@seams/wallet 0.6.1 → 0.7.1

package/dist/esm/react/shared-ts/src/signing-lanes/recordParsers.js

@@ -1,8 +1,10 @@
+import { requireRecord } from "../utils/validation.js";
 import { hasWhitespaceOrControlCharacters, parseLaneShareEpoch, parseLinkedDeviceId, parseSigningLaneId, parseWalletAuthMethodId, parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
-import { requireEvmFamilySigningKeySlotId } from "./evmFamilySigningKeySlotId.js";
-import { parseDigestField, parseEd25519PublicKeyB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs, rejectUnknownFields, requireRecord } from "../passkey-custody/primitives.js";
-import { parseNearEd25519SigningKeyId } from "../utils/registrationIntent.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { parseDigestField, parseEd25519PublicKeyB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs } from "../passkey-custody/primitives.js";
 import { parseLaneHolderParticipantRecordV1, parseLaneParticipantBindingDigestB64u, parseSigningWorkerParticipantRecordV1 } from "./participants.js";
+import { parseNearEd25519SigningKeyId } from "../utils/registrationIds.js";
+import { requireEvmFamilySigningKeySlotId } from "./evmFamilySigningKeySlotId.js";
 import { parseOwnerLaneParticipantContinuityV1 } from "./ownerContinuity.js";
 //#region ../shared-ts/src/signing-lanes/recordParsers.ts
 const WALLET_KEY_COMMON_FIELDS = [
@@ -32,7 +34,7 @@ const WALLET_KEY_LIFECYCLE_FIELDS = [
 	"retiredAtMs",
 	"compromisedAtMs"
 ];
-const SIGNING_LANE_REFERENCE_FIELDS = [
+const SIGNING_LANE_RECORD_BASE_FIELDS = [...[
 	"kind",
 	"walletId",
 	"walletKeyId",
@@ -40,9 +42,7 @@ const SIGNING_LANE_REFERENCE_FIELDS = [
 	"laneKind",
 	"laneShareEpoch",
 	"participantBindingDigestB64u"
-];
-[...SIGNING_LANE_REFERENCE_FIELDS];
-const SIGNING_LANE_RECORD_BASE_FIELDS = [...SIGNING_LANE_REFERENCE_FIELDS, "lifecycle"];
+], "lifecycle"];
 const OWNER_AUTH_SIGNING_LANE_FIELDS = [
 	...SIGNING_LANE_RECORD_BASE_FIELDS,
 	"walletAuthMethodId",

package/dist/esm/react/shared-ts/src/signing-lanes/rotationDigests.js

@@ -1,3 +1,5 @@
+import "../utils/digestEncoding.js";
+import "./ownerContinuity.js";
 new TextEncoder();
 //#endregion
 

package/dist/esm/react/shared-ts/src/signing-lanes/rotationParsers.js

@@ -1,3 +1,3 @@
-import "../threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import "../authorization/capabilityKinds.js";
-import "../utils/registrationIntent.js";
+import "../utils/wireSchema.js";
+import "./participants.js";
+import "./rotationWireFields.js";

package/dist/esm/react/shared-ts/src/signing-lanes/rotationProtocolParsers.js

@@ -0,0 +1,8 @@
+import "../utils/validation.js";
+import "../utils/exactRecord.js";
+import "../utils/wireSchema.js";
+import "./participants.js";
+import "./rotationWireFields.js";
+import "../utils/registrationIds.js";
+import "../threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import "./ownerContinuity.js";

package/dist/esm/react/shared-ts/src/signing-lanes/rotationWireFields.js

@@ -0,0 +1,3 @@
+import "../authorization/capabilityKinds.js";
+import "../utils/wireSchema.js";
+import "./participants.js";

