@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/domains/emailOtp/emailOtpRouteHandlers.js

@@ -2,9 +2,10 @@ import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/b
 import "../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { emailOtpStatusCode } from "./emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 } from "../../../shared-ts/src/utils/emailOtpDomain.js";
 //#region src/router/domains/emailOtp/emailOtpRouteHandlers.ts
-const EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN = "seams/email-otp/factor-release/v1";
 function decodeEmailOtpFactorSecret32(value) {
 	const magnitude = base64UrlDecode(value);
 	if (magnitude.length === 0 || magnitude.length > 32) {
@@ -18,7 +19,7 @@ function decodeEmailOtpFactorSecret32(value) {
 }
 function emailOtpFactorReleaseAad(input) {
 	return new TextEncoder().encode([
-		EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN,
+		EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1,
 		input.walletId,
 		input.enrollmentId,
 		input.enrollmentSealKeyVersion,
@@ -32,19 +33,11 @@ async function sealEmailOtpFactorSecretForWorker(input) {
 		factorSecret32 = decodeEmailOtpFactorSecret32(input.factorSecret32B64u);
 		workerPublicKey65 = base64UrlDecode(input.workerEphemeralPublicKey65B64u);
 	} catch {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP factor release key is invalid"
-		};
+		return failure("invalid_body", "Email OTP factor release key is invalid");
 	}
 	if (workerPublicKey65.length !== 65 || workerPublicKey65[0] !== 4) {
 		factorSecret32.fill(0);
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP factor release key is invalid"
-		};
+		return failure("invalid_body", "Email OTP factor release key is invalid");
 	}
 	try {
 		const workerPublicKey = await crypto.subtle.importKey("raw", workerPublicKey65, {
@@ -76,11 +69,7 @@ async function sealEmailOtpFactorSecretForWorker(input) {
 			ciphertextB64u: base64UrlEncode(ciphertext)
 		};
 	} catch {
-		return {
-			ok: false,
-			code: "factor_release_failed",
-			message: "Email OTP factor release encryption failed"
-		};
+		return failure("factor_release_failed", "Email OTP factor release encryption failed");
 	} finally {
 		factorSecret32.fill(0);
 	}
@@ -92,11 +81,7 @@ async function handleEmailOtpDevCleanupGoogleRegistrationRoute(input) {
 		const code = verified.code || "not_verified";
 		return {
 			status: code === "internal" ? 500 : code === "not_configured" || code === "unsupported" ? 501 : code === "invalid_body" ? 400 : 401,
-			body: {
-				ok: false,
-				code,
-				message: verified.message || "Google login failed"
-			}
+			body: failure(code, verified.message || "Google login failed")
 		};
 	}
 	const runtimePolicyScope = isPlainObject(body.runtimePolicyScope) ? body.runtimePolicyScope : null;
@@ -113,30 +98,18 @@ async function handleEmailOtpDevCleanupGoogleRegistrationRoute(input) {
 async function handleEmailOtpRegistrationSealRoute(input) {
 	if (!isPlainObject(input.body)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid body"
-		}
+		body: failure("invalid_body", "Invalid body")
 	};
 	const allowedFields = new Set(["walletId", "wrappedCiphertext"]);
 	for (const field of Object.keys(input.body)) if (!allowedFields.has(field)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: `Unsupported field: ${field}`
-		}
+		body: failure("invalid_body", `Unsupported field: ${field}`)
 	};
 	const walletId = normalizeOptionalTrimmedString(input.body.walletId);
 	const wrappedCiphertext = normalizeOptionalTrimmedString(input.body.wrappedCiphertext);
 	if (!walletId || !wrappedCiphertext) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing walletId or wrappedCiphertext"
-		}
+		body: failure("invalid_body", "Missing walletId or wrappedCiphertext")
 	};
 	const result = await input.service.applyEmailOtpServerSeal({ wrappedCiphertext });
 	return {
@@ -150,11 +123,7 @@ async function handleEmailOtpRegistrationSealRoute(input) {
 async function handleEmailOtpDevOutboxRoute(input) {
 	if (!isPlainObject(input.body)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid body"
-		}
+		body: failure("invalid_body", "Invalid body")
 	};
 	const allowedFields = new Set([
 		"idToken",
@@ -164,11 +133,7 @@ async function handleEmailOtpDevOutboxRoute(input) {
 	]);
 	for (const field of Object.keys(input.body)) if (!allowedFields.has(field)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: `Unsupported field: ${field}`
-		}
+		body: failure("invalid_body", `Unsupported field: ${field}`)
 	};
 	const idToken = normalizeOptionalTrimmedString(input.body.idToken);
 	const walletId = normalizeOptionalTrimmedString(input.body.walletId);
@@ -176,30 +141,18 @@ async function handleEmailOtpDevOutboxRoute(input) {
 	const challengeSubjectId = normalizeOptionalTrimmedString(input.body.challengeSubjectId);
 	if (!idToken || !walletId) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing idToken or walletId"
-		}
+		body: failure("invalid_body", "Missing idToken or walletId")
 	};
 	if (challengeSubjectId && !challengeId) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "challengeSubjectId requires the exact challengeId it belongs to"
-		}
+		body: failure("invalid_body", "challengeSubjectId requires the exact challengeId it belongs to")
 	};
 	const verified = await input.service.verifyGoogleLogin({ idToken });
 	if (!verified.ok || !verified.verified || !verified.userId) {
 		const code = verified.code || "not_verified";
 		return {
 			status: code === "internal" ? 500 : code === "not_configured" ? 501 : 401,
-			body: {
-				ok: false,
-				code,
-				message: verified.message || "Google login failed"
-			}
+			body: failure(code, verified.message || "Google login failed")
 		};
 	}
 	const result = await input.service.readEmailOtpOutboxEntry({

