@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/shared-ts/src/signing-lanes/participants.js

@@ -1,7 +1,4 @@
-import { hasWhitespaceOrControlCharacters } from "../utils/domainIds.js";
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { requireRecord } from "../utils/validation.js";
 //#region ../shared-ts/src/signing-lanes/participants.ts
 function missing(field) {
 	return {
@@ -15,55 +12,6 @@ function invalid(field, reason) {
 		message: `${field} ${reason}`
 	};
 }
-function parseIdentityId(raw, field) {
-	if (raw === void 0 || raw === null) return {
-		ok: false,
-		error: missing(field)
-	};
-	if (typeof raw !== "string") return {
-		ok: false,
-		error: invalid(field, "must be a string")
-	};
-	const value = raw.trim();
-	if (!value) return {
-		ok: false,
-		error: missing(field)
-	};
-	if (hasWhitespaceOrControlCharacters(value)) return {
-		ok: false,
-		error: invalid(field, "must not contain whitespace or control characters")
-	};
-	return {
-		ok: true,
-		value
-	};
-}
-function parseHpkePublicKey(raw, field) {
-	if (raw === void 0 || raw === null) return {
-		ok: false,
-		error: missing(field)
-	};
-	if (typeof raw !== "string" || raw.length === 0) return {
-		ok: false,
-		error: invalid(field, "must be non-empty base64url")
-	};
-	try {
-		const bytes = base64UrlDecode(raw);
-		if (bytes.length === 0 || base64UrlEncode(bytes) !== raw) return {
-			ok: false,
-			error: invalid(field, "must be canonical unpadded base64url")
-		};
-	} catch {
-		return {
-			ok: false,
-			error: invalid(field, "must be canonical unpadded base64url")
-		};
-	}
-	return {
-		ok: true,
-		value: raw
-	};
-}
 function parseDigest(raw, field, brand) {
 	if (raw === void 0 || raw === null) return {
 		ok: false,
@@ -81,179 +29,13 @@ function parseDigest(raw, field, brand) {
 		};
 	}
 }
-function brandLaneCustodyDigest(value) {
-	return value;
-}
-function brandRecipientDigest(value) {
-	return value;
-}
 function brandParticipantDigest(value) {
 	return value;
 }
-function rejectUnknownFields(record, fields, label) {
-	const allowed = new Set(fields);
-	for (const field of Object.keys(record)) if (!allowed.has(field)) throw new Error(`${label}.${field} is not supported`);
-	for (const field of fields) if (!(field in record)) throw new Error(`${label}.${field} is required`);
-}
-function parseLaneHolderParticipantId(raw) {
-	return parseIdentityId(raw, "laneHolderParticipantId");
-}
-function parseSigningWorkerParticipantId(raw) {
-	return parseIdentityId(raw, "signingWorkerParticipantId");
-}
-function parseSigningWorkerRecipientKeyId(raw) {
-	return parseIdentityId(raw, "signingWorkerRecipientKeyId");
-}
-function parseLaneHolderCustodyBindingId(raw) {
-	return parseIdentityId(raw, "laneHolderCustodyBindingId");
-}
-function parseHpkePublicKeyB64u(raw) {
-	return parseHpkePublicKey(raw, "hpkePublicKeyB64u");
-}
 function parseLaneParticipantBindingDigestB64u(raw) {
 	return parseDigest(raw, "participantBindingDigestB64u", brandParticipantDigest);
 }
-function parseLaneCustodyBindingDigestB64u(raw) {
-	return parseDigest(raw, "custodyBindingDigestB64u", brandLaneCustodyDigest);
-}
-function parseSigningWorkerRecipientKeyDigestB64u(raw) {
-	return parseDigest(raw, "hpkePublicKeyDigestB64u", brandRecipientDigest);
-}
-function buildLaneHolderCustodyIdentityV1(args) {
-	return {
