@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/transport/fetch/routes/walletExecutionLanePreflight.js

@@ -1,9 +1,10 @@
 import { parseMpcMaterialActivationRef, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { WALLET_SESSION_FAILURE_CODES } from "../../../../shared-ts/src/utils/walletSessionFailure.js";
 import { json, readJson } from "../../../framework/http.js";
-import { walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
+import { walletSessionFailure, walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
 import { validateRouterAbEcdsaDerivationWalletSessionInputs, validateRouterAbEd25519WalletSessionInputs } from "../../../auth/commonRouterUtils.js";
 //#region src/router/transport/fetch/routes/walletExecutionLanePreflight.ts
 const OWNER_WALLET_EXECUTION_LANE_PREFLIGHT_PATH = "/wallet/execution-lane/owner";
@@ -177,11 +178,13 @@ async function handleOwnerWalletExecutionLanePreflight(ctx) {
 		};
 	} else {
 		const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
+			materialActivation: routerAbMpcMaterialActivationRefToWire(request.expectedMaterialActivation),
 			headers,
 			authorizationSessions: ctx.service.authorizationSessions,
 			operationKind: EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction
 		});
 		if (!validated.ok) return validationFailure(validated);
+		if (validated.kind === "wallet_session_operation_credential_exhausted_candidate_v1") return validationFailure(walletSessionFailure("wallet_session_unavailable"));
 		walletIdRaw = String(validated.admission.context.authorization.session.walletId);
 		authorization = {
 			kind: "wallet_auth_method",

package/dist/esm/router/transport/fetch/routes/walletRegistration.js

@@ -1,5 +1,6 @@
 import { findRouteDefinitionById, matchesRouteDefinitionRequest } from "../../../framework/routeDefinitions.js";
-import { readJson } from "../../../framework/http.js";
+import "../../../../shared-ts/src/utils/walletManagementProtocol.js";
+import { jsonFailure, readJson } from "../../../framework/http.js";
 import { resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
 import { toFetchRouteResponse } from "../../../framework/routeResponses.js";
 import { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearAdmission, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod } from "../../../domains/walletRegistration/walletRegistrationRoutes.js";
@@ -43,6 +44,7 @@ function resolveWalletRegistrationRoute(ctx) {
 async function handleWalletRegistration(ctx) {
 	const route = resolveWalletRegistrationRoute(ctx);
 	if (!route) return null;
+	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "2") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
 	const common = {
 		body: await readJson(ctx.request),
 		headers: Object.fromEntries(ctx.request.headers.entries()),

package/dist/esm/router/transport/fetch/routes/webauthnAuthenticators.js

@@ -1,4 +1,4 @@
-import { json } from "../../../framework/http.js";
+import { json, jsonFailure } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 //#region src/router/transport/fetch/routes/webauthnAuthenticators.ts
 async function handleWebAuthnAuthenticators(ctx) {
@@ -6,22 +6,14 @@ async function handleWebAuthnAuthenticators(ctx) {
 	if (ctx.pathname !== "/webauthn/authenticators") return null;
 	try {
 		const token = extractBearerCredential(ctx.request.headers);
-		if (!token) return json({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
+		if (!token) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
 		const nowMs = Date.now();
 		const exact = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
 			tenantId: ctx.service.authorizationSessions.tenantId,
 			token,
 			nowMs
 		});
-		if (!exact) return json({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
+		if (!exact) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
 		const rpIdFromQuery = String(ctx.url.searchParams.get("rpId") || ctx.url.searchParams.get("rp_id") || "").trim();
 		const result = await ctx.service.webAuthn.listWebAuthnAuthenticatorsForUser({
 			userId: String(exact.authorization.session.walletId),
@@ -30,11 +22,7 @@ async function handleWebAuthnAuthenticators(ctx) {
 		if (!result.ok) return json(result, { status: result.code === "not_supported" ? 501 : result.code === "invalid_args" ? 400 : 500 });
 		return json(result, { status: 200 });
 	} catch (e) {
-		return json({
-			ok: false,
-			code: "internal",
-			message: e?.message || "Internal error"
-		}, { status: 500 });
+		return jsonFailure(500, "internal", e?.message || "Internal error");
 	}
 }
 //#endregion

package/dist/esm/shared-ts/src/authorization/walletSessionIssuance.js

@@ -1,5 +1,4 @@
 import "./capabilityKinds.js";
-import "../utils/validation.js";
 //#endregion
 
