@seams/wallet 0.6.2 → 0.7.3

package/dist/esm/shared-ts/src/signing-lanes/ownerContinuity.js

@@ -1,5 +1,10 @@
 import { hasWhitespaceOrControlCharacters, parseMpcSigningWorkerRef } from "../utils/domainIds.js";
-import { parseDigestField, rejectUnknownFields, requireRecord } from "../passkey-custody/primitives.js";
+import { requireRecord } from "../utils/validation.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { parseDigestField, requireParsed } from "../passkey-custody/primitives.js";
+import "./participants.js";
+import "../utils/digestEncoding.js";
+import "./participantDigest.js";
 //#region ../shared-ts/src/signing-lanes/ownerContinuity.ts
 const OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
 	"kind",
@@ -9,10 +14,6 @@ const OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
 	"custodyKeyManifestDigestB64u",
 	"sourceIdentityDigestB64u"
 ];
-function requireResult(result, label) {
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
 /** Parse the owner signer identity without widening it into a generic string. */
 function parseWalletSignerId(raw, label = "walletSignerId") {
 	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
@@ -38,7 +39,7 @@ function buildOwnerLaneParticipantContinuityV1(args) {
 		kind: "owner_lane_participant_continuity_v1",
 		signerId: parseWalletSignerId(args.signerId),
 		participantIds,
-		signingWorkerId: requireResult(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
+		signingWorkerId: requireParsed(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
 		custodyKeyManifestDigestB64u: parseDigestField(args.custodyKeyManifestDigestB64u, "custodyKeyManifestDigestB64u"),
 		sourceIdentityDigestB64u: parseDigestField(args.sourceIdentityDigestB64u, "sourceIdentityDigestB64u")
 	};
@@ -50,7 +51,7 @@ function parseOwnerLaneParticipantContinuityV1(raw, label = "ownerParticipantCon
 	return buildOwnerLaneParticipantContinuityV1({
 		signerId: parseWalletSignerId(record.signerId, `${label}.signerId`),
 		participantIds: parseParticipantIds(record.participantIds, `${label}.participantIds`),
-		signingWorkerId: requireResult(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
+		signingWorkerId: requireParsed(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
 		custodyKeyManifestDigestB64u: parseDigestField(record.custodyKeyManifestDigestB64u, `${label}.custodyKeyManifestDigestB64u`),
 		sourceIdentityDigestB64u: parseDigestField(record.sourceIdentityDigestB64u, `${label}.sourceIdentityDigestB64u`)
 	});

package/dist/esm/shared-ts/src/signing-lanes/participantDigest.js

@@ -0,0 +1,2 @@
+import "./participants.js";
+import "../utils/digestEncoding.js";

package/dist/esm/shared-ts/src/signing-lanes/participants.js

@@ -1,4 +1,5 @@
 import { hasWhitespaceOrControlCharacters } from "../utils/domainIds.js";
+import { requireRecord } from "../utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 //#region ../shared-ts/src/signing-lanes/participants.ts
@@ -89,10 +90,6 @@ function brandRecipientDigest(value) {
 function brandParticipantDigest(value) {
 	return value;
 }
-function requireRecord(raw, label) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${label} must be an object`);
-	return raw;
-}
 function rejectUnknownFields(record, fields, label) {
 	const allowed = new Set(fields);
 	for (const field of Object.keys(record)) if (!allowed.has(field)) throw new Error(`${label}.${field} is not supported`);
@@ -254,6 +251,6 @@ function parseSigningWorkerParticipantRecordV1(raw, label = "signingWorkerPartic
 	});
 }
 //#endregion
-export { buildLaneHolderCustodyIdentityV1, buildLaneHolderParticipantRecordV1, buildSigningWorkerParticipantRecordV1, buildSigningWorkerRecipientIdentityV1, parseLaneCustodyBindingDigestB64u, parseLaneHolderCustodyBindingId, parseLaneHolderCustodyIdentityV1, parseLaneHolderParticipantId, parseLaneHolderParticipantRecordV1, parseLaneParticipantBindingDigestB64u, parseSigningWorkerParticipantId, parseSigningWorkerParticipantRecordV1, parseSigningWorkerRecipientIdentityV1, parseSigningWorkerRecipientKeyDigestB64u, parseSigningWorkerRecipientKeyId };
+export { buildLaneHolderParticipantRecordV1, buildSigningWorkerParticipantRecordV1, parseLaneCustodyBindingDigestB64u, parseLaneHolderCustodyBindingId, parseLaneHolderParticipantId, parseLaneHolderParticipantRecordV1, parseLaneParticipantBindingDigestB64u, parseSigningWorkerParticipantId, parseSigningWorkerParticipantRecordV1, parseSigningWorkerRecipientKeyDigestB64u, parseSigningWorkerRecipientKeyId };
 