package/dist/esm/react/shared-ts/src/threshold/ed25519OperationFingerprint.js

@@ -1,4 +1,5 @@
 import { base64UrlEncode } from "../utils/base64.js";
+import { coerceNonEmptyString, requireRecord } from "../utils/validation.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../utils/digests.js";
 //#region ../shared-ts/src/threshold/ed25519OperationFingerprint.ts
 async function thresholdEd25519NearTransactionPlanningOperationFingerprint(input) {
@@ -18,8 +19,8 @@ async function thresholdEd25519NearTransactionOperationFingerprint(input) {
 			purpose: "near_transaction",
 			...canonicalScope(input),
 			transactions: canonicalNearTransactions(input.transactions),
-			unsignedTransactionBorshB64u: requiredString(input.unsignedTransactionBorshB64u, "unsignedTransactionBorshB64u"),
-			signingDigestB64u: requiredString(input.signingDigestB64u, "signingDigestB64u")
+			unsignedTransactionBorshB64u: coerceNonEmptyString(input.unsignedTransactionBorshB64u, "unsignedTransactionBorshB64u"),
+			signingDigestB64u: coerceNonEmptyString(input.signingDigestB64u, "signingDigestB64u")
 		}
 	});
 }
@@ -29,9 +30,9 @@ async function thresholdEd25519Nep413OperationFingerprint(input) {
 		payload: {
 			purpose: "nep413_message",
 			...canonicalScope(input),
-			message: requiredString(input.message, "message"),
-			recipient: requiredString(input.recipient, "recipient"),
-			nonce: requiredString(input.nonce, "nonce"),
+			message: coerceNonEmptyString(input.message, "message"),
+			recipient: coerceNonEmptyString(input.recipient, "recipient"),
+			nonce: coerceNonEmptyString(input.nonce, "nonce"),
 			state: input.state ? String(input.state) : null
 		}
 	});
@@ -48,16 +49,16 @@ async function thresholdEd25519DelegateActionOperationFingerprint(input) {
 }
 async function thresholdEd25519OperationFingerprint(input) {
 	return `sha256:${base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-		kind: requiredString(input.kind, "kind"),
+		kind: coerceNonEmptyString(input.kind, "kind"),
 		payload: normalizeFingerprintValue(input.payload)
 	})))}`;
 }
 function canonicalScope(input) {
 	return {
-		nearAccountId: requiredString(input.nearAccountId, "nearAccountId"),
-		nearNetworkId: requiredString(input.nearNetworkId, "nearNetworkId"),
-		relayerKeyId: requiredString(input.relayerKeyId, "relayerKeyId"),
-		signerPublicKey: requiredString(input.signerPublicKey, "signerPublicKey")
+		nearAccountId: coerceNonEmptyString(input.nearAccountId, "nearAccountId"),
+		nearNetworkId: coerceNonEmptyString(input.nearNetworkId, "nearNetworkId"),
+		relayerKeyId: coerceNonEmptyString(input.relayerKeyId, "relayerKeyId"),
+		signerPublicKey: coerceNonEmptyString(input.signerPublicKey, "signerPublicKey")
 	};
 }
 function canonicalNearTransactions(transactions) {
@@ -66,19 +67,19 @@ function canonicalNearTransactions(transactions) {
 }
 function canonicalDelegate(delegate) {
 	return {
-		senderId: requiredString(delegate.senderId, "delegate.senderId"),
-		receiverId: requiredString(delegate.receiverId, "delegate.receiverId"),
+		senderId: coerceNonEmptyString(delegate.senderId, "delegate.senderId"),
+		receiverId: coerceNonEmptyString(delegate.receiverId, "delegate.receiverId"),
 		actions: canonicalActions(delegate.actions, "delegate.actions"),
-		nonce: requiredString(delegate.nonce, "delegate.nonce"),
-		maxBlockHeight: requiredString(delegate.maxBlockHeight, "delegate.maxBlockHeight"),
-		publicKey: requiredString(delegate.publicKey, "delegate.publicKey")
+		nonce: coerceNonEmptyString(delegate.nonce, "delegate.nonce"),
+		maxBlockHeight: coerceNonEmptyString(delegate.maxBlockHeight, "delegate.maxBlockHeight"),
+		publicKey: coerceNonEmptyString(delegate.publicKey, "delegate.publicKey")
 	};
 }
 function parseThresholdEd25519NearTransaction(raw, label) {
 	const record = requireRecord(raw, label);
 	return {
-		nearAccountId: requiredString(record.nearAccountId, `${label}.nearAccountId`),
-		receiverId: requiredString(record.receiverId, `${label}.receiverId`),
+		nearAccountId: coerceNonEmptyString(record.nearAccountId, `${label}.nearAccountId`),
+		receiverId: coerceNonEmptyString(record.receiverId, `${label}.receiverId`),
 		actions: canonicalActions(record.actions, `${label}.actions`)
