@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/shared-ts/src/utils/registrationEstablishedSession.js

@@ -1,12 +1,12 @@
 import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseWalletId } from "./domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
-import { parseNearAccountId } from "./near.js";
 import { parseActiveWalletSessionV1 } from "../device-linking/activeWalletSession.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "./routerAbNormalSigningIdentity.js";
 import { normalizeRuntimePolicyScope } from "../threshold/signingRootScope.js";
 import { parseRouterAbEcdsaDerivationNormalSigningStateV1 } from "./routerAbEcdsaDerivation.js";
 import { parseRouterAbEd25519NormalSigningState } from "./signingSessionSeal.js";
 import { parseNearEd25519SigningKeyId } from "./registrationIds.js";
+import { parseNearAccountId } from "./near.js";
 import { parseThresholdEcdsaKeyHandle } from "./thresholdEcdsaKeyHandle.js";
 //#region ../shared-ts/src/utils/registrationEstablishedSession.ts
 function registrationSessionTokensMatchCapabilities(walletSession, tokens) {

package/dist/esm/shared-ts/src/utils/registrationIds.js

@@ -1,7 +1,6 @@
 import { parseEmailOtpProviderUserId, parseWalletId } from "./domainIds.js";
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
-import "./encoders.js";
 //#region ../shared-ts/src/utils/registrationIds.ts
 function walletIdFromString(value) {
 	const parsed = parseWalletId(value);
@@ -161,10 +160,7 @@ function parseServerAllocatedWalletId(raw) {
 	const suffix = match?.[3] || "";
 	if (!match || !SERVER_ALLOCATED_WALLET_ADJECTIVE_SET.has(adjective) || !SERVER_ALLOCATED_WALLET_NOUN_SET.has(noun) || !serverAllocatedWalletSuffixIsValid(suffix)) return {
 		ok: false,
-		error: {
-			code: "invalid",
-			message: "server-allocated walletId must match the approved readable word-word-suffix allocation format"
-		}
+		error: { message: "server-allocated walletId must match the approved readable word-word-suffix allocation format" }
 	};
 	return {
 		ok: true,

package/dist/esm/shared-ts/src/utils/registrationIntent.js

@@ -1,7 +1,6 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId } from "./domainIds.js";
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
-import "./encoders.js";
 import { inspectRawObject, trimString } from "./registrationAuthMethodInput.js";
 import "./registrationSignerPlan.js";
 //#region ../shared-ts/src/utils/registrationIntent.ts
@@ -14,23 +13,14 @@ function addAuthMethodIntentGrantFromString(value) {
 function addSignerIntentGrantFromString(value) {
 	return String(value || "").trim();
 }
-function serializeRegistrationIntentV1(intent) {
-	return alphabetizeStringify(intent);
-}
-function serializeAddSignerIntentV1(intent) {
-	return alphabetizeStringify(intent);
-}
-function serializeAddAuthMethodIntentV1(intent) {
-	return alphabetizeStringify(intent);
-}
 async function computeRegistrationIntentDigestB64u(intent) {
-	return base64UrlEncode(await sha256BytesUtf8(serializeRegistrationIntentV1(intent)));
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(intent)));
 }
 async function computeAddSignerIntentDigestB64u(intent) {
-	return base64UrlEncode(await sha256BytesUtf8(serializeAddSignerIntentV1(intent)));
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(intent)));
 }
 async function computeAddAuthMethodIntentDigestB64u(intent) {
-	return base64UrlEncode(await sha256BytesUtf8(serializeAddAuthMethodIntentV1(intent)));
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(intent)));
 }
 function normalizeAddAuthMethodIntentCaller(raw) {
 	const record = inspectRawObject(raw);

package/dist/esm/shared-ts/src/utils/registrationSetupOperation.js

@@ -0,0 +1,8 @@
+//#region ../shared-ts/src/utils/registrationSetupOperation.ts
+function parseRegistrationSetupOperationId(value) {
+	return typeof value === "string" && /^wreg_[A-Za-z0-9_-]{43}$/u.test(value) ? value : null;
+}
+//#endregion
+export { parseRegistrationSetupOperationId };
+
+//# sourceMappingURL=registrationSetupOperation.js.map

