@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js

@@ -1,13 +1,14 @@
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { computeAddSignerNearEd25519SigningKeyId, computeRegistrationNearEd25519SigningKeyId } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 import "../../../../shared-ts/src/threshold/sessionPolicy.js";
+import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { createRouterApiModule } from "../../../framework/modules.js";
 import { InMemoryRouterAbEd25519YaoRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule } from "../registration/routerAbEd25519YaoRegistration.js";
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1 } from "../registration/routerAbEd25519YaoRegistrationIntentAuthorization.js";
@@ -83,9 +84,12 @@ function isDispatchRootMap(input) {
 	for (const [key, value] of input) if (typeof key !== "string" || parseRouterAbEd25519YaoTenantRootWireV1(value) === null) return false;
 	return true;
 }
-function isStringSet(input) {
-	if (!(input instanceof Set)) return false;
-	for (const value of input) if (typeof value !== "string") return false;
+function isWalletOwnershipMap(input) {
+	if (!isStringMap(input)) return false;
+	for (const [key, walletId] of input) {
+		const parsed = parseWalletId(walletId);
+		if (!key || !parsed.ok || parsed.value !== walletId) return false;
+	}
 	return true;
 }
 function hasProductStateCollections(input) {
@@ -96,7 +100,7 @@ function hasProductStateCollections(input) {
 	const recovery = input.recovery;
 	const exportState = input.export;
 	if (!isPlainObject(registration) || !isPlainObject(authorization) || !isPlainObject(recovery) || !isPlainObject(exportState)) return false;
-	return isStringMapWithStateKinds(registration.states, REGISTRATION_STATE_KINDS) && isStringMap(registration.lifecycleSessions) && (registration.admissionClaims === void 0 || isStringMapWithStateKinds(registration.admissionClaims, REGISTRATION_ADMISSION_CLAIM_KINDS)) && isDispatchRootMap(registration.dispatchRoots) && Array.isArray(authorization.authorities) && authorization.authorities.every((authority) => isPlainObject(authority) && INTENT_AUTHORITY_KINDS.has(String(authority.kind))) && isStringMapWithStateKinds(recovery.capabilities, CAPABILITY_STATE_KINDS) && isStringMap(recovery.identityCapabilities) && isStringMapWithStateKinds(recovery.recoveries, RECOVERY_STATE_KINDS) && isStringMap(recovery.recoverySessions) && isStringMapWithStateKinds(exportState.exports, EXPORT_STATE_KINDS) && isStringSet(exportState.authorizationNonces) && (exportState.authorizationUncertain === void 0 || isStringSet(exportState.authorizationUncertain));
+	return isStringMapWithStateKinds(registration.states, REGISTRATION_STATE_KINDS) && isStringMap(registration.lifecycleSessions) && (registration.admissionClaims === void 0 || isStringMapWithStateKinds(registration.admissionClaims, REGISTRATION_ADMISSION_CLAIM_KINDS)) && isDispatchRootMap(registration.dispatchRoots) && Array.isArray(authorization.authorities) && authorization.authorities.every((authority) => isPlainObject(authority) && INTENT_AUTHORITY_KINDS.has(String(authority.kind))) && isStringMapWithStateKinds(recovery.capabilities, CAPABILITY_STATE_KINDS) && isStringMap(recovery.identityCapabilities) && isStringMapWithStateKinds(recovery.recoveries, RECOVERY_STATE_KINDS) && isStringMap(recovery.recoverySessions) && isStringMapWithStateKinds(exportState.exports, EXPORT_STATE_KINDS) && isWalletOwnershipMap(exportState.authorizationNonceOwners) && isWalletOwnershipMap(exportState.authorizationUncertainOwners);
 }
 function parseRouterAbEd25519YaoProductRegistrationStateV1(input) {
 	if (!hasProductStateCollections(input)) return {
@@ -105,7 +109,6 @@ function parseRouterAbEd25519YaoProductRegistrationStateV1(input) {
 	};
 	const registration = input.registration;
 	const admissionClaims = registration.admissionClaims === void 0 ? /* @__PURE__ */ new Map() : registration.admissionClaims;
-	const authorizationUncertain = input.export.authorizationUncertain === void 0 ? /* @__PURE__ */ new Set() : input.export.authorizationUncertain;
 	return {
 		ok: true,
 		value: {
@@ -120,8 +123,8 @@ function parseRouterAbEd25519YaoProductRegistrationStateV1(input) {
 			recovery: input.recovery,
 			export: {
 				exports: input.export.exports,
-				authorizationNonces: input.export.authorizationNonces,
-				authorizationUncertain
+				authorizationNonceOwners: input.export.authorizationNonceOwners,
+				authorizationUncertainOwners: input.export.authorizationUncertainOwners
 			}
 		}
 	};

