@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/shared-ts/src/utils/routerAbEd25519Yao.js

@@ -1,4 +1,6 @@
+import { requireRecord } from "./validation.js";
 import { parseRouterAbMpcMaterialActivationRef, sameRouterAbMpcMaterialActivationRef } from "./routerAbNormalSigningIdentity.js";
+import { equalBytes, requireBytes, requireBytes32, requireVisibleIdentifier } from "./routerAbEd25519YaoDigests.js";
 //#region ../shared-ts/src/utils/routerAbEd25519Yao.ts
 const ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1 = "/router-ab/ed25519/yao/registration/admit";
 const ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1 = "/router-ab/ed25519/yao/registration/execute";
@@ -33,9 +35,6 @@ function sameRouterAbEd25519YaoRegistrationAdmissionRequestV1(left, right) {
 function sameRouterAbEd25519YaoRecoveryAdmissionRequestV1(left, right) {
 	return sameRouterAbEd25519YaoLifecycleScopeV1(left.scope, right.scope) && sameRouterAbMpcMaterialActivationRef(left.active_material_activation, right.active_material_activation) && sameRouterAbEd25519YaoApplicationBindingFactsV1(left.application_binding, right.application_binding) && sameRouterAbEd25519YaoParticipantPairV1(left.participant_ids, right.participant_ids) && sameRouterAbEd25519YaoByteSequence(left.active_capability_binding, right.active_capability_binding) && sameRouterAbEd25519YaoByteSequence(left.replacement_capability_binding, right.replacement_capability_binding) && sameRouterAbEd25519YaoByteSequence(left.registered_public_key, right.registered_public_key);
 }
-function sameRouterAbEd25519YaoActivationKeysetV1(left, right) {
-	return sameRouterAbEd25519YaoByteSequence(left.deriver_a_input_public_key, right.deriver_a_input_public_key) && sameRouterAbEd25519YaoByteSequence(left.deriver_b_input_public_key, right.deriver_b_input_public_key) && sameRouterAbEd25519YaoByteSequence(left.signing_worker_recipient_public_key, right.signing_worker_recipient_public_key);
-}
 function sameRouterAbEd25519YaoActivationPublicReceiptV1(left, right) {
 	return sameRouterAbEd25519YaoByteSequence(left.transcript, right.transcript) && sameRouterAbEd25519YaoByteSequence(left.registered_public_key, right.registered_public_key) && sameRouterAbEd25519YaoByteSequence(left.joined_client_commitment, right.joined_client_commitment) && sameRouterAbEd25519YaoByteSequence(left.joined_signing_worker_commitment, right.joined_signing_worker_commitment) && sameRouterAbEd25519YaoByteSequence(left.signing_worker_verifying_share, right.signing_worker_verifying_share) && left.state_epoch === right.state_epoch && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation);
 }
@@ -45,30 +44,11 @@ const RECOVERY_WORK_KIND = "recovery";
 const RECOVERY_PRIMITIVE_REQUEST_KIND = "recovery";
 const EXPORT_WORK_KIND = "key_export";
 const EXPORT_PRIMITIVE_REQUEST_KIND = "export";
-const APPLICATION_BINDING_DOMAIN = "seams/router-ab/ed25519-yao/application-binding/v1";
-const STABLE_KEY_CONTEXT_DOMAIN = "seams/router-ab/ed25519-yao/stable-key-context/v1";
-const STABLE_KEY_CONTEXT_BINDING_DOMAIN = "seams/router-ab/ed25519-yao/stable-key-context-binding/v1";
-const EXPORT_CONFIRMATION_DOMAIN = "seams/router-ab/ed25519-yao/export-confirmation/v1";
-const EXPORT_AUTHORIZATION_DOMAIN = "seams/router-ab/ed25519-yao/export-authorization/v1";
-const RUNTIME_POLICY_BINDING_DOMAIN = "seams/router-ab/runtime-policy-binding/v1";
-const UTF8 = new TextEncoder();
-function requireRecord(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
 function requireExactKeys(record, label, allowedKeys) {
 	const allowed = new Set(allowedKeys);
 	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is not a supported field`);
 	for (const key of allowedKeys) if (!Object.hasOwn(record, key)) throw new Error(`${label}.${key} is required`);
 }
-function requireVisibleIdentifier(value, label) {
-	if (typeof value !== "string" || value.length === 0) throw new Error(`${label} must be a non-empty visible ASCII string`);
