@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/core/deviceLinking/linkedDeviceSession.js

@@ -2,6 +2,7 @@ import { parseLinkDeviceSessionId, parseWalletAuthorityId } from "../../shared-t
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseLinkedDeviceApprovalV1 } from "../../shared-ts/src/device-linking/parsers.js";
 import { computeLinkedDeviceApprovalDigestV1, computeLinkedDeviceSessionClaimDigestV1 } from "../../shared-ts/src/device-linking/digests.js";
+import { linkedDeviceBootstrapFailure } from "./linkedDeviceBootstrap.js";
 import { activeStateV1, approvalTranscriptMatchesDigest, authorityPendingStateV1, awaitingSourceContributionDeadlineMsV1, awaitingSourceContributionStateV1, awaitingTargetDeadlineMsV1, awaitingTargetFactorStateV1, buildUnclaimedSessionRecordV1, claimTranscriptMatchesDigest, claimedStateV1, conflictResult, integrityResult, invalidStateResult, isPrecommitState, linkedDeviceEmailOtpChallengesEqualV1, linkedDevicePrecommitFailuresEqualV1, linkedDeviceQrPayloadsEqualV1, parseEmailOtpChallengeV1, parseId, parseQrLinkedDeviceSessionPayloadV1, provisioningStateV1, replaceSessionRecordV1, requireDigest, requireTimestamp, sessionExpiryMsV1, sourceContributionTranscriptMatchesDigest } from "./linkedDeviceSessionRecord.js";
 import { validateApprovalMatchesSession, validateLinkedDeviceRequestedAuthorityV1, validateSourceContributionApprovalMatchesSession, validateSourceContributionPreparationMatchesApproval } from "./linkedDeviceSessionApproval.js";
 //#region src/core/deviceLinking/linkedDeviceSession.ts
@@ -20,7 +21,7 @@ var LinkedDeviceSessionServiceV1 = class {
 			};
 			return await this.store.createUnclaimedSessionV1(buildUnclaimedSessionRecordV1(payload, nowMs));
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async claimSessionV1(input) {
@@ -68,7 +69,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async recordOwnerApprovalV1(input) {
@@ -120,7 +121,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async recordTargetCredentialV1(input) {
@@ -150,7 +151,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async recordSourceContributionV1(input) {
@@ -204,7 +205,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async recordEmailOtpChallengeStateV1(input) {
@@ -233,7 +234,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async markAuthorityPendingLocalInstallV1(input) {
@@ -261,7 +262,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async activateSessionV1(input) {
@@ -294,7 +295,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async failBeforeCommitV1(input) {
@@ -322,7 +323,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async cancelSessionV1(input) {
@@ -349,7 +350,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async expireSessionV1(input) {
@@ -380,7 +381,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async deleteActiveSessionV1(input) {
@@ -404,7 +405,7 @@ var LinkedDeviceSessionServiceV1 = class {
 				nowMs
 			});
 		} catch (error) {
-			return invalidInputResult(error);
+			return sessionFailureResult(error);
 		}
 	}
 	async getSessionV1(input) {
@@ -417,7 +418,7 @@ var LinkedDeviceSessionServiceV1 = class {
 			expectedRevision: existing.revision,
 			nowMs: normalized.nowMs
 		});
-		return "record" in expired ? expired.record : existing;
+		return "record" in expired && expired.record !== void 0 ? expired.record : existing;
 	}
 	async listSessionsForWalletV1(input) {
 		const page = await this.store.listSessionsForWalletV1({
@@ -511,7 +512,12 @@ function normalizeSessionReadInput(input) {
 		nowMs: requireTimestamp(input.nowMs, "nowMs")
 	};
 }
-function invalidInputResult(error) {
+function sessionFailureResult(error) {
+	const failure = linkedDeviceBootstrapFailure(error);
+	if (failure) return {
+		outcome: failure,
+		message: "Linked-device bootstrap authority is unavailable or conflicting"
+	};
 	return {
 		outcome: "invalid_input",
 		message: error instanceof Error ? error.message : String(error || "invalid linked-device input")

