEncryptedPackage(record.deriver_a_client_package, "deriver_a_client_package");
@@ -671,7 +672,7 @@ function parseActivationResultValue(value) {
 	}
 }
 function requireRecoveryBinding(value) {
-	const binding = requireActivationBinding(parseCeremonyBinding(value));
+	const binding = parseRouterAbEd25519YaoActivationBindingV1(value);
 	switch (binding.operation) {
 		case "registration": throw new Error("recovery activation requires a recovery binding");
 		case "recovery": return binding;
@@ -819,6 +820,6 @@ function parseEncryptedPackageValue(value) {
 	return parseEncryptedPackage(value, "encrypted_package");
 }
 //#endregion
-export { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoActivationKeysetV1, parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportAdmissionRequestV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationRequestV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRecoveryStatusRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoActivationPublicReceiptV1, sameRouterAbEd25519YaoByteSequence, sameRouterAbEd25519YaoRecoveryAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 };
+export { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoActivationBindingV1, parseRouterAbEd25519YaoActivationKeysetV1, parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportAdmissionRequestV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationRequestV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRecoveryStatusRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoActivationPublicReceiptV1, sameRouterAbEd25519YaoByteSequence, sameRouterAbEd25519YaoRecoveryAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 };
 
 //# sourceMappingURL=routerAbEd25519Yao.js.map

package/dist/esm/storage/tenantRoute.js

@@ -35,6 +35,10 @@ function createCloudflareTenantStorageRoute(input) {
 	};
 }
 var StaticCloudflareTenantStorageRouteResolver = class {
+	routeVersion;
+	topology;
+	jurisdiction;
+	signerTarget;
 	constructor(input) {
 		this.routeVersion = normalizeRouteVersion(input.routeVersion);
 		this.topology = input.topology;

package/dist/esm/threshold/session/signingSessionSeal/crypto/cipher.js

@@ -112,10 +112,10 @@ async function deriveAcceptedKeyHandles(input) {
 	}
 }
 var SigningSessionSealKeyHandles = class {
+	initialization = null;
 	constructor(config, runtime) {
 		this.config = config;
 		this.runtime = runtime;
-		this.initialization = null;
 	}
 	get() {
 		if (!this.initialization) this.initialization = deriveAcceptedKeyHandles({

package/dist/esm/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.js

@@ -35,7 +35,7 @@ async function initializeNodeRuntime() {
 	const { readFile } = await import("node:fs/promises");
 	for (const url of wasmUrls()) try {
 		const bytes = await readFile(fileURLToPath(url));
-		await initializeCompiledModule(await WebAssembly.compile(bytes));
+		await initializeCompiledModule(await WebAssembly.compile(new Uint8Array(bytes)));
 		return;
 	} catch {}
 	throw new Error("[shamir3pass] Failed to initialize WASM from filesystem candidates");

package/dist/esm/threshold/session/signingSessionSeal/guards/backends.js

@@ -47,6 +47,8 @@ function finalizeConsume(input) {
 	};
 }
 var UpstashSigningSessionSealRateLimiter = class {
+	client;
+	keyPrefix;
 	constructor(input) {
 		this.client = new UpstashRedisRestClient({
 			url: input.url,

package/dist/esm/threshold/session/signingSessionSeal/guards/index.js

@@ -15,8 +15,9 @@ function composeSigningSessionSealGuards(...guards) {
 	};
 }
 var InMemorySigningSessionSealRateLimiter = class {
+	maxEntries;
+	buckets = /* @__PURE__ */ new Map();
 	constructor(options = {}) {
-		this.buckets = /* @__PURE__ */ new Map();
 		const configuredMaxEntries = Number(options.maxEntries);
 		this.maxEntries = Number.isFinite(configuredMaxEntries) && configuredMaxEntries > 0 ? Math.floor(configuredMaxEntries) : 1e4;
 	}