-	for (let index = 0; index < value.length; index += 1) {
-		const code = value.charCodeAt(index);
-		if (code < 33 || code > 126) throw new Error(`${label} must contain visible ASCII bytes`);
-	}
-	return value;
-}
 function requirePositiveU32(value, label) {
 	if (!Number.isInteger(value) || typeof value !== "number" || value <= 0 || value > 4294967295) throw new Error(`${label} must be a positive u32`);
 	return value;
@@ -77,146 +57,6 @@ function requirePositiveSafeInteger(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
 	return value;
 }
-function requireByte(value, label) {
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > 255) throw new Error(`${label} must be a byte`);
-	return value;
-}
-function requireBytes(value, label, minimumLength, maximumLength) {
-	if (!Array.isArray(value)) throw new Error(`${label} must be a byte array`);
-	if (value.length < minimumLength || value.length > maximumLength) throw new Error(`${label} has an invalid length`);
-	const parsed = [];
-	for (let index = 0; index < value.length; index += 1) parsed.push(requireByte(value[index], `${label}[${index}]`));
-	return parsed;
-}
-function requireBytes32(value, label, nonzero) {
-	const parsed = requireBytes(value, label, 32, 32);
-	if (nonzero && isZeroBytes(parsed)) throw new Error(`${label} must be nonzero`);
-	return parsed;
-}
-function isZeroBytes(value) {
-	for (const byte of value) if (byte !== 0) return false;
-	return true;
-}
-function equalBytes(left, right) {
-	if (left.length !== right.length) return false;
-	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
-	return true;
-}
-function u32BigEndian(value) {
-	const bytes = new Uint8Array(4);
-	new DataView(bytes.buffer).setUint32(0, value, false);
-	return bytes;
-}
-function u16BigEndian(value) {
-	const bytes = new Uint8Array(2);
-	new DataView(bytes.buffer).setUint16(0, value, false);
-	return bytes;
-}
-function u64BigEndian(value) {
-	if (!Number.isSafeInteger(value) || value <= 0) throw new Error("u64 value must be a positive safe integer");
-	const bytes = new Uint8Array(8);
-	new DataView(bytes.buffer).setBigUint64(0, BigInt(value), false);
-	return bytes;
-}
-function concatenateBytes(chunks) {
-	let length = 0;
-	for (const chunk of chunks) length += chunk.length;
-	const output = new Uint8Array(length);
-	let offset = 0;
-	for (const chunk of chunks) {
-		output.set(chunk, offset);
-		offset += chunk.length;
-	}
-	return output;
-}
-function lengthDelimited(value) {
-	return concatenateBytes([u32BigEndian(value.length), value]);
-}
-function labeledField(label, value) {
-	return concatenateBytes([lengthDelimited(UTF8.encode(label)), lengthDelimited(value)]);
-}
-async function sha256(value) {
-	const digest = await globalThis.crypto.subtle.digest("SHA-256", value);
-	return new Uint8Array(digest);
-}
-async function deriveRouterAbEd25519YaoApplicationBindingDigestV1(facts) {
-	const encoded = concatenateBytes([
-		lengthDelimited(UTF8.encode(APPLICATION_BINDING_DOMAIN)),
-		labeledField("walletId", UTF8.encode(facts.wallet_id)),
-		labeledField("nearEd25519SigningKeyId", UTF8.encode(facts.near_ed25519_signing_key_id)),
-		labeledField("signingRootId", UTF8.encode(facts.signing_root_id)),
-		labeledField("keyCreationSignerSlot", u32BigEndian(facts.key_creation_signer_slot))
-	]);
-	return Array.from(await sha256(encoded));
-}
-async function deriveRouterAbEd25519YaoStableContextBindingV1(applicationBinding, participantIds) {
-	const applicationDigest = await deriveRouterAbEd25519YaoApplicationBindingDigestV1(applicationBinding);
-	const context = concatenateBytes([
-		UTF8.encode(STABLE_KEY_CONTEXT_DOMAIN),
-		Uint8Array.from(applicationDigest),
-		u16BigEndian(participantIds[0]),
-		u16BigEndian(participantIds[1])
-	]);
-	return Array.from(await sha256(concatenateBytes([UTF8.encode(STABLE_KEY_CONTEXT_BINDING_DOMAIN), context])));
-}
-async function deriveRouterAbEd25519YaoRuntimePolicyBindingV1(input) {
