@seams/wallet 0.7.1 → 0.7.3

package/dist/esm/sdk/{walletRecoveryCommit-sjGNTHUj.js → walletRecoveryCommit-AI1AtIRP.js}

@@ -1,20 +1,20 @@
 import { A as parseWalletRecoveryOperationId, D as parseWalletAuthorityId, M as parseWebAuthnRpId, O as parseWalletId, S as parseThresholdEd25519SessionId, T as parseWalletAuthMethodId, j as parseWebAuthnCredentialIdB64u, o as parseEmailOtpChallengeId, s as parseEmailOtpProviderUserId } from "./domainIds-lcrFg6Sa.js";
-import { M as base58Encode, _ as requireRecord } from "./validation-gat4LEKm.js";
+import { M as base58Encode, _ as requireRecord, m as requireArray } from "./validation-gat4LEKm.js";
 import { i as base64UrlEncode, r as base64UrlDecode } from "./base64-Clm8C-e9.js";
-import { E as parseUnixMs, P as rejectUnknownFields, S as parseEnvelopeNonceB64u, T as parseSecp256k1CompressedPublicKeyB64u, b as parseEd25519PublicKeyB64u, h as normalizeRuntimePolicyScope, o as normalizeThresholdRuntimePolicyScope, v as requireEvmFamilySigningKeySlotId, w as parseKeyCreationSignerSlot, x as parseEnvelopeCiphertextB64u, y as parseDigestField } from "./sessionPolicy-CHiilOAB.js";
-import { Ct as routerAbMpcMaterialActivationRefFromWire, E as parseRouterAbEcdsaRegistrationActivationReceiptV1, W as buildEmailOtpWalletAuthAuthority, _t as parseSdkEcdsaDerivationSigningRootId, gt as ecdsaClientRootPublicKey33B64uFromString, ht as computeEcdsaDerivationRoleLocalRelayerKeyId, nt as walletAuthAuthorityRef, pt as parseEcdsaServerGeneration, v as parseRouterAbEcdsaDerivationPublicCapabilityV1, vt as parseSdkEcdsaDerivationSigningRootVersion, wt as routerAbMpcMaterialActivationRefToWire, xt as parseRouterAbMpcMaterialActivationRef, yt as parseSdkEcdsaDerivationThresholdKeyId } from "./ecdsaPresignLifecycle-BFOTNYCK.js";
+import { C as parseEnvelopeNonceB64u, D as parseUnixMs, E as parseSecp256k1CompressedPublicKeyB64u, I as rejectUnknownFields, S as parseEnvelopeCiphertextB64u, T as parseKeyCreationSignerSlot, b as parseDigestField, h as normalizeRuntimePolicyScope, o as normalizeThresholdRuntimePolicyScope, x as parseEd25519PublicKeyB64u, y as requireEvmFamilySigningKeySlotId } from "./sessionPolicy-DO-MkL65.js";
+import { $t as wireLiteral, Ct as parseRouterAbMpcMaterialActivationRef, E as parseRouterAbEcdsaRegistrationActivationReceiptV1, Et as routerAbMpcMaterialActivationRefToWire, K as buildEmailOtpWalletAuthAuthority, Tt as routerAbMpcMaterialActivationRefFromWire, _t as computeEcdsaDerivationRoleLocalRelayerKeyId, bt as parseSdkEcdsaDerivationSigningRootVersion, ht as parseEcdsaServerGeneration, it as walletAuthAuthorityRef, nn as wireResult, tn as wireObject, v as parseRouterAbEcdsaDerivationPublicCapabilityV1, vt as ecdsaClientRootPublicKey33B64uFromString, xt as parseSdkEcdsaDerivationThresholdKeyId, yt as parseSdkEcdsaDerivationSigningRootId } from "./ecdsaPresignLifecycle-Bfx2AQKb.js";
 import { l as parseDeviceId } from "./capabilityKinds-hvYqa6S_.js";
 import { f as alphabetizeStringify, h as sha256HexUtf8 } from "./chains-BMh3btVo.js";
-import { a as parseWalletRecoveryEnvelopeEntry, f as parseRecoveryCodeReservationId, l as buildWalletRecoveryCommittedProjectionV1, n as parseWalletRecoveryEcdsaPossessionProofV1, t as parseWalletRecoveryEcdsaPossessionChallengeV1, u as parseWalletRecoveryCommittedProjectionV1 } from "./wallet-recovery-Bz9qKgaL.js";
-import { M as WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND, h as prepareWalletRecoveryPasskeyPublication, m as prepareWalletRecoveryEmailOtpPublication } from "./accountLifecycle-BAGG_rbk.js";
+import { a as parseWalletRecoveryEnvelopeEntry, f as parseRecoveryCodeReservationId, l as buildWalletRecoveryCommittedProjectionV1, n as parseWalletRecoveryEcdsaPossessionProofV1, t as parseWalletRecoveryEcdsaPossessionChallengeV1, u as parseWalletRecoveryCommittedProjectionV1 } from "./wallet-recovery-BX61-79p.js";
+import { M as WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND, h as prepareWalletRecoveryPasskeyPublication, m as prepareWalletRecoveryEmailOtpPublication } from "./accountLifecycle-zthG08aC.js";
 import { t as toAccountId } from "./accountIds-DhIPGOSN.js";
-import { T as sameWalletAuthMethodRecordV2, p as sameVerifiedActiveWalletAuthorityV1 } from "./walletAuthority-BQBxgUBn.js";
-import { d as parsePasskeyCustodyEnvelopeRecord } from "./passkey-custody-Bk1jAknm.js";
