@seams/wallet-server 0.20.0 → 0.22.0

package/dist/esm/router/transport/fetch/routes/auth.js

@@ -1,3 +1,4 @@
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { resolveThresholdRuntimePolicyScope } from "../../../auth/commonRouterUtils.js";
 import { json, jsonFailure, readJson } from "../../../framework/http.js";
@@ -9,6 +10,9 @@ function assertNeverAuthProviderAction(route) {
 function assertNeverAuthIdentityMutation(route) {
 	throw new Error(`Unsupported auth identity mutation: ${String(route)}`);
 }
+function hasFullOwnerAuthority(context) {
+	return sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions: context.authority.permissions }), buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() }));
+}
 async function requireExactWalletSession(ctx) {
 	const token = extractBearerCredential(ctx.request.headers);
 	if (!token) return {
@@ -74,6 +78,7 @@ async function handleAuth(ctx) {
 		const command = parsed.request;
 		const sess = await requireExactWalletSession(ctx);
 		if (!sess.ok) return sess.response;
+		if (!hasFullOwnerAuthority(sess.context)) return jsonFailure(403, "forbidden", "Full owner authority is required to manage identities");
 		const walletId = String(sess.context.authorization.session.walletId);
 		const stepUpRequest = command.request.stepUp;
 		const stepUp = await requireExactPasskeyStepUp({

