@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/shared-ts/src/signing-lanes/participants.js

@@ -1,7 +1,4 @@
-import { hasWhitespaceOrControlCharacters } from "../utils/domainIds.js";
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { requireRecord } from "../utils/validation.js";
 //#region ../shared-ts/src/signing-lanes/participants.ts
 function missing(field) {
 	return {
@@ -15,55 +12,6 @@ function invalid(field, reason) {
 		message: `${field} ${reason}`
 	};
 }
-function parseIdentityId(raw, field) {
-	if (raw === void 0 || raw === null) return {
-		ok: false,
-		error: missing(field)
-	};
-	if (typeof raw !== "string") return {
-		ok: false,
-		error: invalid(field, "must be a string")
-	};
-	const value = raw.trim();
-	if (!value) return {
-		ok: false,
-		error: missing(field)
-	};
-	if (hasWhitespaceOrControlCharacters(value)) return {
-		ok: false,
-		error: invalid(field, "must not contain whitespace or control characters")
-	};
-	return {
-		ok: true,
-		value
-	};
-}
-function parseHpkePublicKey(raw, field) {
-	if (raw === void 0 || raw === null) return {
-		ok: false,
-		error: missing(field)
-	};
-	if (typeof raw !== "string" || raw.length === 0) return {
-		ok: false,
-		error: invalid(field, "must be non-empty base64url")
-	};
-	try {
-		const bytes = base64UrlDecode(raw);
-		if (bytes.length === 0 || base64UrlEncode(bytes) !== raw) return {
-			ok: false,
-			error: invalid(field, "must be canonical unpadded base64url")
-		};
-	} catch {
-		return {
-			ok: false,
-			error: invalid(field, "must be canonical unpadded base64url")
-		};
-	}
-	return {
-		ok: true,
-		value: raw
-	};
-}
 function parseDigest(raw, field, brand) {
 	if (raw === void 0 || raw === null) return {
 		ok: false,
@@ -81,179 +29,13 @@ function parseDigest(raw, field, brand) {
 		};
 	}
 }
-function brandLaneCustodyDigest(value) {
-	return value;
-}
-function brandRecipientDigest(value) {
-	return value;
-}
 function brandParticipantDigest(value) {
 	return value;
 }
-function rejectUnknownFields(record, fields, label) {
-	const allowed = new Set(fields);
-	for (const field of Object.keys(record)) if (!allowed.has(field)) throw new Error(`${label}.${field} is not supported`);
-	for (const field of fields) if (!(field in record)) throw new Error(`${label}.${field} is required`);
-}
-function parseLaneHolderParticipantId(raw) {
-	return parseIdentityId(raw, "laneHolderParticipantId");
-}
-function parseSigningWorkerParticipantId(raw) {
-	return parseIdentityId(raw, "signingWorkerParticipantId");
-}
-function parseSigningWorkerRecipientKeyId(raw) {
-	return parseIdentityId(raw, "signingWorkerRecipientKeyId");
-}
-function parseLaneHolderCustodyBindingId(raw) {
-	return parseIdentityId(raw, "laneHolderCustodyBindingId");
-}
-function parseHpkePublicKeyB64u(raw) {
-	return parseHpkePublicKey(raw, "hpkePublicKeyB64u");
-}
 function parseLaneParticipantBindingDigestB64u(raw) {
 	return parseDigest(raw, "participantBindingDigestB64u", brandParticipantDigest);
 }
-function parseLaneCustodyBindingDigestB64u(raw) {
-	return parseDigest(raw, "custodyBindingDigestB64u", brandLaneCustodyDigest);
-}
-function parseSigningWorkerRecipientKeyDigestB64u(raw) {
-	return parseDigest(raw, "hpkePublicKeyDigestB64u", brandRecipientDigest);
-}
-function buildLaneHolderCustodyIdentityV1(args) {
-	return {