package/dist/esm/core/deviceLinking/requestProof.js

@@ -23,22 +23,25 @@ var LinkedDeviceRequestProofVerifierV1 = class {
 				code: "invalid",
 				message: "device request proof signature is invalid"
 			};
-			if ((await this.nonceStore.consumeRequestProofNonceV1({
+			const consumed = await this.nonceStore.consumeRequestProofNonceV1({
 				linkSessionId: input.proof.linkSessionId,
 				requestNonceB64u: input.proof.requestNonceB64u,
 				proofDigestB64u,
 				issuedAtMs: input.proof.issuedAtMs,
 				expiresAtMs: input.proof.expiresAtMs,
 				consumedAtMs: input.nowMs
-			})).outcome === "already_used") return {
+			});
+			if (consumed.outcome === "unavailable") return {
+				kind: "denied",
+				code: "unavailable",
+				message: "Device request proof authority is unavailable"
+			};
+			if (consumed.outcome === "already_used") return {
 				kind: "denied",
 				code: "replayed",
 				message: "device request proof was already used"
 			};
-			return {
-				kind: "authorized",
-				proofDigestB64u
-			};
+			return { kind: "authorized" };
 		} catch (error) {
 			const message = errorMessage(error);
 			return {

package/dist/esm/core/emailOtpD1Statements.js

@@ -39,20 +39,6 @@ function challengeValues(record) {
 /** Statements on `email_otp_challenges`. */
 const emailOtpChallengeRows = {
 	insert: (prepare, record) => prepare(INSERT_CHALLENGE_SQL, challengeValues(record)),
-	upsert: (prepare, record) => prepare(`${INSERT_CHALLENGE_SQL}
-      ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
-      DO UPDATE SET
-        challenge_subject_id = EXCLUDED.challenge_subject_id,
-        wallet_id = EXCLUDED.wallet_id,
-        record_org_id = EXCLUDED.record_org_id,
-        otp_channel = EXCLUDED.otp_channel,
-        owner_proof_binding_digest = EXCLUDED.owner_proof_binding_digest,
-        action = EXCLUDED.action,
-        operation = EXCLUDED.operation,
-        otp_code = EXCLUDED.otp_code,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, challengeValues(record)),
 	delete: (prepare, challengeId) => prepare(`DELETE FROM email_otp_challenges
         WHERE namespace = ?
           AND org_id = ?
@@ -92,38 +78,13 @@ function grantValues(record) {
 /** Statements on `email_otp_grants`. */
 const emailOtpGrantRows = {
 	insert: (prepare, record) => prepare(INSERT_GRANT_SQL, grantValues(record)),
-	upsert: (prepare, record) => prepare(`${INSERT_GRANT_SQL}
-      ON CONFLICT (namespace, org_id, project_id, env_id, grant_token)
-      DO UPDATE SET
-        user_id = EXCLUDED.user_id,
-        wallet_id = EXCLUDED.wallet_id,
-        record_org_id = EXCLUDED.record_org_id,
-        challenge_id = EXCLUDED.challenge_id,
-        action = EXCLUDED.action,
-        record_json = EXCLUDED.record_json,
-        issued_at_ms = EXCLUDED.issued_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, grantValues(record)),
-	select: (prepare, grantToken) => prepare(`SELECT record_json, expires_at_ms
-         FROM email_otp_grants
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND grant_token = ?
-        LIMIT 1`, [grantToken]),
 	consume: (prepare, grantToken) => prepare(`DELETE FROM email_otp_grants
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
           AND grant_token = ?
-      RETURNING record_json, expires_at_ms`, [grantToken]),
-	delete: (prepare, grantToken) => prepare(`DELETE FROM email_otp_grants
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND grant_token = ?`, [grantToken])
+      RETURNING record_json, expires_at_ms`, [grantToken])
 };
 const INSERT_WALLET_ENROLLMENT_SQL = `INSERT INTO email_otp_wallet_enrollments (
         namespace,
@@ -235,15 +196,6 @@ function unlockChallengeValues(record) {
 /** Statements on `email_otp_unlock_challenges`. */
 const emailOtpUnlockChallengeRows = {
 	insert: (prepare, record) => prepare(INSERT_UNLOCK_CHALLENGE_SQL, unlockChallengeValues(record)),
-	upsert: (prepare, record) => prepare(`${INSERT_UNLOCK_CHALLENGE_SQL}
-      ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
-      DO UPDATE SET
-        wallet_id = EXCLUDED.wallet_id,