-		kind: "lane_holder_custody_identity_v1",
-		custodyBindingId: args.custodyBindingId,
-		custodyBindingDigestB64u: args.custodyBindingDigestB64u
-	};
-}
-function buildSigningWorkerRecipientIdentityV1(args) {
-	return {
-		kind: "signing_worker_recipient_identity_v1",
-		recipientKeyId: args.recipientKeyId,
-		hpkePublicKeyB64u: args.hpkePublicKeyB64u,
-		hpkePublicKeyDigestB64u: args.hpkePublicKeyDigestB64u
-	};
-}
-function parseLaneHolderCustodyIdentityV1(raw, label = "laneHolderCustodyIdentity") {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, [
-		"kind",
-		"custodyBindingId",
-		"custodyBindingDigestB64u"
-	], label);
-	if (record.kind !== "lane_holder_custody_identity_v1") throw new Error(`${label}.kind is invalid`);
-	const custodyBindingId = parseLaneHolderCustodyBindingId(record.custodyBindingId);
-	if (!custodyBindingId.ok) throw new Error(`${label}.${custodyBindingId.error.message}`);
-	const custodyBindingDigestB64u = parseLaneCustodyBindingDigestB64u(record.custodyBindingDigestB64u);
-	if (!custodyBindingDigestB64u.ok) throw new Error(`${label}.${custodyBindingDigestB64u.error.message}`);
-	return buildLaneHolderCustodyIdentityV1({
-		custodyBindingId: custodyBindingId.value,
-		custodyBindingDigestB64u: custodyBindingDigestB64u.value
-	});
-}
-function parseSigningWorkerRecipientIdentityV1(raw, label = "signingWorkerRecipientIdentity") {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, [
-		"kind",
-		"recipientKeyId",
-		"hpkePublicKeyB64u",
-		"hpkePublicKeyDigestB64u"
-	], label);
-	if (record.kind !== "signing_worker_recipient_identity_v1") throw new Error(`${label}.kind is invalid`);
-	const recipientKeyId = parseSigningWorkerRecipientKeyId(record.recipientKeyId);
-	if (!recipientKeyId.ok) throw new Error(`${label}.${recipientKeyId.error.message}`);
-	const hpkePublicKeyB64u = parseHpkePublicKey(record.hpkePublicKeyB64u, `${label}.hpkePublicKeyB64u`);
-	if (!hpkePublicKeyB64u.ok) throw new Error(hpkePublicKeyB64u.error.message);
-	const hpkePublicKeyDigestB64u = parseSigningWorkerRecipientKeyDigestB64u(record.hpkePublicKeyDigestB64u);
-	if (!hpkePublicKeyDigestB64u.ok) throw new Error(`${label}.${hpkePublicKeyDigestB64u.error.message}`);
-	return buildSigningWorkerRecipientIdentityV1({
-		recipientKeyId: recipientKeyId.value,
-		hpkePublicKeyB64u: hpkePublicKeyB64u.value,
-		hpkePublicKeyDigestB64u: hpkePublicKeyDigestB64u.value
-	});
-}
-function buildLaneHolderParticipantRecordV1(args) {
-	return {
-		kind: "lane_holder_participant_v1",
-		participantId: args.participantId,
-		custodyBindingId: args.custody.custodyBindingId,
-		custodyBindingDigestB64u: args.custody.custodyBindingDigestB64u,
-		hpkePublicKeyB64u: args.hpkePublicKeyB64u,
-		hpkePublicKeyDigestB64u: args.hpkePublicKeyDigestB64u,
-		participantBindingDigestB64u: args.participantBindingDigestB64u
-	};
-}
-function buildSigningWorkerParticipantRecordV1(args) {
-	return {
-		kind: "signing_worker_participant_v1",
-		participantId: args.participantId,
-		recipientKeyId: args.recipient.recipientKeyId,
-		hpkePublicKeyB64u: args.recipient.hpkePublicKeyB64u,
-		hpkePublicKeyDigestB64u: args.recipient.hpkePublicKeyDigestB64u,
-		participantBindingDigestB64u: args.participantBindingDigestB64u
-	};
-}
-function parseLaneHolderParticipantRecordV1(raw, label = "laneHolderParticipant") {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, [
