@seams/wallet 0.6.2 → 0.7.3

package/dist/esm/sdk/{walletRecoveryCommit-G6w6N5RV.js → walletRecoveryCommit-AI1AtIRP.js}

@@ -1,22 +1,21 @@
-import { B as parseWalletRecoveryOperationId, F as parseWalletAuthMethodId, H as parseWebAuthnRpId, L as parseWalletAuthorityId, M as parseThresholdEd25519SessionId, R as parseWalletId, V as parseWebAuthnCredentialIdB64u, _ as parseEmailOtpProviderUserId, g as parseEmailOtpChallengeId } from "./normalize-BephcEIF.js";
-import { C as base58Encode } from "./validation-BphUDXs7.js";
+import { A as parseWalletRecoveryOperationId, D as parseWalletAuthorityId, M as parseWebAuthnRpId, O as parseWalletId, S as parseThresholdEd25519SessionId, T as parseWalletAuthMethodId, j as parseWebAuthnCredentialIdB64u, o as parseEmailOtpChallengeId, s as parseEmailOtpProviderUserId } from "./domainIds-lcrFg6Sa.js";
+import { M as base58Encode, _ as requireRecord, m as requireArray } from "./validation-gat4LEKm.js";
 import { i as base64UrlEncode, r as base64UrlDecode } from "./base64-Clm8C-e9.js";
-import { A as alphabetizeStringify, D as sameWalletAuthMethodRecordV2, N as sha256HexUtf8 } from "./registrationIntent-DwAIMQYh.js";
-import { a as parseWalletRecoveryEnvelopeEntry, f as parseRecoveryCodeReservationId, l as buildWalletRecoveryCommittedProjectionV1, n as parseWalletRecoveryEcdsaPossessionProofV1, t as parseWalletRecoveryEcdsaPossessionChallengeV1, u as parseWalletRecoveryCommittedProjectionV1 } from "./wallet-recovery-CKqoHbxT.js";
-import { _ as parseUnixMs, d as parseEd25519PublicKeyB64u, f as parseEnvelopeCiphertextB64u, g as parseSecp256k1CompressedPublicKeyB64u, h as parseKeyCreationSignerSlot, l as requireEvmFamilySigningKeySlotId, o as normalizeRuntimePolicyScope, p as parseEnvelopeNonceB64u, u as parseDigestField, v as rejectUnknownFields, y as requireRecord } from "./participants-Bcnsa_ip.js";
-import { M as WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND, h as prepareWalletRecoveryPasskeyPublication, m as prepareWalletRecoveryEmailOtpPublication } from "./accountLifecycle-Ddavc_FC.js";
-import { t as toAccountId } from "./accountIds-Ck4GAQfm.js";
-import { o as normalizeThresholdRuntimePolicyScope, x as walletAuthorityDigestsMatchV1 } from "./sessionPolicy-B4FsPuk2.js";
-import { At as buildEmailOtpWalletAuthAuthority, Cn as routerAbMpcMaterialActivationRefToWire, Ht as walletAuthAuthorityRef, Sn as routerAbMpcMaterialActivationRefFromWire, bn as parseRouterAbMpcMaterialActivationRef, ft as parseRouterAbEcdsaRegistrationActivationReceiptV1, it as parseRouterAbEcdsaDerivationPublicCapabilityV1 } from "./ecdsaPresignLifecycle-CnSnzoRJ.js";
-import { l as parseDeviceId } from "./capabilityKinds-jwCEaqBU.js";
-import { St as parseSdkEcdsaDerivationThresholdKeyId, bt as parseSdkEcdsaDerivationSigningRootId, gt as parseEcdsaServerGeneration, vt as computeEcdsaDerivationRoleLocalRelayerKeyId, xt as parseSdkEcdsaDerivationSigningRootVersion, yt as ecdsaClientRootPublicKey33B64uFromString } from "./evmFamilyEcdsaIdentity-_kuKSW35.js";
-import { d as parsePasskeyCustodyEnvelopeRecord } from "./passkey-custody-BaHyYMhj.js";
-import { g as prepareWalletCustodyEcdsaContinuity, s as IndexedDBManager, y as pendingWalletRecoveryCommitIdentityMatches } from "./ed25519SeedMaterial-Cghz8-XB.js";
