@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/shared-ts/src/utils/walletAuthMethodRecord.js

@@ -0,0 +1,362 @@
+import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "./domainIds.js";
+import { alphabetizeStringify } from "./digests.js";
+import { sha256Utf8DigestB64u } from "./canonicalPrimitives.js";
+import { inspectRawObject, trimString } from "./registrationAuthMethodInput.js";
+//#region ../shared-ts/src/utils/walletAuthMethodRecord.ts
+async function computeWalletAuthMethodRevokeOperationFingerprintV1(input) {
+	return sha256Utf8DigestB64u(alphabetizeStringify({
+		version: "wallet_auth_method_revoke_operation_v1",
+		walletId: String(input.walletId),
+		targetWalletAuthMethodId: String(input.targetWalletAuthMethodId),
+		requestedAtMs: input.requestedAtMs
+	}));
+}
+function sameWalletAuthMethodRecordV2(left, right) {
+	if (left.version !== right.version || left.walletAuthMethodId !== right.walletAuthMethodId || left.walletId !== right.walletId || left.walletAuthorityId !== right.walletAuthorityId || left.status !== right.status || left.createdAtMs !== right.createdAtMs || left.updatedAtMs !== right.updatedAtMs) return false;
+	switch (left.kind) {
+		case "passkey":
+			if (right.kind !== "passkey") return false;
+			if (left.rpId === right.rpId && left.credentialIdB64u === right.credentialIdB64u && left.credentialPublicKeyB64u === right.credentialPublicKeyB64u && left.counter === right.counter) break;
+			return false;
+		case "email_otp":
+			if (right.kind !== "email_otp") return false;
+			if (left.emailHashHex === right.emailHashHex && left.registrationAuthorityId === right.registrationAuthorityId) break;
+			return false;
+		default: return assertNeverWalletAuthMethodRecordV2(left, "wallet auth method kind");
+	}
+	switch (left.status) {
+		case "pending_local_install": return right.status === "pending_local_install";
+		case "active": return right.status === "active" && left.activatedAtMs === right.activatedAtMs;
+		case "revoked": return right.status === "revoked" && left.activatedAtMs === right.activatedAtMs && left.revokedAtMs === right.revokedAtMs;
+		default: return assertNeverWalletAuthMethodRecordV2(left, "wallet auth method lifecycle");
+	}
+}
+function assertNeverWalletAuthMethodRecordV2(value, label) {
+	throw new Error(`${label} branch is unsupported: ${String(value)}`);
+}
+function buildWalletAuthMethodRecordV2(input) {
+	validateWalletAuthMethodRecordV2(input);
+	if (input.kind === "passkey") switch (input.status) {
+		case "pending_local_install": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "passkey",
+			status: "pending_local_install",
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs
+		};
+		case "active": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "passkey",
+			status: "active",
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs,
+			activatedAtMs: input.activatedAtMs
+		};
+		case "revoked": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "passkey",
+			status: "revoked",
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs,
+			activatedAtMs: input.activatedAtMs,
+			revokedAtMs: input.revokedAtMs
+		};
+	}
+	switch (input.status) {
+		case "pending_local_install": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "email_otp",
+			status: "pending_local_install",
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs
+		};
+		case "active": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "email_otp",
+			status: "active",
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs,
+			activatedAtMs: input.activatedAtMs
+		};
+		case "revoked": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "email_otp",
+			status: "revoked",
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs,
+			activatedAtMs: input.activatedAtMs,
+			revokedAtMs: input.revokedAtMs
+		};
+	}
+}
+function parseWalletAuthMethodRecordV2(raw) {
+	const record = inspectRawObject(raw);
+	if (!record || !("version" in record) || !("kind" in record) || !("status" in record)) return null;
+	const version = trimString(record.version);
+	const kind = trimString(record.kind);
+	const status = trimString(record.status);
+	if (version !== "wallet_auth_method_v2" || kind !== "passkey" && kind !== "email_otp") return null;
+	try {
+		const common = parseWalletAuthMethodRecordV2Common(record);