-		"kind",
-		"participantId",
-		"custodyBindingId",
-		"custodyBindingDigestB64u",
-		"hpkePublicKeyB64u",
-		"hpkePublicKeyDigestB64u",
-		"participantBindingDigestB64u"
-	], label);
-	if (record.kind !== "lane_holder_participant_v1") throw new Error(`${label}.kind is invalid`);
-	const participantId = parseLaneHolderParticipantId(record.participantId);
-	if (!participantId.ok) throw new Error(`${label}.${participantId.error.message}`);
-	const custody = parseLaneHolderCustodyIdentityV1({
-		kind: "lane_holder_custody_identity_v1",
-		custodyBindingId: record.custodyBindingId,
-		custodyBindingDigestB64u: record.custodyBindingDigestB64u
-	}, `${label}.custody`);
-	const hpkePublicKeyB64u = parseHpkePublicKey(record.hpkePublicKeyB64u, `${label}.hpkePublicKeyB64u`);
-	if (!hpkePublicKeyB64u.ok) throw new Error(hpkePublicKeyB64u.error.message);
-	const hpkePublicKeyDigestB64u = parseSigningWorkerRecipientKeyDigestB64u(record.hpkePublicKeyDigestB64u);
-	if (!hpkePublicKeyDigestB64u.ok) throw new Error(`${label}.${hpkePublicKeyDigestB64u.error.message}`);
-	const participantBindingDigestB64u = parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u);
-	if (!participantBindingDigestB64u.ok) throw new Error(`${label}.${participantBindingDigestB64u.error.message}`);
-	return buildLaneHolderParticipantRecordV1({
-		participantId: participantId.value,
-		custody,
-		hpkePublicKeyB64u: hpkePublicKeyB64u.value,
-		hpkePublicKeyDigestB64u: hpkePublicKeyDigestB64u.value,
-		participantBindingDigestB64u: participantBindingDigestB64u.value
-	});
-}
-function parseSigningWorkerParticipantRecordV1(raw, label = "signingWorkerParticipant") {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, [
-		"kind",
-		"participantId",
-		"recipientKeyId",
-		"hpkePublicKeyB64u",
-		"hpkePublicKeyDigestB64u",
-		"participantBindingDigestB64u"
-	], label);
-	if (record.kind !== "signing_worker_participant_v1") throw new Error(`${label}.kind is invalid`);
-	const participantId = parseSigningWorkerParticipantId(record.participantId);
-	if (!participantId.ok) throw new Error(`${label}.${participantId.error.message}`);
-	const recipient = parseSigningWorkerRecipientIdentityV1({
-		kind: "signing_worker_recipient_identity_v1",
-		recipientKeyId: record.recipientKeyId,
-		hpkePublicKeyB64u: record.hpkePublicKeyB64u,
-		hpkePublicKeyDigestB64u: record.hpkePublicKeyDigestB64u
-	}, `${label}.recipient`);
-	const participantBindingDigestB64u = parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u);
-	if (!participantBindingDigestB64u.ok) throw new Error(`${label}.${participantBindingDigestB64u.error.message}`);
-	return buildSigningWorkerParticipantRecordV1({
-		participantId: participantId.value,
-		recipient,
-		participantBindingDigestB64u: participantBindingDigestB64u.value
-	});
-}
 //#endregion
-export { buildLaneHolderParticipantRecordV1, buildSigningWorkerParticipantRecordV1, parseHpkePublicKeyB64u, parseLaneCustodyBindingDigestB64u, parseLaneHolderCustodyBindingId, parseLaneHolderParticipantId, parseLaneHolderParticipantRecordV1, parseLaneParticipantBindingDigestB64u, parseSigningWorkerParticipantId, parseSigningWorkerParticipantRecordV1, parseSigningWorkerRecipientKeyDigestB64u, parseSigningWorkerRecipientKeyId };
+export { parseLaneParticipantBindingDigestB64u };
 
