@seams/wallet 0.6.2 → 0.7.1

package/dist/esm/shared-ts/src/utils/registrationSignerPlan.js

@@ -0,0 +1,442 @@
+import { parseNamedNearAccountId } from "./near.js";
+import { alphabetizeStringify } from "./digests.js";
+import { inspectRawObject, trimString } from "./registrationAuthMethodInput.js";
+//#region ../shared-ts/src/utils/registrationSignerPlan.ts
+function implicitNearAccountProvisioning() {
+	return {
+		kind: "implicit_account",
+		accountIdSource: "ed25519_public_key"
+	};
+}
+function sponsoredNamedNearAccountProvisioning(requestedAccountId) {
+	return {
+		kind: "sponsored_named_account",
+		requestedAccountId,
+		sponsor: "relayer"
+	};
+}
+function normalizePositiveInteger(raw, fallback) {
+	const value = typeof raw === "number" ? raw : Number(raw);
+	return Number.isFinite(value) && value >= 1 ? Math.floor(value) : fallback;
+}
+function collectPositiveParticipantIds(raw) {
+	if (!Array.isArray(raw)) return [];
+	const participantIds = [];
+	for (const id of raw) {
+		const numericId = Number(id);
+		if (Number.isInteger(numericId) && numericId > 0) participantIds.push(numericId);
+	}
+	return participantIds;
+}
+function normalizeUnknownArray(raw) {
+	return Array.isArray(raw) ? raw : [];
+}
+function normalizeRegistrationNearAccountProvisioning(raw) {
+	const record = inspectRawObject(raw);
+	if (!record || !("kind" in record)) return null;
+	switch (trimString(record.kind)) {
+		case "implicit_account":
+			if (Object.prototype.hasOwnProperty.call(record, "requestedAccountId") || Object.prototype.hasOwnProperty.call(record, "sponsor")) return null;
+			return {
+				kind: "implicit_account",
+				accountIdSource: "ed25519_public_key"
+			};
+		case "sponsored_named_account": {
+			if (Object.prototype.hasOwnProperty.call(record, "accountIdSource") || !("requestedAccountId" in record)) return null;
+			const parsed = parseNamedNearAccountId(record.requestedAccountId);
+			if (!parsed.ok) return null;
+			return {
+				kind: "sponsored_named_account",
+				requestedAccountId: parsed.value,
+				sponsor: "relayer"
+			};
+		}
+		default: return null;
+	}
+}
+function normalizeRegistrationEcdsaSpec(value) {
+	if (!value) return null;
+	if (!("participantIds" in value) || !("chainTargets" in value)) return null;
+	const participantIds = collectPositiveParticipantIds(value.participantIds);
+	const chainTargets = normalizeUnknownArray(value.chainTargets);
+	if (participantIds.length === 0 || chainTargets.length === 0) return null;
+	return {
+		participantIds,
+		chainTargets
+	};
+}
+const REGISTRATION_NEAR_ED25519_KEY_PURPOSE = "near_tx";
+const NEAR_ED25519_YAO_KEY_VERSION_V1 = "router-ab-ed25519-yao-v1";
+function registrationSignerBranchKeyFromString(value) {
+	const normalized = trimString(value);
+	if (!normalized) throw new Error("registration signer branch key is required");
+	return normalized;
+}
+function registrationNearEd25519BranchKey(signerSlot) {
+	return registrationSignerBranchKeyFromString(`near_ed25519:slot:${signerSlot}`);
+}
+function registrationEvmFamilyEcdsaTargetKey(target) {
+	return alphabetizeStringify(target);
+}
+function registrationEvmFamilyEcdsaBranchKey(chainTargets) {
+	return registrationSignerBranchKeyFromString(`evm_family_ecdsa:${chainTargets.map(registrationEvmFamilyEcdsaTargetKey).join("|")}`);
+}
+function registrationSignerPlanFromRequests(signers) {
+	return registrationSignerPlanFromBranches(signers.map(registrationSignerPlanBranchFromRequest));
+}
+function registrationSignerPlanFromBranches(branches) {
+	if (branches.length === 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signer set must include at least one signer"