 //# sourceMappingURL=participants.js.map

package/dist/esm/shared-ts/src/signing-lanes/recordParsers.js

@@ -1,8 +1,10 @@
 import { hasWhitespaceOrControlCharacters, parseLaneShareEpoch, parseLinkedDeviceId, parseSigningLaneId, parseWalletAuthMethodId, parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
-import { parseDigestField, parseEd25519PublicKeyB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs, rejectUnknownFields, requireRecord } from "../passkey-custody/primitives.js";
-import { parseNearEd25519SigningKeyId } from "../utils/registrationIntent.js";
-import { requireEvmFamilySigningKeySlotId } from "./evmFamilySigningKeySlotId.js";
+import { requireRecord } from "../utils/validation.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { parseDigestField, parseEd25519PublicKeyB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs, requireParsed } from "../passkey-custody/primitives.js";
+import { parseNearEd25519SigningKeyId } from "../utils/registrationIds.js";
 import { parseLaneHolderParticipantRecordV1, parseLaneParticipantBindingDigestB64u, parseSigningWorkerParticipantRecordV1 } from "./participants.js";
+import { requireEvmFamilySigningKeySlotId } from "./evmFamilySigningKeySlotId.js";
 import { parseOwnerLaneParticipantContinuityV1 } from "./ownerContinuity.js";
 //#region ../shared-ts/src/signing-lanes/recordParsers.ts
 const WALLET_KEY_COMMON_FIELDS = [
@@ -32,7 +34,7 @@ const WALLET_KEY_LIFECYCLE_FIELDS = [
 	"retiredAtMs",
 	"compromisedAtMs"
 ];
-const SIGNING_LANE_REFERENCE_FIELDS = [
+const SIGNING_LANE_RECORD_BASE_FIELDS = [...[
 	"kind",
 	"walletId",
 	"walletKeyId",
@@ -40,9 +42,7 @@ const SIGNING_LANE_REFERENCE_FIELDS = [
 	"laneKind",
 	"laneShareEpoch",
 	"participantBindingDigestB64u"
-];
-[...SIGNING_LANE_REFERENCE_FIELDS];
-const SIGNING_LANE_RECORD_BASE_FIELDS = [...SIGNING_LANE_REFERENCE_FIELDS, "lifecycle"];
+], "lifecycle"];
 const OWNER_AUTH_SIGNING_LANE_FIELDS = [
 	...SIGNING_LANE_RECORD_BASE_FIELDS,
 	"walletAuthMethodId",
@@ -88,10 +88,6 @@ function signingLaneRecordFields(laneKind) {
 		case "delegated_execution": return DELEGATED_SIGNING_LANE_FIELDS;
 	}
 }
-function requireResult(result, label) {
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
 function parseRequiredDomainId(raw, label) {
 	if (raw === void 0 || raw === null) throw new Error(`${label} is required`);
 	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
@@ -191,12 +187,12 @@ function parseSigningLaneLifecycleState(raw, label) {
 function parseSigningLaneReferenceFields(record, label) {
 	if (record.kind !== "signing_lane_reference_v1") throw new Error(`${label}.kind must be signing_lane_reference_v1`);
 	return buildSigningLaneReference({
-		walletId: requireResult(parseWalletId(record.walletId), `${label}.walletId`),
-		walletKeyId: requireResult(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
-		laneId: requireResult(parseSigningLaneId(record.laneId), `${label}.laneId`),
-		laneShareEpoch: requireResult(parseLaneShareEpoch(record.laneShareEpoch), `${label}.laneShareEpoch`),
+		walletId: requireParsed(parseWalletId(record.walletId), `${label}.walletId`),
+		walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
+		laneId: requireParsed(parseSigningLaneId(record.laneId), `${label}.laneId`),