 //# sourceMappingURL=walletSessionIssuance.js.map

package/dist/esm/shared-ts/src/authorization/walletSignerActivationEquality.js

@@ -0,0 +1,12 @@
+import { mpcMaterialActivationRefsEqual } from "../utils/domainIds.js";
+//#region ../shared-ts/src/authorization/walletSignerActivationEquality.ts
+function sameWalletEd25519SignerActivationV1(left, right) {
+	return left.kind === right.kind && left.signer.kind === right.signer.kind && left.signer.keyFamily === right.signer.keyFamily && left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.registeredPublicKeyB64u === right.signer.registeredPublicKeyB64u && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
+}
+function sameWalletEcdsaSignerActivationV1(left, right) {
+	return left.kind === right.kind && left.signer.kind === right.signer.kind && left.signer.keyFamily === right.signer.keyFamily && left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.thresholdPublicKey33B64u === right.signer.thresholdPublicKey33B64u && left.signer.evmAddress === right.signer.evmAddress && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
+}
+//#endregion
+export { sameWalletEcdsaSignerActivationV1, sameWalletEd25519SignerActivationV1 };
+
+//# sourceMappingURL=walletSignerActivationEquality.js.map

package/dist/esm/shared-ts/src/device-linking/authorityActivation.js

@@ -1,5 +1,3 @@
-import "../utils/validation.js";
-import "../utils/exactRecord.js";
 import { wireLiteral, wireObject } from "../utils/wireSchema.js";
 import { authorizationDeviceId, digest, keyLabeled, parseUnixTime, sessionId, walletAuthMethodId, walletAuthorityId, walletId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
 import "./activeWalletSession.js";

package/dist/esm/shared-ts/src/device-linking/committedSignerPackages.js

@@ -3,7 +3,7 @@ import { alphabetizeStringify } from "../utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../utils/canonicalPrimitives.js";
 import { parseLinkedDeviceEd25519ExportRootPackageV1 } from "./ed25519ExportRoot.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../utils/routerAbNormalSigningIdentity.js";
-import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1 } from "../utils/routerAbEd25519Yao.js";
+import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, sameRouterAbEd25519YaoByteSequence } from "../utils/routerAbEd25519Yao.js";
 import { parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "./sourceContribution.js";
 import { parseWalletAuthMethodRecordV2 } from "../utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../authorization/walletAuthority.js";
@@ -117,7 +117,7 @@ function parseEd25519Package(raw) {
 	if (!mpcMaterialActivationRefsEqual(materialActivation, routerAbMpcMaterialActivationRefFromWire(targetBinding.material_activation))) throw new Error("CommittedEd25519SignerPackageV1 target binding does not match material");
 	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a_client_package", "deriver_a");
 	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b_client_package", "deriver_b");
-	if (!sameBytes(activationReceipt.transcript, deriverA.transcript) || !sameBytes(activationReceipt.transcript, deriverB.transcript)) throw new Error("CommittedEd25519SignerPackageV1 receipt transcript does not match packages");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) throw new Error("CommittedEd25519SignerPackageV1 receipt transcript does not match packages");
 	return {
 		kind: "committed_ed25519_signer_package_v1",
 		materialActivation,
@@ -283,9 +283,6 @@ function parseCommittedEcdsaSignerPackageWireV1(raw) {
 function inspectRawObject(raw) {
 	return raw !== null && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
 }
-function sameBytes(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 function requireExactWireFields(record, keys, label) {
 	const expected = new Set(keys);
 	const actual = Object.keys(record);