package/dist/esm/router/transport/fetch/routes/passkeyCustody.js

@@ -2,6 +2,7 @@ import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWallet
 import { buildVaultOperationRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseDeviceId, parsePrincipalId, parseTenantId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
@@ -15,11 +16,12 @@ import { toFetchRouteResponse } from "../../../framework/routeResponses.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { readJson } from "../../../framework/http.js";
+import { parseWebAuthnAuthenticationCredential, unredactedWebAuthnExtensionField } from "../../../auth/webAuthnCredentialCodecs.js";
+import { parseCustodyOwnerProof, parseRecoveryBackupAcknowledgementRequest, parseRecoveryStatusRequest, requireExactObjectFields } from "./walletCustodyRequestBoundary.js";
 import { isHostWithinRpId, originHostnameOrEmpty } from "../../../../core/authService/webauthnOidcHelpers.js";
 import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { computeWalletCustodyAdminChallengeDigest } from "../../../../shared-ts/src/authorization/walletCustodyOperation.js";
 import { parseWalletRecoveryTargetV1 } from "../../../../shared-ts/src/wallet-recovery/walletRecoveryTarget.js";
-import { parseWebAuthnAuthenticationCredential } from "../../../auth/webAuthnCredentialCodecs.js";
 import { emailOtpStatusCode, hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { parseDerivedWalletRecoveryKeyId } from "../../../../shared-ts/src/wallet-recovery/recoveryKeyId.js";
@@ -53,51 +55,8 @@ const EMAIL_OTP_CHALLENGE_ROUTE_ID = "wallet_custody_email_otp_challenge";
 const ENVELOPE_OWNERSHIP_UPGRADE_ROUTE_ID = "wallet_custody_envelope_ownership_upgrade";
 const CUSTODY_OPERATION_CAPABILITY_ID = "wallet-custody-admin";
 const CUSTODY_PROOF_TTL_MS = 6e4;
-function requireExactObjectFields(value, fields, label) {
-	const keys = Object.keys(value).sort();
-	const expected = [...fields].sort();
-	if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])) throw new Error(`${label} contains unsupported fields`);
-}
-function parseCustodyOwnerProof(value) {
-	if (!isPlainObject(value)) throw new Error("factorProof is required");
-	const kind = normalizeOptionalTrimmedString(value.kind);
-	if (kind === "passkey") {
-		requireExactObjectFields(value, [
-			"kind",
-			"walletId",
-			"rpId",
-			"credentialIdB64u",
-			"challenge_digest",
-			"webauthn_authentication"
-		], "factorProof");
-		const webauthnAuthentication = parseWebAuthnAuthenticationCredential(value.webauthn_authentication);
-		if (!webauthnAuthentication) throw new Error("factorProof.webauthn_authentication is invalid");
-		return {
-			kind,
-			walletId: requireTrimmedString(value.walletId, "factorProof.walletId"),
-			rpId: requireTrimmedString(value.rpId, "factorProof.rpId"),
-			credentialIdB64u: requireTrimmedString(value.credentialIdB64u, "factorProof.credentialIdB64u"),
-			challenge_digest: requireTrimmedString(value.challenge_digest, "factorProof.challenge_digest"),
-			webauthn_authentication: webauthnAuthentication
-		};
-	}
-	if (kind === "email_otp") {
-		requireExactObjectFields(value, [
-			"kind",
-			"provider_subject_id",
-			"challenge_id",
-			"otp_code",
-			"challenge_digest"
-		], "factorProof");
-		return {
-			kind,
-			provider_subject_id: requireTrimmedString(value.provider_subject_id, "factorProof.provider_subject_id"),
-			challenge_id: requireTrimmedString(value.challenge_id, "factorProof.challenge_id"),
-			otp_code: requireTrimmedString(value.otp_code, "factorProof.otp_code"),
-			challenge_digest: requireTrimmedString(value.challenge_digest, "factorProof.challenge_digest")
-		};
-	}
-	throw new Error("factorProof.kind must be passkey or email_otp");
+function hasFullOwnerAuthority(authority) {
+	return sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions: authority.permissions }), buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() }));
 }
 function parseRequiredAuthorizationValue(parsed) {
 	if (!parsed.ok) throw new Error(parsed.error.message);
@@ -190,8 +149,13 @@ async function authorizeWalletCustodyOperation(input) {
 		} catch (error) {
 			return toCustodyAuthorizationFailure(400, "invalid_owner_proof", error instanceof Error ? error.message : "passkey authority is invalid");
 		}
-		const active = await input.ctx.service.walletAuthMethods.verifyActivePasskeyAuthority(authority);
