@seams/wallet-server 0.5.0

package/dist/esm/shared-ts/src/passkey-custody/custodyEnvelope.js

@@ -0,0 +1,272 @@
+import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
+import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseUnixMs, rejectUnknownFields, requireRecord } from "./primitives.js";
+import { parsePasskeyCustodySecretBinding } from "./custodySecretBinding.js";
+//#region ../shared-ts/src/passkey-custody/custodyEnvelope.ts
+const WALLET_CUSTODY_ENVELOPE_VERSION_V2 = "wallet_custody_envelope_v2";
+const PASSKEY_PRF_KEK_VERSION_V1 = "passkey_prf_kek_hkdf_sha256_v1";
+const EMAIL_OTP_FACTOR_KEK_VERSION_V1 = "email_otp_factor_kek_hkdf_sha256_v1";
+const ENVELOPE_OWNERSHIP_FIELDS = ["kind", "walletAuthMethodId"];
+function parseWalletCustodyEnvelopeOwnership(raw, label) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error(`${label} must be an object`);
+	const record = raw;
+	rejectUnknownFields(record, ENVELOPE_OWNERSHIP_FIELDS, label);
+	switch (record.kind) {
+		case "unbound":
+			if (record.walletAuthMethodId !== void 0) throw new Error(`${label}.walletAuthMethodId belongs to the method_bound branch`);
+			return { kind: "unbound" };
+		case "method_bound": {
+			const parsed = parseWalletAuthMethodId(record.walletAuthMethodId);
+			if (!parsed.ok) throw new Error(`${label}.walletAuthMethodId ${parsed.error.message}`);
+			return {
+				kind: "method_bound",
+				walletAuthMethodId: parsed.value
+			};
+		}
+		default: throw new Error(`${label}.kind must be unbound or method_bound`);
+	}
+}
+/**
+* Reads the serde shape back — the inverse of `custodyEnvelopeOwnershipWireV1`.
+*
+* The record shape and the wire shape are deliberately different: one is
+* TypeScript's tagged union, the other is what `serde` emits for a Rust enum.
+* Anything that came out of wasm carries the wire shape, and passing it to the
+* record parser would reject a perfectly valid ownership for having no `kind`.
+*/
+function parseWalletCustodyEnvelopeOwnershipWireV1(raw, label) {
+	if (raw === "unbound") return { kind: "unbound" };
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error(`${label} must be "unbound" or a methodBound object`);
+	const record = raw;
+	rejectUnknownFields(record, ["methodBound"], label);
+	const methodBound = record.methodBound;
+	if (typeof methodBound !== "object" || methodBound === null || Array.isArray(methodBound)) throw new Error(`${label}.methodBound must be an object`);
+	const fields = methodBound;
+	rejectUnknownFields(fields, ["walletAuthMethodId"], `${label}.methodBound`);
+	const parsed = parseWalletAuthMethodId(fields.walletAuthMethodId);
+	if (!parsed.ok) throw new Error(`${label}.methodBound.walletAuthMethodId ${parsed.error.message}`);
+	return {
+		kind: "method_bound",
+		walletAuthMethodId: parsed.value
+	};
+}
+function buildPasskeyEnvelopeFactor(args) {
+	return {
+		kind: "passkey",
+		rpId: args.rpId,
+		credentialIdB64u: args.credentialIdB64u,
+		kekVersion: PASSKEY_PRF_KEK_VERSION_V1
+	};
+}
+function buildEmailOtpEnvelopeFactor(args) {
+	return {
+		kind: "email_otp",
+		enrollmentId: args.enrollmentId,