-        user_id = EXCLUDED.user_id,
-        record_org_id = EXCLUDED.record_org_id,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, unlockChallengeValues(record)),
 	consume: (prepare, challengeId) => prepare(`DELETE FROM email_otp_unlock_challenges
         WHERE namespace = ?
           AND org_id = ?
@@ -269,53 +221,95 @@ const PENDING_ATTEMPTS_SQL = `SELECT record_json, expires_at_ms, updated_at_ms,
           AND expires_at_ms > ?`;
 /** Statements on `email_otp_registration_attempts`. */
 const emailOtpRegistrationAttemptRows = {
-	upsert: (prepare, record) => prepare(`INSERT INTO email_otp_registration_attempts (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        attempt_id,
-        provider_subject,
-        email,
-        wallet_id,
-        state,
-        owner_proof_binding_digest,
-        runtime_org_id,
-        runtime_policy_key,
-        offer_wallet_ids_json,
-        record_json,
-        created_at_ms,
-        updated_at_ms,
-        expires_at_ms
+	insertPendingIfAbsent: (prepare, record) => prepare(`WITH candidate (
+        namespace, org_id, project_id, env_id, attempt_id, provider_subject, email,
+        wallet_id, state, owner_proof_binding_digest, runtime_org_id, runtime_policy_key,
+        offer_wallet_ids_json, record_json, created_at_ms, updated_at_ms, expires_at_ms
+      ) AS (VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?))
+      INSERT INTO email_otp_registration_attempts (
+        namespace, org_id, project_id, env_id, attempt_id, provider_subject, email,
+        wallet_id, state, owner_proof_binding_digest, runtime_org_id, runtime_policy_key,
+        offer_wallet_ids_json, record_json, created_at_ms, updated_at_ms, expires_at_ms
       )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, attempt_id)
-      DO UPDATE SET
-        provider_subject = EXCLUDED.provider_subject,
-        email = EXCLUDED.email,
-        wallet_id = EXCLUDED.wallet_id,
-        state = EXCLUDED.state,
-        owner_proof_binding_digest = EXCLUDED.owner_proof_binding_digest,
-        runtime_org_id = EXCLUDED.runtime_org_id,
-        runtime_policy_key = EXCLUDED.runtime_policy_key,
-        offer_wallet_ids_json = EXCLUDED.offer_wallet_ids_json,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        updated_at_ms = EXCLUDED.updated_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, [
-		record.attemptId,
-		record.providerSubject,
-		record.email,
+      SELECT * FROM candidate
+      WHERE NOT EXISTS (
+        SELECT 1 FROM email_otp_registration_attempts existing
+        WHERE existing.namespace = candidate.namespace
+          AND existing.org_id = candidate.org_id
+          AND existing.project_id = candidate.project_id
+          AND existing.env_id = candidate.env_id
+          AND existing.provider_subject = candidate.provider_subject
+          AND existing.email = candidate.email
+          AND existing.owner_proof_binding_digest = candidate.owner_proof_binding_digest
+          AND existing.runtime_org_id = candidate.runtime_org_id
+          AND existing.runtime_policy_key = candidate.runtime_policy_key
+          AND existing.state IN ('started', 'key_finalized')
+          AND (existing.expires_at_ms > candidate.created_at_ms OR existing.selection_digest IS NOT NULL)
+      )`, registrationAttemptValues(record)),
+	claimCandidate: (prepare, input) => prepare(`WITH scope AS (SELECT ? AS namespace, ? AS org_id, ? AS project_id, ? AS env_id)
+    UPDATE email_otp_registration_attempts
+    SET wallet_id = ?, selection_digest = ?,
+      record_json = json_set(record_json,
+        '$.walletId', ?, '$.selectedCandidateId', ?,
+        '$.collisionCounter', (
+          SELECT json_extract(value, '$.collisionCounter')
+          FROM json_each(record_json, '$.offerCandidates')
+          WHERE json_extract(value, '$.candidateId') = ?
+        ), '$.updatedAtMs', MAX(updated_at_ms, ?)),
+      updated_at_ms = MAX(updated_at_ms, ?)
+    WHERE namespace = (SELECT namespace FROM scope)
+      AND org_id = (SELECT org_id FROM scope)