+	};
+	const nearSlots = /* @__PURE__ */ new Set();
+	const ecdsaTargetKeys = /* @__PURE__ */ new Set();
+	const branchKeys = /* @__PURE__ */ new Set();
+	for (const branch of branches) {
+		const duplicate = findRegistrationSignerPlanDuplicate({
+			branch,
+			nearSlots,
+			ecdsaTargetKeys,
+			branchKeys
+		});
+		if (duplicate) return duplicate;
+	}
+	return {
+		ok: true,
+		value: {
+			kind: "signer_set",
+			branches
+		}
+	};
+}
+function registrationSignerPlanBranchFromRequest(signer) {
+	switch (signer.kind) {
+		case "near_ed25519": return {
+			kind: "near_ed25519",
+			branchKey: registrationNearEd25519BranchKey(signer.signerSlot),
+			accountProvisioning: signer.accountProvisioning,
+			signerSlot: signer.signerSlot,
+			participantIds: signer.participantIds,
+			keyPurpose: REGISTRATION_NEAR_ED25519_KEY_PURPOSE,
+			keyVersion: NEAR_ED25519_YAO_KEY_VERSION_V1,
+			derivationVersion: signer.derivationVersion
+		};
+		case "evm_family_ecdsa": return {
+			kind: "evm_family_ecdsa",
+			branchKey: registrationEvmFamilyEcdsaBranchKey(signer.chainTargets),
+			participantIds: signer.participantIds,
+			chainTargets: signer.chainTargets
+		};
+		default: return assertNeverRegistrationSignerRequest(signer);
+	}
+}
+function findRegistrationSignerPlanDuplicate(input) {
+	switch (input.branch.kind) {
+		case "near_ed25519":
+			if (input.nearSlots.has(input.branch.signerSlot)) return {
+				ok: false,
+				code: "invalid_body",
+				message: "duplicate near_ed25519 signer slot is invalid"
+			};
+			input.nearSlots.add(input.branch.signerSlot);
+			break;
+		case "evm_family_ecdsa":
+			{
+				const duplicateTarget = findDuplicateRegistrationEcdsaTarget(input.branch, input.ecdsaTargetKeys);
+				if (duplicateTarget) return duplicateTarget;
+			}
+			break;
+		default: return assertNeverRegistrationSignerPlanBranch(input.branch);
+	}
+	return findDuplicateRegistrationSignerBranch(input.branch, input.branchKeys);
+}
+function findDuplicateRegistrationSignerBranch(branch, branchKeys) {
+	const branchKey = String(branch.branchKey);
+	if (branchKeys.has(branchKey)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "duplicate signer branch is invalid"
+	};
+	branchKeys.add(branchKey);
+	return null;
+}
+function findDuplicateRegistrationEcdsaTarget(branch, ecdsaTargetKeys) {
+	for (const target of branch.chainTargets) {
+		const targetKey = registrationEvmFamilyEcdsaTargetKey(target);
+		if (ecdsaTargetKeys.has(targetKey)) return {
+			ok: false,
+			code: "invalid_body",
+			message: "duplicate evm_family_ecdsa chain target is invalid"
+		};
+		ecdsaTargetKeys.add(targetKey);
+	}
+	return null;
+}
+function normalizeRegistrationSignerRequest(raw) {
+	const record = inspectRawObject(raw);
+	if (!record) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signer set entry must be an object"
+	};
+	if (!("kind" in record)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "unsupported registration signer kind"
+	};
+	switch (trimString(record.kind)) {
+		case "near_ed25519": return normalizeRegistrationNearEd25519SignerRequest(record);
+		case "evm_family_ecdsa": return normalizeRegistrationEvmFamilyEcdsaSignerRequest(record);
+		default: return {
+			ok: false,
+			code: "invalid_body",
+			message: "unsupported registration signer kind"
+		};
+	}
+}
+function normalizeRegistrationNearEd25519SignerRequest(raw) {
+	if (Object.prototype.hasOwnProperty.call(raw, "keyPurpose") || Object.prototype.hasOwnProperty.call(raw, "keyVersion")) return {
+		ok: false,
+		code: "invalid_body",
+		message: "near_ed25519 signer spec cannot include protocol key fields"