+		enrollmentSealKeyVersion: args.enrollmentSealKeyVersion,
+		kekVersion: EMAIL_OTP_FACTOR_KEK_VERSION_V1
+	};
+}
+function buildActiveEnvelopeLifecycle(args) {
+	return {
+		state: "active",
+		activatedAtMs: args.activatedAtMs
+	};
+}
+function buildRetiredEnvelopeLifecycle(args) {
+	return {
+		state: "retired",
+		activatedAtMs: args.activatedAtMs,
+		retiredAtMs: args.retiredAtMs
+	};
+}
+function buildRevokedEnvelopeLifecycle(args) {
+	return {
+		state: "revoked",
+		activatedAtMs: args.activatedAtMs,
+		revokedAtMs: args.revokedAtMs
+	};
+}
+function buildPasskeyCustodyEnvelopeRecord(args) {
+	return {
+		kind: "wallet_custody_envelope_v2",
+		envelopeId: args.envelopeId,
+		walletId: args.walletId,
+		ownership: args.ownership,
+		binding: args.binding,
+		factor: args.factor,
+		envelopeVersion: WALLET_CUSTODY_ENVELOPE_VERSION_V2,
+		envelopeRevision: args.envelopeRevision,
+		nonceB64u: args.nonceB64u,
+		sealedCustodySecretB64u: args.sealedCustodySecretB64u,
+		ciphertextDigestB64u: args.ciphertextDigestB64u,
+		aadHashB64u: args.aadHashB64u,
+		lifecycle: args.lifecycle,
+		createdAtMs: args.createdAtMs,
+		updatedAtMs: args.updatedAtMs
+	};
+}
+const ENVELOPE_LIFECYCLE_FIELDS = [
+	"state",
+	"activatedAtMs",
+	"retiredAtMs",
+	"revokedAtMs"
+];
+function parsePasskeyCustodyEnvelopeLifecycle(raw, label = "lifecycle") {
+	const record = requireRecord(raw, label);
+	rejectUnknownFields(record, ENVELOPE_LIFECYCLE_FIELDS, label);
+	const activatedAtMs = parseUnixMs(record.activatedAtMs, `${label}.activatedAtMs`);
+	switch (record.state) {
+		case "active":
+			if (record.retiredAtMs !== void 0 || record.revokedAtMs !== void 0) throw new Error(`${label} cannot be active and carry a retired or revoked timestamp`);
+			return buildActiveEnvelopeLifecycle({ activatedAtMs });
+		case "retired": {
+			if (record.revokedAtMs !== void 0) throw new Error(`${label} cannot be retired and carry a revoked timestamp`);
+			const retiredAtMs = parseUnixMs(record.retiredAtMs, `${label}.retiredAtMs`);
+			if (retiredAtMs < activatedAtMs) throw new Error(`${label}.retiredAtMs cannot precede activation`);
+			return buildRetiredEnvelopeLifecycle({
+				activatedAtMs,
+				retiredAtMs
+			});
+		}
+		case "revoked": {
+			if (record.retiredAtMs !== void 0) throw new Error(`${label} cannot be revoked and carry a retired timestamp`);
+			const revokedAtMs = parseUnixMs(record.revokedAtMs, `${label}.revokedAtMs`);
+			if (revokedAtMs < activatedAtMs) throw new Error(`${label}.revokedAtMs cannot precede activation`);
+			return buildRevokedEnvelopeLifecycle({
+				activatedAtMs,
+				revokedAtMs
+			});
+		}
+		default: throw new Error(`${label}.state must be active, retired, or revoked`);
+	}
+}
+const PASSKEY_FACTOR_FIELDS = [
+	"kind",
+	"rpId",
+	"credentialIdB64u",
+	"kekVersion"
+];
+const EMAIL_OTP_FACTOR_FIELDS = [
+	"kind",
+	"enrollmentId",
+	"enrollmentSealKeyVersion",
+	"kekVersion"
+];
+const ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS]));
+function requireNonEmptyString(value, label) {
+	if (typeof value !== "string" || !value.trim()) throw new Error(`${label} is required`);