-		kind: "lane_holder_custody_identity_v1",
-		custodyBindingId: args.custodyBindingId,
-		custodyBindingDigestB64u: args.custodyBindingDigestB64u
-	};
-}
-function buildSigningWorkerRecipientIdentityV1(args) {
-	return {
-		kind: "signing_worker_recipient_identity_v1",
-		recipientKeyId: args.recipientKeyId,
-		hpkePublicKeyB64u: args.hpkePublicKeyB64u,
-		hpkePublicKeyDigestB64u: args.hpkePublicKeyDigestB64u
-	};
-}
-function parseLaneHolderCustodyIdentityV1(raw, label = "laneHolderCustodyIdentity") {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, [
-		"kind",
-		"custodyBindingId",
-		"custodyBindingDigestB64u"
-	], label);
-	if (record.kind !== "lane_holder_custody_identity_v1") throw new Error(`${label}.kind is invalid`);
-	const custodyBindingId = parseLaneHolderCustodyBindingId(record.custodyBindingId);
-	if (!custodyBindingId.ok) throw new Error(`${label}.${custodyBindingId.error.message}`);
-	const custodyBindingDigestB64u = parseLaneCustodyBindingDigestB64u(record.custodyBindingDigestB64u);
-	if (!custodyBindingDigestB64u.ok) throw new Error(`${label}.${custodyBindingDigestB64u.error.message}`);
-	return buildLaneHolderCustodyIdentityV1({
-		custodyBindingId: custodyBindingId.value,
-		custodyBindingDigestB64u: custodyBindingDigestB64u.value
-	});
-}
-function parseSigningWorkerRecipientIdentityV1(raw, label = "signingWorkerRecipientIdentity") {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, [
-		"kind",
-		"recipientKeyId",
-		"hpkePublicKeyB64u",
-		"hpkePublicKeyDigestB64u"
-	], label);
-	if (record.kind !== "signing_worker_recipient_identity_v1") throw new Error(`${label}.kind is invalid`);
-	const recipientKeyId = parseSigningWorkerRecipientKeyId(record.recipientKeyId);
-	if (!recipientKeyId.ok) throw new Error(`${label}.${recipientKeyId.error.message}`);
-	const hpkePublicKeyB64u = parseHpkePublicKey(record.hpkePublicKeyB64u, `${label}.hpkePublicKeyB64u`);
-	if (!hpkePublicKeyB64u.ok) throw new Error(hpkePublicKeyB64u.error.message);
-	const hpkePublicKeyDigestB64u = parseSigningWorkerRecipientKeyDigestB64u(record.hpkePublicKeyDigestB64u);
-	if (!hpkePublicKeyDigestB64u.ok) throw new Error(`${label}.${hpkePublicKeyDigestB64u.error.message}`);
-	return buildSigningWorkerRecipientIdentityV1({
-		recipientKeyId: recipientKeyId.value,
-		hpkePublicKeyB64u: hpkePublicKeyB64u.value,
-		hpkePublicKeyDigestB64u: hpkePublicKeyDigestB64u.value
-	});
-}
-function buildLaneHolderParticipantRecordV1(args) {
-	return {
-		kind: "lane_holder_participant_v1",
-		participantId: args.participantId,
-		custodyBindingId: args.custody.custodyBindingId,
-		custodyBindingDigestB64u: args.custody.custodyBindingDigestB64u,
-		hpkePublicKeyB64u: args.hpkePublicKeyB64u,
-		hpkePublicKeyDigestB64u: args.hpkePublicKeyDigestB64u,
-		participantBindingDigestB64u: args.participantBindingDigestB64u
-	};
-}
-function buildSigningWorkerParticipantRecordV1(args) {
-	return {
-		kind: "signing_worker_participant_v1",
-		participantId: args.participantId,
-		recipientKeyId: args.recipient.recipientKeyId,
-		hpkePublicKeyB64u: args.recipient.hpkePublicKeyB64u,
-		hpkePublicKeyDigestB64u: args.recipient.hpkePublicKeyDigestB64u,
-		participantBindingDigestB64u: args.participantBindingDigestB64u
-	};
-}
-function parseLaneHolderParticipantRecordV1(raw, label = "laneHolderParticipant") {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, [