package/dist/esm/router/domains/emailOtp/emailOtpSessionRouteHelpers.js

@@ -1,23 +1,7 @@
-import { parseProviderSubject } from "../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import { isPlainObject, toOptionalRecordString } from "../../../shared-ts/src/utils/validation.js";
-import { EMAIL_OTP_CHANNEL } from "../../../shared-ts/src/utils/emailOtpDomain.js";
 //#region src/router/domains/emailOtp/emailOtpSessionRouteHelpers.ts
-const EMAIL_OTP_RESEND_RETRY_AFTER_MS = 1e4;
-function emailOtpRouteValidationError(status, code, message) {
-	return {
-		ok: false,
-		status,
-		body: {
-			ok: false,
-			code,
-			message
-		}
-	};
-}
 function emailOtpStatusCode(code) {
 	if (code === "internal") return 500;
 	if (code === "not_configured") return 503;
@@ -28,16 +12,6 @@ function emailOtpStatusCode(code) {
 	if (code === "challenge_id_mismatch" || code === "challenge_purpose_mismatch" || code === "challenge_subject_mismatch" || code === "challenge_email_mismatch" || code === "challenge_wallet_mismatch" || code === "challenge_session_mismatch" || code === "challenge_org_mismatch" || code === "challenge_channel_mismatch" || code === "registration_reroll_disallowed" || code === "challenge_expired_or_invalid" || code === "invalid_otp") return 401;
 	return 400;
 }
-function emailOtpResultStatus(result) {
-	return result.ok ? 200 : emailOtpStatusCode(result.code);
-}
-function emailOtpInternalErrorBody(error) {
-	return {
-		ok: false,
-		code: "internal",
-		message: error instanceof Error ? error.message || "Internal error" : "Internal error"
-	};
-}
 function emailOtpFailureAuditPayload(input) {
 	return {
 		source: input.source,
@@ -77,65 +51,6 @@ function emailOtpLoggedInWebhookEventDescriptor(input) {
 		}
 	};
 }
-function emailOtpEnrolledWebhookEventDescriptor(input) {
-	return {
-		eventType: "wallet.email_otp.enrolled",
-		eventId: input.challengeId,
-		payload: {
-			otpChannel: input.otpChannel,
-			enrollmentSealKeyVersion: input.enrollmentSealKeyVersion,
-			unlockKeyVersion: input.unlockKeyVersion
-		}
-	};
-}
-function validateEmailOtpJsonObjectBody(body) {
-	if (!body || typeof body !== "object" || Array.isArray(body)) return emailOtpRouteValidationError(400, "invalid_body", "Expected JSON object body");
-	return {
-		ok: true,
-		body
-	};
-}
-function validateEmailOtpWalletId(input) {
-	const walletId = normalizeOptionalTrimmedString(input.body.walletId) || "";
-	if (!walletId) return emailOtpRouteValidationError(400, "invalid_body", "walletId is required");
-	if (walletId !== getAuthenticatedWalletId(input.claims, input.userId)) return emailOtpRouteValidationError(403, "wallet_identity_mismatch", "walletId must match the authenticated wallet");
-	return {
-		ok: true,
-		walletId
-	};
-}
-function validateEmailOtpChannel(body) {
-	if ((normalizeOptionalTrimmedString(body.otpChannel)?.toLowerCase() || "") !== "email_otp") return emailOtpRouteValidationError(400, "invalid_body", "otpChannel must be email_otp");
-	return {
-		ok: true,
-		otpChannel: EMAIL_OTP_CHANNEL
-	};
-}
-function validateEmailOtpRequiredString(body, field) {
-	const value = normalizeOptionalTrimmedString(body[field]) || "";
-	if (!value) return emailOtpRouteValidationError(400, "invalid_body", `${field} is required`);
-	return {
-		ok: true,
-		value
-	};
-}
-function getAuthenticatedWalletId(claims, userId) {
-	return toOptionalRecordString(claims, "walletId") || normalizeOptionalTrimmedString(userId) || "";
-}
-function isGoogleOidcEmailOtpSession(claims) {
-	if (!isPlainObject(claims)) return false;
-	const authSource = claims.authSource;
-	if (!isPlainObject(authSource) || authSource.kind !== "oidc_provider") return false;
