@seams/wallet 0.6.2 → 0.7.3

package/dist/workers/wallet-custody-ceremony.worker.js

@@ -983,6 +983,25 @@ function passkey_custody_seal_ed25519_yao_client_root_under_factor_v1(handle, fa
   }
   return takeFromExternrefTable02(ret[0]);
 }
+function passkey_custody_open_ed25519_yao_client_root_envelope_v1(factor_secret, envelope_binding_json, nonce12, sealed_custody_secret_b64u, aad_hash_b64u, ciphertext_digest_b64u) {
+  const ptr0 = passArray8ToWasm02(factor_secret, wasm2.__wbindgen_malloc);
+  const len0 = WASM_VECTOR_LEN2;
+  const ptr1 = passStringToWasm02(envelope_binding_json, wasm2.__wbindgen_malloc, wasm2.__wbindgen_realloc);
+  const len1 = WASM_VECTOR_LEN2;
+  const ptr2 = passArray8ToWasm02(nonce12, wasm2.__wbindgen_malloc);
+  const len2 = WASM_VECTOR_LEN2;
+  const ptr3 = passStringToWasm02(sealed_custody_secret_b64u, wasm2.__wbindgen_malloc, wasm2.__wbindgen_realloc);
+  const len3 = WASM_VECTOR_LEN2;
+  const ptr4 = passStringToWasm02(aad_hash_b64u, wasm2.__wbindgen_malloc, wasm2.__wbindgen_realloc);
+  const len4 = WASM_VECTOR_LEN2;
+  const ptr5 = passStringToWasm02(ciphertext_digest_b64u, wasm2.__wbindgen_malloc, wasm2.__wbindgen_realloc);
+  const len5 = WASM_VECTOR_LEN2;
+  const ret = wasm2.passkey_custody_open_ed25519_yao_client_root_envelope_v1(ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5);
+  if (ret[2]) {
+    throw takeFromExternrefTable02(ret[1]);
+  }
+  return WasmPasskeyCustodyHandleV1.__wrap(ret[0]);
+}
 function passkey_custody_open_wallet_seed_v1(factor_secret, envelope_binding_json, nonce12, sealed_custody_secret_b64u, aad_hash_b64u, ciphertext_digest_b64u) {
   const ptr0 = passArray8ToWasm02(factor_secret, wasm2.__wbindgen_malloc);
   const len0 = WASM_VECTOR_LEN2;
@@ -1058,7 +1077,7 @@ function getArrayU8FromWasm0(ptr, len) {
 function __wbg_adapter_52(arg0, arg1, arg2) {
   wasm2.closure67_externref_shim(arg0, arg1, arg2);
 }
-function __wbg_adapter_387(arg0, arg1, arg2, arg3) {
+function __wbg_adapter_388(arg0, arg1, arg2, arg3) {
   wasm2.closure60_externref_shim(arg0, arg1, arg2, arg3);
 }
 var ConfirmationBehavior = Object.freeze({
@@ -1669,7 +1688,7 @@ function __wbg_get_imports2() {
         const a = state0.a;
         state0.a = 0;
         try {
-          return __wbg_adapter_387(a, state0.b, arg0, arg1);
+          return __wbg_adapter_388(a, state0.b, arg0, arg1);
         } finally {
           state0.a = a;
         }
@@ -1870,7 +1889,7 @@ function __wbg_get_imports2() {
     const ret = false;
     return ret;
   };
-  imports.wbg.__wbindgen_closure_wrapper2623 = function(arg0, arg1, arg2) {
+  imports.wbg.__wbindgen_closure_wrapper2627 = function(arg0, arg1, arg2) {
     const ret = makeMutClosure(arg0, arg1, 68, __wbg_adapter_52);
     return ret;
   };
@@ -3736,6 +3755,13 @@ function base64UrlDecode(base64Url) {
   return base64Decode(normalized + padding);
 }
 
+// ../shared-ts/src/utils/digests.ts
+async function sha256Bytes(input) {
+  const data = input.slice();
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return new Uint8Array(digest);
+}
+
 // ../shared-ts/src/utils/canonicalPrimitives.ts
 function parseDigestB64u(value) {
   if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) {
@@ -3770,6 +3796,11 @@ function requireCanonicalBase64Url(value, label) {
   }
   return decoded;
 }
+function requireParsed(result, label) {
+  if (result.ok)
+    return result.value;
+  throw new Error(`${label} ${result.error.message}`);
+}
 function parseDigestField(value, label) {
   try {
     return parseDigestB64u(value);
@@ -3822,41 +3853,6 @@ function parseUnixMs(value, label) {
   }
   return value;
 }
-function requireRecord(value, label) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new Error(`${label} must be an object`);
-  }
-  return value;
-}
-var SECRET_BEARING_FIELD_SUBSTRINGS = [
-  "prf",
-  "kek",
-  "seed",
-  "scalar",
-  "secretkey",
