@seams/wallet 0.7.1 → 0.7.3

package/dist/esm/shared-ts/src/signing-lanes/recordParsers.js

@@ -1,7 +1,7 @@
 import { hasWhitespaceOrControlCharacters, parseLaneShareEpoch, parseLinkedDeviceId, parseSigningLaneId, parseWalletAuthMethodId, parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
 import { rejectUnknownFields } from "../utils/exactRecord.js";
-import { parseDigestField, parseEd25519PublicKeyB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs } from "../passkey-custody/primitives.js";
+import { parseDigestField, parseEd25519PublicKeyB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs, requireParsed } from "../passkey-custody/primitives.js";
 import { parseNearEd25519SigningKeyId } from "../utils/registrationIds.js";
 import { parseLaneHolderParticipantRecordV1, parseLaneParticipantBindingDigestB64u, parseSigningWorkerParticipantRecordV1 } from "./participants.js";
 import { requireEvmFamilySigningKeySlotId } from "./evmFamilySigningKeySlotId.js";
@@ -88,10 +88,6 @@ function signingLaneRecordFields(laneKind) {
 		case "delegated_execution": return DELEGATED_SIGNING_LANE_FIELDS;
 	}
 }
-function requireResult(result, label) {
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
 function parseRequiredDomainId(raw, label) {
 	if (raw === void 0 || raw === null) throw new Error(`${label} is required`);
 	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
@@ -191,12 +187,12 @@ function parseSigningLaneLifecycleState(raw, label) {
 function parseSigningLaneReferenceFields(record, label) {
 	if (record.kind !== "signing_lane_reference_v1") throw new Error(`${label}.kind must be signing_lane_reference_v1`);
 	return buildSigningLaneReference({
-		walletId: requireResult(parseWalletId(record.walletId), `${label}.walletId`),
-		walletKeyId: requireResult(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
-		laneId: requireResult(parseSigningLaneId(record.laneId), `${label}.laneId`),
-		laneShareEpoch: requireResult(parseLaneShareEpoch(record.laneShareEpoch), `${label}.laneShareEpoch`),
+		walletId: requireParsed(parseWalletId(record.walletId), `${label}.walletId`),
+		walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
+		laneId: requireParsed(parseSigningLaneId(record.laneId), `${label}.laneId`),
+		laneShareEpoch: requireParsed(parseLaneShareEpoch(record.laneShareEpoch), `${label}.laneShareEpoch`),
 		laneKind: parseSigningLaneKind(record.laneKind, `${label}.laneKind`),
-		participantBindingDigestB64u: requireResult(parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u), `${label}.participantBindingDigestB64u`)
+		participantBindingDigestB64u: requireParsed(parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u), `${label}.participantBindingDigestB64u`)
 	});
 }
 function parseSigningLaneRecordCommon(record, label) {
@@ -215,7 +211,7 @@ function parseOwnerAuthSigningLaneRecordBase(record, label) {
 	const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
 	return {
 		...common,
-		walletAuthMethodId: requireResult(walletAuthMethodId, `${label}.walletAuthMethodId`),
+		walletAuthMethodId: requireParsed(walletAuthMethodId, `${label}.walletAuthMethodId`),
 		ownerParticipantContinuity: parseOwnerLaneParticipantContinuityV1(record.ownerParticipantContinuity, `${label}.ownerParticipantContinuity`)
 	};
 }
@@ -411,8 +407,8 @@ function parseWalletKeyRecord(raw, label = "walletKeyRecord") {
 	if (record.keyFamily === "ed25519") {
 		rejectUnknownFields(record, ED25519_WALLET_KEY_FIELDS, label, ALL_WALLET_KEY_FIELDS);
 		return buildEd25519WalletKeyRecord({
-			walletId: requireResult(parseWalletId(record.walletId), `${label}.walletId`),
-			walletKeyId: requireResult(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
+			walletId: requireParsed(parseWalletId(record.walletId), `${label}.walletId`),
+			walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
 			walletKeyVersion: parseWalletKeyVersion(record.walletKeyVersion, `${label}.walletKeyVersion`),
 			nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(record.nearEd25519SigningKeyId),
 			keyCreationSignerSlot: parseKeyCreationSignerSlot(record.keyCreationSignerSlot, `${label}.keyCreationSignerSlot`),
@@ -423,8 +419,8 @@ function parseWalletKeyRecord(raw, label = "walletKeyRecord") {
 	if (record.keyFamily === "ecdsa_secp256k1") {
 		rejectUnknownFields(record, EVM_WALLET_KEY_FIELDS, label, ALL_WALLET_KEY_FIELDS);
 		return buildEvmFamilyWalletKeyRecord({
-			walletId: requireResult(parseWalletId(record.walletId), `${label}.walletId`),
-			walletKeyId: requireResult(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
+			walletId: requireParsed(parseWalletId(record.walletId), `${label}.walletId`),
+			walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
 			walletKeyVersion: parseWalletKeyVersion(record.walletKeyVersion, `${label}.walletKeyVersion`),
 			evmFamilySigningKeySlotId: requireEvmFamilySigningKeySlotId(record.evmFamilySigningKeySlotId, `${label}.evmFamilySigningKeySlotId`),
 			thresholdPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.thresholdPublicKey33B64u, `${label}.thresholdPublicKey33B64u`),
@@ -453,7 +449,7 @@ function parseSigningLaneRecord(raw, label = "signingLaneRecord") {
 				holderParticipant: base.holderParticipant,
 				serverParticipant: base.serverParticipant,
 				lifecycle: base.lifecycle,
-				linkedDeviceId: requireResult(parseLinkedDeviceId(record.linkedDeviceId), `${label}.linkedDeviceId`)
+				linkedDeviceId: requireParsed(parseLinkedDeviceId(record.linkedDeviceId), `${label}.linkedDeviceId`)
 			});
 		}
 		case "delegated_execution": {