+		const active = await input.ctx.service.walletAuthMethods.resolveActivePasskeyAuthorityForVerifiedCredential({
+			walletId,
+			rpId: authority.verifier.rpId,
+			credentialIdB64u: authority.factor.credentialIdB64u
+		});
 		if (!active.ok) return toCustodyAuthorizationFailure(403, active.code, active.message);
+		if (!hasFullOwnerAuthority(active.walletAuthority)) return toCustodyAuthorizationFailure(403, "forbidden", "Full owner authority is required");
 		const credential = parseWebAuthnAuthenticationCredential(proof.webauthn_authentication);
 		if (!credential) return toCustodyAuthorizationFailure(400, "invalid_owner_proof", "passkey assertion is invalid");
 		if (String(credential.rawId || credential.id).trim() !== authority.factor.credentialIdB64u) return toCustodyAuthorizationFailure(401, "unauthorized", "passkey credential changed");
@@ -207,7 +171,7 @@ async function authorizeWalletCustodyOperation(input) {
 			tenantId: operation.tenantId,
 			principalId: operation.principalId,
 			walletId,
-			authorityRef: await walletAuthAuthorityRef({ authority }),
+			authorityRef: await walletAuthAuthorityRef({ authority: active.authority }),
 			requestOrigin: origin,
 			audience: origin,
 			factorId: parseRequiredAuthorizationValue(parseAuthFactorId(`passkey:${authority.factor.credentialIdB64u}`)),
@@ -356,7 +320,10 @@ async function completeWalletCustodyOperation(ctx, operation, status, body, resu
 }
 async function handlePasskeyCustody(ctx) {
 	if (!matchRoute(ctx, ROUTE_ID)) return null;
-	const request = parseWireRequest(await readJsonObject(ctx.request), ctx.request.headers.get("origin"));
+	const body = await readJsonObject(ctx.request);
+	const extensionField = unredactedWebAuthnExtensionField(body?.webauthnAuthentication);
+	if (extensionField) return routeErrorResponse(400, "prf_disclosed", `webauthnAuthentication.${extensionField} must be redacted before retrieval`);
+	const request = parseWireRequest(body, ctx.request.headers.get("origin"));
 	if (!request) return routeErrorResponse(400, "invalid_request", "custody retrieval needs a locator, a challenge id, and an assertion");
 	return toFetchRouteResponse(await ctx.service.passkeyCustody.retrieveEnvelope(request));
 }
@@ -381,7 +348,7 @@ function parseWalletCustodyEmailOtpChallengeRequest(value, actualOrigin) {
 	const walletId = parseRequiredAuthorizationValue(parseWalletId(value.walletId));
 	const providerSubjectId = parseRequiredAuthorizationValue(parseProviderSubject(value.providerSubjectId));
 	const operation = value.operation;
-	if (operation !== "credentials_list" && operation !== "credential_label" && operation !== "recovery_rotate" && operation !== "recovery_read") throw new Error("Email OTP custody challenge operation is invalid");
+	if (operation !== "credentials_list" && operation !== "credential_label" && operation !== "recovery_rotate" && operation !== "recovery_read" && operation !== "recovery_status" && operation !== "recovery_backup_acknowledge") throw new Error("Email OTP custody challenge operation is invalid");
 	if (!isPlainObject(value.payload)) throw new Error("Email OTP custody challenge payload is invalid");
 	if (value.requestOrigin !== void 0 && value.requestOrigin !== actualOrigin) throw new Error("Email OTP custody challenge requestOrigin does not match Origin");
 	return {
@@ -1100,6 +1067,8 @@ function parseWalletRecoveryFinalizeBody(value) {
 		"ecdsaMaterialPossessionProofs"
 	], "wallet recovery finalization");
 	if (!isPlainObject(value.webauthnRegistration)) throw new Error("wallet recovery finalization registration is invalid");
+	const extensionField = unredactedWebAuthnExtensionField(value.webauthnRegistration);
+	if (extensionField) throw new Error(`wallet recovery finalization registration ${extensionField} must be redacted`);
 	return {
 		kind: "finalize",
 		...identity,
@@ -1133,23 +1102,41 @@ function authorizedOperationReplay(operation) {
 }
 async function handleWalletRecoveryBackupAcknowledge(ctx) {
 	if (!matchRoute(ctx, RECOVERY_ACK_ROUTE_ID)) return null;
-	const body = await readJsonObject(ctx.request);
-	let walletId = "";
+	let request;
 	try {
-		if (!body) throw new Error("acknowledgement body is required");
-		requireExactObjectFields(body, ["walletId"], "recovery backup acknowledgement");
-		walletId = requireTrimmedString(body.walletId, "walletId");
+		request = parseRecoveryBackupAcknowledgementRequest(await readJsonObject(ctx.request));
