@seams/wallet-server 0.7.1 → 0.7.3

package/dist/esm/shared-ts/src/authorization/walletSignerActivationEquality.js

@@ -0,0 +1,12 @@
+import { mpcMaterialActivationRefsEqual } from "../utils/domainIds.js";
+//#region ../shared-ts/src/authorization/walletSignerActivationEquality.ts
+function sameWalletEd25519SignerActivationV1(left, right) {
+	return left.kind === right.kind && left.signer.kind === right.signer.kind && left.signer.keyFamily === right.signer.keyFamily && left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.registeredPublicKeyB64u === right.signer.registeredPublicKeyB64u && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
+}
+function sameWalletEcdsaSignerActivationV1(left, right) {
+	return left.kind === right.kind && left.signer.kind === right.signer.kind && left.signer.keyFamily === right.signer.keyFamily && left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.thresholdPublicKey33B64u === right.signer.thresholdPublicKey33B64u && left.signer.evmAddress === right.signer.evmAddress && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
+}
+//#endregion
+export { sameWalletEcdsaSignerActivationV1, sameWalletEd25519SignerActivationV1 };
+
+//# sourceMappingURL=walletSignerActivationEquality.js.map

package/dist/esm/shared-ts/src/device-linking/committedSignerPackages.js

@@ -3,7 +3,7 @@ import { alphabetizeStringify } from "../utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../utils/canonicalPrimitives.js";
 import { parseLinkedDeviceEd25519ExportRootPackageV1 } from "./ed25519ExportRoot.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../utils/routerAbNormalSigningIdentity.js";
-import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1 } from "../utils/routerAbEd25519Yao.js";
+import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, sameRouterAbEd25519YaoByteSequence } from "../utils/routerAbEd25519Yao.js";
 import { parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "./sourceContribution.js";
 import { parseWalletAuthMethodRecordV2 } from "../utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../authorization/walletAuthority.js";
@@ -117,7 +117,7 @@ function parseEd25519Package(raw) {
 	if (!mpcMaterialActivationRefsEqual(materialActivation, routerAbMpcMaterialActivationRefFromWire(targetBinding.material_activation))) throw new Error("CommittedEd25519SignerPackageV1 target binding does not match material");
 	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a_client_package", "deriver_a");
 	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b_client_package", "deriver_b");
-	if (!sameBytes(activationReceipt.transcript, deriverA.transcript) || !sameBytes(activationReceipt.transcript, deriverB.transcript)) throw new Error("CommittedEd25519SignerPackageV1 receipt transcript does not match packages");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) throw new Error("CommittedEd25519SignerPackageV1 receipt transcript does not match packages");
 	return {
 		kind: "committed_ed25519_signer_package_v1",
 		materialActivation,
@@ -283,9 +283,6 @@ function parseCommittedEcdsaSignerPackageWireV1(raw) {
 function inspectRawObject(raw) {
 	return raw !== null && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
 }
-function sameBytes(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 function requireExactWireFields(record, keys, label) {
 	const expected = new Set(keys);
 	const actual = Object.keys(record);

package/dist/esm/shared-ts/src/device-linking/delegatedActivationPlan.js

@@ -1,7 +1,7 @@
 import { parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
 import { rejectUnknownFields } from "../utils/exactRecord.js";
-import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
+import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u, requireParsed } from "../passkey-custody/primitives.js";
 //#region ../shared-ts/src/device-linking/delegatedActivationPlan.ts
 const MANIFEST_FIELDS = [
 	"kind",
@@ -124,10 +124,6 @@ function exactRecord(raw, fields, label) {
 	for (const field of fields) if (!(field in record)) throw new Error(`${label}.${field} is required`);
 	return record;
 }
-function requireParsed(parsed, label) {
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
-}
 //#endregion
 export { buildExactAdministeredSignerManifestV1, parseExactAdministeredSignerManifestV1 };
 