 	};
 }
@@ -88,7 +89,7 @@ function canonicalActions(actions, label) {
 }
 function parseThresholdEd25519NearAction(action, label) {
 	const record = requireRecord(action, label);
-	const actionType = requiredString(record.action_type, `${label}.action_type`);
+	const actionType = coerceNonEmptyString(record.action_type, `${label}.action_type`);
 	switch (actionType) {
 		case "CreateAccount": return { action_type: actionType };
 		case "DeployContract": return {
@@ -97,32 +98,32 @@ function parseThresholdEd25519NearAction(action, label) {
 		};
 		case "FunctionCall": return {
 			action_type: actionType,
-			method_name: requiredString(record.method_name, `${label}.method_name`),
-			args: requiredString(record.args, `${label}.args`),
-			gas: requiredString(record.gas, `${label}.gas`),
-			deposit: requiredString(record.deposit, `${label}.deposit`)
+			method_name: coerceNonEmptyString(record.method_name, `${label}.method_name`),
+			args: coerceNonEmptyString(record.args, `${label}.args`),
+			gas: coerceNonEmptyString(record.gas, `${label}.gas`),
+			deposit: coerceNonEmptyString(record.deposit, `${label}.deposit`)
 		};
 		case "Transfer": return {
 			action_type: actionType,
-			deposit: requiredString(record.deposit, `${label}.deposit`)
+			deposit: coerceNonEmptyString(record.deposit, `${label}.deposit`)
 		};
 		case "Stake": return {
 			action_type: actionType,
-			stake: requiredString(record.stake, `${label}.stake`),
-			public_key: requiredString(record.public_key, `${label}.public_key`)
+			stake: coerceNonEmptyString(record.stake, `${label}.stake`),
+			public_key: coerceNonEmptyString(record.public_key, `${label}.public_key`)
 		};
 		case "AddKey": return {
 			action_type: actionType,
-			public_key: requiredString(record.public_key, `${label}.public_key`),
-			access_key: requiredString(record.access_key, `${label}.access_key`)
+			public_key: coerceNonEmptyString(record.public_key, `${label}.public_key`),
+			access_key: coerceNonEmptyString(record.access_key, `${label}.access_key`)
 		};
 		case "DeleteKey": return {
 			action_type: actionType,
-			public_key: requiredString(record.public_key, `${label}.public_key`)
+			public_key: coerceNonEmptyString(record.public_key, `${label}.public_key`)
 		};
 		case "DeleteAccount": return {
 			action_type: actionType,
-			beneficiary_id: requiredString(record.beneficiary_id, `${label}.beneficiary_id`)
+			beneficiary_id: coerceNonEmptyString(record.beneficiary_id, `${label}.beneficiary_id`)
 		};
 		case "SignedDelegate": return {
 			action_type: actionType,
@@ -141,8 +142,8 @@ function parseThresholdEd25519NearAction(action, label) {
 function parseThresholdEd25519SignedDelegateAction(raw, label) {
 	const record = requireRecord(raw, label);
 	return {
-		senderId: requiredString(record.senderId, `${label}.senderId`),
-		receiverId: requiredString(record.receiverId, `${label}.receiverId`),
+		senderId: coerceNonEmptyString(record.senderId, `${label}.senderId`),
+		receiverId: coerceNonEmptyString(record.receiverId, `${label}.receiverId`),
 		actions: canonicalActions(record.actions, `${label}.actions`),
 		nonce: requiredIntegerLike(record.nonce, `${label}.nonce`),
 		maxBlockHeight: requiredIntegerLike(record.maxBlockHeight, `${label}.maxBlockHeight`),
@@ -191,22 +192,13 @@ function requiredSafeInteger(value, label) {
 function requiredIntegerLike(value, label) {
 	if (typeof value === "bigint") return value;
 	if (typeof value === "number" && Number.isSafeInteger(value)) return value;
-	return requiredString(value, label);
+	return coerceNonEmptyString(value, label);
 }
 function requiredDeployMode(value, label) {
-	const deployMode = requiredString(value, label);
+	const deployMode = coerceNonEmptyString(value, label);
 	if (deployMode === "CodeHash" || deployMode === "AccountId") return deployMode;
 	throw new Error(`${label} is invalid`);
 }
-function requireRecord(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-function requiredString(value, label) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error(`${label} is required`);
-	return normalized;
-}
 function optionalString(value) {
 	return String(value || "").trim() || null;
 }