package/dist/esm/shared-ts/src/utils/registrationSignerPlan.js

@@ -1,6 +1,6 @@
 import { alphabetizeStringify } from "./digests.js";
-import { parseNamedNearAccountId } from "./near.js";
 import { inspectRawObject, trimString } from "./registrationAuthMethodInput.js";
+import { parseNamedNearAccountId } from "./near.js";
 //#region ../shared-ts/src/utils/registrationSignerPlan.ts
 function normalizePositiveInteger(raw, fallback) {
 	const value = typeof raw === "number" ? raw : Number(raw);
@@ -62,11 +62,8 @@ function registrationSignerBranchKeyFromString(value) {
 function registrationNearEd25519BranchKey(signerSlot) {
 	return registrationSignerBranchKeyFromString(`near_ed25519:slot:${signerSlot}`);
 }
-function registrationEvmFamilyEcdsaTargetKey(target) {
-	return alphabetizeStringify(target);
-}
 function registrationEvmFamilyEcdsaBranchKey(chainTargets) {
-	return registrationSignerBranchKeyFromString(`evm_family_ecdsa:${chainTargets.map(registrationEvmFamilyEcdsaTargetKey).join("|")}`);
+	return registrationSignerBranchKeyFromString(`evm_family_ecdsa:${chainTargets.map(alphabetizeStringify).join("|")}`);
 }
 function registrationSignerPlanFromRequests(signers) {
 	return registrationSignerPlanFromBranches(signers.map(registrationSignerPlanBranchFromRequest));
@@ -150,7 +147,7 @@ function findDuplicateRegistrationSignerBranch(branch, branchKeys) {
 }
 function findDuplicateRegistrationEcdsaTarget(branch, ecdsaTargetKeys) {
 	for (const target of branch.chainTargets) {
-		const targetKey = registrationEvmFamilyEcdsaTargetKey(target);
+		const targetKey = alphabetizeStringify(target);
 		if (ecdsaTargetKeys.has(targetKey)) return {
 			ok: false,
 			code: "invalid_body",

package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js

@@ -3,7 +3,6 @@ import { EVM_ECDSA_MPC_OPERATION_KINDS, parseEcdsaAuthorizationSessionId, parseM
 import { base64UrlDecode, base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
 import { parseCorrelationId } from "./canonicalPrimitives.js";
-import "./encoders.js";
 import { requireRecord } from "./validation.js";
 import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../device-linking/activeWalletSession.js";
 import { requireRouterAbX25519PublicKey } from "./routerAbPublicKeyset.js";
@@ -1560,6 +1559,6 @@ function parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(value) {
 	return parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestFields(record);
 }
 //#endregion
-export { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_HEALTH_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationPublicCapabilityV1, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1, parseRouterAbEcdsaDerivationActivationRefreshRequestV1, parseRouterAbEcdsaDerivationActivationRefreshResponseV1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationExplicitExportRequestV1, parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaExplicitExportProtocolForwardedResponseV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaOperationStepUpPreparationV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, parseRouterAbEcdsaPrepareSourceV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaRegistrationActivationRequestV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaRegistrationRequestV1, parseRouterAbEcdsaSigningWorkerProtocolExportShareEnvelopeV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1, projectRouterAbEcdsaDerivationExplicitExportRequestToProtocolV1, requireRouterAbEcdsaDerivationNormalSigningStateV1, routerAbEcdsaDerivationActiveStateId, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaRegistrationRequestFactsV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire, sameRouterAbServerIdentityV1 };
+export { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_HEALTH_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationPublicCapabilityV1, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1, parseRouterAbEcdsaDerivationActivationRefreshRequestV1, parseRouterAbEcdsaDerivationActivationRefreshResponseV1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationExplicitExportRequestV1, parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaExplicitExportProtocolForwardedResponseV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaOperationStepUpPreparationV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, parseRouterAbEcdsaPrepareSourceV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaRegistrationActivationRequestV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaRegistrationRequestV1, parseRouterAbEcdsaSigningWorkerProtocolExportShareEnvelopeV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1, projectRouterAbEcdsaDerivationExplicitExportRequestToProtocolV1, requireRouterAbEcdsaDerivationNormalSigningStateV1, routerAbEcdsaDerivationActiveStateId, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1, sameRegistrationSignerSet, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaRegistrationRequestFactsV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire, sameRouterAbServerIdentityV1 };
 