package/dist/esm/shared-ts/src/device-linking/ed25519ExportRoot.js

@@ -2,7 +2,7 @@ import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDev
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { requireRecord } from "../utils/validation.js";
 import { rejectUnknownFields } from "../utils/exactRecord.js";
-import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u } from "../passkey-custody/primitives.js";
+import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, requireParsed } from "../passkey-custody/primitives.js";
 //#region ../shared-ts/src/device-linking/ed25519ExportRoot.ts
 /**
 * Authenticated relay records for the cross-device Ed25519 Yao Client export
@@ -71,11 +71,11 @@ function parseLinkedDeviceEd25519ExportRootRecipientV1(raw) {
 	requireTransferAlg(record.transferAlg, "LinkedDeviceEd25519ExportRootRecipientV1.transferAlg");
 	return {
 		kind: "linked_device_ed25519_export_root_recipient_v1",
-		linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId"),
-		walletId: parseRequired(parseWalletId(record.walletId), "walletId"),
-		walletKeyId: parseRequired(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
-		enrollmentId: parseRequired(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
-		deviceId: parseRequired(parseLinkedDeviceId(record.deviceId), "deviceId"),
+		linkSessionId: requireParsed(parseLinkDeviceSessionId(record.linkSessionId), "LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId"),
+		walletId: requireParsed(parseWalletId(record.walletId), "walletId"),
+		walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
+		enrollmentId: requireParsed(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
+		deviceId: requireParsed(parseLinkedDeviceId(record.deviceId), "deviceId"),
 		transferAlg: LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1,
 		applicationBindingDigestB64u: parseDigestField(record.applicationBindingDigestB64u, "applicationBindingDigestB64u"),
 		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "registeredPublicKeyB64u"),
@@ -94,11 +94,11 @@ function parseLinkedDeviceEd25519ExportRootPackageV1(raw) {
 	if (recipientPublicKeyB64u === ephemeralPublicKeyB64u) throw new Error("ephemeralPublicKeyB64u repeats the recipient key");
 	return {
 		kind: "linked_device_ed25519_export_root_package_v1",
-		linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
-		walletId: parseRequired(parseWalletId(record.walletId), "walletId"),
-		walletKeyId: parseRequired(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
-		enrollmentId: parseRequired(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
-		deviceId: parseRequired(parseLinkedDeviceId(record.deviceId), "deviceId"),
+		linkSessionId: requireParsed(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
+		walletId: requireParsed(parseWalletId(record.walletId), "walletId"),
+		walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
+		enrollmentId: requireParsed(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
+		deviceId: requireParsed(parseLinkedDeviceId(record.deviceId), "deviceId"),
 		transferAlg: LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1,
 		applicationBindingDigestB64u: parseDigestField(record.applicationBindingDigestB64u, "applicationBindingDigestB64u"),
 		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "registeredPublicKeyB64u"),
@@ -118,7 +118,7 @@ function parseLinkedDeviceEd25519ExportRootSubmissionV1(raw) {
 	if (record.kind !== "linked_device_ed25519_export_root_submission_v1") throw new Error("LinkedDeviceEd25519ExportRootSubmissionV1.kind is invalid");
 	return {
 		kind: "linked_device_ed25519_export_root_submission_v1",
-		linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
+		linkSessionId: requireParsed(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
 		package: parseLinkedDeviceEd25519ExportRootPackageV1(record.package)
 	};
 }
@@ -150,10 +150,6 @@ function parseUnixMs(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive unix-millisecond timestamp`);
 	return value;
 }
-function parseRequired(parsed, label) {
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
-}
 //#endregion
 export { LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1, linkedDeviceEd25519ExportRootMatchesRecipientV1, parseLinkedDeviceEd25519ExportRootPackageV1, parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u, parseLinkedDeviceEd25519ExportRootRecipientV1, parseLinkedDeviceEd25519ExportRootSubmissionV1 };
 