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js

@@ -122,15 +122,16 @@ function parseRouterAbEd25519YaoProductRegistrationPartitionRecordJsonV1(input)
 	return isVersionedJsonObject(input) ? input : null;
 }
 function isEmptyCeremonyState(state) {
-	return state.registration.states.size === 0 && state.registration.lifecycleSessions.size === 0 && state.registration.admissionClaims.size === 0 && state.authorization.authorities.length === 0 && state.recovery.recoveries.size === 0 && state.export.exports.size === 0;
+	return state.registration.states.size === 0 && state.registration.lifecycleSessions.size === 0 && state.registration.admissionClaims.size === 0 && state.registration.dispatchRoots.size === 0 && state.authorization.authorities.length === 0 && state.recovery.recoveries.size === 0 && state.export.exports.size === 0;
 }
 function isEmptySharedState(state) {
-	return state.recovery.capabilities.size === 0 && state.recovery.identityCapabilities.size === 0 && state.recovery.recoverySessions.size === 0 && state.export.authorizationNonces.size === 0 && state.export.authorizationUncertain.size === 0;
+	return state.recovery.capabilities.size === 0 && state.recovery.identityCapabilities.size === 0 && state.recovery.recoverySessions.size === 0 && state.export.authorizationNonceOwners.size === 0 && state.export.authorizationUncertainOwners.size === 0;
 }
 function isCeremonyStateOwnedByLifecycle(state, lifecycleId) {
 	for (const value of state.registration.states.values()) if (value.admissionRequest.scope.lifecycle_id !== lifecycleId) return false;
 	for (const key of state.registration.lifecycleSessions.keys()) if (key !== lifecycleId) return false;
 	for (const key of state.registration.admissionClaims.keys()) if (key !== lifecycleId) return false;
+	for (const key of state.registration.dispatchRoots.keys()) if (key !== lifecycleId) return false;
 	for (const authority of state.authorization.authorities) if (authority.admissionRequest.scope.lifecycle_id !== lifecycleId) return false;
 	for (const value of state.recovery.recoveries.values()) if (value.context.admissionRequest.scope.lifecycle_id !== lifecycleId) return false;
 	for (const value of state.export.exports.values()) if (value.request.scope.lifecycle_id !== lifecycleId) return false;

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitioning.js

@@ -19,8 +19,8 @@ function partitionRouterAbEd25519YaoProductRegistrationStateV1(state, lifecycleI
 			recoveryCapabilities: new Map(state.recovery.capabilities),
 			recoveryIdentityCapabilities: new Map(state.recovery.identityCapabilities),
 			recoverySessions: new Map(state.recovery.recoverySessions),
-			exportAuthorizationNonces: new Set(state.export.authorizationNonces),
-			exportAuthorizationUncertain: new Set(state.export.authorizationUncertain)
+			exportAuthorizationNonceOwners: new Map(state.export.authorizationNonceOwners),
+			exportAuthorizationUncertainOwners: new Map(state.export.authorizationUncertainOwners)
 		},
 		ceremony: {
 			kind: "router_ab_ed25519_yao_product_registration_ceremony_state_v1",
@@ -75,8 +75,8 @@ function mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1(base, partit
 		},
 		export: {
 			exports,
-			authorizationNonces: new Set(partition.shared.exportAuthorizationNonces),
-			authorizationUncertain: new Set(partition.shared.exportAuthorizationUncertain)
+			authorizationNonceOwners: new Map(partition.shared.exportAuthorizationNonceOwners),
+			authorizationUncertainOwners: new Map(partition.shared.exportAuthorizationUncertainOwners)
 		}
 	});
 }
@@ -102,8 +102,8 @@ function boundedRouterAbEd25519YaoProductRegistrationSharedStateV1(source) {
 		recoveryCapabilities,
 		recoveryIdentityCapabilities: retainedRecoveryIdentityCapabilities(source.recoveryIdentityCapabilities, recoveryCapabilities),
 		recoverySessions: new Map(source.recoverySessions),
-		exportAuthorizationNonces: new Set(source.exportAuthorizationNonces),
-		exportAuthorizationUncertain: new Set(source.exportAuthorizationUncertain)
+		exportAuthorizationNonceOwners: new Map(source.exportAuthorizationNonceOwners),
+		exportAuthorizationUncertainOwners: new Map(source.exportAuthorizationUncertainOwners)
 	};
 }
 function boundedRecoveryCapabilities(source) {