package/dist/esm/react/shared-ts/src/threshold/keyMaterialBrands.js

@@ -0,0 +1,25 @@
+//#region ../shared-ts/src/threshold/keyMaterialBrands.ts
+function parseNonEmptyBrand(value, label) {
+	const normalized = String(value ?? "").trim();
+	if (!normalized) throw new Error(`${label} must be a non-empty string`);
+	return normalized;
+}
+function parseSigningSessionSealKeyVersion(value) {
+	return parseNonEmptyBrand(value, "signing-session seal key version");
+}
+function parseEcdsaClientVerifyingShareB64u(value) {
+	return parseNonEmptyBrand(value, "ECDSA client verifying share");
+}
+function parseEcdsaRelayerKeyId(value) {
+	return parseNonEmptyBrand(value, "ECDSA relayer key id");
+}
+function parseEcdsaKeyHandle(value) {
+	return parseNonEmptyBrand(value, "ECDSA key handle");
+}
+function formatEcdsaKeyHandleForWire(value) {
+	return value;
+}
+//#endregion
+export { formatEcdsaKeyHandleForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseNonEmptyBrand, parseSigningSessionSealKeyVersion };
+
+//# sourceMappingURL=keyMaterialBrands.js.map

package/dist/esm/react/shared-ts/src/threshold/secp256k1.js

@@ -1,5 +1,4 @@
-import "../utils/validation.js";
-Object.freeze({ kind: "threshold_secp256k1_ecdsa_2p_v1" });
+//#region ../shared-ts/src/threshold/secp256k1.ts
 const THRESHOLD_SECP256K1_ECDSA_2P_PARTICIPANT_IDS_V1 = [1, 2];
 //#endregion
 export { THRESHOLD_SECP256K1_ECDSA_2P_PARTICIPANT_IDS_V1 };

package/dist/esm/react/shared-ts/src/utils/addAuthMethodRegistration.js

@@ -5,10 +5,9 @@ import { parseWebAuthnRpId } from "./domainIds.js";
 *
 * This lives in the shared package because three parties read the same record:
 * the server that mints it, the browser that passes it to
-* `navigator.credentials.create`, and — since Refactor 103 Phase 8 — the
-* linked-device target preparation that carries it to Device 2. One
-* declaration, so a change to the ceremony cannot silently diverge from what a
-* linked device creates its passkey against.
+* `navigator.credentials.create`, and the linked-device target preparation that
+* carries it to Device 2. One declaration, so a change to the ceremony cannot
+* silently diverge from what a linked device creates its passkey against.
 *
 * Everything here is fixed by the canonical add-auth-method ceremony: two
 * algorithms in a fixed order, a resident key, no attestation, and PRF