+      AND project_id = (SELECT project_id FROM scope)
+      AND env_id = (SELECT env_id FROM scope)
+      AND attempt_id = ? AND state IN ('started', 'key_finalized') AND expires_at_ms > ?
+      AND EXISTS (
+        SELECT 1 FROM json_each(record_json, '$.offerCandidates')
+        WHERE json_extract(value, '$.candidateId') = ? AND json_extract(value, '$.walletId') = ?
+      )
+      AND (selection_digest IS NULL OR (
+        selection_digest = ? AND wallet_id = ? AND json_extract(record_json, '$.selectedCandidateId') = ?
+      ))`, [
+		input.walletId,
+		input.intentDigest,
+		input.walletId,
+		input.candidateId,
+		input.candidateId,
+		input.nowMs,
+		input.nowMs,
+		input.attemptId,
+		input.nowMs,
+		input.candidateId,
+		input.walletId,
+		input.intentDigest,
+		input.walletId,
+		input.candidateId
+	]),
+	updatePending: (prepare, record) => prepare(`WITH scope AS (SELECT ? AS namespace, ? AS org_id, ? AS project_id, ? AS env_id)
+      UPDATE email_otp_registration_attempts
+      SET wallet_id = ?, state = ?, record_json = ?, updated_at_ms = ?
+      WHERE namespace = (SELECT namespace FROM scope)
+        AND org_id = (SELECT org_id FROM scope)
+        AND project_id = (SELECT project_id FROM scope)
+        AND env_id = (SELECT env_id FROM scope)
+        AND attempt_id = ?
+        AND state IN ('started', 'key_finalized')
+        AND wallet_id = ?
+        AND json_extract(record_json, '$.selectedCandidateId') = ?
+        AND NOT (state = 'key_finalized' AND ? = 'started')
+        AND (? NOT IN ('abandoned', 'expired') OR selection_digest IS NULL)
+        AND ? <> 'active'
+        AND updated_at_ms <= ?`, [
 		record.walletId,
 		record.state,
-		record.ownerProofBindingDigest,
-		record.runtimePolicyScope?.orgId || "",
-		runtimePolicyScopeKey(record.runtimePolicyScope),
-		offerWalletIdsJson(record.offerCandidates),
 		JSON.stringify(record),
-		record.createdAtMs,
 		record.updatedAtMs,
-		record.expiresAtMs
+		record.attemptId,
+		record.walletId,
+		record.selectedCandidateId,
+		record.state,
+		record.state,
+		record.state,
+		record.updatedAtMs
 	]),
 	select: (prepare, attemptId) => prepare(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
          FROM email_otp_registration_attempts
@@ -348,6 +342,7 @@ const emailOtpRegistrationAttemptRows = {
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
+          AND state <> 'active' AND selection_digest IS NULL
           AND (expires_at_ms <= ? OR state = 'expired')`, [nowMs]),
 	selectLiveForWallet: (prepare, walletId, nowMs) => prepare(`SELECT 1 AS found
          FROM email_otp_registration_attempts
@@ -356,7 +351,7 @@ const emailOtpRegistrationAttemptRows = {
           AND project_id = ?
           AND env_id = ?
           AND state IN ('started', 'key_finalized')
-          AND expires_at_ms > ?
+          AND (expires_at_ms > ? OR selection_digest IS NOT NULL)
           AND (
             wallet_id = ?
             OR EXISTS (
@@ -370,13 +365,31 @@ const emailOtpRegistrationAttemptRows = {
 		walletId,
 		walletId
 	]),
-	delete: (prepare, attemptId) => prepare(`DELETE FROM email_otp_registration_attempts
+	deleteUnclaimed: (prepare, attemptId) => prepare(`DELETE FROM email_otp_registration_attempts
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
-          AND attempt_id = ?`, [attemptId])
+          AND attempt_id = ?
+          AND selection_digest IS NULL`, [attemptId])
 };
+function registrationAttemptValues(record) {
+	return [
+		record.attemptId,
+		record.providerSubject,
+		record.email,
+		record.walletId,
+		record.state,
+		record.ownerProofBindingDigest,
+		record.runtimePolicyScope?.orgId || "",
+		runtimePolicyScopeKey(record.runtimePolicyScope),
+		offerWalletIdsJson(record.offerCandidates),
+		JSON.stringify(record),
+		record.createdAtMs,
+		record.updatedAtMs,
+		record.expiresAtMs
+	];
+}
 //#endregion
 export { emailOtpAuthStateRows, emailOtpChallengeRows, emailOtpGrantRows, emailOtpRegistrationAttemptRows, emailOtpUnlockChallengeRows, emailOtpWalletEnrollmentRows };
 