-	if (toOptionalRecordString(authSource, "providerId") !== "google_oidc" || toOptionalRecordString(claims, "provider") !== "oidc" || toOptionalRecordString(claims, "oidcProvider") !== "google") return false;
-	const providerSubject = toOptionalRecordString(claims, "providerSubject");
-	const authSourceProviderSubject = toOptionalRecordString(authSource, "providerSubject");
-	const parsedProviderSubject = parseProviderSubject(providerSubject);
-	return Boolean(parsedProviderSubject.ok && parsedProviderSubject.value.startsWith("google:") && authSourceProviderSubject === parsedProviderSubject.value);
-}
-function parseOidcAccountMode(raw) {
-	const value = normalizeOptionalTrimmedString(raw)?.toLowerCase() || "";
-	if (value === "register" || value === "login") return value;
-}
 async function hashEmailOtpOperationBinding(input) {
 	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
 		walletId: input.walletId,
@@ -148,63 +63,7 @@ async function hashEmailOtpOperationBinding(input) {
 		...input.operationFingerprintDigest ? { operationFingerprintDigest: input.operationFingerprintDigest } : {}
 	})));
 }
-function emailOtpChallengeResponseBody(result) {
-	if (!result.ok || !result.challenge) return result;
-	const challenge = result.challenge;
-	return {
-		ok: true,
-		challenge: {
-			challengeId: challenge.challengeId,
-			issuedAt: new Date(challenge.issuedAtMs).toISOString(),
-			issuedAtMs: challenge.issuedAtMs,
-			expiresAt: new Date(challenge.expiresAtMs).toISOString(),
-			expiresAtMs: challenge.expiresAtMs,
-			userId: challenge.userId,
-			walletId: challenge.walletId,
-			...challenge.orgId ? { orgId: challenge.orgId } : {},
-			ownerProofBindingDigest: challenge.ownerProofBindingDigest,
-			otpChannel: challenge.otpChannel,
-			action: challenge.action,
-			operation: challenge.operation
-		},
-		delivery: result.delivery,
-		retryAfterMs: typeof result.retryAfterMs === "number" ? result.retryAfterMs : EMAIL_OTP_RESEND_RETRY_AFTER_MS
-	};
-}
-function emailOtpServerSealResponseBody(result, walletId) {
-	if (!result.ok) return result;
-	return {
-		ok: true,
-		walletId,
-		ciphertext: result.ciphertext,
-		enrollmentSealKeyVersion: result.enrollmentSealKeyVersion
-	};
-}
-function emailOtpEnrollmentFinalizeResponseBody(result) {
-	if (!result.ok) return result;
-	return {
-		ok: true,
-		walletId: result.walletId,
-		otpChannel: result.otpChannel,
-		enrollment: {
-			createdAt: new Date(result.enrollment.createdAtMs).toISOString(),
-			updatedAt: new Date(result.enrollment.updatedAtMs).toISOString(),
-			enrollmentSealKeyVersion: result.enrollment.enrollmentSealKeyVersion,
-			unlockKeyVersion: result.enrollment.unlockKeyVersion
-		}
-	};
-}
-function emailOtpLoginVerifyResponseBody(args) {
-	return {
-		ok: true,
-		challengeId: args.result.challengeId,
-		loginGrant: args.result.loginGrant,
-		grantExpiresAt: new Date(args.result.grantExpiresAtMs).toISOString(),
-		otpChannel: args.result.otpChannel,
-		enrollmentSealKeyVersion: args.enrollment.enrollment.enrollmentSealKeyVersion
-	};
-}
 //#endregion
-export { emailOtpChallengeResponseBody, emailOtpEnrolledWebhookEventDescriptor, emailOtpEnrollmentFinalizeResponseBody, emailOtpFailureAuditPayload, emailOtpFailureWebhookEventDescriptors, emailOtpInternalErrorBody, emailOtpLoggedInWebhookEventDescriptor, emailOtpLoginVerifyResponseBody, emailOtpResultStatus, emailOtpServerSealResponseBody, emailOtpStatusCode, getAuthenticatedWalletId, hashEmailOtpOperationBinding, isGoogleOidcEmailOtpSession, parseOidcAccountMode, shouldEmitEmailOtpLockedWebhook, validateEmailOtpChannel, validateEmailOtpJsonObjectBody, validateEmailOtpRequiredString, validateEmailOtpWalletId };
+export { emailOtpFailureWebhookEventDescriptors, emailOtpLoggedInWebhookEventDescriptor, emailOtpStatusCode, hashEmailOtpOperationBinding };
 