package/dist/esm/shared-ts/src/device-linking/sourceContribution.js

@@ -5,7 +5,7 @@ import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { requireRecordCopy } from "../utils/validation.js";
 import { parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../utils/routerAbNormalSigningIdentity.js";
-import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1 } from "../utils/routerAbEd25519Yao.js";
+import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, sameRouterAbEd25519YaoByteSequence } from "../utils/routerAbEd25519Yao.js";
 import { parseSdkEcdsaDerivationThresholdKeyId } from "../threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { requireRouterAbEcdsaDerivationNormalSigningStateV1 } from "../utils/routerAbEcdsaDerivation.js";
 //#region ../shared-ts/src/device-linking/sourceContribution.ts
@@ -33,7 +33,7 @@ function parseLinkedDeviceEd25519SourcePreservingReservationV1(raw) {
 	const participantIds = parseRouterAbEd25519YaoParticipantIdsV1(record.participant_ids);
 	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a");
 	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b");
-	if (!sameBytes(activationReceipt.transcript, deriverA.transcript) || !sameBytes(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 reservation packages have mismatched transcripts");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 reservation packages have mismatched transcripts");
 	return {
 		state: "inactive",
 		reservationId: requireText(record.reservation_id, "reservation_id"),
@@ -207,10 +207,10 @@ function parseEd25519Contribution(record) {
 	if (!sameEdStableIdentity(sourceBinding, targetBinding)) throw new Error("linked-device Ed25519 source contribution stable identity differs");
 	if (!mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(activationReceipt.material_activation), targetMaterialActivation)) throw new Error("linked-device Ed25519 source contribution receipt activation differs");
 	const sourceRegisteredPublicKeyB64u = parseEd25519PublicKeyB64u(record.sourceRegisteredPublicKeyB64u, "sourceRegisteredPublicKeyB64u");
-	if (!sameBytes(activationReceipt.registered_public_key, Array.from(base64UrlDecode(sourceRegisteredPublicKeyB64u)))) throw new Error("linked-device Ed25519 source contribution receipt public key differs");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.registered_public_key, Array.from(base64UrlDecode(sourceRegisteredPublicKeyB64u)))) throw new Error("linked-device Ed25519 source contribution receipt public key differs");
 	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a");
 	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b");
-	if (!sameBytes(activationReceipt.transcript, deriverA.transcript) || !sameBytes(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 source contribution package transcript differs");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 source contribution package transcript differs");
 	if (sourceBinding.material_activation.activation_id === targetMaterialActivation.activationId) throw new Error("linked-device Ed25519 source contribution reuses the source activation");
 	return {
 		kind: "linked_device_ed25519_source_contribution_v1",
@@ -537,9 +537,6 @@ function parseFixedBase64(raw, byteLength, label) {
 	if (decoded.length !== byteLength || base64UrlEncode(decoded) !== raw) throw new Error(`${label} must decode to ${byteLength} bytes`);
 	return raw;
 }
-function sameBytes(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 function requireText(raw, label) {
 	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw || [...raw].some((character) => {
 		const code = character.charCodeAt(0);
@@ -555,6 +552,6 @@ function exactRecord(raw, keys, label) {
 	return record;
 }
 //#endregion
-export { assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1, parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourceContributionBindingV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceContributionPreparationV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1, parseLinkedDeviceEd25519SourcePreservingReservationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionV1 };
+export { assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1, parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourceContributionBindingV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceContributionPreparationV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1, parseLinkedDeviceEd25519SourcePreservingReservationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionV1, sameEcdsaSourceSigner, sameEcdsaTarget };
 
 //# sourceMappingURL=sourceContribution.js.map

package/dist/esm/shared-ts/src/passkey-custody/primitives.js

@@ -13,6 +13,10 @@ function requireCanonicalBase64Url(value, label) {
 	if (base64UrlEncode(decoded) !== value) throw new Error(`${label} must be canonical base64url`);
 	return decoded;
 }
+function requireParsed(result, label) {
+	if (result.ok) return result.value;
+	throw new Error(`${label} ${result.error.message}`);
+}
 function parseDigestField(value, label) {
 	try {
 		return parseDigestB64u(value);
@@ -53,6 +57,6 @@ function parseUnixMs(value, label) {
 	return value;
 }
 //#endregion
-export { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs };
+export { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs, requireParsed };
 