package/dist/esm/threshold/session/signingSessionSeal/idempotencyBackends.js

@@ -18,6 +18,9 @@ function ttlMsUntilExpiry(expiresAtMs, nowMs) {
 	return ttlMs > 0 ? ttlMs : 0;
 }
 var UpstashSigningSessionSealIdempotencyStore = class {
+	client;
+	keyPrefix;
+	nowMs;
 	constructor(options) {
 		this.client = new UpstashRedisRestClient({
 			url: options.url,

package/dist/types/shared-ts/src/authorization/capabilityKinds.d.ts

@@ -11,26 +11,26 @@ export type AuthorizationParseResult<T> = {
     readonly error: AuthorizationParseError;
 };
 export declare const CAPABILITY_KINDS: {
-    readonly vaultAccess: "vault_access";
-    readonly nearEd25519MpcSigning: "near_ed25519_mpc_signing";
-    readonly evmEcdsaMpcSigning: "evm_ecdsa_mpc_signing";
+    readonly vaultAccess: 'vault_access';
+    readonly nearEd25519MpcSigning: 'near_ed25519_mpc_signing';
+    readonly evmEcdsaMpcSigning: 'evm_ecdsa_mpc_signing';
 };
 type CapabilityKind = (typeof CAPABILITY_KINDS)[keyof typeof CAPABILITY_KINDS];
 export declare const VAULT_OPERATION_KINDS: {
-    readonly proxyUse: "vault.proxy_use";
-    readonly reveal: "vault.reveal";
+    readonly proxyUse: 'vault.proxy_use';
+    readonly reveal: 'vault.reveal';
 };
 type VaultOperationKind = (typeof VAULT_OPERATION_KINDS)[keyof typeof VAULT_OPERATION_KINDS];
 export declare const NEAR_ED25519_MPC_OPERATION_KINDS: {
-    readonly signTransaction: "near.sign_transaction";
-    readonly signDelegateAction: "near.sign_delegate_action";
-    readonly signNep413Message: "near.sign_nep413_message";
-    readonly exportKey: "near.export_key";
+    readonly signTransaction: 'near.sign_transaction';
+    readonly signDelegateAction: 'near.sign_delegate_action';
+    readonly signNep413Message: 'near.sign_nep413_message';
+    readonly exportKey: 'near.export_key';
 };
 export type NearEd25519MpcOperationKind = (typeof NEAR_ED25519_MPC_OPERATION_KINDS)[keyof typeof NEAR_ED25519_MPC_OPERATION_KINDS];
 export declare const EVM_ECDSA_MPC_OPERATION_KINDS: {
-    readonly signTransaction: "evm.sign_transaction";
-    readonly exportKey: "evm.export_key";
+    readonly signTransaction: 'evm.sign_transaction';
+    readonly exportKey: 'evm.export_key';
 };
 export type EvmEcdsaMpcOperationKind = (typeof EVM_ECDSA_MPC_OPERATION_KINDS)[keyof typeof EVM_ECDSA_MPC_OPERATION_KINDS];
 type CapabilityOperationKindByCapability = {
@@ -45,9 +45,9 @@ export type CapabilityOperationRef = {
     };
 }[CapabilityKind];
 export declare const AUTHORIZATION_EVIDENCE_KINDS: {
-    readonly seamsSession: "seams_session";
-    readonly passkeyAssertion: "passkey_assertion";
-    readonly emailOtp: "email_otp";
+    readonly seamsSession: 'seams_session';
+    readonly passkeyAssertion: 'passkey_assertion';
+    readonly emailOtp: 'email_otp';
 };
 type SessionAuthorizationEvidenceKind = typeof AUTHORIZATION_EVIDENCE_KINDS.seamsSession;
 type InteractiveAuthorizationEvidenceKind = typeof AUTHORIZATION_EVIDENCE_KINDS.passkeyAssertion | typeof AUTHORIZATION_EVIDENCE_KINDS.emailOtp;