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.js

@@ -1,4 +1,5 @@
 import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import { parseRouterAbEd25519YaoProductRegistrationStateV1 } from "./routerAbEd25519YaoProductRegistration.js";
 //#region src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.ts
 /** Bind the generic JSON adapter to the validated opaque ceremony key. */
@@ -194,7 +195,7 @@ function decodeRouterAbEd25519YaoProductRegistrationStateValueV1(value) {
 	};
 }
 function decodeRouterAbEd25519YaoProductRegistrationBytesV1(value) {
-	if (!hasExactRouterAbEd25519YaoProductRegistrationJsonKeys(value, ["__seamsType", "values"]) || value.__seamsType !== BYTES_KIND || !Array.isArray(value.values)) return { ok: false };
+	if (!hasExactKeys(value, ["__seamsType", "values"]) || value.__seamsType !== BYTES_KIND || !Array.isArray(value.values)) return { ok: false };
 	const bytes = [];
 	for (const entry of value.values) {
 		if (typeof entry !== "number" || !Number.isSafeInteger(entry) || entry < 0 || entry > 255) return { ok: false };
@@ -206,7 +207,7 @@ function decodeRouterAbEd25519YaoProductRegistrationBytesV1(value) {
 	};
 }
 function decodeRouterAbEd25519YaoProductRegistrationMapV1(value) {
-	if (!hasExactRouterAbEd25519YaoProductRegistrationJsonKeys(value, ["__seamsType", "entries"]) || value.__seamsType !== MAP_KIND || !Array.isArray(value.entries)) return { ok: false };
+	if (!hasExactKeys(value, ["__seamsType", "entries"]) || value.__seamsType !== MAP_KIND || !Array.isArray(value.entries)) return { ok: false };
 	const map = /* @__PURE__ */ new Map();
 	const keys = /* @__PURE__ */ new Set();
 	for (const entry of value.entries) {
@@ -223,7 +224,7 @@ function decodeRouterAbEd25519YaoProductRegistrationMapV1(value) {
 	};
 }
 function decodeRouterAbEd25519YaoProductRegistrationSetV1(value) {
-	if (!hasExactRouterAbEd25519YaoProductRegistrationJsonKeys(value, ["__seamsType", "values"]) || value.__seamsType !== SET_KIND || !Array.isArray(value.values)) return { ok: false };
+	if (!hasExactKeys(value, ["__seamsType", "values"]) || value.__seamsType !== SET_KIND || !Array.isArray(value.values)) return { ok: false };
 	const set = /* @__PURE__ */ new Set();
 	const encodedEntries = /* @__PURE__ */ new Set();
 	for (const entry of value.values) {
@@ -255,11 +256,7 @@ function readRouterAbEd25519YaoCeremonyKeyObjectV1(input) {
 }
 function exactRouterAbEd25519YaoProductRegistrationStateEnvelopeV1(input) {
 	if (!isRouterAbEd25519YaoProductRegistrationJsonObjectV1(input)) return null;
-	return hasExactRouterAbEd25519YaoProductRegistrationJsonKeys(input, ["kind", "state"]) ? input : null;
-}
-function hasExactRouterAbEd25519YaoProductRegistrationJsonKeys(input, fields) {
-	const actual = Object.keys(input);
-	return actual.length === fields.length && actual.every((field) => fields.some((expectedField) => expectedField === field));
+	return hasExactKeys(input, ["kind", "state"]) ? input : null;
 }
 function assertNever(value) {
 	throw new Error(`Unsupported Ed25519 Yao ceremony field: ${String(value)}`);

