@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/shared-ts/src/utils/canonicalPrimitives.js

@@ -16,12 +16,6 @@ function parseDigestB64u(value) {
 	if (bytes.length !== 32 || base64UrlEncode(bytes) !== value) throw new Error("digest must be canonical base64url for 32 bytes");
 	return value;
 }
-function parseIsoTimestamp(value) {
-	if (typeof value !== "string") throw new Error("timestamp must be an ISO timestamp");
-	const timestampMs = Date.parse(value);
-	if (!Number.isFinite(timestampMs) || new Date(timestampMs).toISOString() !== value) throw new Error("timestamp must be canonical ISO-8601 UTC");
-	return value;
-}
 async function sha256DigestB64u(bytes) {
 	return parseDigestB64u(base64UrlEncode(await sha256Bytes(bytes)));
 }
@@ -29,6 +23,6 @@ async function sha256Utf8DigestB64u(text) {
 	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(text)));
 }
 //#endregion
-export { parseCorrelationId, parseDigestB64u, parseIsoTimestamp, sha256DigestB64u, sha256Utf8DigestB64u };
+export { parseCorrelationId, parseDigestB64u, sha256DigestB64u, sha256Utf8DigestB64u };
 
 //# sourceMappingURL=canonicalPrimitives.js.map

package/dist/esm/shared-ts/src/utils/domainIds.js

@@ -121,9 +121,6 @@ function parseChallengeSubjectId(raw) {
 function parseEmailOtpChallengeId(raw) {
 	return parseDomainId(raw, "emailOtpChallengeId");
 }
-function parseEmailOtpRegistrationAttemptId(raw) {
-	return parseDomainId(raw, "emailOtpRegistrationAttemptId");
-}
 function parseOrgId(raw) {
 	return parseDomainId(raw, "orgId");
 }
@@ -279,24 +276,12 @@ function parseLaneShareEpoch(raw) {
 function parseLinkedDeviceId(raw) {
 	return parseDomainId(raw, "linkedDeviceId");
 }
-function parseLaneOperationId(raw) {
-	return parseDomainId(raw, "laneOperationId");
-}
-function parseLaneEnrollmentId(raw) {
-	return parseDomainId(raw, "laneEnrollmentId");
-}
-function parseLaneOperationIdempotencyKey(raw) {
-	return parseDomainId(raw, "laneOperationIdempotencyKey");
-}
 function parseLinkedDeviceEnrollmentId(raw) {
 	return parseDomainId(raw, "linkedDeviceEnrollmentId");
 }
 function parseWalletRecoveryOperationId(raw) {
 	return parseDomainId(raw, "walletRecoveryOperationId");
 }
-function parseEd25519YaoSuiteId(raw) {
-	return parseDomainId(raw, "ed25519YaoSuiteId");
-}
 function parseEcdsaRelayerKeyId(raw) {
 	return parseDomainId(raw, "ecdsaRelayerKeyId");
 }
@@ -304,6 +289,6 @@ function parseLinkDeviceSessionId(raw) {
 	return parseDomainId(raw, "linkDeviceSessionId");
 }
 //#endregion
-export { buildMpcMaterialActivationRef, hasControlCharacter, hasWhitespaceOrControlCharacters, mpcMaterialActivationRefsEqual, parseChallengeSubjectId, parseEcdsaActiveStateId, parseEcdsaRelayerKeyId, parseEd25519YaoSuiteId, parseEmailOtpChallengeId, parseEmailOtpProviderUserId, parseEmailOtpRegistrationAttemptId, parseGoogleProviderSubject, parseLaneEnrollmentId, parseLaneOperationId, parseLaneOperationIdempotencyKey, parseLaneShareEpoch, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationId, parseMpcMaterialActivationRef, parseMpcSigningWorkerRef, parseOrgId, parsePasskeyEnvelopeId, parseProviderSubject, parseRootShareEpoch, parseSigningLaneId, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseThresholdSessionId, parseVerifiedEmailAddress, parseVerifiedGoogleEmail, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId };
+export { buildMpcMaterialActivationRef, hasControlCharacter, hasWhitespaceOrControlCharacters, mpcMaterialActivationRefsEqual, parseChallengeSubjectId, parseEcdsaActiveStateId, parseEcdsaRelayerKeyId, parseEmailOtpChallengeId, parseEmailOtpProviderUserId, parseGoogleProviderSubject, parseLaneShareEpoch, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationId, parseMpcMaterialActivationRef, parseMpcSigningWorkerRef, parseOrgId, parsePasskeyEnvelopeId, parseProviderSubject, parseRootShareEpoch, parseSigningLaneId, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseThresholdSessionId, parseVerifiedEmailAddress, parseVerifiedGoogleEmail, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId };
 