-import { r as prepareWalletCustodyEcdsaContinuity, u as IndexedDBManager, x as pendingWalletRecoveryCommitIdentityMatches } from "./walletCustodyEcdsaContinuity-Hn4ORIbf.js";
+import { T as sameWalletAuthMethodRecordV2, p as sameVerifiedActiveWalletAuthorityV1 } from "./walletAuthority-DD9T25F6.js";
+import { d as parsePasskeyCustodyEnvelopeRecord } from "./passkey-custody-UUHbC0pk.js";
+import { A as thresholdEcdsaChainTargetKey, r as prepareWalletCustodyEcdsaContinuity, u as IndexedDBManager, x as pendingWalletRecoveryCommitIdentityMatches } from "./walletCustodyEcdsaContinuity-CF4bv9OI.js";
 import { n as PASSKEY_PRF_SECOND_SALT_V1, t as PASSKEY_PRF_FIRST_SALT_V1 } from "./signingSessionSeal-Cu-GHm6y.js";
-import { n as parseEmailOtpChallengeDelivery } from "./challengeDelivery-Dd0586fo.js";
+import { n as parseEmailOtpChallengeDelivery } from "./challengeDelivery-DZtopOAG.js";
 import { o as redactedPasskeyRegistrationCredential } from "./helpers-ZrowMnev.js";
-import { C as buildEcdsaRoleLocalPublicFacts } from "./ecdsaCapabilityManifest-kzO_fW09.js";
+import { C as buildEcdsaRoleLocalPublicFacts } from "./ecdsaCapabilityManifest-DuMs0VtU.js";
 import { n as buildRelayerJsonPostRequestInit, r as normalizeRelayerBaseUrl } from "./relayerHttp-VC8Holz1.js";
 //#region ../shared-ts/src/wallet-recovery/walletRecoveryTarget.ts
 function parseWalletRecoveryTargetV1(raw) {
@@ -147,7 +147,7 @@ async function parseWalletRecoveryPrepareResponse(args) {
 	const body = decodeJsonObjectOrNull(await response.json().catch(() => ({})));
 	if (response.status === 200 && body && readJsonField(body, "ok") === true) try {
 		const preparedResponse = decodeExactJsonObject(body, args.target.kind === "passkey" ? WALLET_RECOVERY_PREPARE_PASSKEY_RESPONSE_FIELDS : WALLET_RECOVERY_PREPARE_COMMON_RESPONSE_FIELDS, "walletRecoveryPrepare");
-		const wrap = parsePreparedRecoveryWrap(readJsonField(preparedResponse, "wrap"));
+		const wrap = preparedRecoveryWrap()(readJsonField(preparedResponse, "wrap"), "walletRecoveryPrepare.wrap");
 		const entries = parsePreparedRecoveryEntries(readJsonField(preparedResponse, "entries"));
 		const walletIdResult = parseWalletId(readJsonField(preparedResponse, "walletId"));
 		if (!walletIdResult.ok) throw new Error("walletRecoveryPrepare.walletId is invalid");
@@ -180,7 +180,7 @@ async function parseWalletRecoveryPrepareResponse(args) {
 		};
 		switch (target.kind) {
 			case "passkey": {
-				const registration = parseWalletRecoveryRegistrationOptions(readJsonField(preparedResponse, "registration"), String(walletId), target.rpId);
+				const registration = walletRecoveryRegistrationOptions(String(walletId), target.rpId)(readJsonField(preparedResponse, "registration"), "registration");
 				if (registration.walletAuthMethodId !== targetWalletAuthMethodId.value) throw new Error("wallet recovery registration changed the target auth method");
 				return {
 					...common,
@@ -204,115 +204,69 @@ async function parseWalletRecoveryPrepareResponse(args) {
 	if (response.status === 401 || response.status === 400) return { kind: "refused" };
 	return { kind: "transport_uncertain" };
 }
-function parseWalletRecoveryRegistrationOptions(raw, expectedWalletId, expectedRpId) {
-	const registration = decodeExactJsonObject(raw, [
-		"kind",
-		"challengeId",
-		"challengeB64u",
-		"replacementId",
-		"walletAuthMethodId",
-		"rpId",
-		"user",
-		"pubKeyCredParams",
-		"authenticatorSelection",
-		"timeoutMs",
-		"attestation",
-		"extensions",
-		"excludeCredentials"
-	], "walletRecoveryPrepare.registration");
-	if (readJsonField(registration, "kind") !== "webauthn_recovery_registration_v1") throw new Error("walletRecoveryPrepare.registration kind is invalid");
-	const challengeId = requireResponseString(readJsonField(registration, "challengeId"), "registration.challengeId");
-	const challengeB64u = requireCanonicalBytesB64u(readJsonField(registration, "challengeB64u"), 32, "registration.challengeB64u");
-	const replacementId = requireResponseString(readJsonField(registration, "replacementId"), "registration.replacementId");
-	const walletAuthMethodId = parseWalletAuthMethodId(readJsonField(registration, "walletAuthMethodId"));
-	if (!walletAuthMethodId.ok) throw new Error("walletRecoveryPrepare.registration.walletAuthMethodId is invalid");