-  "privatekey",
-  "plaintext",
-  "recoverycode",
-  "clientroot",
-  "holdershare"
-];
-function rejectUnknownFields(record, allowed, label, knownOnOtherBranches = []) {
-  const allowedSet = new Set(allowed);
-  const knownSet = new Set(knownOnOtherBranches);
-  for (const field of Object.keys(record)) {
-    if (allowedSet.has(field))
-      continue;
-    if (knownSet.has(field)) {
-      throw new Error(`${label}.${field} is not part of ${label}`);
-    }
-    const normalized = field.toLowerCase().replace(/_/g, "");
-    const namesAPublicKey = normalized.includes("publickey");
-    if (!namesAPublicKey && SECRET_BEARING_FIELD_SUBSTRINGS.some((substring) => normalized.includes(substring))) {
-      throw new Error(`${label}.${field} must never carry plaintext custody material`);
-    }
-    throw new Error(`${label}.${field} is not part of ${label}`);
-  }
-}
 // ../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.ts
 function isEvmFamilySigningKeySlotIdShape(value) {
   const parts = value.split(":");
@@ -3885,14 +3881,7 @@ function requireEvmFamilySigningKeySlotId(value, label = "evmFamilySigningKeySlo
     throw new Error(`${label} is required`);
   throw new Error(`${label} must be an EVM-family signing key slot id`);
 }
-
-// ../shared-ts/src/utils/digests.ts
-async function sha256Bytes(input) {
-  const data = input.slice();
-  const digest = await crypto.subtle.digest("SHA-256", data);
-  return new Uint8Array(digest);
-}
-// ../shared-ts/src/utils/registrationIntent.ts
+// ../shared-ts/src/utils/registrationIds.ts
 var SERVER_ALLOCATED_WALLET_ADJECTIVES = [
   "alpine",
   "amber",
@@ -4040,6 +4029,49 @@ function parseNearEd25519SigningKeyId(value) {
   }
   return nearEd25519SigningKeyIdFromString(value);
 }
+// ../shared-ts/src/utils/validation.ts
+function isObject(x) {
+  return x !== null && typeof x === "object";
+}
+function isPlainObject(x) {
+  return isObject(x) && !Array.isArray(x);
+}
+function requireRecord(value, label) {
+  if (!isPlainObject(value))
+    throw new Error(`${label} must be an object`);
+  return value;
+}
+
+// ../shared-ts/src/utils/exactRecord.ts
+var SECRET_BEARING_FIELD_SUBSTRINGS = [
+  "prf",
+  "kek",
+  "seed",
+  "scalar",
+  "secretkey",
+  "privatekey",
+  "plaintext",
+  "recoverycode",
+  "clientroot",
+  "holdershare"
+];
+function rejectUnknownFields(record, allowed, label, knownOnOtherBranches = []) {
+  const allowedSet = new Set(allowed);
+  const knownSet = new Set(knownOnOtherBranches);
+  for (const field of Object.keys(record)) {
+    if (allowedSet.has(field))
+      continue;
+    if (knownSet.has(field)) {
+      throw new Error(`${label}.${field} is not part of ${label}`);
+    }
+    const normalized = field.toLowerCase().replace(/_/g, "");
+    const namesAPublicKey = normalized.includes("publickey");
+    if (!namesAPublicKey && SECRET_BEARING_FIELD_SUBSTRINGS.some((substring) => normalized.includes(substring))) {
+      throw new Error(`${label}.${field} must never carry plaintext custody material`);
+    }
+    throw new Error(`${label}.${field} is not part of ${label}`);
+  }
+}
 
 // ../shared-ts/src/passkey-custody/custodySecretBinding.ts
 var WALLET_SEED_DERIVATION_SCHEME_V1 = "wallet_seed_parallel_hkdf_sha256_v1";
@@ -4649,40 +4681,12 @@ function parseWalletCustodyEvmFamilyCommitPayload(value) {
     clientRootPublicKey33B64u
   };
 }
-// ../shared-ts/src/authorization/capabilityKinds.ts
-var CAPABILITY_KINDS = {
-  vaultAccess: "vault_access",
-  nearEd25519MpcSigning: "near_ed25519_mpc_signing",
-  evmEcdsaMpcSigning: "evm_ecdsa_mpc_signing"
-};
-var VAULT_OPERATION_KINDS = {
-  proxyUse: "vault.proxy_use",
-  reveal: "vault.reveal"
-};
-var NEAR_ED25519_MPC_OPERATION_KINDS = {
-  signTransaction: "near.sign_transaction",
-  signDelegateAction: "near.sign_delegate_action",
-  signNep413Message: "near.sign_nep413_message",