 //# sourceMappingURL=domainIds.js.map

package/dist/esm/shared-ts/src/utils/ecdsaCapabilityActivation.js

@@ -7,16 +7,6 @@ function parseNonEmptyString(value, label) {
 function parseEcdsaServerGeneration(value) {
 	return parseNonEmptyString(value, "ECDSA server generation");
 }
-function parseEcdsaCapabilityManifestId(value) {
-	return parseNonEmptyString(value, "ECDSA manifest id");
-}
-function parseEcdsaCapabilityManifestRevision(value) {
-	if (!Number.isSafeInteger(value) || Number(value) < 1) throw new Error("ECDSA manifest revision must be a positive safe integer");
-	return value;
-}
-function parseEcdsaLifecycleId(value) {
-	return parseNonEmptyString(value, "ECDSA lifecycle id");
-}
 function parseCanonicalEcdsaServerActivationRequest(value) {
 	if (typeof value !== "string" || value.trim() !== value) throw new Error("ECDSA server activation request must be canonical JSON");
 	let parsed;
@@ -29,6 +19,6 @@ function parseCanonicalEcdsaServerActivationRequest(value) {
 	return value;
 }
 //#endregion
-export { parseCanonicalEcdsaServerActivationRequest, parseEcdsaCapabilityManifestId, parseEcdsaCapabilityManifestRevision, parseEcdsaLifecycleId, parseEcdsaServerGeneration };
+export { parseCanonicalEcdsaServerActivationRequest, parseEcdsaServerGeneration };
 
 //# sourceMappingURL=ecdsaCapabilityActivation.js.map

package/dist/esm/shared-ts/src/utils/ecdsaKeyFactsInventory.js

@@ -1,6 +1,5 @@
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
-import "./encoders.js";
 import { thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
 //#region ../shared-ts/src/utils/ecdsaKeyFactsInventory.ts
 function normalizeChainTarget(target) {

package/dist/esm/shared-ts/src/utils/ecdsaServerTiming.js

@@ -1,5 +1,9 @@
 //#region ../shared-ts/src/utils/ecdsaServerTiming.ts
 const ECDSA_TIMING_METRICS = new Set([
+	"wallet_gateway_binding",
+	"wallet_gateway_total",
+	"wallet_console_binding_d1",
+	"wallet_console_binding_sql",
 	"ecdsa_sign_authorize",
 	"ecdsa_sign_admit",
 	"ecdsa_sign_proxy",
@@ -12,7 +16,8 @@ const ECDSA_TIMING_METRICS = new Set([
 	"ecdsa_presign_total",
 	"ecdsa_presign_sw_material",
 	"ecdsa_presign_sw_session",
-	"ecdsa_presign_sw_do_total",
+	"ecdsa_presign_sw_do_response_headers",
+	"ecdsa_presign_sw_do_response_body",
 	"ecdsa_presign_sw_admit",
 	"ecdsa_presign_sw_total"
 ]);

