@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/shared-ts/src/device-linking/requestProof.js

@@ -1,7 +1,7 @@
 import { parseLinkDeviceSessionId } from "../utils/domainIds.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { sha256Bytes } from "../utils/digests.js";
+import { parseDigestB64u, sha256DigestB64u } from "../utils/canonicalPrimitives.js";
+import { concat } from "../utils/digestEncoding.js";
 //#region ../shared-ts/src/device-linking/requestProof.ts
 const LINKED_DEVICE_REQUEST_PROOF_DOMAIN_V1 = "seams/linked-device/request-proof/v1";
 const LINKED_DEVICE_REQUEST_PROOF_HEADER_V1 = "x-seams-linked-device-proof-v1";
@@ -23,10 +23,10 @@ function encodeLinkedDeviceRequestProofV1(proof) {
 	]);
 }
 async function computeLinkedDeviceRequestProofDigestV1(proof) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeLinkedDeviceRequestProofV1(proof))));
+	return sha256DigestB64u(encodeLinkedDeviceRequestProofV1(proof));
 }
 async function computeLinkedDevicePublicKeyDigestV1(publicKeyB64u) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(parseFixedB64u(publicKeyB64u, 32, "devicePublicKeyB64u"))));
+	return sha256DigestB64u(parseFixedB64u(publicKeyB64u, 32, "devicePublicKeyB64u"));
 }
 function validateProofShapeV1(proof) {
 	if (proof.kind !== "linked_device_request_proof_v1") throw new Error("request proof kind is invalid");
@@ -99,16 +99,7 @@ function u64(value, label) {
 function lp32(value, label) {
 	return concat([u32(value.length, `${label}.length`), value]);
 }
-function concat(parts) {
-	const output = new Uint8Array(parts.reduce((length, part) => length + part.length, 0));
-	let offset = 0;
-	for (const part of parts) {
-		output.set(part, offset);
-		offset += part.length;
-	}
-	return output;
-}
 //#endregion
-export { LINKED_DEVICE_CLOCK_SKEW_TOLERANCE_MS_V1, LINKED_DEVICE_REQUEST_PROOF_DOMAIN_V1, LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, computeLinkedDevicePublicKeyDigestV1, computeLinkedDeviceRequestProofDigestV1, encodeLinkedDeviceRequestProofV1 };
+export { LINKED_DEVICE_CLOCK_SKEW_TOLERANCE_MS_V1, LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, computeLinkedDevicePublicKeyDigestV1, computeLinkedDeviceRequestProofDigestV1, encodeLinkedDeviceRequestProofV1 };
 
 //# sourceMappingURL=requestProof.js.map

package/dist/esm/shared-ts/src/device-linking/sourceContribution.js

@@ -2,6 +2,7 @@ import { mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseLinkedDe
 import { parseDeviceId } from "../authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+import { requireRecordCopy } from "../utils/validation.js";
 import { parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1 } from "../utils/routerAbEd25519Yao.js";
@@ -11,7 +12,7 @@ import { requireRouterAbEcdsaDerivationNormalSigningStateV1 } from "../utils/rou
 /** Exact discriminator accepted by the ECDSA source-contribution core. */
 const LINKED_DEVICE_ECDSA_SOURCE_CONTRIBUTION_ENVELOPE_KIND_V1 = "seams/linked-device/ecdsa-source-contribution-envelope/v1";
 function parseLinkedDeviceOrdinaryMaterialSourceContributionV1(raw) {
-	const record = requireRecord(raw, "linked-device ordinary source contribution");
+	const record = requireRecordCopy(raw, "linked-device ordinary source contribution");
 	switch (record.kind) {
 		case "linked_device_ed25519_source_contribution_v1": return parseEd25519Contribution(record);
 		case "linked_device_ecdsa_source_contribution_v1": return parseEcdsaContribution(record);
@@ -72,7 +73,7 @@ function parseLinkedDeviceEcdsaSourceContributionPreparationV1(raw) {
 	};
 }
 function parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1(raw) {
-	const record = requireRecord(raw, "linked-device ordinary source contribution preparation");
+	const record = requireRecordCopy(raw, "linked-device ordinary source contribution preparation");
 	if (record.kind === "linked_device_ed25519_source_contribution_preparation_v1") return parseEd25519SourceContributionPreparation(record);
 	if (Object.prototype.hasOwnProperty.call(record, "source") && Object.prototype.hasOwnProperty.call(record, "target")) return parseLinkedDeviceEcdsaSourceContributionPreparationV1(record);
 	throw new Error("linked-device ordinary source contribution preparation family is invalid");
@@ -453,7 +454,7 @@ function parseLinkedDeviceEcdsaEncryptedSourceContributionV1(raw, label) {
 		"encappedKeyB64u",
 		"ciphertextB64u"
 	], `linked-device ECDSA ${label}`);
-	if (record.kind !== "seams/linked-device/ecdsa-source-contribution-envelope/v1") throw new Error(`${label}.kind is invalid`);
+	if (record.kind !== LINKED_DEVICE_ECDSA_SOURCE_CONTRIBUTION_ENVELOPE_KIND_V1) throw new Error(`${label}.kind is invalid`);
 	return {
 		kind: LINKED_DEVICE_ECDSA_SOURCE_CONTRIBUTION_ENVELOPE_KIND_V1,
 		recipientPublicKeyB64u: parseFixedBase64(record.recipientPublicKeyB64u, 32, `${label}.recipientPublicKeyB64u`),
@@ -546,18 +547,14 @@ function requireText(raw, label) {
 	})) throw new Error(`${label} must be a non-empty visible string`);
 	return raw;
 }
-function requireRecord(raw, label) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${label} must be an object`);
-	return Object.fromEntries(Object.entries(raw));
-}
 function exactRecord(raw, keys, label) {
-	const record = requireRecord(raw, label);
+	const record = requireRecordCopy(raw, label);
 	const expected = new Set(keys);
 	const actual = Object.keys(record);
 	if (actual.length !== keys.length || actual.some((key) => !expected.has(key)) || keys.some((key) => !Object.prototype.hasOwnProperty.call(record, key))) throw new Error(`${label} contains unknown or missing fields`);
 	return record;
 }
 //#endregion
-export { LINKED_DEVICE_ECDSA_SOURCE_CONTRIBUTION_ENVELOPE_KIND_V1, assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1, parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourceContributionBindingV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceContributionPreparationV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1, parseLinkedDeviceEd25519SourcePreservingReservationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionV1 };
+export { assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1, parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourceContributionBindingV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceContributionPreparationV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1, parseLinkedDeviceEd25519SourcePreservingReservationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionV1 };
 