 //# sourceMappingURL=routerAbEcdsaDerivation.js.map

package/dist/esm/shared-ts/src/utils/routerAbEd25519Yao.js

@@ -819,6 +819,6 @@ function parseEncryptedPackageValue(value) {
 	return parseEncryptedPackage(value, "encrypted_package");
 }
 //#endregion
-export { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoActivationKeysetV1, parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportAdmissionRequestV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationRequestV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRecoveryStatusRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoActivationPublicReceiptV1, sameRouterAbEd25519YaoRecoveryAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 };
+export { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoActivationKeysetV1, parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportAdmissionRequestV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationRequestV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRecoveryStatusRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoActivationPublicReceiptV1, sameRouterAbEd25519YaoByteSequence, sameRouterAbEd25519YaoRecoveryAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 };
 
 //# sourceMappingURL=routerAbEd25519Yao.js.map

package/dist/esm/shared-ts/src/utils/thresholdEcdsaChainTarget.js

@@ -0,0 +1,9 @@
+//#region ../shared-ts/src/utils/thresholdEcdsaChainTarget.ts
+function thresholdEcdsaChainTargetKey(target) {
+	if (target.kind === "evm") return `evm:eip155:${target.chainId}`;
+	return `tempo:${target.chainId}`;
+}
+//#endregion
+export { thresholdEcdsaChainTargetKey };
+
+//# sourceMappingURL=thresholdEcdsaChainTarget.js.map

package/dist/esm/shared-ts/src/utils/validation.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "./normalize.js";
-import "./near.js";
 //#region ../shared-ts/src/utils/validation.ts
 function requireTrimmedString(value, label, message = "is required") {
 	const parsed = normalizeOptionalTrimmedString(value);
@@ -24,9 +23,6 @@ function isObject(x) {
 function isPlainObject(x) {
 	return isObject(x) && !Array.isArray(x);
 }
-function isString(x) {
-	return typeof x === "string";
-}
 function isFunction(x) {
 	return typeof x === "function";
 }
@@ -49,6 +45,6 @@ function requireArray(value, label) {
 	return value;
 }
 //#endregion
-export { asRecord, coerceNonEmptyString, isFunction, isObject, isPlainObject, isString, requireArray, requireCanonicalString, requireNonEmptyString, requireRecord, requireRecordCopy, requireRecordOrArray, requireTrimmedString };
+export { asRecord, coerceNonEmptyString, isFunction, isObject, isPlainObject, requireArray, requireCanonicalString, requireNonEmptyString, requireRecord, requireRecordCopy, requireRecordOrArray, requireTrimmedString };
 
 //# sourceMappingURL=validation.js.map

package/dist/esm/shared-ts/src/utils/walletAuthAuthority.js

@@ -1,7 +1,6 @@
 import { parseEmailOtpProviderUserId, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "./domainIds.js";
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
-import "./encoders.js";
 //#region ../shared-ts/src/utils/walletAuthAuthority.ts
 const WALLET_AUTHORITY_BINDING_DIGEST_DOMAIN = "seams:wallet-authority-binding:v1|";
 function isPasskeyWalletAuthAuthority(authority) {

package/dist/esm/shared-ts/src/utils/walletManagementProtocol.js

@@ -0,0 +1,6 @@
+//#region ../shared-ts/src/utils/walletManagementProtocol.ts
+const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
+//#endregion
+export { WALLET_MANAGEMENT_PROTOCOL_HEADER };
+
+//# sourceMappingURL=walletManagementProtocol.js.map