-import { n as PASSKEY_PRF_SECOND_SALT_V1, t as PASSKEY_PRF_FIRST_SALT_V1 } from "./signingSessionSeal-CdtgXHSL.js";
-import { n as parseEmailOtpChallengeDelivery } from "./challengeDelivery-BjLKoou3.js";
-import { o as redactedPasskeyRegistrationCredential } from "./helpers-DpRjHMBx.js";
-import { S as buildEcdsaRoleLocalPublicFacts } from "./ecdsaCapabilityManifest-C8itxV9S.js";
-import { n as buildRelayerJsonPostRequestInit, r as normalizeRelayerBaseUrl } from "./relayerHttp-LsVTZCxA.js";
+import { C as parseEnvelopeNonceB64u, D as parseUnixMs, E as parseSecp256k1CompressedPublicKeyB64u, I as rejectUnknownFields, S as parseEnvelopeCiphertextB64u, T as parseKeyCreationSignerSlot, b as parseDigestField, h as normalizeRuntimePolicyScope, o as normalizeThresholdRuntimePolicyScope, x as parseEd25519PublicKeyB64u, y as requireEvmFamilySigningKeySlotId } from "./sessionPolicy-DO-MkL65.js";
+import { $t as wireLiteral, Ct as parseRouterAbMpcMaterialActivationRef, E as parseRouterAbEcdsaRegistrationActivationReceiptV1, Et as routerAbMpcMaterialActivationRefToWire, K as buildEmailOtpWalletAuthAuthority, Tt as routerAbMpcMaterialActivationRefFromWire, _t as computeEcdsaDerivationRoleLocalRelayerKeyId, bt as parseSdkEcdsaDerivationSigningRootVersion, ht as parseEcdsaServerGeneration, it as walletAuthAuthorityRef, nn as wireResult, tn as wireObject, v as parseRouterAbEcdsaDerivationPublicCapabilityV1, vt as ecdsaClientRootPublicKey33B64uFromString, xt as parseSdkEcdsaDerivationThresholdKeyId, yt as parseSdkEcdsaDerivationSigningRootId } from "./ecdsaPresignLifecycle-Bfx2AQKb.js";
+import { l as parseDeviceId } from "./capabilityKinds-hvYqa6S_.js";
+import { f as alphabetizeStringify, h as sha256HexUtf8 } from "./chains-BMh3btVo.js";
+import { a as parseWalletRecoveryEnvelopeEntry, f as parseRecoveryCodeReservationId, l as buildWalletRecoveryCommittedProjectionV1, n as parseWalletRecoveryEcdsaPossessionProofV1, t as parseWalletRecoveryEcdsaPossessionChallengeV1, u as parseWalletRecoveryCommittedProjectionV1 } from "./wallet-recovery-BX61-79p.js";
+import { M as WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND, h as prepareWalletRecoveryPasskeyPublication, m as prepareWalletRecoveryEmailOtpPublication } from "./accountLifecycle-zthG08aC.js";
+import { t as toAccountId } from "./accountIds-DhIPGOSN.js";
+import { T as sameWalletAuthMethodRecordV2, p as sameVerifiedActiveWalletAuthorityV1 } from "./walletAuthority-DD9T25F6.js";
+import { d as parsePasskeyCustodyEnvelopeRecord } from "./passkey-custody-UUHbC0pk.js";
+import { A as thresholdEcdsaChainTargetKey, r as prepareWalletCustodyEcdsaContinuity, u as IndexedDBManager, x as pendingWalletRecoveryCommitIdentityMatches } from "./walletCustodyEcdsaContinuity-CF4bv9OI.js";
+import { n as PASSKEY_PRF_SECOND_SALT_V1, t as PASSKEY_PRF_FIRST_SALT_V1 } from "./signingSessionSeal-Cu-GHm6y.js";
+import { n as parseEmailOtpChallengeDelivery } from "./challengeDelivery-DZtopOAG.js";
+import { o as redactedPasskeyRegistrationCredential } from "./helpers-ZrowMnev.js";
+import { C as buildEcdsaRoleLocalPublicFacts } from "./ecdsaCapabilityManifest-DuMs0VtU.js";
+import { n as buildRelayerJsonPostRequestInit, r as normalizeRelayerBaseUrl } from "./relayerHttp-VC8Holz1.js";
 //#region ../shared-ts/src/wallet-recovery/walletRecoveryTarget.ts