package/dist/esm/shared-ts/src/utils/emailOtpDomain.js

@@ -18,12 +18,14 @@ const WALLET_EMAIL_OTP_REGISTRATION_OPERATION = "registration";
 /** Linked-device enrollment: prove control of the wallet's enrolled email
 * destination to complete one device link. */
 const WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION = "device_link";
+const WALLET_EMAIL_OTP_RELOCATION_OPERATION = "wallet_relocation";
 const WALLET_EMAIL_OTP_ACTIONS = {
 	login: "wallet_email_otp_login",
 	registration: "wallet_email_otp_registration",
 	recoveryBootstrap: "wallet_email_otp_recovery_bootstrap",
 	unseal: "wallet_email_otp_unseal",
-	deviceLink: "wallet_email_otp_device_link"
+	deviceLink: "wallet_email_otp_device_link",
+	relocation: "wallet_email_otp_relocation"
 };
 const WALLET_EMAIL_OTP_EXPORT_OPERATION = "export_key";
 const WALLET_EMAIL_OTP_UNLOCK_OPERATION = "wallet_unlock";
@@ -35,6 +37,6 @@ function isWalletEmailOtpLoginOperation(value) {
 	return WALLET_EMAIL_OTP_LOGIN_OPERATIONS.includes(value);
 }
 //#endregion
-export { EMAIL_OTP_CHANNEL, EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, emailOtpDeviceEnrollmentId, isWalletEmailOtpLoginOperation, isWalletUnlockBackend };
+export { EMAIL_OTP_CHANNEL, EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_RELOCATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, emailOtpDeviceEnrollmentId, isWalletEmailOtpLoginOperation, isWalletUnlockBackend };
 
 //# sourceMappingURL=emailOtpDomain.js.map

package/dist/esm/shared-ts/src/utils/errors.js

@@ -1,4 +1,3 @@
-import "./near.js";
 //#region ../shared-ts/src/utils/errors.ts
 /**
 * Best-effort error message extractor without relying on `any`.
@@ -17,24 +16,7 @@ function b64uField(prefix) {
 	return `${prefix}B64u`;
 }
 b64uField("seed"), b64uField("canonicalSeed"), b64uField("xClientBase"), b64uField("clientOutputMask"), b64uField("clientRecoverableSecret"), b64uField("prfFirst"), b64uField("prfSecond"), b64uField("signingShare32"), b64uField("clientNonceHandle");
-/**
-* Normalize any thrown value into an Error instance.
-* - preserves message/name/stack when available
-* - best-effort copies optional code/details properties if present
-*/
-function toError(e) {
-	if (e instanceof Error) return e;
-	const err = new Error(errorMessage(e));
-	try {
-		const src = e;
-		if (typeof src?.name === "string") err.name = src.name;
-		if (typeof src?.stack === "string") err.stack = src.stack;
-		if (src && typeof src.code !== "undefined") err.code = src.code;
-		if (src && typeof src.details !== "undefined") err.details = src.details;
-	} catch {}
-	return err;
-}
 //#endregion
-export { errorMessage, toError };
+export { errorMessage };
 
 //# sourceMappingURL=errors.js.map

package/dist/esm/shared-ts/src/utils/near.js

@@ -94,6 +94,6 @@ function deriveImplicitNearAccountIdFromEd25519PublicKey(publicKey) {
 	return bytesToLowerHex(decoded);
 }
 //#endregion
-export { deriveImplicitNearAccountIdFromEd25519PublicKey, ensureEd25519Prefix, isValidAccountId, parseImplicitNearAccountId, parseNamedNearAccountId, parseNearAccountId };
+export { deriveImplicitNearAccountIdFromEd25519PublicKey, ensureEd25519Prefix, parseImplicitNearAccountId, parseNamedNearAccountId, parseNearAccountId };
 
