@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/shared-ts/src/device-linking/contracts.js

@@ -1,8 +1,23 @@
 //#region ../shared-ts/src/device-linking/contracts.ts
+function isLinkSessionTerminalFailureV1(state) {
+	switch (state.state) {
+		case "failed_before_commit":
+		case "cancelled":
+		case "expired": return true;
+		case "displaying_qr":
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning":
+		case "authority_pending_local_install":
+		case "active": return false;
+		default: return assertNeverLinkSessionStateV1(state);
+	}
+}
 function assertNeverLinkSessionStateV1(value) {
 	throw new Error(`[LinkSessionStateV1] unsupported state: ${String(value)}`);
 }
 //#endregion
-export { assertNeverLinkSessionStateV1 };
+export { assertNeverLinkSessionStateV1, isLinkSessionTerminalFailureV1 };
 
 //# sourceMappingURL=contracts.js.map

package/dist/esm/shared-ts/src/device-linking/digests.js

@@ -1,6 +1,6 @@
+import { delegatedWalletPermissionNamesV1 } from "../authorization/delegatedAuthority.js";
 import { alphabetizeStringify } from "../utils/digests.js";
 import { sha256DigestB64u, sha256Utf8DigestB64u } from "../utils/canonicalPrimitives.js";
-import { delegatedWalletPermissionNamesV1 } from "../authorization/delegatedAuthority.js";
 import { concat, lp32, rawDigest, rawPublicKey, text, u32, u64 } from "../utils/digestEncoding.js";
 import "./committedSignerPackages.js";
 //#region ../shared-ts/src/device-linking/digests.ts
@@ -10,13 +10,6 @@ const TARGET_PREPARATION_DOMAIN = "seams/linked-device/target-preparation/v1";
 const TARGET_PASSKEY_CONFIGURATION_DOMAIN = "seams/linked-device/passkey-target-configuration/v1";
 const LOCAL_AUTHORITY_INSTALLATION_RECEIPT_DOMAIN = "seams/linked-device/local-authority-installation-receipt/v1";
 const TEXT_ENCODER = new TextEncoder();
-/**
-* The server stores this digest alongside the authorization. Hashing the
-* opaque token directly keeps the browser binding identical to that row.
-*/
-async function computeWalletSessionOperationCredentialDigestB64u(credential) {
-	return sha256Utf8DigestB64u(credential.token);
-}
 function encodeWalletSessionInstallationReceiptV1(receipt) {
 	return alphabetizeStringify({
 		domain: LOCAL_AUTHORITY_INSTALLATION_RECEIPT_DOMAIN,
@@ -213,6 +206,6 @@ async function assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV
 	}
 }
 //#endregion
-export { assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1, computeLinkedDeviceApprovalDigestV1, computeLinkedDevicePasskeyTargetConfigurationDigestV1, computeLinkedDeviceSessionClaimDigestV1, computeLinkedDeviceTargetPreparationDigestV1, computeWalletSessionInstallationReceiptDigestB64u, computeWalletSessionOperationCredentialDigestB64u };
+export { assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1, computeLinkedDeviceApprovalDigestV1, computeLinkedDevicePasskeyTargetConfigurationDigestV1, computeLinkedDeviceSessionClaimDigestV1, computeLinkedDeviceTargetPreparationDigestV1, computeWalletSessionInstallationReceiptDigestB64u };
 
 //# sourceMappingURL=digests.js.map

package/dist/esm/shared-ts/src/device-linking/ed25519ExportRoot.js

@@ -1,7 +1,7 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { requireRecord } from "../utils/validation.js";
 import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, requireParsed } from "../passkey-custody/primitives.js";
 //#region ../shared-ts/src/device-linking/ed25519ExportRoot.ts
 /**

package/dist/esm/shared-ts/src/device-linking/index.js

@@ -1,5 +1,5 @@
-import "./contracts.js";
 import "./activeWalletSession.js";
+import "./contracts.js";
 import "./ed25519ExportRoot.js";
 import "./delegatedActivationPlan.js";
 import "./sourceContribution.js";