package/dist/esm/shared-ts/src/device-linking/contracts.js

@@ -1,8 +1,23 @@
 //#region ../shared-ts/src/device-linking/contracts.ts
+function isLinkSessionTerminalFailureV1(state) {
+	switch (state.state) {
+		case "failed_before_commit":
+		case "cancelled":
+		case "expired": return true;
+		case "displaying_qr":
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning":
+		case "authority_pending_local_install":
+		case "active": return false;
+		default: return assertNeverLinkSessionStateV1(state);
+	}
+}
 function assertNeverLinkSessionStateV1(value) {
 	throw new Error(`[LinkSessionStateV1] unsupported state: ${String(value)}`);
 }
 //#endregion
-export { assertNeverLinkSessionStateV1 };
+export { assertNeverLinkSessionStateV1, isLinkSessionTerminalFailureV1 };
 
 //# sourceMappingURL=contracts.js.map

package/dist/esm/shared-ts/src/device-linking/delegatedActivationPlan.js

@@ -1,7 +1,7 @@
 import { parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
 import { rejectUnknownFields } from "../utils/exactRecord.js";
-import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
+import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u, requireParsed } from "../passkey-custody/primitives.js";
 //#region ../shared-ts/src/device-linking/delegatedActivationPlan.ts
 const MANIFEST_FIELDS = [
 	"kind",
@@ -124,10 +124,6 @@ function exactRecord(raw, fields, label) {
 	for (const field of fields) if (!(field in record)) throw new Error(`${label}.${field} is required`);
 	return record;
 }
-function requireParsed(parsed, label) {
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
-}
 //#endregion
 export { buildExactAdministeredSignerManifestV1, parseExactAdministeredSignerManifestV1 };
 

package/dist/esm/shared-ts/src/device-linking/digests.js

@@ -10,13 +10,6 @@ const TARGET_PREPARATION_DOMAIN = "seams/linked-device/target-preparation/v1";
 const TARGET_PASSKEY_CONFIGURATION_DOMAIN = "seams/linked-device/passkey-target-configuration/v1";
 const LOCAL_AUTHORITY_INSTALLATION_RECEIPT_DOMAIN = "seams/linked-device/local-authority-installation-receipt/v1";
 const TEXT_ENCODER = new TextEncoder();
-/**
-* The server stores this digest alongside the authorization. Hashing the
-* opaque token directly keeps the browser binding identical to that row.
-*/
-async function computeWalletSessionOperationCredentialDigestB64u(credential) {
-	return sha256Utf8DigestB64u(credential.token);
-}
 function encodeWalletSessionInstallationReceiptV1(receipt) {
 	return alphabetizeStringify({
 		domain: LOCAL_AUTHORITY_INSTALLATION_RECEIPT_DOMAIN,
@@ -213,6 +206,6 @@ async function assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV
 	}
 }
 //#endregion
-export { assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1, computeLinkedDeviceApprovalDigestV1, computeLinkedDevicePasskeyTargetConfigurationDigestV1, computeLinkedDeviceSessionClaimDigestV1, computeLinkedDeviceTargetPreparationDigestV1, computeWalletSessionInstallationReceiptDigestB64u, computeWalletSessionOperationCredentialDigestB64u };
+export { assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1, computeLinkedDeviceApprovalDigestV1, computeLinkedDevicePasskeyTargetConfigurationDigestV1, computeLinkedDeviceSessionClaimDigestV1, computeLinkedDeviceTargetPreparationDigestV1, computeWalletSessionInstallationReceiptDigestB64u };
 