package/dist/esm/shared-ts/src/utils/wireSchema.js

@@ -1,4 +1,4 @@
-import { requireArray, requireRecord } from "./validation.js";
+import { requireRecord } from "./validation.js";
 import { exactRecord } from "./exactRecord.js";
 //#region ../shared-ts/src/utils/wireSchema.ts
 /** One of the given strings. */
@@ -42,17 +42,6 @@ function wireUnion(tag, variants) {
 function wireNullable(parse) {
 	return (raw, label) => raw === null ? null : parse(raw, label);
 }
-/** A non-empty array of `item`; `refine` checks rules that span the items. */
-function wireNonEmptyArray(item, refine) {
-	return (raw, label) => {
-		const entries = requireArray(raw, label);
-		if (entries.length === 0) throw new Error(`${label} must be non-empty`);
-		const [first, ...rest] = entries.map((entry, index) => item(entry, `${label}[${index}]`));
-		const items = [first, ...rest];
-		refine?.(items, label);
-		return items;
-	};
-}
 /** Adapts a parser that returns a result, putting the field's label before its error. */
 function wireResult(parse) {
 	return (raw, label) => {
@@ -72,6 +61,6 @@ function wireLabeled(parse) {
 	};
 }
 //#endregion
-export { wireLabeled, wireLiteral, wireNonEmptyArray, wireNullable, wireObject, wireResult, wireUnion };
+export { wireLabeled, wireLiteral, wireNullable, wireObject, wireResult, wireUnion };
 
 //# sourceMappingURL=wireSchema.js.map

package/dist/esm/shared-ts/src/wallet-recovery/backupAcknowledgement.js

@@ -1,33 +1,15 @@
 //#region ../shared-ts/src/wallet-recovery/backupAcknowledgement.ts
 function parseWalletRecoveryBackupAcknowledgementV1(raw, options) {
-	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return {
-		ok: false,
-		reason: "backup acknowledgement must be an object"
-	};
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return { ok: false };
 	const record = raw;
-	if (record.kind !== "wallet_recovery_backup_acknowledgement_v1") return {
-		ok: false,
-		reason: "backup acknowledgement kind is invalid"
-	};
+	if (record.kind !== "wallet_recovery_backup_acknowledgement_v1") return { ok: false };
 	const walletId = String(record.walletId || "").trim();
-	if (!walletId) return {
-		ok: false,
-		reason: "backup acknowledgement must name its wallet"
-	};
-	if (walletId !== String(options.expectedWalletId).trim()) return {
-		ok: false,
-		reason: "backup acknowledgement is outside the requested wallet"
-	};
+	if (!walletId) return { ok: false };
+	if (walletId !== String(options.expectedWalletId).trim()) return { ok: false };
 	const issuedAtMs = timestamp(record.issuedAtMs);
 	const acknowledgedAtMs = timestamp(record.acknowledgedAtMs);
-	if (issuedAtMs === null || acknowledgedAtMs === null) return {
-		ok: false,
-		reason: "backup acknowledgement needs valid timestamps"
-	};
-	if (acknowledgedAtMs < issuedAtMs) return {
-		ok: false,
-		reason: "backup acknowledgement predates the issuance it names"
-	};
+	if (issuedAtMs === null || acknowledgedAtMs === null) return { ok: false };
+	if (acknowledgedAtMs < issuedAtMs) return { ok: false };
 	return {
 		ok: true,
 		record: {

package/dist/esm/shared-ts/src/wallet-recovery/recoveryCodeLocator.js

@@ -1,7 +1,6 @@
 import { base64UrlEncode } from "../utils/base64.js";
 import { sha256Bytes } from "../utils/digests.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import "../utils/encoders.js";
 import "../utils/emailOtpRecoveryKey.js";
 //#region ../shared-ts/src/wallet-recovery/recoveryCodeLocator.ts
 const RECOVERY_CODE_LOCATOR_CONTEXT_V1 = "seams/wallet-recovery/code-locator/v1";

