@seams/wallet 0.6.2 → 0.7.3

package/dist/esm/shared-ts/src/authorization/walletAuthority.js

@@ -1,20 +1,24 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseMpcMaterialActivationRef, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId } from "../utils/domainIds.js";
 import { parseDeviceId } from "./capabilityKinds.js";
+import { requireRecord } from "../utils/validation.js";
 import { parseDelegatedWalletPermissionSetV1 } from "./delegatedAuthority.js";
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+import { base64UrlEncode } from "../utils/base64.js";
 import { sha256Bytes } from "../utils/digests.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+import { concat, lp32, rawDigest, rawPublicKey, text, u32, u64 } from "../utils/digestEncoding.js";
 import { buildExactAdministeredSignerManifestV1, parseExactAdministeredSignerManifestV1 } from "../device-linking/delegatedActivationPlan.js";
 //#region ../shared-ts/src/authorization/walletAuthority.ts
 const SIGNER_ACTIVATION_SET_DOMAIN = "seams/wallet-signer-activation-set/v1";
 const WALLET_AUTHORITY_DOMAIN = "seams/wallet-authority/v1";
-const TEXT_ENCODER = new TextEncoder();
 function isCombinedWalletSignerActivationSetV1(value) {
 	return isBothFamilyActivationSet(value);
 }
 function isActiveEcdsaWalletAuthorityV1(value) {
 	return isEcdsaOnlyActivationSet(value.signerActivations);
 }
+function isActiveEd25519WalletAuthorityV1(value) {
+	return isEd25519OnlyActivationSet(value.signerActivations);
+}
 function isActiveRecoveredWalletAuthorityV1(value) {
 	return value.provenance.kind === "wallet_recovery";
 }
@@ -145,8 +149,8 @@ function encodeWalletSignerActivationSetV1(value) {
 async function computeWalletSignerActivationSetDigestB64u(value) {
 	return parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeWalletSignerActivationSetV1(value))));
 }
-function buildPendingWalletAuthorityV1(input) {
-	validateWalletAuthorityV1(input);
+/** The fields every lifecycle state carries, copied in record order. */
+function walletAuthorityCommonFields(input) {
 	return {
 		kind: "wallet_authority_v1",
 		authorityId: input.authorityId,
@@ -159,7 +163,13 @@ function buildPendingWalletAuthorityV1(input) {
 		authorityDigestB64u: input.authorityDigestB64u,
 		revocationEpoch: input.revocationEpoch,
 		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
+		updatedAtMs: input.updatedAtMs
+	};
+}
+function buildPendingWalletAuthorityV1(input) {
+	validateWalletAuthorityV1(input);
+	return {
+		...walletAuthorityCommonFields(input),
 		state: "pending_local_install",
 		localInstallPackageSetDigestB64u: input.localInstallPackageSetDigestB64u
 	};
@@ -167,18 +177,7 @@ function buildPendingWalletAuthorityV1(input) {
 function buildActiveWalletAuthorityV1(input) {
 	validateWalletAuthorityV1(input);
 	return {
-		kind: "wallet_authority_v1",
-		authorityId: input.authorityId,
-		walletId: input.walletId,
-		principal: input.principal,
-		provenance: input.provenance,
-		permissions: input.permissions,
-		signerActivations: input.signerActivations,
-		signerActivationSetDigestB64u: input.signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authorityDigestB64u,
-		revocationEpoch: input.revocationEpoch,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
+		...walletAuthorityCommonFields(input),
 		state: "active",
 		activatedAtMs: input.activatedAtMs
 	};
@@ -218,37 +217,14 @@ async function replaceActiveWalletAuthorityEd25519MaterialActivationV1(input) {