 function parseWalletRecoveryTargetV1(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("wallet recovery target must be an object");
@@ -148,7 +147,7 @@ async function parseWalletRecoveryPrepareResponse(args) {
 	const body = decodeJsonObjectOrNull(await response.json().catch(() => ({})));
 	if (response.status === 200 && body && readJsonField(body, "ok") === true) try {
 		const preparedResponse = decodeExactJsonObject(body, args.target.kind === "passkey" ? WALLET_RECOVERY_PREPARE_PASSKEY_RESPONSE_FIELDS : WALLET_RECOVERY_PREPARE_COMMON_RESPONSE_FIELDS, "walletRecoveryPrepare");
-		const wrap = parsePreparedRecoveryWrap(readJsonField(preparedResponse, "wrap"));
+		const wrap = preparedRecoveryWrap()(readJsonField(preparedResponse, "wrap"), "walletRecoveryPrepare.wrap");
 		const entries = parsePreparedRecoveryEntries(readJsonField(preparedResponse, "entries"));
 		const walletIdResult = parseWalletId(readJsonField(preparedResponse, "walletId"));
 		if (!walletIdResult.ok) throw new Error("walletRecoveryPrepare.walletId is invalid");
@@ -181,7 +180,7 @@ async function parseWalletRecoveryPrepareResponse(args) {
 		};
 		switch (target.kind) {
 			case "passkey": {
-				const registration = parseWalletRecoveryRegistrationOptions(readJsonField(preparedResponse, "registration"), String(walletId), target.rpId);
+				const registration = walletRecoveryRegistrationOptions(String(walletId), target.rpId)(readJsonField(preparedResponse, "registration"), "registration");
 				if (registration.walletAuthMethodId !== targetWalletAuthMethodId.value) throw new Error("wallet recovery registration changed the target auth method");
 				return {
 					...common,
@@ -205,115 +204,69 @@ async function parseWalletRecoveryPrepareResponse(args) {
 	if (response.status === 401 || response.status === 400) return { kind: "refused" };
 	return { kind: "transport_uncertain" };
 }
-function parseWalletRecoveryRegistrationOptions(raw, expectedWalletId, expectedRpId) {
-	const registration = decodeExactJsonObject(raw, [
-		"kind",
-		"challengeId",
-		"challengeB64u",
-		"replacementId",
-		"walletAuthMethodId",
-		"rpId",
-		"user",
-		"pubKeyCredParams",
-		"authenticatorSelection",
-		"timeoutMs",
-		"attestation",
-		"extensions",
-		"excludeCredentials"
-	], "walletRecoveryPrepare.registration");
-	if (readJsonField(registration, "kind") !== "webauthn_recovery_registration_v1") throw new Error("walletRecoveryPrepare.registration kind is invalid");
-	const challengeId = requireResponseString(readJsonField(registration, "challengeId"), "registration.challengeId");
-	const challengeB64u = requireCanonicalBytesB64u(readJsonField(registration, "challengeB64u"), 32, "registration.challengeB64u");
-	const replacementId = requireResponseString(readJsonField(registration, "replacementId"), "registration.replacementId");
-	const walletAuthMethodId = parseWalletAuthMethodId(readJsonField(registration, "walletAuthMethodId"));
-	if (!walletAuthMethodId.ok) throw new Error("walletRecoveryPrepare.registration.walletAuthMethodId is invalid");
-	const rpIdResult = parseWebAuthnRpId(readJsonField(registration, "rpId"));
-	if (!rpIdResult.ok) throw new Error("walletRecoveryPrepare.registration.rpId is invalid");
-	if (rpIdResult.value !== expectedRpId) throw new Error("walletRecoveryPrepare.registration changed the relying party");