 //# sourceMappingURL=primitives.js.map

package/dist/esm/shared-ts/src/signing-lanes/ownerContinuity.js

@@ -3,7 +3,7 @@ import { base64UrlEncode } from "../utils/base64.js";
 import { sha256Bytes } from "../utils/digests.js";
 import { requireRecord } from "../utils/validation.js";
 import { rejectUnknownFields } from "../utils/exactRecord.js";
-import { parseDigestField } from "../passkey-custody/primitives.js";
+import { parseDigestField, requireParsed } from "../passkey-custody/primitives.js";
 import { concat } from "../utils/digestEncoding.js";
 import { parseLaneParticipantBindingDigestB64u } from "./participants.js";
 import { encodeLaneCanonicalDigestV1, encodeLaneCanonicalTextV1, encodeLaneCanonicalU64V1 } from "./participantDigest.js";
@@ -17,10 +17,6 @@ const OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
 	"custodyKeyManifestDigestB64u",
 	"sourceIdentityDigestB64u"
 ];
-function requireResult(result, label) {
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
 /** Parse the owner signer identity without widening it into a generic string. */
 function parseWalletSignerId(raw, label = "walletSignerId") {
 	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
@@ -46,7 +42,7 @@ function buildOwnerLaneParticipantContinuityV1(args) {
 		kind: "owner_lane_participant_continuity_v1",
 		signerId: parseWalletSignerId(args.signerId),
 		participantIds,
-		signingWorkerId: requireResult(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
+		signingWorkerId: requireParsed(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
 		custodyKeyManifestDigestB64u: parseDigestField(args.custodyKeyManifestDigestB64u, "custodyKeyManifestDigestB64u"),
 		sourceIdentityDigestB64u: parseDigestField(args.sourceIdentityDigestB64u, "sourceIdentityDigestB64u")
 	};
@@ -58,7 +54,7 @@ function parseOwnerLaneParticipantContinuityV1(raw, label = "ownerParticipantCon
 	return buildOwnerLaneParticipantContinuityV1({
 		signerId: parseWalletSignerId(record.signerId, `${label}.signerId`),
 		participantIds: parseParticipantIds(record.participantIds, `${label}.participantIds`),
-		signingWorkerId: requireResult(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
+		signingWorkerId: requireParsed(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
 		custodyKeyManifestDigestB64u: parseDigestField(record.custodyKeyManifestDigestB64u, `${label}.custodyKeyManifestDigestB64u`),
 		sourceIdentityDigestB64u: parseDigestField(record.sourceIdentityDigestB64u, `${label}.sourceIdentityDigestB64u`)
 	});
@@ -76,7 +72,7 @@ function ownerLaneParticipantContinuityCanonicalBytesV1(input) {
 	]);
 }
 async function computeOwnerLaneParticipantBindingDigestV1(input) {
-	return requireResult(parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(ownerLaneParticipantContinuityCanonicalBytesV1(input)))), "owner participant digest");
+	return requireParsed(parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(ownerLaneParticipantContinuityCanonicalBytesV1(input)))), "owner participant digest");
 }
 //#endregion
 export { buildOwnerLaneParticipantContinuityV1, computeOwnerLaneParticipantBindingDigestV1, ownerLaneParticipantContinuityCanonicalBytesV1, parseOwnerLaneParticipantContinuityV1, parseWalletSignerId };

package/dist/esm/shared-ts/src/tenant-root/tenantRootIdentifier.js

@@ -0,0 +1,12 @@
+//#region ../shared-ts/src/tenant-root/tenantRootIdentifier.ts
+function hasControlCharacters(value) {
+	for (const character of value) {
+		const codePoint = character.codePointAt(0) ?? 0;
+		if (codePoint <= 31 || codePoint >= 127 && codePoint <= 159) return true;
+	}
+	return false;
+}
+//#endregion
+export { hasControlCharacters };
+
+//# sourceMappingURL=tenantRootIdentifier.js.map

package/dist/esm/shared-ts/src/tenant-root/tenantRootIdentity.js

@@ -1,6 +1,6 @@
+import { hasControlCharacters } from "./tenantRootIdentifier.js";
 //#region ../shared-ts/src/tenant-root/tenantRootIdentity.ts
 const TENANT_ROOT_IDENTITY_DOMAIN_V1 = new TextEncoder().encode("seams/tenant-root-identity/v1");
-const TENANT_ROOT_IDENTITY_MAX_IDENTIFIER_BYTES_V1 = 256;
 /**
 * The identity proof is only emitted by the authenticated builder or exact
 * wire decoder. Its private method makes raw object literals structurally
@@ -49,13 +49,6 @@ function hasLeadingOrTrailingRustWhitespace(value) {
 	const codePoints = Array.from(value, (character) => character.codePointAt(0) ?? 0);
 	return codePoints.length > 0 && (isRustWhitespace(codePoints[0]) || isRustWhitespace(codePoints[codePoints.length - 1]));
 }
-function hasControlCharacters(value) {
-	for (const character of value) {
-		const codePoint = character.codePointAt(0) ?? 0;
-		if (codePoint <= 31 || codePoint >= 127 && codePoint <= 159) return true;
-	}
-	return false;
-}
 function hasUnpairedSurrogate(value) {
 	for (let index = 0; index < value.length; index += 1) {
 		const codeUnit = value.charCodeAt(index);
@@ -73,7 +66,7 @@ function isCanonicalTenantRootIdentityField(value) {
 	if (typeof value !== "string" || value.length === 0) return false;
 	if (hasLeadingOrTrailingRustWhitespace(value) || hasControlCharacters(value)) return false;
 	if (hasUnpairedSurrogate(value)) return false;
-	return new TextEncoder().encode(value).length <= TENANT_ROOT_IDENTITY_MAX_IDENTIFIER_BYTES_V1;
+	return new TextEncoder().encode(value).length <= 256;
 }
 /** Checks one already-resolved field without normalizing it. */
 function isTenantRootIdentityFieldCanonicalV1(field, value) {