package/dist/esm/shared-ts/src/threshold/signingRootScope.js

@@ -28,6 +28,9 @@ function normalizeRuntimePolicyScopeFields(input) {
 		...normalizeOptionalTrimmedString(scope.signingRootVersion) ? { signingRootVersion: normalizeOptionalTrimmedString(scope.signingRootVersion) } : {}
 	};
 }
+function sameRuntimePolicyScope(left, right) {
+	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
+}
 function signingRootScopeFromRuntimePolicyScope(scope) {
 	return {
 		signingRootId: deriveSigningRootId(scope),
@@ -35,6 +38,6 @@ function signingRootScopeFromRuntimePolicyScope(scope) {
 	};
 }
 //#endregion
-export { deriveSigningRootId, normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope };
+export { deriveSigningRootId, normalizeRuntimePolicyScope, sameRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope };
 
 //# sourceMappingURL=signingRootScope.js.map

package/dist/esm/shared-ts/src/utils/ecdsaKeyFactsInventory.js

@@ -1,10 +1,8 @@
 import { base64UrlEncode } from "./base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
 import "./encoders.js";
+import { thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
 //#region ../shared-ts/src/utils/ecdsaKeyFactsInventory.ts
-function chainTargetKey(target) {
-	return target.kind === "evm" ? `evm:eip155:${target.chainId}` : `tempo:${target.chainId}`;
-}
 function normalizeChainTarget(target) {
 	if (target.kind === "evm") return {
 		kind: "evm",
@@ -22,7 +20,7 @@ function canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input) {
 	const keyTargets = input.keyTargets.map((target) => ({
 		keyHandle: target.keyHandle,
 		chainTarget: normalizeChainTarget(target.chainTarget),
-		targetKey: chainTargetKey(target.chainTarget)
+		targetKey: thresholdEcdsaChainTargetKey(target.chainTarget)
 	})).sort((left, right) => {
 		const leftKey = `${left.keyHandle}:${left.targetKey}`;
 		const rightKey = `${right.keyHandle}:${right.targetKey}`;