package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js

@@ -45,8 +45,8 @@ function resolveTraceContext(request) {
 var InMemoryRouterAbEd25519YaoExportStateV1 = class {
 	constructor() {
 		this.exports = /* @__PURE__ */ new Map();
-		this.authorizationNonces = /* @__PURE__ */ new Set();
-		this.authorizationUncertain = /* @__PURE__ */ new Set();
+		this.authorizationNonceOwners = /* @__PURE__ */ new Map();
+		this.authorizationUncertainOwners = /* @__PURE__ */ new Map();
 	}
 };
 function bytesToHex(bytes) {
@@ -177,10 +177,10 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 		this.state = state;
 	}
 	authorizationIsUncertain(request) {
-		return this.state.authorizationUncertain.has(exportKey(request));
+		return this.state.authorizationUncertainOwners.has(exportKey(request));
 	}
 	recordAuthorizationUncertain(request) {
-		this.state.authorizationUncertain.add(exportKey(request));
+		this.state.authorizationUncertainOwners.set(exportKey(request), request.scope.account_id);
 	}
 	async admitExport(request, authorizationIdentity, admission, factorRelease, traceContext) {
 		const admitted = await admission.admit();
@@ -256,11 +256,11 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			}
 		}
 		const nonce = bytesToHex(request.authorization.nonce);
-		if (this.state.authorizationNonces.has(nonce)) return {
+		if (this.state.authorizationNonceOwners.has(nonce)) return {
 			kind: "completed",
 			value: authorizationConflict("export_authorization_replayed", "Ed25519 Yao export authorization was already used")
 		};
-		this.state.authorizationNonces.add(nonce);
+		this.state.authorizationNonceOwners.set(nonce, request.scope.account_id);
 		this.state.exports.set(key, {
 			kind: "authorized",
 			request,

package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.js

@@ -2,6 +2,7 @@ import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { publishWalletLifecycleHome } from "../../../../authorization/lifecycleRouting.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { json, readJson } from "../../../framework/http.js";
@@ -159,6 +160,8 @@ async function handleAdmissionRequest(context, raw) {
 	}, { status: 403 });
 	const admission = await runAuthorization(context, parsed, expectedOrigin);
 	if (!admission.ok) return exportResponse(admission);
+	const published = await publishWalletLifecycleHome(context.input.lifecycleRouting ?? null, "yao_export", parsed.protocol);
+	if (!published.ok) return exportResponse(published);
 	const result = await runAdmission(context, parsed.protocol, admission.authorizationIdentity);
 	if (result.ok) return json({
 		protocol: result.value,

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.js

@@ -1,4 +1,5 @@
 import { parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationRequestV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRecoveryStatusRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { publishWalletLifecycleHome } from "../../../../authorization/lifecycleRouting.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { json, readJson } from "../../../framework/http.js";
 import { InMemoryRouterAbEd25519YaoRecoveryService, buildWarmRecoveryBootstrapResponse, recoveryAuthorizationBinding } from "./routerAbEd25519YaoRecovery.js";
@@ -20,6 +21,13 @@ var RecoveryAdmissionRequestRun = class {
 			value: authorized
 		};
 		const prepared = this.service(state).prepareAdmitRecovery(this.request, recoveryAuthorizationBinding(authorized.authorization), await this.context.input.backend.resolveRecoveryDispatchRoot(this.request), Date.now());
+		if (prepared.kind !== "failed") {
+			const published = await publishWalletLifecycleHome(this.context.input.lifecycleRouting ?? null, "yao_recovery", this.request);
+			if (!published.ok) return {
+				kind: "rejected",
+				value: published
+			};
+		}
 		switch (prepared.kind) {
 			case "claimed": return {
 				kind: "claimed",

