@seams/wallet 0.6.2 → 0.7.3

package/dist/esm/core/rpcClients/relayer/routerAbNormalSigning.js

@@ -1,8 +1,9 @@
+import { coerceNonEmptyString } from "../../../shared-ts/src/utils/validation.js";
 import { base64Decode, base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../shared-ts/src/utils/digests.js";
+import { buildBearerAuthorizationHeader, buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
 import { parseRouterAbMpcMaterialActivationRef, parseRouterAbNormalSigningAuthorization } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreRequestV1, parseRouterAbEcdsaOperationStepUpPreparationV1, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { buildBearerAuthorizationHeader, buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
 import { WalletSessionQuotaAdmissionError } from "../../signingEngine/session/operationState/authorizationAdmission.js";
 import { walletSessionFailureErrorFromPayload } from "../../signingEngine/session/lifecycle/walletSessionFailure.js";
 //#region src/core/rpcClients/relayer/routerAbNormalSigning.ts
@@ -42,11 +43,6 @@ function routerAbNormalSigningAdmissionErrorFromPayload(args) {
 		default: return null;
 	}
 }
-function requireNonEmptyString(value, label) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error(`${label} is required`);
-	return normalized;
-}
 function requirePositiveInteger(value, label) {
 	const parsed = Math.floor(Number(value));
 	if (!Number.isSafeInteger(parsed) || parsed <= 0) throw new Error(`${label} must be a positive integer`);
@@ -60,17 +56,17 @@ function requireByteArray(value, label, byteLength) {
 	return bytes;
 }
 function requireDigestB64u(value, label) {
-	const normalized = requireNonEmptyString(value, label);
+	const normalized = coerceNonEmptyString(value, label);
 	if (base64UrlDecode(normalized).length !== 32) throw new Error(`${label} must decode to 32 bytes`);
 	return normalized;
 }
 function requireBase64UrlNonEmpty(value, label) {
-	const normalized = requireNonEmptyString(value, label);
+	const normalized = coerceNonEmptyString(value, label);
 	if (base64UrlDecode(normalized).length === 0) throw new Error(`${label} must decode to non-empty bytes`);
 	return normalized;
 }
 function normalizeNonceToB64u(value, label) {
-	const normalized = requireNonEmptyString(value, label);
+	const normalized = coerceNonEmptyString(value, label);
 	let bytes;
 	try {
 		bytes = base64Decode(normalized);
@@ -90,10 +86,10 @@ async function routerAbNormalSigningActionFingerprint(value) {
 	return base64UrlEncode(await sha256Bytes(new TextEncoder().encode(alphabetizeStringify(value))));
 }
 function routerAbEd25519Nep413CanonicalMessageB64uV2(args) {
-	const message = requireNonEmptyString(args.message, "nep413.message");
-	const recipient = requireNonEmptyString(args.recipient, "nep413.recipient");
+	const message = coerceNonEmptyString(args.message, "nep413.message");
+	const recipient = coerceNonEmptyString(args.recipient, "nep413.recipient");
 	const nonce = base64UrlDecode(normalizeNonceToB64u(args.nonce, "nep413.nonce"));
-	const callbackUrl = args.callbackUrl == null ? void 0 : requireNonEmptyString(args.callbackUrl, "callbackUrl");
+	const callbackUrl = args.callbackUrl == null ? void 0 : coerceNonEmptyString(args.callbackUrl, "callbackUrl");
 	const out = [];
 	pushU32Le(out, NEP413_PREFIX);
 	pushBorshString(out, message);
@@ -112,13 +108,13 @@ async function buildRouterAbEd25519NearTransactionPrepareRequestV2(args) {
 		display_digest: routerAbDigest32Wire(base64UrlDecode(requireDigestB64u(args.displayDigestB64u, "displayDigestB64u"))),
 		intent: {
 			kind: "near_transaction_v1",
-			operation_id: requireNonEmptyString(args.operationId, "operationId"),
-			operation_fingerprint: requireNonEmptyString(args.operationFingerprint, "operationFingerprint"),
-			near_account_id: requireNonEmptyString(args.nearAccountId, "nearAccountId"),
+			operation_id: coerceNonEmptyString(args.operationId, "operationId"),
+			operation_fingerprint: coerceNonEmptyString(args.operationFingerprint, "operationFingerprint"),
+			near_account_id: coerceNonEmptyString(args.nearAccountId, "nearAccountId"),
 			near_network_id: args.nearNetworkId,
 			transactions: args.transactions.map((transaction, index) => ({
-				receiver_id: requireNonEmptyString(transaction.receiverId, `transactions[${index}].receiverId`),
-				action_fingerprint: requireNonEmptyString(transaction.actionFingerprint, `transactions[${index}].actionFingerprint`)
+				receiver_id: coerceNonEmptyString(transaction.receiverId, `transactions[${index}].receiverId`),
+				action_fingerprint: coerceNonEmptyString(transaction.actionFingerprint, `transactions[${index}].actionFingerprint`)
 			})),
 			unsigned_transaction_borsh_b64u: requireBase64UrlNonEmpty(args.unsignedTransactionBorshB64u, "unsignedTransactionBorshB64u")
 		},
@@ -135,7 +131,7 @@ async function buildRouterAbEd25519NearTransactionPrepareRequestV2(args) {
 }