-		"kind",
-		"participantId",
-		"custodyBindingId",
-		"custodyBindingDigestB64u",
-		"hpkePublicKeyB64u",
-		"hpkePublicKeyDigestB64u",
-		"participantBindingDigestB64u"
-	], label);
-	if (record.kind !== "lane_holder_participant_v1") throw new Error(`${label}.kind is invalid`);
-	const participantId = parseLaneHolderParticipantId(record.participantId);
-	if (!participantId.ok) throw new Error(`${label}.${participantId.error.message}`);
-	const custody = parseLaneHolderCustodyIdentityV1({
-		kind: "lane_holder_custody_identity_v1",
-		custodyBindingId: record.custodyBindingId,
-		custodyBindingDigestB64u: record.custodyBindingDigestB64u
-	}, `${label}.custody`);
-	const hpkePublicKeyB64u = parseHpkePublicKey(record.hpkePublicKeyB64u, `${label}.hpkePublicKeyB64u`);
-	if (!hpkePublicKeyB64u.ok) throw new Error(hpkePublicKeyB64u.error.message);
-	const hpkePublicKeyDigestB64u = parseSigningWorkerRecipientKeyDigestB64u(record.hpkePublicKeyDigestB64u);
-	if (!hpkePublicKeyDigestB64u.ok) throw new Error(`${label}.${hpkePublicKeyDigestB64u.error.message}`);
-	const participantBindingDigestB64u = parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u);
-	if (!participantBindingDigestB64u.ok) throw new Error(`${label}.${participantBindingDigestB64u.error.message}`);
-	return buildLaneHolderParticipantRecordV1({
-		participantId: participantId.value,
-		custody,
-		hpkePublicKeyB64u: hpkePublicKeyB64u.value,
-		hpkePublicKeyDigestB64u: hpkePublicKeyDigestB64u.value,
-		participantBindingDigestB64u: participantBindingDigestB64u.value
-	});
-}
-function parseSigningWorkerParticipantRecordV1(raw, label = "signingWorkerParticipant") {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, [
-		"kind",
-		"participantId",
-		"recipientKeyId",
-		"hpkePublicKeyB64u",
-		"hpkePublicKeyDigestB64u",
-		"participantBindingDigestB64u"
-	], label);
-	if (record.kind !== "signing_worker_participant_v1") throw new Error(`${label}.kind is invalid`);
-	const participantId = parseSigningWorkerParticipantId(record.participantId);
-	if (!participantId.ok) throw new Error(`${label}.${participantId.error.message}`);
-	const recipient = parseSigningWorkerRecipientIdentityV1({
-		kind: "signing_worker_recipient_identity_v1",
-		recipientKeyId: record.recipientKeyId,
-		hpkePublicKeyB64u: record.hpkePublicKeyB64u,
-		hpkePublicKeyDigestB64u: record.hpkePublicKeyDigestB64u
-	}, `${label}.recipient`);
-	const participantBindingDigestB64u = parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u);
-	if (!participantBindingDigestB64u.ok) throw new Error(`${label}.${participantBindingDigestB64u.error.message}`);
-	return buildSigningWorkerParticipantRecordV1({
-		participantId: participantId.value,
-		recipient,
-		participantBindingDigestB64u: participantBindingDigestB64u.value
-	});
-}
 //#endregion
-export { buildLaneHolderParticipantRecordV1, buildSigningWorkerParticipantRecordV1, parseHpkePublicKeyB64u, parseLaneCustodyBindingDigestB64u, parseLaneHolderCustodyBindingId, parseLaneHolderParticipantId, parseLaneHolderParticipantRecordV1, parseLaneParticipantBindingDigestB64u, parseSigningWorkerParticipantId, parseSigningWorkerParticipantRecordV1, parseSigningWorkerRecipientKeyDigestB64u, parseSigningWorkerRecipientKeyId };
+export { parseLaneParticipantBindingDigestB64u };
 