+		laneShareEpoch: requireParsed(parseLaneShareEpoch(record.laneShareEpoch), `${label}.laneShareEpoch`),
 		laneKind: parseSigningLaneKind(record.laneKind, `${label}.laneKind`),
-		participantBindingDigestB64u: requireResult(parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u), `${label}.participantBindingDigestB64u`)
+		participantBindingDigestB64u: requireParsed(parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u), `${label}.participantBindingDigestB64u`)
 	});
 }
 function parseSigningLaneRecordCommon(record, label) {
@@ -215,7 +211,7 @@ function parseOwnerAuthSigningLaneRecordBase(record, label) {
 	const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
 	return {
 		...common,
-		walletAuthMethodId: requireResult(walletAuthMethodId, `${label}.walletAuthMethodId`),
+		walletAuthMethodId: requireParsed(walletAuthMethodId, `${label}.walletAuthMethodId`),
 		ownerParticipantContinuity: parseOwnerLaneParticipantContinuityV1(record.ownerParticipantContinuity, `${label}.ownerParticipantContinuity`)
 	};
 }
@@ -411,8 +407,8 @@ function parseWalletKeyRecord(raw, label = "walletKeyRecord") {
 	if (record.keyFamily === "ed25519") {
 		rejectUnknownFields(record, ED25519_WALLET_KEY_FIELDS, label, ALL_WALLET_KEY_FIELDS);
 		return buildEd25519WalletKeyRecord({
-			walletId: requireResult(parseWalletId(record.walletId), `${label}.walletId`),
-			walletKeyId: requireResult(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
+			walletId: requireParsed(parseWalletId(record.walletId), `${label}.walletId`),
+			walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
 			walletKeyVersion: parseWalletKeyVersion(record.walletKeyVersion, `${label}.walletKeyVersion`),
 			nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(record.nearEd25519SigningKeyId),
 			keyCreationSignerSlot: parseKeyCreationSignerSlot(record.keyCreationSignerSlot, `${label}.keyCreationSignerSlot`),
@@ -423,8 +419,8 @@ function parseWalletKeyRecord(raw, label = "walletKeyRecord") {
 	if (record.keyFamily === "ecdsa_secp256k1") {
 		rejectUnknownFields(record, EVM_WALLET_KEY_FIELDS, label, ALL_WALLET_KEY_FIELDS);
 		return buildEvmFamilyWalletKeyRecord({
-			walletId: requireResult(parseWalletId(record.walletId), `${label}.walletId`),
-			walletKeyId: requireResult(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
+			walletId: requireParsed(parseWalletId(record.walletId), `${label}.walletId`),
+			walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
 			walletKeyVersion: parseWalletKeyVersion(record.walletKeyVersion, `${label}.walletKeyVersion`),
 			evmFamilySigningKeySlotId: requireEvmFamilySigningKeySlotId(record.evmFamilySigningKeySlotId, `${label}.evmFamilySigningKeySlotId`),
 			thresholdPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.thresholdPublicKey33B64u, `${label}.thresholdPublicKey33B64u`),
@@ -453,7 +449,7 @@ function parseSigningLaneRecord(raw, label = "signingLaneRecord") {
 				holderParticipant: base.holderParticipant,
 				serverParticipant: base.serverParticipant,
 				lifecycle: base.lifecycle,
-				linkedDeviceId: requireResult(parseLinkedDeviceId(record.linkedDeviceId), `${label}.linkedDeviceId`)
+				linkedDeviceId: requireParsed(parseLinkedDeviceId(record.linkedDeviceId), `${label}.linkedDeviceId`)
 			});
 		}
 		case "delegated_execution": {