 		activatedAtMs: input.authority.activatedAtMs
 	};
 	return buildActiveWalletAuthorityV1({
-		kind: draft.kind,
-		authorityId: draft.authorityId,
-		walletId: draft.walletId,
-		principal: draft.principal,
-		provenance: draft.provenance,
-		permissions: draft.permissions,
-		signerActivations: draft.signerActivations,
-		signerActivationSetDigestB64u: draft.signerActivationSetDigestB64u,
-		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft),
-		revocationEpoch: draft.revocationEpoch,
-		createdAtMs: draft.createdAtMs,
-		updatedAtMs: draft.updatedAtMs,
-		state: draft.state,
-		activatedAtMs: draft.activatedAtMs
+		...draft,
+		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft)
 	});
 }
 function buildActiveCombinedWalletAuthorityV1(input) {
 	validateWalletAuthorityV1(input);
 	return {
-		kind: "wallet_authority_v1",
-		authorityId: input.authorityId,
-		walletId: input.walletId,
-		principal: input.principal,
-		provenance: input.provenance,
-		permissions: input.permissions,
-		signerActivations: input.signerActivations,
-		signerActivationSetDigestB64u: input.signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authorityDigestB64u,
-		revocationEpoch: input.revocationEpoch,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
+		...walletAuthorityCommonFields(input),
 		state: "active",
 		activatedAtMs: input.activatedAtMs
 	};
@@ -256,115 +232,58 @@ function buildActiveCombinedWalletAuthorityV1(input) {
 function buildRevokedWalletAuthorityV1(input) {
 	validateWalletAuthorityV1(input);
 	return {
-		kind: "wallet_authority_v1",
-		authorityId: input.authorityId,
-		walletId: input.walletId,
-		principal: input.principal,
-		provenance: input.provenance,
-		permissions: input.permissions,
-		signerActivations: input.signerActivations,
-		signerActivationSetDigestB64u: input.signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authorityDigestB64u,
-		revocationEpoch: input.revocationEpoch,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
+		...walletAuthorityCommonFields(input),
 		state: "revoked",
 		activatedAtMs: input.activatedAtMs,
 		revokedAtMs: input.revokedAtMs
 	};
 }
+/** The record fields every lifecycle state has, in canonical order; each state adds its own. */
+const WALLET_AUTHORITY_FIELDS = [
+	"kind",
+	"authorityId",
+	"walletId",
+	"principal",
+	"provenance",
+	"permissions",
+	"signerActivations",
+	"signerActivationSetDigestB64u",
+	"authorityDigestB64u",
+	"revocationEpoch",
+	"createdAtMs",
+	"updatedAtMs",
+	"state"
+];
 function parseWalletAuthorityV1(raw) {
 	try {
 		const record = requireRecord(raw, "WalletAuthorityV1");
 		const common = parseWalletAuthorityCommon(record);
 		switch (record.state) {
 			case "pending_local_install":
-				exactFields(record, [
-					"kind",
-					"authorityId",
-					"walletId",
-					"principal",
-					"provenance",
-					"permissions",
-					"signerActivations",
-					"signerActivationSetDigestB64u",
-					"authorityDigestB64u",
-					"revocationEpoch",
-					"createdAtMs",
-					"updatedAtMs",
-					"state",
-					"localInstallPackageSetDigestB64u"
-				], "WalletAuthorityV1");
+				exactFields(record, [...WALLET_AUTHORITY_FIELDS, "localInstallPackageSetDigestB64u"], "WalletAuthorityV1");
 				return {
 					ok: true,
 					value: buildPendingWalletAuthorityV1({
 						kind: "wallet_authority_v1",
-						authorityId: common.authorityId,
-						walletId: common.walletId,
-						principal: common.principal,
-						provenance: common.provenance,
-						permissions: common.permissions,