 //# sourceMappingURL=sourceContribution.js.map

package/dist/esm/shared-ts/src/device-linking/walletSessionCredentialDelivery.js

@@ -1,8 +1,8 @@
 import { parseLinkDeviceSessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../utils/digests.js";
+import { alphabetizeStringify } from "../utils/digests.js";
+import { parseDigestB64u, sha256Utf8DigestB64u } from "../utils/canonicalPrimitives.js";
 import { parseLinkDevicePublicKeyB64u } from "./parsers.js";
 //#region ../shared-ts/src/device-linking/walletSessionCredentialDelivery.ts
 const DELIVERY_AAD_DOMAIN = "seams/linked-device/wallet-session-credential-delivery-aad/v1";
@@ -25,19 +25,19 @@ function buildLinkedDeviceWalletSessionCredentialDeliveryBindingV1(aad) {
 	};
 }
 async function computeLinkedDeviceWalletSessionCredentialDeliveryAadDigestB64u(aad) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(encodeLinkedDeviceWalletSessionCredentialDeliveryAadV1(aad))));
+	return sha256Utf8DigestB64u(encodeLinkedDeviceWalletSessionCredentialDeliveryAadV1(aad));
 }
 async function computeLinkedDeviceWalletSessionCredentialEnvelopeDigestB64u(envelope) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+	return sha256Utf8DigestB64u(alphabetizeStringify({
 		domain: DELIVERY_ENVELOPE_DOMAIN,
 		envelope
-	}))));
+	}));
 }
 async function computeLinkedDeviceActivationCleanupReceiptDigestB64u(receipt) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+	return sha256Utf8DigestB64u(alphabetizeStringify({
 		domain: "seams/linked-device/activation-cleanup-receipt/v1",
 		receipt
-	}))));
+	}));
 }
 function parseLinkedDeviceActivationCleanupReceiptV1(raw) {
 	const record = exactRecord(raw, [
@@ -80,10 +80,10 @@ function parseLinkedDeviceActivationCleanupReceiptV1(raw) {
 async function assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1(delivery) {
 	if (await computeLinkedDeviceWalletSessionCredentialDeliveryAadDigestB64u(delivery.aad) !== delivery.aadDigestB64u) throw new Error("linked-device Wallet Session credential delivery AAD digest is invalid");
 	if (await computeLinkedDeviceWalletSessionCredentialEnvelopeDigestB64u(delivery.envelope) !== delivery.envelopeDigestB64u) throw new Error("linked-device Wallet Session credential delivery envelope digest is invalid");
-	if (parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+	if (await sha256Utf8DigestB64u(alphabetizeStringify({
 		domain: "seams/linked-device/delivery-recipient/v1",
 		recipientPublicKey65B64u: delivery.aad.recipientPublicKey65B64u
-	})))) !== delivery.recipientBindingDigestB64u) throw new Error("linked-device Wallet Session credential delivery recipient binding is invalid");
+	})) !== delivery.recipientBindingDigestB64u) throw new Error("linked-device Wallet Session credential delivery recipient binding is invalid");
 }
 function parseLinkedDeviceWalletSessionCredentialDeliveryV1(raw) {
 	const record = exactRecord(raw, [