 async function buildRouterAbEd25519Nep413PrepareRequestV2(args) {
 	const nonceB64u = normalizeNonceToB64u(args.nonce, "nonce");
-	const callbackUrl = args.callbackUrl == null ? void 0 : requireNonEmptyString(args.callbackUrl, "callbackUrl");
+	const callbackUrl = args.callbackUrl == null ? void 0 : coerceNonEmptyString(args.callbackUrl, "callbackUrl");
 	const canonicalMessageB64u = routerAbEd25519Nep413CanonicalMessageB64uV2({
 		message: args.message,
 		recipient: args.recipient,
@@ -148,12 +144,12 @@ async function buildRouterAbEd25519Nep413PrepareRequestV2(args) {
 		display_digest: routerAbDigest32Wire(base64UrlDecode(requireDigestB64u(args.displayDigestB64u, "displayDigestB64u"))),
 		intent: {
 			kind: "nep413_v1",
-			operation_id: requireNonEmptyString(args.operationId, "operationId"),
-			operation_fingerprint: requireNonEmptyString(args.operationFingerprint, "operationFingerprint"),
-			near_account_id: requireNonEmptyString(args.nearAccountId, "nearAccountId"),
+			operation_id: coerceNonEmptyString(args.operationId, "operationId"),
+			operation_fingerprint: coerceNonEmptyString(args.operationFingerprint, "operationFingerprint"),
+			near_account_id: coerceNonEmptyString(args.nearAccountId, "nearAccountId"),
 			near_network_id: args.nearNetworkId,
-			recipient: requireNonEmptyString(args.recipient, "recipient"),
-			message: requireNonEmptyString(args.message, "message"),
+			recipient: coerceNonEmptyString(args.recipient, "recipient"),
+			message: coerceNonEmptyString(args.message, "message"),
 			nonce_b64u: nonceB64u,
 			...callbackUrl ? { callback_url: callbackUrl } : {}
 		},
@@ -176,17 +172,17 @@ async function buildRouterAbEd25519DelegateActionPrepareRequestV2(args) {
 		display_digest: routerAbDigest32Wire(base64UrlDecode(requireDigestB64u(args.displayDigestB64u, "displayDigestB64u"))),
 		intent: {
 			kind: "near_delegate_action_v1",
-			operation_id: requireNonEmptyString(args.operationId, "operationId"),
-			operation_fingerprint: requireNonEmptyString(args.operationFingerprint, "operationFingerprint"),
-			near_account_id: requireNonEmptyString(args.nearAccountId, "nearAccountId"),
+			operation_id: coerceNonEmptyString(args.operationId, "operationId"),
+			operation_fingerprint: coerceNonEmptyString(args.operationFingerprint, "operationFingerprint"),
+			near_account_id: coerceNonEmptyString(args.nearAccountId, "nearAccountId"),
 			near_network_id: args.nearNetworkId,
 			delegate: {
-				sender_id: requireNonEmptyString(args.delegate.senderId, "delegate.senderId"),
-				receiver_id: requireNonEmptyString(args.delegate.receiverId, "delegate.receiverId"),
-				public_key: requireNonEmptyString(args.delegate.publicKey, "delegate.publicKey"),
-				nonce: requireNonEmptyString(args.delegate.nonce, "delegate.nonce"),
-				max_block_height: requireNonEmptyString(args.delegate.maxBlockHeight, "delegate.maxBlockHeight"),
-				action_fingerprint: requireNonEmptyString(args.delegate.actionFingerprint, "delegate.actionFingerprint"),
+				sender_id: coerceNonEmptyString(args.delegate.senderId, "delegate.senderId"),
+				receiver_id: coerceNonEmptyString(args.delegate.receiverId, "delegate.receiverId"),
+				public_key: coerceNonEmptyString(args.delegate.publicKey, "delegate.publicKey"),
+				nonce: coerceNonEmptyString(args.delegate.nonce, "delegate.nonce"),
+				max_block_height: coerceNonEmptyString(args.delegate.maxBlockHeight, "delegate.maxBlockHeight"),
+				action_fingerprint: coerceNonEmptyString(args.delegate.actionFingerprint, "delegate.actionFingerprint"),
 				canonical_delegate_borsh_b64u: canonicalDelegateBorshB64u
 			}
 		},
@@ -207,7 +203,7 @@ function buildRouterAbEd25519NormalSigningFinalizeRequestV2(args) {
 		scope,
 		expires_at_ms: requirePositiveInteger(args.expiresAtMs, "expiresAtMs"),
 		prepare_binding: {
-			server_round1_handle: requireNonEmptyString(args.prepareResponse.server_round1_handle, "server_round1_handle"),
+			server_round1_handle: coerceNonEmptyString(args.prepareResponse.server_round1_handle, "server_round1_handle"),
 			round1_binding_digest: parseDigest32(args.prepareResponse.round1_binding_digest, "round1_binding_digest"),
 			intent_digest: parseDigest32(args.admissionMaterial.intentDigest, "intent_digest"),
 			signing_payload_digest: parseDigest32(args.admissionMaterial.signingPayloadDigest, "signing_payload_digest")
@@ -216,9 +212,9 @@ function buildRouterAbEd25519NormalSigningFinalizeRequestV2(args) {
 			kind: "ed25519_two_party_frost_finalize_v1",
 			client_commitments: parseCommitments(args.clientCommitments, "clientCommitments"),
 			server_commitments: parseCommitments(args.prepareResponse.server_commitments, "serverCommitments"),
-			client_verifying_share_b64u: requireNonEmptyString(args.clientVerifyingShareB64u, "clientVerifyingShareB64u"),
-			server_verifying_share_b64u: requireNonEmptyString(args.prepareResponse.server_verifying_share_b64u, "serverVerifyingShareB64u"),