-						signerActivations: common.signerActivations,
-						signerActivationSetDigestB64u: common.signerActivationSetDigestB64u,
-						authorityDigestB64u: common.authorityDigestB64u,
-						revocationEpoch: common.revocationEpoch,
-						createdAtMs: common.createdAtMs,
-						updatedAtMs: common.updatedAtMs,
+						...common,
 						state: "pending_local_install",
 						localInstallPackageSetDigestB64u: parseDigestField(record.localInstallPackageSetDigestB64u, "localInstallPackageSetDigestB64u")
 					})
 				};
 			case "active":
-				exactFields(record, [
-					"kind",
-					"authorityId",
-					"walletId",
-					"principal",
-					"provenance",
-					"permissions",
-					"signerActivations",
-					"signerActivationSetDigestB64u",
-					"authorityDigestB64u",
-					"revocationEpoch",
-					"createdAtMs",
-					"updatedAtMs",
-					"state",
-					"activatedAtMs"
-				], "WalletAuthorityV1");
+				exactFields(record, [...WALLET_AUTHORITY_FIELDS, "activatedAtMs"], "WalletAuthorityV1");
 				return {
 					ok: true,
 					value: buildActiveWalletAuthorityV1({
 						kind: "wallet_authority_v1",
-						authorityId: common.authorityId,
-						walletId: common.walletId,
-						principal: common.principal,
-						provenance: common.provenance,
-						permissions: common.permissions,
-						signerActivations: common.signerActivations,
-						signerActivationSetDigestB64u: common.signerActivationSetDigestB64u,
-						authorityDigestB64u: common.authorityDigestB64u,
-						revocationEpoch: common.revocationEpoch,
-						createdAtMs: common.createdAtMs,
-						updatedAtMs: common.updatedAtMs,
+						...common,
 						state: "active",
 						activatedAtMs: parseSafeInteger(record.activatedAtMs, "activatedAtMs")
 					})
 				};
 			case "revoked":
 				exactFields(record, [
-					"kind",
-					"authorityId",
-					"walletId",
-					"principal",
-					"provenance",
-					"permissions",
-					"signerActivations",
-					"signerActivationSetDigestB64u",
-					"authorityDigestB64u",
-					"revocationEpoch",
-					"createdAtMs",
-					"updatedAtMs",
-					"state",
+					...WALLET_AUTHORITY_FIELDS,
 					"activatedAtMs",
 					"revokedAtMs"
 				], "WalletAuthorityV1");
@@ -372,17 +291,7 @@ function parseWalletAuthorityV1(raw) {
 					ok: true,
 					value: buildRevokedWalletAuthorityV1({
 						kind: "wallet_authority_v1",
-						authorityId: common.authorityId,
-						walletId: common.walletId,
-						principal: common.principal,
-						provenance: common.provenance,
-						permissions: common.permissions,
-						signerActivations: common.signerActivations,
-						signerActivationSetDigestB64u: common.signerActivationSetDigestB64u,
-						authorityDigestB64u: common.authorityDigestB64u,
-						revocationEpoch: common.revocationEpoch,
-						createdAtMs: common.createdAtMs,
-						updatedAtMs: common.updatedAtMs,
+						...common,
 						state: "revoked",
 						activatedAtMs: parseSafeInteger(record.activatedAtMs, "activatedAtMs"),
 						revokedAtMs: parseSafeInteger(record.revokedAtMs, "revokedAtMs")
@@ -415,6 +324,14 @@ async function walletAuthorityDigestsMatchV1(value) {
 	if (await computeWalletSignerActivationSetDigestB64u(value.signerActivations) !== value.signerActivationSetDigestB64u) return false;
 	return await computeWalletAuthorityDigestB64u(value) === value.authorityDigestB64u;
 }
+/**
+* True when both authorities' stored digests verify and agree. The authority digest does not
+* cover the timestamps, so those must agree too.