-  exportKey: "near.export_key"
-};
-var EVM_ECDSA_MPC_OPERATION_KINDS = {
-  signTransaction: "evm.sign_transaction",
-  exportKey: "evm.export_key"
-};
-var AUTHORIZATION_EVIDENCE_KINDS = {
-  seamsSession: "seams_session",
-  passkeyAssertion: "passkey_assertion",
-  emailOtp: "email_otp"
-};
-var CAPABILITY_KIND_VALUES = Object.values(CAPABILITY_KINDS);
-var VAULT_OPERATION_KIND_VALUES = Object.values(VAULT_OPERATION_KINDS);
-var NEAR_ED25519_MPC_OPERATION_KIND_VALUES = Object.values(NEAR_ED25519_MPC_OPERATION_KINDS);
-var EVM_ECDSA_MPC_OPERATION_KIND_VALUES = Object.values(EVM_ECDSA_MPC_OPERATION_KINDS);
-var AUTHORIZATION_EVIDENCE_KIND_VALUES = Object.values(AUTHORIZATION_EVIDENCE_KINDS);
-
-// ../shared-ts/src/signing-lanes/participantDigest.ts
+// ../shared-ts/src/utils/digestEncoding.ts
+var TEXT_ENCODER = new TextEncoder;
 function concat(parts) {
-  const length = parts.reduce((total, part) => total + part.length, 0);
+  let length = 0;
+  for (const part of parts)
+    length += part.length;
   const output = new Uint8Array(length);
   let offset = 0;
   for (const part of parts) {
@@ -4691,7 +4695,45 @@ function concat(parts) {
   }
   return output;
 }
-function u32(value) {
+function u32(value, label) {
+  if (!Number.isSafeInteger(value) || value < 0 || value > 4294967295) {
+    throw new Error(`${label} must be a non-negative u32`);
+  }
+  return Uint8Array.from([
+    value >>> 24 & 255,
+    value >>> 16 & 255,
+    value >>> 8 & 255,
+    value & 255
+  ]);
+}
+function u64(value, label) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new Error(`${label} must be a non-negative safe integer`);
+  }
+  let remaining = BigInt(value);
+  const output = new Uint8Array(8);
+  for (let index = 7;index >= 0; index -= 1) {
+    output[index] = Number(remaining & 0xffn);
+    remaining >>= 8n;
+  }
+  return output;
+}
+function lp32(value, label) {
+  return concat([u32(value.length, `${label}.length`), value]);
+}
+function text(value, label) {
+  if (typeof value !== "string")
+    throw new Error(`${label} must be a string`);
+  return lp32(TEXT_ENCODER.encode(value), label);
+}
+
+// ../shared-ts/src/signing-lanes/rotation.ts
+function isProvisionedLaneProtocolSourceV1(source) {
+  return source.sourceKind === "provisioned_lane";
+}
+
+// ../shared-ts/src/signing-lanes/participantDigest.ts
+function u322(value) {
   if (!Number.isInteger(value) || value < 0 || value > 4294967295) {
     throw new Error("canonical u32 must be an integer between 0 and 4294967295");
   }
@@ -4706,11 +4748,11 @@ function encodeLaneCanonicalTextV1(value) {
   if (typeof value !== "string")
     throw new Error("canonical text must be a string");
   const bytes = new TextEncoder().encode(value);
-  return concat([u32(bytes.length), bytes]);
+  return concat([u322(bytes.length), bytes]);
 }
 function encodeLaneCanonicalDigestV1(value) {
   const parsed = parseDigestB64u(value);
-  return concat([u32(32), base64UrlDecode(parsed)]);
+  return concat([u322(32), base64UrlDecode(parsed)]);
 }
 function encodeLaneCanonicalU64V1(value) {
   if (!Number.isSafeInteger(value) || value < 0) {
@@ -4734,11 +4776,6 @@ var OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
   "custodyKeyManifestDigestB64u",
   "sourceIdentityDigestB64u"
 ];
-function requireResult(result, label) {
-  if (result.ok)
-    return result.value;
-  throw new Error(`${label} ${result.error.message}`);
-}
 function parseWalletSignerId(raw, label = "walletSignerId") {
   if (typeof raw !== "string")
     throw new Error(`${label} must be a string`);
@@ -4772,7 +4809,7 @@ function buildOwnerLaneParticipantContinuityV1(args) {
     kind: "owner_lane_participant_continuity_v1",
     signerId: parseWalletSignerId(args.signerId),
     participantIds,
-    signingWorkerId: requireResult(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