+	return value;
+}
+function parseWalletCustodyEnvelopeFactor(raw, label = "factor") {
+	const record = requireRecord(raw, label);
+	switch (record.kind) {
+		case "passkey": {
+			rejectUnknownFields(record, PASSKEY_FACTOR_FIELDS, label, ALL_FACTOR_FIELDS);
+			if (record.kekVersion !== "passkey_prf_kek_hkdf_sha256_v1") throw new Error(`${label}.kekVersion must be ${PASSKEY_PRF_KEK_VERSION_V1}`);
+			const rpId = parseWebAuthnRpId(record.rpId);
+			if (!rpId.ok) throw new Error(`${label}.rpId ${rpId.error.message}`);
+			const credentialIdB64u = parseWebAuthnCredentialIdB64u(record.credentialIdB64u);
+			if (!credentialIdB64u.ok) throw new Error(`${label}.credentialIdB64u ${credentialIdB64u.error.message}`);
+			return buildPasskeyEnvelopeFactor({
+				rpId: rpId.value,
+				credentialIdB64u: credentialIdB64u.value
+			});
+		}
+		case "email_otp":
+			rejectUnknownFields(record, EMAIL_OTP_FACTOR_FIELDS, label, ALL_FACTOR_FIELDS);
+			if (record.kekVersion !== "email_otp_factor_kek_hkdf_sha256_v1") throw new Error(`${label}.kekVersion must be ${EMAIL_OTP_FACTOR_KEK_VERSION_V1}`);
+			return buildEmailOtpEnvelopeFactor({
+				enrollmentId: requireNonEmptyString(record.enrollmentId, `${label}.enrollmentId`),
+				enrollmentSealKeyVersion: requireNonEmptyString(record.enrollmentSealKeyVersion, `${label}.enrollmentSealKeyVersion`)
+			});
+		default: throw new Error(`${label}.kind must be passkey or email_otp`);
+	}
+}
+const ENVELOPE_RECORD_FIELDS = [
+	"kind",
+	"envelopeId",
+	"walletId",
+	"ownership",
+	"binding",
+	"factor",
+	"envelopeVersion",
+	"envelopeRevision",
+	"nonceB64u",
+	"sealedCustodySecretB64u",
+	"ciphertextDigestB64u",
+	"aadHashB64u",
+	"lifecycle",
+	"createdAtMs",
+	"updatedAtMs"
+];
+/**
+* Parses one raw server row, wire payload, or IndexedDB cache entry into the
+* exact envelope record. This is the single boundary: core custody code accepts
+* `PasskeyCustodyEnvelopeRecord`, never a raw shape.
+*/
+function parsePasskeyCustodyEnvelopeRecord(raw, label = "walletCustodyEnvelope") {
+	const record = requireRecord(raw, label);
+	if (record.kind !== "wallet_custody_envelope_v2") throw new Error(`${label}.kind must be ${WALLET_CUSTODY_ENVELOPE_VERSION_V2}`);
+	rejectUnknownFields(record, ENVELOPE_RECORD_FIELDS, label);
+	if (record.envelopeVersion !== "wallet_custody_envelope_v2") throw new Error(`${label}.envelopeVersion must be ${WALLET_CUSTODY_ENVELOPE_VERSION_V2}`);
+	const envelopeId = parsePasskeyEnvelopeId(record.envelopeId);
+	if (!envelopeId.ok) throw new Error(`${label}.envelopeId ${envelopeId.error.message}`);
+	const walletId = parseWalletId(record.walletId);
+	if (!walletId.ok) throw new Error(`${label}.walletId ${walletId.error.message}`);
+	const ownership = parseWalletCustodyEnvelopeOwnership(record.ownership, `${label}.ownership`);
+	const createdAtMs = parseUnixMs(record.createdAtMs, `${label}.createdAtMs`);
+	const updatedAtMs = parseUnixMs(record.updatedAtMs, `${label}.updatedAtMs`);
+	if (updatedAtMs < createdAtMs) throw new Error(`${label}.updatedAtMs cannot precede createdAtMs`);