-			client_signature_share_b64u: requireNonEmptyString(args.clientSignatureShareB64u, "clientSignatureShareB64u")
+			client_verifying_share_b64u: coerceNonEmptyString(args.clientVerifyingShareB64u, "clientVerifyingShareB64u"),
+			server_verifying_share_b64u: coerceNonEmptyString(args.prepareResponse.server_verifying_share_b64u, "serverVerifyingShareB64u"),
+			client_signature_share_b64u: coerceNonEmptyString(args.clientSignatureShareB64u, "clientSignatureShareB64u")
 		}
 	};
 	if (scope.authorization.kind === "reusable_wallet_session" && args.prepareResponse.scope.authorization.kind === "reusable_wallet_session") return {
@@ -267,11 +263,11 @@ function parseScope(value, label) {
 		"signing_worker_id"
 	], label);
 	const scope = {
-		request_id: requireNonEmptyString(record.request_id, `${label}.request_id`),
-		account_id: requireNonEmptyString(record.account_id, `${label}.account_id`),
+		request_id: coerceNonEmptyString(record.request_id, `${label}.request_id`),
+		account_id: coerceNonEmptyString(record.account_id, `${label}.account_id`),
 		authorization: parseRouterAbNormalSigningAuthorization(record.authorization),
 		material_activation: parseRouterAbMpcMaterialActivationRef(record.material_activation),
-		signing_worker_id: requireNonEmptyString(record.signing_worker_id, `${label}.signing_worker_id`)
+		signing_worker_id: coerceNonEmptyString(record.signing_worker_id, `${label}.signing_worker_id`)
 	};
 	if (scope.material_activation.signing_worker !== scope.signing_worker_id) throw new Error(`${label} material activation SigningWorker mismatch`);
 	return scope;
@@ -292,17 +288,17 @@ function parseCommitments(value, label) {
 	const record = value && typeof value === "object" ? value : null;
 	if (!record) throw new Error(`${label} must be an object`);
 	return {
-		hiding: requireNonEmptyString(record.hiding, `${label}.hiding`),
-		binding: requireNonEmptyString(record.binding, `${label}.binding`)
+		hiding: coerceNonEmptyString(record.hiding, `${label}.hiding`),
+		binding: coerceNonEmptyString(record.binding, `${label}.binding`)
 	};
 }
 function parseServerIdentity(value, label) {
 	const record = value && typeof value === "object" ? value : null;
 	if (!record) throw new Error(`${label} must be an object`);
 	return {
-		server_id: requireNonEmptyString(record.server_id, `${label}.server_id`),
-		key_epoch: requireNonEmptyString(record.key_epoch, `${label}.key_epoch`),
-		recipient_encryption_key: requireNonEmptyString(record.recipient_encryption_key, `${label}.recipient_encryption_key`)
+		server_id: coerceNonEmptyString(record.server_id, `${label}.server_id`),
+		key_epoch: coerceNonEmptyString(record.key_epoch, `${label}.key_epoch`),
+		recipient_encryption_key: coerceNonEmptyString(record.recipient_encryption_key, `${label}.recipient_encryption_key`)
 	};
 }
 function parseReusableWalletSessionAuthorizedOperation(value, label) {
@@ -319,16 +315,16 @@ function parseReusableWalletSessionAuthorizedOperation(value, label) {
 		"display_digest_b64u",
 		"operation_fingerprint_digest"
 	], label);
-	const kind = requireNonEmptyString(record.kind, `${label}.kind`);
+	const kind = coerceNonEmptyString(record.kind, `${label}.kind`);
 	if (kind !== "reusable_wallet_session_authorized_operation_v1") throw new Error(`${label}.kind is invalid`);
-	const capabilityKind = requireNonEmptyString(record.capability_kind, `${label}.capability_kind`);
+	const capabilityKind = coerceNonEmptyString(record.capability_kind, `${label}.capability_kind`);
 	if (capabilityKind !== "near_ed25519_mpc_signing") throw new Error(`${label}.capability_kind is invalid`);
-	const operationKind = requireNonEmptyString(record.operation_kind, `${label}.operation_kind`);
+	const operationKind = coerceNonEmptyString(record.operation_kind, `${label}.operation_kind`);
 	if (operationKind !== "near.sign_transaction" && operationKind !== "near.sign_delegate_action" && operationKind !== "near.sign_nep413_message") throw new Error(`${label}.operation_kind is invalid`);
 	return {
 		kind,
-		authorized_operation_id: requireNonEmptyString(record.authorized_operation_id, `${label}.authorized_operation_id`),
-		operation_id: requireNonEmptyString(record.operation_id, `${label}.operation_id`),
+		authorized_operation_id: coerceNonEmptyString(record.authorized_operation_id, `${label}.authorized_operation_id`),
+		operation_id: coerceNonEmptyString(record.operation_id, `${label}.operation_id`),
 		capability_kind: capabilityKind,
 		operation_kind: operationKind,
 		lane_digest_b64u: requireDigestB64u(record.lane_digest_b64u, `${label}.lane_digest_b64u`),
@@ -353,16 +349,16 @@ function parseVerifiedStepUpAuthorizedOperation(value, label) {
 		"display_digest_b64u",
 		"operation_fingerprint_digest"
 	], label);
-	if (requireNonEmptyString(record.kind, `${label}.kind`) !== "verified_step_up_authorized_operation_v1") throw new Error(`${label}.kind is invalid`);