 //# sourceMappingURL=near.js.map

package/dist/esm/shared-ts/src/utils/registrationEstablishedSession.js

@@ -1,12 +1,12 @@
 import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseWalletId } from "./domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
-import { parseNearAccountId } from "./near.js";
 import { parseActiveWalletSessionV1 } from "../device-linking/activeWalletSession.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "./routerAbNormalSigningIdentity.js";
 import { normalizeRuntimePolicyScope } from "../threshold/signingRootScope.js";
 import { parseRouterAbEcdsaDerivationNormalSigningStateV1 } from "./routerAbEcdsaDerivation.js";
 import { parseRouterAbEd25519NormalSigningState } from "./signingSessionSeal.js";
 import { parseNearEd25519SigningKeyId } from "./registrationIds.js";
+import { parseNearAccountId } from "./near.js";
 import { parseThresholdEcdsaKeyHandle } from "./thresholdEcdsaKeyHandle.js";
 //#region ../shared-ts/src/utils/registrationEstablishedSession.ts
 function registrationSessionTokensMatchCapabilities(walletSession, tokens) {

package/dist/esm/shared-ts/src/utils/registrationIds.js

@@ -1,7 +1,6 @@
 import { parseEmailOtpProviderUserId, parseWalletId } from "./domainIds.js";
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
-import "./encoders.js";
 //#region ../shared-ts/src/utils/registrationIds.ts
 function walletIdFromString(value) {
 	const parsed = parseWalletId(value);
@@ -161,10 +160,7 @@ function parseServerAllocatedWalletId(raw) {
 	const suffix = match?.[3] || "";
 	if (!match || !SERVER_ALLOCATED_WALLET_ADJECTIVE_SET.has(adjective) || !SERVER_ALLOCATED_WALLET_NOUN_SET.has(noun) || !serverAllocatedWalletSuffixIsValid(suffix)) return {
 		ok: false,
-		error: {
-			code: "invalid",
-			message: "server-allocated walletId must match the approved readable word-word-suffix allocation format"
-		}
+		error: { message: "server-allocated walletId must match the approved readable word-word-suffix allocation format" }
 	};
 	return {
 		ok: true,

package/dist/esm/shared-ts/src/utils/registrationIntent.js

@@ -1,7 +1,6 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId } from "./domainIds.js";
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
-import "./encoders.js";
 import { inspectRawObject, trimString } from "./registrationAuthMethodInput.js";
 import "./registrationSignerPlan.js";
 //#region ../shared-ts/src/utils/registrationIntent.ts

package/dist/esm/shared-ts/src/utils/registrationSetupOperation.js

@@ -0,0 +1,8 @@
+//#region ../shared-ts/src/utils/registrationSetupOperation.ts
+function parseRegistrationSetupOperationId(value) {
+	return typeof value === "string" && /^wreg_[A-Za-z0-9_-]{43}$/u.test(value) ? value : null;
+}
+//#endregion
+export { parseRegistrationSetupOperationId };
+
+//# sourceMappingURL=registrationSetupOperation.js.map

package/dist/esm/shared-ts/src/utils/registrationSignerPlan.js

@@ -1,6 +1,6 @@
 import { alphabetizeStringify } from "./digests.js";
-import { parseNamedNearAccountId } from "./near.js";
 import { inspectRawObject, trimString } from "./registrationAuthMethodInput.js";
+import { parseNamedNearAccountId } from "./near.js";
 //#region ../shared-ts/src/utils/registrationSignerPlan.ts
 function normalizePositiveInteger(raw, fallback) {
 	const value = typeof raw === "number" ? raw : Number(raw);