+	};
+	if (Object.prototype.hasOwnProperty.call(raw, "nearAccountId") || Object.prototype.hasOwnProperty.call(raw, "createNearAccount")) return {
+		ok: false,
+		code: "invalid_body",
+		message: "near_ed25519 signer spec is invalid"
+	};
+	const accountProvisioning = normalizeRegistrationNearAccountProvisioning("accountProvisioning" in raw ? raw.accountProvisioning : void 0);
+	const signerSlot = normalizePositiveInteger("signerSlot" in raw ? raw.signerSlot : void 0, 0);
+	const derivationVersion = Number("derivationVersion" in raw ? raw.derivationVersion : void 0);
+	const participantIds = collectPositiveParticipantIds("participantIds" in raw ? raw.participantIds : void 0);
+	if (!accountProvisioning || signerSlot < 1 || participantIds.length === 0 || derivationVersion !== 1) return {
+		ok: false,
+		code: "invalid_body",
+		message: "near_ed25519 signer spec is invalid"
+	};
+	return {
+		ok: true,
+		value: {
+			kind: "near_ed25519",
+			accountProvisioning,
+			signerSlot,
+			participantIds,
+			derivationVersion
+		}
+	};
+}
+function normalizeRegistrationEvmFamilyEcdsaSignerRequest(raw) {
+	const ecdsa = normalizeRegistrationEcdsaSpec(raw);
+	if (!ecdsa) return {
+		ok: false,
+		code: "invalid_body",
+		message: "evm_family_ecdsa signer spec is invalid"
+	};
+	return {
+		ok: true,
+		value: {
+			kind: "evm_family_ecdsa",
+			participantIds: ecdsa.participantIds,
+			chainTargets: ecdsa.chainTargets
+		}
+	};
+}
+function normalizeRegistrationSignerSetPlan(raw) {
+	if (!("signers" in raw) || !Array.isArray(raw.signers)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signerSelection.signers must be an array"
+	};
+	const signers = [];
+	for (const rawSigner of raw.signers) {
+		const signer = normalizeRegistrationSignerRequest(rawSigner);
+		if (!signer.ok) return signer;
+		signers.push(signer.value);
+	}
+	return registrationSignerPlanFromRequests(signers);
+}
+function normalizeRegistrationSignerPlan(raw) {
+	const record = inspectRawObject(raw);
+	if (!record) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signerSelection must be an object"
+	};
+	if (!("kind" in record)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signerSelection.kind must be signer_set"
+	};
+	if (trimString(record.kind) === "signer_set") return normalizeRegistrationSignerSetPlan(record);
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: "signerSelection.kind must be signer_set"
+	};
+}
+function registrationSignerPlanFromSelection(selection) {
+	return registrationSignerPlanFromRequests(selection.signers);
+}
+function findRegistrationSignerPlanNearEd25519Branch(plan) {
+	for (const branch of plan.branches) if (branch.kind === "near_ed25519") return branch;
+	return null;
+}
+function findRegistrationSignerPlanEvmFamilyEcdsaBranch(plan) {
+	for (const branch of plan.branches) if (branch.kind === "evm_family_ecdsa") return branch;
+	return null;
+}
+function registrationSignerSetSelectionFromPlan(plan, options = {}) {
+	const signers = [];
+	for (const branch of plan.branches) {
+		const signer = registrationSignerRequestFromPlanBranchForSelection(branch, options);
+		if (!signer.ok) return signer;
+		signers.push(signer.value);
+	}
+	return {
+		ok: true,
+		value: {
+			kind: "signer_set",
+			signers
+		}
+	};
+}
+function registrationSignerRequestFromPlanBranchForSelection(branch, options) {
+	switch (branch.kind) {
+		case "near_ed25519": return {
+			ok: true,
+			value: registrationNearEd25519RequestFromPlanBranch(branch)
+		};
+		case "evm_family_ecdsa": return registrationEvmFamilyEcdsaRequestFromPlanBranch(branch, options);