 //# sourceMappingURL=digests.js.map

package/dist/esm/shared-ts/src/device-linking/ed25519ExportRoot.js

@@ -2,7 +2,7 @@ import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDev
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { requireRecord } from "../utils/validation.js";
 import { rejectUnknownFields } from "../utils/exactRecord.js";
-import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u } from "../passkey-custody/primitives.js";
+import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, requireParsed } from "../passkey-custody/primitives.js";
 //#region ../shared-ts/src/device-linking/ed25519ExportRoot.ts
 /**
 * Authenticated relay records for the cross-device Ed25519 Yao Client export
@@ -71,11 +71,11 @@ function parseLinkedDeviceEd25519ExportRootRecipientV1(raw) {
 	requireTransferAlg(record.transferAlg, "LinkedDeviceEd25519ExportRootRecipientV1.transferAlg");
 	return {
 		kind: "linked_device_ed25519_export_root_recipient_v1",
-		linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId"),
-		walletId: parseRequired(parseWalletId(record.walletId), "walletId"),
-		walletKeyId: parseRequired(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
-		enrollmentId: parseRequired(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
-		deviceId: parseRequired(parseLinkedDeviceId(record.deviceId), "deviceId"),
+		linkSessionId: requireParsed(parseLinkDeviceSessionId(record.linkSessionId), "LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId"),
+		walletId: requireParsed(parseWalletId(record.walletId), "walletId"),
+		walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
+		enrollmentId: requireParsed(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
+		deviceId: requireParsed(parseLinkedDeviceId(record.deviceId), "deviceId"),
 		transferAlg: LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1,
 		applicationBindingDigestB64u: parseDigestField(record.applicationBindingDigestB64u, "applicationBindingDigestB64u"),
 		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "registeredPublicKeyB64u"),
@@ -94,11 +94,11 @@ function parseLinkedDeviceEd25519ExportRootPackageV1(raw) {
 	if (recipientPublicKeyB64u === ephemeralPublicKeyB64u) throw new Error("ephemeralPublicKeyB64u repeats the recipient key");
 	return {
 		kind: "linked_device_ed25519_export_root_package_v1",
-		linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
-		walletId: parseRequired(parseWalletId(record.walletId), "walletId"),
-		walletKeyId: parseRequired(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
-		enrollmentId: parseRequired(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
-		deviceId: parseRequired(parseLinkedDeviceId(record.deviceId), "deviceId"),
+		linkSessionId: requireParsed(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
+		walletId: requireParsed(parseWalletId(record.walletId), "walletId"),
+		walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
+		enrollmentId: requireParsed(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
+		deviceId: requireParsed(parseLinkedDeviceId(record.deviceId), "deviceId"),
 		transferAlg: LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1,
 		applicationBindingDigestB64u: parseDigestField(record.applicationBindingDigestB64u, "applicationBindingDigestB64u"),
 		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "registeredPublicKeyB64u"),
@@ -118,7 +118,7 @@ function parseLinkedDeviceEd25519ExportRootSubmissionV1(raw) {
 	if (record.kind !== "linked_device_ed25519_export_root_submission_v1") throw new Error("LinkedDeviceEd25519ExportRootSubmissionV1.kind is invalid");
 	return {
 		kind: "linked_device_ed25519_export_root_submission_v1",
-		linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
+		linkSessionId: requireParsed(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
 		package: parseLinkedDeviceEd25519ExportRootPackageV1(record.package)
 	};
 }
@@ -150,10 +150,6 @@ function parseUnixMs(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive unix-millisecond timestamp`);
 	return value;
 }
-function parseRequired(parsed, label) {
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
-}
 //#endregion
 export { LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1, linkedDeviceEd25519ExportRootMatchesRecipientV1, parseLinkedDeviceEd25519ExportRootPackageV1, parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u, parseLinkedDeviceEd25519ExportRootRecipientV1, parseLinkedDeviceEd25519ExportRootSubmissionV1 };
 