package/dist/types/shared-ts/src/authorization/delegatedAuthority.d.ts

@@ -1,6 +1,6 @@
 import type { AuthorizationParseResult } from './capabilityKinds';
 export type DelegatedWalletPermissionV1 = (typeof DELEGATED_WALLET_PERMISSION_VALUES)[number];
-declare const DELEGATED_WALLET_PERMISSION_VALUES: readonly ["export_keys", "link_devices", "revoke_devices", "sign"];
+declare const DELEGATED_WALLET_PERMISSION_VALUES: readonly ['export_keys', 'link_devices', 'revoke_devices', 'sign'];
 type CanonicalPermissionTuple = readonly [
     DelegatedWalletPermissionV1,
     ...DelegatedWalletPermissionV1[]

package/dist/types/shared-ts/src/device-linking/ed25519ExportRoot.d.ts

@@ -9,7 +9,7 @@ import { type LinkedDeviceEnrollmentId, type LinkedDeviceId, type LinkDeviceSess
 import { type WalletId } from '../utils/domainIds';
 import type { LinkedDeviceTargetFactorV1 } from './contracts';
 /** Frozen by signer-core's Ed25519 Yao Client-root transfer module. */
-export declare const LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1: "x25519-hkdf-sha256-chacha20poly1305-v1";
+export declare const LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1: 'x25519-hkdf-sha256-chacha20poly1305-v1';
 /** One-use X25519 public key generated and retained by Device 2's worker. */
 type LinkedDeviceEd25519ExportRootRecipientPublicKeyB64u = string & {
     readonly __linkedDeviceEd25519ExportRootRecipientPublicKeyB64uBrand: 'LinkedDeviceEd25519ExportRootRecipientPublicKeyB64u';

package/dist/types/shared-ts/src/device-linking/requestProof.d.ts

@@ -19,7 +19,7 @@ export type LinkedDeviceRequestProofV1 = {
     readonly expiresAtMs: number;
     readonly signatureB64u: string;
 };
-export declare function encodeLinkedDeviceRequestProofV1(proof: LinkedDeviceRequestProofV1): Uint8Array;
+export declare function encodeLinkedDeviceRequestProofV1(proof: LinkedDeviceRequestProofV1): Uint8Array<ArrayBuffer>;
 export declare function computeLinkedDeviceRequestProofDigestV1(proof: LinkedDeviceRequestProofV1): Promise<DigestB64u>;
 export declare function computeLinkedDevicePublicKeyDigestV1(publicKeyB64u: LinkDevicePublicKeyB64u | string): Promise<DigestB64u>;
 //# sourceMappingURL=requestProof.d.ts.map