 //# sourceMappingURL=participants.js.map

package/dist/esm/shared-ts/src/signing-lanes/recordParsers.js

@@ -1,8 +1,5 @@
 import { hasWhitespaceOrControlCharacters } from "../utils/domainIds.js";
-import "../utils/validation.js";
-import "../utils/exactRecord.js";
 import "../utils/registrationIds.js";
-import "./participants.js";
 import "./ownerContinuity.js";
 //#region ../shared-ts/src/signing-lanes/recordParsers.ts
 const WALLET_KEY_COMMON_FIELDS = [

package/dist/esm/shared-ts/src/tenant-root/tenantRootIdentifier.js

@@ -0,0 +1,12 @@
+//#region ../shared-ts/src/tenant-root/tenantRootIdentifier.ts
+function hasControlCharacters(value) {
+	for (const character of value) {
+		const codePoint = character.codePointAt(0) ?? 0;
+		if (codePoint <= 31 || codePoint >= 127 && codePoint <= 159) return true;
+	}
+	return false;
+}
+//#endregion
+export { hasControlCharacters };
+
+//# sourceMappingURL=tenantRootIdentifier.js.map

package/dist/esm/shared-ts/src/tenant-root/tenantRootIdentity.js

@@ -1,6 +1,6 @@
+import { hasControlCharacters } from "./tenantRootIdentifier.js";
 //#region ../shared-ts/src/tenant-root/tenantRootIdentity.ts
 const TENANT_ROOT_IDENTITY_DOMAIN_V1 = new TextEncoder().encode("seams/tenant-root-identity/v1");
-const TENANT_ROOT_IDENTITY_MAX_IDENTIFIER_BYTES_V1 = 256;
 /**
 * The identity proof is only emitted by the authenticated builder or exact
 * wire decoder. Its private method makes raw object literals structurally
@@ -49,13 +49,6 @@ function hasLeadingOrTrailingRustWhitespace(value) {
 	const codePoints = Array.from(value, (character) => character.codePointAt(0) ?? 0);
 	return codePoints.length > 0 && (isRustWhitespace(codePoints[0]) || isRustWhitespace(codePoints[codePoints.length - 1]));
 }
-function hasControlCharacters(value) {
-	for (const character of value) {
-		const codePoint = character.codePointAt(0) ?? 0;
-		if (codePoint <= 31 || codePoint >= 127 && codePoint <= 159) return true;
-	}
-	return false;
-}
 function hasUnpairedSurrogate(value) {
 	for (let index = 0; index < value.length; index += 1) {
 		const codeUnit = value.charCodeAt(index);
@@ -73,7 +66,7 @@ function isCanonicalTenantRootIdentityField(value) {
 	if (typeof value !== "string" || value.length === 0) return false;
 	if (hasLeadingOrTrailingRustWhitespace(value) || hasControlCharacters(value)) return false;
 	if (hasUnpairedSurrogate(value)) return false;
-	return new TextEncoder().encode(value).length <= TENANT_ROOT_IDENTITY_MAX_IDENTIFIER_BYTES_V1;
+	return new TextEncoder().encode(value).length <= 256;
 }
 /** Checks one already-resolved field without normalizing it. */
 function isTenantRootIdentityFieldCanonicalV1(field, value) {

package/dist/esm/shared-ts/src/tenant-root/tenantRootOperationRecord.js

@@ -1,5 +1,6 @@
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { alphabetizeStringify, sha256Bytes } from "../utils/digests.js";
+import { hasExactKeys } from "../utils/exactKeys.js";
 import { isTenantRootIdentityFieldCanonicalV1 } from "./tenantRootIdentity.js";
 //#region ../shared-ts/src/tenant-root/tenantRootOperationRecord.ts
 /**
@@ -7,8 +8,7 @@ import { isTenantRootIdentityFieldCanonicalV1 } from "./tenantRootIdentity.js";
 *
 * The console builds these records in TypeScript and the control plane
 * consumes their digests in Rust, so both sides must produce identical
-* canonical bytes. The encoding is pinned by the cross-runtime fixtures in
-* `crates/router-ab-core/tests/fixtures/tenant-root-operation`.
+* canonical bytes.
 *
 * A record is the unit of authorization: changing any field changes the
 * digest, so a capability minted for one record cannot be carried to another
@@ -126,10 +126,6 @@ const RESTORE_ROLE_IMPORT_KEY_RECORD_KEYS_V1 = [
 	"subject",
 	"tenantRootIdentityDigest"
 ];
-function hasExactKeys(record, keys) {
-	const actual = Object.keys(record);
-	return actual.length === keys.length && keys.every((key) => actual.includes(key));
-}
 function parseRestoreRoleImportKeyIssueRecord(raw) {
 	if (!hasExactKeys(raw, RESTORE_ROLE_IMPORT_KEY_RECORD_KEYS_V1)) return null;
 	if (raw.formatVersion !== TENANT_ROOT_OPERATION_RECORD_FORMAT_V1) return null;