-	const rpIdResult = parseWebAuthnRpId(readJsonField(registration, "rpId"));
-	if (!rpIdResult.ok) throw new Error("walletRecoveryPrepare.registration.rpId is invalid");
-	if (rpIdResult.value !== expectedRpId) throw new Error("walletRecoveryPrepare.registration changed the relying party");
-	const user = decodeExactJsonObject(readJsonField(registration, "user"), [
-		"idB64u",
-		"name",
-		"displayName"
-	], "walletRecoveryPrepare.registration.user");
+function walletRecoveryRegistrationOptions(expectedWalletId, expectedRpId) {
 	const expectedUserIdB64u = base64UrlEncode(new TextEncoder().encode(expectedWalletId));
-	const idB64u = requireCanonicalNonEmptyB64u(readJsonField(user, "idB64u"), "registration.user.idB64u");
-	if (idB64u !== expectedUserIdB64u) throw new Error("walletRecoveryPrepare.registration user is bound to another wallet");
-	const name = requireResponseString(readJsonField(user, "name"), "registration.user.name");
-	const displayName = requireResponseString(readJsonField(user, "displayName"), "registration.user.displayName");
-	if (name !== expectedWalletId || displayName !== expectedWalletId) throw new Error("walletRecoveryPrepare.registration user labels changed the wallet identity");
-	const pubKeyCredParams = parseRecoveryPublicKeyParameters(readJsonField(registration, "pubKeyCredParams"));
-	const authenticatorSelection = parseRecoveryAuthenticatorSelection(readJsonField(registration, "authenticatorSelection"));
-	const timeoutMs = Number(readJsonField(registration, "timeoutMs"));
-	if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new Error("walletRecoveryPrepare.registration.timeoutMs is invalid");
-	if (readJsonField(registration, "attestation") !== "none") throw new Error("walletRecoveryPrepare.registration.attestation is invalid");
-	const extensions = parseRecoveryPrfExtensions(readJsonField(registration, "extensions"));
-	const excludeCredentials = parseRecoveryExcludeCredentials(readJsonField(registration, "excludeCredentials"));
-	return {
-		kind: "webauthn_recovery_registration_v1",
-		challengeId,
-		challengeB64u,
-		replacementId,
-		walletAuthMethodId: walletAuthMethodId.value,
-		rpId: rpIdResult.value,
-		user: {
-			idB64u,
-			name,
-			displayName
+	const credentialDescriptor = wireObject({
+		type: wireLiteral("public-key"),
+		id: (raw, label) => {
+			const id = wireResult(parseWebAuthnCredentialIdB64u)(raw, label);
+			requireCanonicalNonEmptyB64u(id, label);
+			return id;
+		}
+	});
+	return wireObject({
+		kind: wireLiteral("webauthn_recovery_registration_v1"),
+		challengeId: requireResponseString,
+		challengeB64u: (raw, label) => requireCanonicalBytesB64u(raw, 32, label),
+		replacementId: requireResponseString,
+		walletAuthMethodId: wireResult(parseWalletAuthMethodId),
+		rpId: wireResult(parseWebAuthnRpId),
+		user: wireObject({
+			idB64u: requireCanonicalNonEmptyB64u,
+			name: requireResponseString,
+			displayName: requireResponseString
+		}, (user, label) => {
+			if (user.idB64u !== expectedUserIdB64u || user.name !== expectedWalletId || user.displayName !== expectedWalletId) throw new Error(`${label} is bound to another wallet`);
+		}),
+		pubKeyCredParams: (raw, label) => {
+			if (!Array.isArray(raw) || raw.length !== 2) throw new Error(`${label} is invalid`);
+			return [publicKeyCredentialParameter(-7)(raw[0], `${label}[0]`), publicKeyCredentialParameter(-257)(raw[1], `${label}[1]`)];
 		},
-		pubKeyCredParams,
-		authenticatorSelection,
-		timeoutMs,
-		attestation: "none",
-		extensions,
-		excludeCredentials
-	};
-}
-function parseRecoveryPrfExtensions(raw) {
-	const evaluation = decodeExactJsonObject(readJsonField(decodeExactJsonObject(readJsonField(decodeExactJsonObject(raw, ["prf"], "walletRecoveryPrepare.registration.extensions"), "prf"), ["eval"], "walletRecoveryPrepare.registration.extensions.prf"), "eval"), ["firstB64u", "secondB64u"], "walletRecoveryPrepare.registration.extensions.prf.eval");
-	const firstB64u = requireCanonicalBytesB64u(readJsonField(evaluation, "firstB64u"), PASSKEY_PRF_FIRST_SALT_V1.length, "registration.extensions.prf.eval.firstB64u");
-	const secondB64u = requireCanonicalBytesB64u(readJsonField(evaluation, "secondB64u"), PASSKEY_PRF_SECOND_SALT_V1.length, "registration.extensions.prf.eval.secondB64u");