package/dist/esm/shared-ts/src/device-linking/sourceContribution.js

@@ -5,7 +5,7 @@ import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { requireRecordCopy } from "../utils/validation.js";
 import { parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../utils/routerAbNormalSigningIdentity.js";
-import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1 } from "../utils/routerAbEd25519Yao.js";
+import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, sameRouterAbEd25519YaoByteSequence } from "../utils/routerAbEd25519Yao.js";
 import { parseSdkEcdsaDerivationThresholdKeyId } from "../threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { requireRouterAbEcdsaDerivationNormalSigningStateV1 } from "../utils/routerAbEcdsaDerivation.js";
 //#region ../shared-ts/src/device-linking/sourceContribution.ts
@@ -33,7 +33,7 @@ function parseLinkedDeviceEd25519SourcePreservingReservationV1(raw) {
 	const participantIds = parseRouterAbEd25519YaoParticipantIdsV1(record.participant_ids);
 	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a");
 	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b");
-	if (!sameBytes(activationReceipt.transcript, deriverA.transcript) || !sameBytes(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 reservation packages have mismatched transcripts");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 reservation packages have mismatched transcripts");
 	return {
 		state: "inactive",
 		reservationId: requireText(record.reservation_id, "reservation_id"),
@@ -207,10 +207,10 @@ function parseEd25519Contribution(record) {
 	if (!sameEdStableIdentity(sourceBinding, targetBinding)) throw new Error("linked-device Ed25519 source contribution stable identity differs");
 	if (!mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(activationReceipt.material_activation), targetMaterialActivation)) throw new Error("linked-device Ed25519 source contribution receipt activation differs");
 	const sourceRegisteredPublicKeyB64u = parseEd25519PublicKeyB64u(record.sourceRegisteredPublicKeyB64u, "sourceRegisteredPublicKeyB64u");
-	if (!sameBytes(activationReceipt.registered_public_key, Array.from(base64UrlDecode(sourceRegisteredPublicKeyB64u)))) throw new Error("linked-device Ed25519 source contribution receipt public key differs");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.registered_public_key, Array.from(base64UrlDecode(sourceRegisteredPublicKeyB64u)))) throw new Error("linked-device Ed25519 source contribution receipt public key differs");
 	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a");
 	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b");
-	if (!sameBytes(activationReceipt.transcript, deriverA.transcript) || !sameBytes(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 source contribution package transcript differs");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 source contribution package transcript differs");
 	if (sourceBinding.material_activation.activation_id === targetMaterialActivation.activationId) throw new Error("linked-device Ed25519 source contribution reuses the source activation");
 	return {
 		kind: "linked_device_ed25519_source_contribution_v1",
@@ -537,9 +537,6 @@ function parseFixedBase64(raw, byteLength, label) {
 	if (decoded.length !== byteLength || base64UrlEncode(decoded) !== raw) throw new Error(`${label} must decode to ${byteLength} bytes`);
 	return raw;
 }
-function sameBytes(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 function requireText(raw, label) {
 	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw || [...raw].some((character) => {
 		const code = character.charCodeAt(0);
@@ -555,6 +552,6 @@ function exactRecord(raw, keys, label) {
 	return record;
 }
 //#endregion
-export { assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1, parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourceContributionBindingV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceContributionPreparationV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1, parseLinkedDeviceEd25519SourcePreservingReservationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionV1 };
+export { assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1, parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourceContributionBindingV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceContributionPreparationV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1, parseLinkedDeviceEd25519SourcePreservingReservationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionV1, sameEcdsaSourceSigner, sameEcdsaTarget };
 
 //# sourceMappingURL=sourceContribution.js.map

package/dist/esm/shared-ts/src/near/actions.js

@@ -1,4 +1,3 @@
-import "../utils/validation.js";
 //#region ../shared-ts/src/near/actions.ts
 let ActionType = /* @__PURE__ */ function(ActionType) {
 	ActionType["CreateAccount"] = "CreateAccount";