package/dist/esm/shared-ts/src/wallet-recovery/recoveryKeyId.js

@@ -1,7 +1,5 @@
 import { base64UrlEncode } from "../utils/base64.js";
-import "../utils/encoders.js";
 import { encodeSigningSessionHkdfTuple } from "../utils/signingSessionSeal.js";
-import "../utils/emailOtpRecoveryKey.js";
 //#region ../shared-ts/src/wallet-recovery/recoveryKeyId.ts
 const WALLET_RECOVERY_KEY_ID_PREFIX_V1 = "wallet-rkid-v1-";
 const WALLET_RECOVERY_KEY_ID_CONTEXT_V1 = "seams/wallet-recovery/recovery-key-id/v1";
@@ -13,11 +11,12 @@ function parseDerivedWalletRecoveryKeyId(value, label = "recoveryKeyId") {
 	return value;
 }
 /**
-* The same derivation from decoded bytes.
+* Derives one code's id within a wallet's recovery set, from the decoded code
+* bytes the ceremony already holds.
 *
-* Separate entry point because the ceremony seals wraps from bytes it already
-* holds, while a user typing a code arrives as a string. Both must reach one
-* id, so both go through this.
+* Bound to the wallet and the set version, so the same code typed against a
+* different wallet produces a different id and finds no wrap. Length-delimited
+* fields under a fixed context, so no two inputs encode alike.
 */
 async function deriveWalletRecoveryKeyIdFromBytes(args) {
 	const walletId = String(args.walletId || "").trim();

package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js

@@ -45,7 +45,7 @@ function buildGoogleEmailOtpProjection(input) {
 			providerSubject: input.providerSubject,
 			emailHashHex: requireEmailHash(input.emailHashHex),
 			registrationAuthorityId: requireTrimmedString(input.registrationAuthorityId, "registrationAuthorityId", "is invalid"),
-			enrollment: buildEnrollmentReference(input.enrollment)
+			enrollment: parseEnrollmentReference(input.enrollment)
 		}
 	};
 	assertProjectionShape(projection);
@@ -60,9 +60,6 @@ function parseEnrollmentReference(raw) {
 		enrollmentSealKeyVersion: requireTrimmedString(record.enrollmentSealKeyVersion, "enrollment.enrollmentSealKeyVersion", "is invalid")
 	};
 }
-function buildEnrollmentReference(value) {
-	return parseEnrollmentReference(value);
-}
 function assertProjectionShape(projection) {
 	if (projection.authority.walletId !== projection.walletId || projection.authority.authorityId !== projection.targetAuthorityId || projection.authority.principal.deviceId !== projection.targetDeviceId || projection.authority.provenance.kind !== "wallet_recovery" || projection.authority.provenance.recoveryOperationId !== projection.recoveryOperationId || projection.authority.provenance.continuityAuthorityId === projection.targetAuthorityId || projection.authMethod.walletId !== projection.walletId || projection.authMethod.walletAuthorityId !== projection.targetAuthorityId || projection.authMethod.walletAuthMethodId !== projection.targetWalletAuthMethodId || projection.authMethod.status !== "active") throw new Error("wallet recovery committed projection relations are invalid");
 	if (projection.kind === "passkey") {

package/dist/esm/storage/d1Sql.js

@@ -73,12 +73,6 @@ function isD1DatabaseLike(value) {
 	const probe = d1DatabaseProbe(value);
 	return Boolean(probe && typeof probe.prepare === "function" && typeof probe.batch === "function" && typeof probe.exec === "function");
 }
-function resolveD1DatabaseFromConfig(config) {
-	if (isD1DatabaseLike(config.database)) return config.database;
-	if (isD1DatabaseLike(config.metadataDatabase)) return config.metadataDatabase;
-	if (isD1DatabaseLike(config.SIGNER_DB)) return config.SIGNER_DB;
-	return null;
-}
 /**
 * Aborts the D1 batch it is in when the statement just before it changed no
 * row: it collides with the guard table's immutable singleton, and the
@@ -89,6 +83,6 @@ const D1_BATCH_CAS_GUARD_SQL = `INSERT INTO router_ab_yao_versioned_json_cas_gua
 SELECT 1
  WHERE changes() = 0`;
 //#endregion
-export { D1_BATCH_CAS_GUARD_SQL, d1ChangedRows, d1Integer, d1Number, formatD1ExecStatement, isD1DatabaseLike, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, queryD1All, queryD1One, resolveD1DatabaseFromConfig };
+export { D1_BATCH_CAS_GUARD_SQL, d1ChangedRows, d1Integer, d1Number, formatD1ExecStatement, isD1DatabaseLike, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, queryD1All, queryD1One };
 