package/dist/esm/core/keyMaterialBrands.js

@@ -1,12 +1,2 @@
-import { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEd25519RelayerKeyId, parseNonEmptyBrand, parseSigningSessionSealKeyVersion } from "../shared-ts/src/threshold/keyMaterialBrands.js";
-//#region src/core/keyMaterialBrands.ts
-function parseEcdsaThresholdKeyId(value) {
-	return parseNonEmptyBrand(value, "ECDSA threshold key id");
-}
-function formatEd25519ClientVerifyingShareB64uForWire(value) {
-	return value;
-}
-//#endregion
-export { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519ClientVerifyingShareB64uForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEcdsaThresholdKeyId, parseEd25519RelayerKeyId, parseSigningSessionSealKeyVersion };
-
-//# sourceMappingURL=keyMaterialBrands.js.map
+import { formatEcdsaKeyHandleForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseSigningSessionSealKeyVersion } from "../shared-ts/src/threshold/keyMaterialBrands.js";
+export { formatEcdsaKeyHandleForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseSigningSessionSealKeyVersion };

package/dist/esm/core/nearKeys.js

@@ -1,5 +1,4 @@
 import { ensureEd25519Prefix } from "../shared-ts/src/utils/near.js";
-import "../shared-ts/src/utils/validation.js";
 import bs58 from "bs58";
 //#region src/core/nearKeys.ts
 function stripEd25519Prefix(value) {