+	return buildPasskeyCustodyEnvelopeRecord({
+		envelopeId: envelopeId.value,
+		walletId: walletId.value,
+		ownership,
+		binding: parsePasskeyCustodySecretBinding(record.binding, `${label}.binding`),
+		factor: parseWalletCustodyEnvelopeFactor(record.factor, `${label}.factor`),
+		envelopeRevision: parseEnvelopeRevision(record.envelopeRevision, `${label}.envelopeRevision`),
+		nonceB64u: parseEnvelopeNonceB64u(record.nonceB64u, `${label}.nonceB64u`),
+		sealedCustodySecretB64u: parseEnvelopeCiphertextB64u(record.sealedCustodySecretB64u, `${label}.sealedCustodySecretB64u`),
+		ciphertextDigestB64u: parseDigestField(record.ciphertextDigestB64u, `${label}.ciphertextDigestB64u`),
+		aadHashB64u: parseDigestField(record.aadHashB64u, `${label}.aadHashB64u`),
+		lifecycle: parsePasskeyCustodyEnvelopeLifecycle(record.lifecycle, `${label}.lifecycle`),
+		createdAtMs,
+		updatedAtMs
+	});
+}
+/** Two ownerships name the same owner. */
+function sameWalletCustodyEnvelopeOwnership(left, right) {
+	if (left.kind !== right.kind) return false;
+	if (left.kind === "unbound") return true;
+	return right.kind === "method_bound" && String(left.walletAuthMethodId) === String(right.walletAuthMethodId);
+}
+/**
+* Whether a stored envelope's ownership may be replaced by another.
+*
+* Two rules, and both are load-bearing. A replacement is always `method_bound`,
+* because no path may write a new V2 envelope — `unbound` exists only to decode
+* what was sealed before ownership was authenticated. And a stored owner may
+* only be replaced by itself: an envelope already bound to one method is never
+* rebound to a sibling, which is the whole point of putting the owner in the
+* AAD. That leaves exactly one transition that moves anything — the pre-109C
+* upgrade, `unbound` to the method that just proved it can open the envelope.
+*/
+function admitWalletCustodyEnvelopeOwnershipReplacementV1(input) {
+	if (input.replacement.kind === "unbound") return {
+		kind: "refused",
+		reason: "a replacement custody envelope must name its owning method"
+	};
+	switch (input.stored.kind) {
+		case "unbound": return { kind: "admitted" };
+		case "method_bound": return String(input.stored.walletAuthMethodId) === String(input.replacement.walletAuthMethodId) ? { kind: "admitted" } : {
+			kind: "refused",
+			reason: "a custody envelope owned by one auth method is never rebound to another"
+		};
+		default: return {
+			kind: "refused",
+			reason: "unhandled stored custody envelope ownership"
+		};
+	}
+}
+//#endregion
+export { EMAIL_OTP_FACTOR_KEK_VERSION_V1, PASSKEY_PRF_KEK_VERSION_V1, WALLET_CUSTODY_ENVELOPE_VERSION_V2, admitWalletCustodyEnvelopeOwnershipReplacementV1, buildActiveEnvelopeLifecycle, buildEmailOtpEnvelopeFactor, buildPasskeyCustodyEnvelopeRecord, buildPasskeyEnvelopeFactor, buildRetiredEnvelopeLifecycle, buildRevokedEnvelopeLifecycle, parsePasskeyCustodyEnvelopeLifecycle, parsePasskeyCustodyEnvelopeRecord, parseWalletCustodyEnvelopeFactor, parseWalletCustodyEnvelopeOwnership, parseWalletCustodyEnvelopeOwnershipWireV1, sameWalletCustodyEnvelopeOwnership };
+
+//# sourceMappingURL=custodyEnvelope.js.map