-	if (firstB64u !== base64UrlEncode(PASSKEY_PRF_FIRST_SALT_V1) || secondB64u !== base64UrlEncode(PASSKEY_PRF_SECOND_SALT_V1)) throw new Error("walletRecoveryPrepare.registration PRF salts are unsupported");
-	return { prf: { eval: {
-		firstB64u,
-		secondB64u
-	} } };
-}
-function parseRecoveryPublicKeyParameters(raw) {
-	if (!Array.isArray(raw) || raw.length !== 2) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams is invalid");
-	const first = decodeExactJsonObject(raw[0], ["type", "alg"], "walletRecoveryPrepare.registration.pubKeyCredParams[0]");
-	const second = decodeExactJsonObject(raw[1], ["type", "alg"], "walletRecoveryPrepare.registration.pubKeyCredParams[1]");
-	if (readJsonField(first, "type") !== "public-key" || readJsonField(first, "alg") !== -7) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams[0] is invalid");
-	if (readJsonField(second, "type") !== "public-key" || readJsonField(second, "alg") !== -257) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams[1] is invalid");
-	return [{
-		type: "public-key",
-		alg: -7
-	}, {
-		type: "public-key",
-		alg: -257
-	}];
-}
-function parseRecoveryAuthenticatorSelection(raw) {
-	const selection = decodeExactJsonObject(raw, ["residentKey", "userVerification"], "walletRecoveryPrepare.registration.authenticatorSelection");
-	if (readJsonField(selection, "residentKey") !== "required" || readJsonField(selection, "userVerification") !== "preferred") throw new Error("walletRecoveryPrepare.registration.authenticatorSelection is invalid");
-	return {
-		residentKey: "required",
-		userVerification: "preferred"
-	};
+		authenticatorSelection: wireObject({
+			residentKey: wireLiteral("required"),
+			userVerification: wireLiteral("preferred")
+		}),
+		timeoutMs: (raw, label) => {
+			const timeoutMs = Number(raw);
+			if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new Error(`${label} is invalid`);
+			return timeoutMs;
+		},
+		attestation: wireLiteral("none"),
+		extensions: wireObject({ prf: wireObject({ eval: wireObject({
+			firstB64u: prfSalt(PASSKEY_PRF_FIRST_SALT_V1),
+			secondB64u: prfSalt(PASSKEY_PRF_SECOND_SALT_V1)
+		}) }) }),
+		excludeCredentials: (raw, label) => requireArray(raw, label).map((entry, index) => credentialDescriptor(entry, `${label}[${index}]`))
+	}, (registration, label) => {
+		if (registration.rpId !== expectedRpId) throw new Error(`${label} changed the relying party`);
+	});
 }
-function parseRecoveryExcludeCredentials(raw) {
-	if (!Array.isArray(raw)) throw new Error("walletRecoveryPrepare.registration.excludeCredentials is invalid");
-	return raw.map((entry, index) => {
-		const descriptor = decodeExactJsonObject(entry, ["type", "id"], `walletRecoveryPrepare.registration.excludeCredentials[${index}]`);
-		if (readJsonField(descriptor, "type") !== "public-key") throw new Error("walletRecoveryPrepare.registration.excludeCredentials type is invalid");
-		const parsedId = parseWebAuthnCredentialIdB64u(readJsonField(descriptor, "id"));
-		if (!parsedId.ok) throw new Error("walletRecoveryPrepare.registration.excludeCredentials id is invalid");
-		requireCanonicalNonEmptyB64u(parsedId.value, "registration.excludeCredentials.id");
-		return {
-			type: "public-key",
-			id: parsedId.value
-		};
+function publicKeyCredentialParameter(alg) {
+	return wireObject({
+		type: wireLiteral("public-key"),
+		alg: (raw, label) => {
+			if (raw !== alg) throw new Error(`${label} is invalid`);
+			return alg;
+		}
 	});
 }
+function prfSalt(salt) {
+	return (raw, label) => {
+		const value = requireCanonicalBytesB64u(raw, salt.length, label);
+		if (value !== base64UrlEncode(salt)) throw new Error(`${label} is unsupported`);
+		return value;
+	};
+}
 function recoveryTargetsMatch(left, right) {
 	if (left.kind !== right.kind) return false;
 	switch (left.kind) {
@@ -324,18 +278,12 @@ function recoveryTargetsMatch(left, right) {
 function assertNeverRecoveryTarget(value) {
 	throw new Error(`unsupported wallet recovery target: ${String(value)}`);
 }
-const PREPARED_WRAP_FIELDS = [
-	"nonceB64u",
-	"wrappedManifestKekB64u",
-	"aadHashB64u"
-];
-function parsePreparedRecoveryWrap(raw) {
-	const wrap = decodeExactJsonObject(raw, PREPARED_WRAP_FIELDS, "walletRecoveryPrepare.wrap");
-	return {
-		nonceB64u: parseEnvelopeNonceB64u(readJsonField(wrap, "nonceB64u"), "walletRecoveryPrepare.wrap.nonceB64u"),