package/dist/esm/shared-ts/src/device-linking/parsers.js

@@ -1,8 +1,8 @@
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { requireArray, requireRecord } from "../utils/validation.js";
 import { exactRecord } from "../utils/exactRecord.js";
 import { wireLiteral, wireNullable, wireObject, wireUnion } from "../utils/wireSchema.js";
 import "../authorization/delegatedAuthority.js";
+import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseEd25519PublicKeyB64u } from "../passkey-custody/primitives.js";
 import { authorizationDeviceId, credentialId, digest, enrollmentId, linkedDeviceId, parseDelegatedWalletAuthority, parseNonEmptyToken, parseNonNegativeSafeInteger, parseTargetEmail, parseUnixTime, rpId, sessionId, walletAuthMethodId, walletAuthorityId, walletId, walletKeyId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
 import { parseWalletAddAuthMethodRegistrationOptions } from "../utils/addAuthMethodRegistration.js";

package/dist/esm/shared-ts/src/device-linking/sourceContribution.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseMpcMaterialActivationRef, parseWalletAuthorityId, parseWalletKeyId } from "../utils/domainIds.js";
 import { parseDeviceId } from "../authorization/capabilityKinds.js";
+import { requireRecordCopy } from "../utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { requireRecordCopy } from "../utils/validation.js";
 import { parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, sameRouterAbEd25519YaoByteSequence } from "../utils/routerAbEd25519Yao.js";

package/dist/esm/shared-ts/src/device-linking/wireFields.js

@@ -1,8 +1,8 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationRef, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
 import { parseDeviceId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { wireLabeled, wireNullable, wireResult } from "../utils/wireSchema.js";
 import { parseDelegatedWalletAuthorityV1 } from "../authorization/delegatedAuthority.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { parseUnixMs } from "../passkey-custody/primitives.js";
 //#region ../shared-ts/src/device-linking/wireFields.ts
 const sessionId = /* @__PURE__ */ wireResult(parseLinkDeviceSessionId);

package/dist/esm/shared-ts/src/near/actions.js

@@ -1,4 +1,3 @@
-import "../utils/validation.js";
 //#region ../shared-ts/src/near/actions.ts
 let ActionType = /* @__PURE__ */ function(ActionType) {
 	ActionType["CreateAccount"] = "CreateAccount";

package/dist/esm/shared-ts/src/near/nearClient.js

@@ -1,5 +1,5 @@
-import { base64Decode, base64Encode } from "../utils/base64.js";
 import { isFunction } from "../utils/validation.js";
+import { base64Decode, base64Encode } from "../utils/base64.js";
 import { secureRandomId } from "../utils/secureRandomId.js";
 import { errorMessage } from "../utils/errors.js";
 import { decodeJsonRpcEnvelope } from "../utils/jsonRpc.js";
@@ -7,10 +7,8 @@ import { decodeNearAccessKeyList, decodeNearAccessKeyView, decodeNearAccountView
 //#region ../shared-ts/src/near/nearClient.ts
 var RpcCallType = /* @__PURE__ */ function(RpcCallType) {
 	RpcCallType["Query"] = "query";
-	RpcCallType["View"] = "view";
 	RpcCallType["Send"] = "send_tx";
 	RpcCallType["Block"] = "block";
-	RpcCallType["Call"] = "call_function";
 	return RpcCallType;
 }(RpcCallType || {});
 const DEFAULT_SEND_WAIT_UNTIL = "EXECUTED_OPTIMISTIC";

package/dist/esm/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js

@@ -44,6 +44,6 @@ function deriveEvmFamilySigningKeySlotId(input) {
 	].join(":"));
 }
 //#endregion
-export { deriveEvmFamilySigningKeySlotId, parseEvmFamilySigningKeySlotId, requireEvmFamilySigningKeySlotId };
+export { deriveEvmFamilySigningKeySlotId, requireEvmFamilySigningKeySlotId };
 