package/dist/esm/core/nearRelayerAccountProvisioning.js

@@ -2,17 +2,17 @@ import { base64UrlDecode, base64UrlEncode } from "../shared-ts/src/utils/base64.
 import { sha256Bytes } from "../shared-ts/src/utils/digests.js";
 import { base58Encode } from "../shared-ts/src/utils/base58.js";
 import "../shared-ts/src/utils/encoders.js";
-import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId, parseNamedNearAccountId } from "../shared-ts/src/utils/near.js";
 import { coerceNonEmptyString, requireRecordOrArray } from "../shared-ts/src/utils/validation.js";
 import { failure } from "../shared-ts/src/utils/failure.js";
 import { ActionType, validateActionArgsWasm } from "../shared-ts/src/near/actions.js";
+import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId, parseNamedNearAccountId } from "../shared-ts/src/utils/near.js";
 import { errorMessage } from "../shared-ts/src/utils/errors.js";
+import { threshold_ed25519_build_near_tx_unsigned_borsh, threshold_ed25519_decode_signed_near_tx_borsh, threshold_ed25519_finalize_near_tx_from_signature } from "../wasm/near_signer/pkg/wasm_signer_worker.js";
 import { toPublicKeyStringFromSecretKey } from "./nearKeys.js";
-import { SignedTransaction } from "../shared-ts/src/near/nearClient.js";
-import { MinimalNearClient, NearRpcError } from "./rpcClients/near/NearClient.js";
 import { requireFinalizeNearTxFromSignatureOutput, requireSingleUnsignedNearTxBorshOutput, signNearDigestWithSecretKey } from "./authService/nearPrivateKeySigning.js";
-import { threshold_ed25519_build_near_tx_unsigned_borsh, threshold_ed25519_decode_signed_near_tx_borsh, threshold_ed25519_finalize_near_tx_from_signature } from "../wasm/near_signer/pkg/wasm_signer_worker.js";
 import { ensureNearSignerWasm } from "./nearSignerWasmRuntime.js";
+import { SignedTransaction } from "../shared-ts/src/near/nearClient.js";
+import { MinimalNearClient, NearRpcError } from "./rpcClients/near/NearClient.js";
 //#region src/core/nearRelayerAccountProvisioning.ts
 /**
 * A plain funding transfer only has to be executed before the client can read
@@ -73,8 +73,7 @@ function requireDecodedSponsoredNearAccountCreation(value, signedTransactionBors
 					permission: "FullAccess"
 				}
 			} }
-		],
-		signedTransactionBorshB64u
+		]
 	};
 }
 function parsePositiveYocto(value, label) {
@@ -310,11 +309,9 @@ async function prepareSponsoredNearAccountCreationWithRelayer(input) {
 			}
 		};
 	} catch (error) {
-		const message = errorMessage(error) || "Failed to prepare NEAR account creation";
 		return {
 			ok: false,
-			error: message,
-			message
+			message: errorMessage(error) || "Failed to prepare NEAR account creation"
 		};
 	}
 }

package/dist/esm/core/passkeyCredentialClaims.js

@@ -0,0 +1,8 @@
+//#region src/core/passkeyCredentialClaims.ts
+async function reservePasskeyCredential(claims, input) {
+	if (claims && !await claims.claim(input)) throw new Error("Passkey credential belongs to another wallet or home");
+}
+//#endregion
+export { reservePasskeyCredential };
+
+//# sourceMappingURL=passkeyCredentialClaims.js.map

package/dist/esm/core/routerAbSigning/RouterAbEcdsaPresignRuntime.js

@@ -1,12 +1,9 @@
-import { coerceThresholdNodeRole, parseThresholdEd25519ParticipantIds2p } from "../ThresholdService/config.js";
+import { parseThresholdEd25519ParticipantIds2p } from "../ThresholdService/config.js";
 import { exportRouterAbLinkedDeviceEcdsaShare, startRouterAbLinkedDeviceEcdsaPresignSession, stepRouterAbLinkedDeviceEcdsaPresignSession } from "../ThresholdService/routerAb/ecdsaDerivationPresignBridge.js";
 import { RouterAbEcdsaDerivationPoolFillHandlers } from "../ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.js";
 //#region src/core/routerAbSigning/RouterAbEcdsaPresignRuntime.ts
 function parseRouterAbEcdsaPresignRuntimeConfig(input) {
-	return {
-		nodeRole: coerceThresholdNodeRole(input.THRESHOLD_NODE_ROLE),
-		participantIds: parseThresholdEd25519ParticipantIds2p(input)
-	};
+	return { participantIds: parseThresholdEd25519ParticipantIds2p(input) };
 }
 function routerAbEcdsaPresignGlobalFetch(input, init) {
 	return globalThis.fetch(input, init);
@@ -24,7 +21,6 @@ var RouterAbEcdsaPresignRuntime = class {
 	constructor(input) {
 		this.signingWorkerTransport = resolveSigningWorkerTransport(input.signingWorkerTransport);
 		this.handlers = new RouterAbEcdsaDerivationPoolFillHandlers({
-			nodeRole: input.config.nodeRole,
 			participantIds2p: input.config.participantIds.participantIds2p,
 			ensureReady: input.ensureReady,
 			signingWorkerTransport: this.signingWorkerTransport