+*/
+async function sameVerifiedActiveWalletAuthorityV1(left, right) {
+	const [leftVerified, rightVerified] = await Promise.all([walletAuthorityDigestsMatchV1(left), walletAuthorityDigestsMatchV1(right)]);
+	return leftVerified && rightVerified && left.authorityDigestB64u === right.authorityDigestB64u && left.signerActivationSetDigestB64u === right.signerActivationSetDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs && left.activatedAtMs === right.activatedAtMs;
+}
 function parseWalletAuthorityCommon(record) {
 	if (record.kind !== "wallet_authority_v1") throw new Error("WalletAuthorityV1.kind is unsupported");
 	const authorityId = requireParsed(parseWalletAuthorityId(record.authorityId), "authorityId");
@@ -563,7 +480,7 @@ function parseEcdsaActivation(raw, label) {
 		materialActivation: requireParsed(parseMpcMaterialActivationRef(record.materialActivation), `${label}.materialActivation`)
 	});
 }
-function parseManifestForSigner(raw, family, label) {
+function parseManifestForSigner(raw, family, _label) {
 	return parseExactAdministeredSignerManifestV1({
 		kind: "exact_administered_signer_manifest_v1",
 		keyFamilies: [family],
@@ -639,10 +556,6 @@ function encodePermissions(value) {
 	for (const permission of value) parts.push(lp32(text(permission, "permissions.item"), "permissions.item"));
 	return concat(parts);
 }
-function requireRecord(value, label) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
 function exactRecord(value, fields, label) {
 	const record = requireRecord(value, label);
 	exactFields(record, fields, label);
@@ -717,59 +630,6 @@ function parseDigestField(raw, label) {
 		throw new Error(`${label} ${errorMessage(error, "is invalid")}`);
 	}
 }
-function rawDigest(value, label) {
-	try {
-		return base64UrlDecode(parseDigestB64u(value));
-	} catch (error) {
-		throw new Error(`${label} ${errorMessage(error, "is invalid")}`);
-	}
-}
-function rawPublicKey(value, label) {
-	try {
-		const decoded = base64UrlDecode(value);
-		if (decoded.length === 0 || base64UrlEncode(decoded) !== value) throw new Error("must be canonical base64url");
-		return decoded;
-	} catch (error) {
-		throw new Error(`${label} ${errorMessage(error, "is invalid")}`);
-	}
-}
-function concat(parts) {
-	let length = 0;
-	for (const part of parts) length += part.length;
-	const output = new Uint8Array(length);
-	let offset = 0;
-	for (const part of parts) {
-		output.set(part, offset);
-		offset += part.length;
-	}
-	return output;
-}
-function u32(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0 || value > 4294967295) throw new Error(`${label} must be a non-negative u32`);
-	return Uint8Array.from([
-		value >>> 24 & 255,
-		value >>> 16 & 255,
-		value >>> 8 & 255,
-		value & 255
-	]);
-}
-function u64(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	let remaining = BigInt(value);
-	const output = new Uint8Array(8);
-	for (let index = 7; index >= 0; index -= 1) {
-		output[index] = Number(remaining & 255n);
-		remaining >>= 8n;
-	}
-	return output;
-}
-function lp32(value, label) {
-	return concat([u32(value.length, `${label}.length`), value]);
-}
-function text(value, label) {
-	if (typeof value !== "string") throw new Error(`${label} must be a string`);
-	return lp32(TEXT_ENCODER.encode(value), label);
-}
 function parseSafeInteger(raw, label) {
 	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0) throw new Error(`${label} must be a non-negative safe integer`);
 	return raw;
@@ -796,6 +656,33 @@ function errorMessage(error, fallback) {
 function assertNever(value, label) {
 	throw new Error(`${label} branch is unsupported: ${String(value)}`);
 }
+/**
+* Re-seals an authority around its new combined signer activations. Both digests are
+* recomputed; identity, provenance, permissions and lifecycle stay as they were.