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js

@@ -1,7 +1,7 @@
 import { NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { sameRouterAbEd25519YaoByteSequence } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { walletSessionFailureMessage } from "../../../auth/walletSessionFailure.js";
 import { resolveWalletSessionAuthorizationV2Admission } from "../../signingOperations/walletExecutionAdmission.js";
@@ -16,9 +16,6 @@ function authorizationFailure(input) {
 		message: input.message
 	};
 }
-function sameRouterAbEd25519YaoByteSequenceV1(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 function sameRouterAbEd25519YaoApplicationBindingV1(left, right) {
 	return left.wallet_id === right.wallet_id && left.near_ed25519_signing_key_id === right.near_ed25519_signing_key_id && left.signing_root_id === right.signing_root_id && left.key_creation_signer_slot === right.key_creation_signer_slot;
 }
@@ -28,7 +25,7 @@ async function entryMatchesAdmission(input) {
 		keySetId: input.entry.keySetId
 	});
 	const basis = input.entry.recoveryBasis;
-	return String(input.prepared.walletId) === input.request.scope.account_id && String(input.prepared.walletId) === input.request.application_binding.wallet_id && input.request.scope.lifecycle_id === expectedLifecycleId && input.request.scope.threshold_session_id === `${expectedLifecycleId}:threshold-session` && input.request.scope.root_share_epoch === basis.scope.root_share_epoch && input.request.scope.account_id === basis.scope.account_id && input.request.scope.signer_set_id === basis.scope.signer_set_id && input.request.scope.signing_worker_id === basis.scope.signing_worker_id && sameRouterAbMpcMaterialActivationRef(input.request.active_material_activation, basis.activeMaterialActivation) && sameRouterAbEd25519YaoApplicationBindingV1(input.request.application_binding, basis.applicationBinding) && input.request.participant_ids[0] === basis.participantIds[0] && input.request.participant_ids[1] === basis.participantIds[1] && sameRouterAbEd25519YaoByteSequenceV1(input.request.active_capability_binding, basis.activeCapabilityBinding) && sameRouterAbEd25519YaoByteSequenceV1(input.request.registered_public_key, basis.registeredPublicKey);
+	return String(input.prepared.walletId) === input.request.scope.account_id && String(input.prepared.walletId) === input.request.application_binding.wallet_id && input.request.scope.lifecycle_id === expectedLifecycleId && input.request.scope.threshold_session_id === `${expectedLifecycleId}:threshold-session` && input.request.scope.root_share_epoch === basis.scope.root_share_epoch && input.request.scope.account_id === basis.scope.account_id && input.request.scope.signer_set_id === basis.scope.signer_set_id && input.request.scope.signing_worker_id === basis.scope.signing_worker_id && sameRouterAbMpcMaterialActivationRef(input.request.active_material_activation, basis.activeMaterialActivation) && sameRouterAbEd25519YaoApplicationBindingV1(input.request.application_binding, basis.applicationBinding) && input.request.participant_ids[0] === basis.participantIds[0] && input.request.participant_ids[1] === basis.participantIds[1] && sameRouterAbEd25519YaoByteSequence(input.request.active_capability_binding, basis.activeCapabilityBinding) && sameRouterAbEd25519YaoByteSequence(input.request.registered_public_key, basis.registeredPublicKey);
 }
 async function authorizePreparedRecovery(input) {
 	const challengeId = String(input.request.request.headers.get("x-seams-wallet-recovery-challenge-id") || "").trim();
@@ -249,7 +246,7 @@ function exactRecoveryAdmissionMatches(input) {
 	const identity = input.activeMaterial.exportIdentity;
 	const walletId = String(input.admission.context.authorization.session.walletId);
 	const registeredPublicKeyB64u = base64UrlEncode(Uint8Array.from(identity.registered_public_key));
-	return String(input.admission.admission.signer.walletId) === walletId && registeredPublicKeyB64u === input.admission.admission.signer.registeredPublicKeyB64u && request.scope.account_id === walletId && request.application_binding.wallet_id === walletId && sameRouterAbMpcMaterialActivationRef(request.active_material_activation, input.materialActivation) && sameRouterAbMpcMaterialActivationRef(input.activeMaterial.materialActivation, input.materialActivation) && sameRouterAbMpcMaterialActivationRef(identity.scope.material_activation, input.materialActivation) && request.scope.root_share_epoch === identity.scope.root_share_epoch && request.scope.account_id === identity.scope.account_id && request.scope.threshold_session_id === identity.scope.threshold_session_id && request.scope.signer_set_id === identity.scope.signer_set_id && request.scope.signing_worker_id === identity.scope.signing_worker_id && input.activeMaterial.runtimePolicyScope.signingRootVersion === request.scope.root_share_epoch && input.activeMaterial.nearAccountId.length > 0 && input.activeMaterial.signerSlot === request.application_binding.key_creation_signer_slot && input.activeMaterial.signingWorkerId === request.scope.signing_worker_id && sameRouterAbEd25519YaoApplicationBindingV1(request.application_binding, identity.application_binding) && request.participant_ids[0] === input.activeMaterial.participantIds[0] && request.participant_ids[1] === input.activeMaterial.participantIds[1] && request.participant_ids[0] === identity.participant_ids[0] && request.participant_ids[1] === identity.participant_ids[1] && sameRouterAbEd25519YaoByteSequenceV1(request.registered_public_key, identity.registered_public_key);
+	return String(input.admission.admission.signer.walletId) === walletId && registeredPublicKeyB64u === input.admission.admission.signer.registeredPublicKeyB64u && request.scope.account_id === walletId && request.application_binding.wallet_id === walletId && sameRouterAbMpcMaterialActivationRef(request.active_material_activation, input.materialActivation) && sameRouterAbMpcMaterialActivationRef(input.activeMaterial.materialActivation, input.materialActivation) && sameRouterAbMpcMaterialActivationRef(identity.scope.material_activation, input.materialActivation) && request.scope.root_share_epoch === identity.scope.root_share_epoch && request.scope.account_id === identity.scope.account_id && request.scope.threshold_session_id === identity.scope.threshold_session_id && request.scope.signer_set_id === identity.scope.signer_set_id && request.scope.signing_worker_id === identity.scope.signing_worker_id && input.activeMaterial.runtimePolicyScope.signingRootVersion === request.scope.root_share_epoch && input.activeMaterial.nearAccountId.length > 0 && input.activeMaterial.signerSlot === request.application_binding.key_creation_signer_slot && input.activeMaterial.signingWorkerId === request.scope.signing_worker_id && sameRouterAbEd25519YaoApplicationBindingV1(request.application_binding, identity.application_binding) && request.participant_ids[0] === input.activeMaterial.participantIds[0] && request.participant_ids[1] === input.activeMaterial.participantIds[1] && request.participant_ids[0] === identity.participant_ids[0] && request.participant_ids[1] === identity.participant_ids[1] && sameRouterAbEd25519YaoByteSequence(request.registered_public_key, identity.registered_public_key);
 }
 async function authorizeV2RecoveryAdmission(input) {
 	const resolved = await resolveExactEd25519OperationCredentialMaterial({