-		wrappedManifestKekB64u: parseEnvelopeCiphertextB64u(readJsonField(wrap, "wrappedManifestKekB64u"), "walletRecoveryPrepare.wrap.wrappedManifestKekB64u"),
-		aadHashB64u: parseDigestField(readJsonField(wrap, "aadHashB64u"), "walletRecoveryPrepare.wrap.aadHashB64u")
-	};
+function preparedRecoveryWrap() {
+	return wireObject({
+		nonceB64u: parseEnvelopeNonceB64u,
+		wrappedManifestKekB64u: parseEnvelopeCiphertextB64u,
+		aadHashB64u: parseDigestField
+	});
 }
 function parsePreparedRecoveryEntries(raw) {
 	if (!Array.isArray(raw) || raw.length !== 1) throw new Error("walletRecoveryPrepare.entries must contain exactly one custody seed");
@@ -497,7 +445,7 @@ function parseWalletRecoveryPreparationEcdsaRecoveryBasis(raw, expectedWalletId)
 function parseWalletRecoveryEcdsaChainTargets(raw) {
 	if (!Array.isArray(raw) || raw.length === 0) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are invalid");
 	const targets = raw.map((value, index) => parseWalletRecoveryEcdsaChainTarget(value, index));
-	if (new Set(targets.map(walletRecoveryEcdsaChainTargetKey)).size !== targets.length) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are duplicated");
+	if (new Set(targets.map(thresholdEcdsaChainTargetKey)).size !== targets.length) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are duplicated");
 	const first = targets[0];
 	if (!first) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are invalid");
 	return [first, ...targets.slice(1)];
@@ -537,9 +485,6 @@ function parseWalletRecoveryEcdsaChainTarget(raw, index) {
 	};
 	throw new Error("walletRecoveryPrepare ECDSA recovery chain family is invalid");
 }
-function walletRecoveryEcdsaChainTargetKey(target) {
-	return target.kind === "evm" ? `evm:eip155:${target.chainId}` : `tempo:${target.chainId}`;
-}
 function parseWalletRecoveryEcdsaParticipantIds(raw) {
 	if (!Array.isArray(raw) || raw.length !== 2 || raw[0] !== 1 || raw[1] !== 2) throw new Error("walletRecoveryPrepare ECDSA recovery participant IDs are invalid");
 	return [1, 2];
@@ -843,9 +788,6 @@ function durableBase64Url(value, label, byteLength) {
 	if (byteLength !== void 0 && bytes.byteLength !== byteLength) throw new Error(label + " must decode to " + byteLength + " bytes");
 	return normalized;
 }
-function durableCompressedPublicKey(value, label) {
-	return parseSecp256k1CompressedPublicKeyB64u(value, label);
-}
 function durableSafeInteger(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(label + " must be a non-negative safe integer");
 	return value;
@@ -916,10 +858,10 @@ function parseWalletRecoveryDurableEcdsaPublicFacts(raw) {
 	if (!/^0x[0-9a-f]{40}$/.test(ethereumAddress)) throw new Error("recovery durable ECDSA ethereumAddress is invalid");
 	return {
 		contextBinding32B64u: parseDigestField(record.contextBinding32B64u, "recovery durable ECDSA context binding"),
-		derivationClientSharePublicKey33B64u: durableCompressedPublicKey(record.derivationClientSharePublicKey33B64u, "recovery durable ECDSA client share"),
-		clientVerifyingShare33B64u: durableCompressedPublicKey(record.clientVerifyingShare33B64u, "recovery durable ECDSA client verifying share"),
-		relayerPublicKey33B64u: durableCompressedPublicKey(record.relayerPublicKey33B64u, "recovery durable ECDSA relayer public key"),
-		groupPublicKey33B64u: durableCompressedPublicKey(record.groupPublicKey33B64u, "recovery durable ECDSA group public key"),
+		derivationClientSharePublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.derivationClientSharePublicKey33B64u, "recovery durable ECDSA client share"),
+		clientVerifyingShare33B64u: parseSecp256k1CompressedPublicKeyB64u(record.clientVerifyingShare33B64u, "recovery durable ECDSA client verifying share"),
+		relayerPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.relayerPublicKey33B64u, "recovery durable ECDSA relayer public key"),
+		groupPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.groupPublicKey33B64u, "recovery durable ECDSA group public key"),
 		ethereumAddress,
 		clientShareRetryCounter: durableSafeInteger(record.clientShareRetryCounter, "recovery durable ECDSA client-share retry counter"),
 		relayerShareRetryCounter: durableSafeInteger(record.relayerShareRetryCounter, "recovery durable ECDSA relayer-share retry counter")