package/dist/esm/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js

@@ -1,6 +1,5 @@
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { alphabetizeStringify, sha256Bytes, sha256BytesUtf8 } from "../utils/digests.js";
-import "../utils/encoders.js";
 import { deriveEvmFamilySigningKeySlotId } from "../signing-lanes/evmFamilySigningKeySlotId.js";
 //#region ../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.ts
 const THRESHOLD_SECP256K1_ECDSA_2P_V1_SCHEME_ID = "threshold-secp256k1-ecdsa-2p-v1";

package/dist/esm/shared-ts/src/threshold/keyMaterialBrands.js

@@ -4,46 +4,25 @@ function parseNonEmptyBrand(value, label) {
 	if (!normalized) throw new Error(`${label} must be a non-empty string`);
 	return normalized;
 }
-function parseEcdsaDerivationKeyVersion(value) {
-	return parseNonEmptyBrand(value, "ECDSA DERIVATION key version");
-}
 function parseSigningSessionSealKeyVersion(value) {
 	return parseNonEmptyBrand(value, "signing-session seal key version");
 }
 function parseEcdsaClientVerifyingShareB64u(value) {
 	return parseNonEmptyBrand(value, "ECDSA client verifying share");
 }
-function parseEd25519RelayerKeyId(value) {
-	return parseNonEmptyBrand(value, "Ed25519 relayer key id");
-}
 function parseEcdsaRelayerKeyId(value) {
 	return parseNonEmptyBrand(value, "ECDSA relayer key id");
 }
 function parseEcdsaKeyHandle(value) {
 	return parseNonEmptyBrand(value, "ECDSA key handle");
 }
-function formatEcdsaDerivationKeyVersionForWire(value) {
-	return value;
-}
 function formatSigningSessionSealKeyVersionForWire(value) {
 	return value;
 }
-function formatEcdsaClientVerifyingShareB64uForWire(value) {
-	return value;
-}
-function formatEd25519RelayerKeyIdForWire(value) {
-	return value;
-}
-function formatEcdsaRelayerKeyIdForWire(value) {
-	return value;
-}
-function formatEcdsaThresholdKeyIdForWire(value) {
-	return value;
-}
 function formatEcdsaKeyHandleForWire(value) {
 	return value;
 }
 //#endregion
-export { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEd25519RelayerKeyId, parseNonEmptyBrand, parseSigningSessionSealKeyVersion };
+export { formatEcdsaKeyHandleForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseSigningSessionSealKeyVersion };
 
 //# sourceMappingURL=keyMaterialBrands.js.map

package/dist/esm/shared-ts/src/threshold/participants.js

@@ -1,4 +1,3 @@
-import "../utils/validation.js";
 const THRESHOLD_ED25519_2P_PARTICIPANT_IDS = [1, 2];
 function normalizeThresholdEd25519ParticipantId(id) {
 	const n = Number(id);

package/dist/esm/shared-ts/src/threshold/signingRootScope.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../utils/normalize.js";
-import "../utils/validation.js";
 //#region ../shared-ts/src/threshold/signingRootScope.ts
 function requireScopeField(label, value) {
 	const normalized = normalizeOptionalTrimmedString(value);

package/dist/esm/shared-ts/src/utils/addWalletAuthMethod.js

@@ -1,4 +1,3 @@
-import "../authorization/capabilityKinds.js";
 //#region ../shared-ts/src/utils/addWalletAuthMethod.ts
 function unreachableAuthMethodFamily(value) {
 	throw new Error(`Unhandled wallet auth-method family: ${String(value)}`);
@@ -12,21 +11,13 @@ function unreachableAuthMethodFamily(value) {
 * which is why the operation needs no same-family rejection of its own.
 */
 function admitAddWalletAuthMethod(input) {
-	const present = input.activeMethodsOnAuthority.find((method) => method.kind === input.targetFamily);
-	if (present) return {
+	if (input.activeMethodsOnAuthority.find((method) => method.kind === input.targetFamily)) return {
 		kind: "already_configured",
-		family: input.targetFamily,
-		existingWalletAuthMethodId: present.walletAuthMethodId
+		family: input.targetFamily
 	};
 	switch (input.sourceMethod.kind) {
-		case "passkey": return {
-			kind: "proceed",
-			branch: "passkey_to_email_otp"
-		};
-		case "email_otp": return {
-			kind: "proceed",
-			branch: "email_otp_to_passkey"
-		};
+		case "passkey": return { kind: "proceed" };
+		case "email_otp": return { kind: "proceed" };
 		default: return unreachableAuthMethodFamily(input.sourceMethod);
 	}
 }