+		if (kind === "passkey") {
+			if (!("rpId" in record) || !("credentialIdB64u" in record) || !("credentialPublicKeyB64u" in record) || !("counter" in record)) return null;
+			exactWalletAuthMethodV2Fields(record, "passkey", status);
+			const rpId = parseWebAuthnRpId(record.rpId);
+			const credentialIdB64u = parseWebAuthnCredentialIdB64u(record.credentialIdB64u);
+			if (!rpId.ok || !credentialIdB64u.ok || typeof record.credentialPublicKeyB64u !== "string" || !record.credentialPublicKeyB64u.trim() || Object.prototype.hasOwnProperty.call(record, "emailHashHex") || Object.prototype.hasOwnProperty.call(record, "registrationAuthorityId")) return null;
+			return buildParsedPasskeyWalletAuthMethodRecordV2({
+				common,
+				lifecycle: parseWalletAuthMethodLifecycle(record),
+				rpId: rpId.value,
+				credentialIdB64u: credentialIdB64u.value,
+				credentialPublicKeyB64u: record.credentialPublicKeyB64u,
+				counter: parseNonNegativeInteger(record.counter)
+			});
+		}
+		if (!("emailHashHex" in record) || !("registrationAuthorityId" in record)) return null;
+		exactWalletAuthMethodV2Fields(record, "email_otp", status);
+		const emailHashHex = trimString(record.emailHashHex);
+		const registrationAuthorityId = trimString(record.registrationAuthorityId);
+		if (!emailHashHex || !registrationAuthorityId || Object.prototype.hasOwnProperty.call(record, "rpId") || Object.prototype.hasOwnProperty.call(record, "credentialIdB64u") || Object.prototype.hasOwnProperty.call(record, "credentialPublicKeyB64u") || Object.prototype.hasOwnProperty.call(record, "counter")) return null;
+		return buildParsedEmailOtpWalletAuthMethodRecordV2({
+			common,
+			lifecycle: parseWalletAuthMethodLifecycle(record),
+			emailHashHex,
+			registrationAuthorityId
+		});
+	} catch {
+		return null;
+	}
+}
+function parseWalletAuthMethodRecordV2Common(raw) {
+	if (!("walletAuthMethodId" in raw) || !("walletId" in raw) || !("walletAuthorityId" in raw) || !("createdAtMs" in raw) || !("updatedAtMs" in raw)) throw new Error("wallet auth method common fields are required");
+	return {
+		version: "wallet_auth_method_v2",
+		walletAuthMethodId: parseWalletAuthMethodIdRequired(raw.walletAuthMethodId),
+		walletId: parseWalletIdRequired(raw.walletId),
+		walletAuthorityId: parseWalletAuthorityIdRequired(raw.walletAuthorityId),
+		createdAtMs: parseNonNegativeInteger(raw.createdAtMs),
+		updatedAtMs: parseNonNegativeInteger(raw.updatedAtMs)
+	};
+}
+function validateWalletAuthMethodRecordV2(value) {
+	if (value.version !== "wallet_auth_method_v2") throw new Error("wallet auth method record version is unsupported");
+	if (!value.walletAuthMethodId || !value.walletId || !value.walletAuthorityId) throw new Error("wallet auth method record identities are required");
+	if (!Number.isSafeInteger(value.createdAtMs) || value.createdAtMs < 0) throw new Error("wallet auth method createdAtMs must be a non-negative safe integer");
+	if (!Number.isSafeInteger(value.updatedAtMs) || value.updatedAtMs < value.createdAtMs) throw new Error("wallet auth method updatedAtMs must follow createdAtMs");
+	if (value.kind === "passkey") {
+		if (!value.rpId || !value.credentialIdB64u || !value.credentialPublicKeyB64u.trim()) throw new Error("passkey wallet auth method fields are required");
+		if (!Number.isSafeInteger(value.counter) || value.counter < 0) throw new Error("passkey authenticator counter must be non-negative");
+	} else if (!value.emailHashHex.trim() || !value.registrationAuthorityId.trim()) throw new Error("email OTP wallet auth method fields are required");
+	switch (value.status) {
+		case "pending_local_install": return;
+		case "active":
+			validateNonNegativeInteger(value.activatedAtMs, "activatedAtMs");
+			return;
+		case "revoked":
+			validateNonNegativeInteger(value.activatedAtMs, "activatedAtMs");
+			validateNonNegativeInteger(value.revokedAtMs, "revokedAtMs");
+			if (value.revokedAtMs < value.activatedAtMs) throw new Error("revokedAtMs cannot precede activatedAtMs");
+			return;
+	}
+}
+function parseWalletAuthMethodLifecycle(raw) {
+	if (!("status" in raw)) throw new Error("wallet auth method status is required");
+	switch (raw.status) {
+		case "pending_local_install": return { status: "pending_local_install" };
+		case "active":
+			if (!("activatedAtMs" in raw)) throw new Error("wallet auth method activatedAtMs is required");