package/dist/esm/shared-ts/src/authorization/walletSessionIssuance.js

@@ -1,6 +1,7 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "./capabilityKinds.js";
 import { isPlainObject } from "../utils/validation.js";
+import { hasExactKeys } from "../utils/exactKeys.js";
 //#region ../shared-ts/src/authorization/walletSessionIssuance.ts
 const COMMITTED_IDENTITY_FIELDS = [
 	"kind",
@@ -38,12 +39,8 @@ const UNLOCK_FLAT_RESPONSE_FIELDS = [
 	"unlocked",
 	"unlockBackend"
 ];
-function hasOnlyFields(record, fields) {
-	const actual = Object.keys(record);
-	return actual.length === new Set(fields).size && actual.every((field) => fields.includes(field));
-}
 function parseCommittedIdentity(value) {
-	if (!isPlainObject(value) || !hasOnlyFields(value, COMMITTED_IDENTITY_FIELDS)) return null;
+	if (!isPlainObject(value) || !hasExactKeys(value, COMMITTED_IDENTITY_FIELDS)) return null;
 	if (value.kind !== "already_committed_wallet_session_v1") return null;
 	const walletId = parseWalletId(value.walletId);
 	const authorityId = parseWalletAuthorityId(value.authorityId);
@@ -74,8 +71,8 @@ function parseResponseEnvelope(value) {
 	};
 }
 function parseFlatCommittedIdentity(value) {
-	if (!hasOnlyFields(value, FLAT_RESPONSE_FIELDS) && !hasOnlyFields(value, UNLOCK_FLAT_RESPONSE_FIELDS)) return null;
-	if (hasOnlyFields(value, UNLOCK_FLAT_RESPONSE_FIELDS) && (value.unlocked !== false || value.unlockBackend !== "passkey" && value.unlockBackend !== "email_otp")) return null;
+	if (!hasExactKeys(value, FLAT_RESPONSE_FIELDS) && !hasExactKeys(value, UNLOCK_FLAT_RESPONSE_FIELDS)) return null;
+	if (hasExactKeys(value, UNLOCK_FLAT_RESPONSE_FIELDS) && (value.unlocked !== false || value.unlockBackend !== "passkey" && value.unlockBackend !== "email_otp")) return null;
 	if (value.kind !== "already_committed") return null;
 	return parseCommittedIdentity({
 		kind: "already_committed_wallet_session_v1",
@@ -101,7 +98,7 @@ function parseWalletSessionAlreadyCommittedResponseV1(value) {
 	if (!isPlainObject(value)) return null;
 	const envelope = parseResponseEnvelope(value);
 	if (!envelope) return null;
-	if (!hasOnlyFields(value, NESTED_RESPONSE_FIELDS)) return null;
+	if (!hasExactKeys(value, NESTED_RESPONSE_FIELDS)) return null;
 	const committed = parseCommittedIdentity(value.committed);
 	return committed ? buildAlreadyCommittedResponse(envelope, committed) : null;
 }

package/dist/esm/shared-ts/src/authorization/walletSignerActivationEquality.js

@@ -0,0 +1,12 @@
+import { mpcMaterialActivationRefsEqual } from "../utils/domainIds.js";
+//#region ../shared-ts/src/authorization/walletSignerActivationEquality.ts
+function sameWalletEd25519SignerActivationV1(left, right) {
+	return left.kind === right.kind && left.signer.kind === right.signer.kind && left.signer.keyFamily === right.signer.keyFamily && left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.registeredPublicKeyB64u === right.signer.registeredPublicKeyB64u && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
+}
+function sameWalletEcdsaSignerActivationV1(left, right) {
+	return left.kind === right.kind && left.signer.kind === right.signer.kind && left.signer.keyFamily === right.signer.keyFamily && left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.thresholdPublicKey33B64u === right.signer.thresholdPublicKey33B64u && left.signer.evmAddress === right.signer.evmAddress && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
+}
+//#endregion
+export { sameWalletEcdsaSignerActivationV1, sameWalletEd25519SignerActivationV1 };
+
+//# sourceMappingURL=walletSignerActivationEquality.js.map

package/dist/esm/shared-ts/src/device-linking/committedSignerPackages.js

@@ -1,7 +1,7 @@
 import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef } from "../utils/domainIds.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../utils/routerAbNormalSigningIdentity.js";
-import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1 } from "../utils/routerAbEd25519Yao.js";
+import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, sameRouterAbEd25519YaoByteSequence } from "../utils/routerAbEd25519Yao.js";
 import { parseLinkedDeviceEd25519ExportRootPackageV1 } from "./ed25519ExportRoot.js";
 import { parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "./sourceContribution.js";
 import { parseWalletAuthMethodRecordV2 } from "../utils/walletAuthMethodRecord.js";
@@ -91,7 +91,7 @@ function parseEd25519Package(raw) {
 	if (!mpcMaterialActivationRefsEqual(materialActivation, routerAbMpcMaterialActivationRefFromWire(targetBinding.material_activation))) throw new Error("CommittedEd25519SignerPackageV1 target binding does not match material");
 	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a_client_package", "deriver_a");
 	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b_client_package", "deriver_b");
-	if (!sameBytes(activationReceipt.transcript, deriverA.transcript) || !sameBytes(activationReceipt.transcript, deriverB.transcript)) throw new Error("CommittedEd25519SignerPackageV1 receipt transcript does not match packages");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) throw new Error("CommittedEd25519SignerPackageV1 receipt transcript does not match packages");
 	return {
 		kind: "committed_ed25519_signer_package_v1",
 		materialActivation,
@@ -257,9 +257,6 @@ function parseCommittedEcdsaSignerPackageWireV1(raw) {
 function inspectRawObject(raw) {
 	return raw !== null && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
 }
-function sameBytes(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 function requireExactWireFields(record, keys, label) {
 	const expected = new Set(keys);
 	const actual = Object.keys(record);