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js

@@ -1,6 +1,7 @@
 import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveRouterAbEd25519YaoStableContextBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { computeAddSignerNearEd25519SigningKeyId } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { findRegistrationSignerPlanNearEd25519Branch, registrationNearEd25519BranchKey, registrationSignerPlanFromSelection } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.ts
@@ -217,21 +218,9 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 	}
 	async bindVerifiedIntent(verified) {
 		const credential = activationIntentCredential(verified);
-		if (!VERIFIED_INTENT_CREDENTIAL.test(credential)) return {
-			ok: false,
-			code: "invalid_registration_intent",
-			message: "registration intent grant is not a canonical Bearer credential"
-		};
-		if (!Number.isSafeInteger(verified.expiresAtMs) || verified.expiresAtMs <= Date.now()) return {
-			ok: false,
-			code: "invalid_registration_intent",
-			message: "registration intent authority is expired"
-		};
-		if (!await activationIntentMatchesAdmission(verified)) return {
-			ok: false,
-			code: "invalid_registration_intent",
-			message: "registration intent does not match the Ed25519 Yao admission subject"
-		};
+		if (!VERIFIED_INTENT_CREDENTIAL.test(credential)) return failure("invalid_registration_intent", "registration intent grant is not a canonical Bearer credential");
+		if (!Number.isSafeInteger(verified.expiresAtMs) || verified.expiresAtMs <= Date.now()) return failure("invalid_registration_intent", "registration intent authority is expired");
+		if (!await activationIntentMatchesAdmission(verified)) return failure("invalid_registration_intent", "registration intent does not match the Ed25519 Yao admission subject");
 		const credentialDigest = await credentialDigestSha256(credential);
 		const purpose = activationIntentPurpose(verified);
 		const copiedAdmissionRequest = copyAdmissionRequest(verified.admissionRequest);
@@ -245,11 +234,7 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 			return exactRetry ? {
 				ok: true,
 				admissionRequest: copyAdmissionRequest(existing.admissionRequest)
-			} : {
-				ok: false,
-				code: "registration_intent_conflict",
-				message: "registration intent credential or lifecycle is already bound"
-			};
+			} : failure("registration_intent_conflict", "registration intent credential or lifecycle is already bound");
 		}
 		this.authorities.push({
 			kind: "available",
@@ -266,11 +251,7 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 	}
 	async bindVerifiedContinuation(verified) {
 		const existing = findAuthorityByLifecycleId(this.authorities, verified.admissionRequest.scope.lifecycle_id);
-		if (!existing || existing.authority.purpose !== "wallet_registration" || existing.authority.admissionFingerprint !== canonicalAdmissionRequest(verified.admissionRequest) || !Number.isSafeInteger(verified.expiresAtMs) || verified.expiresAtMs <= Date.now() || !verified.credential.startsWith("wst_") || !VERIFIED_INTENT_CREDENTIAL.test(verified.credential)) return {
-			ok: false,
-			code: "registration_intent_conflict",
-			message: "NEAR continuation does not match its original authorization"
-		};
+		if (!existing || existing.authority.purpose !== "wallet_registration" || existing.authority.admissionFingerprint !== canonicalAdmissionRequest(verified.admissionRequest) || !Number.isSafeInteger(verified.expiresAtMs) || verified.expiresAtMs <= Date.now() || !verified.credential.startsWith("wst_") || !VERIFIED_INTENT_CREDENTIAL.test(verified.credential)) return failure("registration_intent_conflict", "NEAR continuation does not match its original authorization");
 		this.authorities[existing.index] = {
 			kind: existing.authority.kind,
 			purpose: existing.authority.purpose,