 //# sourceMappingURL=emailOtpSessionRouteHelpers.js.map

package/dist/esm/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrievalRoute.js

@@ -40,6 +40,6 @@ function refusal(status, code, message) {
 	};
 }
 //#endregion
-export { handlePasskeyCustodyEnvelopeRetrieval, passkeyCustodyEnvelopeRetrievalRouteResponse };
+export { handlePasskeyCustodyEnvelopeRetrieval };
 
 //# sourceMappingURL=passkeyCustodyEnvelopeRetrievalRoute.js.map

package/dist/esm/router/domains/passkeyCustody/walletCustodyRegistrationCommit.js

@@ -1,6 +1,6 @@
 import { parsePasskeyEnvelopeId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision } from "../../../shared-ts/src/passkey-custody/primitives.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision } from "../../../shared-ts/src/passkey-custody/primitives.js";
 import { parsePasskeyCustodySecretBinding } from "../../../shared-ts/src/passkey-custody/custodySecretBinding.js";
 import { buildActiveEnvelopeLifecycle, buildPasskeyCustodyEnvelopeRecord, parseWalletCustodyEnvelopeFactor, parseWalletCustodyEnvelopeOwnershipWireV1 } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
@@ -165,6 +165,6 @@ async function commitWalletCustodyRegistration(input) {
 	}
 }
 //#endregion
-export { buildWalletCustodyRegistrationRecords, commitWalletCustodyRegistration };
+export { commitWalletCustodyRegistration };
 