 	} catch {
-		return routeErrorResponse(400, "invalid_request", "an acknowledgement needs a wallet");
+		return routeErrorResponse(400, "invalid_request", "acknowledgement body is invalid");
 	}
-	const result = await ctx.service.passkeyCustody.acknowledgeRecoveryBackup({ walletId });
-	if (result.kind === "no_recovery_set") return routeErrorResponse(404, "no_recovery_set", "this wallet has no issued recovery codes to acknowledge");
-	return toFetchRouteResponse({
-		status: 200,
-		body: {
-			ok: true,
-			issuedAtMs: result.issuedAtMs
-		}
+	const authorized = await authorizeWalletCustodyOperation({
+		ctx,
+		walletId: request.walletId,
+		operation: "recovery_backup_acknowledge",
+		payload: {
+			walletId: request.walletId,
+			requestId: request.requestId,
+			expectedIssuedAtMs: request.expectedIssuedAtMs
+		},
+		factorProof: request.factorProof
+	});
+	if (!authorized.ok) return authorized.response;
+	const result = await ctx.service.passkeyCustody.acknowledgeRecoveryBackup({
+		walletId: request.walletId,
+		expectedIssuedAtMs: request.expectedIssuedAtMs
+	});
+	if (result.kind === "conflict") return await completeWalletCustodyOperation(ctx, authorized.operation, 409, {
+		ok: false,
+		code: "recovery_set_conflict",
+		message: "the recovery set changed"
+	}, "failed_before_side_effect");
+	if (result.kind === "no_recovery_set") return await completeWalletCustodyOperation(ctx, authorized.operation, 404, {
+		ok: false,
+		code: "no_recovery_set",
+		message: "this wallet has no issued recovery codes to acknowledge"
+	}, "failed_before_side_effect");
+	return await completeWalletCustodyOperation(ctx, authorized.operation, 200, {
+		ok: true,
+		issuedAtMs: result.issuedAtMs
 	});
 }
 /**
@@ -1253,39 +1240,42 @@ async function handleWalletRecoveryRead(ctx) {
 		storeVersion: result.storeVersion
 	});
 }
-/**
-* Reporting recovery status to the wallet's owner.
-*
-* The wallet comes from the path. Origin binding keeps this count endpoint
-* scoped to browser callers without exposing recovery identifiers.
-*
-* Counts only, never identifiers. Which codes remain is not something even
-* the owner's browser needs, and a list would be one leak away from being
-* useful to someone else.
-*/
+/** Reports current recovery-code counts after fresh owner proof. */
 async function handleWalletRecoveryStatus(ctx) {
 	const route = matchRoute(ctx, RECOVERY_STATUS_ROUTE_ID);
 	if (!route) return null;
 	const walletId = walletIdFromPath(route.path, ctx.pathname);
 	if (!walletId) return routeErrorResponse(400, "invalid_request", "status needs a wallet");
-	const origin = normalizeOptionalTrimmedString(ctx.request.headers.get("origin"));
+	let request;
 	try {
-		parseSessionOrigin(origin);
+		request = parseRecoveryStatusRequest(await readJsonObject(ctx.request));
 	} catch {
-		return routeErrorResponse(400, "invalid_origin", "request Origin is invalid");
+		return routeErrorResponse(400, "invalid_request", "status body is invalid");
 	}
+	const authorized = await authorizeWalletCustodyOperation({
+		ctx,
+		walletId,
+		operation: "recovery_status",
+		payload: {
+			walletId,
+			requestId: request.requestId
+		},
+		factorProof: request.factorProof
+	});
+	if (!authorized.ok) return authorized.response;
 	const result = await ctx.service.passkeyCustody.readRecoveryStatus({ walletId });
-	if (result.kind === "no_recovery_set") return routeErrorResponse(404, "no_recovery_set", "this wallet has no recovery codes");
-	return toFetchRouteResponse({
-		status: 200,
-		body: {
-			ok: true,
-			activeCodeCount: result.activeCodeCount,
-			totalCodeCount: result.totalCodeCount,
-			issuedAtMs: result.issuedAtMs,
-			storeVersion: result.storeVersion,
-			backupOutstanding: result.backupOutstanding
-		}
+	if (result.kind === "no_recovery_set") return await completeWalletCustodyOperation(ctx, authorized.operation, 404, {
+		ok: false,
+		code: "no_recovery_set",
+		message: "this wallet has no recovery codes"
+	}, "failed_before_side_effect");
+	return await completeWalletCustodyOperation(ctx, authorized.operation, 200, {
+		ok: true,
+		activeCodeCount: result.activeCodeCount,
+		totalCodeCount: result.totalCodeCount,
+		issuedAtMs: result.issuedAtMs,
+		storeVersion: result.storeVersion,
+		backupOutstanding: result.backupOutstanding
 	});
 }
 function walletIdFromPath(routePath, pathname) {