+    signingWorkerId: requireParsed(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
     custodyKeyManifestDigestB64u: parseDigestField(args.custodyKeyManifestDigestB64u, "custodyKeyManifestDigestB64u"),
     sourceIdentityDigestB64u: parseDigestField(args.sourceIdentityDigestB64u, "sourceIdentityDigestB64u")
   };
@@ -4786,24 +4823,14 @@ function parseOwnerLaneParticipantContinuityV1(raw, label = "ownerParticipantCon
   return buildOwnerLaneParticipantContinuityV1({
     signerId: parseWalletSignerId(record.signerId, `${label}.signerId`),
     participantIds: parseParticipantIds(record.participantIds, `${label}.participantIds`),
-    signingWorkerId: requireResult(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
+    signingWorkerId: requireParsed(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
     custodyKeyManifestDigestB64u: parseDigestField(record.custodyKeyManifestDigestB64u, `${label}.custodyKeyManifestDigestB64u`),
     sourceIdentityDigestB64u: parseDigestField(record.sourceIdentityDigestB64u, `${label}.sourceIdentityDigestB64u`)
   });
 }
-function concat2(parts) {
-  const length = parts.reduce((total, part) => total + part.length, 0);
-  const output = new Uint8Array(length);
-  let offset = 0;
-  for (const part of parts) {
-    output.set(part, offset);
-    offset += part.length;
-  }
-  return output;
-}
 function ownerLaneParticipantContinuityCanonicalBytesV1(input) {
   const record = parseOwnerLaneParticipantContinuityV1(input);
-  return concat2([
+  return concat([
     encodeLaneCanonicalTextV1(OWNER_LANE_PARTICIPANT_BINDING_DOMAIN_V1),
     encodeLaneCanonicalTextV1(record.signerId),
     encodeLaneCanonicalU64V1(record.participantIds[0]),
@@ -4814,56 +4841,10 @@ function ownerLaneParticipantContinuityCanonicalBytesV1(input) {
   ]);
 }
 
-// ../shared-ts/src/signing-lanes/rotation.ts
-function isProvisionedLaneProtocolSourceV1(source) {
-  return source.sourceKind === "provisioned_lane";
-}
-
 // ../shared-ts/src/signing-lanes/rotationDigests.ts
 var ED25519_JOB_TRANSCRIPT_DOMAIN = "seams/rotatable-signing-lanes/ed25519-job/v1";
 var ED25519_SESSION_DOMAIN = "seams/rotatable-signing-lanes/ed25519-session/v1";
-var TEXT_ENCODER = new TextEncoder;
-function bytes(value) {
-  return Uint8Array.from(value);
-}
-function concat3(parts) {
-  let length = 0;
-  for (const part of parts)
-    length += part.length;
-  const output = new Uint8Array(length);
-  let offset = 0;
-  for (const part of parts) {
-    output.set(part, offset);
-    offset += part.length;
-  }
-  return output;
-}
-function u322(value, label) {
-  if (!Number.isSafeInteger(value) || value < 0 || value > 4294967295) {
-    throw new Error(`${label} must be a non-negative u32`);
-  }
-  return bytes([value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255]);
-}
-function u64(value, label) {
-  if (!Number.isSafeInteger(value) || value < 0) {
-    throw new Error(`${label} must be a non-negative safe integer`);
-  }
-  let remaining = BigInt(value);
-  const output = new Uint8Array(8);
-  for (let index = 7;index >= 0; index -= 1) {
-    output[index] = Number(remaining & 0xffn);
-    remaining >>= 8n;
-  }
-  return output;
-}
-function lp32(value, label) {
-  return concat3([u322(value.length, `${label}.length`), value]);
-}
-function text(value, label) {
-  if (typeof value !== "string")
-    throw new Error(`${label} must be a string`);
-  return lp32(TEXT_ENCODER.encode(value), label);
-}
+var TEXT_ENCODER2 = new TextEncoder;
 function digest(value, label) {
   try {
     return lp32(base64UrlDecode(parseDigestB64u(value)), label);
@@ -4875,7 +4856,7 @@ function recordDomain(domain) {
   return text(domain, "domain");
 }
 function activation(value) {
-  return concat3([
+  return concat([
     text(value.kind, "materialActivation.kind"),
     text(value.activationId, "materialActivation.activationId"),
     text(value.capability, "materialActivation.capability"),