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js

@@ -1,3 +1,4 @@
+import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.ts
 const SIDE_EFFECT_CLAIM_FIELDS = [
 	"kind",
@@ -34,79 +35,66 @@ function throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(failure) {
 function parseRouterAbEd25519YaoRegistrationSideEffectRecordV2(raw, input) {
 	const record = readRouterAbEd25519YaoRegistrationSideEffectRecordObjectV1(raw);
 	if (record === null || record.operation !== input.operation) return null;
-	if (record.kind === "router_ab_ed25519_yao_registration_side_effect_claim_v1") {
-		if (!hasExactRouterAbEd25519YaoRegistrationSideEffectRecordKeys(record, SIDE_EFFECT_CLAIM_FIELDS)) return null;
-		const requestFingerprint = parseFingerprint(record.requestFingerprint);
-		const preparedArtifactFingerprint = parsePreparedFingerprint(record.preparedArtifactFingerprint);
-		const claimedAtMs = parseTimestamp(record.claimedAtMs);
-		const prepared = input.parsePrepared(record.prepared);
-		if (requestFingerprint === null || preparedArtifactFingerprint === null || claimedAtMs === null || prepared === null) return null;
-		return {
-			kind: "router_ab_ed25519_yao_registration_side_effect_claim_v1",
-			operation: input.operation,
-			requestFingerprint,
-			preparedArtifactFingerprint,
-			claimedAtMs,
-			prepared
-		};
-	}
-	if (record.kind !== "router_ab_ed25519_yao_registration_side_effect_completion_v2" || !hasExactRouterAbEd25519YaoRegistrationSideEffectRecordKeys(record, SIDE_EFFECT_COMPLETION_V2_FIELDS)) return null;
-	const requestFingerprint = parseFingerprint(record.requestFingerprint);
-	const preparedArtifactFingerprint = parsePreparedFingerprint(record.preparedArtifactFingerprint);
-	const claimedAtMs = parseTimestamp(record.claimedAtMs);
-	const prepared = input.parsePrepared(record.prepared);
-	if (requestFingerprint === null || preparedArtifactFingerprint === null || claimedAtMs === null || prepared === null) return null;
+	if (record.kind === "router_ab_ed25519_yao_registration_side_effect_claim_v1") return parseRouterAbEd25519YaoRegistrationSideEffectClaimV1(record, input);
+	if (record.kind !== "router_ab_ed25519_yao_registration_side_effect_completion_v2" || !hasExactKeys(record, SIDE_EFFECT_COMPLETION_V2_FIELDS)) return null;
+	const claim = parseRouterAbEd25519YaoRegistrationSideEffectClaimFields(record, input.parsePrepared);
+	if (claim === null) return null;
 	const completedAtMs = parseTimestamp(record.completedAtMs);
 	const receipt = input.parseReceipt(record.receipt);
 	if (completedAtMs === null || receipt === null) return null;
 	return {
 		kind: "router_ab_ed25519_yao_registration_side_effect_completion_v2",
 		operation: input.operation,
-		requestFingerprint,
-		preparedArtifactFingerprint,
-		claimedAtMs,
+		requestFingerprint: claim.requestFingerprint,
+		preparedArtifactFingerprint: claim.preparedArtifactFingerprint,
+		claimedAtMs: claim.claimedAtMs,
 		completedAtMs,
-		prepared,
+		prepared: claim.prepared,
 		receipt
 	};
 }
 function parseRouterAbEd25519YaoRegistrationSideEffectRecordV1(raw, input) {
 	const record = readRouterAbEd25519YaoRegistrationSideEffectRecordObjectV1(raw);
 	if (record === null || record.operation !== input.operation) return null;
-	if (record.kind === "router_ab_ed25519_yao_registration_side_effect_claim_v1") {
-		if (!hasExactRouterAbEd25519YaoRegistrationSideEffectRecordKeys(record, SIDE_EFFECT_CLAIM_FIELDS)) return null;
-		const requestFingerprint = parseFingerprint(record.requestFingerprint);
-		const preparedArtifactFingerprint = parsePreparedFingerprint(record.preparedArtifactFingerprint);
-		const claimedAtMs = parseTimestamp(record.claimedAtMs);
-		const prepared = input.parsePrepared(record.prepared);
-		if (requestFingerprint === null || preparedArtifactFingerprint === null || claimedAtMs === null || prepared === null) return null;