package/dist/esm/shared-ts/src/passkey-custody/custodySecretBinding.js

@@ -0,0 +1,175 @@
+import { parseLaneShareEpoch, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseSigningLaneId, parseThresholdEcdsaSessionId, parseWalletKeyId } from "../utils/domainIds.js";
+import { parseDigestField, parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u, rejectUnknownFields, requireRecord } from "./primitives.js";
+import { parseNearEd25519SigningKeyId } from "../utils/registrationIntent.js";
+import { requireEvmFamilySigningKeySlotId } from "../signing-lanes/evmFamilySigningKeySlotId.js";
+//#region ../shared-ts/src/passkey-custody/custodySecretBinding.ts
+/** The only derivation scheme owner custody supports. */
+const WALLET_SEED_DERIVATION_SCHEME_V1 = "wallet_seed_parallel_hkdf_sha256_v1";
+function buildWalletCustodySeedBinding() {
+	return {
+		kind: "wallet_custody_seed_v1",
+		derivationScheme: WALLET_SEED_DERIVATION_SCHEME_V1
+	};
+}
+function buildEd25519YaoClientRootBinding(args) {
+	return {
+		kind: "ed25519_yao_client_root_v1",
+		linkSessionId: args.linkSessionId,
+		walletKeyId: args.walletKeyId,
+		targetFactor: args.targetFactor,
+		applicationBindingDigestB64u: args.applicationBindingDigestB64u,
+		registeredPublicKeyB64u: args.registeredPublicKeyB64u,
+		enrollmentId: args.enrollmentId,
+		deviceId: args.deviceId,
+		revocationEpoch: args.revocationEpoch
+	};
+}
+function buildEd25519LaneHolderShareBinding(args) {
+	return {
+		kind: "ed25519_lane_holder_share_v1",
+		walletKeyId: args.walletKeyId,
+		laneId: args.laneId,
+		laneShareEpoch: args.laneShareEpoch,
+		nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
+		registeredPublicKeyB64u: args.registeredPublicKeyB64u,
+		participantBindingDigestB64u: args.participantBindingDigestB64u
+	};
+}
+function buildEcdsaLaneHolderShareBinding(args) {
+	return {
+		kind: "ecdsa_lane_holder_share_v1",
+		walletKeyId: args.walletKeyId,
+		laneId: args.laneId,
+		laneShareEpoch: args.laneShareEpoch,
+		evmFamilySigningKeySlotId: args.evmFamilySigningKeySlotId,
+		thresholdSessionId: args.thresholdSessionId,
+		thresholdPublicKey33B64u: args.thresholdPublicKey33B64u
+	};
+}
+const LANE_SCOPE_FIELDS = [
+	"kind",
+	"walletKeyId",
+	"laneId",
+	"laneShareEpoch"
+];
+const ALLOWED_FIELDS_BY_KIND = {
+	wallet_custody_seed_v1: ["kind", "derivationScheme"],
+	ed25519_yao_client_root_v1: [
+		"kind",
+		"linkSessionId",
+		"walletKeyId",
+		"targetFactor",
+		"applicationBindingDigestB64u",
+		"registeredPublicKeyB64u",
+		"enrollmentId",
+		"deviceId",
+		"revocationEpoch"
+	],
+	ed25519_lane_holder_share_v1: [
+		...LANE_SCOPE_FIELDS,
+		"nearEd25519SigningKeyId",
+		"registeredPublicKeyB64u",
+		"participantBindingDigestB64u"
+	],
+	ecdsa_lane_holder_share_v1: [
+		...LANE_SCOPE_FIELDS,
+		"evmFamilySigningKeySlotId",
+		"thresholdSessionId",
+		"thresholdPublicKey33B64u"
+	]
+};
+const ALL_BRANCH_FIELDS = Array.from(new Set(Object.values(ALLOWED_FIELDS_BY_KIND).flat()));
+function requireCustodySecretKind(value, label) {
+	if (value === "wallet_custody_seed_v1" || value === "ed25519_yao_client_root_v1" || value === "ed25519_lane_holder_share_v1" || value === "ecdsa_lane_holder_share_v1") return value;
+	throw new Error(`${label}.kind must be a known passkey custody secret kind`);
+}
+function requireNonNegativeSafeInteger(value, label) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative safe integer`);
+	return value;
+}
+function parseEd25519YaoClientRootTargetFactor(value, label) {
+	const record = requireRecord(value, label);
+	rejectUnknownFields(record, ["kind"], label);
+	if (record.kind === "passkey_prf" || record.kind === "email_otp") return { kind: record.kind };
+	throw new Error(`${label}.kind must be passkey_prf or email_otp`);
+}
+function requireLaneScope(record, label) {
+	const walletKeyId = parseWalletKeyId(record.walletKeyId);
+	if (!walletKeyId.ok) throw new Error(`${label}.walletKeyId ${walletKeyId.error.message}`);
+	const laneId = parseSigningLaneId(record.laneId);
+	if (!laneId.ok) throw new Error(`${label}.laneId ${laneId.error.message}`);