package/dist/esm/react/shared-ts/src/utils/canonicalPrimitives.js

@@ -1,4 +1,5 @@
 import { base64UrlDecode, base64UrlEncode } from "./base64.js";
+import { sha256Bytes, sha256BytesUtf8 } from "./digests.js";
 //#region ../shared-ts/src/utils/canonicalPrimitives.ts
 function parseCorrelationId(value) {
 	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error("correlation id must be a non-empty canonical string");
@@ -25,7 +26,13 @@ function isoTimestampFromUnixMs(value) {
 	if (!Number.isSafeInteger(value) || Number(value) <= 0) throw new Error("timestamp milliseconds must be a positive safe integer");
 	return parseIsoTimestamp(new Date(Number(value)).toISOString());
 }
+async function sha256DigestB64u(bytes) {
+	return parseDigestB64u(base64UrlEncode(await sha256Bytes(bytes)));
+}
+async function sha256Utf8DigestB64u(text) {
+	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(text)));
+}
 //#endregion
-export { isoTimestampFromUnixMs, parseCorrelationId, parseDigestB64u, parseIsoTimestamp };
+export { isoTimestampFromUnixMs, parseCorrelationId, parseDigestB64u, parseIsoTimestamp, sha256DigestB64u, sha256Utf8DigestB64u };
 
 //# sourceMappingURL=canonicalPrimitives.js.map

package/dist/esm/react/shared-ts/src/utils/digestEncoding.js

@@ -0,0 +1,63 @@
+import { base64UrlDecode, base64UrlEncode } from "./base64.js";
+import { parseDigestB64u } from "./canonicalPrimitives.js";
+//#region ../shared-ts/src/utils/digestEncoding.ts
+const TEXT_ENCODER = new TextEncoder();
+function concat(parts) {
+	let length = 0;
+	for (const part of parts) length += part.length;
+	const output = new Uint8Array(length);
+	let offset = 0;
+	for (const part of parts) {
+		output.set(part, offset);
+		offset += part.length;
+	}
+	return output;
+}
+function u32(value, label) {
+	if (!Number.isSafeInteger(value) || value < 0 || value > 4294967295) throw new Error(`${label} must be a non-negative u32`);
+	return Uint8Array.from([
+		value >>> 24 & 255,
+		value >>> 16 & 255,
+		value >>> 8 & 255,
+		value & 255
+	]);
+}
+function u64(value, label) {
+	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative safe integer`);
+	let remaining = BigInt(value);
+	const output = new Uint8Array(8);
+	for (let index = 7; index >= 0; index -= 1) {
+		output[index] = Number(remaining & 255n);
+		remaining >>= 8n;
+	}
+	return output;
+}
+function lp32(value, label) {
+	return concat([u32(value.length, `${label}.length`), value]);
+}
+function text(value, label) {
+	if (typeof value !== "string") throw new Error(`${label} must be a string`);
+	return lp32(TEXT_ENCODER.encode(value), label);
+}
+function rawDigest(value, label) {
+	try {
+		const decoded = base64UrlDecode(parseDigestB64u(value));
+		if (decoded.length !== 32) throw new Error("must decode to 32 bytes");
+		return decoded;
+	} catch (error) {
+		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
+	}
+}
+function rawPublicKey(value, label) {
+	try {
+		const decoded = base64UrlDecode(value);
+		if (decoded.length === 0 || base64UrlEncode(decoded) !== value) throw new Error("must be canonical base64url");
+		return decoded;
+	} catch (error) {
+		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
+	}
+}
+//#endregion
+export { concat, lp32, rawDigest, rawPublicKey, text, u32, u64 };
+
+//# sourceMappingURL=digestEncoding.js.map

package/dist/esm/react/shared-ts/src/utils/ecdsaKeyFactsInventory.js

@@ -41,6 +41,6 @@ async function computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u(input) {
 	return base64UrlEncode(await sha256BytesUtf8(canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input)));
 }
 //#endregion
-export { canonicalizeWalletEcdsaKeyFactsInventoryChallenge, computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u };
+export { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u };
 