-	const user = decodeExactJsonObject(readJsonField(registration, "user"), [
-		"idB64u",
-		"name",
-		"displayName"
-	], "walletRecoveryPrepare.registration.user");
+function walletRecoveryRegistrationOptions(expectedWalletId, expectedRpId) {
 	const expectedUserIdB64u = base64UrlEncode(new TextEncoder().encode(expectedWalletId));
-	const idB64u = requireCanonicalNonEmptyB64u(readJsonField(user, "idB64u"), "registration.user.idB64u");
-	if (idB64u !== expectedUserIdB64u) throw new Error("walletRecoveryPrepare.registration user is bound to another wallet");
-	const name = requireResponseString(readJsonField(user, "name"), "registration.user.name");
-	const displayName = requireResponseString(readJsonField(user, "displayName"), "registration.user.displayName");
-	if (name !== expectedWalletId || displayName !== expectedWalletId) throw new Error("walletRecoveryPrepare.registration user labels changed the wallet identity");
-	const pubKeyCredParams = parseRecoveryPublicKeyParameters(readJsonField(registration, "pubKeyCredParams"));
-	const authenticatorSelection = parseRecoveryAuthenticatorSelection(readJsonField(registration, "authenticatorSelection"));
-	const timeoutMs = Number(readJsonField(registration, "timeoutMs"));
-	if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new Error("walletRecoveryPrepare.registration.timeoutMs is invalid");
-	if (readJsonField(registration, "attestation") !== "none") throw new Error("walletRecoveryPrepare.registration.attestation is invalid");
-	const extensions = parseRecoveryPrfExtensions(readJsonField(registration, "extensions"));
-	const excludeCredentials = parseRecoveryExcludeCredentials(readJsonField(registration, "excludeCredentials"));
-	return {
-		kind: "webauthn_recovery_registration_v1",
-		challengeId,
-		challengeB64u,
-		replacementId,
-		walletAuthMethodId: walletAuthMethodId.value,
-		rpId: rpIdResult.value,
-		user: {
-			idB64u,
-			name,
-			displayName
+	const credentialDescriptor = wireObject({
+		type: wireLiteral("public-key"),
+		id: (raw, label) => {
+			const id = wireResult(parseWebAuthnCredentialIdB64u)(raw, label);
+			requireCanonicalNonEmptyB64u(id, label);
+			return id;
+		}
+	});
+	return wireObject({
+		kind: wireLiteral("webauthn_recovery_registration_v1"),
+		challengeId: requireResponseString,
+		challengeB64u: (raw, label) => requireCanonicalBytesB64u(raw, 32, label),
+		replacementId: requireResponseString,
+		walletAuthMethodId: wireResult(parseWalletAuthMethodId),
+		rpId: wireResult(parseWebAuthnRpId),
+		user: wireObject({
+			idB64u: requireCanonicalNonEmptyB64u,
+			name: requireResponseString,
+			displayName: requireResponseString
+		}, (user, label) => {
+			if (user.idB64u !== expectedUserIdB64u || user.name !== expectedWalletId || user.displayName !== expectedWalletId) throw new Error(`${label} is bound to another wallet`);
+		}),
+		pubKeyCredParams: (raw, label) => {
+			if (!Array.isArray(raw) || raw.length !== 2) throw new Error(`${label} is invalid`);
+			return [publicKeyCredentialParameter(-7)(raw[0], `${label}[0]`), publicKeyCredentialParameter(-257)(raw[1], `${label}[1]`)];
 		},
-		pubKeyCredParams,
-		authenticatorSelection,
-		timeoutMs,
-		attestation: "none",
-		extensions,
-		excludeCredentials
-	};
-}
-function parseRecoveryPrfExtensions(raw) {