+	const laneShareEpoch = parseLaneShareEpoch(record.laneShareEpoch);
+	if (!laneShareEpoch.ok) throw new Error(`${label}.laneShareEpoch ${laneShareEpoch.error.message}`);
+	return {
+		walletKeyId: walletKeyId.value,
+		laneId: laneId.value,
+		laneShareEpoch: laneShareEpoch.value
+	};
+}
+function requireThresholdEcdsaSessionId(value, label) {
+	const parsed = parseThresholdEcdsaSessionId(value);
+	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
+	return parsed.value;
+}
+/**
+* Parses one raw persistence or wire shape into an exact custody-secret branch.
+* Cross-branch fields, unknown fields, and plaintext-secret fields are rejected
+* rather than dropped, so a mismatched record can never be narrowed into a
+* branch it does not satisfy.
+*/
+function parsePasskeyCustodySecretBinding(raw, label = "passkeyCustodySecretBinding") {
+	const record = requireRecord(raw, label);
+	const kind = requireCustodySecretKind(record.kind, label);
+	rejectUnknownFields(record, ALLOWED_FIELDS_BY_KIND[kind], label, ALL_BRANCH_FIELDS);
+	switch (kind) {
+		case "wallet_custody_seed_v1":
+			if (record.derivationScheme !== "wallet_seed_parallel_hkdf_sha256_v1") throw new Error(`${label}.derivationScheme must be ${WALLET_SEED_DERIVATION_SCHEME_V1}`);
+			return buildWalletCustodySeedBinding();
+		case "ed25519_yao_client_root_v1": {
+			const linkSessionId = parseLinkDeviceSessionId(record.linkSessionId);
+			if (!linkSessionId.ok) throw new Error(`${label}.linkSessionId ${linkSessionId.error.message}`);
+			const walletKeyId = parseWalletKeyId(record.walletKeyId);
+			if (!walletKeyId.ok) throw new Error(`${label}.walletKeyId ${walletKeyId.error.message}`);
+			const enrollmentId = parseLinkedDeviceEnrollmentId(record.enrollmentId);
+			if (!enrollmentId.ok) throw new Error(`${label}.enrollmentId ${enrollmentId.error.message}`);
+			const deviceId = parseLinkedDeviceId(record.deviceId);
+			if (!deviceId.ok) throw new Error(`${label}.deviceId ${deviceId.error.message}`);
+			return buildEd25519YaoClientRootBinding({
+				linkSessionId: linkSessionId.value,
+				walletKeyId: walletKeyId.value,
+				targetFactor: parseEd25519YaoClientRootTargetFactor(record.targetFactor, `${label}.targetFactor`),
+				applicationBindingDigestB64u: parseDigestField(record.applicationBindingDigestB64u, `${label}.applicationBindingDigestB64u`),
+				registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, `${label}.registeredPublicKeyB64u`),
+				enrollmentId: enrollmentId.value,
+				deviceId: deviceId.value,
+				revocationEpoch: requireNonNegativeSafeInteger(record.revocationEpoch, `${label}.revocationEpoch`)
+			});
+		}
+		case "ed25519_lane_holder_share_v1": {
+			const lane = requireLaneScope(record, label);
+			return buildEd25519LaneHolderShareBinding({
+				walletKeyId: lane.walletKeyId,
+				laneId: lane.laneId,
+				laneShareEpoch: lane.laneShareEpoch,
+				nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(record.nearEd25519SigningKeyId),
+				registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, `${label}.registeredPublicKeyB64u`),
+				participantBindingDigestB64u: parseDigestField(record.participantBindingDigestB64u, `${label}.participantBindingDigestB64u`)
+			});
+		}
+		case "ecdsa_lane_holder_share_v1": {
+			const lane = requireLaneScope(record, label);
+			return buildEcdsaLaneHolderShareBinding({
+				walletKeyId: lane.walletKeyId,
+				laneId: lane.laneId,
+				laneShareEpoch: lane.laneShareEpoch,
+				evmFamilySigningKeySlotId: requireEvmFamilySigningKeySlotId(record.evmFamilySigningKeySlotId, `${label}.evmFamilySigningKeySlotId`),
+				thresholdSessionId: requireThresholdEcdsaSessionId(record.thresholdSessionId, `${label}.thresholdSessionId`),
+				thresholdPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.thresholdPublicKey33B64u, `${label}.thresholdPublicKey33B64u`)
+			});
+		}
+	}
+}
+//#endregion
+export { WALLET_SEED_DERIVATION_SCHEME_V1, buildEcdsaLaneHolderShareBinding, buildEd25519LaneHolderShareBinding, buildEd25519YaoClientRootBinding, buildWalletCustodySeedBinding, parsePasskeyCustodySecretBinding };
+
+//# sourceMappingURL=custodySecretBinding.js.map