+		default: return assertNeverRegistrationSignerPlanBranch(branch);
+	}
+}
+function registrationNearEd25519RequestFromPlanBranch(branch) {
+	return {
+		kind: "near_ed25519",
+		accountProvisioning: branch.accountProvisioning,
+		signerSlot: branch.signerSlot,
+		participantIds: [...branch.participantIds],
+		derivationVersion: branch.derivationVersion
+	};
+}
+function registrationEvmFamilyEcdsaRequestFromPlanBranch(branch, options) {
+	const chainTargets = registrationEcdsaChainTargetsFromPlanBranch(branch, options);
+	if (!chainTargets) return {
+		ok: false,
+		code: "invalid_body",
+		message: "registration ECDSA chainTargets are invalid"
+	};
+	return {
+		ok: true,
+		value: {
+			kind: "evm_family_ecdsa",
+			participantIds: [...branch.participantIds],
+			chainTargets
+		}
+	};
+}
+function registrationEcdsaChainTargetsFromPlanBranch(branch, options) {
+	if (!options.normalizeEcdsaChainTarget) return [...branch.chainTargets];
+	const chainTargets = [];
+	for (const target of branch.chainTargets) {
+		const normalized = options.normalizeEcdsaChainTarget(target);
+		if (!normalized) return null;
+		chainTargets.push(normalized);
+	}
+	return chainTargets;
+}
+function assertNeverRegistrationSignerRequest(value) {
+	throw new Error(`Unsupported registration signer request: ${String(value)}`);
+}
+function assertNeverRegistrationSignerPlanBranch(value) {
+	throw new Error(`Unsupported registration signer plan branch: ${String(value)}`);
+}
+function normalizeAddSignerSelection(raw, options) {
+	const record = inspectRawObject(raw);
+	if (!record) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signerSelection must be an object"
+	};
+	if (!("mode" in record)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "unsupported add-signer mode"
+	};
+	const mode = trimString(record.mode);
+	if (mode === "ecdsa") return normalizeAddSignerEcdsaSelection("ecdsa" in record ? record.ecdsa : void 0, options);
+	if (mode === "ed25519") return normalizeAddSignerEd25519Selection("ed25519" in record ? record.ed25519 : void 0);
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: "unsupported add-signer mode"
+	};
+}
+function normalizeAddSignerEcdsaSelection(raw, options) {
+	const ecdsaRecord = inspectRawObject(raw);
+	const participantIds = collectPositiveParticipantIds(ecdsaRecord && "participantIds" in ecdsaRecord ? ecdsaRecord.participantIds : void 0);
+	const chainTargets = normalizeAddSignerEcdsaChainTargets(ecdsaRecord && "chainTargets" in ecdsaRecord ? ecdsaRecord.chainTargets : void 0, options);
+	if (participantIds.length === 0 || chainTargets.length === 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ecdsa add-signer spec is invalid"
+	};
+	return {
+		ok: true,
+		value: {
+			mode: "ecdsa",
+			ecdsa: {
+				chainTargets,
+				participantIds
+			}
+		}
+	};
+}
+function normalizeAddSignerEcdsaChainTargets(raw, options) {
+	if (!Array.isArray(raw)) return [];
+	const chainTargets = [];
+	for (const target of raw) {
+		const normalized = options.normalizeEcdsaChainTarget(target);
+		if (!normalized) return [];
+		chainTargets.push(normalized);
+	}
+	return chainTargets;
+}
+function normalizeAddSignerEd25519Selection(raw) {
+	const ed25519Record = inspectRawObject(raw);
+	const ed25519Mode = trimString(ed25519Record && "mode" in ed25519Record ? ed25519Record.mode : void 0);
+	const signerSlot = normalizePositiveInteger(ed25519Record && "signerSlot" in ed25519Record ? ed25519Record.signerSlot : void 0, 1);
+	const keyPurpose = trimString(ed25519Record && "keyPurpose" in ed25519Record ? ed25519Record.keyPurpose : void 0);