@@ -4897,7 +4878,7 @@ function encodeSource(value) {
     text(value.sourceKind, "source.sourceKind")
   ];
   if (value.ownerParticipantContinuity !== undefined) {
-    return concat3([
+    return concat([
       ...common,
       ownerLaneParticipantContinuityCanonicalBytesV1(value.ownerParticipantContinuity),
       digest(value.participantBindingDigestB64u, "source.participantBindingDigestB64u"),
@@ -4907,7 +4888,7 @@ function encodeSource(value) {
   if (!isProvisionedLaneProtocolSourceV1(value)) {
     throw new Error("provisioned lane source participant identities are required");
   }
-  return concat3([
+  return concat([
     ...common,
     text(value.holderParticipantId, "source.holderParticipantId"),
     text(value.signingWorkerParticipantId, "source.signingWorkerParticipantId"),
@@ -4917,27 +4898,27 @@ function encodeSource(value) {
   ]);
 }
 function encodeEd25519YaoLaneJobTranscriptV1(value) {
-  const target = value.target.operation === "create_lane" ? concat3([
+  const target = value.target.operation === "create_lane" ? concat([
     text(value.target.operation, "target.operation"),
     text(value.target.laneKind, "target.laneKind"),
     text(value.target.expectedTargetState, "target.expectedTargetState")
-  ]) : concat3([
+  ]) : concat([
     text(value.target.operation, "target.operation"),
     text(value.target.laneKind, "target.laneKind"),
     text(value.target.expectedTargetState, "target.expectedTargetState"),
     activation(value.target.priorMaterialActivation)
   ]);
-  const authorization = value.authorization.kind === "linked_device_enrollment" ? concat3([
+  const authorization = value.authorization.kind === "linked_device_enrollment" ? concat([
     text(value.authorization.kind, "authorization.kind"),
     text(value.authorization.authorizedOperationId, "authorization.authorizedOperationId"),
     text(value.authorization.linkedDeviceEnrollmentId, "authorization.linkedDeviceEnrollmentId"),
     text(value.authorization.linkedDevicePermissionDigestB64u, "authorization.linkedDevicePermissionDigestB64u")
-  ]) : concat3([
+  ]) : concat([
     text(value.authorization.kind, "authorization.kind"),
     text(value.authorization.authorizedOperationId, "authorization.authorizedOperationId"),
     text(value.authorization.ownerLaneRefreshDigestB64u, "authorization.ownerLaneRefreshDigestB64u")
   ]);
-  return concat3([
+  return concat([
     recordDomain(ED25519_JOB_TRANSCRIPT_DOMAIN),
     text(value.kind, "kind"),
     text(value.yaoRequestKind, "yaoRequestKind"),
@@ -4975,73 +4956,10 @@ function encodeEd25519YaoLaneJobTranscriptV1(value) {
 }
 async function computeEd25519YaoLaneSessionDigestV1(value) {
   const jobDigest = await sha256Bytes(encodeEd25519YaoLaneJobTranscriptV1(value));
-  return base64UrlEncode(await sha256Bytes(concat3([TEXT_ENCODER.encode(ED25519_SESSION_DOMAIN), jobDigest])));
+  return base64UrlEncode(await sha256Bytes(concat([TEXT_ENCODER2.encode(ED25519_SESSION_DOMAIN), jobDigest])));
 }
 
-// ../shared-ts/src/utils/routerAbNormalSigningIdentity.ts
-function requireRecord2(value, label) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${label} must be an object`);
-  }
-  return value;
-}
-function requireExactFields(record, expectedFields, label) {
-  const actualFields = Object.keys(record).sort();
-  const expected = [...expectedFields].sort();
-  if (actualFields.length !== expected.length || actualFields.some((field, index) => field !== expected[index])) {
-    throw new Error(`${label} has invalid fields`);
-  }
-}
-function requireAsciiString(value, label) {
-  if (typeof value !== "string" || value.trim() !== value || !value) {
-    throw new Error(`${label} is required`);
-  }
-  if (!/^[\x20-\x7e]+$/.test(value)) {
-    throw new Error(`${label} must be printable ASCII`);
-  }
-  return value;
-}
-function parseRouterAbMpcMaterialActivationRef(value) {