 //# sourceMappingURL=d1Sql.js.map

package/dist/esm/threshold/session/signingSessionSeal/crypto/cipher.js

@@ -1,33 +1,17 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, encodeSigningSessionHkdfTuple } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { parseSigningSessionSealKeyVersion } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { addSigningSessionSealLock, deriveSigningSessionSealLockKeyHandle, destroySigningSessionSealLockKeyHandle, removeSigningSessionSealLock } from "./shamir3PassWasm.js";
 //#region src/threshold/session/signingSessionSeal/crypto/cipher.ts
 function toErrorResult(error) {
-	if (error && typeof error === "object" && !Array.isArray(error) && error.code) return {
-		ok: false,
-		code: String(error.code || "").trim() || "internal",
-		message: String(error.message || "").trim() || "Signing-session seal cipher failed"
-	};
-	return {
-		ok: false,
-		code: "internal",
-		message: error instanceof Error ? error.message : String(error || "Signing-session seal cipher failed")
-	};
+	if (error && typeof error === "object" && !Array.isArray(error) && error.code) return failure(String(error.code || "").trim() || "internal", String(error.message || "").trim() || "Signing-session seal cipher failed");
+	return failure("internal", error instanceof Error ? error.message : String(error || "Signing-session seal cipher failed"));
 }
 function normalizeResult(result) {
-	if (!result.ok) return {
-		ok: false,
-		code: String(result.code || "internal").trim() || "internal",
-		message: String(result.message || "Signing-session seal cipher failed").trim() || "Signing-session seal cipher failed"
-	};
+	if (!result.ok) return failure(String(result.code || "internal").trim() || "internal", String(result.message || "Signing-session seal cipher failed").trim() || "Signing-session seal cipher failed");
 	const ciphertext = normalizeOptionalTrimmedString(result.ciphertext);
-	if (!ciphertext) return {
-		ok: false,
-		code: "invalid_ciphertext",
-		message: "Signing-session seal cipher returned empty ciphertext"
-	};
+	if (!ciphertext) return failure("invalid_ciphertext", "Signing-session seal cipher returned empty ciphertext");
 	return {
 		ok: true,
 		ciphertext,
@@ -141,19 +125,12 @@ var SigningSessionSealKeyHandles = class {
 		return this.initialization;
 	}
 };
-function cipherFailure(code, message) {
-	return {
-		ok: false,
-		code,
-		message
-	};
-}
 function mapCipherError(error, defaultMessage) {
 	const message = normalizeOptionalTrimmedString(error instanceof Error ? error.message : error) || defaultMessage;
 	const lowered = message.toLowerCase();
-	if (lowered.includes("keyversion")) return cipherFailure("invalid_key_version", message);
-	if (lowered.includes("ciphertext") || lowered.includes("base64url") || lowered.includes("group")) return cipherFailure("invalid_ciphertext", message);
-	return cipherFailure("internal", message);
+	if (lowered.includes("keyversion")) return failure("invalid_key_version", message);
+	if (lowered.includes("ciphertext") || lowered.includes("base64url") || lowered.includes("group")) return failure("invalid_ciphertext", message);
+	return failure("internal", message);
 }
 function createSigningSessionSealShamir3PassCipherAdapter(options) {
 	const config = normalizeConfig(options.config);
@@ -163,7 +140,7 @@ function createSigningSessionSealShamir3PassCipherAdapter(options) {
 	return createSigningSessionSealCipherAdapter({
 		applyServerSeal: async (input) => {
 			const requestedKeyVersion = normalizeOptionalTrimmedString(input.keyVersion);
-			if (requestedKeyVersion && requestedKeyVersion !== config.currentKeyVersion) return cipherFailure("invalid_key_version", `Requested keyVersion "${requestedKeyVersion}" does not match active keyVersion "${config.currentKeyVersion}"`);
+			if (requestedKeyVersion && requestedKeyVersion !== config.currentKeyVersion) return failure("invalid_key_version", `Requested keyVersion "${requestedKeyVersion}" does not match active keyVersion "${config.currentKeyVersion}"`);
 			try {
 				const handle = (await handles.get()).get(config.currentKeyVersion);
 				if (handle === void 0) throw new Error("currentKeyVersion handle is unavailable");
@@ -183,7 +160,7 @@ function createSigningSessionSealShamir3PassCipherAdapter(options) {
 			const keyVersion = normalizeKeyVersion(input.keyVersion, "keyVersion");
 			try {
 				const handle = (await handles.get()).get(keyVersion);
-				if (handle === void 0) return cipherFailure("invalid_key_version", `Unknown keyVersion "${keyVersion}"`);
+				if (handle === void 0) return failure("invalid_key_version", `Unknown keyVersion "${keyVersion}"`);
 				return {
 					ok: true,
 					ciphertext: await runtime.removeLock({