package/dist/esm/router/transport/fetch/routes/sessions.js

@@ -871,7 +871,10 @@ async function handleWalletEmailOtpFactorRelease(ctx) {
 		if (!consumed.ok) return json(consumed, { status: emailOtpStatusCode(consumed.code) });
 		factorReleaseChallengeId = consumed.challengeId;
 	}
-	const unsealed = await ctx.service.emailOtp.removeEmailOtpServerSeal({ wrappedCiphertext: enrollment.enrollment.serverSealedFactorCiphertextB64u });
+	const unsealed = await ctx.service.emailOtp.removeEmailOtpServerSeal({
+		wrappedCiphertext: enrollment.enrollment.serverSealedFactorCiphertextB64u,
+		enrollmentSealKeyVersion: enrollment.enrollment.enrollmentSealKeyVersion
+	});
 	if (!unsealed.ok) return json(unsealed, { status: emailOtpStatusCode(unsealed.code) });
 	if (unsealed.enrollmentSealKeyVersion !== enrollment.enrollment.enrollmentSealKeyVersion) return json({
 		ok: false,

package/dist/esm/router/transport/fetch/routes/thresholdEd25519.js

@@ -126,7 +126,10 @@ function buildRouterAbEd25519AuthorizedOperationWire(input) {
 	});
 }
 async function releaseEmailOtpFactorForWorker(input) {
-	const unsealed = await input.emailOtp.removeEmailOtpServerSeal({ wrappedCiphertext: input.request.enrollment.serverSealedFactorCiphertextB64u });
+	const unsealed = await input.emailOtp.removeEmailOtpServerSeal({
+		wrappedCiphertext: input.request.enrollment.serverSealedFactorCiphertextB64u,
+		enrollmentSealKeyVersion: input.request.enrollment.enrollmentSealKeyVersion
+	});
 	if (!unsealed.ok) return unsealed;
 	if (unsealed.enrollmentSealKeyVersion !== input.request.enrollment.enrollmentSealKeyVersion) return {
 		ok: false,

package/dist/esm/router/transport/fetch/routes/walletCustodyRequestBoundary.js

@@ -0,0 +1,80 @@
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { isPlainObject, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
+import { parseUnixMs } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { parseWebAuthnAuthenticationCredential, unredactedWebAuthnExtensionField } from "../../../auth/webAuthnCredentialCodecs.js";
+//#region src/router/transport/fetch/routes/walletCustodyRequestBoundary.ts
+function requireExactObjectFields(value, fields, label) {
+	const keys = Object.keys(value).sort();
+	const expected = [...fields].sort();
+	if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])) throw new Error(`${label} contains unsupported fields`);
+}
+function parseCustodyOwnerProof(value) {
+	if (!isPlainObject(value)) throw new Error("factorProof is required");
+	const kind = normalizeOptionalTrimmedString(value.kind);
+	if (kind === "passkey") {
+		requireExactObjectFields(value, [
+			"kind",
+			"walletId",
+			"rpId",
+			"credentialIdB64u",
+			"challenge_digest",
+			"webauthn_authentication"
+		], "factorProof");
+		const extensionField = unredactedWebAuthnExtensionField(value.webauthn_authentication);
+		if (extensionField) throw new Error(`factorProof.webauthn_authentication.${extensionField} must be redacted`);
+		const webauthnAuthentication = parseWebAuthnAuthenticationCredential(value.webauthn_authentication);
+		if (!webauthnAuthentication) throw new Error("factorProof.webauthn_authentication is invalid");
+		return {
+			kind,
+			walletId: requireTrimmedString(value.walletId, "factorProof.walletId"),
+			rpId: requireTrimmedString(value.rpId, "factorProof.rpId"),
+			credentialIdB64u: requireTrimmedString(value.credentialIdB64u, "factorProof.credentialIdB64u"),
+			challenge_digest: requireTrimmedString(value.challenge_digest, "factorProof.challenge_digest"),
+			webauthn_authentication: webauthnAuthentication
+		};
+	}
+	if (kind === "email_otp") {
+		requireExactObjectFields(value, [
+			"kind",
+			"provider_subject_id",
+			"challenge_id",
+			"otp_code",
+			"challenge_digest"
+		], "factorProof");
+		return {
+			kind,
+			provider_subject_id: requireTrimmedString(value.provider_subject_id, "factorProof.provider_subject_id"),
+			challenge_id: requireTrimmedString(value.challenge_id, "factorProof.challenge_id"),
+			otp_code: requireTrimmedString(value.otp_code, "factorProof.otp_code"),
+			challenge_digest: requireTrimmedString(value.challenge_digest, "factorProof.challenge_digest")
+		};
+	}
+	throw new Error("factorProof.kind must be passkey or email_otp");
+}
+function parseRecoveryBackupAcknowledgementRequest(body) {
+	if (!isPlainObject(body)) throw new Error("acknowledgement body is required");
+	requireExactObjectFields(body, [
+		"expectedIssuedAtMs",
+		"factorProof",
+		"requestId",
+		"walletId"
+	], "recovery backup acknowledgement");
+	return {
+		walletId: requireTrimmedString(body.walletId, "walletId"),
+		requestId: requireTrimmedString(body.requestId, "requestId"),
+		expectedIssuedAtMs: parseUnixMs(body.expectedIssuedAtMs, "expectedIssuedAtMs"),
+		factorProof: body.factorProof
+	};
+}
+function parseRecoveryStatusRequest(body) {
+	if (!isPlainObject(body)) throw new Error("status body is required");
+	requireExactObjectFields(body, ["factorProof", "requestId"], "recovery status");
+	return {
+		requestId: requireTrimmedString(body.requestId, "requestId"),
+		factorProof: body.factorProof
+	};
+}
+//#endregion
+export { parseCustodyOwnerProof, parseRecoveryBackupAcknowledgementRequest, parseRecoveryStatusRequest, requireExactObjectFields };
+
+//# sourceMappingURL=walletCustodyRequestBoundary.js.map

