@seams/wallet 0.6.2 → 0.7.3

package/dist/esm/core/signingEngine/session/material/ecdsaSigningCapability.js

@@ -1,6 +1,6 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
+import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 //#region src/core/signingEngine/session/material/ecdsaSigningCapability.ts
 function exactEcdsaSubjectMatches(args) {
 	return args.session.capabilitySubjects.filter((subject) => subject.kind === "sign" && subject.keyFamily === "ecdsa_secp256k1" && mpcMaterialActivationRefsEqual(subject.materialActivation, args.materialActivation)).length === 1;
@@ -226,6 +226,6 @@ async function buildCanonicalEvmFamilyEcdsaSigningCapability(input) {
 	};
 }
 //#endregion
-export { authorizeEvmFamilyEcdsaSigningCapability, buildCanonicalEvmFamilyEcdsaSigningCapability, buildEcdsaPreprocessingCapability, buildExactEcdsaDirectCapabilityRuntime, buildExactEvmFamilyWalletSessionAuthorization, exactEcdsaWalletSessionRuntimesMatch, signingAuthorizationFromPreprocessing };
+export { authorizeEvmFamilyEcdsaSigningCapability, buildCanonicalEvmFamilyEcdsaSigningCapability, buildEcdsaPreprocessingCapability, buildExactEcdsaDirectCapabilityRuntime, buildExactEvmFamilyWalletSessionAuthorization, exactAuthorizationMatchesCapability, exactEcdsaWalletSessionRuntimesMatch, signingAuthorizationFromPreprocessing };
 
 //# sourceMappingURL=ecdsaSigningCapability.js.map

package/dist/esm/core/signingEngine/session/material/nearEd25519YaoSigningPreparation.js

@@ -1,6 +1,6 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { activeWalletSessionV1RecordsEqual } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 //#region src/core/signingEngine/session/material/nearEd25519YaoSigningPreparation.ts
 function classifyNearEd25519WalletSessionAuthorization(result) {
 	switch (result.kind) {

package/dist/esm/core/signingEngine/session/operationState/authorizationAdmission.js

@@ -22,16 +22,16 @@ function walletSessionQuotaAdmissionFailureMessage(failure) {
 function classifyWalletSessionQuotaAdmissionFailure(error) {
 	if (isWalletSessionQuotaAdmissionError(error)) return error.failure;
 	const message = error instanceof Error ? error.message : String(error || "");
-	if (message.includes("[WalletSessionQuotaAdmission] wallet-session quota is reserved by an in-flight operation")) return {
+	if (message.includes(WALLET_SESSION_QUOTA_IN_FLIGHT_ERROR)) return {
 		kind: "in_flight",
 		source: "local_projection",
-		detail: message || "[WalletSessionQuotaAdmission] wallet-session quota is reserved by an in-flight operation",
+		detail: message || WALLET_SESSION_QUOTA_IN_FLIGHT_ERROR,
 		retryAfterMs: 150
 	};
-	if (message.includes("[WalletSessionQuotaAdmission] wallet-session quota is exhausted")) return {
+	if (message.includes(WALLET_SESSION_QUOTA_EXHAUSTED_ERROR)) return {
 		kind: "exhausted",
 		source: "local_projection",
-		detail: message || "[WalletSessionQuotaAdmission] wallet-session quota is exhausted"
+		detail: message || WALLET_SESSION_QUOTA_EXHAUSTED_ERROR
 	};
 	return null;
 }

package/dist/esm/core/signingEngine/session/passkey/ecdsaKeyFactsInventory.js

@@ -1,8 +1,8 @@
 import { isObject } from "../../../../shared-ts/src/utils/validation.js";
-import { parseRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { SIGNER_AUTH_METHODS, SIGNER_KINDS } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual, walletIdFromWalletProfile } from "../../interfaces/ecdsaChainTarget.js";
 import { buildEvmFamilyEcdsaWalletKey, parseThresholdSigningRootBinding, resolveThresholdEcdsaKeyIdFromRecord, toEvmFamilyEcdsaKeyHandle, toThresholdEcdsaPublicKeyB64u } from "../identity/evmFamilyEcdsaIdentity.js";
+import { parseRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 //#region src/core/signingEngine/session/passkey/ecdsaKeyFactsInventory.ts
 function normalizeEvmOwnerAddress(value) {
 	const candidate = String(value || "").trim().toLowerCase();