package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js

@@ -1,10 +1,9 @@
 import { parseEcdsaActiveStateId, parseRootShareEpoch, parseThresholdEcdsaSessionId } from "./domainIds.js";
 import { EVM_ECDSA_MPC_OPERATION_KINDS, parseEcdsaAuthorizationSessionId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../authorization/capabilityKinds.js";
+import { requireRecord } from "./validation.js";
 import { base64UrlDecode, base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
 import { parseCorrelationId } from "./canonicalPrimitives.js";
-import "./encoders.js";
-import { requireRecord } from "./validation.js";
 import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../device-linking/activeWalletSession.js";
 import { requireRouterAbX25519PublicKey } from "./routerAbPublicKeyset.js";
 import { canonicalRouterAbMpcMaterialActivationRefBytes, canonicalRouterAbNormalSigningAuthorizationBytes, parseRouterAbMpcMaterialActivationRef, parseRouterAbNormalSigningAuthorization, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "./routerAbNormalSigningIdentity.js";

package/dist/esm/shared-ts/src/utils/routerAbPublicKeyset.js

@@ -20,11 +20,6 @@ function requireSignerRole(value, label) {
 		default: throw new Error(`${label} must be signer_a or signer_b`);
 	}
 }
-function requireLowerHex(value, label, byteLength) {
-	const hex = coerceNonEmptyString(value, label);
-	if (!new RegExp(`^[0-9a-f]{${byteLength * 2}}$`).test(hex)) throw new Error(`${label} must be ${byteLength} lowercase-hex bytes`);
-	return hex;
-}
 function requireRouterAbX25519PublicKey(value, label) {
 	const publicKey = coerceNonEmptyString(value, label);
 	if (!/^x25519:[0-9a-f]{64}$/.test(publicKey)) throw new Error(`${label} must use x25519:<64 lowercase hex chars> encoding`);
@@ -79,26 +74,6 @@ function parseSignerEnvelopeHpkeRotationPublicKeySet(value, label) {
 		previous_retire_at_ms: requirePositiveInteger(record.previous_retire_at_ms, `${label}.previous_retire_at_ms`)
 	};
 }
-function parseSignerPeerVerifyingKey(value, label) {
-	const record = requireRecord(value, label);
-	requireExactKeys(record, ["role", "verifying_key_hex"], label);
-	return {
-		role: requireSignerRole(record.role, `${label}.role`),
-		verifying_key_hex: requireLowerHex(record.verifying_key_hex, `${label}.verifying_key_hex`, 32)
-	};
-}
-function parseSignerPeerVerifyingKeySet(value, label) {
-	const record = requireRecord(value, label);
-	requireExactKeys(record, ["deriver_a", "deriver_b"], label);
-	const deriverA = parseSignerPeerVerifyingKey(record.deriver_a, `${label}.deriver_a`);
-	const deriverB = parseSignerPeerVerifyingKey(record.deriver_b, `${label}.deriver_b`);
-	if (deriverA.role !== "signer_a") throw new Error(`${label}.deriver_a.role must be signer_a`);
-	if (deriverB.role !== "signer_b") throw new Error(`${label}.deriver_b.role must be signer_b`);
-	return {
-		deriver_a: deriverA,
-		deriver_b: deriverB
-	};
-}
 function parsePublicHpkeKeyDescriptor(value, label) {
 	const record = requireRecord(value, label);
 	requireExactKeys(record, ["key_epoch", "public_key"], label);
@@ -112,7 +87,6 @@ function parseRouterAbPublicKeysetV2(value) {
 	requireExactKeys(record, [
 		"keyset_version",
 		"signer_envelope_hpke",
-		"signer_peer_verifying_keys",
 		"signing_worker_server_output_hpke"
 	], "Router A/B public keyset");
 	const keysetVersion = coerceNonEmptyString(record.keyset_version, "keyset_version");
@@ -120,7 +94,6 @@ function parseRouterAbPublicKeysetV2(value) {
 	return {
 		keyset_version: ROUTER_AB_PUBLIC_KEYSET_VERSION_V2,
 		signer_envelope_hpke: parseSignerEnvelopeHpkeRotationPublicKeySet(record.signer_envelope_hpke, "signer_envelope_hpke"),
-		signer_peer_verifying_keys: parseSignerPeerVerifyingKeySet(record.signer_peer_verifying_keys, "signer_peer_verifying_keys"),
 		signing_worker_server_output_hpke: parsePublicHpkeKeyDescriptor(record.signing_worker_server_output_hpke, "signing_worker_server_output_hpke")
 	};
 }