-	const encoded = concatenateBytes([
-		lengthDelimited(UTF8.encode(RUNTIME_POLICY_BINDING_DOMAIN)),
-		labeledField("orgId", UTF8.encode(requireVisibleIdentifier(input.orgId, "orgId"))),
-		labeledField("projectId", UTF8.encode(requireVisibleIdentifier(input.projectId, "projectId"))),
-		labeledField("envId", UTF8.encode(requireVisibleIdentifier(input.envId, "envId"))),
-		labeledField("signingRootVersion", UTF8.encode(requireVisibleIdentifier(input.signingRootVersion, "signingRootVersion")))
-	]);
-	return Array.from(await sha256(encoded));
-}
-function exportIdentityFields(identity) {
-	const scope = identity.scope;
-	const application = identity.application_binding;
-	return [
-		labeledField("lifecycleId", UTF8.encode(scope.lifecycle_id)),
-		labeledField("rootShareEpoch", UTF8.encode(scope.root_share_epoch)),
-		labeledField("accountId", UTF8.encode(scope.account_id)),
-		labeledField("thresholdSessionId", UTF8.encode(scope.threshold_session_id)),
-		labeledField("signerSetId", UTF8.encode(scope.signer_set_id)),
-		labeledField("signingWorkerId", UTF8.encode(scope.signing_worker_id)),
-		labeledField("walletId", UTF8.encode(application.wallet_id)),
-		labeledField("nearEd25519SigningKeyId", UTF8.encode(application.near_ed25519_signing_key_id)),
-		labeledField("signingRootId", UTF8.encode(application.signing_root_id)),
-		labeledField("keyCreationSignerSlot", u32BigEndian(application.key_creation_signer_slot)),
-		labeledField("participantA", u16BigEndian(identity.participant_ids[0])),
-		labeledField("participantB", u16BigEndian(identity.participant_ids[1])),
-		labeledField("registeredPublicKey", Uint8Array.from(identity.registered_public_key)),
-		labeledField("stateEpoch", u64BigEndian(identity.state_epoch)),
-		labeledField("runtimePolicyBinding", Uint8Array.from(identity.runtime_policy_binding))
-	];
-}
-async function deriveRouterAbEd25519YaoExportConfirmationDigestV1(input) {
-	const nonce = requireBytes32(input.nonce, "export authorization nonce", true);
-	if (input.expiresAtMs <= input.issuedAtMs) throw new Error("export authorization expiry must follow issue time");
-	const encoded = concatenateBytes([
-		lengthDelimited(UTF8.encode(EXPORT_CONFIRMATION_DOMAIN)),
-		...exportIdentityFields(input.identity),
-		labeledField("nonce", Uint8Array.from(nonce)),
-		labeledField("issuedAtMs", u64BigEndian(input.issuedAtMs)),
-		labeledField("expiresAtMs", u64BigEndian(input.expiresAtMs))
-	]);
-	return Array.from(await sha256(encoded));
-}
-async function deriveRouterAbEd25519YaoExportAuthorizationDigestV1(input) {
-	const confirmationDigest = requireBytes32(input.confirmationDigest, "export confirmation digest", true);
-	const nonce = requireBytes32(input.nonce, "export authorization nonce", true);
-	const encoded = concatenateBytes([
-		lengthDelimited(UTF8.encode(EXPORT_AUTHORIZATION_DOMAIN)),
-		...exportIdentityFields(input.identity),
-		labeledField("confirmationDigest", Uint8Array.from(confirmationDigest)),
-		labeledField("nonce", Uint8Array.from(nonce)),
-		labeledField("issuedAtMs", u64BigEndian(input.issuedAtMs)),
-		labeledField("expiresAtMs", u64BigEndian(input.expiresAtMs)),
-		labeledField("authorityKind", UTF8.encode(input.authority.kind)),
-		labeledField("authoritySubject", UTF8.encode(input.authority.kind === "passkey" ? requireVisibleIdentifier(input.authority.credentialIdB64u, "credentialIdB64u") : requireVisibleIdentifier(input.authority.providerSubjectId, "providerSubjectId")))
-	]);
-	return Array.from(await sha256(encoded));
-}
 function parseOperation(value, label) {
 	switch (value) {
 		case "registration":
@@ -979,6 +819,6 @@ function parseEncryptedPackageValue(value) {
 	return parseEncryptedPackage(value, "encrypted_package");
 }
 //#endregion