+			return {
+				status: "active",
+				activatedAtMs: parseNonNegativeInteger(raw.activatedAtMs)
+			};
+		case "revoked":
+			if (!("activatedAtMs" in raw) || !("revokedAtMs" in raw)) throw new Error("wallet auth method revocation timestamps are required");
+			return {
+				status: "revoked",
+				activatedAtMs: parseNonNegativeInteger(raw.activatedAtMs),
+				revokedAtMs: parseNonNegativeInteger(raw.revokedAtMs)
+			};
+		default: throw new Error("wallet auth method status is unsupported");
+	}
+}
+function exactWalletAuthMethodV2Fields(raw, kind, status) {
+	const fields = [
+		"version",
+		"walletAuthMethodId",
+		"walletId",
+		"walletAuthorityId",
+		"kind",
+		"status",
+		"createdAtMs",
+		"updatedAtMs"
+	];
+	if (kind === "passkey") fields.push("rpId", "credentialIdB64u", "credentialPublicKeyB64u", "counter");
+	else fields.push("emailHashHex", "registrationAuthorityId");
+	if (status === "active") fields.push("activatedAtMs");
+	if (status === "revoked") fields.push("activatedAtMs", "revokedAtMs");
+	if (status !== "pending_local_install" && status !== "active" && status !== "revoked") throw new Error("wallet auth method status is unsupported");
+	const expected = new Set(fields);
+	const actual = Object.keys(raw);
+	if (actual.length !== fields.length) throw new Error("wallet auth method record has invalid fields");
+	for (const field of actual) if (!expected.has(field)) throw new Error(`wallet auth method field ${field} is invalid`);
+}
+function buildParsedPasskeyWalletAuthMethodRecordV2(input) {
+	switch (input.lifecycle.status) {
+		case "pending_local_install": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "passkey",
+			status: "pending_local_install",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter
+		};
+		case "active": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "passkey",
+			status: "active",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter,
+			activatedAtMs: input.lifecycle.activatedAtMs
+		};
+		case "revoked": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "passkey",
+			status: "revoked",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter,
+			activatedAtMs: input.lifecycle.activatedAtMs,
+			revokedAtMs: input.lifecycle.revokedAtMs
+		};
+	}
+}
+function buildParsedEmailOtpWalletAuthMethodRecordV2(input) {
+	switch (input.lifecycle.status) {
+		case "pending_local_install": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "email_otp",
+			status: "pending_local_install",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId
+		};
+		case "active": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "email_otp",
+			status: "active",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId,
+			activatedAtMs: input.lifecycle.activatedAtMs
+		};
+		case "revoked": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "email_otp",
+			status: "revoked",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId,
+			activatedAtMs: input.lifecycle.activatedAtMs,
+			revokedAtMs: input.lifecycle.revokedAtMs
+		};
+	}
+}
+function parseWalletAuthMethodIdRequired(raw) {
+	const parsed = parseWalletAuthMethodId(raw);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseWalletIdRequired(raw) {
+	const parsed = parseWalletId(raw);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseWalletAuthorityIdRequired(raw) {
+	const parsed = parseWalletAuthorityId(raw);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseNonNegativeInteger(raw) {
+	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0) throw new Error("value must be a non-negative safe integer");
+	return raw;
+}
+function validateNonNegativeInteger(raw, label) {
+	if (!Number.isSafeInteger(raw) || raw < 0) throw new Error(`${label} must be a non-negative safe integer`);
+}
+function walletAuthMethodRecordId(record) {
+	const parsed = parseWalletAuthMethodId(record.kind === "passkey" ? `passkey:${record.rpId}:${record.credentialIdB64u}` : `email_otp:${record.walletId}:${record.emailHashHex}`);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+//#endregion
+export { buildWalletAuthMethodRecordV2, computeWalletAuthMethodRevokeOperationFingerprintV1, parseWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2, walletAuthMethodRecordId };
+
+//# sourceMappingURL=walletAuthMethodRecord.js.map