package/dist/esm/shared-ts/src/signing-lanes/rotationDigests.js

@@ -1,3 +1,5 @@
+import "../utils/digestEncoding.js";
+import "./ownerContinuity.js";
 new TextEncoder();
 //#endregion
 

package/dist/esm/shared-ts/src/signing-lanes/rotationParsers.js

@@ -1,3 +1,3 @@
-import "../authorization/capabilityKinds.js";
-import "../utils/registrationIntent.js";
-import "../threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import "../utils/wireSchema.js";
+import "./participants.js";
+import "./rotationWireFields.js";

package/dist/esm/shared-ts/src/signing-lanes/rotationProtocolParsers.js

@@ -0,0 +1,8 @@
+import "../utils/validation.js";
+import "../utils/exactRecord.js";
+import "../utils/wireSchema.js";
+import "../utils/registrationIds.js";
+import "./participants.js";
+import "./rotationWireFields.js";
+import "../threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import "./ownerContinuity.js";

package/dist/esm/shared-ts/src/signing-lanes/rotationWireFields.js

@@ -0,0 +1,3 @@
+import "../authorization/capabilityKinds.js";
+import "../utils/wireSchema.js";
+import "./participants.js";

package/dist/esm/shared-ts/src/threshold/ed25519OperationFingerprint.js

@@ -1,3 +1,4 @@
+import { coerceNonEmptyString, requireRecord } from "../utils/validation.js";
 import { base64UrlEncode } from "../utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../utils/digests.js";
 //#region ../shared-ts/src/threshold/ed25519OperationFingerprint.ts
@@ -18,8 +19,8 @@ async function thresholdEd25519NearTransactionOperationFingerprint(input) {
 			purpose: "near_transaction",
 			...canonicalScope(input),
 			transactions: canonicalNearTransactions(input.transactions),
-			unsignedTransactionBorshB64u: requiredString(input.unsignedTransactionBorshB64u, "unsignedTransactionBorshB64u"),
-			signingDigestB64u: requiredString(input.signingDigestB64u, "signingDigestB64u")
+			unsignedTransactionBorshB64u: coerceNonEmptyString(input.unsignedTransactionBorshB64u, "unsignedTransactionBorshB64u"),
+			signingDigestB64u: coerceNonEmptyString(input.signingDigestB64u, "signingDigestB64u")
 		}
 	});
 }
@@ -29,9 +30,9 @@ async function thresholdEd25519Nep413OperationFingerprint(input) {
 		payload: {
 			purpose: "nep413_message",
 			...canonicalScope(input),
-			message: requiredString(input.message, "message"),
-			recipient: requiredString(input.recipient, "recipient"),
-			nonce: requiredString(input.nonce, "nonce"),
+			message: coerceNonEmptyString(input.message, "message"),
+			recipient: coerceNonEmptyString(input.recipient, "recipient"),
+			nonce: coerceNonEmptyString(input.nonce, "nonce"),
 			state: input.state ? String(input.state) : null
 		}
 	});
@@ -48,16 +49,16 @@ async function thresholdEd25519DelegateActionOperationFingerprint(input) {
 }
 async function thresholdEd25519OperationFingerprint(input) {
 	return `sha256:${base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-		kind: requiredString(input.kind, "kind"),
+		kind: coerceNonEmptyString(input.kind, "kind"),
 		payload: normalizeFingerprintValue(input.payload)
 	})))}`;
 }
 function canonicalScope(input) {
 	return {
-		nearAccountId: requiredString(input.nearAccountId, "nearAccountId"),
-		nearNetworkId: requiredString(input.nearNetworkId, "nearNetworkId"),
-		relayerKeyId: requiredString(input.relayerKeyId, "relayerKeyId"),
-		signerPublicKey: requiredString(input.signerPublicKey, "signerPublicKey")
+		nearAccountId: coerceNonEmptyString(input.nearAccountId, "nearAccountId"),
+		nearNetworkId: coerceNonEmptyString(input.nearNetworkId, "nearNetworkId"),
+		relayerKeyId: coerceNonEmptyString(input.relayerKeyId, "relayerKeyId"),
+		signerPublicKey: coerceNonEmptyString(input.signerPublicKey, "signerPublicKey")
 	};
 }
 function canonicalNearTransactions(transactions) {
@@ -66,19 +67,19 @@ function canonicalNearTransactions(transactions) {
 }
 function canonicalDelegate(delegate) {
 	return {
-		senderId: requiredString(delegate.senderId, "delegate.senderId"),
-		receiverId: requiredString(delegate.receiverId, "delegate.receiverId"),
+		senderId: coerceNonEmptyString(delegate.senderId, "delegate.senderId"),
+		receiverId: coerceNonEmptyString(delegate.receiverId, "delegate.receiverId"),
 		actions: canonicalActions(delegate.actions, "delegate.actions"),
-		nonce: requiredString(delegate.nonce, "delegate.nonce"),
-		maxBlockHeight: requiredString(delegate.maxBlockHeight, "delegate.maxBlockHeight"),
-		publicKey: requiredString(delegate.publicKey, "delegate.publicKey")
+		nonce: coerceNonEmptyString(delegate.nonce, "delegate.nonce"),
+		maxBlockHeight: coerceNonEmptyString(delegate.maxBlockHeight, "delegate.maxBlockHeight"),
+		publicKey: coerceNonEmptyString(delegate.publicKey, "delegate.publicKey")