 //# sourceMappingURL=evmFamilySigningKeySlotId.js.map

package/dist/esm/shared-ts/src/signing-lanes/index.js

@@ -1,11 +1,6 @@
 import "../utils/domainIds.js";
 import "./evmFamilySigningKeySlotId.js";
 import "./participants.js";
-import "./rotationParsers.js";
-import "./rotation.js";
 import "./participantDigest.js";
-import "./ownerContinuity.js";
-import "./rotationDigests.js";
-import "./rotationProtocolParsers.js";
-import "./rotationLifecycle.js";
 import "./execution.js";
+import "./ownerContinuity.js";

package/dist/esm/shared-ts/src/signing-lanes/ownerContinuity.js

@@ -1,8 +1,8 @@
 import { hasWhitespaceOrControlCharacters, parseMpcSigningWorkerRef } from "../utils/domainIds.js";
-import { base64UrlEncode } from "../utils/base64.js";
-import { sha256Bytes } from "../utils/digests.js";
 import { requireRecord } from "../utils/validation.js";
 import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { base64UrlEncode } from "../utils/base64.js";
+import { sha256Bytes } from "../utils/digests.js";
 import { parseDigestField, requireParsed } from "../passkey-custody/primitives.js";
 import { concat } from "../utils/digestEncoding.js";
 import { parseLaneParticipantBindingDigestB64u } from "./participants.js";
@@ -75,6 +75,6 @@ async function computeOwnerLaneParticipantBindingDigestV1(input) {
 	return requireParsed(parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(ownerLaneParticipantContinuityCanonicalBytesV1(input)))), "owner participant digest");
 }
 //#endregion
-export { buildOwnerLaneParticipantContinuityV1, computeOwnerLaneParticipantBindingDigestV1, ownerLaneParticipantContinuityCanonicalBytesV1, parseOwnerLaneParticipantContinuityV1, parseWalletSignerId };
+export { buildOwnerLaneParticipantContinuityV1, computeOwnerLaneParticipantBindingDigestV1, parseOwnerLaneParticipantContinuityV1, parseWalletSignerId };
 