-export { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, deriveRouterAbEd25519YaoApplicationBindingDigestV1, deriveRouterAbEd25519YaoExportAuthorizationDigestV1, deriveRouterAbEd25519YaoExportConfirmationDigestV1, deriveRouterAbEd25519YaoRuntimePolicyBindingV1, deriveRouterAbEd25519YaoStableContextBindingV1, parseRouterAbEd25519YaoActivationKeysetV1, parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportAdmissionRequestV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationRequestV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRecoveryStatusRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoActivationKeysetV1, sameRouterAbEd25519YaoActivationPublicReceiptV1, sameRouterAbEd25519YaoRecoveryAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 };
+export { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoActivationKeysetV1, parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportAdmissionRequestV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationRequestV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRecoveryStatusRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoActivationPublicReceiptV1, sameRouterAbEd25519YaoRecoveryAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 };
 
 //# sourceMappingURL=routerAbEd25519Yao.js.map

package/dist/esm/shared-ts/src/utils/routerAbEd25519YaoDigests.js

@@ -0,0 +1,160 @@
+//#region ../shared-ts/src/utils/routerAbEd25519YaoDigests.ts
+const APPLICATION_BINDING_DOMAIN = "seams/router-ab/ed25519-yao/application-binding/v1";
+const STABLE_KEY_CONTEXT_DOMAIN = "seams/router-ab/ed25519-yao/stable-key-context/v1";
+const STABLE_KEY_CONTEXT_BINDING_DOMAIN = "seams/router-ab/ed25519-yao/stable-key-context-binding/v1";
+const EXPORT_CONFIRMATION_DOMAIN = "seams/router-ab/ed25519-yao/export-confirmation/v1";
+const EXPORT_AUTHORIZATION_DOMAIN = "seams/router-ab/ed25519-yao/export-authorization/v1";
+const RUNTIME_POLICY_BINDING_DOMAIN = "seams/router-ab/runtime-policy-binding/v1";
+const UTF8 = new TextEncoder();
+function requireVisibleIdentifier(value, label) {
+	if (typeof value !== "string" || value.length === 0) throw new Error(`${label} must be a non-empty visible ASCII string`);
+	for (let index = 0; index < value.length; index += 1) {
+		const code = value.charCodeAt(index);
+		if (code < 33 || code > 126) throw new Error(`${label} must contain visible ASCII bytes`);
+	}
+	return value;
+}
+function requireByte(value, label) {
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > 255) throw new Error(`${label} must be a byte`);
+	return value;
+}
+function requireBytes(value, label, minimumLength, maximumLength) {
+	if (!Array.isArray(value)) throw new Error(`${label} must be a byte array`);
+	if (value.length < minimumLength || value.length > maximumLength) throw new Error(`${label} has an invalid length`);
+	const parsed = [];
+	for (let index = 0; index < value.length; index += 1) parsed.push(requireByte(value[index], `${label}[${index}]`));
+	return parsed;
+}
+function requireBytes32(value, label, nonzero) {
+	const parsed = requireBytes(value, label, 32, 32);
+	if (nonzero && isZeroBytes(parsed)) throw new Error(`${label} must be nonzero`);
+	return parsed;
+}
+function isZeroBytes(value) {
+	for (const byte of value) if (byte !== 0) return false;
+	return true;
+}
+function equalBytes(left, right) {
+	if (left.length !== right.length) return false;
+	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
+	return true;
+}
+function u32BigEndian(value) {
+	const bytes = new Uint8Array(4);
+	new DataView(bytes.buffer).setUint32(0, value, false);
+	return bytes;
+}
+function u16BigEndian(value) {
+	const bytes = new Uint8Array(2);
+	new DataView(bytes.buffer).setUint16(0, value, false);
+	return bytes;
+}
+function u64BigEndian(value) {
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error("u64 value must be a positive safe integer");
+	const bytes = new Uint8Array(8);
+	new DataView(bytes.buffer).setBigUint64(0, BigInt(value), false);
+	return bytes;
+}
+function concatenateBytes(chunks) {
+	let length = 0;
+	for (const chunk of chunks) length += chunk.length;