package/dist/esm/core/signingEngine/session/passkey/ecdsaRecovery.js

@@ -1,6 +1,6 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
 import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { parseSigningSessionSealKeyVersion } from "../keyMaterialBrands.js";
+import { parseSigningSessionSealKeyVersion } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";
 //#region src/core/signingEngine/session/passkey/ecdsaRecovery.ts
 function shouldDeletePasskeyEcdsaSealedRecordAfterRestoreFailure(status) {
 	if (status.ok) return false;

package/dist/esm/core/signingEngine/session/passkey/ed25519YaoLocalMaterial.js

@@ -1,11 +1,12 @@
 import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef, parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
-import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parsePasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { asRecord } from "../../../../shared-ts/src/utils/validation.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { requireRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { normalizeThresholdRuntimePolicyScope } from "../../threshold/sessionPolicy.js";
+import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { ROUTER_AB_ED25519_YAO_ACTIVE_CLIENT_KIND_V1, RouterAbEd25519YaoClientV1 } from "../../threshold/ed25519/yaoClient.js";
+import { parsePasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { buildNearAccountRefs } from "../../../accountData/near/accountRefs.js";
 import { resolveAccountKeyMaterialTarget } from "../../../indexedDB/accountKeyMaterial.js";
 import { buildEnvelopeAAD } from "../../../indexedDB/keyMaterialEnvelope.js";
@@ -17,10 +18,6 @@ const ED25519_YAO_LOCAL_MATERIAL_SCHEMA_VERSION = 3;
 const ED25519_YAO_LOCAL_MATERIAL_ALGORITHM = "chacha20poly1305-hkdf-sha256-prf-first-v1";
 const ED25519_YAO_LOCAL_MATERIAL_NONCE_BYTES = 12;
 const MAX_U64 = (1n << 64n) - 1n;
-function asRecord(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-	return value;
-}
 function requireNonEmpty(value, label) {
 	const parsed = String(value ?? "").trim();
 	if (!parsed) throw new Error(`${label} is required for local Ed25519 material`);
@@ -130,7 +127,7 @@ function assertBindingIdentity(binding, identity) {
 }
 function parsePasskeyEd25519YaoLocalMaterialBindingV1(value) {
 	const record = asRecord(value);
-	if (!record || record.kind !== "router_ab_ed25519_yao_active_client_v1") throw new Error("Stored Ed25519 Client material binding is invalid");
+	if (!record || record.kind !== ED25519_YAO_LOCAL_MATERIAL_KEY_KIND) throw new Error("Stored Ed25519 Client material binding is invalid");
 	const materialActivation = parseMpcMaterialActivationRef(record.materialActivation);
 	if (!materialActivation.ok) throw new Error(materialActivation.error.message);
 	const binding = {
@@ -182,7 +179,7 @@ async function parseStoredLocalMaterialLocator(args) {
 	const binding = parsePasskeyEd25519YaoLocalMaterialBindingV1(record.binding);
 	const expectedPublicKey = `ed25519:${base58Encode(base64UrlDecode(binding.registeredPublicKeyB64u))}`;
 	const envelope = args.stored.payloadEnvelope;
-	if (args.stored.profileId !== args.target.profileId || args.stored.chainIdKey !== args.target.chainIdKey || args.stored.accountAddress !== args.target.accountAddress || args.stored.keyKind !== "router_ab_ed25519_yao_active_client_v1" || args.stored.schemaVersion !== ED25519_YAO_LOCAL_MATERIAL_SCHEMA_VERSION || args.stored.publicKey !== expectedPublicKey || args.stored.signerId !== binding.nearEd25519SigningKeyId || envelope?.encVersion !== 1 || envelope.alg !== ED25519_YAO_LOCAL_MATERIAL_ALGORITHM) throw new Error("Stored Ed25519 Client local material record is invalid");
+	if (args.stored.profileId !== args.target.profileId || args.stored.chainIdKey !== args.target.chainIdKey || args.stored.accountAddress !== args.target.accountAddress || args.stored.keyKind !== ED25519_YAO_LOCAL_MATERIAL_KEY_KIND || args.stored.schemaVersion !== ED25519_YAO_LOCAL_MATERIAL_SCHEMA_VERSION || args.stored.publicKey !== expectedPublicKey || args.stored.signerId !== binding.nearEd25519SigningKeyId || envelope?.encVersion !== 1 || envelope.alg !== ED25519_YAO_LOCAL_MATERIAL_ALGORITHM) throw new Error("Stored Ed25519 Client local material record is invalid");