package/dist/esm/shared-ts/src/tenant-root/tenantRootOperationRecord.js

@@ -1,5 +1,6 @@
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { alphabetizeStringify, sha256Bytes } from "../utils/digests.js";
+import { hasExactKeys } from "../utils/exactKeys.js";
 import { isTenantRootIdentityFieldCanonicalV1 } from "./tenantRootIdentity.js";
 //#region ../shared-ts/src/tenant-root/tenantRootOperationRecord.ts
 /**
@@ -126,10 +127,6 @@ const RESTORE_ROLE_IMPORT_KEY_RECORD_KEYS_V1 = [
 	"subject",
 	"tenantRootIdentityDigest"
 ];
-function hasExactKeys(record, keys) {
-	const actual = Object.keys(record);
-	return actual.length === keys.length && keys.every((key) => actual.includes(key));
-}
 function parseRestoreRoleImportKeyIssueRecord(raw) {
 	if (!hasExactKeys(raw, RESTORE_ROLE_IMPORT_KEY_RECORD_KEYS_V1)) return null;
 	if (raw.formatVersion !== TENANT_ROOT_OPERATION_RECORD_FORMAT_V1) return null;

package/dist/esm/shared-ts/src/utils/ecdsaKeyFactsInventory.js

@@ -1,10 +1,8 @@
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
 import "./encoders.js";
+import { thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
 //#region ../shared-ts/src/utils/ecdsaKeyFactsInventory.ts
-function chainTargetKey(target) {
-	return target.kind === "evm" ? `evm:eip155:${target.chainId}` : `tempo:${target.chainId}`;
-}
 function normalizeChainTarget(target) {
 	if (target.kind === "evm") return {
 		kind: "evm",
@@ -22,7 +20,7 @@ function canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input) {
 	const keyTargets = input.keyTargets.map((target) => ({
 		keyHandle: target.keyHandle,
 		chainTarget: normalizeChainTarget(target.chainTarget),
-		targetKey: chainTargetKey(target.chainTarget)
+		targetKey: thresholdEcdsaChainTargetKey(target.chainTarget)
 	})).sort((left, right) => {
 		const leftKey = `${left.keyHandle}:${left.targetKey}`;
 		const rightKey = `${right.keyHandle}:${right.targetKey}`;

package/dist/esm/shared-ts/src/utils/ecdsaServerTiming.js

@@ -5,7 +5,6 @@ const ECDSA_TIMING_METRICS = new Set([
 	"ecdsa_sign_proxy",
 	"ecdsa_sign_complete",
 	"ecdsa_sign_total",
-	"ecdsa_presign_queue",
 	"ecdsa_presign_authenticate",
 	"ecdsa_presign_material",
 	"ecdsa_presign_admit",

package/dist/esm/shared-ts/src/utils/emailOtpDomain.js

@@ -6,6 +6,8 @@ function emailOtpDeviceEnrollmentId(walletId, providerSubject) {
 	if (!normalizedWalletId || !normalizedProviderSubject) throw new Error("Email OTP enrollment identity requires wallet and provider subject");
 	return `email-otp-device-enrollment-v1:${normalizedWalletId}:${normalizedProviderSubject}`;
 }
+/** Domain label that opens the AAD binding a released Email OTP factor to its challenge. */
+const EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 = "seams/email-otp/factor-release/v1";
 const WALLET_UNLOCK_BACKENDS = ["passkey", EMAIL_OTP_CHANNEL];
 const WALLET_EMAIL_OTP_LOGIN_OPERATIONS = [
 	"wallet_unlock",
@@ -33,6 +35,6 @@ function isWalletEmailOtpLoginOperation(value) {
 	return WALLET_EMAIL_OTP_LOGIN_OPERATIONS.includes(value);
 }
 //#endregion
-export { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, emailOtpDeviceEnrollmentId, isWalletEmailOtpLoginOperation, isWalletUnlockBackend };
+export { EMAIL_OTP_CHANNEL, EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, emailOtpDeviceEnrollmentId, isWalletEmailOtpLoginOperation, isWalletUnlockBackend };
 