 //# sourceMappingURL=ecdsaKeyFactsInventory.js.map

package/dist/esm/react/shared-ts/src/utils/emailOtpDomain.js

@@ -6,8 +6,8 @@ const WALLET_EMAIL_OTP_LOGIN_OPERATIONS = [
 	"export_key"
 ];
 const WALLET_EMAIL_OTP_REGISTRATION_OPERATION = "registration";
-/** Linked-device enrollment (Refactor 103 Phase 6): prove control of the
-* wallet's enrolled email destination to complete one device link. */
+/** Linked-device enrollment: prove control of the wallet's enrolled email
+* destination to complete one device link. */
 const WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION = "device_link";
 const WALLET_EMAIL_OTP_ACTIONS = {
 	login: "wallet_email_otp_login",
@@ -23,6 +23,6 @@ function isWalletEmailOtpLoginOperation(value) {
 	return WALLET_EMAIL_OTP_LOGIN_OPERATIONS.includes(value);
 }
 //#endregion
-export { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_LOGIN_OPERATIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation };
+export { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation };
 
 //# sourceMappingURL=emailOtpDomain.js.map

package/dist/esm/react/shared-ts/src/utils/encoders.js

@@ -1,2 +1,2 @@
-import "./base64.js";
 import "./base58.js";
+import "./base64.js";

package/dist/esm/react/shared-ts/src/utils/errors.js

@@ -90,6 +90,6 @@ function getUserFriendlyErrorMessage(error, context = "registration", accountId)
 	return msg;
 }
 //#endregion
-export { errorMessage, getTouchIdCancellationMessage, getUserFriendlyErrorMessage, isTouchIdCancellationError, isUserCancellationError, isWebAuthnRpIdOriginConfigurationError, toError };
+export { errorMessage, getUserFriendlyErrorMessage, isTouchIdCancellationError, isUserCancellationError, isWebAuthnRpIdOriginConfigurationError, toError };
 
 //# sourceMappingURL=errors.js.map

package/dist/esm/react/shared-ts/src/utils/exactRecord.js

@@ -0,0 +1,44 @@
+import { requireRecord } from "./validation.js";
+//#region ../shared-ts/src/utils/exactRecord.ts
+const SECRET_BEARING_FIELD_SUBSTRINGS = [
+	"prf",
+	"kek",
+	"seed",
+	"scalar",
+	"secretkey",
+	"privatekey",
+	"plaintext",
+	"recoverycode",
+	"clientroot",
+	"holdershare"
+];
+/**
+* Rejects every field outside this record's exact shape.
+*
+* `knownOnOtherBranches` names fields that are legitimate public bindings
+* somewhere else in the same union. Those are reported as the branch mismatch
+* they are; only genuinely unknown fields are classified as leaks, so a public
+* key like `clientRootPublicKey33B64u` on the wrong branch is never mistaken
+* for plaintext custody material.
+*/
+function rejectUnknownFields(record, allowed, label, knownOnOtherBranches = []) {
+	const allowedSet = new Set(allowed);
+	const knownSet = new Set(knownOnOtherBranches);
+	for (const field of Object.keys(record)) {
+		if (allowedSet.has(field)) continue;
+		if (knownSet.has(field)) throw new Error(`${label}.${field} is not part of ${label}`);
+		const normalized = field.toLowerCase().replace(/_/g, "");
+		if (!normalized.includes("publickey") && SECRET_BEARING_FIELD_SUBSTRINGS.some((substring) => normalized.includes(substring))) throw new Error(`${label}.${field} must never carry plaintext custody material`);
+		throw new Error(`${label}.${field} is not part of ${label}`);
+	}
+}
+function exactRecord(raw, fields, label) {
+	const record = requireRecord(raw, label);
+	rejectUnknownFields(record, fields, label);
+	for (const field of fields) if (!Object.prototype.hasOwnProperty.call(record, field) || record[field] === void 0) throw new Error(`${label}.${field} is required`);
+	return record;
+}
+//#endregion
+export { exactRecord, rejectUnknownFields };
+
+//# sourceMappingURL=exactRecord.js.map