package/dist/esm/shared-ts/src/utils/ecdsaServerTiming.js

@@ -5,7 +5,6 @@ const ECDSA_TIMING_METRICS = new Set([
 	"ecdsa_sign_proxy",
 	"ecdsa_sign_complete",
 	"ecdsa_sign_total",
-	"ecdsa_presign_queue",
 	"ecdsa_presign_authenticate",
 	"ecdsa_presign_material",
 	"ecdsa_presign_admit",

package/dist/esm/shared-ts/src/utils/exactKeys.js

@@ -0,0 +1,17 @@
+//#region ../shared-ts/src/utils/exactKeys.ts
+/**
+* True when `value` is a non-array object whose own enumerable string keys are exactly `keys`.
+*
+* A key whose value is `undefined` still counts as present. Symbol, non-enumerable and inherited
+* keys are not counted, and the prototype is not checked. A list that repeats a key never matches.
+* Kept apart from validation.ts, which the wallet iframe's boot path loads.
+*/
+function hasExactKeys(value, keys) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const actual = Object.keys(value);
+	return actual.length === keys.length && actual.every((key) => keys.includes(key));
+}
+//#endregion
+export { hasExactKeys };
+
+//# sourceMappingURL=exactKeys.js.map

package/dist/esm/shared-ts/src/utils/registrationIntent.js

@@ -11,17 +11,11 @@ function addAuthMethodIntentGrantFromString(value) {
 function addSignerIntentGrantFromString(value) {
 	return String(value || "").trim();
 }
-function serializeRegistrationIntentV1(intent) {
-	return alphabetizeStringify(intent);
-}
-function serializeAddAuthMethodIntentV1(intent) {
-	return alphabetizeStringify(intent);
-}
 async function computeRegistrationIntentDigestB64u(intent) {
-	return base64UrlEncode(await sha256BytesUtf8(serializeRegistrationIntentV1(intent)));
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(intent)));
 }
 async function computeAddAuthMethodIntentDigestB64u(intent) {
-	return base64UrlEncode(await sha256BytesUtf8(serializeAddAuthMethodIntentV1(intent)));
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(intent)));
 }
 function normalizeAddAuthMethodIntentCaller(raw) {
 	const record = inspectRawObject(raw);

package/dist/esm/shared-ts/src/utils/registrationSignerPlan.js

@@ -75,11 +75,8 @@ function registrationSignerBranchKeyFromString(value) {
 function registrationNearEd25519BranchKey(signerSlot) {
 	return registrationSignerBranchKeyFromString(`near_ed25519:slot:${signerSlot}`);
 }
-function registrationEvmFamilyEcdsaTargetKey(target) {
-	return alphabetizeStringify(target);
-}
 function registrationEvmFamilyEcdsaBranchKey(chainTargets) {
-	return registrationSignerBranchKeyFromString(`evm_family_ecdsa:${chainTargets.map(registrationEvmFamilyEcdsaTargetKey).join("|")}`);
+	return registrationSignerBranchKeyFromString(`evm_family_ecdsa:${chainTargets.map(alphabetizeStringify).join("|")}`);
 }
 function registrationSignerPlanFromRequests(signers) {
 	return registrationSignerPlanFromBranches(signers.map(registrationSignerPlanBranchFromRequest));
@@ -163,7 +160,7 @@ function findDuplicateRegistrationSignerBranch(branch, branchKeys) {
 }
 function findDuplicateRegistrationEcdsaTarget(branch, ecdsaTargetKeys) {
 	for (const target of branch.chainTargets) {
-		const targetKey = registrationEvmFamilyEcdsaTargetKey(target);
+		const targetKey = alphabetizeStringify(target);
 		if (ecdsaTargetKeys.has(targetKey)) return {
 			ok: false,
 			code: "invalid_body",