 //# sourceMappingURL=ownerContinuity.js.map

package/dist/esm/shared-ts/src/signing-lanes/participantDigest.js

@@ -1,19 +1,7 @@
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { sha256Bytes } from "../utils/digests.js";
+import { base64UrlDecode } from "../utils/base64.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { concat } from "../utils/digestEncoding.js";
-import { buildSigningWorkerParticipantRecordV1, parseLaneHolderParticipantRecordV1, parseLaneParticipantBindingDigestB64u, parseSigningWorkerParticipantRecordV1 } from "./participants.js";
 //#region ../shared-ts/src/signing-lanes/participantDigest.ts
-/** Domain tags are part of the wire contract and must never be shortened. */
-const LANE_HOLDER_PARTICIPANT_BINDING_DOMAIN_V1 = "seams/rotatable-signing-lanes/lane-holder-participant/v1";
-const SIGNING_WORKER_PARTICIPANT_BINDING_DOMAIN_V1 = "seams/rotatable-signing-lanes/signing-worker-participant/v1";
-/** The lane digest binds the fixed holder-then-SigningWorker participant set. */
-const LANE_PARTICIPANT_SET_BINDING_DOMAIN_V1 = "seams/rotatable-signing-lanes/lane-participant-set/v1";
-function placeholderParticipantDigest() {
-	const parsed = parseLaneParticipantBindingDigestB64u(base64UrlEncode(new Uint8Array(32)));
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
 function u32(value) {
 	if (!Number.isInteger(value) || value < 0 || value > 4294967295) throw new Error("canonical u32 must be an integer between 0 and 4294967295");
 	return new Uint8Array([
@@ -42,74 +30,7 @@ function encodeLaneCanonicalU64V1(value) {
 	for (let shift = 56; shift >= 0; shift -= 8) output[7 - shift / 8] = Number(remaining >> BigInt(shift) & 255n);
 	return output;
 }
-/** Nonempty array count encoding used by enrollment and receipt records. */
-function encodeLaneCanonicalNonEmptyCountV1(count) {
-	if (!Number.isInteger(count) || count < 1 || count > 4294967295) throw new Error("canonical array count must be a nonempty u32");
-	return u32(count);
-}
-function laneHolderParticipantCanonicalBytesV1(input) {
-	const record = parseLaneHolderParticipantRecordV1(input);
-	return concat([
-		encodeLaneCanonicalTextV1(LANE_HOLDER_PARTICIPANT_BINDING_DOMAIN_V1),
-		encodeLaneCanonicalTextV1(record.participantId),
-		encodeLaneCanonicalTextV1(record.custodyBindingId),
-		encodeLaneCanonicalDigestV1(record.custodyBindingDigestB64u),
-		encodeLaneCanonicalTextV1(record.hpkePublicKeyB64u),
-		encodeLaneCanonicalDigestV1(record.hpkePublicKeyDigestB64u)
-	]);
-}
-function signingWorkerParticipantCanonicalBytesV1(input) {
-	const record = parseSigningWorkerParticipantRecordV1(input);
-	return concat([
-		encodeLaneCanonicalTextV1(SIGNING_WORKER_PARTICIPANT_BINDING_DOMAIN_V1),
-		encodeLaneCanonicalTextV1(record.participantId),
-		encodeLaneCanonicalTextV1(record.recipientKeyId),
-		encodeLaneCanonicalTextV1(record.hpkePublicKeyB64u),
-		encodeLaneCanonicalDigestV1(record.hpkePublicKeyDigestB64u)
-	]);
-}
-function encodeCanonicalBytes(value) {
-	return concat([u32(value.length), value]);
-}
-/**
-* Canonical bytes for the lane's complete participant set. The order is part
-* of the protocol: holder first, SigningWorker second. Individual participant
-* binding digests are included after their canonical identity bytes so a
-* verified record cannot be substituted while retaining the same identities.
-*/
-function laneParticipantSetCanonicalBytesV1(input) {
-	const holderParticipant = parseLaneHolderParticipantRecordV1(input.holderParticipant);
-	const signingWorkerParticipant = parseSigningWorkerParticipantRecordV1(input.signingWorkerParticipant);
-	return concat([
-		encodeLaneCanonicalTextV1(LANE_PARTICIPANT_SET_BINDING_DOMAIN_V1),
-		encodeLaneCanonicalNonEmptyCountV1(2),
-		encodeLaneCanonicalTextV1("holder"),
-		encodeCanonicalBytes(laneHolderParticipantCanonicalBytesV1(holderParticipant)),
-		encodeLaneCanonicalDigestV1(holderParticipant.participantBindingDigestB64u),
-		encodeLaneCanonicalTextV1("signing_worker"),
-		encodeCanonicalBytes(signingWorkerParticipantCanonicalBytesV1(signingWorkerParticipant)),
-		encodeLaneCanonicalDigestV1(signingWorkerParticipant.participantBindingDigestB64u)
-	]);
-}
-async function digestCanonicalBytes(bytes) {
-	const parsed = parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(bytes)));
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-async function computeLaneParticipantSetBindingDigestV1(input) {
-	return await digestCanonicalBytes(laneParticipantSetCanonicalBytesV1(input));
-}
-async function buildSigningWorkerParticipantRecordWithDigestV1(input) {
-	const draft = buildSigningWorkerParticipantRecordV1({
-		...input,
-		participantBindingDigestB64u: placeholderParticipantDigest()
-	});
-	return buildSigningWorkerParticipantRecordV1({
-		...input,
-		participantBindingDigestB64u: await digestCanonicalBytes(signingWorkerParticipantCanonicalBytesV1(draft))
-	});
-}
 //#endregion
-export { buildSigningWorkerParticipantRecordWithDigestV1, computeLaneParticipantSetBindingDigestV1, encodeLaneCanonicalDigestV1, encodeLaneCanonicalTextV1, encodeLaneCanonicalU64V1 };
+export { encodeLaneCanonicalDigestV1, encodeLaneCanonicalTextV1, encodeLaneCanonicalU64V1 };
 