package/dist/esm/shared-ts/src/device-linking/wireFields.js

@@ -0,0 +1,59 @@
+import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationRef, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
+import { parseDeviceId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+import { wireLabeled, wireNullable, wireResult } from "../utils/wireSchema.js";
+import { parseDelegatedWalletAuthorityV1 } from "../authorization/delegatedAuthority.js";
+import { parseUnixMs } from "../passkey-custody/primitives.js";
+//#region ../shared-ts/src/device-linking/wireFields.ts
+const sessionId = /* @__PURE__ */ wireResult(parseLinkDeviceSessionId);
+const walletId = /* @__PURE__ */ wireResult(parseWalletId);
+const enrollmentId = /* @__PURE__ */ wireResult(parseLinkedDeviceEnrollmentId);
+const linkedDeviceId = /* @__PURE__ */ wireResult(parseLinkedDeviceId);
+const authorizationDeviceId = /* @__PURE__ */ wireResult(parseDeviceId);
+const walletKeyId = /* @__PURE__ */ wireResult(parseWalletKeyId);
+const walletSessionId = /* @__PURE__ */ wireResult(parseWalletSessionId);
+const walletSessionAuthorizationId = /* @__PURE__ */ wireResult(parseWalletSessionAuthorizationId);
+const walletAuthMethodId = /* @__PURE__ */ wireResult(parseWalletAuthMethodId);
+const walletAuthorityId = /* @__PURE__ */ wireResult(parseWalletAuthorityId);
+const credentialId = /* @__PURE__ */ wireResult(parseWebAuthnCredentialIdB64u);
+const rpId = /* @__PURE__ */ wireResult(parseWebAuthnRpId);
+const quotaId = /* @__PURE__ */ wireResult(parseMpcWalletSigningQuotaId);
+const materialActivation = /* @__PURE__ */ wireResult(parseMpcMaterialActivationRef);
+const digest = /* @__PURE__ */ wireLabeled(parseDigestB64u);
+const nullableToken = /* @__PURE__ */ wireNullable(parseNonEmptyToken);
+function keyLabeled(parse) {
+	return (raw, label) => parse(raw, label.slice(label.lastIndexOf(".") + 1));
+}
+function parseUnixTime(raw, label) {
+	try {
+		return parseUnixMs(raw, label);
+	} catch (error) {
+		throw new Error(error instanceof Error ? error.message : `${label} is invalid`);
+	}
+}
+function parseNonEmptyToken(raw, label) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw) throw new Error(`${label} must be a non-empty canonical string`);
+	for (const character of raw) {
+		const code = character.charCodeAt(0);
+		if (/\s/.test(character) || code <= 31 || code === 127) throw new Error(`${label} must not contain whitespace or control characters`);
+	}
+	return raw;
+}
+function parseNonNegativeSafeInteger(raw, label) {
+	if (!Number.isSafeInteger(raw) || Number(raw) < 0) throw new Error(`${label} must be a non-negative safe integer`);
+	return Number(raw);
+}
+function parseDelegatedWalletAuthority(raw, label) {
+	const result = parseDelegatedWalletAuthorityV1(raw);
+	if (!result.ok) throw new Error(`${label}: ${result.error.message}`);
+	return result.value;
+}
+function parseTargetEmail(raw, label) {
+	const parsed = parseVerifiedEmailAddress(raw);
+	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
+	return parsed.value;
+}
+//#endregion
+export { authorizationDeviceId, credentialId, digest, enrollmentId, keyLabeled, linkedDeviceId, materialActivation, nullableToken, parseDelegatedWalletAuthority, parseNonEmptyToken, parseNonNegativeSafeInteger, parseTargetEmail, parseUnixTime, quotaId, rpId, sessionId, walletAuthMethodId, walletAuthorityId, walletId, walletKeyId, walletSessionAuthorizationId, walletSessionId };
+
+//# sourceMappingURL=wireFields.js.map