package/dist/types/shared-ts/src/device-linking/sourceContribution.d.ts

@@ -3,11 +3,11 @@ import { type LinkedDeviceEnrollmentId, type LinkDeviceSessionId, type WalletKey
 import { type MpcMaterialActivationRef, type WalletAuthorityId } from '../utils/domainIds';
 import { type DigestB64u } from '../utils/canonicalPrimitives';
 import { type Ed25519PublicKeyB64u, type Secp256k1CompressedPublicKeyB64u } from '../passkey-custody/primitives';
-import { type RouterAbEd25519YaoCeremonyBindingV1, type RouterAbEd25519YaoActivationAdmissionReceiptV1, type RouterAbEd25519YaoActivationPublicReceiptV1, type RouterAbEd25519YaoApplicationBindingFactsV1, type RouterAbEd25519YaoActivationClientPackageV1 } from '../utils/routerAbEd25519Yao';
+import { type RouterAbEd25519YaoActivationBindingV1, type RouterAbEd25519YaoActivationAdmissionReceiptV1, type RouterAbEd25519YaoActivationPublicReceiptV1, type RouterAbEd25519YaoApplicationBindingFactsV1, type RouterAbEd25519YaoActivationClientPackageV1 } from '../utils/routerAbEd25519Yao';
 import { type EcdsaThresholdKeyId } from '../threshold/ecdsaDerivationRoleLocalBootstrap';
 import { type RouterAbEcdsaDerivationNormalSigningStateV1 } from '../utils/routerAbEcdsaDerivation';
 /** Exact discriminator accepted by the ECDSA source-contribution core. */
-declare const LINKED_DEVICE_ECDSA_SOURCE_CONTRIBUTION_ENVELOPE_KIND_V1: "seams/linked-device/ecdsa-source-contribution-envelope/v1";
+declare const LINKED_DEVICE_ECDSA_SOURCE_CONTRIBUTION_ENVELOPE_KIND_V1: 'seams/linked-device/ecdsa-source-contribution-envelope/v1';
 /** Source derivation facts required by the Cloudflare ECDSA reservation wire. */
 export type LinkedDeviceEcdsaSourceDerivationV1 = {
     readonly applicationBindingDigestB64u: DigestB64u;
@@ -50,7 +50,7 @@ export type LinkedDeviceEd25519SourceContributionPreparationV1 = {
     readonly walletKeyId: WalletKeyId;
     readonly targetDeviceId: DeviceId;
     readonly targetFactorVerificationDigestB64u: DigestB64u;
-    readonly sourceBinding: RouterAbEd25519YaoCeremonyBindingV1;
+    readonly sourceBinding: RouterAbEd25519YaoActivationBindingV1;
     readonly targetAdmission: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
     readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
     readonly sourceRevocationEpoch: number;
@@ -120,10 +120,10 @@ export type LinkedDeviceEd25519SourceContributionV1 = {
     readonly targetClientRecipientPublicKeyB64u: string;
     readonly targetSigningWorkerRecipientPublicKeyB64u: string;
     readonly sourceRegisteredPublicKeyB64u: Ed25519PublicKeyB64u;
-    readonly sourceBinding: RouterAbEd25519YaoCeremonyBindingV1;
+    readonly sourceBinding: RouterAbEd25519YaoActivationBindingV1;
     /** Exact inactive reservation returned by Router source-preserving execution. */
     readonly reservationId: string;
-    readonly targetBinding: RouterAbEd25519YaoCeremonyBindingV1;
+    readonly targetBinding: RouterAbEd25519YaoActivationBindingV1<'registration'>;
     readonly activationReceipt: RouterAbEd25519YaoActivationPublicReceiptV1;
     readonly participantIds: readonly [number, number];
     readonly deriver_a_client_package: RouterAbEd25519YaoActivationClientPackageV1<'deriver_a'>;

package/dist/types/shared-ts/src/passkey-custody/custodyEnvelope.d.ts

@@ -3,9 +3,9 @@ import type { DigestB64u } from '../utils/canonicalPrimitives';
 import type { PasskeyCustodySecretBinding } from './custodySecretBinding';
 import type { EnvelopeCiphertextB64u, EnvelopeNonceB64u, EnvelopeRevision } from './primitives';
 import type { ExclusiveUnion } from '../utils/variant';
-export declare const WALLET_CUSTODY_ENVELOPE_VERSION_V2: "wallet_custody_envelope_v2";
-declare const PASSKEY_PRF_KEK_VERSION_V1: "passkey_prf_kek_hkdf_sha256_v1";
-declare const EMAIL_OTP_FACTOR_KEK_VERSION_V1: "email_otp_factor_kek_hkdf_sha256_v1";
+export declare const WALLET_CUSTODY_ENVELOPE_VERSION_V2: 'wallet_custody_envelope_v2';
+declare const PASSKEY_PRF_KEK_VERSION_V1: 'passkey_prf_kek_hkdf_sha256_v1';
+declare const EMAIL_OTP_FACTOR_KEK_VERSION_V1: 'email_otp_factor_kek_hkdf_sha256_v1';
 type WalletCustodyEnvelopeVersion = typeof WALLET_CUSTODY_ENVELOPE_VERSION_V2;
 type PasskeyPrfKekVersion = typeof PASSKEY_PRF_KEK_VERSION_V1;
 type EmailOtpFactorKekVersion = typeof EMAIL_OTP_FACTOR_KEK_VERSION_V1;