+	const keyVersion = trimString(ed25519Record && "keyVersion" in ed25519Record ? ed25519Record.keyVersion : void 0);
+	const derivationVersion = normalizePositiveInteger(ed25519Record && "derivationVersion" in ed25519Record ? ed25519Record.derivationVersion : void 0, 0);
+	const participantIds = collectPositiveParticipantIds(ed25519Record && "participantIds" in ed25519Record ? ed25519Record.participantIds : void 0);
+	if (!keyPurpose || !keyVersion || !derivationVersion || participantIds.length === 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ed25519 add-signer spec is invalid"
+	};
+	if (ed25519Mode === "create_implicit_near_account") return {
+		ok: true,
+		value: {
+			mode: "ed25519",
+			ed25519: {
+				mode: ed25519Mode,
+				signerSlot,
+				participantIds,
+				keyPurpose,
+				keyVersion,
+				derivationVersion
+			}
+		}
+	};
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: "unsupported add-signer mode"
+	};
+}
+//#endregion
+export { NEAR_ED25519_YAO_KEY_VERSION_V1, findRegistrationSignerPlanEvmFamilyEcdsaBranch, findRegistrationSignerPlanNearEd25519Branch, implicitNearAccountProvisioning, normalizeAddSignerSelection, normalizeRegistrationSignerPlan, registrationEvmFamilyEcdsaBranchKey, registrationNearEd25519BranchKey, registrationSignerBranchKeyFromString, registrationSignerPlanFromSelection, registrationSignerSetSelectionFromPlan, sponsoredNamedNearAccountProvisioning };
+
+//# sourceMappingURL=registrationSignerPlan.js.map

package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js

@@ -1,17 +1,22 @@
 import { parseEcdsaActiveStateId, parseRootShareEpoch, parseThresholdEcdsaSessionId } from "./domainIds.js";
 import { EVM_ECDSA_MPC_OPERATION_KINDS, parseEcdsaAuthorizationSessionId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../authorization/capabilityKinds.js";
+import { requireRecord } from "./validation.js";
 import { base64UrlDecode, base64UrlEncode } from "./base64.js";
-import { parseCorrelationId, parseDigestB64u } from "./canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
+import { parseCorrelationId, parseDigestB64u } from "./canonicalPrimitives.js";
+import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../device-linking/activeWalletSession.js";
 import "./encoders.js";
-import { requireRouterAbX25519PublicKey } from "./routerAbPublicKeyset.js";
-import { canonicalRouterAbMpcMaterialActivationRefBytes, canonicalRouterAbNormalSigningAuthorizationBytes, parseRouterAbMpcMaterialActivationRef, parseRouterAbNormalSigningAuthorization, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "./routerAbNormalSigningIdentity.js";
-import "../threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeRuntimePolicyScope } from "../threshold/signingRootScope.js";
 import { parseEcdsaServerGeneration } from "./ecdsaCapabilityActivation.js";
+import { canonicalRouterAbMpcMaterialActivationRefBytes, canonicalRouterAbNormalSigningAuthorizationBytes, parseRouterAbMpcMaterialActivationRef, parseRouterAbNormalSigningAuthorization, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "./routerAbNormalSigningIdentity.js";
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, parseWalletAuthAuthority } from "./walletAuthAuthority.js";
-import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../device-linking/parsers.js";
+import { requireRouterAbX25519PublicKey } from "./routerAbPublicKeyset.js";
 //#region ../shared-ts/src/utils/routerAbEcdsaDerivation.ts
+/**
+* The longest an ECDSA presignature ceremony may run. The Gateway authorizes a
+* pool fill only when the requested ceremony deadline is within this limit.