package/dist/esm/shared-ts/src/utils/validation.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "./normalize.js";
-import "./near.js";
 //#region ../shared-ts/src/utils/validation.ts
 function requireTrimmedString(value, label, message = "is required") {
 	const parsed = normalizeOptionalTrimmedString(value);
@@ -24,9 +23,6 @@ function isObject(x) {
 function isPlainObject(x) {
 	return isObject(x) && !Array.isArray(x);
 }
-function isString(x) {
-	return typeof x === "string";
-}
 function isFunction(x) {
 	return typeof x === "function";
 }
@@ -49,6 +45,6 @@ function requireArray(value, label) {
 	return value;
 }
 //#endregion
-export { asRecord, coerceNonEmptyString, isFunction, isObject, isPlainObject, isString, requireArray, requireCanonicalString, requireNonEmptyString, requireRecord, requireRecordCopy, requireRecordOrArray, requireTrimmedString };
+export { asRecord, coerceNonEmptyString, isFunction, isObject, isPlainObject, requireArray, requireCanonicalString, requireNonEmptyString, requireRecord, requireRecordCopy, requireRecordOrArray, requireTrimmedString };
 
 //# sourceMappingURL=validation.js.map

package/dist/esm/shared-ts/src/utils/walletAuthAuthority.js

@@ -1,7 +1,6 @@
 import { parseEmailOtpProviderUserId, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "./domainIds.js";
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
-import "./encoders.js";
 //#region ../shared-ts/src/utils/walletAuthAuthority.ts
 const WALLET_AUTHORITY_BINDING_DIGEST_DOMAIN = "seams:wallet-authority-binding:v1|";
 function isPasskeyWalletAuthAuthority(authority) {

package/dist/esm/shared-ts/src/utils/walletManagementProtocol.js

@@ -0,0 +1,6 @@
+//#region ../shared-ts/src/utils/walletManagementProtocol.ts
+const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
+//#endregion
+export { WALLET_MANAGEMENT_PROTOCOL_HEADER };
+
+//# sourceMappingURL=walletManagementProtocol.js.map

package/dist/esm/shared-ts/src/utils/wireSchema.js

@@ -1,4 +1,4 @@
-import { requireArray, requireRecord } from "./validation.js";
+import { requireRecord } from "./validation.js";
 import { exactRecord } from "./exactRecord.js";
 //#region ../shared-ts/src/utils/wireSchema.ts
 /** One of the given strings. */
@@ -42,17 +42,6 @@ function wireUnion(tag, variants) {
 function wireNullable(parse) {
 	return (raw, label) => raw === null ? null : parse(raw, label);
 }
-/** A non-empty array of `item`; `refine` checks rules that span the items. */
-function wireNonEmptyArray(item, refine) {
-	return (raw, label) => {
-		const entries = requireArray(raw, label);
-		if (entries.length === 0) throw new Error(`${label} must be non-empty`);
-		const [first, ...rest] = entries.map((entry, index) => item(entry, `${label}[${index}]`));
-		const items = [first, ...rest];
-		refine?.(items, label);
-		return items;
-	};
-}
 /** Adapts a parser that returns a result, putting the field's label before its error. */
 function wireResult(parse) {
 	return (raw, label) => {
@@ -72,6 +61,6 @@ function wireLabeled(parse) {
 	};
 }
 //#endregion
-export { wireLabeled, wireLiteral, wireNonEmptyArray, wireNullable, wireObject, wireResult, wireUnion };
+export { wireLabeled, wireLiteral, wireNullable, wireObject, wireResult, wireUnion };
 