+*/
+async function withCombinedSignerActivations(authority, signerActivations, now) {
+	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
+	const draft = {
+		kind: "wallet_authority_v1",
+		authorityId: authority.authorityId,
+		walletId: authority.walletId,
+		principal: authority.principal,
+		provenance: authority.provenance,
+		permissions: authority.permissions,
+		signerActivations,
+		signerActivationSetDigestB64u,
+		authorityDigestB64u: authority.authorityDigestB64u,
+		revocationEpoch: authority.revocationEpoch,
+		createdAtMs: authority.createdAtMs,
+		updatedAtMs: Math.max(authority.updatedAtMs, now),
+		state: "active",
+		activatedAtMs: authority.activatedAtMs
+	};
+	return buildActiveCombinedWalletAuthorityV1({
+		...draft,
+		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft)
+	});
+}
 async function extendEcdsaWalletAuthorityWithEd25519(input) {
 	if (input.ed25519.signer.walletId !== input.authority.walletId) throw new Error("NEAR signer belongs to a different wallet authority");
 	const existingEcdsa = input.authority.signerActivations.ecdsa;
@@ -809,46 +696,24 @@ async function extendEcdsaWalletAuthorityWithEd25519(input) {
 		}
 	});
 	if (!isCombinedWalletSignerActivationSetV1(signerActivationsCandidate)) throw new Error("Deferred Ed25519 activation did not produce a combined signer activation set");
-	const signerActivations = signerActivationsCandidate;
-	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
-	const draft = {
-		kind: "wallet_authority_v1",
-		authorityId: input.authority.authorityId,
-		walletId: input.authority.walletId,
-		principal: input.authority.principal,
-		provenance: input.authority.provenance,
-		permissions: input.authority.permissions,
-		signerActivations,
-		signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authority.authorityDigestB64u,
-		revocationEpoch: input.authority.revocationEpoch,
-		createdAtMs: input.authority.createdAtMs,
-		updatedAtMs: Math.max(input.authority.updatedAtMs, input.now),
-		state: "active",
-		activatedAtMs: input.authority.activatedAtMs
-	};
-	return buildActiveCombinedWalletAuthorityV1({
-		kind: draft.kind,
-		authorityId: draft.authorityId,
-		walletId: draft.walletId,
-		principal: draft.principal,
-		provenance: draft.provenance,
-		permissions: draft.permissions,
-		signerActivations: draft.signerActivations,
-		signerActivationSetDigestB64u: draft.signerActivationSetDigestB64u,
-		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft),
-		revocationEpoch: draft.revocationEpoch,
-		createdAtMs: draft.createdAtMs,
-		updatedAtMs: draft.updatedAtMs,
-		state: draft.state,
-		activatedAtMs: draft.activatedAtMs
-	});
+	return withCombinedSignerActivations(input.authority, signerActivationsCandidate, input.now);
+}
+/** `next` keeps everything of `previous` that an added signer must not change. */
+function keepsWalletAuthorityApartFromSigners(previous, next) {
+	return previous.authorityId === next.authorityId && previous.walletId === next.walletId && previous.revocationEpoch === next.revocationEpoch && previous.createdAtMs === next.createdAtMs && previous.activatedAtMs === next.activatedAtMs && base64UrlEncode(encodePrincipal(previous.principal)) === base64UrlEncode(encodePrincipal(next.principal)) && base64UrlEncode(encodeProvenance(previous.provenance)) === base64UrlEncode(encodeProvenance(next.provenance)) && base64UrlEncode(encodePermissions(previous.permissions)) === base64UrlEncode(encodePermissions(next.permissions));
+}
+/**
+* Whether `next` is `previous` with an added ECDSA signer and nothing else
+* changed. Both projections have already passed digest validation.
+*/
+function isEcdsaExtensionOfEd25519WalletAuthority(previous, next) {
+	return isActiveEd25519WalletAuthorityV1(previous) && isCombinedWalletSignerActivationSetV1(next.signerActivations) && keepsWalletAuthorityApartFromSigners(previous, next) && base64UrlEncode(encodeEd25519Activation(previous.signerActivations.ed25519)) === base64UrlEncode(encodeEd25519Activation(next.signerActivations.ed25519));