package/dist/esm/shared-ts/src/near/nearClient.js

@@ -7,10 +7,8 @@ import { decodeNearAccessKeyList, decodeNearAccessKeyView, decodeNearAccountView
 //#region ../shared-ts/src/near/nearClient.ts
 var RpcCallType = /* @__PURE__ */ function(RpcCallType) {
 	RpcCallType["Query"] = "query";
-	RpcCallType["View"] = "view";
 	RpcCallType["Send"] = "send_tx";
 	RpcCallType["Block"] = "block";
-	RpcCallType["Call"] = "call_function";
 	return RpcCallType;
 }(RpcCallType || {});
 const DEFAULT_SEND_WAIT_UNTIL = "EXECUTED_OPTIMISTIC";

package/dist/esm/shared-ts/src/passkey-custody/primitives.js

@@ -13,6 +13,10 @@ function requireCanonicalBase64Url(value, label) {
 	if (base64UrlEncode(decoded) !== value) throw new Error(`${label} must be canonical base64url`);
 	return decoded;
 }
+function requireParsed(result, label) {
+	if (result.ok) return result.value;
+	throw new Error(`${label} ${result.error.message}`);
+}
 function parseDigestField(value, label) {
 	try {
 		return parseDigestB64u(value);
@@ -53,6 +57,6 @@ function parseUnixMs(value, label) {
 	return value;
 }
 //#endregion
-export { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs };
+export { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs, requireParsed };
 
 //# sourceMappingURL=primitives.js.map

package/dist/esm/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js

@@ -44,6 +44,6 @@ function deriveEvmFamilySigningKeySlotId(input) {
 	].join(":"));
 }
 //#endregion
-export { deriveEvmFamilySigningKeySlotId, parseEvmFamilySigningKeySlotId, requireEvmFamilySigningKeySlotId };
+export { deriveEvmFamilySigningKeySlotId, requireEvmFamilySigningKeySlotId };
 
 //# sourceMappingURL=evmFamilySigningKeySlotId.js.map

package/dist/esm/shared-ts/src/signing-lanes/index.js

@@ -1,11 +1,6 @@
 import "../utils/domainIds.js";
 import "./evmFamilySigningKeySlotId.js";
 import "./participants.js";
-import "./rotationParsers.js";
-import "./rotation.js";
 import "./participantDigest.js";
-import "./ownerContinuity.js";
-import "./rotationDigests.js";
-import "./rotationProtocolParsers.js";
-import "./rotationLifecycle.js";
 import "./execution.js";
+import "./ownerContinuity.js";