package/dist/esm/core/routerAbSigning/RouterAbNormalSigningRuntime.js

@@ -1,35 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
 import { MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS } from "../../shared-ts/src/threshold/sessionPolicy.js";
-import { parseRouterAbNormalSigningServerPolicy, validateRouterAbNormalSigningServerPolicy } from "../ThresholdService/routerAbNormalSigningPolicy.js";
+import { validateRouterAbNormalSigningServerPolicy } from "../ThresholdService/routerAbNormalSigningPolicy.js";
 //#region src/core/routerAbSigning/RouterAbNormalSigningRuntime.ts
-function requireRouterAbConfiguredSigningWorkerPrivateTransport(transport) {
-	if (transport.kind !== "configured") throw new Error("InvalidLocalServiceConfig: ROUTER_AB_SIGNING_WORKER_URL and ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET are required for Router A/B ECDSA presign");
-	return transport;
-}
-function parseSigningWorkerTransport(config) {
-	const signingWorkerBaseUrl = normalizeOptionalTrimmedString(config.ROUTER_AB_SIGNING_WORKER_URL);
-	const secret = normalizeOptionalTrimmedString(config.ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET);
-	const fetchImpl = typeof config.routerAbSigningWorkerFetch === "function" ? config.routerAbSigningWorkerFetch : void 0;
-	if (!signingWorkerBaseUrl && !secret) return { kind: "unconfigured" };
-	if (!signingWorkerBaseUrl) throw new Error("ROUTER_AB_SIGNING_WORKER_URL is required when Router A/B internal service auth is configured");
-	if (!secret) throw new Error("ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET is required when Router A/B SigningWorker URL is configured");
-	return {
-		kind: "configured",
-		signingWorkerBaseUrl,
-		auth: {
-			kind: "internal_service_auth_secret",
-			secret
-		},
-		...fetchImpl ? { fetchImpl } : {}
-	};
-}
-function parseRouterAbNormalSigningRuntimeConfig(config) {
-	return {
-		policy: parseRouterAbNormalSigningServerPolicy(config),
-		signingWorkerTransport: parseSigningWorkerTransport(config)
-	};
-}
 var RouterAbNormalSigningRuntime = class {
 	constructor(input) {
 		this.walletSessionStore = input.walletSessionStore;
@@ -96,6 +68,6 @@ var RouterAbNormalSigningRuntime = class {
 	}
 };
 //#endregion
-export { RouterAbNormalSigningRuntime, parseRouterAbNormalSigningRuntimeConfig, requireRouterAbConfiguredSigningWorkerPrivateTransport };
+export { RouterAbNormalSigningRuntime };
 
 //# sourceMappingURL=RouterAbNormalSigningRuntime.js.map

package/dist/esm/core/thresholdEcdsaChainTarget.js

@@ -32,10 +32,7 @@ function thresholdEcdsaChainTargetFromValue(value) {
 	}
 	return null;
 }
-function thresholdEcdsaChainTargetsEqual(left, right) {
-	return thresholdEcdsaChainTargetKey(left) === thresholdEcdsaChainTargetKey(right);
-}
 //#endregion
-export { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual };
+export { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey };
 
 //# sourceMappingURL=thresholdEcdsaChainTarget.js.map