 //# sourceMappingURL=emailOtpDomain.js.map

package/dist/esm/shared-ts/src/utils/exactKeys.js

@@ -0,0 +1,17 @@
+//#region ../shared-ts/src/utils/exactKeys.ts
+/**
+* True when `value` is a non-array object whose own enumerable string keys are exactly `keys`.
+*
+* A key whose value is `undefined` still counts as present. Symbol, non-enumerable and inherited
+* keys are not counted, and the prototype is not checked. A list that repeats a key never matches.
+* Kept apart from validation.ts, which the wallet iframe's boot path loads.
+*/
+function hasExactKeys(value, keys) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const actual = Object.keys(value);
+	return actual.length === keys.length && actual.every((key) => keys.includes(key));
+}
+//#endregion
+export { hasExactKeys };
+
+//# sourceMappingURL=exactKeys.js.map

package/dist/esm/shared-ts/src/utils/failure.js

@@ -0,0 +1,20 @@
+//#region ../shared-ts/src/utils/failure.ts
+function failure(code, message) {
+	return {
+		ok: false,
+		code,
+		message
+	};
+}
+function failedVerification(code, message) {
+	return {
+		ok: false,
+		verified: false,
+		code,
+		message
+	};
+}
+//#endregion
+export { failedVerification, failure };
+
+//# sourceMappingURL=failure.js.map

package/dist/esm/shared-ts/src/utils/registrationIntent.js

@@ -14,23 +14,14 @@ function addAuthMethodIntentGrantFromString(value) {
 function addSignerIntentGrantFromString(value) {
 	return String(value || "").trim();
 }
-function serializeRegistrationIntentV1(intent) {
-	return alphabetizeStringify(intent);
-}
-function serializeAddSignerIntentV1(intent) {
-	return alphabetizeStringify(intent);
-}
-function serializeAddAuthMethodIntentV1(intent) {
-	return alphabetizeStringify(intent);
-}
 async function computeRegistrationIntentDigestB64u(intent) {
-	return base64UrlEncode(await sha256BytesUtf8(serializeRegistrationIntentV1(intent)));
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(intent)));
 }
 async function computeAddSignerIntentDigestB64u(intent) {
-	return base64UrlEncode(await sha256BytesUtf8(serializeAddSignerIntentV1(intent)));
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(intent)));
 }
 async function computeAddAuthMethodIntentDigestB64u(intent) {
-	return base64UrlEncode(await sha256BytesUtf8(serializeAddAuthMethodIntentV1(intent)));
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(intent)));
 }
 function normalizeAddAuthMethodIntentCaller(raw) {
 	const record = inspectRawObject(raw);

package/dist/esm/shared-ts/src/utils/registrationSignerPlan.js

@@ -62,11 +62,8 @@ function registrationSignerBranchKeyFromString(value) {
 function registrationNearEd25519BranchKey(signerSlot) {
 	return registrationSignerBranchKeyFromString(`near_ed25519:slot:${signerSlot}`);
 }
-function registrationEvmFamilyEcdsaTargetKey(target) {
-	return alphabetizeStringify(target);
-}
 function registrationEvmFamilyEcdsaBranchKey(chainTargets) {
-	return registrationSignerBranchKeyFromString(`evm_family_ecdsa:${chainTargets.map(registrationEvmFamilyEcdsaTargetKey).join("|")}`);
+	return registrationSignerBranchKeyFromString(`evm_family_ecdsa:${chainTargets.map(alphabetizeStringify).join("|")}`);
 }
 function registrationSignerPlanFromRequests(signers) {
 	return registrationSignerPlanFromBranches(signers.map(registrationSignerPlanBranchFromRequest));
@@ -150,7 +147,7 @@ function findDuplicateRegistrationSignerBranch(branch, branchKeys) {
 }
 function findDuplicateRegistrationEcdsaTarget(branch, ecdsaTargetKeys) {
 	for (const target of branch.chainTargets) {
-		const targetKey = registrationEvmFamilyEcdsaTargetKey(target);
+		const targetKey = alphabetizeStringify(target);
 		if (ecdsaTargetKeys.has(targetKey)) return {
 			ok: false,
 			code: "invalid_body",