package/dist/esm/shared-ts/src/signing-lanes/ownerContinuity.js

@@ -3,7 +3,7 @@ import { base64UrlEncode } from "../utils/base64.js";
 import { sha256Bytes } from "../utils/digests.js";
 import { requireRecord } from "../utils/validation.js";
 import { rejectUnknownFields } from "../utils/exactRecord.js";
-import { parseDigestField } from "../passkey-custody/primitives.js";
+import { parseDigestField, requireParsed } from "../passkey-custody/primitives.js";
 import { concat } from "../utils/digestEncoding.js";
 import { parseLaneParticipantBindingDigestB64u } from "./participants.js";
 import { encodeLaneCanonicalDigestV1, encodeLaneCanonicalTextV1, encodeLaneCanonicalU64V1 } from "./participantDigest.js";
@@ -17,10 +17,6 @@ const OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
 	"custodyKeyManifestDigestB64u",
 	"sourceIdentityDigestB64u"
 ];
-function requireResult(result, label) {
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
 /** Parse the owner signer identity without widening it into a generic string. */
 function parseWalletSignerId(raw, label = "walletSignerId") {
 	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
@@ -46,7 +42,7 @@ function buildOwnerLaneParticipantContinuityV1(args) {
 		kind: "owner_lane_participant_continuity_v1",
 		signerId: parseWalletSignerId(args.signerId),
 		participantIds,
-		signingWorkerId: requireResult(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
+		signingWorkerId: requireParsed(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
 		custodyKeyManifestDigestB64u: parseDigestField(args.custodyKeyManifestDigestB64u, "custodyKeyManifestDigestB64u"),
 		sourceIdentityDigestB64u: parseDigestField(args.sourceIdentityDigestB64u, "sourceIdentityDigestB64u")
 	};
@@ -58,7 +54,7 @@ function parseOwnerLaneParticipantContinuityV1(raw, label = "ownerParticipantCon
 	return buildOwnerLaneParticipantContinuityV1({
 		signerId: parseWalletSignerId(record.signerId, `${label}.signerId`),
 		participantIds: parseParticipantIds(record.participantIds, `${label}.participantIds`),
-		signingWorkerId: requireResult(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
+		signingWorkerId: requireParsed(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
 		custodyKeyManifestDigestB64u: parseDigestField(record.custodyKeyManifestDigestB64u, `${label}.custodyKeyManifestDigestB64u`),
 		sourceIdentityDigestB64u: parseDigestField(record.sourceIdentityDigestB64u, `${label}.sourceIdentityDigestB64u`)
 	});
@@ -76,9 +72,9 @@ function ownerLaneParticipantContinuityCanonicalBytesV1(input) {
 	]);
 }
 async function computeOwnerLaneParticipantBindingDigestV1(input) {
-	return requireResult(parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(ownerLaneParticipantContinuityCanonicalBytesV1(input)))), "owner participant digest");
+	return requireParsed(parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(ownerLaneParticipantContinuityCanonicalBytesV1(input)))), "owner participant digest");
 }
 //#endregion
-export { buildOwnerLaneParticipantContinuityV1, computeOwnerLaneParticipantBindingDigestV1, ownerLaneParticipantContinuityCanonicalBytesV1, parseOwnerLaneParticipantContinuityV1, parseWalletSignerId };
+export { buildOwnerLaneParticipantContinuityV1, computeOwnerLaneParticipantBindingDigestV1, parseOwnerLaneParticipantContinuityV1, parseWalletSignerId };
 