 //# sourceMappingURL=participants.js.map

package/dist/esm/shared-ts/src/signing-lanes/recordParsers.js

@@ -1,8 +1,5 @@
 import { hasWhitespaceOrControlCharacters } from "../utils/domainIds.js";
-import "../utils/validation.js";
-import "../utils/exactRecord.js";
 import "../utils/registrationIds.js";
-import "./participants.js";
 import "./ownerContinuity.js";
 //#region ../shared-ts/src/signing-lanes/recordParsers.ts
 const WALLET_KEY_COMMON_FIELDS = [

package/dist/esm/shared-ts/src/tenant-root/tenantRootOperationRecord.js

@@ -8,8 +8,7 @@ import { isTenantRootIdentityFieldCanonicalV1 } from "./tenantRootIdentity.js";
 *
 * The console builds these records in TypeScript and the control plane
 * consumes their digests in Rust, so both sides must produce identical
-* canonical bytes. The encoding is pinned by the cross-runtime fixtures in
-* `crates/router-ab-core/tests/fixtures/tenant-root-operation`.
+* canonical bytes.
 *
 * A record is the unit of authorization: changing any field changes the
 * digest, so a capability minted for one record cannot be carried to another

package/dist/esm/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js

@@ -1,6 +1,5 @@
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { alphabetizeStringify, sha256Bytes, sha256BytesUtf8 } from "../utils/digests.js";
-import "../utils/encoders.js";
 import { deriveEvmFamilySigningKeySlotId } from "../signing-lanes/evmFamilySigningKeySlotId.js";
 //#region ../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.ts
 const THRESHOLD_SECP256K1_ECDSA_2P_V1_SCHEME_ID = "threshold-secp256k1-ecdsa-2p-v1";

package/dist/esm/shared-ts/src/threshold/keyMaterialBrands.js

@@ -4,46 +4,25 @@ function parseNonEmptyBrand(value, label) {
 	if (!normalized) throw new Error(`${label} must be a non-empty string`);
 	return normalized;
 }
-function parseEcdsaDerivationKeyVersion(value) {
-	return parseNonEmptyBrand(value, "ECDSA DERIVATION key version");
-}
 function parseSigningSessionSealKeyVersion(value) {
 	return parseNonEmptyBrand(value, "signing-session seal key version");
 }
 function parseEcdsaClientVerifyingShareB64u(value) {
 	return parseNonEmptyBrand(value, "ECDSA client verifying share");
 }
-function parseEd25519RelayerKeyId(value) {
-	return parseNonEmptyBrand(value, "Ed25519 relayer key id");
-}
 function parseEcdsaRelayerKeyId(value) {
 	return parseNonEmptyBrand(value, "ECDSA relayer key id");
 }
 function parseEcdsaKeyHandle(value) {
 	return parseNonEmptyBrand(value, "ECDSA key handle");
 }
-function formatEcdsaDerivationKeyVersionForWire(value) {
-	return value;
-}
 function formatSigningSessionSealKeyVersionForWire(value) {
 	return value;
 }
-function formatEcdsaClientVerifyingShareB64uForWire(value) {
-	return value;
-}
-function formatEd25519RelayerKeyIdForWire(value) {
-	return value;
-}
-function formatEcdsaRelayerKeyIdForWire(value) {
-	return value;
-}
-function formatEcdsaThresholdKeyIdForWire(value) {
-	return value;
-}
 function formatEcdsaKeyHandleForWire(value) {
 	return value;
 }
 //#endregion
-export { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEd25519RelayerKeyId, parseNonEmptyBrand, parseSigningSessionSealKeyVersion };
+export { formatEcdsaKeyHandleForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseSigningSessionSealKeyVersion };
 
 //# sourceMappingURL=keyMaterialBrands.js.map

package/dist/esm/shared-ts/src/threshold/participants.js

@@ -1,4 +1,3 @@
-import "../utils/validation.js";
 const THRESHOLD_ED25519_2P_PARTICIPANT_IDS = [1, 2];
 function normalizeThresholdEd25519ParticipantId(id) {
 	const n = Number(id);

package/dist/esm/shared-ts/src/threshold/signingRootScope.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../utils/normalize.js";
-import "../utils/validation.js";
 //#region ../shared-ts/src/threshold/signingRootScope.ts
 function requireScopeField(label, value) {
 	const normalized = normalizeOptionalTrimmedString(value);