+	const output = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of chunks) {
+		output.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return output;
+}
+function lengthDelimited(value) {
+	return concatenateBytes([u32BigEndian(value.length), value]);
+}
+function labeledField(label, value) {
+	return concatenateBytes([lengthDelimited(UTF8.encode(label)), lengthDelimited(value)]);
+}
+async function sha256(value) {
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", value);
+	return new Uint8Array(digest);
+}
+async function deriveRouterAbEd25519YaoApplicationBindingDigestV1(facts) {
+	const encoded = concatenateBytes([
+		lengthDelimited(UTF8.encode(APPLICATION_BINDING_DOMAIN)),
+		labeledField("walletId", UTF8.encode(facts.wallet_id)),
+		labeledField("nearEd25519SigningKeyId", UTF8.encode(facts.near_ed25519_signing_key_id)),
+		labeledField("signingRootId", UTF8.encode(facts.signing_root_id)),
+		labeledField("keyCreationSignerSlot", u32BigEndian(facts.key_creation_signer_slot))
+	]);
+	return Array.from(await sha256(encoded));
+}
+async function deriveRouterAbEd25519YaoStableContextBindingV1(applicationBinding, participantIds) {
+	const applicationDigest = await deriveRouterAbEd25519YaoApplicationBindingDigestV1(applicationBinding);
+	const context = concatenateBytes([
+		UTF8.encode(STABLE_KEY_CONTEXT_DOMAIN),
+		Uint8Array.from(applicationDigest),
+		u16BigEndian(participantIds[0]),
+		u16BigEndian(participantIds[1])
+	]);
+	return Array.from(await sha256(concatenateBytes([UTF8.encode(STABLE_KEY_CONTEXT_BINDING_DOMAIN), context])));
+}
+async function deriveRouterAbEd25519YaoRuntimePolicyBindingV1(input) {
+	const encoded = concatenateBytes([
+		lengthDelimited(UTF8.encode(RUNTIME_POLICY_BINDING_DOMAIN)),
+		labeledField("orgId", UTF8.encode(requireVisibleIdentifier(input.orgId, "orgId"))),
+		labeledField("projectId", UTF8.encode(requireVisibleIdentifier(input.projectId, "projectId"))),
+		labeledField("envId", UTF8.encode(requireVisibleIdentifier(input.envId, "envId"))),
+		labeledField("signingRootVersion", UTF8.encode(requireVisibleIdentifier(input.signingRootVersion, "signingRootVersion")))
+	]);
+	return Array.from(await sha256(encoded));
+}
+function exportIdentityFields(identity) {
+	const scope = identity.scope;
+	const application = identity.application_binding;
+	return [
+		labeledField("lifecycleId", UTF8.encode(scope.lifecycle_id)),
+		labeledField("rootShareEpoch", UTF8.encode(scope.root_share_epoch)),
+		labeledField("accountId", UTF8.encode(scope.account_id)),
+		labeledField("thresholdSessionId", UTF8.encode(scope.threshold_session_id)),
+		labeledField("signerSetId", UTF8.encode(scope.signer_set_id)),
+		labeledField("signingWorkerId", UTF8.encode(scope.signing_worker_id)),
+		labeledField("walletId", UTF8.encode(application.wallet_id)),
+		labeledField("nearEd25519SigningKeyId", UTF8.encode(application.near_ed25519_signing_key_id)),
+		labeledField("signingRootId", UTF8.encode(application.signing_root_id)),
+		labeledField("keyCreationSignerSlot", u32BigEndian(application.key_creation_signer_slot)),
+		labeledField("participantA", u16BigEndian(identity.participant_ids[0])),
+		labeledField("participantB", u16BigEndian(identity.participant_ids[1])),
+		labeledField("registeredPublicKey", Uint8Array.from(identity.registered_public_key)),
+		labeledField("stateEpoch", u64BigEndian(identity.state_epoch)),
+		labeledField("runtimePolicyBinding", Uint8Array.from(identity.runtime_policy_binding))
+	];
+}
+async function deriveRouterAbEd25519YaoExportConfirmationDigestV1(input) {
+	const nonce = requireBytes32(input.nonce, "export authorization nonce", true);
+	if (input.expiresAtMs <= input.issuedAtMs) throw new Error("export authorization expiry must follow issue time");
+	const encoded = concatenateBytes([
+		lengthDelimited(UTF8.encode(EXPORT_CONFIRMATION_DOMAIN)),
+		...exportIdentityFields(input.identity),
+		labeledField("nonce", Uint8Array.from(nonce)),