-	const evaluation = decodeExactJsonObject(readJsonField(decodeExactJsonObject(readJsonField(decodeExactJsonObject(raw, ["prf"], "walletRecoveryPrepare.registration.extensions"), "prf"), ["eval"], "walletRecoveryPrepare.registration.extensions.prf"), "eval"), ["firstB64u", "secondB64u"], "walletRecoveryPrepare.registration.extensions.prf.eval");
-	const firstB64u = requireCanonicalBytesB64u(readJsonField(evaluation, "firstB64u"), PASSKEY_PRF_FIRST_SALT_V1.length, "registration.extensions.prf.eval.firstB64u");
-	const secondB64u = requireCanonicalBytesB64u(readJsonField(evaluation, "secondB64u"), PASSKEY_PRF_SECOND_SALT_V1.length, "registration.extensions.prf.eval.secondB64u");
-	if (firstB64u !== base64UrlEncode(PASSKEY_PRF_FIRST_SALT_V1) || secondB64u !== base64UrlEncode(PASSKEY_PRF_SECOND_SALT_V1)) throw new Error("walletRecoveryPrepare.registration PRF salts are unsupported");
-	return { prf: { eval: {
-		firstB64u,
-		secondB64u
-	} } };
-}
-function parseRecoveryPublicKeyParameters(raw) {
-	if (!Array.isArray(raw) || raw.length !== 2) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams is invalid");
-	const first = decodeExactJsonObject(raw[0], ["type", "alg"], "walletRecoveryPrepare.registration.pubKeyCredParams[0]");
-	const second = decodeExactJsonObject(raw[1], ["type", "alg"], "walletRecoveryPrepare.registration.pubKeyCredParams[1]");
-	if (readJsonField(first, "type") !== "public-key" || readJsonField(first, "alg") !== -7) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams[0] is invalid");
-	if (readJsonField(second, "type") !== "public-key" || readJsonField(second, "alg") !== -257) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams[1] is invalid");
-	return [{
-		type: "public-key",
-		alg: -7
-	}, {
-		type: "public-key",
-		alg: -257
-	}];
-}
-function parseRecoveryAuthenticatorSelection(raw) {
-	const selection = decodeExactJsonObject(raw, ["residentKey", "userVerification"], "walletRecoveryPrepare.registration.authenticatorSelection");
-	if (readJsonField(selection, "residentKey") !== "required" || readJsonField(selection, "userVerification") !== "preferred") throw new Error("walletRecoveryPrepare.registration.authenticatorSelection is invalid");
-	return {
-		residentKey: "required",
-		userVerification: "preferred"
-	};
+		authenticatorSelection: wireObject({
+			residentKey: wireLiteral("required"),
+			userVerification: wireLiteral("preferred")
+		}),
+		timeoutMs: (raw, label) => {
+			const timeoutMs = Number(raw);
+			if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new Error(`${label} is invalid`);
+			return timeoutMs;
+		},
+		attestation: wireLiteral("none"),
+		extensions: wireObject({ prf: wireObject({ eval: wireObject({
+			firstB64u: prfSalt(PASSKEY_PRF_FIRST_SALT_V1),
+			secondB64u: prfSalt(PASSKEY_PRF_SECOND_SALT_V1)
+		}) }) }),
+		excludeCredentials: (raw, label) => requireArray(raw, label).map((entry, index) => credentialDescriptor(entry, `${label}[${index}]`))
+	}, (registration, label) => {
+		if (registration.rpId !== expectedRpId) throw new Error(`${label} changed the relying party`);
+	});
 }
-function parseRecoveryExcludeCredentials(raw) {
-	if (!Array.isArray(raw)) throw new Error("walletRecoveryPrepare.registration.excludeCredentials is invalid");
-	return raw.map((entry, index) => {