package/dist/esm/shared-ts/src/utils/addWalletAuthMethod.js

@@ -1,4 +1,3 @@
-import "../authorization/capabilityKinds.js";
 //#region ../shared-ts/src/utils/addWalletAuthMethod.ts
 function unreachableAuthMethodFamily(value) {
 	throw new Error(`Unhandled wallet auth-method family: ${String(value)}`);
@@ -12,21 +11,13 @@ function unreachableAuthMethodFamily(value) {
 * which is why the operation needs no same-family rejection of its own.
 */
 function admitAddWalletAuthMethod(input) {
-	const present = input.activeMethodsOnAuthority.find((method) => method.kind === input.targetFamily);
-	if (present) return {
+	if (input.activeMethodsOnAuthority.find((method) => method.kind === input.targetFamily)) return {
 		kind: "already_configured",
-		family: input.targetFamily,
-		existingWalletAuthMethodId: present.walletAuthMethodId
+		family: input.targetFamily
 	};
 	switch (input.sourceMethod.kind) {
-		case "passkey": return {
-			kind: "proceed",
-			branch: "passkey_to_email_otp"
-		};
-		case "email_otp": return {
-			kind: "proceed",
-			branch: "email_otp_to_passkey"
-		};
+		case "passkey": return { kind: "proceed" };
+		case "email_otp": return { kind: "proceed" };
 		default: return unreachableAuthMethodFamily(input.sourceMethod);
 	}
 }

package/dist/esm/shared-ts/src/utils/canonicalPrimitives.js

@@ -16,12 +16,6 @@ function parseDigestB64u(value) {
 	if (bytes.length !== 32 || base64UrlEncode(bytes) !== value) throw new Error("digest must be canonical base64url for 32 bytes");
 	return value;
 }
-function parseIsoTimestamp(value) {
-	if (typeof value !== "string") throw new Error("timestamp must be an ISO timestamp");
-	const timestampMs = Date.parse(value);
-	if (!Number.isFinite(timestampMs) || new Date(timestampMs).toISOString() !== value) throw new Error("timestamp must be canonical ISO-8601 UTC");
-	return value;
-}
 async function sha256DigestB64u(bytes) {
 	return parseDigestB64u(base64UrlEncode(await sha256Bytes(bytes)));
 }
@@ -29,6 +23,6 @@ async function sha256Utf8DigestB64u(text) {
 	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(text)));
 }
 //#endregion
-export { parseCorrelationId, parseDigestB64u, parseIsoTimestamp, sha256DigestB64u, sha256Utf8DigestB64u };
+export { parseCorrelationId, parseDigestB64u, sha256DigestB64u, sha256Utf8DigestB64u };
 
 //# sourceMappingURL=canonicalPrimitives.js.map

package/dist/esm/shared-ts/src/utils/domainIds.js

@@ -121,9 +121,6 @@ function parseChallengeSubjectId(raw) {
 function parseEmailOtpChallengeId(raw) {
 	return parseDomainId(raw, "emailOtpChallengeId");
 }
-function parseEmailOtpRegistrationAttemptId(raw) {
-	return parseDomainId(raw, "emailOtpRegistrationAttemptId");
-}
 function parseOrgId(raw) {
 	return parseDomainId(raw, "orgId");
 }
@@ -279,24 +276,12 @@ function parseLaneShareEpoch(raw) {
 function parseLinkedDeviceId(raw) {
 	return parseDomainId(raw, "linkedDeviceId");
 }
-function parseLaneOperationId(raw) {
-	return parseDomainId(raw, "laneOperationId");
-}
-function parseLaneEnrollmentId(raw) {
-	return parseDomainId(raw, "laneEnrollmentId");
-}
-function parseLaneOperationIdempotencyKey(raw) {
-	return parseDomainId(raw, "laneOperationIdempotencyKey");
-}
 function parseLinkedDeviceEnrollmentId(raw) {
 	return parseDomainId(raw, "linkedDeviceEnrollmentId");
 }
 function parseWalletRecoveryOperationId(raw) {
 	return parseDomainId(raw, "walletRecoveryOperationId");
 }
-function parseEd25519YaoSuiteId(raw) {
-	return parseDomainId(raw, "ed25519YaoSuiteId");
-}
 function parseEcdsaRelayerKeyId(raw) {
 	return parseDomainId(raw, "ecdsaRelayerKeyId");
 }
@@ -304,6 +289,6 @@ function parseLinkDeviceSessionId(raw) {
 	return parseDomainId(raw, "linkDeviceSessionId");
 }
 //#endregion
-export { buildMpcMaterialActivationRef, hasControlCharacter, hasWhitespaceOrControlCharacters, mpcMaterialActivationRefsEqual, parseChallengeSubjectId, parseEcdsaActiveStateId, parseEcdsaRelayerKeyId, parseEd25519YaoSuiteId, parseEmailOtpChallengeId, parseEmailOtpProviderUserId, parseEmailOtpRegistrationAttemptId, parseGoogleProviderSubject, parseLaneEnrollmentId, parseLaneOperationId, parseLaneOperationIdempotencyKey, parseLaneShareEpoch, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationId, parseMpcMaterialActivationRef, parseMpcSigningWorkerRef, parseOrgId, parsePasskeyEnvelopeId, parseProviderSubject, parseRootShareEpoch, parseSigningLaneId, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseThresholdSessionId, parseVerifiedEmailAddress, parseVerifiedGoogleEmail, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId };
+export { buildMpcMaterialActivationRef, hasControlCharacter, hasWhitespaceOrControlCharacters, mpcMaterialActivationRefsEqual, parseChallengeSubjectId, parseEcdsaActiveStateId, parseEcdsaRelayerKeyId, parseEmailOtpChallengeId, parseEmailOtpProviderUserId, parseGoogleProviderSubject, parseLaneShareEpoch, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationId, parseMpcMaterialActivationRef, parseMpcSigningWorkerRef, parseOrgId, parsePasskeyEnvelopeId, parseProviderSubject, parseRootShareEpoch, parseSigningLaneId, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseThresholdSessionId, parseVerifiedEmailAddress, parseVerifiedGoogleEmail, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId };
 