package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js

@@ -1560,6 +1560,6 @@ function parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(value) {
 	return parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestFields(record);
 }
 //#endregion
-export { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_HEALTH_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationPublicCapabilityV1, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1, parseRouterAbEcdsaDerivationActivationRefreshRequestV1, parseRouterAbEcdsaDerivationActivationRefreshResponseV1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationExplicitExportRequestV1, parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaExplicitExportProtocolForwardedResponseV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaOperationStepUpPreparationV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, parseRouterAbEcdsaPrepareSourceV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaRegistrationActivationRequestV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaRegistrationRequestV1, parseRouterAbEcdsaSigningWorkerProtocolExportShareEnvelopeV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1, projectRouterAbEcdsaDerivationExplicitExportRequestToProtocolV1, requireRouterAbEcdsaDerivationNormalSigningStateV1, routerAbEcdsaDerivationActiveStateId, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaRegistrationRequestFactsV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire, sameRouterAbServerIdentityV1 };
+export { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_HEALTH_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationPublicCapabilityV1, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1, parseRouterAbEcdsaDerivationActivationRefreshRequestV1, parseRouterAbEcdsaDerivationActivationRefreshResponseV1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationExplicitExportRequestV1, parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaExplicitExportProtocolForwardedResponseV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaOperationStepUpPreparationV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, parseRouterAbEcdsaPrepareSourceV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaRegistrationActivationRequestV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaRegistrationRequestV1, parseRouterAbEcdsaSigningWorkerProtocolExportShareEnvelopeV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1, projectRouterAbEcdsaDerivationExplicitExportRequestToProtocolV1, requireRouterAbEcdsaDerivationNormalSigningStateV1, routerAbEcdsaDerivationActiveStateId, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1, sameRegistrationSignerSet, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaRegistrationRequestFactsV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire, sameRouterAbServerIdentityV1 };
 
 //# sourceMappingURL=routerAbEcdsaDerivation.js.map

package/dist/esm/shared-ts/src/utils/routerAbEd25519Yao.js

@@ -819,6 +819,6 @@ function parseEncryptedPackageValue(value) {
 	return parseEncryptedPackage(value, "encrypted_package");
 }
 //#endregion
-export { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoActivationKeysetV1, parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportAdmissionRequestV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationRequestV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRecoveryStatusRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoActivationPublicReceiptV1, sameRouterAbEd25519YaoRecoveryAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 };
+export { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoActivationKeysetV1, parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportAdmissionRequestV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationRequestV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRecoveryStatusRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoActivationPublicReceiptV1, sameRouterAbEd25519YaoByteSequence, sameRouterAbEd25519YaoRecoveryAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 };
 
 //# sourceMappingURL=routerAbEd25519Yao.js.map

package/dist/esm/shared-ts/src/utils/thresholdEcdsaChainTarget.js

@@ -0,0 +1,9 @@
+//#region ../shared-ts/src/utils/thresholdEcdsaChainTarget.ts
+function thresholdEcdsaChainTargetKey(target) {
+	if (target.kind === "evm") return `evm:eip155:${target.chainId}`;
+	return `tempo:${target.chainId}`;
+}
+//#endregion
+export { thresholdEcdsaChainTargetKey };
+
+//# sourceMappingURL=thresholdEcdsaChainTarget.js.map

package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js

@@ -45,7 +45,7 @@ function buildGoogleEmailOtpProjection(input) {
 			providerSubject: input.providerSubject,
 			emailHashHex: requireEmailHash(input.emailHashHex),
 			registrationAuthorityId: requireTrimmedString(input.registrationAuthorityId, "registrationAuthorityId", "is invalid"),
-			enrollment: buildEnrollmentReference(input.enrollment)
+			enrollment: parseEnrollmentReference(input.enrollment)
 		}
 	};
 	assertProjectionShape(projection);
@@ -60,9 +60,6 @@ function parseEnrollmentReference(raw) {
 		enrollmentSealKeyVersion: requireTrimmedString(record.enrollmentSealKeyVersion, "enrollment.enrollmentSealKeyVersion", "is invalid")
 	};
 }
-function buildEnrollmentReference(value) {
-	return parseEnrollmentReference(value);
-}
 function assertProjectionShape(projection) {
 	if (projection.authority.walletId !== projection.walletId || projection.authority.authorityId !== projection.targetAuthorityId || projection.authority.principal.deviceId !== projection.targetDeviceId || projection.authority.provenance.kind !== "wallet_recovery" || projection.authority.provenance.recoveryOperationId !== projection.recoveryOperationId || projection.authority.provenance.continuityAuthorityId === projection.targetAuthorityId || projection.authMethod.walletId !== projection.walletId || projection.authMethod.walletAuthorityId !== projection.targetAuthorityId || projection.authMethod.walletAuthMethodId !== projection.targetWalletAuthMethodId || projection.authMethod.status !== "active") throw new Error("wallet recovery committed projection relations are invalid");
 	if (projection.kind === "passkey") {