-	if (requireNonEmptyString(record.capability_kind, `${label}.capability_kind`) !== "near_ed25519_mpc_signing") throw new Error(`${label}.capability_kind is invalid`);
-	const operationKind = requireNonEmptyString(record.operation_kind, `${label}.operation_kind`);
+	if (coerceNonEmptyString(record.kind, `${label}.kind`) !== "verified_step_up_authorized_operation_v1") throw new Error(`${label}.kind is invalid`);
+	if (coerceNonEmptyString(record.capability_kind, `${label}.capability_kind`) !== "near_ed25519_mpc_signing") throw new Error(`${label}.capability_kind is invalid`);
+	const operationKind = coerceNonEmptyString(record.operation_kind, `${label}.operation_kind`);
 	if (operationKind !== "near.sign_transaction" && operationKind !== "near.sign_delegate_action" && operationKind !== "near.sign_nep413_message") throw new Error(`${label}.operation_kind is invalid`);
 	return {
 		kind: "verified_step_up_authorized_operation_v1",
-		authorization_session_id: requireNonEmptyString(record.authorization_session_id, `${label}.authorization_session_id`),
+		authorization_session_id: coerceNonEmptyString(record.authorization_session_id, `${label}.authorization_session_id`),
 		evidence_set_digest: requireDigestB64u(record.evidence_set_digest, `${label}.evidence_set_digest`),
-		authorized_operation_id: requireNonEmptyString(record.authorized_operation_id, `${label}.authorized_operation_id`),
-		operation_id: requireNonEmptyString(record.operation_id, `${label}.operation_id`),
+		authorized_operation_id: coerceNonEmptyString(record.authorized_operation_id, `${label}.authorized_operation_id`),
+		operation_id: coerceNonEmptyString(record.operation_id, `${label}.operation_id`),
 		capability_kind: "near_ed25519_mpc_signing",
 		operation_kind: operationKind,
 		lane_digest_b64u: requireDigestB64u(record.lane_digest_b64u, `${label}.lane_digest_b64u`),
@@ -374,7 +370,7 @@ function parseVerifiedStepUpAuthorizedOperation(value, label) {
 function parsePrepareResponse(value) {
 	const record = value && typeof value === "object" ? value : null;
 	if (!record) throw new Error("Router A/B normal-signing prepare response must be an object");
-	const signatureScheme = requireNonEmptyString(record.signature_scheme, "signature_scheme");
+	const signatureScheme = coerceNonEmptyString(record.signature_scheme, "signature_scheme");
 	if (signatureScheme !== "ed25519_v1") throw new Error(`Unsupported Router A/B normal-signing signature scheme: ${signatureScheme}`);
 	const scope = parseScope(record.scope, "scope");
 	const base = {
@@ -382,9 +378,9 @@ function parsePrepareResponse(value) {
 		signing_payload_digest: parseDigest32(record.signing_payload_digest, "signing_payload_digest"),
 		round1_binding_digest: parseDigest32(record.round1_binding_digest, "round1_binding_digest"),
 		signing_worker: parseServerIdentity(record.signing_worker, "signing_worker"),
-		server_round1_handle: requireNonEmptyString(record.server_round1_handle, "server_round1_handle"),
+		server_round1_handle: coerceNonEmptyString(record.server_round1_handle, "server_round1_handle"),
 		server_commitments: parseCommitments(record.server_commitments, "server_commitments"),
-		server_verifying_share_b64u: requireNonEmptyString(record.server_verifying_share_b64u, "server_verifying_share_b64u"),
+		server_verifying_share_b64u: coerceNonEmptyString(record.server_verifying_share_b64u, "server_verifying_share_b64u"),
 		signature_scheme: "ed25519_v1",
 		prepared_at_ms: requirePositiveInteger(record.prepared_at_ms, "prepared_at_ms"),
 		expires_at_ms: requirePositiveInteger(record.expires_at_ms, "expires_at_ms")
@@ -447,7 +443,7 @@ function parseNormalSigningResponse(value) {
 		"signature",
 		"signed_at_ms"
 	], "Router A/B normal-signing response");
-	const signatureScheme = requireNonEmptyString(record.signature_scheme, "signature_scheme");
+	const signatureScheme = coerceNonEmptyString(record.signature_scheme, "signature_scheme");
 	if (signatureScheme !== "ed25519_v1") throw new Error(`Unsupported Router A/B normal-signing signature scheme: ${signatureScheme}`);
 	return {
 		scope: parseScope(record.scope, "scope"),
@@ -636,7 +632,7 @@ function routerAbSigningHttpError(args) {
 }
 async function postRouterAbNormalSigningJson(args) {
 	if (typeof fetch !== "function") throw new Error("fetch is not available for Router A/B normal-signing request");
-	const base = normalizeRelayerBaseUrl(requireNonEmptyString(args.relayServerUrl, "relayServerUrl"));
+	const base = normalizeRelayerBaseUrl(coerceNonEmptyString(args.relayServerUrl, "relayServerUrl"));
 	const response = await fetch(`${base}${args.path}`, {
 		...buildRouterAbRequestInit({
 			credential: args.credential,
@@ -677,31 +673,6 @@ async function prepareRouterAbEcdsaDerivationEvmDigestSigningV1(args) {
 		parse: (value) => parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1(args.request, value)
 	});
 }
-async function parseFinalBatchPrepareResponse(request, value) {