 //# sourceMappingURL=walletCustodyRegistrationCommit.js.map

package/dist/esm/router/domains/passkeyCustody/walletRecoveryFinalization.js

@@ -1,9 +1,9 @@
 import { parseWalletAuthorityBindingDigest, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
 import { buildFullOwnerPermissionsV1 } from "../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { buildActiveWalletAuthorityV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, replaceActiveWalletAuthorityEd25519MaterialActivationV1, walletAuthorityDigestsMatchV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
-import { buildWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { buildWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { buildActiveWalletAuthorityV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, replaceActiveWalletAuthorityEd25519MaterialActivationV1, sameVerifiedActiveWalletAuthorityV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
+import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { sameWalletCustodyEnvelopeOwnership } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
 import { consumeReservedRecoveryCode } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
@@ -16,10 +16,6 @@ function requireWalletId(value) {
 	if (!parsed.ok) throw new Error(parsed.error.message);
 	return parsed.value;
 }
-async function sameVerifiedActiveWalletAuthorityV1(left, right) {
-	const [leftVerified, rightVerified] = await Promise.all([walletAuthorityDigestsMatchV1(left), walletAuthorityDigestsMatchV1(right)]);
-	return leftVerified && rightVerified && left.authorityDigestB64u === right.authorityDigestB64u && left.signerActivationSetDigestB64u === right.signerActivationSetDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs && left.activatedAtMs === right.activatedAtMs;
-}
 function sameWalletCustodyRecoveryReplacementEnvelopeV1(left, right) {
 	if (left.kind !== right.kind || left.envelopeId !== right.envelopeId || left.walletId !== right.walletId || !sameWalletCustodyEnvelopeOwnership(left.ownership, right.ownership) || left.binding.kind !== "wallet_custody_seed_v1" || right.binding.kind !== "wallet_custody_seed_v1" || left.binding.derivationScheme !== right.binding.derivationScheme || left.envelopeVersion !== right.envelopeVersion || left.envelopeRevision !== right.envelopeRevision || left.nonceB64u !== right.nonceB64u || left.sealedCustodySecretB64u !== right.sealedCustodySecretB64u || left.ciphertextDigestB64u !== right.ciphertextDigestB64u || left.aadHashB64u !== right.aadHashB64u || left.lifecycle.state !== "active" || right.lifecycle.state !== "active" || left.lifecycle.activatedAtMs !== right.lifecycle.activatedAtMs || left.createdAtMs !== right.createdAtMs || left.updatedAtMs !== right.updatedAtMs) return false;
 	switch (left.factor.kind) {
@@ -38,9 +34,6 @@ function requireActivePasskeyWalletAuthMethodRecordV2(method) {
 	if (!isActivePasskeyWalletAuthMethodRecordV2(method)) throw new Error("recovery target auth method must be active passkey V2");
 	return method;
 }
-function isActivePasskeyCustodyEnvelopeRecord(envelope) {
-	return envelope.lifecycle.state === "active";
-}
 function continuityEnvelopeLocator(anchor) {
 	switch (anchor.envelope.kind) {
 		case "passkey": return {
@@ -64,13 +57,13 @@ function continuityEnvelopeLocator(anchor) {
 	}
 }
 function continuityEnvelopeMatchesAnchor(envelope, anchor) {
-	if (!isActivePasskeyCustodyEnvelopeRecord(envelope) || envelope.walletId !== anchor.envelope.walletId || envelope.envelopeId !== anchor.envelope.envelopeId || envelope.binding.kind !== "wallet_custody_seed_v1" || envelope.ownership.kind !== "method_bound" || envelope.ownership.walletAuthMethodId !== anchor.method.walletAuthMethodId || envelope.envelopeRevision !== anchor.envelope.envelopeRevision || envelope.updatedAtMs !== anchor.envelope.updatedAtMs) return false;
+	if (envelope.lifecycle.state !== "active" || envelope.walletId !== anchor.envelope.walletId || envelope.envelopeId !== anchor.envelope.envelopeId || envelope.binding.kind !== "wallet_custody_seed_v1" || envelope.ownership.kind !== "method_bound" || envelope.ownership.walletAuthMethodId !== anchor.method.walletAuthMethodId || envelope.envelopeRevision !== anchor.envelope.envelopeRevision || envelope.updatedAtMs !== anchor.envelope.updatedAtMs) return false;
 	switch (anchor.envelope.kind) {
 		case "passkey": return envelope.factor.kind === "passkey" && envelope.factor.rpId === anchor.envelope.rpId && envelope.factor.credentialIdB64u === anchor.envelope.credentialIdB64u;
 		case "email_otp": return envelope.factor.kind === "email_otp" && envelope.factor.enrollmentId === anchor.envelope.enrollmentId && envelope.factor.enrollmentSealKeyVersion === anchor.envelope.enrollmentSealKeyVersion;
 	}
 }
-async function readContinuityAnchor(input) {
+async function readRecoveryContinuityAnchor(input) {