package/dist/esm/threshold/session/signingSessionSeal/crypto/cipher.js

@@ -1,33 +1,18 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
 import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, encodeSigningSessionHkdfTuple } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { parseSigningSessionSealKeyVersion } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { addSigningSessionSealLock, deriveSigningSessionSealLockKeyHandle, destroySigningSessionSealLockKeyHandle, removeSigningSessionSealLock } from "./shamir3PassWasm.js";
 //#region src/threshold/session/signingSessionSeal/crypto/cipher.ts
 function toErrorResult(error) {
-	if (error && typeof error === "object" && !Array.isArray(error) && error.code) return {
-		ok: false,
-		code: String(error.code || "").trim() || "internal",
-		message: String(error.message || "").trim() || "Signing-session seal cipher failed"
-	};
-	return {
-		ok: false,
-		code: "internal",
-		message: error instanceof Error ? error.message : String(error || "Signing-session seal cipher failed")
-	};
+	if (error && typeof error === "object" && !Array.isArray(error) && error.code) return failure(String(error.code || "").trim() || "internal", String(error.message || "").trim() || "Signing-session seal cipher failed");
+	return failure("internal", error instanceof Error ? error.message : String(error || "Signing-session seal cipher failed"));
 }
 function normalizeResult(result) {
-	if (!result.ok) return {
-		ok: false,
-		code: String(result.code || "internal").trim() || "internal",
-		message: String(result.message || "Signing-session seal cipher failed").trim() || "Signing-session seal cipher failed"
-	};
+	if (!result.ok) return failure(String(result.code || "internal").trim() || "internal", String(result.message || "Signing-session seal cipher failed").trim() || "Signing-session seal cipher failed");
 	const ciphertext = normalizeOptionalTrimmedString(result.ciphertext);
-	if (!ciphertext) return {
-		ok: false,
-		code: "invalid_ciphertext",
-		message: "Signing-session seal cipher returned empty ciphertext"
-	};
+	if (!ciphertext) return failure("invalid_ciphertext", "Signing-session seal cipher returned empty ciphertext");
 	return {
 		ok: true,
 		ciphertext,
@@ -141,19 +126,12 @@ var SigningSessionSealKeyHandles = class {
 		return this.initialization;
 	}
 };
-function cipherFailure(code, message) {
-	return {
-		ok: false,
-		code,
-		message
-	};
-}
 function mapCipherError(error, defaultMessage) {
 	const message = normalizeOptionalTrimmedString(error instanceof Error ? error.message : error) || defaultMessage;
 	const lowered = message.toLowerCase();
-	if (lowered.includes("keyversion")) return cipherFailure("invalid_key_version", message);
-	if (lowered.includes("ciphertext") || lowered.includes("base64url") || lowered.includes("group")) return cipherFailure("invalid_ciphertext", message);
-	return cipherFailure("internal", message);
+	if (lowered.includes("keyversion")) return failure("invalid_key_version", message);
+	if (lowered.includes("ciphertext") || lowered.includes("base64url") || lowered.includes("group")) return failure("invalid_ciphertext", message);
+	return failure("internal", message);
 }
 function createSigningSessionSealShamir3PassCipherAdapter(options) {
 	const config = normalizeConfig(options.config);
@@ -163,7 +141,7 @@ function createSigningSessionSealShamir3PassCipherAdapter(options) {
 	return createSigningSessionSealCipherAdapter({
 		applyServerSeal: async (input) => {
 			const requestedKeyVersion = normalizeOptionalTrimmedString(input.keyVersion);
-			if (requestedKeyVersion && requestedKeyVersion !== config.currentKeyVersion) return cipherFailure("invalid_key_version", `Requested keyVersion "${requestedKeyVersion}" does not match active keyVersion "${config.currentKeyVersion}"`);
+			if (requestedKeyVersion && requestedKeyVersion !== config.currentKeyVersion) return failure("invalid_key_version", `Requested keyVersion "${requestedKeyVersion}" does not match active keyVersion "${config.currentKeyVersion}"`);
 			try {
 				const handle = (await handles.get()).get(config.currentKeyVersion);
 				if (handle === void 0) throw new Error("currentKeyVersion handle is unavailable");
@@ -183,7 +161,7 @@ function createSigningSessionSealShamir3PassCipherAdapter(options) {
 			const keyVersion = normalizeKeyVersion(input.keyVersion, "keyVersion");
 			try {
 				const handle = (await handles.get()).get(keyVersion);
-				if (handle === void 0) return cipherFailure("invalid_key_version", `Unknown keyVersion "${keyVersion}"`);
+				if (handle === void 0) return failure("invalid_key_version", `Unknown keyVersion "${keyVersion}"`);
 				return {
 					ok: true,
 					ciphertext: await runtime.removeLock({