-	if (!value || typeof value !== "object" || !("prepared_response" in value) || !("outgoing_messages_b64u" in value)) throw new Error("Invalid terminal prepare response");
-	const messages = value.outgoing_messages_b64u;
-	if (!Array.isArray(messages) || messages.length !== 1 || typeof messages[0] !== "string" || !/^[A-Za-z0-9_-]+$/.test(messages[0])) throw new Error("Terminal prepare response must contain one protocol message");
-	return {
-		preparedResponse: await parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1(request, value.prepared_response),
-		outgoingMessagesB64u: [messages[0]]
-	};
-}
-async function prepareRouterAbEcdsaFinalPresignBatchV1(args) {
-	await routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1(args.request);
-	const timeoutMs = Math.min(5e3, args.source.batch.ceremony_expires_at_ms - Date.now());
-	if (timeoutMs <= 0) throw new Error("Terminal presign ceremony expired before prepare");
-	return postRouterAbNormalSigningJson({
-		signal: AbortSignal.timeout(Math.floor(timeoutMs)),
-		relayServerUrl: args.relayServerUrl,
-		path: "/router-ab/ecdsa-derivation/sign/prepare",
-		credential: args.credential,
-		body: {
-			...args.request,
-			presign_source: args.source
-		},
-		parse: parseFinalBatchPrepareResponse.bind(void 0, args.request)
-	});
-}
 async function finalizeRouterAbNormalSigningV2(args) {
 	return postRouterAbNormalSigningJson({
 		relayServerUrl: args.relayServerUrl,
@@ -836,6 +807,6 @@ function sameBytes(left, right) {
 	return left.length === right.length && left.every((byte, index) => byte === right[index]);
 }
 //#endregion
-export { RouterAbSigningRequestError, buildRouterAbEd25519DelegateActionPrepareRequestV2, buildRouterAbEd25519NearTransactionPrepareRequestV2, buildRouterAbEd25519Nep413PrepareRequestV2, buildRouterAbEd25519NormalSigningFinalizeRequestV2, finalizeRouterAbEcdsaDerivationEvmDigestSigningV1, finalizeRouterAbNormalSigningV2, prepareRouterAbEcdsaDerivationEvmDigestSigningV1, prepareRouterAbEcdsaFinalPresignBatchV1, prepareRouterAbNormalSigningV2, routerAbCanonicalWireBytesToB64u, routerAbNormalSigningActionFingerprint };
+export { RouterAbSigningRequestError, buildRouterAbEd25519DelegateActionPrepareRequestV2, buildRouterAbEd25519NearTransactionPrepareRequestV2, buildRouterAbEd25519Nep413PrepareRequestV2, buildRouterAbEd25519NormalSigningFinalizeRequestV2, finalizeRouterAbEcdsaDerivationEvmDigestSigningV1, finalizeRouterAbNormalSigningV2, prepareRouterAbEcdsaDerivationEvmDigestSigningV1, prepareRouterAbNormalSigningV2, routerAbCanonicalWireBytesToB64u, routerAbNormalSigningActionFingerprint };
 
 //# sourceMappingURL=routerAbNormalSigning.js.map

package/dist/esm/core/rpcClients/relayer/thresholdEcdsa.js

@@ -1,7 +1,7 @@
 import { parseRootShareEpoch } from "../../../shared-ts/src/utils/domainIds.js";
-import { ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, requireRouterAbEcdsaDerivationNormalSigningStateV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { buildBearerAuthorizationHeader, buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
 import { toWalletId } from "../../signingEngine/interfaces/ecdsaChainTarget.js";
+import { ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, requireRouterAbEcdsaDerivationNormalSigningStateV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { toEcdsaDerivationThresholdKeyId } from "../../signingEngine/session/identity/emailOtpEcdsaDerivationIdentity.js";
 import { errorMessage } from "../../../shared-ts/src/utils/errors.js";
 //#region src/core/rpcClients/relayer/thresholdEcdsa.ts

package/dist/esm/core/rpcClients/relayer/walletRecoveryPrepare.js

@@ -1,20 +1,23 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { requireArray } from "../../../shared-ts/src/utils/validation.js";
+import { wireLiteral, wireObject, wireResult } from "../../../shared-ts/src/utils/wireSchema.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseUnixMs } from "../../../shared-ts/src/passkey-custody/primitives.js";
+import { buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
+import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../shared-ts/src/utils/signingSessionSeal.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { parseRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { requireEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
-import { ecdsaClientRootPublicKey33B64uFromString, parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion, parseSdkEcdsaDerivationThresholdKeyId } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseEcdsaServerGeneration } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
-import { parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
-import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../shared-ts/src/utils/signingSessionSeal.js";
+import { requireEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