package/dist/esm/shared-ts/src/utils/routerAbEcdsaDerivation.js

@@ -1329,6 +1329,6 @@ async function parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreReques
 	return response;
 }
 //#endregion
-export { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreRequestV1, parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaExplicitExportForwardedResponseV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaOperationStepUpAuthorizationResponseV1, parseRouterAbEcdsaOperationStepUpPreparationV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaRegistrationPublicActivationReceiptV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaSigningWorkerExportShareEnvelopeV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1, requireRouterAbEcdsaDerivationNormalSigningStateV1, routerAbEcdsaDerivationActiveStateId, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1, routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1, routerAbEcdsaRerandomizationClientCommitmentV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire, sameRouterAbServerIdentityV1 };
+export { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreRequestV1, parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaExplicitExportForwardedResponseV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaOperationStepUpAuthorizationResponseV1, parseRouterAbEcdsaOperationStepUpPreparationV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaRegistrationPublicActivationReceiptV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaSigningWorkerExportShareEnvelopeV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1, requireRouterAbEcdsaDerivationNormalSigningStateV1, routerAbEcdsaDerivationActiveStateId, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1, routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1, routerAbEcdsaRerandomizationClientCommitmentV1, sameRegistrationRecipientKeys, sameRegistrationSignerSet, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire, sameRouterAbServerIdentityV1 };
 
 //# sourceMappingURL=routerAbEcdsaDerivation.js.map

package/dist/esm/shared-ts/src/utils/routerAbEd25519Yao.js

@@ -742,6 +742,6 @@ function parseEncryptedPackageValue(value) {
 	return parseEncryptedPackage(value, "encrypted_package");
 }
 //#endregion
-export { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 };
+export { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoByteSequence, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 };
 
 //# sourceMappingURL=routerAbEd25519Yao.js.map

package/dist/esm/shared-ts/src/utils/thresholdEcdsaChainTarget.js

@@ -0,0 +1,9 @@
+//#region ../shared-ts/src/utils/thresholdEcdsaChainTarget.ts
+function thresholdEcdsaChainTargetKey(target) {
+	if (target.kind === "evm") return `evm:eip155:${target.chainId}`;
+	return `tempo:${target.chainId}`;
+}
+//#endregion
+export { thresholdEcdsaChainTargetKey };
+
+//# sourceMappingURL=thresholdEcdsaChainTarget.js.map

package/dist/esm/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js

@@ -47,7 +47,7 @@ function buildGoogleEmailOtpProjection(input) {
 			providerSubject: input.providerSubject,
 			emailHashHex: requireEmailHash(input.emailHashHex),
 			registrationAuthorityId: requireTrimmedString(input.registrationAuthorityId, "registrationAuthorityId", "is invalid"),
-			enrollment: buildEnrollmentReference(input.enrollment)
+			enrollment: parseEnrollmentReference(input.enrollment)
 		}
 	};
 	assertProjectionShape(projection);
@@ -133,9 +133,6 @@ function parseEnrollmentReference(raw) {
 		enrollmentSealKeyVersion: requireTrimmedString(record.enrollmentSealKeyVersion, "enrollment.enrollmentSealKeyVersion", "is invalid")
 	};
 }
-function buildEnrollmentReference(value) {
-	return parseEnrollmentReference(value);
-}
 function assertExpectedIdentity(projection, expected) {
 	if (projection.kind !== expected.kind || projection.walletId !== expected.walletId || projection.recoveryOperationId !== expected.recoveryOperationId || projection.targetDeviceId !== expected.targetDeviceId || projection.targetAuthorityId !== expected.targetAuthorityId || projection.targetWalletAuthMethodId !== expected.targetWalletAuthMethodId) throw new Error("wallet recovery committed projection identity changed");
 	if (projection.kind === "passkey" && expected.kind === "passkey") {