 //# sourceMappingURL=participantDigest.js.map

package/dist/esm/shared-ts/src/signing-lanes/participants.js

@@ -1,7 +1,4 @@
-import { hasWhitespaceOrControlCharacters } from "../utils/domainIds.js";
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { requireRecord } from "../utils/validation.js";
 //#region ../shared-ts/src/signing-lanes/participants.ts
 function missing(field) {
 	return {
@@ -15,55 +12,6 @@ function invalid(field, reason) {
 		message: `${field} ${reason}`
 	};
 }
-function parseIdentityId(raw, field) {
-	if (raw === void 0 || raw === null) return {
-		ok: false,
-		error: missing(field)
-	};
-	if (typeof raw !== "string") return {
-		ok: false,
-		error: invalid(field, "must be a string")
-	};
-	const value = raw.trim();
-	if (!value) return {
-		ok: false,
-		error: missing(field)
-	};
-	if (hasWhitespaceOrControlCharacters(value)) return {
-		ok: false,
-		error: invalid(field, "must not contain whitespace or control characters")
-	};
-	return {
-		ok: true,
-		value
-	};
-}
-function parseHpkePublicKey(raw, field) {
-	if (raw === void 0 || raw === null) return {
-		ok: false,
-		error: missing(field)
-	};
-	if (typeof raw !== "string" || raw.length === 0) return {
-		ok: false,
-		error: invalid(field, "must be non-empty base64url")
-	};
-	try {
-		const bytes = base64UrlDecode(raw);
-		if (bytes.length === 0 || base64UrlEncode(bytes) !== raw) return {
-			ok: false,
-			error: invalid(field, "must be canonical unpadded base64url")
-		};
-	} catch {
-		return {
-			ok: false,
-			error: invalid(field, "must be canonical unpadded base64url")
-		};
-	}
-	return {
-		ok: true,
-		value: raw
-	};
-}
 function parseDigest(raw, field, brand) {
 	if (raw === void 0 || raw === null) return {
 		ok: false,
@@ -81,179 +29,13 @@ function parseDigest(raw, field, brand) {
 		};
 	}
 }
-function brandLaneCustodyDigest(value) {
-	return value;
-}
-function brandRecipientDigest(value) {
-	return value;
-}
 function brandParticipantDigest(value) {
 	return value;
 }
-function rejectUnknownFields(record, fields, label) {
-	const allowed = new Set(fields);
-	for (const field of Object.keys(record)) if (!allowed.has(field)) throw new Error(`${label}.${field} is not supported`);
-	for (const field of fields) if (!(field in record)) throw new Error(`${label}.${field} is required`);
-}
-function parseLaneHolderParticipantId(raw) {
-	return parseIdentityId(raw, "laneHolderParticipantId");
-}
-function parseSigningWorkerParticipantId(raw) {
-	return parseIdentityId(raw, "signingWorkerParticipantId");
-}
-function parseSigningWorkerRecipientKeyId(raw) {
-	return parseIdentityId(raw, "signingWorkerRecipientKeyId");
-}
-function parseLaneHolderCustodyBindingId(raw) {
-	return parseIdentityId(raw, "laneHolderCustodyBindingId");
-}
-function parseHpkePublicKeyB64u(raw) {
-	return parseHpkePublicKey(raw, "hpkePublicKeyB64u");
-}
 function parseLaneParticipantBindingDigestB64u(raw) {
 	return parseDigest(raw, "participantBindingDigestB64u", brandParticipantDigest);
 }
-function parseLaneCustodyBindingDigestB64u(raw) {
-	return parseDigest(raw, "custodyBindingDigestB64u", brandLaneCustodyDigest);
-}
-function parseSigningWorkerRecipientKeyDigestB64u(raw) {
-	return parseDigest(raw, "hpkePublicKeyDigestB64u", brandRecipientDigest);
-}
-function buildLaneHolderCustodyIdentityV1(args) {
-	return {
-		kind: "lane_holder_custody_identity_v1",
-		custodyBindingId: args.custodyBindingId,
-		custodyBindingDigestB64u: args.custodyBindingDigestB64u
-	};
-}
-function buildSigningWorkerRecipientIdentityV1(args) {
-	return {
-		kind: "signing_worker_recipient_identity_v1",
-		recipientKeyId: args.recipientKeyId,
-		hpkePublicKeyB64u: args.hpkePublicKeyB64u,
-		hpkePublicKeyDigestB64u: args.hpkePublicKeyDigestB64u
-	};
-}
-function parseLaneHolderCustodyIdentityV1(raw, label = "laneHolderCustodyIdentity") {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, [
-		"kind",
-		"custodyBindingId",
-		"custodyBindingDigestB64u"
-	], label);
-	if (record.kind !== "lane_holder_custody_identity_v1") throw new Error(`${label}.kind is invalid`);
-	const custodyBindingId = parseLaneHolderCustodyBindingId(record.custodyBindingId);
-	if (!custodyBindingId.ok) throw new Error(`${label}.${custodyBindingId.error.message}`);
-	const custodyBindingDigestB64u = parseLaneCustodyBindingDigestB64u(record.custodyBindingDigestB64u);
-	if (!custodyBindingDigestB64u.ok) throw new Error(`${label}.${custodyBindingDigestB64u.error.message}`);
-	return buildLaneHolderCustodyIdentityV1({
-		custodyBindingId: custodyBindingId.value,
-		custodyBindingDigestB64u: custodyBindingDigestB64u.value
-	});
-}
-function parseSigningWorkerRecipientIdentityV1(raw, label = "signingWorkerRecipientIdentity") {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, [
-		"kind",
-		"recipientKeyId",
-		"hpkePublicKeyB64u",
-		"hpkePublicKeyDigestB64u"
-	], label);
-	if (record.kind !== "signing_worker_recipient_identity_v1") throw new Error(`${label}.kind is invalid`);