package/dist/esm/shared-ts/src/utils/canonicalPrimitives.js

@@ -16,12 +16,6 @@ function parseDigestB64u(value) {
 	if (bytes.length !== 32 || base64UrlEncode(bytes) !== value) throw new Error("digest must be canonical base64url for 32 bytes");
 	return value;
 }
-function parseIsoTimestamp(value) {
-	if (typeof value !== "string") throw new Error("timestamp must be an ISO timestamp");
-	const timestampMs = Date.parse(value);
-	if (!Number.isFinite(timestampMs) || new Date(timestampMs).toISOString() !== value) throw new Error("timestamp must be canonical ISO-8601 UTC");
-	return value;
-}
 async function sha256DigestB64u(bytes) {
 	return parseDigestB64u(base64UrlEncode(await sha256Bytes(bytes)));
 }
@@ -29,6 +23,6 @@ async function sha256Utf8DigestB64u(text) {
 	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(text)));
 }
 //#endregion
-export { parseCorrelationId, parseDigestB64u, parseIsoTimestamp, sha256DigestB64u, sha256Utf8DigestB64u };
+export { parseCorrelationId, parseDigestB64u, sha256DigestB64u, sha256Utf8DigestB64u };
 
 //# sourceMappingURL=canonicalPrimitives.js.map

package/dist/esm/shared-ts/src/utils/domainIds.js

@@ -121,9 +121,6 @@ function parseChallengeSubjectId(raw) {
 function parseEmailOtpChallengeId(raw) {
 	return parseDomainId(raw, "emailOtpChallengeId");
 }
-function parseEmailOtpRegistrationAttemptId(raw) {
-	return parseDomainId(raw, "emailOtpRegistrationAttemptId");
-}
 function parseOrgId(raw) {
 	return parseDomainId(raw, "orgId");
 }
@@ -279,24 +276,12 @@ function parseLaneShareEpoch(raw) {
 function parseLinkedDeviceId(raw) {
 	return parseDomainId(raw, "linkedDeviceId");
 }
-function parseLaneOperationId(raw) {
-	return parseDomainId(raw, "laneOperationId");
-}
-function parseLaneEnrollmentId(raw) {
-	return parseDomainId(raw, "laneEnrollmentId");
-}
-function parseLaneOperationIdempotencyKey(raw) {
-	return parseDomainId(raw, "laneOperationIdempotencyKey");
-}
 function parseLinkedDeviceEnrollmentId(raw) {
 	return parseDomainId(raw, "linkedDeviceEnrollmentId");
 }
 function parseWalletRecoveryOperationId(raw) {
 	return parseDomainId(raw, "walletRecoveryOperationId");
 }
-function parseEd25519YaoSuiteId(raw) {
-	return parseDomainId(raw, "ed25519YaoSuiteId");
-}
 function parseEcdsaRelayerKeyId(raw) {
 	return parseDomainId(raw, "ecdsaRelayerKeyId");
 }
@@ -304,6 +289,6 @@ function parseLinkDeviceSessionId(raw) {
 	return parseDomainId(raw, "linkDeviceSessionId");
 }
 //#endregion
-export { buildMpcMaterialActivationRef, hasControlCharacter, hasWhitespaceOrControlCharacters, mpcMaterialActivationRefsEqual, parseChallengeSubjectId, parseEcdsaActiveStateId, parseEcdsaRelayerKeyId, parseEd25519YaoSuiteId, parseEmailOtpChallengeId, parseEmailOtpProviderUserId, parseEmailOtpRegistrationAttemptId, parseGoogleProviderSubject, parseLaneEnrollmentId, parseLaneOperationId, parseLaneOperationIdempotencyKey, parseLaneShareEpoch, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationId, parseMpcMaterialActivationRef, parseMpcSigningWorkerRef, parseOrgId, parsePasskeyEnvelopeId, parseProviderSubject, parseRootShareEpoch, parseSigningLaneId, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseThresholdSessionId, parseVerifiedEmailAddress, parseVerifiedGoogleEmail, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId };
+export { buildMpcMaterialActivationRef, hasControlCharacter, hasWhitespaceOrControlCharacters, mpcMaterialActivationRefsEqual, parseChallengeSubjectId, parseEcdsaActiveStateId, parseEcdsaRelayerKeyId, parseEmailOtpChallengeId, parseEmailOtpProviderUserId, parseGoogleProviderSubject, parseLaneShareEpoch, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationId, parseMpcMaterialActivationRef, parseMpcSigningWorkerRef, parseOrgId, parsePasskeyEnvelopeId, parseProviderSubject, parseRootShareEpoch, parseSigningLaneId, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseThresholdSessionId, parseVerifiedEmailAddress, parseVerifiedGoogleEmail, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId };
 