 	const parsedAuthority = parsePasskeyWalletAuthAuthority({
 		walletId: binding.walletId,
 		factor: {
@@ -214,7 +211,7 @@ async function parseStoredLocalMaterialLocator(args) {
 }
 function assertStoredIdentitySubset(args) {
 	const binding = asRecord(args.stored.payload?.binding);
-	if (args.stored.profileId !== args.target.profileId || args.stored.chainIdKey !== args.target.chainIdKey || args.stored.accountAddress !== args.target.accountAddress || args.stored.signerSlot !== args.input.signerSlot || args.stored.signerId !== args.input.nearEd25519SigningKeyId || args.stored.keyKind !== "router_ab_ed25519_yao_active_client_v1" || binding?.kind !== "router_ab_ed25519_yao_active_client_v1" || binding.walletId !== args.input.walletId || binding.nearAccountId !== args.input.nearAccountId || binding.nearEd25519SigningKeyId !== args.input.nearEd25519SigningKeyId || binding.signerSlot !== args.input.signerSlot || binding.rpId !== args.input.rpId || binding.credentialIdB64u !== args.input.credentialIdB64u) throw new Error("Stored Ed25519 Client material locator does not match local custody");
+	if (args.stored.profileId !== args.target.profileId || args.stored.chainIdKey !== args.target.chainIdKey || args.stored.accountAddress !== args.target.accountAddress || args.stored.signerSlot !== args.input.signerSlot || args.stored.signerId !== args.input.nearEd25519SigningKeyId || args.stored.keyKind !== ED25519_YAO_LOCAL_MATERIAL_KEY_KIND || binding?.kind !== ED25519_YAO_LOCAL_MATERIAL_KEY_KIND || binding.walletId !== args.input.walletId || binding.nearAccountId !== args.input.nearAccountId || binding.nearEd25519SigningKeyId !== args.input.nearEd25519SigningKeyId || binding.signerSlot !== args.input.signerSlot || binding.rpId !== args.input.rpId || binding.credentialIdB64u !== args.input.credentialIdB64u) throw new Error("Stored Ed25519 Client material locator does not match local custody");
 }
 function metadataFromPasskeyEd25519YaoLocalMaterialBindingV1(binding, thresholdSessionId) {
 	const resolvedThresholdSessionId = requireNonEmpty(thresholdSessionId, "thresholdSessionId");
@@ -372,7 +369,7 @@ function hydrationBlocked(plan) {
 		plan
 	};
 }
-async function preparePasskeyEd25519YaoLocalMaterialRehydrationV1(input) {
+async function observePasskeyEd25519YaoLocalMaterial(input) {
 	const expectedAuthority = await expectedPasskeyAuthority(input);
 	const publicLocator = input.publicLocator.kind === "available" && !publicLocatorMatchesIdentity({
 		publicLocator: input.publicLocator,
@@ -394,26 +391,42 @@ async function preparePasskeyEd25519YaoLocalMaterialRehydrationV1(input) {
 			authority: expectedAuthority
 		});
 	} catch {
-		const plan = resolveNearEd25519YaoCapabilityHydrationV1({
-			publicLocator,
-			sealed: { kind: "corrupt" },
-			runtime: { kind: "absent" },
-			unlockSource: { kind: "unavailable" }
-		});
-		if (plan.kind !== "blocked") throw new Error("Corrupt Near Ed25519 material resolved to an executable hydration plan");
 		return {
-			kind: "blocked",
-			plan
+			expectedAuthority,
+			publicLocator,
+			sealed: { kind: "corrupt" }
 		};
 	}
-	const plan = resolveNearEd25519YaoCapabilityHydrationV1({
+	return {
+		expectedAuthority,
 		publicLocator,
 		sealed: localMaterial.kind === "available" ? {
 			kind: "available",
 			authority: localMaterial.locator.authority,
 			materialActivation: localMaterial.locator.materialActivation,
 			sealedMaterial: localMaterial.locator.sealedMaterial
-		} : { kind: "missing" },
+		} : { kind: "missing" }
+	};
+}
+function blockedByCorruptMaterial(publicLocator, runtime) {
+	const plan = resolveNearEd25519YaoCapabilityHydrationV1({
+		publicLocator,
+		sealed: { kind: "corrupt" },
+		runtime,
+		unlockSource: { kind: "unavailable" }
+	});
+	if (plan.kind !== "blocked") throw new Error("Corrupt Near Ed25519 material resolved to an executable hydration plan");
+	return plan;
+}