-	const recipientKeyId = parseSigningWorkerRecipientKeyId(record.recipientKeyId);
-	if (!recipientKeyId.ok) throw new Error(`${label}.${recipientKeyId.error.message}`);
-	const hpkePublicKeyB64u = parseHpkePublicKey(record.hpkePublicKeyB64u, `${label}.hpkePublicKeyB64u`);
-	if (!hpkePublicKeyB64u.ok) throw new Error(hpkePublicKeyB64u.error.message);
-	const hpkePublicKeyDigestB64u = parseSigningWorkerRecipientKeyDigestB64u(record.hpkePublicKeyDigestB64u);
-	if (!hpkePublicKeyDigestB64u.ok) throw new Error(`${label}.${hpkePublicKeyDigestB64u.error.message}`);
-	return buildSigningWorkerRecipientIdentityV1({
-		recipientKeyId: recipientKeyId.value,
-		hpkePublicKeyB64u: hpkePublicKeyB64u.value,
-		hpkePublicKeyDigestB64u: hpkePublicKeyDigestB64u.value
-	});
-}
-function buildLaneHolderParticipantRecordV1(args) {
-	return {
-		kind: "lane_holder_participant_v1",
-		participantId: args.participantId,
-		custodyBindingId: args.custody.custodyBindingId,
-		custodyBindingDigestB64u: args.custody.custodyBindingDigestB64u,
-		hpkePublicKeyB64u: args.hpkePublicKeyB64u,
-		hpkePublicKeyDigestB64u: args.hpkePublicKeyDigestB64u,
-		participantBindingDigestB64u: args.participantBindingDigestB64u
-	};
-}
-function buildSigningWorkerParticipantRecordV1(args) {
-	return {
-		kind: "signing_worker_participant_v1",
-		participantId: args.participantId,
-		recipientKeyId: args.recipient.recipientKeyId,
-		hpkePublicKeyB64u: args.recipient.hpkePublicKeyB64u,
-		hpkePublicKeyDigestB64u: args.recipient.hpkePublicKeyDigestB64u,
-		participantBindingDigestB64u: args.participantBindingDigestB64u
-	};
-}
-function parseLaneHolderParticipantRecordV1(raw, label = "laneHolderParticipant") {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, [
-		"kind",
-		"participantId",
-		"custodyBindingId",
-		"custodyBindingDigestB64u",
-		"hpkePublicKeyB64u",
-		"hpkePublicKeyDigestB64u",
-		"participantBindingDigestB64u"
-	], label);
-	if (record.kind !== "lane_holder_participant_v1") throw new Error(`${label}.kind is invalid`);
-	const participantId = parseLaneHolderParticipantId(record.participantId);
-	if (!participantId.ok) throw new Error(`${label}.${participantId.error.message}`);
-	const custody = parseLaneHolderCustodyIdentityV1({
-		kind: "lane_holder_custody_identity_v1",
-		custodyBindingId: record.custodyBindingId,
-		custodyBindingDigestB64u: record.custodyBindingDigestB64u
-	}, `${label}.custody`);
-	const hpkePublicKeyB64u = parseHpkePublicKey(record.hpkePublicKeyB64u, `${label}.hpkePublicKeyB64u`);
-	if (!hpkePublicKeyB64u.ok) throw new Error(hpkePublicKeyB64u.error.message);
-	const hpkePublicKeyDigestB64u = parseSigningWorkerRecipientKeyDigestB64u(record.hpkePublicKeyDigestB64u);
-	if (!hpkePublicKeyDigestB64u.ok) throw new Error(`${label}.${hpkePublicKeyDigestB64u.error.message}`);
-	const participantBindingDigestB64u = parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u);
-	if (!participantBindingDigestB64u.ok) throw new Error(`${label}.${participantBindingDigestB64u.error.message}`);
-	return buildLaneHolderParticipantRecordV1({
-		participantId: participantId.value,
-		custody,
-		hpkePublicKeyB64u: hpkePublicKeyB64u.value,
-		hpkePublicKeyDigestB64u: hpkePublicKeyDigestB64u.value,
-		participantBindingDigestB64u: participantBindingDigestB64u.value
-	});
-}
-function parseSigningWorkerParticipantRecordV1(raw, label = "signingWorkerParticipant") {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, [
-		"kind",
-		"participantId",
-		"recipientKeyId",
-		"hpkePublicKeyB64u",
-		"hpkePublicKeyDigestB64u",
-		"participantBindingDigestB64u"
-	], label);
-	if (record.kind !== "signing_worker_participant_v1") throw new Error(`${label}.kind is invalid`);
-	const participantId = parseSigningWorkerParticipantId(record.participantId);
-	if (!participantId.ok) throw new Error(`${label}.${participantId.error.message}`);
-	const recipient = parseSigningWorkerRecipientIdentityV1({
-		kind: "signing_worker_recipient_identity_v1",
-		recipientKeyId: record.recipientKeyId,
-		hpkePublicKeyB64u: record.hpkePublicKeyB64u,
-		hpkePublicKeyDigestB64u: record.hpkePublicKeyDigestB64u
-	}, `${label}.recipient`);
-	const participantBindingDigestB64u = parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u);
-	if (!participantBindingDigestB64u.ok) throw new Error(`${label}.${participantBindingDigestB64u.error.message}`);
-	return buildSigningWorkerParticipantRecordV1({
-		participantId: participantId.value,
-		recipient,
-		participantBindingDigestB64u: participantBindingDigestB64u.value
-	});
-}
 //#endregion
-export { buildLaneHolderParticipantRecordV1, buildSigningWorkerParticipantRecordV1, parseHpkePublicKeyB64u, parseLaneCustodyBindingDigestB64u, parseLaneHolderCustodyBindingId, parseLaneHolderParticipantId, parseLaneHolderParticipantRecordV1, parseLaneParticipantBindingDigestB64u, parseSigningWorkerParticipantId, parseSigningWorkerParticipantRecordV1, parseSigningWorkerRecipientKeyDigestB64u, parseSigningWorkerRecipientKeyId };
+export { parseLaneParticipantBindingDigestB64u };
 