 	};
 }
 function parseThresholdEd25519NearTransaction(raw, label) {
 	const record = requireRecord(raw, label);
 	return {
-		nearAccountId: requiredString(record.nearAccountId, `${label}.nearAccountId`),
-		receiverId: requiredString(record.receiverId, `${label}.receiverId`),
+		nearAccountId: coerceNonEmptyString(record.nearAccountId, `${label}.nearAccountId`),
+		receiverId: coerceNonEmptyString(record.receiverId, `${label}.receiverId`),
 		actions: canonicalActions(record.actions, `${label}.actions`)
 	};
 }
@@ -88,7 +89,7 @@ function canonicalActions(actions, label) {
 }
 function parseThresholdEd25519NearAction(action, label) {
 	const record = requireRecord(action, label);
-	const actionType = requiredString(record.action_type, `${label}.action_type`);
+	const actionType = coerceNonEmptyString(record.action_type, `${label}.action_type`);
 	switch (actionType) {
 		case "CreateAccount": return { action_type: actionType };
 		case "DeployContract": return {
@@ -97,32 +98,32 @@ function parseThresholdEd25519NearAction(action, label) {
 		};
 		case "FunctionCall": return {
 			action_type: actionType,
-			method_name: requiredString(record.method_name, `${label}.method_name`),
-			args: requiredString(record.args, `${label}.args`),
-			gas: requiredString(record.gas, `${label}.gas`),
-			deposit: requiredString(record.deposit, `${label}.deposit`)
+			method_name: coerceNonEmptyString(record.method_name, `${label}.method_name`),
+			args: coerceNonEmptyString(record.args, `${label}.args`),
+			gas: coerceNonEmptyString(record.gas, `${label}.gas`),
+			deposit: coerceNonEmptyString(record.deposit, `${label}.deposit`)
 		};
 		case "Transfer": return {
 			action_type: actionType,
-			deposit: requiredString(record.deposit, `${label}.deposit`)
+			deposit: coerceNonEmptyString(record.deposit, `${label}.deposit`)
 		};
 		case "Stake": return {
 			action_type: actionType,
-			stake: requiredString(record.stake, `${label}.stake`),
-			public_key: requiredString(record.public_key, `${label}.public_key`)
+			stake: coerceNonEmptyString(record.stake, `${label}.stake`),
+			public_key: coerceNonEmptyString(record.public_key, `${label}.public_key`)
 		};
 		case "AddKey": return {
 			action_type: actionType,
-			public_key: requiredString(record.public_key, `${label}.public_key`),
-			access_key: requiredString(record.access_key, `${label}.access_key`)
+			public_key: coerceNonEmptyString(record.public_key, `${label}.public_key`),
+			access_key: coerceNonEmptyString(record.access_key, `${label}.access_key`)
 		};
 		case "DeleteKey": return {
 			action_type: actionType,
-			public_key: requiredString(record.public_key, `${label}.public_key`)
+			public_key: coerceNonEmptyString(record.public_key, `${label}.public_key`)
 		};
 		case "DeleteAccount": return {
 			action_type: actionType,
-			beneficiary_id: requiredString(record.beneficiary_id, `${label}.beneficiary_id`)
+			beneficiary_id: coerceNonEmptyString(record.beneficiary_id, `${label}.beneficiary_id`)
 		};
 		case "SignedDelegate": return {
 			action_type: actionType,
@@ -141,8 +142,8 @@ function parseThresholdEd25519NearAction(action, label) {
 function parseThresholdEd25519SignedDelegateAction(raw, label) {
 	const record = requireRecord(raw, label);
 	return {
-		senderId: requiredString(record.senderId, `${label}.senderId`),
-		receiverId: requiredString(record.receiverId, `${label}.receiverId`),
+		senderId: coerceNonEmptyString(record.senderId, `${label}.senderId`),
+		receiverId: coerceNonEmptyString(record.receiverId, `${label}.receiverId`),
 		actions: canonicalActions(record.actions, `${label}.actions`),
 		nonce: requiredIntegerLike(record.nonce, `${label}.nonce`),
 		maxBlockHeight: requiredIntegerLike(record.maxBlockHeight, `${label}.maxBlockHeight`),
@@ -191,22 +192,13 @@ function requiredSafeInteger(value, label) {
 function requiredIntegerLike(value, label) {
 	if (typeof value === "bigint") return value;
 	if (typeof value === "number" && Number.isSafeInteger(value)) return value;
-	return requiredString(value, label);
+	return coerceNonEmptyString(value, label);
 }
 function requiredDeployMode(value, label) {
-	const deployMode = requiredString(value, label);
+	const deployMode = coerceNonEmptyString(value, label);
 	if (deployMode === "CodeHash" || deployMode === "AccountId") return deployMode;
 	throw new Error(`${label} is invalid`);
 }
-function requireRecord(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-function requiredString(value, label) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error(`${label} is required`);
-	return normalized;
-}
 function optionalString(value) {
 	return String(value || "").trim() || null;
 }