+		labeledField("issuedAtMs", u64BigEndian(input.issuedAtMs)),
+		labeledField("expiresAtMs", u64BigEndian(input.expiresAtMs))
+	]);
+	return Array.from(await sha256(encoded));
+}
+async function deriveRouterAbEd25519YaoExportAuthorizationDigestV1(input) {
+	const confirmationDigest = requireBytes32(input.confirmationDigest, "export confirmation digest", true);
+	const nonce = requireBytes32(input.nonce, "export authorization nonce", true);
+	const encoded = concatenateBytes([
+		lengthDelimited(UTF8.encode(EXPORT_AUTHORIZATION_DOMAIN)),
+		...exportIdentityFields(input.identity),
+		labeledField("confirmationDigest", Uint8Array.from(confirmationDigest)),
+		labeledField("nonce", Uint8Array.from(nonce)),
+		labeledField("issuedAtMs", u64BigEndian(input.issuedAtMs)),
+		labeledField("expiresAtMs", u64BigEndian(input.expiresAtMs)),
+		labeledField("authorityKind", UTF8.encode(input.authority.kind)),
+		labeledField("authoritySubject", UTF8.encode(input.authority.kind === "passkey" ? requireVisibleIdentifier(input.authority.credentialIdB64u, "credentialIdB64u") : requireVisibleIdentifier(input.authority.providerSubjectId, "providerSubjectId")))
+	]);
+	return Array.from(await sha256(encoded));
+}
+//#endregion
+export { deriveRouterAbEd25519YaoApplicationBindingDigestV1, deriveRouterAbEd25519YaoExportAuthorizationDigestV1, deriveRouterAbEd25519YaoExportConfirmationDigestV1, deriveRouterAbEd25519YaoRuntimePolicyBindingV1, deriveRouterAbEd25519YaoStableContextBindingV1, equalBytes, requireBytes, requireBytes32, requireVisibleIdentifier };
+
+//# sourceMappingURL=routerAbEd25519YaoDigests.js.map

package/dist/esm/shared-ts/src/utils/routerAbNormalSigningIdentity.js

@@ -1,9 +1,6 @@
 import { parseMpcMaterialActivationRef } from "./domainIds.js";
+import { requireRecord } from "./validation.js";
 //#region ../shared-ts/src/utils/routerAbNormalSigningIdentity.ts
-function requireRecord(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
 function requireExactFields(record, expectedFields, label) {
 	const actualFields = Object.keys(record).sort();
 	const expected = [...expectedFields].sort();

package/dist/esm/shared-ts/src/utils/routerAbPublicKeyset.js

@@ -1,27 +1,19 @@
+import { coerceNonEmptyString, requireRecord } from "./validation.js";
 //#region ../shared-ts/src/utils/routerAbPublicKeyset.ts
 const ROUTER_AB_PUBLIC_KEYSET_VERSION_V2 = "router_ab_keyset_v2";
 const ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH = "/.well-known/router-ab/keyset";
 const ROUTER_AB_PUBLIC_KEYSET_PATH = "/router-ab/keyset";
-function requireRecord(value, label) {
-	if (value && typeof value === "object" && !Array.isArray(value)) return value;
-	throw new Error(`${label} must be an object`);
-}
 function requireExactKeys(record, allowedKeys, label) {
 	const allowed = new Set(allowedKeys);
 	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is not supported`);
 }
-function requireNonEmptyString(value, label) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error(`${label} is required`);
-	return normalized;
-}
 function requirePositiveInteger(value, label) {
 	const parsed = Number(value);
 	if (!Number.isSafeInteger(parsed) || parsed <= 0) throw new Error(`${label} must be a positive integer`);
 	return parsed;
 }
 function requireSignerRole(value, label) {
-	const role = requireNonEmptyString(value, label);
+	const role = coerceNonEmptyString(value, label);
 	switch (role) {
 		case "signer_a":
 		case "signer_b": return role;
@@ -29,12 +21,12 @@ function requireSignerRole(value, label) {
 	}
 }
 function requireLowerHex(value, label, byteLength) {
-	const hex = requireNonEmptyString(value, label);
+	const hex = coerceNonEmptyString(value, label);
 	if (!new RegExp(`^[0-9a-f]{${byteLength * 2}}$`).test(hex)) throw new Error(`${label} must be ${byteLength} lowercase-hex bytes`);
 	return hex;
 }
 function requireRouterAbX25519PublicKey(value, label) {
-	const publicKey = requireNonEmptyString(value, label);