package/dist/esm/shared-ts/src/passkey-custody/index.js

@@ -0,0 +1,5 @@
+import "./primitives.js";
+import "./custodySecretBinding.js";
+import "./custodyEnvelope.js";
+import "./ceremonyCommitPayload.js";
+import "./credentialActivity.js";

package/dist/esm/shared-ts/src/passkey-custody/primitives.js

@@ -0,0 +1,92 @@
+import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+//#region ../shared-ts/src/passkey-custody/primitives.ts
+const UNPADDED_BASE64URL = /^[A-Za-z0-9_-]+$/;
+function requireCanonicalBase64Url(value, label) {
+	if (typeof value !== "string" || !UNPADDED_BASE64URL.test(value)) throw new Error(`${label} must be unpadded base64url`);
+	let decoded;
+	try {
+		decoded = base64UrlDecode(value);
+	} catch {
+		throw new Error(`${label} must be valid base64url`);
+	}
+	if (base64UrlEncode(decoded) !== value) throw new Error(`${label} must be canonical base64url`);
+	return decoded;
+}
+function parseDigestField(value, label) {
+	try {
+		return parseDigestB64u(value);
+	} catch (error) {
+		throw new Error(`${label} ${error instanceof Error ? error.message : "is not a digest"}`);
+	}
+}
+function parseEnvelopeNonceB64u(value, label = "nonceB64u") {
+	if (requireCanonicalBase64Url(value, label).length !== 12) throw new Error(`${label} must decode to a 12-byte ChaCha20Poly1305 nonce`);
+	return value;
+}
+function parseEnvelopeCiphertextB64u(value, label = "ciphertextB64u") {
+	if (requireCanonicalBase64Url(value, label).length < 17) throw new Error(`${label} must decode to sealed ciphertext with an authentication tag`);
+	return value;
+}
+function parseEd25519PublicKeyB64u(value, label = "registeredPublicKeyB64u") {
+	if (requireCanonicalBase64Url(value, label).length !== 32) throw new Error(`${label} must decode to a 32-byte Ed25519 public key`);
+	return value;
+}
+function parseSecp256k1CompressedPublicKeyB64u(value, label = "publicKey33B64u") {
+	const decoded = requireCanonicalBase64Url(value, label);
+	if (decoded.length !== 33) throw new Error(`${label} must decode to a 33-byte compressed secp256k1 point`);
+	if (decoded[0] !== 2 && decoded[0] !== 3) throw new Error(`${label} must be a compressed secp256k1 public key`);
+	return value;
+}
+function parseKeyCreationSignerSlot(value, label = "keyCreationSignerSlot") {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0 || value > 4294967295) throw new Error(`${label} must be a positive u32`);
+	return value;
+}
+function parseEnvelopeRevision(value, label = "envelopeRevision") {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive integer revision`);
+	return value;
+}
+function parseUnixMs(value, label) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive unix-millisecond timestamp`);
+	return value;
+}
+function requireRecord(value, label) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} must be an object`);
+	return value;
+}
+const SECRET_BEARING_FIELD_SUBSTRINGS = [
+	"prf",
+	"kek",
+	"seed",
+	"scalar",
+	"secretkey",
+	"privatekey",
+	"plaintext",
+	"recoverycode",
+	"clientroot",
+	"holdershare"
+];
+/**
+* Rejects every field outside this record's exact shape.
+*
+* `knownOnOtherBranches` names fields that are legitimate public bindings
+* somewhere else in the same union. Those are reported as the branch mismatch
+* they are; only genuinely unknown fields are classified as leaks, so a public
+* key like `clientRootPublicKey33B64u` on the wrong branch is never mistaken
+* for plaintext custody material.
+*/
+function rejectUnknownFields(record, allowed, label, knownOnOtherBranches = []) {
+	const allowedSet = new Set(allowed);
+	const knownSet = new Set(knownOnOtherBranches);
+	for (const field of Object.keys(record)) {
+		if (allowedSet.has(field)) continue;
+		if (knownSet.has(field)) throw new Error(`${label}.${field} is not part of ${label}`);
+		const normalized = field.toLowerCase().replace(/_/g, "");
+		if (!normalized.includes("publickey") && SECRET_BEARING_FIELD_SUBSTRINGS.some((substring) => normalized.includes(substring))) throw new Error(`${label}.${field} must never carry plaintext custody material`);
+		throw new Error(`${label}.${field} is not part of ${label}`);
+	}
+}
+//#endregion
+export { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs, rejectUnknownFields, requireRecord };
+
+//# sourceMappingURL=primitives.js.map