 //# sourceMappingURL=wireSchema.js.map

package/dist/esm/shared-ts/src/wallet-recovery/backupAcknowledgement.js

@@ -1,33 +1,15 @@
 //#region ../shared-ts/src/wallet-recovery/backupAcknowledgement.ts
 function parseWalletRecoveryBackupAcknowledgementV1(raw, options) {
-	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return {
-		ok: false,
-		reason: "backup acknowledgement must be an object"
-	};
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return { ok: false };
 	const record = raw;
-	if (record.kind !== "wallet_recovery_backup_acknowledgement_v1") return {
-		ok: false,
-		reason: "backup acknowledgement kind is invalid"
-	};
+	if (record.kind !== "wallet_recovery_backup_acknowledgement_v1") return { ok: false };
 	const walletId = String(record.walletId || "").trim();
-	if (!walletId) return {
-		ok: false,
-		reason: "backup acknowledgement must name its wallet"
-	};
-	if (walletId !== String(options.expectedWalletId).trim()) return {
-		ok: false,
-		reason: "backup acknowledgement is outside the requested wallet"
-	};
+	if (!walletId) return { ok: false };
+	if (walletId !== String(options.expectedWalletId).trim()) return { ok: false };
 	const issuedAtMs = timestamp(record.issuedAtMs);
 	const acknowledgedAtMs = timestamp(record.acknowledgedAtMs);
-	if (issuedAtMs === null || acknowledgedAtMs === null) return {
-		ok: false,
-		reason: "backup acknowledgement needs valid timestamps"
-	};
-	if (acknowledgedAtMs < issuedAtMs) return {
-		ok: false,
-		reason: "backup acknowledgement predates the issuance it names"
-	};
+	if (issuedAtMs === null || acknowledgedAtMs === null) return { ok: false };
+	if (acknowledgedAtMs < issuedAtMs) return { ok: false };
 	return {
 		ok: true,
 		record: {

package/dist/esm/shared-ts/src/wallet-recovery/recoveryCodeLocator.js

@@ -1,7 +1,6 @@
 import { base64UrlEncode } from "../utils/base64.js";
 import { sha256Bytes } from "../utils/digests.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import "../utils/encoders.js";
 import "../utils/emailOtpRecoveryKey.js";
 //#region ../shared-ts/src/wallet-recovery/recoveryCodeLocator.ts
 const RECOVERY_CODE_LOCATOR_CONTEXT_V1 = "seams/wallet-recovery/code-locator/v1";

package/dist/esm/shared-ts/src/wallet-recovery/recoveryKeyId.js

@@ -1,7 +1,5 @@
 import { base64UrlEncode } from "../utils/base64.js";
-import "../utils/encoders.js";
 import { encodeSigningSessionHkdfTuple } from "../utils/signingSessionSeal.js";
-import "../utils/emailOtpRecoveryKey.js";
 //#region ../shared-ts/src/wallet-recovery/recoveryKeyId.ts
 const WALLET_RECOVERY_KEY_ID_PREFIX_V1 = "wallet-rkid-v1-";
 const WALLET_RECOVERY_KEY_ID_CONTEXT_V1 = "seams/wallet-recovery/recovery-key-id/v1";
@@ -13,11 +11,12 @@ function parseDerivedWalletRecoveryKeyId(value, label = "recoveryKeyId") {
 	return value;
 }
 /**
-* The same derivation from decoded bytes.
+* Derives one code's id within a wallet's recovery set, from the decoded code
+* bytes the ceremony already holds.
 *
-* Separate entry point because the ceremony seals wraps from bytes it already
-* holds, while a user typing a code arrives as a string. Both must reach one
-* id, so both go through this.
+* Bound to the wallet and the set version, so the same code typed against a
+* different wallet produces a different id and finds no wrap. Length-delimited
+* fields under a fixed context, so no two inputs encode alike.
 */
 async function deriveWalletRecoveryKeyIdFromBytes(args) {
 	const walletId = String(args.walletId || "").trim();