+*/
+const ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS = 5 * 6e4;
 const ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1 = "router_ab_ecdsa_derivation_normal_signing_v1";
 const ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH = "/router-ab/ecdsa-derivation/export";
 const ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH = "/router-ab/ecdsa-derivation/presignature-pool/fill/init";
@@ -119,10 +124,6 @@ async function computeRouterAbEcdsaOperationStepUpChallengeB64u(value) {
 		operation: parseRouterAbEcdsaOperationStepUpPreparationV1(value)
 	})));
 }
-function requireRecord(value, label) {
-	if (value && typeof value === "object" && !Array.isArray(value)) return value;
-	throw new Error(`${label} must be an object`);
-}
 function requireExactKeys(record, label, allowedKeys) {
 	const allowed = new Set(allowedKeys);
 	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is not a supported field`);
@@ -1328,6 +1329,6 @@ async function parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreReques
 	return response;
 }
 //#endregion
-export { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningResponseV1, parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaExplicitExportForwardedResponseV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaOperationStepUpAuthorizationResponseV1, parseRouterAbEcdsaOperationStepUpPreparationV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaRegistrationPublicActivationReceiptV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaSigningWorkerExportShareEnvelopeV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1, requireRouterAbEcdsaDerivationNormalSigningStateV1, routerAbEcdsaDerivationActiveStateId, routerAbEcdsaDerivationContextBindingDigestV1, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestCanonicalBytesV1, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestCanonicalBytesV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1, routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1, routerAbEcdsaRerandomizationClientCommitmentV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire, sameRouterAbServerIdentityV1, verifyRouterAbEcdsaDerivationNormalSigningScopeContextBindingV1 };
+export { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreRequestV1, parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaExplicitExportForwardedResponseV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaOperationStepUpAuthorizationResponseV1, parseRouterAbEcdsaOperationStepUpPreparationV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaRegistrationPublicActivationReceiptV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaSigningWorkerExportShareEnvelopeV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1, requireRouterAbEcdsaDerivationNormalSigningStateV1, routerAbEcdsaDerivationActiveStateId, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1, routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1, routerAbEcdsaRerandomizationClientCommitmentV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire, sameRouterAbServerIdentityV1 };
 
 //# sourceMappingURL=routerAbEcdsaDerivation.js.map

package/dist/esm/shared-ts/src/utils/routerAbEd25519Yao.js

@@ -1,4 +1,6 @@
+import { requireRecord } from "./validation.js";
 import { parseRouterAbMpcMaterialActivationRef, sameRouterAbMpcMaterialActivationRef } from "./routerAbNormalSigningIdentity.js";
+import { equalBytes, requireBytes, requireBytes32, requireVisibleIdentifier } from "./routerAbEd25519YaoDigests.js";
 //#region ../shared-ts/src/utils/routerAbEd25519Yao.ts
 const ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1 = "/router-ab/ed25519/yao/registration/admit";
 const ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1 = "/router-ab/ed25519/yao/registration/execute";
@@ -35,25 +37,11 @@ const RECOVERY_WORK_KIND = "recovery";