package/dist/esm/shared-ts/src/near/nearClient.js

@@ -0,0 +1,252 @@
+import { base64Decode, base64Encode } from "../utils/base64.js";
+import { isFunction } from "../utils/validation.js";
+import { secureRandomId } from "../utils/secureRandomId.js";
+import { errorMessage } from "../utils/errors.js";
+import { decodeJsonRpcEnvelope } from "../utils/jsonRpc.js";
+import { decodeNearAccessKeyList, decodeNearAccessKeyView, decodeNearAccountView, decodeNearBlockReference, decodeNearCodeBase64, decodeNearContractCallResult, decodeNearFinalExecutionOutcome, parseNearContractResult } from "../utils/nearRpcResults.js";
+//#region ../shared-ts/src/near/nearClient.ts
+var RpcCallType = /* @__PURE__ */ function(RpcCallType) {
+	RpcCallType["Query"] = "query";
+	RpcCallType["View"] = "view";
+	RpcCallType["Send"] = "send_tx";
+	RpcCallType["Block"] = "block";
+	RpcCallType["Call"] = "call_function";
+	return RpcCallType;
+}(RpcCallType || {});
+const DEFAULT_SEND_WAIT_UNTIL = "EXECUTED_OPTIMISTIC";
+/** The wallet narrows the transaction, signature and nonce lease types. */
+var SignedTransaction = class SignedTransaction {
+	constructor(data) {
+		this.transaction = data.transaction;
+		this.signature = data.signature;
+		this.borsh_bytes = data.borsh_bytes;
+		if (data.nonceLease) this.nonceLease = data.nonceLease;
+		if (data.serverDispatch) this.serverDispatch = data.serverDispatch;
+	}
+	static fromPlain(input) {
+		return new SignedTransaction({
+			transaction: input.transaction,
+			signature: input.signature,
+			borsh_bytes: input.borsh_bytes,
+			...input.nonceLease ? { nonceLease: input.nonceLease } : {},
+			...input.serverDispatch ? { serverDispatch: input.serverDispatch } : {}
+		});
+	}
+	encode() {
+		return new Uint8Array(this.borsh_bytes).buffer;
+	}
+	base64Encode() {
+		return base64Encode(this.encode());
+	}
+};
+function toArrayBufferFromUnknownBytes(bytes) {
+	if (!bytes) return null;
+	if (Array.isArray(bytes)) return new Uint8Array(bytes).buffer;
+	if (ArrayBuffer.isView(bytes)) {
+		const view = bytes;
+		return view.buffer.slice(view.byteOffset, view.byteOffset + view.byteLength);
+	}
+	if (bytes instanceof ArrayBuffer) return bytes;
+	return null;
+}
+function encodeSignedTransactionBase64(signed) {
+	const maybeSigned = signed?.signedTransaction;
+	const txPayload = maybeSigned && typeof maybeSigned === "object" ? maybeSigned : signed;
+	const maybeBase64 = txPayload.base64Encode;
+	if (isFunction(maybeBase64)) return maybeBase64.call(txPayload);
+	const maybeEncode = txPayload.encode;
+	if (isFunction(maybeEncode)) return base64Encode(maybeEncode.call(txPayload));
+	const snakeBuf = toArrayBufferFromUnknownBytes(txPayload.borsh_bytes);
+	if (snakeBuf) return base64Encode(snakeBuf);
+	const camelBuf = toArrayBufferFromUnknownBytes(txPayload.borshBytes);
+	if (camelBuf) return base64Encode(camelBuf);
+	throw new Error("Invalid signed transaction payload: cannot serialize to base64");
+}
+var NearJsonRpcClient = class NearJsonRpcClient {
+	constructor(rpcUrl) {
+		this.rpcUrls = NearJsonRpcClient.normalizeRpcUrls(rpcUrl);
+	}
+	static normalizeRpcUrls(input) {
+		const normalized = (Array.isArray(input) ? input : input.split(/[\s,]+/).map((url) => url.trim()).filter(Boolean)).map((url) => {
+			try {
+				return new URL(url).toString();
+			} catch (err) {
+				const message = errorMessage(err) || `Invalid NEAR RPC URL: ${url}`;
+				throw new Error(message);
+			}
+		});
+		if (!normalized.length) throw new Error("NEAR RPC URL cannot be empty");
+		return Array.from(new Set(normalized));
+	}
+	/** The error for a non-2xx HTTP response. */
+	errorFromHttpStatus(response) {
+		return /* @__PURE__ */ new Error(`RPC request failed: ${response.status} ${response.statusText}`);
+	}
+	/**
+	* What a call rejects with when its request, response or decoding fails; the
+	* server reports every such failure as a NearRpcError.
+	*/
+	errorFromFailedCall(_operationName, error) {
+		return error;
+	}
+	/** Sends a transaction once; the wallet retries transient failures. */
+	sendWithRetry(send) {
+		return send();
+	}
+	/** Build a JSON-RPC 2.0 POST body (stringified). */
+	buildRequestBody(method, params) {
+		return JSON.stringify({
+			jsonrpc: "2.0",
+			id: secureRandomId("near-rpc", 32, "NEAR JSON-RPC request IDs"),
+			method,
+			params
+		});
+	}
+	/** Perform a single POST to one endpoint and decode its JSON-RPC envelope. */
+	async postOnce(url, requestBody) {
+		const response = await fetch(url, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: requestBody
+		});
+		if (!response.ok) throw this.errorFromHttpStatus(response);
+		const text = await response.text();
+		if (!text?.trim()) throw new Error("Empty response from RPC server");
+		const decoded = decodeJsonRpcEnvelope(JSON.parse(text));
+		if (!decoded.ok) throw new Error(`Invalid NEAR JSON-RPC response: ${decoded.error}`);
+		return decoded.value;
+	}
+	/** Try each configured RPC endpoint in order and return the first decoded envelope. */
+	async requestWithFallback(requestBody) {
+		let lastError;
+		for (const [index, url] of this.rpcUrls.entries()) try {
+			const result = await this.postOnce(url, requestBody);