 }
 /** Both projections have already passed digest validation at their boundaries. */
 function isEd25519ExtensionOfEcdsaWalletAuthority(previous, next) {
-	return isActiveEcdsaWalletAuthorityV1(previous) && isCombinedWalletSignerActivationSetV1(next.signerActivations) && previous.provenance.kind === "wallet_registration" && previous.authorityId === next.authorityId && previous.walletId === next.walletId && previous.revocationEpoch === next.revocationEpoch && previous.createdAtMs === next.createdAtMs && previous.activatedAtMs === next.activatedAtMs && base64UrlEncode(encodePrincipal(previous.principal)) === base64UrlEncode(encodePrincipal(next.principal)) && base64UrlEncode(encodeProvenance(previous.provenance)) === base64UrlEncode(encodeProvenance(next.provenance)) && base64UrlEncode(encodePermissions(previous.permissions)) === base64UrlEncode(encodePermissions(next.permissions)) && base64UrlEncode(encodeEcdsaActivation(previous.signerActivations.ecdsa)) === base64UrlEncode(encodeEcdsaActivation(next.signerActivations.ecdsa));
+	return isActiveEcdsaWalletAuthorityV1(previous) && isCombinedWalletSignerActivationSetV1(next.signerActivations) && previous.provenance.kind === "wallet_registration" && keepsWalletAuthorityApartFromSigners(previous, next) && base64UrlEncode(encodeEcdsaActivation(previous.signerActivations.ecdsa)) === base64UrlEncode(encodeEcdsaActivation(next.signerActivations.ecdsa));
 }
 //#endregion
-export { buildActiveCombinedWalletAuthorityV1, buildActiveWalletAuthorityV1, buildPendingWalletAuthorityV1, buildRevokedWalletAuthorityV1, buildWalletEcdsaSignerActivationV1, buildWalletEd25519SignerActivationV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, encodeWalletAuthorityV1, encodeWalletSignerActivationSetV1, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1, isActiveRecoveredWalletAuthorityV1, isCombinedWalletSignerActivationSetV1, isEd25519ExtensionOfEcdsaWalletAuthority, parseWalletAuthorityV1, parseWalletSignerActivationSetV1, replaceActiveWalletAuthorityEd25519MaterialActivationV1, walletAuthorityDigestsMatchV1 };
+export { buildActiveCombinedWalletAuthorityV1, buildActiveWalletAuthorityV1, buildPendingWalletAuthorityV1, buildRevokedWalletAuthorityV1, buildWalletEcdsaSignerActivationV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, encodeWalletSignerActivationSetV1, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1, isActiveEd25519WalletAuthorityV1, isActiveRecoveredWalletAuthorityV1, isCombinedWalletSignerActivationSetV1, isEcdsaExtensionOfEd25519WalletAuthority, isEd25519ExtensionOfEcdsaWalletAuthority, parseWalletAuthorityV1, parseWalletSignerActivationSetV1, replaceActiveWalletAuthorityEd25519MaterialActivationV1, sameVerifiedActiveWalletAuthorityV1, walletAuthorityDigestsMatchV1 };
 
 //# sourceMappingURL=walletAuthority.js.map

package/dist/esm/shared-ts/src/authorization/walletCustodyOperation.js

@@ -1,16 +1,14 @@
-import { base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../utils/digests.js";
-import "../utils/encoders.js";
+import { alphabetizeStringify } from "../utils/digests.js";
+import { sha256Utf8DigestB64u } from "../utils/canonicalPrimitives.js";
 //#region ../shared-ts/src/authorization/walletCustodyOperation.ts
 /** Public challenge digest for a single wallet-administration factor proof. */
 async function computeWalletCustodyAdminChallengeDigest(input) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(`seams:wallet-custody:challenge:v1|${alphabetizeStringify({
+	return sha256Utf8DigestB64u(`seams:wallet-custody:challenge:v1|${alphabetizeStringify({
 		walletId: input.walletId,
 		operation: input.operation,
 		payload: input.payload,
 		requestOrigin: input.requestOrigin
-	})}`)));
+	})}`);
 }
 //#endregion
 export { computeWalletCustodyAdminChallengeDigest };

package/dist/esm/shared-ts/src/authorization/walletSessionIssuance.js

@@ -1,6 +1,7 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "./capabilityKinds.js";