-  const activation = requireRecord2(value, "material_activation");
-  requireExactFields(activation, [
-    "kind",
-    "activation_id",
-    "capability",
-    "material_owner",
-    "key_binding",
-    "lifecycle_binding",
-    "signing_worker"
-  ], "material_activation");
-  if (activation.kind !== "mpc_material_activation_ref") {
-    throw new Error("material_activation.kind is not supported");
-  }
-  return {
-    kind: "mpc_material_activation_ref",
-    activation_id: requireAsciiString(activation.activation_id, "material_activation.activation_id"),
-    capability: requireAsciiString(activation.capability, "material_activation.capability"),
-    material_owner: requireAsciiString(activation.material_owner, "material_activation.material_owner"),
-    key_binding: requireAsciiString(activation.key_binding, "material_activation.key_binding"),
-    lifecycle_binding: requireAsciiString(activation.lifecycle_binding, "material_activation.lifecycle_binding"),
-    signing_worker: requireAsciiString(activation.signing_worker, "material_activation.signing_worker")
-  };
-}
-function routerAbMpcMaterialActivationRefToWire(input) {
-  return parseRouterAbMpcMaterialActivationRef({
-    kind: input.kind,
-    activation_id: input.activationId,
-    capability: input.capability,
-    material_owner: input.materialOwner,
-    key_binding: input.keyBinding,
-    lifecycle_binding: input.lifecycleBinding,
-    signing_worker: input.signingWorker
-  });
-}
-function sameRouterAbMpcMaterialActivationRef(left, right) {
-  return left.kind === right.kind && left.activation_id === right.activation_id && left.capability === right.capability && left.material_owner === right.material_owner && left.key_binding === right.key_binding && left.lifecycle_binding === right.lifecycle_binding && left.signing_worker === right.signing_worker;
-}
-
-// ../shared-ts/src/utils/routerAbEd25519Yao.ts
-var ED25519_YAO_CONTROL_CIPHERTEXT_MAX_BYTES_V1 = 64 * 1024;
+// ../shared-ts/src/utils/routerAbEd25519YaoDigests.ts
 var APPLICATION_BINDING_DOMAIN = "seams/router-ab/ed25519-yao/application-binding/v1";
 var STABLE_KEY_CONTEXT_DOMAIN = "seams/router-ab/ed25519-yao/stable-key-context/v1";
 var STABLE_KEY_CONTEXT_BINDING_DOMAIN = "seams/router-ab/ed25519-yao/stable-key-context-binding/v1";
@@ -5099,6 +5017,62 @@ async function deriveRouterAbEd25519YaoStableContextBindingV1(applicationBinding
   return Array.from(await sha256(concatenateBytes([UTF8.encode(STABLE_KEY_CONTEXT_BINDING_DOMAIN), context])));
 }
 
+// ../shared-ts/src/utils/routerAbNormalSigningIdentity.ts
+function requireExactFields(record, expectedFields, label) {
+  const actualFields = Object.keys(record).sort();
+  const expected = [...expectedFields].sort();
+  if (actualFields.length !== expected.length || actualFields.some((field, index) => field !== expected[index])) {
+    throw new Error(`${label} has invalid fields`);
+  }
+}
+function requireAsciiString(value, label) {
+  if (typeof value !== "string" || value.trim() !== value || !value) {
+    throw new Error(`${label} is required`);
+  }
+  if (!/^[\x20-\x7e]+$/.test(value)) {
+    throw new Error(`${label} must be printable ASCII`);
+  }
+  return value;
+}
+function parseRouterAbMpcMaterialActivationRef(value) {
+  const activation = requireRecord(value, "material_activation");
+  requireExactFields(activation, [
+    "kind",
+    "activation_id",
+    "capability",
+    "material_owner",
+    "key_binding",
+    "lifecycle_binding",
+    "signing_worker"
+  ], "material_activation");
+  if (activation.kind !== "mpc_material_activation_ref") {
+    throw new Error("material_activation.kind is not supported");
+  }
+  return {
+    kind: "mpc_material_activation_ref",
+    activation_id: requireAsciiString(activation.activation_id, "material_activation.activation_id"),