+			if (index > 0) console.warn(`[NearClient] RPC succeeded via fallback: ${url}`);
+			return result;
+		} catch (err) {
+			lastError = err;
+			const remaining = index < this.rpcUrls.length - 1;
+			console.warn(`[NearClient] RPC call to ${url} failed${remaining ? ", trying next" : ""}: ${errorMessage(err) || "RPC request failed"}`);
+			if (!remaining) throw err instanceof Error ? err : new Error(String(err));
+		}
+		throw new Error(errorMessage(lastError) || "RPC request failed");
+	}
+	/** Unwrap an envelope while keeping the method result unknown. */
+	unwrapRpcResult(rpc, operationName) {
+		if (rpc.kind === "failure") throw this.errorFromRpc(operationName, rpc.error);
+		const result = rpc.result;
+		if (typeof result === "object" && result !== null && "error" in result) {
+			const wrappedError = Reflect.get(result, "error");
+			const msg = typeof wrappedError === "string" ? wrappedError : JSON.stringify(wrappedError);
+			throw this.errorFromWrappedResult(`${operationName} Error: ${msg}`);
+		}
+		return rpc.result;
+	}
+	/**
+	* Execute RPC call with proper error handling and result extraction
+	*/
+	async makeRpcCall(method, params, operationName, decodeResult) {
+		const requestBody = this.buildRequestBody(method, params);
+		try {
+			const rpc = await this.requestWithFallback(requestBody);
+			return decodeResult(this.unwrapRpcResult(rpc, operationName));
+		} catch (error) {
+			throw this.errorFromFailedCall(operationName, error);
+		}
+	}
+	async query(params, decodeResult) {
+		return this.makeRpcCall(RpcCallType.Query, params, "Query", decodeResult);
+	}
+	async viewAccessKey(accountId, publicKey, finalityQuery) {
+		const params = {
+			request_type: "view_access_key",
+			finality: finalityQuery?.finality || "final",
+			account_id: accountId,
+			public_key: publicKey
+		};
+		return this.makeRpcCall(RpcCallType.Query, params, "View Access Key", decodeNearAccessKeyView);
+	}
+	async viewAccessKeyList(accountId, finalityQuery) {
+		const params = {
+			request_type: "view_access_key_list",
+			finality: finalityQuery?.finality || "final",
+			account_id: accountId
+		};
+		return this.makeRpcCall(RpcCallType.Query, params, "View Access Key List", decodeNearAccessKeyList);
+	}
+	async viewAccount(accountId) {
+		const params = {
+			request_type: "view_account",
+			finality: "final",
+			account_id: accountId
+		};
+		return this.makeRpcCall(RpcCallType.Query, params, "View Account", decodeNearAccountView);
+	}
+	async viewCode(accountId, finalityQuery) {
+		const params = {
+			request_type: "view_code",
+			finality: finalityQuery?.finality || "final",
+			account_id: accountId
+		};
+		return base64Decode(await this.makeRpcCall(RpcCallType.Query, params, "View Code", decodeNearCodeBase64));
+	}
+	async viewBlock(params) {
+		return this.makeRpcCall(RpcCallType.Block, params, "View Block", decodeNearBlockReference);
+	}
+	async sendTransaction(signedTransaction, waitUntil = DEFAULT_SEND_WAIT_UNTIL) {
+		const params = {
+			signed_tx_base64: encodeSignedTransactionBase64(signedTransaction),
+			wait_until: waitUntil
+		};
+		return this.sendWithRetry(async () => {
+			const outcome = await this.makeRpcCall(RpcCallType.Send, params, "Send Transaction", decodeNearFinalExecutionOutcome);
+			const status = outcome.status;
+			if (status && typeof status === "object" && "Failure" in status) throw this.errorFromOutcome("Send Transaction", outcome, status.Failure);
+			return outcome;
+		});
+	}
+	async txStatus(txHash, senderAccountId) {
+		const params = {
+			tx_hash: txHash,
+			sender_account_id: senderAccountId
+		};
+		return this.makeRpcCall("EXPERIMENTAL_tx_status", params, "Tx Status", decodeNearFinalExecutionOutcome);
+	}
+	async callFunction(accountId, method, args, decodeResult, blockQuery) {
+		const rpcParams = {
+			request_type: "call_function",
+			...blockQuery ?? { finality: "final" },
+			account_id: accountId,
+			method_name: method,
+			args_base64: base64Encode(new TextEncoder().encode(JSON.stringify(args)).buffer)
+		};
+		return decodeResult(parseNearContractResult((await this.makeRpcCall(RpcCallType.Query, rpcParams, "View Function", decodeNearContractCallResult)).result));
+	}
+	async view(params) {
+		return this.callFunction(params.account, params.method, params.args, params.decodeResult);
+	}
+	async getAccessKeys({ account, block_id }) {
+		const params = {
+			request_type: "view_access_key_list",
+			account_id: account,
+			finality: "final"
+		};
+		if (block_id) {
+			params.block_id = block_id;
+			delete params.finality;
+		}
+		const accessKeyList = await this.makeRpcCall(RpcCallType.Query, params, "View Access Key List", decodeNearAccessKeyList);
+		const fullAccessKeys = [];
+		const functionCallAccessKeys = [];
+		for (const key of accessKeyList.keys) if (key.access_key.permission === "FullAccess") fullAccessKeys.push(key);
+		else if (key.access_key.permission && typeof key.access_key.permission === "object" && "FunctionCall" in key.access_key.permission) functionCallAccessKeys.push(key);
+		return {
+			fullAccessKeys,
+			functionCallAccessKeys
+		};
+	}
+};
+//#endregion
+export { NearJsonRpcClient, SignedTransaction };
+
+//# sourceMappingURL=nearClient.js.map