 import { isPlainObject } from "../utils/validation.js";
+import { hasExactKeys } from "../utils/exactKeys.js";
 //#region ../shared-ts/src/authorization/walletSessionIssuance.ts
 const COMMITTED_IDENTITY_FIELDS = [
 	"kind",
@@ -38,12 +39,8 @@ const UNLOCK_FLAT_RESPONSE_FIELDS = [
 	"unlocked",
 	"unlockBackend"
 ];
-function hasOnlyFields(record, fields) {
-	const actual = Object.keys(record);
-	return actual.length === new Set(fields).size && actual.every((field) => fields.includes(field));
-}
 function parseCommittedIdentity(value) {
-	if (!isPlainObject(value) || !hasOnlyFields(value, COMMITTED_IDENTITY_FIELDS)) return null;
+	if (!isPlainObject(value) || !hasExactKeys(value, COMMITTED_IDENTITY_FIELDS)) return null;
 	if (value.kind !== "already_committed_wallet_session_v1") return null;
 	const walletId = parseWalletId(value.walletId);
 	const authorityId = parseWalletAuthorityId(value.authorityId);
@@ -74,8 +71,8 @@ function parseResponseEnvelope(value) {
 	};
 }
 function parseFlatCommittedIdentity(value) {
-	if (!hasOnlyFields(value, FLAT_RESPONSE_FIELDS) && !hasOnlyFields(value, UNLOCK_FLAT_RESPONSE_FIELDS)) return null;
-	if (hasOnlyFields(value, UNLOCK_FLAT_RESPONSE_FIELDS) && (value.unlocked !== false || value.unlockBackend !== "passkey" && value.unlockBackend !== "email_otp")) return null;
+	if (!hasExactKeys(value, FLAT_RESPONSE_FIELDS) && !hasExactKeys(value, UNLOCK_FLAT_RESPONSE_FIELDS)) return null;
+	if (hasExactKeys(value, UNLOCK_FLAT_RESPONSE_FIELDS) && (value.unlocked !== false || value.unlockBackend !== "passkey" && value.unlockBackend !== "email_otp")) return null;
 	if (value.kind !== "already_committed") return null;
 	return parseCommittedIdentity({
 		kind: "already_committed_wallet_session_v1",
@@ -101,7 +98,7 @@ function parseWalletSessionAlreadyCommittedResponseV1(value) {
 	if (!isPlainObject(value)) return null;
 	const envelope = parseResponseEnvelope(value);
 	if (!envelope) return null;
-	if (!hasOnlyFields(value, NESTED_RESPONSE_FIELDS)) return null;
+	if (!hasExactKeys(value, NESTED_RESPONSE_FIELDS)) return null;
 	const committed = parseCommittedIdentity(value.committed);
 	return committed ? buildAlreadyCommittedResponse(envelope, committed) : null;
 }

package/dist/esm/shared-ts/src/authorization/walletSignerActivationEquality.js

@@ -0,0 +1,12 @@
+import { mpcMaterialActivationRefsEqual } from "../utils/domainIds.js";
+//#region ../shared-ts/src/authorization/walletSignerActivationEquality.ts
+function sameWalletEd25519SignerActivationV1(left, right) {
+	return left.kind === right.kind && left.signer.kind === right.signer.kind && left.signer.keyFamily === right.signer.keyFamily && left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.registeredPublicKeyB64u === right.signer.registeredPublicKeyB64u && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
+}
+function sameWalletEcdsaSignerActivationV1(left, right) {
+	return left.kind === right.kind && left.signer.kind === right.signer.kind && left.signer.keyFamily === right.signer.keyFamily && left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.thresholdPublicKey33B64u === right.signer.thresholdPublicKey33B64u && left.signer.evmAddress === right.signer.evmAddress && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
+}
+//#endregion
+export { sameWalletEcdsaSignerActivationV1, sameWalletEd25519SignerActivationV1 };
+
+//# sourceMappingURL=walletSignerActivationEquality.js.map

package/dist/esm/shared-ts/src/device-linking/activeWalletSession.js

@@ -1,4 +1,8 @@
 import { mpcMaterialActivationRefsEqual } from "../utils/domainIds.js";
+import { requireRecord } from "../utils/validation.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { wireLiteral, wireObject } from "../utils/wireSchema.js";
+import { digest, keyLabeled, materialActivation, parseNonNegativeSafeInteger, parseUnixTime, quotaId, walletAuthMethodId, walletAuthorityId, walletId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