package/dist/esm/shared-ts/src/utils/wireSchema.js

@@ -0,0 +1,77 @@
+import { requireArray, requireRecord } from "./validation.js";
+import { exactRecord } from "./exactRecord.js";
+//#region ../shared-ts/src/utils/wireSchema.ts
+/** One of the given strings. */
+function wireLiteral(...literals) {
+	const parse = (raw, label) => {
+		if (!literals.includes(raw)) throw new Error(`${label} is invalid`);
+		return raw;
+	};
+	return Object.assign(parse, { literals });
+}
+/**
+* An object with exactly the fields of `shape`, all required, returned in the shape's order.
+* Checks run in this order: exact keys, then literals (they say which record this is), then
+* the other fields in declaration order, then `refine`'s cross-field rules.
+*/
+function wireObject(shape, refine) {
+	const keys = Object.keys(shape);
+	const order = [...keys.filter((key) => "literals" in shape[key]), ...keys.filter((key) => !("literals" in shape[key]))];
+	const parse = (raw, label) => {
+		const record = exactRecord(raw, keys, label);
+		const parsed = /* @__PURE__ */ new Map();
+		for (const key of order) parsed.set(key, shape[key](record[key], `${label}.${key}`));
+		const value = Object.fromEntries(keys.map((key) => [key, parsed.get(key)]));
+		refine?.(value, label);
+		return value;
+	};
+	return Object.assign(parse, { shape });
+}
+/** One of `variants`, chosen by the literal each declares for field `tag`. */
+function wireUnion(tag, variants) {
+	const byTag = /* @__PURE__ */ new Map();
+	for (const variant of variants) for (const literal of variant.shape[tag].literals) byTag.set(literal, variant);
+	return (raw, label) => {
+		const record = requireRecord(raw, label);
+		const variant = byTag.get(record[tag]);
+		if (!variant) throw new Error(`${label}.${tag} is invalid`);
+		return variant(record, label);
+	};
+}
+/** `null`, or a value `parse` accepts. */
+function wireNullable(parse) {
+	return (raw, label) => raw === null ? null : parse(raw, label);
+}
+/** A non-empty array of `item`; `refine` checks rules that span the items. */
+function wireNonEmptyArray(item, refine) {
+	return (raw, label) => {
+		const entries = requireArray(raw, label);
+		if (entries.length === 0) throw new Error(`${label} must be non-empty`);
+		const [first, ...rest] = entries.map((entry, index) => item(entry, `${label}[${index}]`));
+		const items = [first, ...rest];
+		refine?.(items, label);
+		return items;
+	};
+}
+/** Adapts a parser that returns a result, putting the field's label before its error. */
+function wireResult(parse) {
+	return (raw, label) => {
+		const result = parse(raw);
+		if (result.ok) return result.value;
+		throw new Error(`${label} ${result.error.message}`);
+	};
+}
+/** Adapts a parser that throws, putting the field's label before its error. */
+function wireLabeled(parse) {
+	return (raw, label) => {
+		try {
+			return parse(raw);
+		} catch (error) {
+			throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
+		}
+	};
+}
+//#endregion
+export { wireLabeled, wireLiteral, wireNonEmptyArray, wireNullable, wireObject, wireResult, wireUnion };
+
+//# sourceMappingURL=wireSchema.js.map