 //# sourceMappingURL=domainIds.js.map

package/dist/esm/shared-ts/src/utils/ecdsaCapabilityActivation.js

@@ -7,16 +7,6 @@ function parseNonEmptyString(value, label) {
 function parseEcdsaServerGeneration(value) {
 	return parseNonEmptyString(value, "ECDSA server generation");
 }
-function parseEcdsaCapabilityManifestId(value) {
-	return parseNonEmptyString(value, "ECDSA manifest id");
-}
-function parseEcdsaCapabilityManifestRevision(value) {
-	if (!Number.isSafeInteger(value) || Number(value) < 1) throw new Error("ECDSA manifest revision must be a positive safe integer");
-	return value;
-}
-function parseEcdsaLifecycleId(value) {
-	return parseNonEmptyString(value, "ECDSA lifecycle id");
-}
 function parseCanonicalEcdsaServerActivationRequest(value) {
 	if (typeof value !== "string" || value.trim() !== value) throw new Error("ECDSA server activation request must be canonical JSON");
 	let parsed;
@@ -29,6 +19,6 @@ function parseCanonicalEcdsaServerActivationRequest(value) {
 	return value;
 }
 //#endregion
-export { parseCanonicalEcdsaServerActivationRequest, parseEcdsaCapabilityManifestId, parseEcdsaCapabilityManifestRevision, parseEcdsaLifecycleId, parseEcdsaServerGeneration };
+export { parseCanonicalEcdsaServerActivationRequest, parseEcdsaServerGeneration };
 
 //# sourceMappingURL=ecdsaCapabilityActivation.js.map

package/dist/esm/shared-ts/src/utils/ecdsaKeyFactsInventory.js

@@ -1,10 +1,7 @@
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
-import "./encoders.js";
+import { thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
 //#region ../shared-ts/src/utils/ecdsaKeyFactsInventory.ts
-function chainTargetKey(target) {
-	return target.kind === "evm" ? `evm:eip155:${target.chainId}` : `tempo:${target.chainId}`;
-}
 function normalizeChainTarget(target) {
 	if (target.kind === "evm") return {
 		kind: "evm",
@@ -22,7 +19,7 @@ function canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input) {
 	const keyTargets = input.keyTargets.map((target) => ({
 		keyHandle: target.keyHandle,
 		chainTarget: normalizeChainTarget(target.chainTarget),
-		targetKey: chainTargetKey(target.chainTarget)
+		targetKey: thresholdEcdsaChainTargetKey(target.chainTarget)
 	})).sort((left, right) => {
 		const leftKey = `${left.keyHandle}:${left.targetKey}`;
 		const rightKey = `${right.keyHandle}:${right.targetKey}`;

package/dist/esm/shared-ts/src/utils/ecdsaServerTiming.js

@@ -5,7 +5,6 @@ const ECDSA_TIMING_METRICS = new Set([
 	"ecdsa_sign_proxy",
 	"ecdsa_sign_complete",
 	"ecdsa_sign_total",
-	"ecdsa_presign_queue",
 	"ecdsa_presign_authenticate",
 	"ecdsa_presign_material",
 	"ecdsa_presign_admit",