package/dist/types/shared-ts/src/passkey-custody/custodySecretBinding.d.ts

@@ -14,7 +14,7 @@ import type { Ed25519PublicKeyB64u, Secp256k1CompressedPublicKeyB64u } from './p
  */
 export type PasskeyCustodySecretKind = 'wallet_custody_seed_v1' | 'ed25519_yao_client_root_v1' | 'ed25519_lane_holder_share_v1' | 'ecdsa_lane_holder_share_v1';
 /** The only derivation scheme owner custody supports. */
-declare const WALLET_SEED_DERIVATION_SCHEME_V1: "wallet_seed_parallel_hkdf_sha256_v1";
+declare const WALLET_SEED_DERIVATION_SCHEME_V1: 'wallet_seed_parallel_hkdf_sha256_v1';
 type WalletSeedDerivationScheme = typeof WALLET_SEED_DERIVATION_SCHEME_V1;
 export type PasskeyCustodySecretBinding = {
     /**

package/dist/types/shared-ts/src/tenant-root/tenantRootIdentity.d.ts

@@ -67,6 +67,6 @@ export declare function buildTenantRootIdentityFromAuthenticatedDeploymentV1(inp
 /** Decodes the exact private wire/persistence representation of the identity. */
 export declare function decodeTenantRootIdentityWireV1(value: unknown): TenantRootIdentityDecodeResultV1<TenantRootIdentityV1>;
 /** Encodes the exact Rust-compatible canonical identity bytes. */
-export declare function encodeTenantRootIdentityV1(identity: TenantRootIdentityV1): Uint8Array;
+export declare function encodeTenantRootIdentityV1(identity: TenantRootIdentityV1): Uint8Array<ArrayBuffer>;
 export {};
 //# sourceMappingURL=tenantRootIdentity.d.ts.map

package/dist/types/shared-ts/src/tenant-root/tenantRootOperationRecord.d.ts

@@ -18,7 +18,7 @@ export type TenantRootOperationSubjectV1 = {
 };
 /** The single Deriver role a role-local operation acts on. */
 export type TenantRootDeriverRoleV1 = 'deriver_a' | 'deriver_b';
-export declare const TENANT_ROOT_RESTORE_ROLE_IMPORT_KEY_ISSUE_OPERATION_KIND_V1: "tenant_root_restore_role_import_key_issue_v1";
+export declare const TENANT_ROOT_RESTORE_ROLE_IMPORT_KEY_ISSUE_OPERATION_KIND_V1: 'tenant_root_restore_role_import_key_issue_v1';
 type TenantRootOperationRecordWithActiveRootV1 = {
     readonly formatVersion: typeof TENANT_ROOT_OPERATION_RECORD_FORMAT_V1;
     readonly operationKind: Exclude<TenantRootOperationKindV1, typeof TENANT_ROOT_RESTORE_ROLE_IMPORT_KEY_ISSUE_OPERATION_KIND_V1>;
@@ -157,7 +157,7 @@ export type TenantRootRestoreRoleImportKeyIssueOperationInputV1 = {
 };
 /** Inputs the console resolves before building a record. */
 export type TenantRootOperationRecordInputV1 = TenantRootOperationRecordInputWithActiveRootV1 | TenantRootRestoreRoleImportKeyIssueOperationInputV1;
-declare const TENANT_ROOT_OPERATION_KINDS_V1: readonly ["tenant_root_operational_share_rotation_v1", "tenant_root_recovery_governance_change_v1", "tenant_root_recovery_recipient_pair_enroll_v1", "tenant_root_recovery_recipient_pair_replace_v1", "tenant_root_recovery_backup_create_v1", "tenant_root_recovery_backup_replace_v1", "tenant_root_recovery_role_package_download_v1", "tenant_root_recovery_manifest_download_v1", "tenant_root_restore_session_start_v1", "tenant_root_restore_manifest_register_v1", "tenant_root_restore_role_import_key_issue_v1", "tenant_root_restore_role_import_v1", "tenant_root_restore_activate_v1", "tenant_root_source_lineage_retire_v1"];
+declare const TENANT_ROOT_OPERATION_KINDS_V1: readonly ['tenant_root_operational_share_rotation_v1', 'tenant_root_recovery_governance_change_v1', 'tenant_root_recovery_recipient_pair_enroll_v1', 'tenant_root_recovery_recipient_pair_replace_v1', 'tenant_root_recovery_backup_create_v1', 'tenant_root_recovery_backup_replace_v1', 'tenant_root_recovery_role_package_download_v1', 'tenant_root_recovery_manifest_download_v1', 'tenant_root_restore_session_start_v1', 'tenant_root_restore_manifest_register_v1', 'tenant_root_restore_role_import_key_issue_v1', 'tenant_root_restore_role_import_v1', 'tenant_root_restore_activate_v1', 'tenant_root_source_lineage_retire_v1'];
 /** Returns the four operations that follow the tenant's recovery governance. */
 export declare function tenantRootOperationFollowsGovernanceV1(kind: TenantRootOperationKindV1): boolean;
 /** Returns the maximum authorization lifetime for one operation. */