 const RECOVERY_PRIMITIVE_REQUEST_KIND = "recovery";
 const EXPORT_WORK_KIND = "key_export";
 const EXPORT_PRIMITIVE_REQUEST_KIND = "export";
-const APPLICATION_BINDING_DOMAIN = "seams/router-ab/ed25519-yao/application-binding/v1";
-const UTF8 = new TextEncoder();
-function requireRecord(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
 function requireExactKeys(record, label, allowedKeys) {
 	const allowed = new Set(allowedKeys);
 	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is not a supported field`);
 	for (const key of allowedKeys) if (!Object.hasOwn(record, key)) throw new Error(`${label}.${key} is required`);
 }
-function requireVisibleIdentifier(value, label) {
-	if (typeof value !== "string" || value.length === 0) throw new Error(`${label} must be a non-empty visible ASCII string`);
-	for (let index = 0; index < value.length; index += 1) {
-		const code = value.charCodeAt(index);
-		if (code < 33 || code > 126) throw new Error(`${label} must contain visible ASCII bytes`);
-	}
-	return value;
-}
 function requirePositiveU32(value, label) {
 	if (!Number.isInteger(value) || typeof value !== "number" || value <= 0 || value > 4294967295) throw new Error(`${label} must be a positive u32`);
 	return value;
@@ -62,67 +50,6 @@ function requirePositiveSafeInteger(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
 	return value;
 }
-function requireByte(value, label) {
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > 255) throw new Error(`${label} must be a byte`);
-	return value;
-}
-function requireBytes(value, label, minimumLength, maximumLength) {
-	if (!Array.isArray(value)) throw new Error(`${label} must be a byte array`);
-	if (value.length < minimumLength || value.length > maximumLength) throw new Error(`${label} has an invalid length`);
-	const parsed = [];
-	for (let index = 0; index < value.length; index += 1) parsed.push(requireByte(value[index], `${label}[${index}]`));
-	return parsed;
-}
-function requireBytes32(value, label, nonzero) {
-	const parsed = requireBytes(value, label, 32, 32);
-	if (nonzero && isZeroBytes(parsed)) throw new Error(`${label} must be nonzero`);
-	return parsed;
-}
-function isZeroBytes(value) {
-	for (const byte of value) if (byte !== 0) return false;
-	return true;
-}
-function equalBytes(left, right) {
-	if (left.length !== right.length) return false;
-	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
-	return true;
-}
-function u32BigEndian(value) {
-	const bytes = new Uint8Array(4);
-	new DataView(bytes.buffer).setUint32(0, value, false);
-	return bytes;
-}
-function concatenateBytes(chunks) {
-	let length = 0;
-	for (const chunk of chunks) length += chunk.length;
-	const output = new Uint8Array(length);
-	let offset = 0;
-	for (const chunk of chunks) {
-		output.set(chunk, offset);
-		offset += chunk.length;
-	}
-	return output;
-}
-function lengthDelimited(value) {
-	return concatenateBytes([u32BigEndian(value.length), value]);
-}
-function labeledField(label, value) {
-	return concatenateBytes([lengthDelimited(UTF8.encode(label)), lengthDelimited(value)]);
-}
-async function sha256(value) {
-	const digest = await globalThis.crypto.subtle.digest("SHA-256", value);
-	return new Uint8Array(digest);
-}
-async function deriveRouterAbEd25519YaoApplicationBindingDigestV1(facts) {
-	const encoded = concatenateBytes([
-		lengthDelimited(UTF8.encode(APPLICATION_BINDING_DOMAIN)),
-		labeledField("walletId", UTF8.encode(facts.wallet_id)),
-		labeledField("nearEd25519SigningKeyId", UTF8.encode(facts.near_ed25519_signing_key_id)),
-		labeledField("signingRootId", UTF8.encode(facts.signing_root_id)),
-		labeledField("keyCreationSignerSlot", u32BigEndian(facts.key_creation_signer_slot))
-	]);
-	return Array.from(await sha256(encoded));
-}
 function parseOperation(value, label) {
 	switch (value) {