package/dist/esm/shared-ts/src/threshold/keyMaterialBrands.js

@@ -0,0 +1,25 @@
+//#region ../shared-ts/src/threshold/keyMaterialBrands.ts
+function parseNonEmptyBrand(value, label) {
+	const normalized = String(value ?? "").trim();
+	if (!normalized) throw new Error(`${label} must be a non-empty string`);
+	return normalized;
+}
+function parseSigningSessionSealKeyVersion(value) {
+	return parseNonEmptyBrand(value, "signing-session seal key version");
+}
+function parseEcdsaClientVerifyingShareB64u(value) {
+	return parseNonEmptyBrand(value, "ECDSA client verifying share");
+}
+function parseEcdsaRelayerKeyId(value) {
+	return parseNonEmptyBrand(value, "ECDSA relayer key id");
+}
+function parseEcdsaKeyHandle(value) {
+	return parseNonEmptyBrand(value, "ECDSA key handle");
+}
+function formatEcdsaKeyHandleForWire(value) {
+	return value;
+}
+//#endregion
+export { formatEcdsaKeyHandleForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseNonEmptyBrand, parseSigningSessionSealKeyVersion };
+
+//# sourceMappingURL=keyMaterialBrands.js.map

package/dist/esm/shared-ts/src/threshold/secp256k1.js

@@ -1,5 +1,4 @@
-import "../utils/validation.js";
-Object.freeze({ kind: "threshold_secp256k1_ecdsa_2p_v1" });
+//#region ../shared-ts/src/threshold/secp256k1.ts
 const THRESHOLD_SECP256K1_ECDSA_2P_PARTICIPANT_IDS_V1 = [1, 2];
 //#endregion
 export { THRESHOLD_SECP256K1_ECDSA_2P_PARTICIPANT_IDS_V1 };

package/dist/esm/shared-ts/src/threshold/signingRootScope.js

@@ -28,6 +28,9 @@ function normalizeRuntimePolicyScopeFields(input) {
 		...normalizeOptionalTrimmedString(scope.signingRootVersion) ? { signingRootVersion: normalizeOptionalTrimmedString(scope.signingRootVersion) } : {}
 	};
 }
+function sameRuntimePolicyScope(left, right) {
+	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
+}
 function signingRootScopeFromRuntimePolicyScope(scope) {
 	return {
 		signingRootId: deriveSigningRootId(scope),
@@ -35,6 +38,6 @@ function signingRootScopeFromRuntimePolicyScope(scope) {
 	};
 }
 //#endregion
-export { deriveSigningRootId, normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope };
+export { deriveSigningRootId, normalizeRuntimePolicyScope, sameRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope };
 