 //# sourceMappingURL=participants.js.map

package/dist/esm/shared-ts/src/signing-lanes/recordParsers.js

@@ -1,8 +1,5 @@
 import { hasWhitespaceOrControlCharacters } from "../utils/domainIds.js";
-import "../utils/validation.js";
-import "../utils/exactRecord.js";
 import "../utils/registrationIds.js";
-import "./participants.js";
 import "./ownerContinuity.js";
 //#region ../shared-ts/src/signing-lanes/recordParsers.ts
 const WALLET_KEY_COMMON_FIELDS = [

package/dist/esm/shared-ts/src/tenant-root/tenantRootOperationRecord.js

@@ -8,8 +8,7 @@ import { isTenantRootIdentityFieldCanonicalV1 } from "./tenantRootIdentity.js";
 *
 * The console builds these records in TypeScript and the control plane
 * consumes their digests in Rust, so both sides must produce identical
-* canonical bytes. The encoding is pinned by the cross-runtime fixtures in
-* `crates/router-ab-core/tests/fixtures/tenant-root-operation`.
+* canonical bytes.
 *
 * A record is the unit of authorization: changing any field changes the
 * digest, so a capability minted for one record cannot be carried to another

package/dist/esm/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js

@@ -1,6 +1,5 @@
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { alphabetizeStringify, sha256Bytes, sha256BytesUtf8 } from "../utils/digests.js";
-import "../utils/encoders.js";
 import { deriveEvmFamilySigningKeySlotId } from "../signing-lanes/evmFamilySigningKeySlotId.js";
 //#region ../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.ts
 const THRESHOLD_SECP256K1_ECDSA_2P_V1_SCHEME_ID = "threshold-secp256k1-ecdsa-2p-v1";