+import { ecdsaClientRootPublicKey33B64uFromString, parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion, parseSdkEcdsaDerivationThresholdKeyId } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import "../../../shared-ts/src/signing-lanes/index.js";
 import { parseRecoveryCodeReservationId } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
+import { parseRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { parseWalletRecoveryEcdsaPossessionChallengeV1 } from "../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.js";
+import { thresholdEcdsaChainTargetKey } from "../../../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
 import { parseWalletRecoveryEnvelopeEntry } from "../../../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js";
 import "../../../shared-ts/src/wallet-recovery/index.js";
 import { parseWalletRecoveryTargetV1 } from "../../../shared-ts/src/wallet-recovery/walletRecoveryTarget.js";
@@ -124,7 +127,7 @@ async function parseWalletRecoveryPrepareResponse(args) {
 	const body = decodeJsonObjectOrNull(await response.json().catch(() => ({})));
 	if (response.status === 200 && body && readJsonField(body, "ok") === true) try {
 		const preparedResponse = decodeExactJsonObject(body, args.target.kind === "passkey" ? WALLET_RECOVERY_PREPARE_PASSKEY_RESPONSE_FIELDS : WALLET_RECOVERY_PREPARE_COMMON_RESPONSE_FIELDS, "walletRecoveryPrepare");
-		const wrap = parsePreparedRecoveryWrap(readJsonField(preparedResponse, "wrap"));
+		const wrap = preparedRecoveryWrap()(readJsonField(preparedResponse, "wrap"), "walletRecoveryPrepare.wrap");
 		const entries = parsePreparedRecoveryEntries(readJsonField(preparedResponse, "entries"));
 		const walletIdResult = parseWalletId(readJsonField(preparedResponse, "walletId"));
 		if (!walletIdResult.ok) throw new Error("walletRecoveryPrepare.walletId is invalid");
@@ -157,7 +160,7 @@ async function parseWalletRecoveryPrepareResponse(args) {
 		};
 		switch (target.kind) {
 			case "passkey": {
-				const registration = parseWalletRecoveryRegistrationOptions(readJsonField(preparedResponse, "registration"), String(walletId), target.rpId);
+				const registration = walletRecoveryRegistrationOptions(String(walletId), target.rpId)(readJsonField(preparedResponse, "registration"), "registration");
 				if (registration.walletAuthMethodId !== targetWalletAuthMethodId.value) throw new Error("wallet recovery registration changed the target auth method");
 				return {
 					...common,
@@ -181,115 +184,69 @@ async function parseWalletRecoveryPrepareResponse(args) {
 	if (response.status === 401 || response.status === 400) return { kind: "refused" };
 	return { kind: "transport_uncertain" };
 }
-function parseWalletRecoveryRegistrationOptions(raw, expectedWalletId, expectedRpId) {
-	const registration = decodeExactJsonObject(raw, [
-		"kind",
-		"challengeId",
-		"challengeB64u",
-		"replacementId",
-		"walletAuthMethodId",
-		"rpId",
-		"user",
-		"pubKeyCredParams",
-		"authenticatorSelection",
-		"timeoutMs",
-		"attestation",
-		"extensions",
-		"excludeCredentials"
-	], "walletRecoveryPrepare.registration");
-	if (readJsonField(registration, "kind") !== "webauthn_recovery_registration_v1") throw new Error("walletRecoveryPrepare.registration kind is invalid");
-	const challengeId = requireResponseString(readJsonField(registration, "challengeId"), "registration.challengeId");
-	const challengeB64u = requireCanonicalBytesB64u(readJsonField(registration, "challengeB64u"), 32, "registration.challengeB64u");
-	const replacementId = requireResponseString(readJsonField(registration, "replacementId"), "registration.replacementId");
-	const walletAuthMethodId = parseWalletAuthMethodId(readJsonField(registration, "walletAuthMethodId"));
-	if (!walletAuthMethodId.ok) throw new Error("walletRecoveryPrepare.registration.walletAuthMethodId is invalid");
-	const rpIdResult = parseWebAuthnRpId(readJsonField(registration, "rpId"));
-	if (!rpIdResult.ok) throw new Error("walletRecoveryPrepare.registration.rpId is invalid");
-	if (rpIdResult.value !== expectedRpId) throw new Error("walletRecoveryPrepare.registration changed the relying party");
-	const user = decodeExactJsonObject(readJsonField(registration, "user"), [
-		"idB64u",
-		"name",
-		"displayName"
-	], "walletRecoveryPrepare.registration.user");
+function walletRecoveryRegistrationOptions(expectedWalletId, expectedRpId) {
 	const expectedUserIdB64u = base64UrlEncode(new TextEncoder().encode(expectedWalletId));
-	const idB64u = requireCanonicalNonEmptyB64u(readJsonField(user, "idB64u"), "registration.user.idB64u");
-	if (idB64u !== expectedUserIdB64u) throw new Error("walletRecoveryPrepare.registration user is bound to another wallet");
-	const name = requireResponseString(readJsonField(user, "name"), "registration.user.name");
-	const displayName = requireResponseString(readJsonField(user, "displayName"), "registration.user.displayName");
-	if (name !== expectedWalletId || displayName !== expectedWalletId) throw new Error("walletRecoveryPrepare.registration user labels changed the wallet identity");