package/dist/esm/shared-ts/src/wallet-recovery/recoveryCodeLocator.js

@@ -1,6 +1,6 @@
 import { base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { sha256Bytes } from "../utils/digests.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import "../utils/encoders.js";
 import "../utils/emailOtpRecoveryKey.js";
 //#region ../shared-ts/src/wallet-recovery/recoveryCodeLocator.ts

package/dist/esm/shared-ts/src/wallet-recovery/recoveryCodeReservation.js

@@ -1,7 +1,7 @@
 import { hasWhitespaceOrControlCharacters } from "../utils/domainIds.js";
 import { base64UrlEncode } from "../utils/base64.js";
-import { parseCorrelationId } from "../utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../utils/digests.js";
+import { parseCorrelationId } from "../utils/canonicalPrimitives.js";
 //#region ../shared-ts/src/wallet-recovery/recoveryCodeReservation.ts
 const WALLET_RECOVERY_KEY_LIFECYCLE_DOMAIN_V1 = "seams/wallet-recovery/key-lifecycle/v1";
 /** One protocol lifecycle below a wallet-scoped recovery reservation. */

package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js

@@ -1,6 +1,6 @@
 import "../authorization/capabilityKinds.js";
+import { requireTrimmedString } from "../utils/validation.js";
 import "../authorization/walletAuthority.js";
-import "../utils/registrationIntent.js";
 //#region ../shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.ts
 function buildWalletRecoveryCommittedProjectionV1(input) {
 	if (input.kind === "passkey") return buildPasskeyProjection(input);
@@ -9,7 +9,7 @@ function buildWalletRecoveryCommittedProjectionV1(input) {
 function buildPasskeyProjection(input) {
 	const projection = {
 		version: "wallet_recovery_committed_projection_v1",
-		storeVersion: requireNonEmptyString(input.storeVersion, "storeVersion"),
+		storeVersion: requireTrimmedString(input.storeVersion, "storeVersion", "is invalid"),
 		walletId: input.walletId,
 		recoveryOperationId: input.recoveryOperationId,
 		targetDeviceId: input.targetDeviceId,
@@ -30,7 +30,7 @@ function buildPasskeyProjection(input) {
 function buildGoogleEmailOtpProjection(input) {
 	const projection = {
 		version: "wallet_recovery_committed_projection_v1",
-		storeVersion: requireNonEmptyString(input.storeVersion, "storeVersion"),
+		storeVersion: requireTrimmedString(input.storeVersion, "storeVersion", "is invalid"),
 		walletId: input.walletId,
 		recoveryOperationId: input.recoveryOperationId,
 		targetDeviceId: input.targetDeviceId,
@@ -44,7 +44,7 @@ function buildGoogleEmailOtpProjection(input) {
 			provider: "google",
 			providerSubject: input.providerSubject,
 			emailHashHex: requireEmailHash(input.emailHashHex),
-			registrationAuthorityId: requireNonEmptyString(input.registrationAuthorityId, "registrationAuthorityId"),
+			registrationAuthorityId: requireTrimmedString(input.registrationAuthorityId, "registrationAuthorityId", "is invalid"),
 			enrollment: buildEnrollmentReference(input.enrollment)
 		}
 	};
@@ -56,8 +56,8 @@ function parseEnrollmentReference(raw) {
 	if (record.kind !== "email_otp_enrollment_reference_v1") throw new Error("wallet recovery Email OTP enrollment is invalid");
 	return {
 		kind: "email_otp_enrollment_reference_v1",
-		enrollmentId: requireNonEmptyString(record.enrollmentId, "enrollment.enrollmentId"),
-		enrollmentSealKeyVersion: requireNonEmptyString(record.enrollmentSealKeyVersion, "enrollment.enrollmentSealKeyVersion")
+		enrollmentId: requireTrimmedString(record.enrollmentId, "enrollment.enrollmentId", "is invalid"),
+		enrollmentSealKeyVersion: requireTrimmedString(record.enrollmentSealKeyVersion, "enrollment.enrollmentSealKeyVersion", "is invalid")
 	};
 }
 function buildEnrollmentReference(value) {
@@ -93,12 +93,8 @@ function requireExactFields(record, expected, label) {
 	const actual = Object.keys(record);
 	if (actual.length !== expected.length || actual.some((field) => !expectedSet.has(field))) throw new Error(`${label} contains unexpected fields`);
 }
-function requireNonEmptyString(value, label) {
-	if (typeof value !== "string" || value.trim() === "") throw new Error(`${label} is invalid`);
-	return value.trim();
-}
 function requireEmailHash(value) {
-	const hash = requireNonEmptyString(value, "emailHashHex");
+	const hash = requireTrimmedString(value, "emailHashHex", "is invalid");
 	if (!/^[0-9a-f]{64}$/.test(hash)) throw new Error("emailHashHex is invalid");
 	return hash;
 }