 	const authority = await input.walletAuthorityStore.readById(input.anchor.authority.authorityId);
 	const expectedAuthority = authority ? await recoveryContinuityAuthorityAfterActivation({
 		authority: input.anchor.authority,
@@ -96,18 +89,15 @@ async function readContinuityAnchor(input) {
 		kind: "rejected",
 		reason: "the recovery continuity authority changed"
 	};
-	const authorityRef = {
-		kind: "wallet_auth_authority_ref",
-		walletId: input.walletId,
-		authorityDigest: authorityDigest.value,
-		walletAuthMethodId: input.anchor.method.walletAuthMethodId
-	};
 	return {
 		kind: "ready",
 		authority,
-		method,
-		envelope: envelopeLookup.envelope,
-		authorityRef
+		authorityRef: {
+			kind: "wallet_auth_authority_ref",
+			walletId: input.walletId,
+			authorityDigest: authorityDigest.value,
+			walletAuthMethodId: input.anchor.method.walletAuthMethodId
+		}
 	};
 }
 async function recoveryContinuityAuthorityAfterActivation(input) {
@@ -135,15 +125,15 @@ async function buildRecoveredWalletAuthority(input) {
 	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
 	const draft = {
 		kind: "wallet_authority_v1",
-		authorityId: input.challenge.targetAuthorityId,
+		authorityId: input.target.targetAuthorityId,
 		walletId: input.walletId,
 		principal: {
 			kind: "owner_device",
-			deviceId: input.challenge.targetDeviceId
+			deviceId: input.target.targetDeviceId
 		},
 		provenance: {
 			kind: "wallet_recovery",
-			recoveryOperationId: input.challenge.recoveryOperationId,
+			recoveryOperationId: input.target.recoveryOperationId,
 			continuityAuthorityId: input.continuityAuthority.authorityId
 		},
 		permissions: buildFullOwnerPermissionsV1(),
@@ -242,20 +232,11 @@ function buildRecoveredCredentialBinding(input) {
 		updatedAtMs: input.nowMs
 	};
 	if (source) {
-		if (source.nearAccountId === void 0 || source.nearEd25519SigningKeyId === void 0 || source.publicKey === void 0 || source.signerSlot === void 0) return {
-			version: "webauthn_credential_binding_v1",
-			rpId: input.rpId,
-			credentialIdB64u: input.credentialIdB64u,
-			userId: input.userId,
-			...source.relayerKeyId ? { relayerKeyId: source.relayerKeyId } : {},
-			...source.keyVersion ? { keyVersion: source.keyVersion } : {},
-			...typeof source.recoveryExportCapable === "boolean" ? { recoveryExportCapable: source.recoveryExportCapable } : {},
-			...source.clientParticipantId !== void 0 ? { clientParticipantId: source.clientParticipantId } : {},
-			...source.relayerParticipantId !== void 0 ? { relayerParticipantId: source.relayerParticipantId } : {},
-			...source.participantIds ? { participantIds: [...source.participantIds] } : {},
-			...source.runtimePolicyScope ? { runtimePolicyScope: source.runtimePolicyScope } : {},
-			createdAtMs: input.nowMs,
-			updatedAtMs: input.nowMs
+		const ed25519 = source.nearAccountId === void 0 || source.nearEd25519SigningKeyId === void 0 || source.publicKey === void 0 || source.signerSlot === void 0 ? {} : {
+			nearAccountId: source.nearAccountId,
+			nearEd25519SigningKeyId: source.nearEd25519SigningKeyId,
+			publicKey: source.publicKey,
+			signerSlot: source.signerSlot
 		};
 		return {
 			version: "webauthn_credential_binding_v1",
@@ -269,10 +250,7 @@ function buildRecoveredCredentialBinding(input) {
 			...source.relayerParticipantId !== void 0 ? { relayerParticipantId: source.relayerParticipantId } : {},
 			...source.participantIds ? { participantIds: [...source.participantIds] } : {},
 			...source.runtimePolicyScope ? { runtimePolicyScope: source.runtimePolicyScope } : {},
-			nearAccountId: source.nearAccountId,
-			nearEd25519SigningKeyId: source.nearEd25519SigningKeyId,
-			publicKey: source.publicKey,
-			signerSlot: source.signerSlot,
+			...ed25519,
 			createdAtMs: input.nowMs,
 			updatedAtMs: input.nowMs
 		};
@@ -382,7 +360,7 @@ async function finalizeRecoveredWalletCredentialV1(input) {
 			reason: error instanceof Error ? error.message : "wallet recovery key manifest unavailable"
 		};
 	}
-	const continuity = await readContinuityAnchor({
+	const continuity = await readRecoveryContinuityAnchor({
 		walletId,
 		anchor: challenge.continuityAnchor,
 		manifest,
@@ -483,7 +461,7 @@ async function finalizeRecoveredWalletCredentialV1(input) {
 	});
 	const authority = await buildRecoveredWalletAuthority({
 		walletId,
-		challenge,
+		target: challenge,
 		continuityAuthority: continuity.authority,
 		manifest,
 		nowMs: input.nowMs
@@ -647,6 +625,6 @@ async function resolveCommittedRecoveryReplayV1(input) {
 	};
 }
 //#endregion
-export { finalizeRecoveredWalletCredentialV1, resolveCommittedRecoveryReplayV1 };
+export { buildConsumedRecoverySet, buildRecoveredWalletAuthority, finalizeRecoveredWalletCredentialV1, parseRecoveryAuthorityDigest, readRecoveryContinuityAnchor, resolveCommittedRecoveryReplayV1, sameWalletCustodyRecoveryReplacementEnvelopeV1 };
 