-		const descriptor = decodeExactJsonObject(entry, ["type", "id"], `walletRecoveryPrepare.registration.excludeCredentials[${index}]`);
-		if (readJsonField(descriptor, "type") !== "public-key") throw new Error("walletRecoveryPrepare.registration.excludeCredentials type is invalid");
-		const parsedId = parseWebAuthnCredentialIdB64u(readJsonField(descriptor, "id"));
-		if (!parsedId.ok) throw new Error("walletRecoveryPrepare.registration.excludeCredentials id is invalid");
-		requireCanonicalNonEmptyB64u(parsedId.value, "registration.excludeCredentials.id");
-		return {
-			type: "public-key",
-			id: parsedId.value
-		};
+function publicKeyCredentialParameter(alg) {
+	return wireObject({
+		type: wireLiteral("public-key"),
+		alg: (raw, label) => {
+			if (raw !== alg) throw new Error(`${label} is invalid`);
+			return alg;
+		}
 	});
 }
+function prfSalt(salt) {
+	return (raw, label) => {
+		const value = requireCanonicalBytesB64u(raw, salt.length, label);
+		if (value !== base64UrlEncode(salt)) throw new Error(`${label} is unsupported`);
+		return value;
+	};
+}
 function recoveryTargetsMatch(left, right) {
 	if (left.kind !== right.kind) return false;
 	switch (left.kind) {
@@ -325,18 +278,12 @@ function recoveryTargetsMatch(left, right) {
 function assertNeverRecoveryTarget(value) {
 	throw new Error(`unsupported wallet recovery target: ${String(value)}`);
 }
-const PREPARED_WRAP_FIELDS = [
-	"nonceB64u",
-	"wrappedManifestKekB64u",
-	"aadHashB64u"
-];
-function parsePreparedRecoveryWrap(raw) {
-	const wrap = decodeExactJsonObject(raw, PREPARED_WRAP_FIELDS, "walletRecoveryPrepare.wrap");
-	return {
-		nonceB64u: parseEnvelopeNonceB64u(readJsonField(wrap, "nonceB64u"), "walletRecoveryPrepare.wrap.nonceB64u"),
-		wrappedManifestKekB64u: parseEnvelopeCiphertextB64u(readJsonField(wrap, "wrappedManifestKekB64u"), "walletRecoveryPrepare.wrap.wrappedManifestKekB64u"),
-		aadHashB64u: parseDigestField(readJsonField(wrap, "aadHashB64u"), "walletRecoveryPrepare.wrap.aadHashB64u")
-	};
+function preparedRecoveryWrap() {
+	return wireObject({
+		nonceB64u: parseEnvelopeNonceB64u,
+		wrappedManifestKekB64u: parseEnvelopeCiphertextB64u,
+		aadHashB64u: parseDigestField
+	});
 }
 function parsePreparedRecoveryEntries(raw) {
 	if (!Array.isArray(raw) || raw.length !== 1) throw new Error("walletRecoveryPrepare.entries must contain exactly one custody seed");
@@ -498,7 +445,7 @@ function parseWalletRecoveryPreparationEcdsaRecoveryBasis(raw, expectedWalletId)
 function parseWalletRecoveryEcdsaChainTargets(raw) {
 	if (!Array.isArray(raw) || raw.length === 0) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are invalid");
 	const targets = raw.map((value, index) => parseWalletRecoveryEcdsaChainTarget(value, index));
-	if (new Set(targets.map(walletRecoveryEcdsaChainTargetKey)).size !== targets.length) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are duplicated");
+	if (new Set(targets.map(thresholdEcdsaChainTargetKey)).size !== targets.length) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are duplicated");
 	const first = targets[0];
 	if (!first) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are invalid");
 	return [first, ...targets.slice(1)];
@@ -538,9 +485,6 @@ function parseWalletRecoveryEcdsaChainTarget(raw, index) {
 	};
 	throw new Error("walletRecoveryPrepare ECDSA recovery chain family is invalid");
 }