package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.js

@@ -1,6 +1,6 @@
+import { requireRecord } from "../utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestB64u, sha256DigestB64u } from "../utils/canonicalPrimitives.js";
-import { requireRecord } from "../utils/validation.js";
 //#region ../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.ts
 const POSSESSION_CHALLENGE_DOMAIN_V1 = "seams/wallet-recovery/ecdsa-existing-material-possession/v1";
 const POSSESSION_PROOF_SCHEME_V1 = "secp256k1_bip340_sha256_v1";

package/dist/esm/storage/d1Sql.js

@@ -73,12 +73,6 @@ function isD1DatabaseLike(value) {
 	const probe = d1DatabaseProbe(value);
 	return Boolean(probe && typeof probe.prepare === "function" && typeof probe.batch === "function" && typeof probe.exec === "function");
 }
-function resolveD1DatabaseFromConfig(config) {
-	if (isD1DatabaseLike(config.database)) return config.database;
-	if (isD1DatabaseLike(config.metadataDatabase)) return config.metadataDatabase;
-	if (isD1DatabaseLike(config.SIGNER_DB)) return config.SIGNER_DB;
-	return null;
-}
 /**
 * Aborts the D1 batch it is in when the statement just before it changed no
 * row: it collides with the guard table's immutable singleton, and the
@@ -89,6 +83,6 @@ const D1_BATCH_CAS_GUARD_SQL = `INSERT INTO router_ab_yao_versioned_json_cas_gua
 SELECT 1
  WHERE changes() = 0`;
 //#endregion
-export { D1_BATCH_CAS_GUARD_SQL, d1ChangedRows, d1Integer, d1Number, formatD1ExecStatement, isD1DatabaseLike, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, queryD1All, queryD1One, resolveD1DatabaseFromConfig };
+export { D1_BATCH_CAS_GUARD_SQL, d1ChangedRows, d1Integer, d1Number, formatD1ExecStatement, isD1DatabaseLike, parseD1JsonArrayColumn, parseD1JsonColumn, parseD1JsonObjectColumn, queryD1All, queryD1One };
 
 //# sourceMappingURL=d1Sql.js.map

package/dist/esm/threshold/session/signingSessionSeal/crypto/cipher.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, encodeSigningSessionHkdfTuple } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { parseSigningSessionSealKeyVersion } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";

package/dist/esm/threshold/session/signingSessionSeal/guards/backends.js

@@ -1,7 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
-import { RedisTcpClient, UpstashRedisRestClient } from "../../../../core/ThresholdService/kv.js";
 import { createInMemorySigningSessionSealRateLimiter } from "./index.js";
+import { RedisTcpClient, UpstashRedisRestClient } from "../../../../core/ThresholdService/kv.js";
 //#region src/threshold/session/signingSessionSeal/guards/backends.ts
 const WINDOW_COUNTER_LUA = `
 local key = KEYS[1]

package/dist/esm/threshold/session/signingSessionSeal/idempotencyBackends.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetJson, redisSetJson } from "../../../core/ThresholdService/kv.js";
 import { createInMemorySigningSessionSealIdempotencyStore } from "./idempotency.js";
 import { parseCurrentSigningSessionSealIdempotencyResultRecord, parseCurrentSigningSessionSealIdempotencyStoredEntry } from "./idempotencyRecords.js";

package/dist/esm/threshold/session/signingSessionSeal/idempotencyRecords.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { failure } from "../../../shared-ts/src/utils/failure.js";
 //#region src/threshold/session/signingSessionSeal/idempotencyRecords.ts
 function toPositiveInt(value) {

package/dist/esm/threshold/session/signingSessionSeal/options.js

@@ -1,7 +1,6 @@
+import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID } from "../../../shared-ts/src/utils/signingSessionSeal.js";
 import { parseSigningSessionSealKeyVersion } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { createSigningSessionSealShamir3PassCipherAdapter } from "./crypto/cipher.js";