package/dist/esm/shared-ts/src/device-linking/delegatedActivationPlan.js

@@ -1,7 +1,7 @@
 import { parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
 import { rejectUnknownFields } from "../utils/exactRecord.js";
-import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
+import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u, requireParsed } from "../passkey-custody/primitives.js";
 //#region ../shared-ts/src/device-linking/delegatedActivationPlan.ts
 const MANIFEST_FIELDS = [
 	"kind",
@@ -124,10 +124,6 @@ function exactRecord(raw, fields, label) {
 	for (const field of fields) if (!(field in record)) throw new Error(`${label}.${field} is required`);
 	return record;
 }
-function requireParsed(parsed, label) {
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
-}
 //#endregion
 export { buildExactAdministeredSignerManifestV1, parseExactAdministeredSignerManifestV1 };
 

package/dist/esm/shared-ts/src/device-linking/ed25519ExportRoot.js

@@ -2,7 +2,7 @@ import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDev
 import { requireRecord } from "../utils/validation.js";
 import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u } from "../passkey-custody/primitives.js";
+import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, requireParsed } from "../passkey-custody/primitives.js";
 //#region ../shared-ts/src/device-linking/ed25519ExportRoot.ts
 /**
 * Authenticated relay records for the cross-device Ed25519 Yao Client export
@@ -95,11 +95,11 @@ function parseLinkedDeviceEd25519ExportRootRecipientV1(raw) {
 	requireTransferAlg(record.transferAlg, "LinkedDeviceEd25519ExportRootRecipientV1.transferAlg");
 	return {
 		kind: "linked_device_ed25519_export_root_recipient_v1",
-		linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId"),
-		walletId: parseRequired(parseWalletId(record.walletId), "walletId"),
-		walletKeyId: parseRequired(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
-		enrollmentId: parseRequired(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
-		deviceId: parseRequired(parseLinkedDeviceId(record.deviceId), "deviceId"),
+		linkSessionId: requireParsed(parseLinkDeviceSessionId(record.linkSessionId), "LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId"),
+		walletId: requireParsed(parseWalletId(record.walletId), "walletId"),
+		walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
+		enrollmentId: requireParsed(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
+		deviceId: requireParsed(parseLinkedDeviceId(record.deviceId), "deviceId"),
 		transferAlg: LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1,
 		applicationBindingDigestB64u: parseDigestField(record.applicationBindingDigestB64u, "applicationBindingDigestB64u"),
 		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "registeredPublicKeyB64u"),
@@ -118,11 +118,11 @@ function parseLinkedDeviceEd25519ExportRootPackageV1(raw) {
 	if (recipientPublicKeyB64u === ephemeralPublicKeyB64u) throw new Error("ephemeralPublicKeyB64u repeats the recipient key");
 	return {
 		kind: "linked_device_ed25519_export_root_package_v1",
-		linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
-		walletId: parseRequired(parseWalletId(record.walletId), "walletId"),
-		walletKeyId: parseRequired(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
-		enrollmentId: parseRequired(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
-		deviceId: parseRequired(parseLinkedDeviceId(record.deviceId), "deviceId"),
+		linkSessionId: requireParsed(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
+		walletId: requireParsed(parseWalletId(record.walletId), "walletId"),
+		walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
+		enrollmentId: requireParsed(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
+		deviceId: requireParsed(parseLinkedDeviceId(record.deviceId), "deviceId"),
 		transferAlg: LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1,
 		applicationBindingDigestB64u: parseDigestField(record.applicationBindingDigestB64u, "applicationBindingDigestB64u"),
 		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "registeredPublicKeyB64u"),
@@ -161,10 +161,6 @@ function parseUnixMs(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive unix-millisecond timestamp`);
 	return value;
 }
-function parseRequired(parsed, label) {
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
-}
 //#endregion
 export { LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1, buildLinkedDeviceEd25519ExportRootTransferBindingV1, parseLinkedDeviceEd25519ExportRootPackageV1, parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u, parseLinkedDeviceEd25519ExportRootRecipientV1, serializeLinkedDeviceEd25519ExportRootTransferBindingV1 };
 