 //#region ../shared-ts/src/device-linking/activeWalletSession.ts
 function activeWalletSessionV1RecordsEqual(left, right) {
 	if (left.kind !== right.kind || left.walletId !== right.walletId || left.authorityId !== right.authorityId || left.authMethodId !== right.authMethodId || left.authorizationId !== right.authorizationId || left.quotaId !== right.quotaId || left.authorityDigestB64u !== right.authorityDigestB64u || left.authorityRevocationEpoch !== right.authorityRevocationEpoch || left.issuedAtMs !== right.issuedAtMs || left.expiresAtMs !== right.expiresAtMs || left.capabilitySubjects.length !== right.capabilitySubjects.length) return false;
@@ -29,7 +33,72 @@ function walletSessionPreservesCapabilities(previous, next) {
 	}
 	return true;
 }
+function walletSessionOperationCredentialV1() {
+	return wireObject({
+		kind: wireLiteral("opaque_wallet_session_operation_credential_v1"),
+		token: (raw, label) => {
+			if (typeof raw !== "string" || raw.length > 8192) throw new Error(`${label} is invalid`);
+			return raw;
+		},
+		walletSessionId: keyLabeled(walletSessionId)
+	}, (credential, label) => {
+		if (!/^wst_[A-Za-z0-9_-]{43}$/.test(credential.token)) throw new Error(`${label} opaque token is invalid`);
+	});
+}
+function parseWalletSessionOperationCredentialV1(raw) {
+	return walletSessionOperationCredentialV1()(raw, "WalletSessionOperationCredentialV1");
+}
+function capabilitySubjectKey(subject) {
+	return subject.kind === "sign" || subject.kind === "export_keys" ? `${subject.kind}:${subject.keyFamily}:${subject.materialActivation.activationId}` : subject.kind;
+}
+function activeWalletSessionV1() {
+	return wireObject({
+		kind: wireLiteral("active_wallet_session_v1"),
+		walletId: keyLabeled(walletId),
+		authorityId: keyLabeled(walletAuthorityId),
+		authMethodId: keyLabeled(walletAuthMethodId),
+		authorizationId: keyLabeled(walletSessionAuthorizationId),
+		quotaId: keyLabeled(quotaId),
+		authorityDigestB64u: keyLabeled(digest),
+		authorityRevocationEpoch: keyLabeled(parseNonNegativeSafeInteger),
+		capabilitySubjects: (raw, label) => {
+			if (!Array.isArray(raw) || raw.length === 0) throw new Error(`${label} must be non-empty`);
+			const subjects = [];
+			for (const [index, subject] of raw.entries()) subjects.push(parseWalletCapabilitySubjectV1(subject, `capabilitySubjects[${index}]`));
+			const first = subjects[0];
+			if (!first) throw new Error(`${label} must be non-empty`);
+			return [first, ...subjects.slice(1)];
+		},
+		issuedAtMs: keyLabeled(parseUnixTime),
+		expiresAtMs: keyLabeled(parseUnixTime)
+	}, (session, label) => {
+		const keys = session.capabilitySubjects.map(capabilitySubjectKey);
+		if (new Set(keys).size !== keys.length) throw new Error(`${label} capability subjects repeat`);
+	});
+}
+function parseActiveWalletSessionV1(raw) {
+	return activeWalletSessionV1()(raw, "ActiveWalletSessionV1");
+}
+function parseWalletCapabilitySubjectV1(raw, label) {
+	const record = requireRecord(raw, label);
+	if (record.kind === "link_devices" || record.kind === "revoke_devices") {
+		rejectUnknownFields(record, ["kind"], label);
+		return { kind: record.kind };
+	}
+	if (record.kind !== "sign" && record.kind !== "export_keys") throw new Error(`${label}.kind is invalid`);
+	rejectUnknownFields(record, [
+		"kind",
+		"keyFamily",
+		"materialActivation"
+	], label);
+	if (record.keyFamily !== "ed25519" && record.keyFamily !== "ecdsa_secp256k1") throw new Error(`${label}.keyFamily is invalid`);
+	return {
+		kind: record.kind,
+		keyFamily: record.keyFamily,
+		materialActivation: materialActivation(record.materialActivation, `${label}.materialActivation`)
+	};
+}
 //#endregion
-export { activeWalletSessionV1RecordsEqual, walletCapabilitySubjectsEqual, walletSessionPreservesCapabilities };
+export { activeWalletSessionV1RecordsEqual, parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1, walletSessionPreservesCapabilities };
 
 //# sourceMappingURL=activeWalletSession.js.map