-		return {
-			kind: "router_ab_ed25519_yao_registration_side_effect_claim_v1",
-			operation: input.operation,
-			requestFingerprint,
-			preparedArtifactFingerprint,
-			claimedAtMs,
-			prepared
-		};
-	}
-	if (record.kind !== "router_ab_ed25519_yao_registration_side_effect_completion_v1" || !hasExactRouterAbEd25519YaoRegistrationSideEffectRecordKeys(record, SIDE_EFFECT_COMPLETION_V1_FIELDS)) return null;
-	const requestFingerprint = parseFingerprint(record.requestFingerprint);
-	const preparedArtifactFingerprint = parsePreparedFingerprint(record.preparedArtifactFingerprint);
-	const claimedAtMs = parseTimestamp(record.claimedAtMs);
-	const prepared = input.parsePrepared(record.prepared);
-	if (requestFingerprint === null || preparedArtifactFingerprint === null || claimedAtMs === null || prepared === null) return null;
+	if (record.kind === "router_ab_ed25519_yao_registration_side_effect_claim_v1") return parseRouterAbEd25519YaoRegistrationSideEffectClaimV1(record, input);
+	if (record.kind !== "router_ab_ed25519_yao_registration_side_effect_completion_v1" || !hasExactKeys(record, SIDE_EFFECT_COMPLETION_V1_FIELDS)) return null;
+	const claim = parseRouterAbEd25519YaoRegistrationSideEffectClaimFields(record, input.parsePrepared);
+	if (claim === null) return null;
 	const completedAtMs = parseTimestamp(record.completedAtMs);
 	const response = input.parseResponse(record.response);
 	if (completedAtMs === null || response === null) return null;
 	return {
 		kind: "router_ab_ed25519_yao_registration_side_effect_completion_v1",
 		operation: input.operation,
+		requestFingerprint: claim.requestFingerprint,
+		preparedArtifactFingerprint: claim.preparedArtifactFingerprint,
+		claimedAtMs: claim.claimedAtMs,
+		completedAtMs,
+		prepared: claim.prepared,
+		response
+	};
+}
+function parseRouterAbEd25519YaoRegistrationSideEffectClaimV1(record, input) {
+	if (!hasExactKeys(record, SIDE_EFFECT_CLAIM_FIELDS)) return null;
+	const claim = parseRouterAbEd25519YaoRegistrationSideEffectClaimFields(record, input.parsePrepared);
+	if (claim === null) return null;
+	return {
+		kind: "router_ab_ed25519_yao_registration_side_effect_claim_v1",
+		operation: input.operation,
+		...claim
+	};
+}
+function parseRouterAbEd25519YaoRegistrationSideEffectClaimFields(record, parsePrepared) {
+	const requestFingerprint = parseFingerprint(record.requestFingerprint);
+	const preparedArtifactFingerprint = parsePreparedFingerprint(record.preparedArtifactFingerprint);
+	const claimedAtMs = parseTimestamp(record.claimedAtMs);
+	const prepared = parsePrepared(record.prepared);
+	if (requestFingerprint === null || preparedArtifactFingerprint === null || claimedAtMs === null || prepared === null) return null;
+	return {
 		requestFingerprint,
 		preparedArtifactFingerprint,
 		claimedAtMs,
-		completedAtMs,
-		prepared,
-		response
+		prepared
 	};
 }
 /**
@@ -403,10 +391,6 @@ function readRouterAbEd25519YaoRegistrationSideEffectRecordObjectV1(value) {
 function isRouterAbEd25519YaoRegistrationSideEffectRecordObjectV1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function hasExactRouterAbEd25519YaoRegistrationSideEffectRecordKeys(record, expectedKeys) {
-	const actualKeys = Object.keys(record);
-	return actualKeys.length === expectedKeys.length && actualKeys.every((key) => expectedKeys.some((expectedKey) => expectedKey === key));
-}
 function parseFingerprint(value) {
 	return typeof value === "string" && /^[a-zA-Z0-9_-]{32,128}$/u.test(value) ? value : null;
 }

package/dist/esm/router/domains/emailOtp/emailOtpRequestValidation.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation, isWalletUnlockBackend } from "../../../shared-ts/src/utils/emailOtpDomain.js";
 //#region src/router/domains/emailOtp/emailOtpRequestValidation.ts
 function parseWalletUnlockBackend(raw) {