 //# sourceMappingURL=signingRootScope.js.map

package/dist/esm/shared-ts/src/utils/addAuthMethodRegistration.js

@@ -5,10 +5,9 @@ import { parseWebAuthnRpId } from "./domainIds.js";
 *
 * This lives in the shared package because three parties read the same record:
 * the server that mints it, the browser that passes it to
-* `navigator.credentials.create`, and — since Refactor 103 Phase 8 — the
-* linked-device target preparation that carries it to Device 2. One
-* declaration, so a change to the ceremony cannot silently diverge from what a
-* linked device creates its passkey against.
+* `navigator.credentials.create`, and the linked-device target preparation that
+* carries it to Device 2. One declaration, so a change to the ceremony cannot
+* silently diverge from what a linked device creates its passkey against.
 *
 * Everything here is fixed by the canonical add-auth-method ceremony: two
 * algorithms in a fixed order, a resident key, no attestation, and PRF

package/dist/esm/shared-ts/src/utils/canonicalPrimitives.js

@@ -1,4 +1,5 @@
 import { base64UrlDecode, base64UrlEncode } from "./base64.js";
+import { sha256Bytes, sha256BytesUtf8 } from "./digests.js";
 //#region ../shared-ts/src/utils/canonicalPrimitives.ts
 function parseCorrelationId(value) {
 	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error("correlation id must be a non-empty canonical string");
@@ -25,7 +26,13 @@ function isoTimestampFromUnixMs(value) {
 	if (!Number.isSafeInteger(value) || Number(value) <= 0) throw new Error("timestamp milliseconds must be a positive safe integer");
 	return parseIsoTimestamp(new Date(Number(value)).toISOString());
 }
+async function sha256DigestB64u(bytes) {
+	return parseDigestB64u(base64UrlEncode(await sha256Bytes(bytes)));
+}
+async function sha256Utf8DigestB64u(text) {
+	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(text)));
+}
 //#endregion
-export { isoTimestampFromUnixMs, parseCorrelationId, parseDigestB64u, parseIsoTimestamp };
+export { isoTimestampFromUnixMs, parseCorrelationId, parseDigestB64u, parseIsoTimestamp, sha256DigestB64u, sha256Utf8DigestB64u };
 
 //# sourceMappingURL=canonicalPrimitives.js.map

package/dist/esm/shared-ts/src/utils/digestEncoding.js

@@ -0,0 +1,63 @@
+import { base64UrlDecode, base64UrlEncode } from "./base64.js";
+import { parseDigestB64u } from "./canonicalPrimitives.js";
+//#region ../shared-ts/src/utils/digestEncoding.ts
+const TEXT_ENCODER = new TextEncoder();
+function concat(parts) {
+	let length = 0;
+	for (const part of parts) length += part.length;
+	const output = new Uint8Array(length);
+	let offset = 0;
+	for (const part of parts) {
+		output.set(part, offset);
+		offset += part.length;
+	}
+	return output;
+}
+function u32(value, label) {
+	if (!Number.isSafeInteger(value) || value < 0 || value > 4294967295) throw new Error(`${label} must be a non-negative u32`);
+	return Uint8Array.from([
+		value >>> 24 & 255,
+		value >>> 16 & 255,
+		value >>> 8 & 255,
+		value & 255
+	]);
+}
+function u64(value, label) {
+	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative safe integer`);
+	let remaining = BigInt(value);
+	const output = new Uint8Array(8);
+	for (let index = 7; index >= 0; index -= 1) {
+		output[index] = Number(remaining & 255n);
+		remaining >>= 8n;
+	}
+	return output;
+}
+function lp32(value, label) {
+	return concat([u32(value.length, `${label}.length`), value]);
+}
+function text(value, label) {
+	if (typeof value !== "string") throw new Error(`${label} must be a string`);
+	return lp32(TEXT_ENCODER.encode(value), label);
+}
+function rawDigest(value, label) {
+	try {
+		const decoded = base64UrlDecode(parseDigestB64u(value));
+		if (decoded.length !== 32) throw new Error("must decode to 32 bytes");
+		return decoded;
+	} catch (error) {
+		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
+	}
+}
+function rawPublicKey(value, label) {
+	try {
+		const decoded = base64UrlDecode(value);
+		if (decoded.length === 0 || base64UrlEncode(decoded) !== value) throw new Error("must be canonical base64url");
+		return decoded;
+	} catch (error) {
+		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
+	}
+}
+//#endregion
+export { concat, lp32, rawDigest, rawPublicKey, text, u32, u64 };
+
+//# sourceMappingURL=digestEncoding.js.map