+async function preparePasskeyEd25519YaoLocalMaterialRehydrationV1(input) {
+	const { expectedAuthority, publicLocator, sealed } = await observePasskeyEd25519YaoLocalMaterial(input);
+	if (sealed.kind === "corrupt") return {
+		kind: "blocked",
+		plan: blockedByCorruptMaterial(publicLocator, { kind: "absent" })
+	};
+	const plan = resolveNearEd25519YaoCapabilityHydrationV1({
+		publicLocator,
+		sealed,
 		runtime: { kind: "absent" },
 		unlockSource: {
 			kind: "available",
@@ -435,48 +448,15 @@ async function preparePasskeyEd25519YaoLocalMaterialRehydrationV1(input) {
 	}
 }
 async function hydratePasskeyEd25519YaoLocalMaterialV1(input) {
-	const expectedAuthority = await expectedPasskeyAuthority(input);
-	const publicLocator = input.publicLocator.kind === "available" && !publicLocatorMatchesIdentity({
-		publicLocator: input.publicLocator,
-		identity: input.identity
-	}) ? { kind: "conflict" } : input.publicLocator.kind === "available" ? {
-		...input.publicLocator,
-		authority: expectedAuthority
-	} : input.publicLocator;
-	let localMaterial;
-	try {
-		localMaterial = await readPasskeyEd25519YaoLocalMaterialLocatorV1({
-			store: input.store,
-			walletId: String(input.identity.walletId),
-			nearAccountId: String(input.identity.nearAccountId),
-			nearEd25519SigningKeyId: String(input.identity.nearEd25519SigningKeyId),
-			signerSlot: input.identity.signerSlot,
-			rpId: input.identity.rpId,
-			credentialIdB64u: input.identity.credentialIdB64u,
-			authority: expectedAuthority
-		});
-	} catch {
-		const plan = resolveNearEd25519YaoCapabilityHydrationV1({
-			publicLocator,
-			sealed: { kind: "corrupt" },
-			runtime: liveRuntimeObservation(input.liveMaterial),
-			unlockSource: { kind: "unavailable" }
-		});
-		if (plan.kind !== "blocked") throw new Error("Corrupt Near Ed25519 material resolved to an executable hydration plan");
-		return hydrationBlocked(plan);
-	}
+	const { expectedAuthority, publicLocator, sealed } = await observePasskeyEd25519YaoLocalMaterial(input);
+	if (sealed.kind === "corrupt") return hydrationBlocked(blockedByCorruptMaterial(publicLocator, liveRuntimeObservation(input.liveMaterial)));
 	const unlockSource = input.unlockSource.kind === "available" ? {
 		kind: "available",
 		authority: expectedAuthority
 	} : { kind: "unavailable" };
 	const plan = resolveNearEd25519YaoCapabilityHydrationV1({
 		publicLocator,
-		sealed: localMaterial.kind === "available" ? {
-			kind: "available",
-			authority: localMaterial.locator.authority,
-			materialActivation: localMaterial.locator.materialActivation,
-			sealedMaterial: localMaterial.locator.sealedMaterial
-		} : { kind: "missing" },
+		sealed,
 		runtime: liveRuntimeObservation(input.liveMaterial),
 		unlockSource
 	});
@@ -532,7 +512,7 @@ async function rehydratePasskeyEd25519YaoLocalMaterialRecordV1(input) {
 	const stored = input.stored;
 	const target = input.target;
 	const envelope = stored.payloadEnvelope;
-	if (stored.profileId !== target.profileId || stored.accountAddress !== target.accountAddress || stored.signerId !== identity.nearEd25519SigningKeyId || stored.keyKind !== "router_ab_ed25519_yao_active_client_v1" || stored.schemaVersion !== ED25519_YAO_LOCAL_MATERIAL_SCHEMA_VERSION || envelope?.encVersion !== 1 || envelope.alg !== ED25519_YAO_LOCAL_MATERIAL_ALGORITHM) throw new Error("Stored Ed25519 Client material record is invalid");
+	if (stored.profileId !== target.profileId || stored.accountAddress !== target.accountAddress || stored.signerId !== identity.nearEd25519SigningKeyId || stored.keyKind !== ED25519_YAO_LOCAL_MATERIAL_KEY_KIND || stored.schemaVersion !== ED25519_YAO_LOCAL_MATERIAL_SCHEMA_VERSION || envelope?.encVersion !== 1 || envelope.alg !== ED25519_YAO_LOCAL_MATERIAL_ALGORITHM) throw new Error("Stored Ed25519 Client material record is invalid");
 	const binding = parseStoredBinding(stored.payload?.binding, identity);
 	const metadata = metadataFromPasskeyEd25519YaoLocalMaterialBindingV1(binding, identity.thresholdSessionId);
 	const expectedPublicKey = `ed25519:${base58Encode(metadata.registeredPublicKey)}`;