+    capability: requireAsciiString(activation.capability, "material_activation.capability"),
+    material_owner: requireAsciiString(activation.material_owner, "material_activation.material_owner"),
+    key_binding: requireAsciiString(activation.key_binding, "material_activation.key_binding"),
+    lifecycle_binding: requireAsciiString(activation.lifecycle_binding, "material_activation.lifecycle_binding"),
+    signing_worker: requireAsciiString(activation.signing_worker, "material_activation.signing_worker")
+  };
+}
+function routerAbMpcMaterialActivationRefToWire(input) {
+  return parseRouterAbMpcMaterialActivationRef({
+    kind: input.kind,
+    activation_id: input.activationId,
+    capability: input.capability,
+    material_owner: input.materialOwner,
+    key_binding: input.keyBinding,
+    lifecycle_binding: input.lifecycleBinding,
+    signing_worker: input.signingWorker
+  });
+}
+function sameRouterAbMpcMaterialActivationRef(left, right) {
+  return left.kind === right.kind && left.activation_id === right.activation_id && left.capability === right.capability && left.material_owner === right.material_owner && left.key_binding === right.key_binding && left.lifecycle_binding === right.lifecycle_binding && left.signing_worker === right.signing_worker;
+}
+
 // src/core/signingEngine/threshold/crypto/ed25519YaoLaneWasm.ts
 async function assertEd25519YaoLaneCeremonyBindingParityV1(input) {
   const expectedApplicationDigestB64u = base64UrlEncode(Uint8Array.from(await deriveRouterAbEd25519YaoApplicationBindingDigestV1(input.applicationBinding)));
@@ -5257,6 +5231,9 @@ function requireUnlockedExportRootCapabilityRecord(capability) {
   if (!record) {
     throw new Error("unlocked Ed25519 export-root capability is unknown or destroyed");
   }
+  if (capabilitySourceForKind(capability.kind) !== record.source) {
+    throw new Error("unlocked Ed25519 export-root capability names another kind of handle");
+  }
   if (String(capability.walletId) !== record.walletId || String(capability.walletAuthMethodId) !== record.walletAuthMethodId || String(capability.walletSessionId) !== record.walletSessionId || capability.expiresAtMs !== record.expiresAtMs) {
     throw new Error("unlocked Ed25519 export-root capability reference does not match the held handle");
   }
@@ -5266,13 +5243,23 @@ function requireUnlockedExportRootCapabilityRecord(capability) {
   }
   return record;
 }
+function capabilitySourceForKind(kind) {
+  return kind === "unlocked_linked_device_ed25519_client_root_capability_v1" ? "linked_device_client_root" : "wallet_custody_seed";
+}
 function openedCustodyCapabilityLaneSourceInput(capability) {
   const record = requireUnlockedExportRootCapabilityRecord(capability);
   return {
+    source: record.source,
     envelope: record.envelope,
     factorSecret: record.factorSecret.slice()
   };
 }
+function requireClientRootEnvelopeMatchesLaneSource(envelope, expected) {
+  const binding = envelope.binding;
+  if (binding.kind !== "ed25519_yao_client_root_v1" || String(binding.walletKeyId) !== expected.walletKeyId || String(binding.applicationBindingDigestB64u) !== expected.applicationBindingDigestB64u || String(binding.registeredPublicKeyB64u) !== expected.registeredPublicKeyB64u) {
+    throw new Error("linked-device Ed25519 Client root names another wallet key");
+  }
+}
 function distinctLaneSealSeeds() {
   const first = randomNonzero32();
   let second = randomNonzero32();
@@ -5289,11 +5276,15 @@ async function openEd25519YaoLaneSource(request) {
   }
   const payload = request.payload;
   const opened = payload.kind === "factor" ? {
+    source: "factor",
     envelope: parsePasskeyCustodyEnvelopeRecord(payload.envelope),
     factorSecret: toBytes(payload.factorSecret)
   } : openedCustodyCapabilityLaneSourceInput(payload.capability);
   const factorSecret = opened.factorSecret;
   try {
+    if (opened.source === "linked_device_client_root" && payload.kind !== "factor") {