 //# sourceMappingURL=domainIds.js.map

package/dist/esm/shared-ts/src/utils/ecdsaCapabilityActivation.js

@@ -7,16 +7,6 @@ function parseNonEmptyString(value, label) {
 function parseEcdsaServerGeneration(value) {
 	return parseNonEmptyString(value, "ECDSA server generation");
 }
-function parseEcdsaCapabilityManifestId(value) {
-	return parseNonEmptyString(value, "ECDSA manifest id");
-}
-function parseEcdsaCapabilityManifestRevision(value) {
-	if (!Number.isSafeInteger(value) || Number(value) < 1) throw new Error("ECDSA manifest revision must be a positive safe integer");
-	return value;
-}
-function parseEcdsaLifecycleId(value) {
-	return parseNonEmptyString(value, "ECDSA lifecycle id");
-}
 function parseCanonicalEcdsaServerActivationRequest(value) {
 	if (typeof value !== "string" || value.trim() !== value) throw new Error("ECDSA server activation request must be canonical JSON");
 	let parsed;
@@ -29,6 +19,6 @@ function parseCanonicalEcdsaServerActivationRequest(value) {
 	return value;
 }
 //#endregion
-export { parseCanonicalEcdsaServerActivationRequest, parseEcdsaCapabilityManifestId, parseEcdsaCapabilityManifestRevision, parseEcdsaLifecycleId, parseEcdsaServerGeneration };
+export { parseCanonicalEcdsaServerActivationRequest, parseEcdsaServerGeneration };
 
 //# sourceMappingURL=ecdsaCapabilityActivation.js.map

package/dist/esm/shared-ts/src/utils/ecdsaKeyFactsInventory.js

@@ -1,6 +1,5 @@
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
-import "./encoders.js";
 import { thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
 //#region ../shared-ts/src/utils/ecdsaKeyFactsInventory.ts
 function normalizeChainTarget(target) {

package/dist/esm/shared-ts/src/utils/errors.js

@@ -1,4 +1,3 @@
-import "./near.js";
 //#region ../shared-ts/src/utils/errors.ts
 /**
 * Best-effort error message extractor without relying on `any`.
@@ -17,24 +16,7 @@ function b64uField(prefix) {
 	return `${prefix}B64u`;
 }
 b64uField("seed"), b64uField("canonicalSeed"), b64uField("xClientBase"), b64uField("clientOutputMask"), b64uField("clientRecoverableSecret"), b64uField("prfFirst"), b64uField("prfSecond"), b64uField("signingShare32"), b64uField("clientNonceHandle");
-/**
-* Normalize any thrown value into an Error instance.
-* - preserves message/name/stack when available
-* - best-effort copies optional code/details properties if present
-*/
-function toError(e) {
-	if (e instanceof Error) return e;
-	const err = new Error(errorMessage(e));
-	try {
-		const src = e;
-		if (typeof src?.name === "string") err.name = src.name;
-		if (typeof src?.stack === "string") err.stack = src.stack;
-		if (src && typeof src.code !== "undefined") err.code = src.code;
-		if (src && typeof src.details !== "undefined") err.details = src.details;
-	} catch {}
-	return err;
-}
 //#endregion
-export { errorMessage, toError };
+export { errorMessage };
 