package/dist/esm/shared-ts/src/passkey-custody/credentialActivity.js

@@ -1,3 +1,5 @@
+//#region ../shared-ts/src/passkey-custody/credentialActivity.ts
+const MAX_WALLET_CREDENTIAL_LABEL_LENGTH = 64;
 function parseWalletCredentialActivityRecordV1(raw, options) {
 	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return {
 		ok: false,
@@ -72,7 +74,7 @@ function normalizeLabel(value) {
 	if (typeof value !== "string") return "invalid";
 	const label = value.trim();
 	if (!label) return void 0;
-	if (label.length > 64) return "invalid";
+	if (label.length > MAX_WALLET_CREDENTIAL_LABEL_LENGTH) return "invalid";
 	return label;
 }
 //#endregion

package/dist/esm/shared-ts/src/passkey-custody/custodyEnvelope.js

@@ -1,5 +1,7 @@
 import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
-import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseUnixMs, rejectUnknownFields, requireRecord } from "./primitives.js";
+import { requireRecord } from "../utils/validation.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseUnixMs } from "./primitives.js";
 import { parsePasskeyCustodySecretBinding } from "./custodySecretBinding.js";
 //#region ../shared-ts/src/passkey-custody/custodyEnvelope.ts
 const WALLET_CUSTODY_ENVELOPE_VERSION_V2 = "wallet_custody_envelope_v2";
@@ -161,7 +163,7 @@ function parseWalletCustodyEnvelopeFactor(raw, label = "factor") {
 	switch (record.kind) {
 		case "passkey": {
 			rejectUnknownFields(record, PASSKEY_FACTOR_FIELDS, label, ALL_FACTOR_FIELDS);
-			if (record.kekVersion !== "passkey_prf_kek_hkdf_sha256_v1") throw new Error(`${label}.kekVersion must be ${PASSKEY_PRF_KEK_VERSION_V1}`);
+			if (record.kekVersion !== PASSKEY_PRF_KEK_VERSION_V1) throw new Error(`${label}.kekVersion must be ${PASSKEY_PRF_KEK_VERSION_V1}`);
 			const rpId = parseWebAuthnRpId(record.rpId);
 			if (!rpId.ok) throw new Error(`${label}.rpId ${rpId.error.message}`);
 			const credentialIdB64u = parseWebAuthnCredentialIdB64u(record.credentialIdB64u);
@@ -173,7 +175,7 @@ function parseWalletCustodyEnvelopeFactor(raw, label = "factor") {
 		}
 		case "email_otp":
 			rejectUnknownFields(record, EMAIL_OTP_FACTOR_FIELDS, label, ALL_FACTOR_FIELDS);
-			if (record.kekVersion !== "email_otp_factor_kek_hkdf_sha256_v1") throw new Error(`${label}.kekVersion must be ${EMAIL_OTP_FACTOR_KEK_VERSION_V1}`);
+			if (record.kekVersion !== EMAIL_OTP_FACTOR_KEK_VERSION_V1) throw new Error(`${label}.kekVersion must be ${EMAIL_OTP_FACTOR_KEK_VERSION_V1}`);
 			return buildEmailOtpEnvelopeFactor({
 				enrollmentId: requireNonEmptyString(record.enrollmentId, `${label}.enrollmentId`),
 				enrollmentSealKeyVersion: requireNonEmptyString(record.enrollmentSealKeyVersion, `${label}.enrollmentSealKeyVersion`)
@@ -246,7 +248,7 @@ function sameWalletCustodyEnvelopeOwnership(left, right) {
 * what was sealed before ownership was authenticated. And a stored owner may
 * only be replaced by itself: an envelope already bound to one method is never
 * rebound to a sibling, which is the whole point of putting the owner in the
-* AAD. That leaves exactly one transition that moves anything — the pre-109C
+* AAD. That leaves exactly one transition that moves anything — the ownership
 * upgrade, `unbound` to the method that just proved it can open the envelope.
 */
 function admitWalletCustodyEnvelopeOwnershipReplacementV1(input) {
@@ -267,6 +269,6 @@ function admitWalletCustodyEnvelopeOwnershipReplacementV1(input) {
 	}
 }
 //#endregion
-export { EMAIL_OTP_FACTOR_KEK_VERSION_V1, PASSKEY_PRF_KEK_VERSION_V1, WALLET_CUSTODY_ENVELOPE_VERSION_V2, admitWalletCustodyEnvelopeOwnershipReplacementV1, buildActiveEnvelopeLifecycle, buildEmailOtpEnvelopeFactor, buildPasskeyCustodyEnvelopeRecord, buildPasskeyEnvelopeFactor, buildRetiredEnvelopeLifecycle, buildRevokedEnvelopeLifecycle, parsePasskeyCustodyEnvelopeLifecycle, parsePasskeyCustodyEnvelopeRecord, parseWalletCustodyEnvelopeFactor, parseWalletCustodyEnvelopeOwnership, parseWalletCustodyEnvelopeOwnershipWireV1, sameWalletCustodyEnvelopeOwnership };
+export { WALLET_CUSTODY_ENVELOPE_VERSION_V2, admitWalletCustodyEnvelopeOwnershipReplacementV1, buildActiveEnvelopeLifecycle, buildEmailOtpEnvelopeFactor, buildPasskeyCustodyEnvelopeRecord, buildPasskeyEnvelopeFactor, buildRevokedEnvelopeLifecycle, parsePasskeyCustodyEnvelopeRecord, parseWalletCustodyEnvelopeFactor, parseWalletCustodyEnvelopeOwnershipWireV1, sameWalletCustodyEnvelopeOwnership };
 