-	const pubKeyCredParams = parseRecoveryPublicKeyParameters(readJsonField(registration, "pubKeyCredParams"));
-	const authenticatorSelection = parseRecoveryAuthenticatorSelection(readJsonField(registration, "authenticatorSelection"));
-	const timeoutMs = Number(readJsonField(registration, "timeoutMs"));
-	if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new Error("walletRecoveryPrepare.registration.timeoutMs is invalid");
-	if (readJsonField(registration, "attestation") !== "none") throw new Error("walletRecoveryPrepare.registration.attestation is invalid");
-	const extensions = parseRecoveryPrfExtensions(readJsonField(registration, "extensions"));
-	const excludeCredentials = parseRecoveryExcludeCredentials(readJsonField(registration, "excludeCredentials"));
-	return {
-		kind: "webauthn_recovery_registration_v1",
-		challengeId,
-		challengeB64u,
-		replacementId,
-		walletAuthMethodId: walletAuthMethodId.value,
-		rpId: rpIdResult.value,
-		user: {
-			idB64u,
-			name,
-			displayName
+	const credentialDescriptor = wireObject({
+		type: wireLiteral("public-key"),
+		id: (raw, label) => {
+			const id = wireResult(parseWebAuthnCredentialIdB64u)(raw, label);
+			requireCanonicalNonEmptyB64u(id, label);
+			return id;
+		}
+	});
+	return wireObject({
+		kind: wireLiteral("webauthn_recovery_registration_v1"),
+		challengeId: requireResponseString,
+		challengeB64u: (raw, label) => requireCanonicalBytesB64u(raw, 32, label),
+		replacementId: requireResponseString,
+		walletAuthMethodId: wireResult(parseWalletAuthMethodId),
+		rpId: wireResult(parseWebAuthnRpId),
+		user: wireObject({
+			idB64u: requireCanonicalNonEmptyB64u,
+			name: requireResponseString,
+			displayName: requireResponseString
+		}, (user, label) => {
+			if (user.idB64u !== expectedUserIdB64u || user.name !== expectedWalletId || user.displayName !== expectedWalletId) throw new Error(`${label} is bound to another wallet`);
+		}),
+		pubKeyCredParams: (raw, label) => {
+			if (!Array.isArray(raw) || raw.length !== 2) throw new Error(`${label} is invalid`);
+			return [publicKeyCredentialParameter(-7)(raw[0], `${label}[0]`), publicKeyCredentialParameter(-257)(raw[1], `${label}[1]`)];
 		},
-		pubKeyCredParams,
-		authenticatorSelection,
-		timeoutMs,
-		attestation: "none",
-		extensions,
-		excludeCredentials
-	};
-}
-function parseRecoveryPrfExtensions(raw) {
-	const evaluation = decodeExactJsonObject(readJsonField(decodeExactJsonObject(readJsonField(decodeExactJsonObject(raw, ["prf"], "walletRecoveryPrepare.registration.extensions"), "prf"), ["eval"], "walletRecoveryPrepare.registration.extensions.prf"), "eval"), ["firstB64u", "secondB64u"], "walletRecoveryPrepare.registration.extensions.prf.eval");
-	const firstB64u = requireCanonicalBytesB64u(readJsonField(evaluation, "firstB64u"), PASSKEY_PRF_FIRST_SALT_V1.length, "registration.extensions.prf.eval.firstB64u");
-	const secondB64u = requireCanonicalBytesB64u(readJsonField(evaluation, "secondB64u"), PASSKEY_PRF_SECOND_SALT_V1.length, "registration.extensions.prf.eval.secondB64u");
-	if (firstB64u !== base64UrlEncode(PASSKEY_PRF_FIRST_SALT_V1) || secondB64u !== base64UrlEncode(PASSKEY_PRF_SECOND_SALT_V1)) throw new Error("walletRecoveryPrepare.registration PRF salts are unsupported");
-	return { prf: { eval: {
-		firstB64u,
-		secondB64u
-	} } };
+		authenticatorSelection: wireObject({
+			residentKey: wireLiteral("required"),
+			userVerification: wireLiteral("preferred")
+		}),
+		timeoutMs: (raw, label) => {
+			const timeoutMs = Number(raw);
+			if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new Error(`${label} is invalid`);
+			return timeoutMs;
+		},
+		attestation: wireLiteral("none"),
+		extensions: wireObject({ prf: wireObject({ eval: wireObject({
+			firstB64u: prfSalt(PASSKEY_PRF_FIRST_SALT_V1),
+			secondB64u: prfSalt(PASSKEY_PRF_SECOND_SALT_V1)
+		}) }) }),
+		excludeCredentials: (raw, label) => requireArray(raw, label).map((entry, index) => credentialDescriptor(entry, `${label}[${index}]`))
+	}, (registration, label) => {
+		if (registration.rpId !== expectedRpId) throw new Error(`${label} changed the relying party`);
+	});
 }
-function parseRecoveryPublicKeyParameters(raw) {
-	if (!Array.isArray(raw) || raw.length !== 2) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams is invalid");
-	const first = decodeExactJsonObject(raw[0], ["type", "alg"], "walletRecoveryPrepare.registration.pubKeyCredParams[0]");
-	const second = decodeExactJsonObject(raw[1], ["type", "alg"], "walletRecoveryPrepare.registration.pubKeyCredParams[1]");
-	if (readJsonField(first, "type") !== "public-key" || readJsonField(first, "alg") !== -7) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams[0] is invalid");
-	if (readJsonField(second, "type") !== "public-key" || readJsonField(second, "alg") !== -257) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams[1] is invalid");
-	return [{
-		type: "public-key",