package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.js

@@ -1,13 +1,9 @@
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { sha256Bytes } from "../utils/digests.js";
+import { parseDigestB64u, sha256DigestB64u } from "../utils/canonicalPrimitives.js";
+import { requireRecord } from "../utils/validation.js";
 //#region ../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.ts
 const POSSESSION_CHALLENGE_DOMAIN_V1 = "seams/wallet-recovery/ecdsa-existing-material-possession/v1";
 const POSSESSION_PROOF_SCHEME_V1 = "secp256k1_bip340_sha256_v1";
-function requireRecord(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
 function requireExactKeys(record, label, keys) {
 	const allowed = new Set(keys);
 	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is not a supported field`);
@@ -149,9 +145,9 @@ function expiryBytes(value) {
 	return bytes;
 }
 async function walletRecoveryEcdsaPossessionChallengeDigestB64uV1(challenge) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(walletRecoveryEcdsaPossessionChallengeCanonicalBytesV1(challenge))));
+	return sha256DigestB64u(walletRecoveryEcdsaPossessionChallengeCanonicalBytesV1(challenge));
 }
 //#endregion
-export { parseWalletRecoveryEcdsaPossessionChallengeV1, parseWalletRecoveryEcdsaPossessionProofV1, walletRecoveryEcdsaPossessionChallengeCanonicalBytesV1, walletRecoveryEcdsaPossessionChallengeDigestB64uV1 };
+export { parseWalletRecoveryEcdsaPossessionChallengeV1, parseWalletRecoveryEcdsaPossessionProofV1, walletRecoveryEcdsaPossessionChallengeDigestB64uV1 };
 
 //# sourceMappingURL=walletRecoveryEcdsaPossession.js.map

package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js

@@ -1,5 +1,7 @@
 import { parseWalletId } from "../utils/domainIds.js";
-import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseUnixMs, rejectUnknownFields, requireRecord } from "../passkey-custody/primitives.js";
+import { requireRecord } from "../utils/validation.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseUnixMs } from "../passkey-custody/primitives.js";
 import "../passkey-custody/index.js";
 import { parseRecoveryCodeReservationId } from "./recoveryCodeReservation.js";
 import { parseDerivedWalletRecoveryKeyId } from "./recoveryKeyId.js";

package/dist/esm/storage/d1Sql.js

@@ -79,7 +79,16 @@ function resolveD1DatabaseFromConfig(config) {
 	if (isD1DatabaseLike(config.SIGNER_DB)) return config.SIGNER_DB;
 	return null;
 }
+/**
+* Aborts the D1 batch it is in when the statement just before it changed no
+* row: it collides with the guard table's immutable singleton, and the
+* constraint failure rolls the whole batch back. The singleton is seeded by
+* migration 0012.
+*/
+const D1_BATCH_CAS_GUARD_SQL = `INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)
+SELECT 1
+ WHERE changes() = 0`;
 //#endregion
-export { d1ChangedRows, d1Integer, d1Number, formatD1ExecStatement, isD1DatabaseLike, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, queryD1All, queryD1One, resolveD1DatabaseFromConfig };
+export { D1_BATCH_CAS_GUARD_SQL, d1ChangedRows, d1Integer, d1Number, formatD1ExecStatement, isD1DatabaseLike, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, queryD1All, queryD1One, resolveD1DatabaseFromConfig };
 