package/dist/esm/threshold/session/signingSessionSeal/guards/backends.js

@@ -1,7 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
-import { RedisTcpClient, UpstashRedisRestClient } from "../../../../core/ThresholdService/kv.js";
 import { createInMemorySigningSessionSealRateLimiter } from "./index.js";
+import { RedisTcpClient, UpstashRedisRestClient } from "../../../../core/ThresholdService/kv.js";
 //#region src/threshold/session/signingSessionSeal/guards/backends.ts
 const WINDOW_COUNTER_LUA = `
 local key = KEYS[1]

package/dist/esm/threshold/session/signingSessionSeal/idempotencyBackends.js

@@ -1,8 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetJson, redisSetJson } from "../../../core/ThresholdService/kv.js";
 import { createInMemorySigningSessionSealIdempotencyStore } from "./idempotency.js";
-import { parseCurrentSigningSessionSealIdempotencyRouteResult, parseCurrentSigningSessionSealIdempotencyStoredEntry } from "./idempotencyRecords.js";
+import { parseCurrentSigningSessionSealIdempotencyResultRecord, parseCurrentSigningSessionSealIdempotencyStoredEntry } from "./idempotencyRecords.js";
 //#region src/threshold/session/signingSessionSeal/idempotencyBackends.ts
 const DEFAULT_KEY_PREFIX = "threshold:signing-session-seal:idempotency:";
 function toPositiveInt(value) {
@@ -46,7 +45,7 @@ var UpstashSigningSessionSealIdempotencyStore = class {
 		if (!key) return;
 		const expiresAtMs = toPositiveInt(input.expiresAtMs);
 		if (expiresAtMs === void 0) return;
-		const normalizedResult = parseCurrentSigningSessionSealIdempotencyRouteResult(input.result);
+		const normalizedResult = parseCurrentSigningSessionSealIdempotencyResultRecord(input.result);
 		if (!normalizedResult) return;
 		const ttlMs = ttlMsUntilExpiry(expiresAtMs, this.nowMs());
 		if (ttlMs <= 0) return;
@@ -80,7 +79,7 @@ var RedisTcpSigningSessionSealIdempotencyStore = class {
 		if (!key) return;
 		const expiresAtMs = toPositiveInt(input.expiresAtMs);
 		if (expiresAtMs === void 0) return;
-		const normalizedResult = parseCurrentSigningSessionSealIdempotencyRouteResult(input.result);
+		const normalizedResult = parseCurrentSigningSessionSealIdempotencyResultRecord(input.result);
 		if (!normalizedResult) return;
 		const ttlMs = ttlMsUntilExpiry(expiresAtMs, this.nowMs());
 		if (ttlMs <= 0) return;

package/dist/esm/threshold/session/signingSessionSeal/idempotencyRecords.js

@@ -1,5 +1,5 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 //#region src/threshold/session/signingSessionSeal/idempotencyRecords.ts
 function toPositiveInt(value) {
 	const parsed = Number(value);
@@ -26,11 +26,7 @@ function parseCurrentSigningSessionSealIdempotencyResultRecord(raw) {
 		const code = normalizeOptionalTrimmedString(obj.code);
 		const message = normalizeOptionalTrimmedString(obj.message);
 		if (!code || !message) return null;
-		return {
-			ok: false,
-			code,
-			message
-		};
+		return failure(code, message);
 	}
 	return null;
 }
@@ -45,10 +41,7 @@ function parseCurrentSigningSessionSealIdempotencyStoredEntry(raw) {
 		expiresAtMs
 	};
 }
-function parseCurrentSigningSessionSealIdempotencyRouteResult(raw) {
-	return parseCurrentSigningSessionSealIdempotencyResultRecord(raw);
-}
 //#endregion
-export { parseCurrentSigningSessionSealIdempotencyRouteResult, parseCurrentSigningSessionSealIdempotencyStoredEntry };
+export { parseCurrentSigningSessionSealIdempotencyResultRecord, parseCurrentSigningSessionSealIdempotencyStoredEntry };
 