package/dist/esm/shared-ts/src/utils/emailOtpDomain.js

@@ -6,6 +6,8 @@ function emailOtpDeviceEnrollmentId(walletId, providerSubject) {
 	if (!normalizedWalletId || !normalizedProviderSubject) throw new Error("Email OTP enrollment identity requires wallet and provider subject");
 	return `email-otp-device-enrollment-v1:${normalizedWalletId}:${normalizedProviderSubject}`;
 }
+/** Domain label that opens the AAD binding a released Email OTP factor to its challenge. */
+const EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 = "seams/email-otp/factor-release/v1";
 const WALLET_UNLOCK_BACKENDS = ["passkey", EMAIL_OTP_CHANNEL];
 const WALLET_EMAIL_OTP_LOGIN_OPERATIONS = [
 	"wallet_unlock",
@@ -33,6 +35,6 @@ function isWalletEmailOtpLoginOperation(value) {
 	return WALLET_EMAIL_OTP_LOGIN_OPERATIONS.includes(value);
 }
 //#endregion
-export { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, emailOtpDeviceEnrollmentId, isWalletEmailOtpLoginOperation, isWalletUnlockBackend };
+export { EMAIL_OTP_CHANNEL, EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, emailOtpDeviceEnrollmentId, isWalletEmailOtpLoginOperation, isWalletUnlockBackend };
 
 //# sourceMappingURL=emailOtpDomain.js.map

package/dist/esm/shared-ts/src/utils/errors.js

@@ -1,4 +1,3 @@
-import "./near.js";
 //#region ../shared-ts/src/utils/errors.ts
 /**
 * Best-effort error message extractor without relying on `any`.
@@ -17,24 +16,7 @@ function b64uField(prefix) {
 	return `${prefix}B64u`;
 }
 b64uField("seed"), b64uField("canonicalSeed"), b64uField("xClientBase"), b64uField("clientOutputMask"), b64uField("clientRecoverableSecret"), b64uField("prfFirst"), b64uField("prfSecond"), b64uField("signingShare32"), b64uField("clientNonceHandle");
-/**
-* Normalize any thrown value into an Error instance.
-* - preserves message/name/stack when available
-* - best-effort copies optional code/details properties if present
-*/
-function toError(e) {
-	if (e instanceof Error) return e;
-	const err = new Error(errorMessage(e));
-	try {
-		const src = e;
-		if (typeof src?.name === "string") err.name = src.name;
-		if (typeof src?.stack === "string") err.stack = src.stack;
-		if (src && typeof src.code !== "undefined") err.code = src.code;
-		if (src && typeof src.details !== "undefined") err.details = src.details;
-	} catch {}
-	return err;
-}
 //#endregion
-export { errorMessage, toError };
+export { errorMessage };
 
 //# sourceMappingURL=errors.js.map

package/dist/esm/shared-ts/src/utils/exactKeys.js

@@ -0,0 +1,17 @@
+//#region ../shared-ts/src/utils/exactKeys.ts
+/**
+* True when `value` is a non-array object whose own enumerable string keys are exactly `keys`.
+*
+* A key whose value is `undefined` still counts as present. Symbol, non-enumerable and inherited
+* keys are not counted, and the prototype is not checked. A list that repeats a key never matches.
+* Kept apart from validation.ts, which the wallet iframe's boot path loads.
+*/
+function hasExactKeys(value, keys) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const actual = Object.keys(value);
+	return actual.length === keys.length && actual.every((key) => keys.includes(key));
+}
+//#endregion
+export { hasExactKeys };
+
+//# sourceMappingURL=exactKeys.js.map

package/dist/esm/shared-ts/src/utils/failure.js

@@ -0,0 +1,20 @@
+//#region ../shared-ts/src/utils/failure.ts
+function failure(code, message) {
+	return {
+		ok: false,
+		code,
+		message
+	};
+}
+function failedVerification(code, message) {
+	return {
+		ok: false,
+		verified: false,
+		code,
+		message
+	};
+}
+//#endregion
+export { failedVerification, failure };
+
+//# sourceMappingURL=failure.js.map

package/dist/esm/shared-ts/src/utils/near.js

@@ -94,6 +94,6 @@ function deriveImplicitNearAccountIdFromEd25519PublicKey(publicKey) {
 	return bytesToLowerHex(decoded);
 }
 //#endregion
-export { deriveImplicitNearAccountIdFromEd25519PublicKey, ensureEd25519Prefix, isValidAccountId, parseImplicitNearAccountId, parseNamedNearAccountId, parseNearAccountId };
+export { deriveImplicitNearAccountIdFromEd25519PublicKey, ensureEd25519Prefix, parseImplicitNearAccountId, parseNamedNearAccountId, parseNearAccountId };
 
 //# sourceMappingURL=near.js.map