package/dist/esm/react/shared-ts/src/utils/index.js

@@ -1,7 +1,7 @@
-import "./base64.js";
 import "./base58.js";
 import "./near.js";
 import "./errors.js";
+import "./base64.js";
 import "./secureRandomId.js";
 import "./normalize.js";
 import "./validation.js";
@@ -12,23 +12,27 @@ import "./digests.js";
 import "./encoders.js";
 import "./theme.js";
 import "./signingSessionSeal.js";
-import "./domainIds.js";
 import "./routerAbPublicKeyset.js";
+import "./domainIds.js";
 import "./canonicalPrimitives.js";
 import "./ecdsaCapabilityActivation.js";
-import "./addAuthMethodRegistration.js";
-import "./registrationIntent.js";
-import "./webauthnDeviceInfo.js";
-import "./routerAbEd25519Yao.js";
 import "./walletAuthAuthority.js";
 import "./routerAbEcdsaDerivation.js";
-import "./walletCapabilityBindings.js";
 import "./emailOtpDomain.js";
 import "./signerDomain.js";
+import "./registrationIds.js";
+import "./walletCapabilityBindings.js";
 import "./signerSlot.js";
+import "./registrationAuthMethodInput.js";
+import "./walletAuthMethodRecord.js";
+import "./addAuthMethodRegistration.js";
+import "./routerAbEd25519YaoDigests.js";
+import "./routerAbEd25519Yao.js";
+import "./webauthnDeviceInfo.js";
 import "./emailOtpRecoveryKey.js";
 import "./routerAbTraceContext.js";
 import "./keccak.js";
-import "./paillier.js";
 import "./addWalletAuthMethod.js";
+import "./registrationSignerPlan.js";
+import "./registrationIntent.js";
 import "./ecdsaKeyFactsInventory.js";