+      requireClientRootEnvelopeMatchesLaneSource(opened.envelope, payload);
+    }
     const envelopeArgs = [
       factorSecret,
       custodyEnvelopeBindingJson(opened.envelope),
@@ -5302,7 +5293,7 @@ async function openEd25519YaoLaneSource(request) {
       base64UrlDecode(opened.envelope.aadHashB64u),
       base64UrlDecode(opened.envelope.ciphertextDigestB64u)
     ];
-    const source = payload.kind === "factor" ? new WasmEd25519YaoLaneSourceV1(...envelopeArgs) : ed25519_yao_lane_source_from_wallet_seed_v1(...envelopeArgs, base64UrlDecode(payload.applicationBindingDigestB64u), payload.walletKeyId, payload.enrollmentId, BigInt(payload.revocationEpoch), base64UrlDecode(payload.registeredPublicKeyB64u));
+    const source = payload.kind === "factor" || opened.source === "linked_device_client_root" ? new WasmEd25519YaoLaneSourceV1(...envelopeArgs) : ed25519_yao_lane_source_from_wallet_seed_v1(...envelopeArgs, base64UrlDecode(payload.applicationBindingDigestB64u), payload.walletKeyId, payload.enrollmentId, BigInt(payload.revocationEpoch), base64UrlDecode(payload.registeredPublicKeyB64u));
     const sourceHandle = secureOpaqueHandle("ed25519-yao-lane-source-v1");
     ed25519YaoLaneSources.set(sourceHandle, source);
     return { sourceHandle };
@@ -5629,9 +5620,12 @@ async function establishUnlockedWalletEd25519ExportRootCapability(request) {
     if (unlockedExportRootCapabilities.size >= MAX_ACTIVE_UNLOCKED_EXPORT_ROOT_CAPABILITIES) {
       throw new Error("too many unlocked Ed25519 export-root capabilities are active");
     }
-    const handle = passkey_custody_open_wallet_seed_v1(existingFactorSecret, custodyEnvelopeBindingJson(envelope), base64UrlDecode(envelope.nonceB64u), envelope.sealedCustodySecretB64u, envelope.aadHashB64u, envelope.ciphertextDigestB64u);
+    const source = envelope.binding.kind === "ed25519_yao_client_root_v1" ? "linked_device_client_root" : "wallet_custody_seed";
+    const openEnvelope = source === "linked_device_client_root" ? passkey_custody_open_ed25519_yao_client_root_envelope_v1 : passkey_custody_open_wallet_seed_v1;
+    const handle = openEnvelope(existingFactorSecret, custodyEnvelopeBindingJson(envelope), base64UrlDecode(envelope.nonceB64u), envelope.sealedCustodySecretB64u, envelope.aadHashB64u, envelope.ciphertextDigestB64u);
     const capabilityHandleId = createUnlockedExportRootCapabilityHandleId();
     unlockedExportRootCapabilities.set(capabilityHandleId, {
+      source,
       handle,
       envelope,
       factorSecret: existingFactorSecret,
@@ -5641,6 +5635,16 @@ async function establishUnlockedWalletEd25519ExportRootCapability(request) {
       expiresAtMs
     });
     factorSecretStored = true;
+    if (source === "linked_device_client_root") {
+      return {
+        kind: "unlocked_linked_device_ed25519_client_root_capability_v1",
+        capabilityHandleId,
+        walletId,
+        walletAuthMethodId,
+        walletSessionId,
+        expiresAtMs
+      };
+    }
     const upgradedEnvelope = envelope.ownership.kind === "unbound" ? resealUnboundEnvelopeAsMethodBound({
       handle,
       envelope,
@@ -5734,6 +5738,10 @@ async function sealEd25519ExportRootForLinkedDevice(request) {
 async function resealWalletCustodyFromUnlockedCapability(request) {
   await initializeNearSignerWasm();
   const record = requireUnlockedExportRootCapabilityRecord(request.payload.capability);
+  if (record.source !== "wallet_custody_seed") {
+    new Uint8Array(request.payload.replacementFactorSecret).fill(0);
+    throw new Error("only a wallet custody seed capability reseals the seed");
+  }
   const replacementFactorSecret = toBytes(request.payload.replacementFactorSecret);
   try {
     const resealed = passkey_custody_reseal_wallet_seed_v1(record.handle, replacementFactorSecret, request.payload.replacementEnvelopeBindingJson);