package/dist/esm/shared-ts/src/passkey-custody/ceremonyCommitPayload.js

@@ -1,3 +1,4 @@
+import { parseUnixMs } from "./primitives.js";
 //#region ../shared-ts/src/passkey-custody/ceremonyCommitPayload.ts
 /**
 * Reads a commit payload off the wire without judging it.
@@ -42,8 +43,11 @@ function parseWalletCustodyRegistrationOutcome(value, label) {
 	const record = value;
 	switch (record.status) {
 		case "not_requested":
-		case "committed":
 		case "custody_already_established": return { status: record.status };
+		case "committed": return {
+			status: "committed",
+			issuedAtMs: parseUnixMs(record.issuedAtMs, `${label}.issuedAtMs`)
+		};
 		case "joined": {
 			const digest = record.keyManifestDigestB64u;
 			if (typeof digest !== "string" || !digest) throw new Error(`${label} joined custody carries no key manifest digest`);

package/dist/esm/shared-ts/src/utils/evmRpcResults.js

@@ -31,17 +31,19 @@ function decodeEvmTransactionReceipt(value) {
 	if (typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid eth_getTransactionReceipt result");
 	const record = value;
 	const transactionHash = optionalRpcHexData(record, "transactionHash", "eth_getTransactionReceipt");
+	if (typeof transactionHash !== "string" || !/^0x[0-9a-fA-F]{64}$/.test(transactionHash)) throw new Error("Invalid eth_getTransactionReceipt result: transactionHash");
 	const from = optionalRpcAddress(record, "from", "eth_getTransactionReceipt");
 	const blockNumber = optionalRpcHexQuantity(record, "blockNumber", "eth_getTransactionReceipt");
 	const status = optionalRpcHexQuantity(record, "status", "eth_getTransactionReceipt");
+	if (typeof blockNumber !== "string" || typeof status !== "string") throw new Error("Invalid eth_getTransactionReceipt result: missing blockNumber or status");
 	const gasUsed = optionalRpcHexQuantity(record, "gasUsed", "eth_getTransactionReceipt");
 	const effectiveGasPrice = optionalRpcHexQuantity(record, "effectiveGasPrice", "eth_getTransactionReceipt");
 	const gasPrice = optionalRpcHexQuantity(record, "gasPrice", "eth_getTransactionReceipt");
 	return {
-		...transactionHash !== void 0 ? { transactionHash } : {},
+		transactionHash,
 		...from !== void 0 ? { from } : {},
-		...blockNumber !== void 0 ? { blockNumber } : {},
-		...status !== void 0 ? { status } : {},
+		blockNumber,
+		status,
 		...gasUsed !== void 0 ? { gasUsed } : {},
 		...effectiveGasPrice !== void 0 ? { effectiveGasPrice } : {},
 		...gasPrice !== void 0 ? { gasPrice } : {}

package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js

@@ -1405,6 +1405,7 @@ function parseRouterAbEcdsaOperationStepUpWebAuthnCredentialV1(value) {
 		"signature",
 		"userHandle"
 	]);
+	if (credential.clientExtensionResults !== null) throw new Error("webauthn_authentication.clientExtensionResults must be redacted");
 	const authenticatorAttachment = credential.authenticatorAttachment === null ? null : requireAsciiNonEmptyString(credential.authenticatorAttachment, "webauthn_authentication.authenticatorAttachment");
 	const userHandle = response.userHandle === null ? null : requireAsciiNonEmptyString(response.userHandle, "webauthn_authentication.response.userHandle");
 	return {
@@ -1418,7 +1419,7 @@ function parseRouterAbEcdsaOperationStepUpWebAuthnCredentialV1(value) {
 			signature: requireAsciiNonEmptyString(response.signature, "webauthn_authentication.response.signature"),
 			userHandle
 		},
-		clientExtensionResults: credential.clientExtensionResults
+		clientExtensionResults: null
 	};
 }
 function parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1(value) {