package/dist/types/shared-ts/src/utils/base64.d.ts

@@ -17,7 +17,7 @@ export declare const base64Encode: (value: ArrayBufferLike | ArrayBufferView) =>
  * @returns Uint8Array containing the decoded bytes
  * @throws Error if decoding fails due to invalid base64 input
  */
-export declare function base64Decode(base64: string): Uint8Array;
+export declare function base64Decode(base64: string): Uint8Array<ArrayBuffer>;
 /**
  * Encodes an ArrayBuffer into a base64url string.
  * Converts binary data to base64 then replaces standard base64 characters with URL-safe ones:
@@ -40,7 +40,7 @@ export declare const base64UrlEncode: (value: ArrayBufferLike | ArrayBufferView)
  * @returns Uint8Array containing the decoded bytes
  * @throws Error if decoding fails due to invalid base64url input
  */
-export declare function base64UrlDecode(base64Url: string): Uint8Array;
+export declare function base64UrlDecode(base64Url: string): Uint8Array<ArrayBuffer>;
 /**
  * Converts an ArrayBuffer or ArrayBufferLike object to a plain number array for WASM compatibility.
  * WASM bindings require plain number arrays rather than TypedArrays for memory safety and direct access.

package/dist/types/shared-ts/src/utils/digestEncoding.d.ts

@@ -1,5 +1,5 @@
 import { type DigestB64u } from './canonicalPrimitives';
-export declare function concat(parts: readonly Uint8Array[]): Uint8Array;
+export declare function concat(parts: readonly Uint8Array[]): Uint8Array<ArrayBuffer>;
 export declare function u32(value: number, label: string): Uint8Array;
 export declare function u64(value: number, label: string): Uint8Array;
 export declare function lp32(value: Uint8Array, label: string): Uint8Array;

package/dist/types/shared-ts/src/utils/digests.d.ts

@@ -1,6 +1,6 @@
 export declare function alphabetizeStringify(input: unknown): string;
-export declare function sha256BytesUtf8(input: string): Promise<Uint8Array>;
-export declare function sha256Bytes(input: Uint8Array): Promise<Uint8Array>;
+export declare function sha256BytesUtf8(input: string): Promise<Uint8Array<ArrayBuffer>>;
+export declare function sha256Bytes(input: Uint8Array): Promise<Uint8Array<ArrayBuffer>>;
 export declare function bytesToUnprefixedHex(bytes: Uint8Array): string;
 export declare function sha256HexUtf8(input: string): Promise<string>;
 //# sourceMappingURL=digests.d.ts.map