package/dist/esm/shared-ts/src/utils/ecdsaKeyFactsInventory.js

@@ -1,10 +1,8 @@
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
 import "./encoders.js";
+import { thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
 //#region ../shared-ts/src/utils/ecdsaKeyFactsInventory.ts
-function chainTargetKey(target) {
-	return target.kind === "evm" ? `evm:eip155:${target.chainId}` : `tempo:${target.chainId}`;
-}
 function normalizeChainTarget(target) {
 	if (target.kind === "evm") return {
 		kind: "evm",
@@ -22,7 +20,7 @@ function canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input) {
 	const keyTargets = input.keyTargets.map((target) => ({
 		keyHandle: target.keyHandle,
 		chainTarget: normalizeChainTarget(target.chainTarget),
-		targetKey: chainTargetKey(target.chainTarget)
+		targetKey: thresholdEcdsaChainTargetKey(target.chainTarget)
 	})).sort((left, right) => {
 		const leftKey = `${left.keyHandle}:${left.targetKey}`;
 		const rightKey = `${right.keyHandle}:${right.targetKey}`;
@@ -41,6 +39,6 @@ async function computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u(input) {
 	return base64UrlEncode(await sha256BytesUtf8(canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input)));
 }
 //#endregion
-export { canonicalizeWalletEcdsaKeyFactsInventoryChallenge, computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u };
+export { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u };
 
 //# sourceMappingURL=ecdsaKeyFactsInventory.js.map

package/dist/esm/shared-ts/src/utils/ecdsaServerTiming.js

@@ -5,7 +5,6 @@ const ECDSA_TIMING_METRICS = new Set([
 	"ecdsa_sign_proxy",
 	"ecdsa_sign_complete",
 	"ecdsa_sign_total",
-	"ecdsa_presign_queue",
 	"ecdsa_presign_authenticate",
 	"ecdsa_presign_material",
 	"ecdsa_presign_admit",

package/dist/esm/shared-ts/src/utils/emailOtpDomain.js

@@ -6,8 +6,8 @@ const WALLET_EMAIL_OTP_LOGIN_OPERATIONS = [
 	"export_key"
 ];
 const WALLET_EMAIL_OTP_REGISTRATION_OPERATION = "registration";
-/** Linked-device enrollment (Refactor 103 Phase 6): prove control of the
-* wallet's enrolled email destination to complete one device link. */
+/** Linked-device enrollment: prove control of the wallet's enrolled email
+* destination to complete one device link. */
 const WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION = "device_link";
 const WALLET_EMAIL_OTP_ACTIONS = {
 	login: "wallet_email_otp_login",
@@ -23,6 +23,6 @@ function isWalletEmailOtpLoginOperation(value) {
 	return WALLET_EMAIL_OTP_LOGIN_OPERATIONS.includes(value);
 }
 //#endregion
-export { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_LOGIN_OPERATIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation };
+export { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation };
 
 //# sourceMappingURL=emailOtpDomain.js.map

package/dist/esm/shared-ts/src/utils/encoders.js

@@ -1,2 +1,2 @@
-import "./base64.js";
 import "./base58.js";
+import "./base64.js";

package/dist/esm/shared-ts/src/utils/errors.js

@@ -90,6 +90,6 @@ function getUserFriendlyErrorMessage(error, context = "registration", accountId)
 	return msg;
 }
 //#endregion
-export { errorMessage, getTouchIdCancellationMessage, getUserFriendlyErrorMessage, isTouchIdCancellationError, isUserCancellationError, isWebAuthnRpIdOriginConfigurationError, toError };
+export { errorMessage, getUserFriendlyErrorMessage, isTouchIdCancellationError, isUserCancellationError, isWebAuthnRpIdOriginConfigurationError, toError };
 
 //# sourceMappingURL=errors.js.map

package/dist/esm/shared-ts/src/utils/exactKeys.js

@@ -0,0 +1,17 @@
+//#region ../shared-ts/src/utils/exactKeys.ts
+/**
+* True when `value` is a non-array object whose own enumerable string keys are exactly `keys`.
+*
+* A key whose value is `undefined` still counts as present. Symbol, non-enumerable and inherited
+* keys are not counted, and the prototype is not checked. A list that repeats a key never matches.
+* Kept apart from validation.ts, which the wallet iframe's boot path loads.
+*/
+function hasExactKeys(value, keys) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const actual = Object.keys(value);
+	return actual.length === keys.length && actual.every((key) => keys.includes(key));
+}
+//#endregion
+export { hasExactKeys };
+
+//# sourceMappingURL=exactKeys.js.map