-function walletRecoveryEcdsaChainTargetKey(target) {
-	return target.kind === "evm" ? `evm:eip155:${target.chainId}` : `tempo:${target.chainId}`;
-}
 function parseWalletRecoveryEcdsaParticipantIds(raw) {
 	if (!Array.isArray(raw) || raw.length !== 2 || raw[0] !== 1 || raw[1] !== 2) throw new Error("walletRecoveryPrepare ECDSA recovery participant IDs are invalid");
 	return [1, 2];
@@ -844,9 +788,6 @@ function durableBase64Url(value, label, byteLength) {
 	if (byteLength !== void 0 && bytes.byteLength !== byteLength) throw new Error(label + " must decode to " + byteLength + " bytes");
 	return normalized;
 }
-function durableCompressedPublicKey(value, label) {
-	return parseSecp256k1CompressedPublicKeyB64u(value, label);
-}
 function durableSafeInteger(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(label + " must be a non-negative safe integer");
 	return value;
@@ -917,10 +858,10 @@ function parseWalletRecoveryDurableEcdsaPublicFacts(raw) {
 	if (!/^0x[0-9a-f]{40}$/.test(ethereumAddress)) throw new Error("recovery durable ECDSA ethereumAddress is invalid");
 	return {
 		contextBinding32B64u: parseDigestField(record.contextBinding32B64u, "recovery durable ECDSA context binding"),
-		derivationClientSharePublicKey33B64u: durableCompressedPublicKey(record.derivationClientSharePublicKey33B64u, "recovery durable ECDSA client share"),
-		clientVerifyingShare33B64u: durableCompressedPublicKey(record.clientVerifyingShare33B64u, "recovery durable ECDSA client verifying share"),
-		relayerPublicKey33B64u: durableCompressedPublicKey(record.relayerPublicKey33B64u, "recovery durable ECDSA relayer public key"),
-		groupPublicKey33B64u: durableCompressedPublicKey(record.groupPublicKey33B64u, "recovery durable ECDSA group public key"),
+		derivationClientSharePublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.derivationClientSharePublicKey33B64u, "recovery durable ECDSA client share"),
+		clientVerifyingShare33B64u: parseSecp256k1CompressedPublicKeyB64u(record.clientVerifyingShare33B64u, "recovery durable ECDSA client verifying share"),
+		relayerPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.relayerPublicKey33B64u, "recovery durable ECDSA relayer public key"),
+		groupPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.groupPublicKey33B64u, "recovery durable ECDSA group public key"),
 		ethereumAddress,
 		clientShareRetryCounter: durableSafeInteger(record.clientShareRetryCounter, "recovery durable ECDSA client-share retry counter"),
 		relayerShareRetryCounter: durableSafeInteger(record.relayerShareRetryCounter, "recovery durable ECDSA relayer-share retry counter")
@@ -1689,10 +1630,6 @@ function requireEmailHash(value) {
 }
 //#endregion
 //#region src/SeamsWeb/operations/recovery/walletRecoveryCommit.ts
-async function sameVerifiedActiveWalletAuthorityV1(left, right) {
-	const [leftVerified, rightVerified] = await Promise.all([walletAuthorityDigestsMatchV1(left), walletAuthorityDigestsMatchV1(right)]);
-	return leftVerified && rightVerified && left.authorityDigestB64u === right.authorityDigestB64u && left.signerActivationSetDigestB64u === right.signerActivationSetDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs && left.activatedAtMs === right.activatedAtMs;
-}
 async function sameWalletRecoveryCommittedProjectionV1(left, right) {