package/dist/esm/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js

@@ -0,0 +1,53 @@
+import { parseWalletKeyId } from "../utils/domainIds.js";
+//#region ../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.ts
+function requiredPart(value, field) {
+	if (typeof value !== "string") throw new Error(`EVM-family signing key slot id requires ${field}`);
+	const normalized = value.trim();
+	if (!normalized) throw new Error(`EVM-family signing key slot id requires ${field}`);
+	return normalized;
+}
+function keyPart(value) {
+	return encodeURIComponent(requiredPart(value, "non-empty components"));
+}
+function isEvmFamilySigningKeySlotIdShape(value) {
+	const parts = value.split(":");
+	return parts.length === 5 && parts[0] === "wallet-key" && parts[1] === "evm-family" && parts.slice(2).every((part) => part.length > 0);
+}
+function parseEvmFamilySigningKeySlotId(raw) {
+	const parsed = parseWalletKeyId(raw);
+	if (!parsed.ok) return parsed;
+	if (!isEvmFamilySigningKeySlotIdShape(String(parsed.value))) return {
+		ok: false,
+		error: {
+			code: "invalid",
+			message: "EVM-family signing key slot id must be wallet-key:evm-family:<walletId>:<signingRootId>:<signingRootVersion>"
+		}
+	};
+	return {
+		ok: true,
+		value: String(parsed.value)
+	};
+}
+function parseEvmFamilySigningKeySlotIdOrNull(raw) {
+	const parsed = parseEvmFamilySigningKeySlotId(raw);
+	return parsed.ok ? parsed.value : null;
+}
+function requireEvmFamilySigningKeySlotId(value, label = "evmFamilySigningKeySlotId") {
+	const parsed = parseEvmFamilySigningKeySlotId(value);
+	if (parsed.ok) return parsed.value;
+	if (parsed.error.code === "missing") throw new Error(`${label} is required`);
+	throw new Error(`${label} must be an EVM-family signing key slot id`);
+}
+function deriveEvmFamilySigningKeySlotId(input) {
+	return requireEvmFamilySigningKeySlotId([
+		"wallet-key",
+		"evm-family",
+		keyPart(input.walletId),
+		keyPart(input.signingRootId),
+		keyPart(input.signingRootVersion)
+	].join(":"));
+}
+//#endregion
+export { deriveEvmFamilySigningKeySlotId, parseEvmFamilySigningKeySlotId, parseEvmFamilySigningKeySlotIdOrNull, requireEvmFamilySigningKeySlotId };
+
+//# sourceMappingURL=evmFamilySigningKeySlotId.js.map

package/dist/esm/shared-ts/src/signing-lanes/execution.js

@@ -0,0 +1,14 @@
+//#region ../shared-ts/src/signing-lanes/execution.ts
+function buildPreparedOwnerWalletExecution(input) {
+	return {
+		kind: "prepared_owner_wallet_execution",
+		laneKind: input.lane.laneKind,
+		authorization: input.authorization,
+		materialActivation: input.materialActivation,
+		lane: input.lane
+	};
+}
+//#endregion
+export { buildPreparedOwnerWalletExecution };
+
+//# sourceMappingURL=execution.js.map

package/dist/esm/shared-ts/src/signing-lanes/index.js

@@ -0,0 +1,11 @@
+import "../utils/domainIds.js";
+import "./evmFamilySigningKeySlotId.js";
+import "./participants.js";
+import "./participantDigest.js";
+import "./ownerContinuity.js";
+import "./rotationParsers.js";
+import "./rotation.js";
+import "./rotationDigests.js";
+import "./rotationLifecycle.js";
+import "./execution.js";
+import "./linkedEcdsaScope.js";

package/dist/esm/shared-ts/src/signing-lanes/linkedEcdsaScope.js

@@ -0,0 +1 @@
+import "./rotationParsers.js";