package/dist/esm/core/signingEngine/session/passkey/ed25519YaoRecoveryCapability.js

@@ -1,19 +1,10 @@
 import { parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { requireRecord, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
+import { toAccountId } from "../../../types/accountIds.js";
+import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
-import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { toAccountId } from "../../../types/accountIds.js";
 //#region src/core/signingEngine/session/passkey/ed25519YaoRecoveryCapability.ts
-function requireRecord(value, label) {
-	if (!isPlainObject(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-function requireString(value, label) {
-	const parsed = typeof value === "string" ? value.trim() : "";
-	if (!parsed) throw new Error(`${label} is required`);
-	return parsed;
-}
 function requirePositiveInteger(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) throw new Error(`${label} must be a positive integer`);
 	return value;
@@ -76,22 +67,22 @@ function parseEd25519YaoRecoveryCapabilityV1(raw) {
 		materialActivation,
 		activeCapabilityBinding: requireBytes32(record.activeCapabilityBinding, "capability.activeCapabilityBinding"),
 		registeredPublicKey: requireBytes32(record.registeredPublicKey, "capability.registeredPublicKey"),
-		nearAccountId: toAccountId(requireString(record.nearAccountId, "capability.nearAccountId")),
+		nearAccountId: toAccountId(requireTrimmedString(record.nearAccountId, "capability.nearAccountId")),
 		applicationBinding: {
-			wallet_id: requireString(application.wallet_id, "applicationBinding.wallet_id"),
-			near_ed25519_signing_key_id: requireString(application.near_ed25519_signing_key_id, "applicationBinding.near_ed25519_signing_key_id"),
-			signing_root_id: requireString(application.signing_root_id, "applicationBinding.signing_root_id"),
+			wallet_id: requireTrimmedString(application.wallet_id, "applicationBinding.wallet_id"),
+			near_ed25519_signing_key_id: requireTrimmedString(application.near_ed25519_signing_key_id, "applicationBinding.near_ed25519_signing_key_id"),
+			signing_root_id: requireTrimmedString(application.signing_root_id, "applicationBinding.signing_root_id"),
 			key_creation_signer_slot: requirePositiveInteger(application.key_creation_signer_slot, "applicationBinding.key_creation_signer_slot")
 		},
 		participantIds: requireParticipantIds(record.participantIds),
 		runtimePolicyScope: normalizeRuntimePolicyScope(requireRecord(record.runtimePolicyScope, "capability.runtimePolicyScope")),
 		lifecycle: {
-			lifecycleId: requireString(lifecycle.lifecycleId, "lifecycle.lifecycleId"),
-			rootShareEpoch: requireString(lifecycle.rootShareEpoch, "lifecycle.rootShareEpoch"),
-			accountId: requireString(lifecycle.accountId, "lifecycle.accountId"),
-			thresholdSessionId: requireThresholdEd25519SessionId(requireString(lifecycle.thresholdSessionId, "lifecycle.thresholdSessionId"), "lifecycle.thresholdSessionId"),
-			signerSetId: requireString(lifecycle.signerSetId, "lifecycle.signerSetId"),
-			signingWorkerId: requireString(lifecycle.signingWorkerId, "lifecycle.signingWorkerId")
+			lifecycleId: requireTrimmedString(lifecycle.lifecycleId, "lifecycle.lifecycleId"),
+			rootShareEpoch: requireTrimmedString(lifecycle.rootShareEpoch, "lifecycle.rootShareEpoch"),
+			accountId: requireTrimmedString(lifecycle.accountId, "lifecycle.accountId"),
+			thresholdSessionId: requireThresholdEd25519SessionId(requireTrimmedString(lifecycle.thresholdSessionId, "lifecycle.thresholdSessionId"), "lifecycle.thresholdSessionId"),
+			signerSetId: requireTrimmedString(lifecycle.signerSetId, "lifecycle.signerSetId"),
+			signingWorkerId: requireTrimmedString(lifecycle.signingWorkerId, "lifecycle.signingWorkerId")
 		},
 		stateEpoch: requirePositiveInteger(record.stateEpoch, "capability.stateEpoch"),
 		registrationContinuity: parseRegistrationContinuity(record.registrationContinuity)