package/dist/esm/shared-ts/src/device-linking/sourceContribution.js

@@ -6,7 +6,7 @@ import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
 import { parseSdkEcdsaDerivationThresholdKeyId } from "../threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../utils/routerAbNormalSigningIdentity.js";
-import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1 } from "../utils/routerAbEd25519Yao.js";
+import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, sameRouterAbEd25519YaoByteSequence } from "../utils/routerAbEd25519Yao.js";
 import { requireRouterAbEcdsaDerivationNormalSigningStateV1 } from "../utils/routerAbEcdsaDerivation.js";
 //#region ../shared-ts/src/device-linking/sourceContribution.ts
 /** Exact discriminator accepted by the ECDSA source-contribution core. */
@@ -33,7 +33,7 @@ function parseLinkedDeviceEd25519SourcePreservingReservationV1(raw) {
 	const participantIds = parseRouterAbEd25519YaoParticipantIdsV1(record.participant_ids);
 	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a");
 	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b");
-	if (!sameBytes(activationReceipt.transcript, deriverA.transcript) || !sameBytes(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 reservation packages have mismatched transcripts");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 reservation packages have mismatched transcripts");
 	return {
 		state: "inactive",
 		reservationId: requireText(record.reservation_id, "reservation_id"),
@@ -192,10 +192,10 @@ function parseEd25519Contribution(record) {
 	if (!sameEdStableIdentity(sourceBinding, targetBinding)) throw new Error("linked-device Ed25519 source contribution stable identity differs");
 	if (!mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(activationReceipt.material_activation), targetMaterialActivation)) throw new Error("linked-device Ed25519 source contribution receipt activation differs");
 	const sourceRegisteredPublicKeyB64u = parseEd25519PublicKeyB64u(record.sourceRegisteredPublicKeyB64u, "sourceRegisteredPublicKeyB64u");
-	if (!sameBytes(activationReceipt.registered_public_key, Array.from(base64UrlDecode(sourceRegisteredPublicKeyB64u)))) throw new Error("linked-device Ed25519 source contribution receipt public key differs");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.registered_public_key, Array.from(base64UrlDecode(sourceRegisteredPublicKeyB64u)))) throw new Error("linked-device Ed25519 source contribution receipt public key differs");
 	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a");
 	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b");
-	if (!sameBytes(activationReceipt.transcript, deriverA.transcript) || !sameBytes(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 source contribution package transcript differs");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 source contribution package transcript differs");
 	if (sourceBinding.material_activation.activation_id === targetMaterialActivation.activationId) throw new Error("linked-device Ed25519 source contribution reuses the source activation");
 	return {
 		kind: "linked_device_ed25519_source_contribution_v1",
@@ -522,9 +522,6 @@ function parseFixedBase64(raw, byteLength, label) {
 	if (decoded.length !== byteLength || base64UrlEncode(decoded) !== raw) throw new Error(`${label} must decode to ${byteLength} bytes`);
 	return raw;
 }
-function sameBytes(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 function requireText(raw, label) {
 	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw || [...raw].some((character) => {
 		const code = character.charCodeAt(0);
@@ -540,6 +537,6 @@ function exactRecord(raw, keys, label) {
 	return record;
 }
 //#endregion
-export { parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourceContributionBindingV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceContributionPreparationV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1, parseLinkedDeviceEd25519SourcePreservingReservationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionV1 };
+export { parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourceContributionBindingV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceContributionPreparationV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1, parseLinkedDeviceEd25519SourcePreservingReservationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionV1, sameEcdsaSourceSigner, sameEcdsaTarget };
 
 //# sourceMappingURL=sourceContribution.js.map

package/dist/esm/shared-ts/src/passkey-custody/primitives.js

@@ -13,6 +13,10 @@ function requireCanonicalBase64Url(value, label) {
 	if (base64UrlEncode(decoded) !== value) throw new Error(`${label} must be canonical base64url`);
 	return decoded;
 }
+function requireParsed(result, label) {
+	if (result.ok) return result.value;
+	throw new Error(`${label} ${result.error.message}`);
+}
 function parseDigestField(value, label) {
 	try {
 		return parseDigestB64u(value);
@@ -53,6 +57,6 @@ function parseUnixMs(value, label) {
 	return value;
 }
 //#endregion
-export { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs };
+export { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs, requireParsed };
 
 //# sourceMappingURL=primitives.js.map

package/dist/esm/shared-ts/src/signing-lanes/ownerContinuity.js

@@ -1,7 +1,7 @@
 import { hasWhitespaceOrControlCharacters, parseMpcSigningWorkerRef } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
 import { rejectUnknownFields } from "../utils/exactRecord.js";
-import { parseDigestField } from "../passkey-custody/primitives.js";
+import { parseDigestField, requireParsed } from "../passkey-custody/primitives.js";
 import "./participants.js";
 import "../utils/digestEncoding.js";
 import "./participantDigest.js";
@@ -14,10 +14,6 @@ const OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
 	"custodyKeyManifestDigestB64u",
 	"sourceIdentityDigestB64u"
 ];
-function requireResult(result, label) {
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
 /** Parse the owner signer identity without widening it into a generic string. */
 function parseWalletSignerId(raw, label = "walletSignerId") {
 	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
@@ -43,7 +39,7 @@ function buildOwnerLaneParticipantContinuityV1(args) {
 		kind: "owner_lane_participant_continuity_v1",
 		signerId: parseWalletSignerId(args.signerId),
 		participantIds,
-		signingWorkerId: requireResult(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
+		signingWorkerId: requireParsed(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
 		custodyKeyManifestDigestB64u: parseDigestField(args.custodyKeyManifestDigestB64u, "custodyKeyManifestDigestB64u"),
 		sourceIdentityDigestB64u: parseDigestField(args.sourceIdentityDigestB64u, "sourceIdentityDigestB64u")
 	};
@@ -55,7 +51,7 @@ function parseOwnerLaneParticipantContinuityV1(raw, label = "ownerParticipantCon
 	return buildOwnerLaneParticipantContinuityV1({
 		signerId: parseWalletSignerId(record.signerId, `${label}.signerId`),
 		participantIds: parseParticipantIds(record.participantIds, `${label}.participantIds`),
-		signingWorkerId: requireResult(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
+		signingWorkerId: requireParsed(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
 		custodyKeyManifestDigestB64u: parseDigestField(record.custodyKeyManifestDigestB64u, `${label}.custodyKeyManifestDigestB64u`),
 		sourceIdentityDigestB64u: parseDigestField(record.sourceIdentityDigestB64u, `${label}.sourceIdentityDigestB64u`)
 	});