-		alg: -7
-	}, {
-		type: "public-key",
-		alg: -257
-	}];
+function publicKeyCredentialParameter(alg) {
+	return wireObject({
+		type: wireLiteral("public-key"),
+		alg: (raw, label) => {
+			if (raw !== alg) throw new Error(`${label} is invalid`);
+			return alg;
+		}
+	});
 }
-function parseRecoveryAuthenticatorSelection(raw) {
-	const selection = decodeExactJsonObject(raw, ["residentKey", "userVerification"], "walletRecoveryPrepare.registration.authenticatorSelection");
-	if (readJsonField(selection, "residentKey") !== "required" || readJsonField(selection, "userVerification") !== "preferred") throw new Error("walletRecoveryPrepare.registration.authenticatorSelection is invalid");
-	return {
-		residentKey: "required",
-		userVerification: "preferred"
+function prfSalt(salt) {
+	return (raw, label) => {
+		const value = requireCanonicalBytesB64u(raw, salt.length, label);
+		if (value !== base64UrlEncode(salt)) throw new Error(`${label} is unsupported`);
+		return value;
 	};
 }
-function parseRecoveryExcludeCredentials(raw) {
-	if (!Array.isArray(raw)) throw new Error("walletRecoveryPrepare.registration.excludeCredentials is invalid");
-	return raw.map((entry, index) => {
-		const descriptor = decodeExactJsonObject(entry, ["type", "id"], `walletRecoveryPrepare.registration.excludeCredentials[${index}]`);
-		if (readJsonField(descriptor, "type") !== "public-key") throw new Error("walletRecoveryPrepare.registration.excludeCredentials type is invalid");
-		const parsedId = parseWebAuthnCredentialIdB64u(readJsonField(descriptor, "id"));
-		if (!parsedId.ok) throw new Error("walletRecoveryPrepare.registration.excludeCredentials id is invalid");
-		requireCanonicalNonEmptyB64u(parsedId.value, "registration.excludeCredentials.id");
-		return {
-			type: "public-key",
-			id: parsedId.value
-		};
-	});
-}
 function recoveryTargetsMatch(left, right) {
 	if (left.kind !== right.kind) return false;
 	switch (left.kind) {
@@ -301,18 +258,12 @@ function recoveryTargetsMatch(left, right) {
 function assertNeverRecoveryTarget(value) {
 	throw new Error(`unsupported wallet recovery target: ${String(value)}`);
 }
-const PREPARED_WRAP_FIELDS = [
-	"nonceB64u",
-	"wrappedManifestKekB64u",
-	"aadHashB64u"
-];
-function parsePreparedRecoveryWrap(raw) {
-	const wrap = decodeExactJsonObject(raw, PREPARED_WRAP_FIELDS, "walletRecoveryPrepare.wrap");
-	return {
-		nonceB64u: parseEnvelopeNonceB64u(readJsonField(wrap, "nonceB64u"), "walletRecoveryPrepare.wrap.nonceB64u"),
-		wrappedManifestKekB64u: parseEnvelopeCiphertextB64u(readJsonField(wrap, "wrappedManifestKekB64u"), "walletRecoveryPrepare.wrap.wrappedManifestKekB64u"),
-		aadHashB64u: parseDigestField(readJsonField(wrap, "aadHashB64u"), "walletRecoveryPrepare.wrap.aadHashB64u")
-	};
+function preparedRecoveryWrap() {
+	return wireObject({
+		nonceB64u: parseEnvelopeNonceB64u,
+		wrappedManifestKekB64u: parseEnvelopeCiphertextB64u,
+		aadHashB64u: parseDigestField
+	});
 }
 function parsePreparedRecoveryEntries(raw) {
 	if (!Array.isArray(raw) || raw.length !== 1) throw new Error("walletRecoveryPrepare.entries must contain exactly one custody seed");
@@ -474,7 +425,7 @@ function parseWalletRecoveryPreparationEcdsaRecoveryBasis(raw, expectedWalletId)
 function parseWalletRecoveryEcdsaChainTargets(raw) {
 	if (!Array.isArray(raw) || raw.length === 0) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are invalid");
 	const targets = raw.map((value, index) => parseWalletRecoveryEcdsaChainTarget(value, index));
-	if (new Set(targets.map(walletRecoveryEcdsaChainTargetKey)).size !== targets.length) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are duplicated");
+	if (new Set(targets.map(thresholdEcdsaChainTargetKey)).size !== targets.length) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are duplicated");
 	const first = targets[0];
 	if (!first) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are invalid");
 	return [first, ...targets.slice(1)];
@@ -514,9 +465,6 @@ function parseWalletRecoveryEcdsaChainTarget(raw, index) {
 	};
 	throw new Error("walletRecoveryPrepare ECDSA recovery chain family is invalid");
 }
-function walletRecoveryEcdsaChainTargetKey(target) {
-	return target.kind === "evm" ? `evm:eip155:${target.chainId}` : `tempo:${target.chainId}`;
-}
 function parseWalletRecoveryEcdsaParticipantIds(raw) {
 	if (!Array.isArray(raw) || raw.length !== 2 || raw[0] !== 1 || raw[1] !== 2) throw new Error("walletRecoveryPrepare ECDSA recovery participant IDs are invalid");
 	return [1, 2];

package/dist/esm/core/rpcClients/relayer/walletRecoveryRotate.js

@@ -1,5 +1,4 @@
 import { buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
-import "../../../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js";
 //#region src/core/rpcClients/relayer/walletRecoveryRotate.ts
 const WALLET_RECOVERY_ROTATE_PATH = "/wallets/recovery/rotate";
 const WALLET_RECOVERY_ACK_PATH = "/wallets/recovery/acknowledge-backup";