package/dist/esm/core/signingEngine/session/passkey/ed25519YaoWarmRecovery.js

@@ -1,25 +1,16 @@
 import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
-import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { isPlainObject, requireRecord, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
 import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { toAccountId } from "../../../types/accountIds.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
+import { normalizeRuntimePolicyScope, sameRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { ed25519DurableMaterialLocator } from "../sealedRecovery/materialActivationKey.js";
 import { parseEd25519YaoRecoveryCapabilityV1 } from "./ed25519YaoRecoveryCapability.js";
 import { assertEd25519YaoWarmRecoveryDescriptorStableMaterialContinuity } from "../../flows/recovery/passkeyEd25519YaoRecovery.js";
 //#region src/core/signingEngine/session/passkey/ed25519YaoWarmRecovery.ts
-function requireRecord(value, label) {
-	if (!isPlainObject(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-function requireString(value, label) {
-	const parsed = typeof value === "string" ? value.trim() : "";
-	if (!parsed) throw new Error(`${label} is required`);
-	return parsed;
-}
 function requirePositiveInteger(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) throw new Error(`${label} must be a positive integer`);
 	return value;
@@ -171,21 +162,18 @@ async function parseJsonResponseOrNull(response) {
 		return null;
 	}
 }
-function sameRuntimePolicyScope(left, right) {
-	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
 async function parseWarmRecoveryDescriptor(args) {
 	const record = args.record;
 	const response = args.response;
 	exactResponseKeys(response, WARM_RECOVERY_RESPONSE_KEYS);
 	if (response.kind !== "router_ab_ed25519_yao_v2_session_bootstrap_v1") throw new Error("warm recovery bootstrap response kind is invalid");
 	const restore = record.ed25519Restore;
-	const walletId = requireString(response.walletId, "response.walletId");
-	const nearAccountId = requireString(response.nearAccountId, "response.nearAccountId");
-	const nearEd25519SigningKeyId = requireString(response.nearEd25519SigningKeyId, "response.nearEd25519SigningKeyId");
+	const walletId = requireTrimmedString(response.walletId, "response.walletId");
+	const nearAccountId = requireTrimmedString(response.nearAccountId, "response.nearAccountId");
+	const nearEd25519SigningKeyId = requireTrimmedString(response.nearEd25519SigningKeyId, "response.nearEd25519SigningKeyId");
 	const signerSlot = requirePositiveInteger(response.signerSlot, "response.signerSlot");
-	const thresholdSessionId = requireString(response.thresholdSessionId, "response.thresholdSessionId");
-	const signingWorkerId = requireString(response.signingWorkerId, "response.signingWorkerId");