package/dist/esm/react/shared-ts/src/utils/registrationAuthMethodInput.js

@@ -0,0 +1,84 @@
+import { parseWebAuthnRpId } from "./domainIds.js";
+//#region ../shared-ts/src/utils/registrationAuthMethodInput.ts
+function inspectRawObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function trimString(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+function normalizeRegistrationAuthMethodInput(raw) {
+	const record = inspectRawObject(raw);
+	if (!record || !("kind" in record)) return null;
+	const kind = trimString(record.kind);
+	if (kind === "passkey") {
+		const rpId = parseWebAuthnRpId("rpId" in record ? record.rpId : void 0);
+		if (!rpId.ok || Object.prototype.hasOwnProperty.call(record, "email") || Object.prototype.hasOwnProperty.call(record, "otpCode") || Object.prototype.hasOwnProperty.call(record, "challengeId")) return null;
+		return {
+			kind: "passkey",
+			rpId: rpId.value,
+			..."authenticatorOptions" in record && record.authenticatorOptions !== void 0 ? { authenticatorOptions: record.authenticatorOptions } : {}
+		};
+	}
+	if (kind === "email_otp") {
+		const proofKind = trimString("proofKind" in record ? record.proofKind : void 0);
+		const email = trimString("email" in record ? record.email : void 0);
+		const providerSubject = trimString("providerSubject" in record ? record.providerSubject : void 0);
+		if (!email || !providerSubject || Object.prototype.hasOwnProperty.call(record, "rpId") || Object.prototype.hasOwnProperty.call(record, "authenticatorOptions")) return null;
+		if (proofKind === "otp_challenge") {
+			const otpCode = trimString("otpCode" in record ? record.otpCode : void 0);
+			const challengeId = trimString("challengeId" in record ? record.challengeId : void 0);
+			if (!otpCode || Object.prototype.hasOwnProperty.call(record, "googleEmailOtpRegistrationAttemptId") || Object.prototype.hasOwnProperty.call(record, "googleEmailOtpRegistrationOfferId") || Object.prototype.hasOwnProperty.call(record, "googleEmailOtpRegistrationCandidateId")) return null;
+			return {
+				kind: "email_otp",
+				proofKind: "otp_challenge",
+				email,
+				providerSubject,
+				otpCode,
+				...challengeId ? { challengeId } : {}
+			};
+		}
+		if (proofKind === "google_sso_registration") {
+			const googleEmailOtpRegistrationAttemptId = trimString("googleEmailOtpRegistrationAttemptId" in record ? record.googleEmailOtpRegistrationAttemptId : void 0);
+			const googleEmailOtpRegistrationOfferId = trimString("googleEmailOtpRegistrationOfferId" in record ? record.googleEmailOtpRegistrationOfferId : void 0);
+			const googleEmailOtpRegistrationCandidateId = trimString("googleEmailOtpRegistrationCandidateId" in record ? record.googleEmailOtpRegistrationCandidateId : void 0);
+			if (!googleEmailOtpRegistrationAttemptId || !googleEmailOtpRegistrationOfferId || !googleEmailOtpRegistrationCandidateId || Object.prototype.hasOwnProperty.call(record, "otpCode") || Object.prototype.hasOwnProperty.call(record, "challengeId")) return null;
+			return {
+				kind: "email_otp",
+				proofKind: "google_sso_registration",
+				email,
+				providerSubject,
+				googleEmailOtpRegistrationAttemptId,
+				googleEmailOtpRegistrationOfferId,
+				googleEmailOtpRegistrationCandidateId
+			};
+		}
+		return null;
+	}
+	return null;
+}
+function normalizeAddAuthMethodInput(raw) {
+	const record = inspectRawObject(raw);
+	if (!record || !("kind" in record)) return null;
+	const kind = trimString(record.kind);
+	if (kind === "passkey") {
+		const rpId = parseWebAuthnRpId("rpId" in record ? record.rpId : void 0);
+		if (!rpId.ok || Object.prototype.hasOwnProperty.call(record, "email") || Object.prototype.hasOwnProperty.call(record, "otpCode") || Object.prototype.hasOwnProperty.call(record, "challengeId") || Object.prototype.hasOwnProperty.call(record, "authenticatorOptions")) return null;
+		return {
+			kind: "passkey",
+			rpId: rpId.value
+		};
+	}
+	if (kind === "email_otp") {
+		const email = trimString("email" in record ? record.email : void 0);
+		if (!email || Object.prototype.hasOwnProperty.call(record, "rpId") || Object.prototype.hasOwnProperty.call(record, "otpCode") || Object.prototype.hasOwnProperty.call(record, "challengeId") || Object.prototype.hasOwnProperty.call(record, "authenticatorOptions")) return null;
+		return {
+			kind: "email_otp",
+			email
+		};
+	}
+	return null;
+}
+//#endregion
+export { inspectRawObject, normalizeAddAuthMethodInput, normalizeRegistrationAuthMethodInput, trimString };
+
+//# sourceMappingURL=registrationAuthMethodInput.js.map

package/dist/esm/react/shared-ts/src/utils/registrationEstablishedSession.js

@@ -4,10 +4,10 @@ import { parseRouterAbEd25519NormalSigningState } from "./signingSessionSeal.js"
 import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseWalletId } from "./domainIds.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "./routerAbNormalSigningIdentity.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
-import { parseNearEd25519SigningKeyId } from "./registrationIntent.js";
-import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../device-linking/parsers.js";
+import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../device-linking/activeWalletSession.js";
 import { parseRouterAbEcdsaDerivationNormalSigningStateV1 } from "./routerAbEcdsaDerivation.js";
 import { parseThresholdEcdsaKeyHandle } from "./thresholdEcdsaKeyHandle.js";
+import { parseNearEd25519SigningKeyId } from "./registrationIds.js";
 //#region ../shared-ts/src/utils/registrationEstablishedSession.ts
 function parseRegistrationEstablishedSessionResultV2(raw) {
 	const result = inspectRawObject(raw);