 //# sourceMappingURL=errors.js.map

package/dist/esm/shared-ts/src/utils/near.js

@@ -94,6 +94,6 @@ function deriveImplicitNearAccountIdFromEd25519PublicKey(publicKey) {
 	return bytesToLowerHex(decoded);
 }
 //#endregion
-export { deriveImplicitNearAccountIdFromEd25519PublicKey, ensureEd25519Prefix, isValidAccountId, parseImplicitNearAccountId, parseNamedNearAccountId, parseNearAccountId };
+export { deriveImplicitNearAccountIdFromEd25519PublicKey, ensureEd25519Prefix, parseImplicitNearAccountId, parseNamedNearAccountId, parseNearAccountId };
 
 //# sourceMappingURL=near.js.map

package/dist/esm/shared-ts/src/utils/registrationEstablishedSession.js

@@ -1,12 +1,12 @@
 import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseWalletId } from "./domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
-import { parseNearAccountId } from "./near.js";
 import { parseActiveWalletSessionV1 } from "../device-linking/activeWalletSession.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "./routerAbNormalSigningIdentity.js";
 import { normalizeRuntimePolicyScope } from "../threshold/signingRootScope.js";
 import { parseRouterAbEcdsaDerivationNormalSigningStateV1 } from "./routerAbEcdsaDerivation.js";
 import { parseRouterAbEd25519NormalSigningState } from "./signingSessionSeal.js";
 import { parseNearEd25519SigningKeyId } from "./registrationIds.js";
+import { parseNearAccountId } from "./near.js";
 import { parseThresholdEcdsaKeyHandle } from "./thresholdEcdsaKeyHandle.js";
 //#region ../shared-ts/src/utils/registrationEstablishedSession.ts
 function registrationSessionTokensMatchCapabilities(walletSession, tokens) {

package/dist/esm/shared-ts/src/utils/registrationIds.js

@@ -1,7 +1,6 @@
 import { parseEmailOtpProviderUserId, parseWalletId } from "./domainIds.js";
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
-import "./encoders.js";
 //#region ../shared-ts/src/utils/registrationIds.ts
 function walletIdFromString(value) {
 	const parsed = parseWalletId(value);
@@ -161,10 +160,7 @@ function parseServerAllocatedWalletId(raw) {
 	const suffix = match?.[3] || "";
 	if (!match || !SERVER_ALLOCATED_WALLET_ADJECTIVE_SET.has(adjective) || !SERVER_ALLOCATED_WALLET_NOUN_SET.has(noun) || !serverAllocatedWalletSuffixIsValid(suffix)) return {
 		ok: false,
-		error: {
-			code: "invalid",
-			message: "server-allocated walletId must match the approved readable word-word-suffix allocation format"
-		}
+		error: { message: "server-allocated walletId must match the approved readable word-word-suffix allocation format" }
 	};
 	return {
 		ok: true,

package/dist/esm/shared-ts/src/utils/registrationIntent.js

@@ -1,7 +1,6 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId } from "./domainIds.js";
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
-import "./encoders.js";
 import { inspectRawObject, trimString } from "./registrationAuthMethodInput.js";
 import "./registrationSignerPlan.js";
 //#region ../shared-ts/src/utils/registrationIntent.ts

package/dist/esm/shared-ts/src/utils/registrationSetupOperation.js

@@ -0,0 +1,8 @@
+//#region ../shared-ts/src/utils/registrationSetupOperation.ts
+function parseRegistrationSetupOperationId(value) {
+	return typeof value === "string" && /^wreg_[A-Za-z0-9_-]{43}$/u.test(value) ? value : null;
+}
+//#endregion
+export { parseRegistrationSetupOperationId };
+
+//# sourceMappingURL=registrationSetupOperation.js.map

package/dist/esm/shared-ts/src/utils/registrationSignerPlan.js

@@ -1,6 +1,6 @@
 import { alphabetizeStringify } from "./digests.js";
-import { parseNamedNearAccountId } from "./near.js";
 import { inspectRawObject, trimString } from "./registrationAuthMethodInput.js";
+import { parseNamedNearAccountId } from "./near.js";
 //#region ../shared-ts/src/utils/registrationSignerPlan.ts
 function normalizePositiveInteger(raw, fallback) {
 	const value = typeof raw === "number" ? raw : Number(raw);