+	const thresholdSessionId = requireTrimmedString(response.thresholdSessionId, "response.thresholdSessionId");
+	const signingWorkerId = requireTrimmedString(response.signingWorkerId, "response.signingWorkerId");
 	const thresholdExpiresAtMs = requirePositiveInteger(response.thresholdExpiresAtMs, "response.thresholdExpiresAtMs");
 	const participantIds = requireParticipantIds(response.participantIds);
 	const responseRuntimePolicyScope = normalizeRuntimePolicyScope(requireRecord(response.runtimePolicyScope, "response.runtimePolicyScope"));
@@ -206,7 +194,7 @@ async function parseWarmRecoveryDescriptor(args) {
 		signerSlot,
 		operationalPublicKey: `ed25519:${base58Encode(Uint8Array.from(capability.registeredPublicKey))}`,
 		relayerKeyId: signingWorkerId,
-		credentialIdB64u: requireString(restore.credentialIdB64u, "ed25519Restore.credentialIdB64u"),
+		credentialIdB64u: requireTrimmedString(restore.credentialIdB64u, "ed25519Restore.credentialIdB64u"),
 		session: {
 			sessionKind: "opaque",
 			walletSessionToken,
@@ -233,7 +221,7 @@ async function resolvePasskeyEd25519YaoExportContextV1(input, runtime) {
 	};
 	const walletId = parseWalletId(exactRecord.record.walletId);
 	if (!walletId.ok) throw new Error("[SigningEngine][near] sealed Ed25519 wallet identity is invalid");
-	const credentialIdB64u = requireString(exactRecord.record.ed25519Restore.credentialIdB64u, "ed25519Restore.credentialIdB64u");
+	const credentialIdB64u = requireTrimmedString(exactRecord.record.ed25519Restore.credentialIdB64u, "ed25519Restore.credentialIdB64u");
 	let expectedAuthorityRef;
 	try {
 		expectedAuthorityRef = await runtime.resolveExactPasskeyWalletAuthAuthorityRef({

package/dist/esm/core/signingEngine/session/passkey/unlockEcdsaWarmupPlanner.js

@@ -1,7 +1,7 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { thresholdEcdsaChainTargetKey } from "../../interfaces/ecdsaChainTarget.js";
 import { deriveEvmFamilyKeyFingerprint, evmFamilyEcdsaWalletKeyToIdentity } from "../identity/evmFamilyEcdsaIdentity.js";
+import { sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { parseProfileContinuityEcdsaWarmKey } from "./ecdsaKeyFactsInventory.js";
 //#region src/core/signingEngine/session/passkey/unlockEcdsaWarmupPlanner.ts
 function walletUnlockSelectionIncludesEcdsa(selection) {

package/dist/esm/core/signingEngine/session/persistence/ecdsaRoleLocalRecords.js

@@ -1,7 +1,7 @@
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { toRpId } from "../identity/evmFamilyEcdsaIdentity.js";
+import { parseRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { toEcdsaDerivationSigningRootId, toEcdsaDerivationSigningRootVersion, toEcdsaDerivationThresholdKeyId, toEmailOtpAuthSubjectId } from "../identity/emailOtpEcdsaDerivationIdentity.js";
 //#region src/core/signingEngine/session/persistence/ecdsaRoleLocalRecords.ts
 function assertNever(value) {