 //# sourceMappingURL=d1Sql.js.map

package/dist/esm/storage/syncSqlite.js

@@ -0,0 +1,79 @@
+//#region src/storage/syncSqlite.ts
+/**
+* Presents a synchronous SQLite connection through the async SQL shape used
+* by the shared stores. `batch` is one SQLite transaction: a failing statement
+* rolls back every earlier statement, so guarded compare-and-set batches keep
+* the all-or-nothing semantics they have on D1.
+*/
+function createSyncSqliteDatabase(connection) {
+	return new SyncSqliteDatabase(connection);
+}
+var SyncSqliteDatabase = class {
+	constructor(connection) {
+		this.connection = connection;
+	}
+	prepare(query) {
+		return new SyncSqliteStatement(this.connection, query, []);
+	}
+	async batch(statements) {
+		const owned = statements.map((statement) => {
+			if (!(statement instanceof SyncSqliteStatement) || statement.connection !== this.connection) throw new Error("SQLite batch statements must be prepared by the same database");
+			return statement;
+		});
+		return this.connection.transaction(() => owned.map((statement) => statement.executeNow()));
+	}
+	async exec(query) {
+		this.connection.executeScript(query);
+		return { success: true };
+	}
+};
+var SyncSqliteStatement = class SyncSqliteStatement {
+	constructor(connection, query, values) {
+		this.connection = connection;
+		this.query = query;
+		this.values = values;
+	}
+	bind(...values) {
+		return new SyncSqliteStatement(this.connection, this.query, values.map(toSqliteValue));
+	}
+	async first(columnName) {
+		const row = this.connection.execute(this.query, this.values)[0];
+		if (!row) return null;
+		if (columnName === void 0) return row;
+		return row[columnName] ?? null;
+	}
+	async all() {
+		return this.executeNow();
+	}
+	async run() {
+		return this.executeNow();
+	}
+	/** Executes synchronously so a batch can run inside one host transaction. */
+	executeNow() {
+		const results = this.connection.execute(this.query, this.values);
+		const [counters] = this.connection.execute("SELECT changes() AS changes, last_insert_rowid() AS last_row_id", []);
+		return {
+			results,
+			success: true,
+			meta: {
+				changes: Number(counters?.changes ?? 0),
+				last_row_id: Number(counters?.last_row_id ?? 0)
+			}
+		};
+	}
+};
+function toSqliteValue(value) {
+	if (value === null || typeof value === "string") return value;
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) throw new Error("SQLite binding must be a finite number");
+		return value;
+	}
+	if (typeof value === "boolean") return value ? 1 : 0;
+	if (value instanceof Uint8Array) return value;
+	if (value instanceof ArrayBuffer) return new Uint8Array(value);
+	throw new Error(`unsupported SQLite binding type ${typeof value}`);
+}
+//#endregion
+export { createSyncSqliteDatabase };
+
+//# sourceMappingURL=syncSqlite.js.map

package/dist/esm/threshold/session/signingSessionSeal/crypto/cipher.js

@@ -1,7 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
 import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, encodeSigningSessionHkdfTuple } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { parseSigningSessionSealKeyVersion } from "../../../../core/keyMaterialBrands.js";
+import { parseSigningSessionSealKeyVersion } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { addSigningSessionSealLock, deriveSigningSessionSealLockKeyHandle, destroySigningSessionSealLockKeyHandle, removeSigningSessionSealLock } from "./shamir3PassWasm.js";
 //#region src/threshold/session/signingSessionSeal/crypto/cipher.ts
 function toErrorResult(error) {