package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js

@@ -3,7 +3,6 @@ import { EVM_ECDSA_MPC_OPERATION_KINDS, parseEcdsaAuthorizationSessionId, parseM
 import { base64UrlDecode, base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
 import { parseCorrelationId } from "./canonicalPrimitives.js";
-import "./encoders.js";
 import { requireRecord } from "./validation.js";
 import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../device-linking/activeWalletSession.js";
 import { requireRouterAbX25519PublicKey } from "./routerAbPublicKeyset.js";

package/dist/esm/shared-ts/src/utils/validation.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "./normalize.js";
-import "./near.js";
 //#region ../shared-ts/src/utils/validation.ts
 function requireTrimmedString(value, label, message = "is required") {
 	const parsed = normalizeOptionalTrimmedString(value);
@@ -24,9 +23,6 @@ function isObject(x) {
 function isPlainObject(x) {
 	return isObject(x) && !Array.isArray(x);
 }
-function isString(x) {
-	return typeof x === "string";
-}
 function isFunction(x) {
 	return typeof x === "function";
 }
@@ -49,6 +45,6 @@ function requireArray(value, label) {
 	return value;
 }
 //#endregion
-export { asRecord, coerceNonEmptyString, isFunction, isObject, isPlainObject, isString, requireArray, requireCanonicalString, requireNonEmptyString, requireRecord, requireRecordCopy, requireRecordOrArray, requireTrimmedString };
+export { asRecord, coerceNonEmptyString, isFunction, isObject, isPlainObject, requireArray, requireCanonicalString, requireNonEmptyString, requireRecord, requireRecordCopy, requireRecordOrArray, requireTrimmedString };
 
 //# sourceMappingURL=validation.js.map

package/dist/esm/shared-ts/src/utils/walletAuthAuthority.js

@@ -1,7 +1,6 @@
 import { parseEmailOtpProviderUserId, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "./domainIds.js";
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
-import "./encoders.js";
 //#region ../shared-ts/src/utils/walletAuthAuthority.ts
 const WALLET_AUTHORITY_BINDING_DIGEST_DOMAIN = "seams:wallet-authority-binding:v1|";
 function isPasskeyWalletAuthAuthority(authority) {

package/dist/esm/shared-ts/src/utils/walletManagementProtocol.js

@@ -0,0 +1,6 @@
+//#region ../shared-ts/src/utils/walletManagementProtocol.ts
+const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
+//#endregion
+export { WALLET_MANAGEMENT_PROTOCOL_HEADER };
+
+//# sourceMappingURL=walletManagementProtocol.js.map

package/dist/esm/shared-ts/src/utils/wireSchema.js

@@ -1,4 +1,4 @@
-import { requireArray, requireRecord } from "./validation.js";
+import { requireRecord } from "./validation.js";
 import { exactRecord } from "./exactRecord.js";
 //#region ../shared-ts/src/utils/wireSchema.ts
 /** One of the given strings. */
@@ -42,17 +42,6 @@ function wireUnion(tag, variants) {
 function wireNullable(parse) {
 	return (raw, label) => raw === null ? null : parse(raw, label);
 }
-/** A non-empty array of `item`; `refine` checks rules that span the items. */
-function wireNonEmptyArray(item, refine) {
-	return (raw, label) => {
-		const entries = requireArray(raw, label);
-		if (entries.length === 0) throw new Error(`${label} must be non-empty`);
-		const [first, ...rest] = entries.map((entry, index) => item(entry, `${label}[${index}]`));
-		const items = [first, ...rest];
-		refine?.(items, label);
-		return items;
-	};
-}
 /** Adapts a parser that returns a result, putting the field's label before its error. */
 function wireResult(parse) {
 	return (raw, label) => {
@@ -72,6 +61,6 @@ function wireLabeled(parse) {
 	};
 }
 //#endregion
-export { wireLabeled, wireLiteral, wireNonEmptyArray, wireNullable, wireObject, wireResult, wireUnion };
+export { wireLabeled, wireLiteral, wireNullable, wireObject, wireResult, wireUnion };
 
 //# sourceMappingURL=wireSchema.js.map