 //# sourceMappingURL=idempotencyRecords.js.map

package/dist/esm/threshold/session/signingSessionSeal/options.js

@@ -1,7 +1,6 @@
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import "../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID } from "../../../shared-ts/src/utils/signingSessionSeal.js";
 import { parseSigningSessionSealKeyVersion } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { createSigningSessionSealShamir3PassCipherAdapter } from "./crypto/cipher.js";

package/dist/esm/threshold/session/signingSessionSeal/service.js

@@ -1,6 +1,7 @@
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
 import "../../../shared-ts/src/utils/encoders.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 //#region src/threshold/session/signingSessionSeal/service.ts
 const SIGNING_SESSION_SEAL_LOG_LABEL = "[threshold-signing-session-seal]";
 const SIGNING_SESSION_SEAL_IDEMPOTENCY_TTL_MS_DEFAULT = 9e4;
@@ -120,11 +121,7 @@ function shouldPersistIdempotentResult(result) {
 async function runSealOperation(input) {
 	const nowMs = input.options.nowMs || Date.now;
 	const startedAtMs = nowMs();
-	let result = {
-		ok: false,
-		code: "internal",
-		message: "Internal error"
-	};
+	let result = failure("internal", "Internal error");
 	try {
 		emitOperationRequestLog({
 			options: input.options,
@@ -136,27 +133,15 @@ async function runSealOperation(input) {
 		});
 		const session = input.auth.session;
 		if (signingSessionSealAuthorizationId(session) !== input.request.thresholdSessionId) {
-			result = {
-				ok: false,
-				code: "forbidden",
-				message: "Wallet Session does not match requested thresholdSessionId"
-			};
+			result = failure("forbidden", "Wallet Session does not match requested thresholdSessionId");
 			return result;
 		}
 		if (session.userId !== input.auth.userId) {
-			result = {
-				ok: false,
-				code: "forbidden",
-				message: "thresholdSessionId does not belong to authenticated user"
-			};
+			result = failure("forbidden", "thresholdSessionId does not belong to authenticated user");
 			return result;
 		}
 		if (isExpired(session, nowMs())) {
-			result = {
-				ok: false,
-				code: "expired",
-				message: "threshold session expired"
-			};
+			result = failure("expired", "threshold session expired");
 			return result;
 		}
 		if (input.options.guard) {
@@ -166,11 +151,7 @@ async function runSealOperation(input) {
 				auth: input.auth
 			});
 			if (!guard.ok) {
-				result = {
-					ok: false,
-					code: toCode(guard.code, "forbidden"),
-					message: toMessage(guard.message, "Request rejected")
-				};
+				result = failure(toCode(guard.code, "forbidden"), toMessage(guard.message, "Request rejected"));
 				return result;
 			}
 		}
@@ -183,11 +164,7 @@ async function runSealOperation(input) {
 			auth: { userId: input.auth.userId }
 		});
 		if (!sealed.ok) {
-			result = {
-				ok: false,
-				code: toCode(sealed.code, "internal"),
-				message: toMessage(sealed.message, "Signing-session seal operation failed")
-			};
+			result = failure(toCode(sealed.code, "internal"), toMessage(sealed.message, "Signing-session seal operation failed"));
 			return result;
 		}
 		result = {
@@ -198,11 +175,7 @@ async function runSealOperation(input) {
 		};
 		return result;
 	} catch (error) {
-		result = {
-			ok: false,
-			code: "internal",
-			message: toMessage(error instanceof Error ? error.message : error, "Internal error")
-		};
+		result = failure("internal", toMessage(error instanceof Error ? error.message : error, "Internal error"));
 		return result;
 	} finally {
 		const durationMs = Math.max(0, nowMs() - startedAtMs);