 //# sourceMappingURL=custodyEnvelope.js.map

package/dist/esm/shared-ts/src/passkey-custody/custodySecretBinding.js

@@ -1,7 +1,9 @@
 import { parseLaneShareEpoch, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseSigningLaneId, parseThresholdEcdsaSessionId, parseWalletKeyId } from "../utils/domainIds.js";
-import { parseDigestField, parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u, rejectUnknownFields, requireRecord } from "./primitives.js";
-import { parseNearEd25519SigningKeyId } from "../utils/registrationIntent.js";
+import { requireRecord } from "../utils/validation.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { parseDigestField, parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "./primitives.js";
 import { requireEvmFamilySigningKeySlotId } from "../signing-lanes/evmFamilySigningKeySlotId.js";
+import { parseNearEd25519SigningKeyId } from "../utils/registrationIds.js";
 //#region ../shared-ts/src/passkey-custody/custodySecretBinding.ts
 /** The only derivation scheme owner custody supports. */
 const WALLET_SEED_DERIVATION_SCHEME_V1 = "wallet_seed_parallel_hkdf_sha256_v1";
@@ -123,7 +125,7 @@ function parsePasskeyCustodySecretBinding(raw, label = "passkeyCustodySecretBind
 	rejectUnknownFields(record, ALLOWED_FIELDS_BY_KIND[kind], label, ALL_BRANCH_FIELDS);
 	switch (kind) {
 		case "wallet_custody_seed_v1":
-			if (record.derivationScheme !== "wallet_seed_parallel_hkdf_sha256_v1") throw new Error(`${label}.derivationScheme must be ${WALLET_SEED_DERIVATION_SCHEME_V1}`);
+			if (record.derivationScheme !== WALLET_SEED_DERIVATION_SCHEME_V1) throw new Error(`${label}.derivationScheme must be ${WALLET_SEED_DERIVATION_SCHEME_V1}`);
 			return buildWalletCustodySeedBinding();
 		case "ed25519_yao_client_root_v1": {
 			const linkSessionId = parseLinkDeviceSessionId(record.linkSessionId);
@@ -170,6 +172,6 @@ function parsePasskeyCustodySecretBinding(raw, label = "passkeyCustodySecretBind
 	}
 }
 //#endregion
-export { WALLET_SEED_DERIVATION_SCHEME_V1, buildEcdsaLaneHolderShareBinding, buildEd25519LaneHolderShareBinding, buildEd25519YaoClientRootBinding, buildWalletCustodySeedBinding, parsePasskeyCustodySecretBinding };
+export { buildEd25519YaoClientRootBinding, parsePasskeyCustodySecretBinding };
 