package/dist/esm/shared-ts/src/threshold/keyMaterialBrands.js

@@ -4,46 +4,25 @@ function parseNonEmptyBrand(value, label) {
 	if (!normalized) throw new Error(`${label} must be a non-empty string`);
 	return normalized;
 }
-function parseEcdsaDerivationKeyVersion(value) {
-	return parseNonEmptyBrand(value, "ECDSA DERIVATION key version");
-}
 function parseSigningSessionSealKeyVersion(value) {
 	return parseNonEmptyBrand(value, "signing-session seal key version");
 }
 function parseEcdsaClientVerifyingShareB64u(value) {
 	return parseNonEmptyBrand(value, "ECDSA client verifying share");
 }
-function parseEd25519RelayerKeyId(value) {
-	return parseNonEmptyBrand(value, "Ed25519 relayer key id");
-}
 function parseEcdsaRelayerKeyId(value) {
 	return parseNonEmptyBrand(value, "ECDSA relayer key id");
 }
 function parseEcdsaKeyHandle(value) {
 	return parseNonEmptyBrand(value, "ECDSA key handle");
 }
-function formatEcdsaDerivationKeyVersionForWire(value) {
-	return value;
-}
 function formatSigningSessionSealKeyVersionForWire(value) {
 	return value;
 }
-function formatEcdsaClientVerifyingShareB64uForWire(value) {
-	return value;
-}
-function formatEd25519RelayerKeyIdForWire(value) {
-	return value;
-}
-function formatEcdsaRelayerKeyIdForWire(value) {
-	return value;
-}
-function formatEcdsaThresholdKeyIdForWire(value) {
-	return value;
-}
 function formatEcdsaKeyHandleForWire(value) {
 	return value;
 }
 //#endregion
-export { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEd25519RelayerKeyId, parseNonEmptyBrand, parseSigningSessionSealKeyVersion };
+export { formatEcdsaKeyHandleForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseSigningSessionSealKeyVersion };
 
 //# sourceMappingURL=keyMaterialBrands.js.map

package/dist/esm/shared-ts/src/threshold/participants.js

@@ -1,4 +1,3 @@
-import "../utils/validation.js";
 const THRESHOLD_ED25519_2P_PARTICIPANT_IDS = [1, 2];
 function normalizeThresholdEd25519ParticipantId(id) {
 	const n = Number(id);

package/dist/esm/shared-ts/src/threshold/signingRootScope.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../utils/normalize.js";
-import "../utils/validation.js";
 //#region ../shared-ts/src/threshold/signingRootScope.ts
 function requireScopeField(label, value) {
 	const normalized = normalizeOptionalTrimmedString(value);

package/dist/esm/shared-ts/src/utils/addWalletAuthMethod.js

@@ -1,4 +1,3 @@
-import "../authorization/capabilityKinds.js";
 //#region ../shared-ts/src/utils/addWalletAuthMethod.ts
 function unreachableAuthMethodFamily(value) {
 	throw new Error(`Unhandled wallet auth-method family: ${String(value)}`);
@@ -12,21 +11,13 @@ function unreachableAuthMethodFamily(value) {
 * which is why the operation needs no same-family rejection of its own.
 */
 function admitAddWalletAuthMethod(input) {
-	const present = input.activeMethodsOnAuthority.find((method) => method.kind === input.targetFamily);
-	if (present) return {
+	if (input.activeMethodsOnAuthority.find((method) => method.kind === input.targetFamily)) return {
 		kind: "already_configured",
-		family: input.targetFamily,
-		existingWalletAuthMethodId: present.walletAuthMethodId
+		family: input.targetFamily
 	};
 	switch (input.sourceMethod.kind) {
-		case "passkey": return {
-			kind: "proceed",
-			branch: "passkey_to_email_otp"
-		};
-		case "email_otp": return {
-			kind: "proceed",
-			branch: "email_otp_to_passkey"
-		};
+		case "passkey": return { kind: "proceed" };
+		case "email_otp": return { kind: "proceed" };
 		default: return unreachableAuthMethodFamily(input.sourceMethod);
 	}
 }