 		case "registration":
@@ -815,6 +742,6 @@ function parseEncryptedPackageValue(value) {
 	return parseEncryptedPackage(value, "encrypted_package");
 }
 //#endregion
-export { ED25519_YAO_CONTROL_CIPHERTEXT_MAX_BYTES_V1, ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, deriveRouterAbEd25519YaoApplicationBindingDigestV1, parseRouterAbEd25519YaoActivationAdmissionReceiptV1, parseRouterAbEd25519YaoActivationExecuteRequestV1, parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 };
+export { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 };
 
 //# sourceMappingURL=routerAbEd25519Yao.js.map

package/dist/esm/shared-ts/src/utils/routerAbEd25519YaoDigests.js

@@ -0,0 +1,76 @@
+//#region ../shared-ts/src/utils/routerAbEd25519YaoDigests.ts
+const APPLICATION_BINDING_DOMAIN = "seams/router-ab/ed25519-yao/application-binding/v1";
+const UTF8 = new TextEncoder();
+function requireVisibleIdentifier(value, label) {
+	if (typeof value !== "string" || value.length === 0) throw new Error(`${label} must be a non-empty visible ASCII string`);
+	for (let index = 0; index < value.length; index += 1) {
+		const code = value.charCodeAt(index);
+		if (code < 33 || code > 126) throw new Error(`${label} must contain visible ASCII bytes`);
+	}
+	return value;
+}
+function requireByte(value, label) {
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > 255) throw new Error(`${label} must be a byte`);
+	return value;
+}
+function requireBytes(value, label, minimumLength, maximumLength) {
+	if (!Array.isArray(value)) throw new Error(`${label} must be a byte array`);
+	if (value.length < minimumLength || value.length > maximumLength) throw new Error(`${label} has an invalid length`);
+	const parsed = [];
+	for (let index = 0; index < value.length; index += 1) parsed.push(requireByte(value[index], `${label}[${index}]`));
+	return parsed;
+}
+function requireBytes32(value, label, nonzero) {
+	const parsed = requireBytes(value, label, 32, 32);
+	if (nonzero && isZeroBytes(parsed)) throw new Error(`${label} must be nonzero`);
+	return parsed;
+}
+function isZeroBytes(value) {
+	for (const byte of value) if (byte !== 0) return false;
+	return true;
+}
+function equalBytes(left, right) {
+	if (left.length !== right.length) return false;
+	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
+	return true;
+}
+function u32BigEndian(value) {
+	const bytes = new Uint8Array(4);
+	new DataView(bytes.buffer).setUint32(0, value, false);
+	return bytes;
+}
+function concatenateBytes(chunks) {
+	let length = 0;
+	for (const chunk of chunks) length += chunk.length;
+	const output = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of chunks) {
+		output.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return output;
+}
+function lengthDelimited(value) {
+	return concatenateBytes([u32BigEndian(value.length), value]);
+}
+function labeledField(label, value) {
+	return concatenateBytes([lengthDelimited(UTF8.encode(label)), lengthDelimited(value)]);
+}
+async function sha256(value) {
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", value);
+	return new Uint8Array(digest);
+}
+async function deriveRouterAbEd25519YaoApplicationBindingDigestV1(facts) {
+	const encoded = concatenateBytes([
+		lengthDelimited(UTF8.encode(APPLICATION_BINDING_DOMAIN)),
+		labeledField("walletId", UTF8.encode(facts.wallet_id)),
+		labeledField("nearEd25519SigningKeyId", UTF8.encode(facts.near_ed25519_signing_key_id)),
+		labeledField("signingRootId", UTF8.encode(facts.signing_root_id)),
+		labeledField("keyCreationSignerSlot", u32BigEndian(facts.key_creation_signer_slot))
+	]);
+	return Array.from(await sha256(encoded));
+}
+//#endregion
+export { deriveRouterAbEd25519YaoApplicationBindingDigestV1, equalBytes, requireBytes, requireBytes32, requireVisibleIdentifier };
+
+//# sourceMappingURL=routerAbEd25519YaoDigests.js.map