 //# sourceMappingURL=custodySecretBinding.js.map

package/dist/esm/shared-ts/src/passkey-custody/primitives.js

@@ -20,12 +20,14 @@ function parseDigestField(value, label) {
 		throw new Error(`${label} ${error instanceof Error ? error.message : "is not a digest"}`);
 	}
 }
+const PASSKEY_CUSTODY_WRAP_NONCE_LENGTH = 12;
+const PASSKEY_CUSTODY_WRAP_TAG_LENGTH = 16;
 function parseEnvelopeNonceB64u(value, label = "nonceB64u") {
-	if (requireCanonicalBase64Url(value, label).length !== 12) throw new Error(`${label} must decode to a 12-byte ChaCha20Poly1305 nonce`);
+	if (requireCanonicalBase64Url(value, label).length !== PASSKEY_CUSTODY_WRAP_NONCE_LENGTH) throw new Error(`${label} must decode to a 12-byte ChaCha20Poly1305 nonce`);
 	return value;
 }
 function parseEnvelopeCiphertextB64u(value, label = "ciphertextB64u") {
-	if (requireCanonicalBase64Url(value, label).length < 17) throw new Error(`${label} must decode to sealed ciphertext with an authentication tag`);
+	if (requireCanonicalBase64Url(value, label).length < PASSKEY_CUSTODY_WRAP_TAG_LENGTH + 1) throw new Error(`${label} must decode to sealed ciphertext with an authentication tag`);
 	return value;
 }
 function parseEd25519PublicKeyB64u(value, label = "registeredPublicKeyB64u") {
@@ -50,43 +52,7 @@ function parseUnixMs(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive unix-millisecond timestamp`);
 	return value;
 }
-function requireRecord(value, label) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-const SECRET_BEARING_FIELD_SUBSTRINGS = [
-	"prf",
-	"kek",
-	"seed",
-	"scalar",
-	"secretkey",
-	"privatekey",
-	"plaintext",
-	"recoverycode",
-	"clientroot",
-	"holdershare"
-];
-/**
-* Rejects every field outside this record's exact shape.
-*
-* `knownOnOtherBranches` names fields that are legitimate public bindings
-* somewhere else in the same union. Those are reported as the branch mismatch
-* they are; only genuinely unknown fields are classified as leaks, so a public
-* key like `clientRootPublicKey33B64u` on the wrong branch is never mistaken
-* for plaintext custody material.
-*/
-function rejectUnknownFields(record, allowed, label, knownOnOtherBranches = []) {
-	const allowedSet = new Set(allowed);
-	const knownSet = new Set(knownOnOtherBranches);
-	for (const field of Object.keys(record)) {
-		if (allowedSet.has(field)) continue;
-		if (knownSet.has(field)) throw new Error(`${label}.${field} is not part of ${label}`);
-		const normalized = field.toLowerCase().replace(/_/g, "");
-		if (!normalized.includes("publickey") && SECRET_BEARING_FIELD_SUBSTRINGS.some((substring) => normalized.includes(substring))) throw new Error(`${label}.${field} must never carry plaintext custody material`);
-		throw new Error(`${label}.${field} is not part of ${label}`);
-	}
-}
 //#endregion
-export { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs, rejectUnknownFields, requireRecord };
+export { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs };
 
 //# sourceMappingURL=primitives.js.map

package/dist/esm/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js

@@ -28,10 +28,6 @@ function parseEvmFamilySigningKeySlotId(raw) {
 		value: String(parsed.value)
 	};
 }
-function parseEvmFamilySigningKeySlotIdOrNull(raw) {
-	const parsed = parseEvmFamilySigningKeySlotId(raw);
-	return parsed.ok ? parsed.value : null;
-}
 function requireEvmFamilySigningKeySlotId(value, label = "evmFamilySigningKeySlotId") {
 	const parsed = parseEvmFamilySigningKeySlotId(value);
 	if (parsed.ok) return parsed.value;
@@ -48,6 +44,6 @@ function deriveEvmFamilySigningKeySlotId(input) {
 	].join(":"));
 }
 //#endregion
-export { deriveEvmFamilySigningKeySlotId, parseEvmFamilySigningKeySlotId, parseEvmFamilySigningKeySlotIdOrNull, requireEvmFamilySigningKeySlotId };
+export { deriveEvmFamilySigningKeySlotId, parseEvmFamilySigningKeySlotId, requireEvmFamilySigningKeySlotId };
 
 //# sourceMappingURL=evmFamilySigningKeySlotId.js.map

package/dist/esm/shared-ts/src/signing-lanes/index.js

@@ -1,11 +1,11 @@
 import "../utils/domainIds.js";
 import "./evmFamilySigningKeySlotId.js";
 import "./participants.js";
-import "./participantDigest.js";
-import "./ownerContinuity.js";
 import "./rotationParsers.js";
 import "./rotation.js";
+import "./participantDigest.js";
+import "./ownerContinuity.js";
 import "./rotationDigests.js";
+import "./rotationProtocolParsers.js";
 import "./rotationLifecycle.js";
 import "./execution.js";
-import "./linkedEcdsaScope.js";