 //# sourceMappingURL=ownerContinuity.js.map

package/dist/esm/shared-ts/src/signing-lanes/participantDigest.js

@@ -1,19 +1,7 @@
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { sha256Bytes } from "../utils/digests.js";
+import { base64UrlDecode } from "../utils/base64.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { concat } from "../utils/digestEncoding.js";
-import { buildSigningWorkerParticipantRecordV1, parseLaneHolderParticipantRecordV1, parseLaneParticipantBindingDigestB64u, parseSigningWorkerParticipantRecordV1 } from "./participants.js";
 //#region ../shared-ts/src/signing-lanes/participantDigest.ts
-/** Domain tags are part of the wire contract and must never be shortened. */
-const LANE_HOLDER_PARTICIPANT_BINDING_DOMAIN_V1 = "seams/rotatable-signing-lanes/lane-holder-participant/v1";
-const SIGNING_WORKER_PARTICIPANT_BINDING_DOMAIN_V1 = "seams/rotatable-signing-lanes/signing-worker-participant/v1";
-/** The lane digest binds the fixed holder-then-SigningWorker participant set. */
-const LANE_PARTICIPANT_SET_BINDING_DOMAIN_V1 = "seams/rotatable-signing-lanes/lane-participant-set/v1";
-function placeholderParticipantDigest() {
-	const parsed = parseLaneParticipantBindingDigestB64u(base64UrlEncode(new Uint8Array(32)));
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
 function u32(value) {
 	if (!Number.isInteger(value) || value < 0 || value > 4294967295) throw new Error("canonical u32 must be an integer between 0 and 4294967295");
 	return new Uint8Array([
@@ -42,74 +30,7 @@ function encodeLaneCanonicalU64V1(value) {
 	for (let shift = 56; shift >= 0; shift -= 8) output[7 - shift / 8] = Number(remaining >> BigInt(shift) & 255n);
 	return output;
 }
-/** Nonempty array count encoding used by enrollment and receipt records. */
-function encodeLaneCanonicalNonEmptyCountV1(count) {
-	if (!Number.isInteger(count) || count < 1 || count > 4294967295) throw new Error("canonical array count must be a nonempty u32");
-	return u32(count);
-}
-function laneHolderParticipantCanonicalBytesV1(input) {
-	const record = parseLaneHolderParticipantRecordV1(input);
-	return concat([
-		encodeLaneCanonicalTextV1(LANE_HOLDER_PARTICIPANT_BINDING_DOMAIN_V1),
-		encodeLaneCanonicalTextV1(record.participantId),
-		encodeLaneCanonicalTextV1(record.custodyBindingId),
-		encodeLaneCanonicalDigestV1(record.custodyBindingDigestB64u),
-		encodeLaneCanonicalTextV1(record.hpkePublicKeyB64u),
-		encodeLaneCanonicalDigestV1(record.hpkePublicKeyDigestB64u)
-	]);
-}
-function signingWorkerParticipantCanonicalBytesV1(input) {
-	const record = parseSigningWorkerParticipantRecordV1(input);
-	return concat([
-		encodeLaneCanonicalTextV1(SIGNING_WORKER_PARTICIPANT_BINDING_DOMAIN_V1),
-		encodeLaneCanonicalTextV1(record.participantId),
-		encodeLaneCanonicalTextV1(record.recipientKeyId),
-		encodeLaneCanonicalTextV1(record.hpkePublicKeyB64u),
-		encodeLaneCanonicalDigestV1(record.hpkePublicKeyDigestB64u)
-	]);
-}
-function encodeCanonicalBytes(value) {
-	return concat([u32(value.length), value]);
-}
-/**
-* Canonical bytes for the lane's complete participant set. The order is part
-* of the protocol: holder first, SigningWorker second. Individual participant
-* binding digests are included after their canonical identity bytes so a
-* verified record cannot be substituted while retaining the same identities.
-*/
-function laneParticipantSetCanonicalBytesV1(input) {
-	const holderParticipant = parseLaneHolderParticipantRecordV1(input.holderParticipant);
-	const signingWorkerParticipant = parseSigningWorkerParticipantRecordV1(input.signingWorkerParticipant);
-	return concat([
-		encodeLaneCanonicalTextV1(LANE_PARTICIPANT_SET_BINDING_DOMAIN_V1),
-		encodeLaneCanonicalNonEmptyCountV1(2),
-		encodeLaneCanonicalTextV1("holder"),
-		encodeCanonicalBytes(laneHolderParticipantCanonicalBytesV1(holderParticipant)),
-		encodeLaneCanonicalDigestV1(holderParticipant.participantBindingDigestB64u),
-		encodeLaneCanonicalTextV1("signing_worker"),
-		encodeCanonicalBytes(signingWorkerParticipantCanonicalBytesV1(signingWorkerParticipant)),
-		encodeLaneCanonicalDigestV1(signingWorkerParticipant.participantBindingDigestB64u)
-	]);
-}
-async function digestCanonicalBytes(bytes) {
-	const parsed = parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(bytes)));
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-async function computeLaneParticipantSetBindingDigestV1(input) {
-	return await digestCanonicalBytes(laneParticipantSetCanonicalBytesV1(input));
-}
-async function buildSigningWorkerParticipantRecordWithDigestV1(input) {
-	const draft = buildSigningWorkerParticipantRecordV1({
-		...input,
-		participantBindingDigestB64u: placeholderParticipantDigest()
-	});
-	return buildSigningWorkerParticipantRecordV1({
-		...input,
-		participantBindingDigestB64u: await digestCanonicalBytes(signingWorkerParticipantCanonicalBytesV1(draft))
-	});
-}
 //#endregion
-export { buildSigningWorkerParticipantRecordWithDigestV1, computeLaneParticipantSetBindingDigestV1, encodeLaneCanonicalDigestV1, encodeLaneCanonicalTextV1, encodeLaneCanonicalU64V1 };
+export { encodeLaneCanonicalDigestV1, encodeLaneCanonicalTextV1, encodeLaneCanonicalU64V1 };
 
 //# sourceMappingURL=participantDigest.js.map