 //# sourceMappingURL=walletRecoveryFinalization.js.map

package/dist/esm/router/domains/passkeyCustody/walletRecoveryKeyManifest.js

@@ -1,6 +1,6 @@
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
+import { alphabetizeStringify } from "../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u, sha256Utf8DigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../shared-ts/src/utils/encoders.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
@@ -19,8 +19,8 @@ async function buildWalletRecoveryEcdsaPossessionChallengesV1(input) {
 	const challenges = /* @__PURE__ */ new Map();
 	for (const entry of input.manifest.entries) {
 		if (entry.kind !== "evm_family_ecdsa") continue;
-		const publicCapabilityDigestB64u = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(entry.publicCapability))));
-		const serverNonceB64u = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(`seams:wallet-recovery-ecdsa-server-nonce:v1|${input.challengeB64u}|${entry.keySetId}`)));
+		const publicCapabilityDigestB64u = await sha256Utf8DigestB64u(alphabetizeStringify(entry.publicCapability));
+		const serverNonceB64u = await sha256Utf8DigestB64u(`seams:wallet-recovery-ecdsa-server-nonce:v1|${input.challengeB64u}|${entry.keySetId}`);
 		challenges.set(entry.keySetId, {
 			kind: "wallet_recovery_ecdsa_possession_challenge_v1",
 			walletId: String(input.walletId),
@@ -351,7 +351,7 @@ async function verifyEcdsaMaterialPossessionActivation(input) {
 	if (!proof || input.proofs.filter((candidate) => candidate.keySetId === input.entry.keySetId).length !== 1) return `wallet recovery ECDSA possession proof is missing for ${input.entry.keySetId}`;
 	const activationReceipt = input.activationReceipts.find((candidate) => candidate.keySetId === input.entry.keySetId)?.activationReceipt;
 	if (!activationReceipt || input.activationReceipts.filter((candidate) => candidate.keySetId === input.entry.keySetId).length !== 1 || !sameRouterAbEcdsaRegistrationActivationReceiptV1(activationReceipt, input.entry.activationReceipt)) return `wallet recovery ECDSA activation receipt changed for ${input.entry.keySetId}`;
-	const expectedPublicCapabilityDigestB64u = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(input.entry.publicCapability))));
+	const expectedPublicCapabilityDigestB64u = await sha256Utf8DigestB64u(alphabetizeStringify(input.entry.publicCapability));
 	if (!sameWalletRecoveryEcdsaPossessionChallengeV1(parseWalletRecoveryEcdsaPossessionChallengeV1({
 		...challenge,
 		walletId: String(input.walletId),

package/dist/esm/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.js

@@ -84,6 +84,6 @@ function parseEd25519VerifiedStepUpAuthorizedOperationReceipt(value) {
 	};
 }
 //#endregion
-export { parseEd25519ReusableAuthorizedOperationReceipt, parseEd25519VerifiedStepUpAuthorizedOperationReceipt, requireAuthorizedOperationReceiptString, requireEd25519OperationKind, requireExactAuthorizedOperationReceiptFields };
+export { parseEd25519ReusableAuthorizedOperationReceipt, parseEd25519VerifiedStepUpAuthorizedOperationReceipt, requireEd25519OperationKind };
 
 //# sourceMappingURL=ed25519AuthorizedOperationReceipt.js.map