+	const publicKey = coerceNonEmptyString(value, label);
 	if (!/^x25519:[0-9a-f]{64}$/.test(publicKey)) throw new Error(`${label} must use x25519:<64 lowercase hex chars> encoding`);
 	return publicKey;
 }
@@ -47,7 +39,7 @@ function parseSignerEnvelopeHpkePublicKey(value, label) {
 	], label);
 	return {
 		role: requireSignerRole(record.role, `${label}.role`),
-		key_epoch: requireNonEmptyString(record.key_epoch, `${label}.key_epoch`),
+		key_epoch: coerceNonEmptyString(record.key_epoch, `${label}.key_epoch`),
 		public_key: requireRouterAbX25519PublicKey(record.public_key, `${label}.public_key`)
 	};
 }
@@ -111,7 +103,7 @@ function parsePublicHpkeKeyDescriptor(value, label) {
 	const record = requireRecord(value, label);
 	requireExactKeys(record, ["key_epoch", "public_key"], label);
 	return {
-		key_epoch: requireNonEmptyString(record.key_epoch, `${label}.key_epoch`),
+		key_epoch: coerceNonEmptyString(record.key_epoch, `${label}.key_epoch`),
 		public_key: requireRouterAbX25519PublicKey(record.public_key, `${label}.public_key`)
 	};
 }
@@ -123,7 +115,7 @@ function parseRouterAbPublicKeysetV2(value) {
 		"signer_peer_verifying_keys",
 		"signing_worker_server_output_hpke"
 	], "Router A/B public keyset");
-	const keysetVersion = requireNonEmptyString(record.keyset_version, "keyset_version");
+	const keysetVersion = coerceNonEmptyString(record.keyset_version, "keyset_version");
 	if (keysetVersion !== "router_ab_keyset_v2") throw new Error(`Unsupported Router A/B public keyset version: ${keysetVersion}`);
 	return {
 		keyset_version: ROUTER_AB_PUBLIC_KEYSET_VERSION_V2,

package/dist/esm/shared-ts/src/utils/validation.js

@@ -1,23 +1,54 @@
-import "./near.js";
 import { normalizeOptionalTrimmedString } from "./normalize.js";
+import "./near.js";
 //#region ../shared-ts/src/utils/validation.ts
+function requireTrimmedString(value, label, message = "is required") {
+	const parsed = normalizeOptionalTrimmedString(value);
+	if (!parsed) throw new Error(`${label} ${message}`);
+	return parsed;
+}
+function requireNonEmptyString(value, label) {
+	return requireTrimmedString(value, label, "must be a non-empty string");
+}
+function requireCanonicalString(value, label, message = "is invalid") {
+	if (typeof value !== "string" || value.length === 0 || value.trim() !== value) throw new Error(`${label} ${message}`);
+	return value;
+}
+function coerceNonEmptyString(value, label) {
+	const normalized = String(value || "").trim();
+	if (!normalized) throw new Error(`${label} is required`);
+	return normalized;
+}
 function isObject(x) {
 	return x !== null && typeof x === "object";
 }
 function isPlainObject(x) {
 	return isObject(x) && !Array.isArray(x);
 }
-function toOptionalRecordString(record, key) {
-	if (!isPlainObject(record)) return void 0;
-	return normalizeOptionalTrimmedString(record[key]);
-}
 function isString(x) {
 	return typeof x === "string";
 }
 function isFunction(x) {
 	return typeof x === "function";
 }
+function asRecord(value) {
+	return isPlainObject(value) ? value : null;
+}
+function requireRecord(value, label) {
+	if (!isPlainObject(value)) throw new Error(`${label} must be an object`);
+	return value;
+}
+function requireRecordOrArray(value, label) {
+	if (!isObject(value)) throw new Error(`${label} must be an object`);
+	return value;
+}
+function requireRecordCopy(value, label) {
+	return Object.fromEntries(Object.entries(requireRecord(value, label)));
+}
+function requireArray(value, label) {
+	if (!Array.isArray(value)) throw new Error(`${label} must be an array`);
+	return value;
+}
 //#endregion
-export { isFunction, isObject, isPlainObject, isString, toOptionalRecordString };
+export { asRecord, coerceNonEmptyString, isFunction, isObject, isPlainObject, isString, requireArray, requireCanonicalString, requireNonEmptyString, requireRecord, requireRecordCopy, requireRecordOrArray, requireTrimmedString };
 
 //# sourceMappingURL=validation.js.map