 	if (left.version !== right.version || left.storeVersion !== right.storeVersion || left.walletId !== right.walletId || left.recoveryOperationId !== right.recoveryOperationId || left.targetDeviceId !== right.targetDeviceId || left.targetAuthorityId !== right.targetAuthorityId || left.targetWalletAuthMethodId !== right.targetWalletAuthMethodId || !await sameVerifiedActiveWalletAuthorityV1(left.authority, right.authority) || !sameWalletAuthMethodRecordV2(left.authMethod, right.authMethod)) return false;
 	if (left.kind !== right.kind) return false;

package/dist/{public/sdk/walletRecoveryRotate-BYOYJAyb.js → esm/sdk/walletRecoveryRotate-BgLlW5ih.js}

@@ -1,4 +1,4 @@
-import { n as buildRelayerJsonPostRequestInit, r as normalizeRelayerBaseUrl } from "./relayerHttp-LsVTZCxA.js";
+import { n as buildRelayerJsonPostRequestInit, r as normalizeRelayerBaseUrl } from "./relayerHttp-VC8Holz1.js";
 //#region src/core/rpcClients/relayer/walletRecoveryRotate.ts
 const WALLET_RECOVERY_ROTATE_PATH = "/wallets/recovery/rotate";
 const WALLET_RECOVERY_ACK_PATH = "/wallets/recovery/acknowledge-backup";

package/dist/esm/sdk/{warmSessionHydration-DDNYdTCz.js → warmSessionHydration-Os8niEm7.js}

@@ -1,4 +1,4 @@
-import { t as cacheCredentialBoundarySetupExportPrfFirst } from "./prfCache-CgAr-VEU.js";
+import { t as cacheCredentialBoundarySetupExportPrfFirst } from "./prfCache-wqQSjYLn.js";
 //#region src/core/signingEngine/session/passkey/warmSessionHydration.ts
 function createWarmSessionHydrationService(deps) {
 	return { hydrateSigningSession: (input) => cacheCredentialBoundarySetupExportPrfFirst(deps.getWarmSessionMaterialWriter(), input) };

package/dist/{public/sdk/webauthnP256-CHqprSh1.js → esm/sdk/webauthnP256-DC5EIbKN.js}

@@ -1,5 +1,5 @@
 import { r as base64UrlDecode, t as base64Decode } from "./base64-Clm8C-e9.js";
-import { n as buildWebauthnP256SignatureWasm } from "./evmCryptoWasm-BVj135bZ.js";
+import { n as buildWebauthnP256SignatureWasm } from "./evmCryptoWasm-DWklhEEb.js";
 //#region src/core/signingEngine/flows/signEvmFamily/signers/webauthnP256.ts
 function bytesEq(a, b) {
 	if (a.length !== b.length) return false;

package/dist/esm/shared-ts/src/authorization/delegatedAuthority.js

@@ -116,6 +116,6 @@ function invalidAuthorityResult(message) {
 	};
 }
 //#endregion
-export { FULL_OWNER_PERMISSIONS, buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, delegatedWalletPermissionNamesV1, hasDelegatedWalletPermissionV1, isDelegatedWalletPermissionV1, parseDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, sameDelegatedWalletAuthorityV1 };
+export { buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, delegatedWalletPermissionNamesV1, hasDelegatedWalletPermissionV1, parseDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, sameDelegatedWalletAuthorityV1 };
 
 //# sourceMappingURL=delegatedAuthority.js.map

package/dist/esm/shared-ts/src/authorization/operationFingerprint.js

@@ -1,7 +1,6 @@
-import "./capabilityKinds.js";
 import { base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../utils/digests.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 //#region ../shared-ts/src/authorization/operationFingerprint.ts
 const CAPABILITY_OPERATION_FINGERPRINT_DOMAIN_V1 = "seams:authorization:capability-operation-fingerprint:v1";
 var CapabilityOperationEnvelopeProof = class {