package/dist/esm/utils/menuItemBlink.js

@@ -0,0 +1,24 @@
+//#region src/utils/menuItemBlink.ts
+const MENU_ITEM_BLINK_PHASE_MS = 90;
+const waitForBlinkPhase = () => new Promise((resolve) => setTimeout(resolve, MENU_ITEM_BLINK_PHASE_MS));
+/**
+* Blinks a chosen menu item once, highlight off and then on again, so the menu
+* confirms which item was picked before it closes, as macOS menus do. The item's
+* stylesheet renders `data-blink="off"` and `data-blink="on"`.
+*
+* Returns null while the item is already blinking, so a double click commits once.
+*/
+function blinkMenuItem(item) {
+	if (item.dataset.blink) return null;
+	item.dataset.blink = "off";
+	return waitForBlinkPhase().then(() => {
+		item.dataset.blink = "on";
+		return waitForBlinkPhase();
+	}).then(() => {
+		delete item.dataset.blink;
+	});
+}
+//#endregion
+export { blinkMenuItem };
+
+//# sourceMappingURL=menuItemBlink.js.map

package/dist/esm/wasm/near_signer/pkg/wasm_signer_worker.d.ts

@@ -821,6 +821,7 @@ export interface InitOutput {
   readonly __wbg_get_workerprogressmessage_status: (a: number) => [number, number];
   readonly __wbg_get_wasmtransaction_publicKey: (a: number) => number;
   readonly __wbg_get_wasmtransaction_nonce: (a: number) => bigint;
+  readonly __wbg_set_wasmsignedtransaction_signature: (a: number, b: number) => void;
   readonly __wbg_set_derivethresholded25519clientverifyingsharerequest_wrapKeySalt: (a: number, b: number, c: number) => void;
   readonly __wbg_set_keyactionresult_error: (a: number, b: number, c: number) => void;
   readonly __wbg_set_keyactionresult_transactionHash: (a: number, b: number, c: number) => void;
@@ -830,7 +831,6 @@ export interface InitOutput {
   readonly __wbg_set_webauthnauthenticationcredentialstruct_user_handle: (a: number, b: number, c: number) => void;
   readonly __wbg_set_webauthnregistrationcredentialstruct_ed25519_prf_output: (a: number, b: number, c: number) => void;
   readonly wasmsignature_new: (a: number, b: number, c: number) => number;
-  readonly __wbg_set_wasmsignedtransaction_signature: (a: number, b: number) => void;
   readonly __wbg_set_wasmsignedtransaction_borshBytes: (a: number, b: number, c: number) => void;
   readonly __wbg_set_transactioncontext_nextNonce: (a: number, b: number, c: number) => void;
   readonly __wbg_set_rpccallpayload_nearAccountId: (a: number, b: number, c: number) => void;

package/dist/public/headers.manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "packageName": "@seams/wallet",
-  "packageVersion": "0.7.1",
+  "packageVersion": "0.7.3",
   "assetRoot": "dist/public",
   "routeClasses": [
     {

package/dist/public/sdk/{accountLifecycle-BAGG_rbk.js → accountLifecycle-zthG08aC.js}

@@ -8,7 +8,7 @@ import { a as toIndexedDbChainTargetKey, t as normalizeIndexedDbAccountAddress }
 import { t as toAccountId } from "./accountIds-DhIPGOSN.js";
 import { i as nearEd25519SigningKeyIdFromString } from "./registrationIds-DLSdEKSv.js";
 import { t as parseSignerSlot } from "./signerSlot-_ovonwVX.js";
-import { t as NEAR_ED25519_YAO_KEY_VERSION_V1 } from "./registrationSignerPlan-CAikVZZQ.js";
+import { t as NEAR_ED25519_YAO_KEY_VERSION_V1 } from "./registrationSignerPlan-DhV8VAob.js";
 import { a as getNearChainCandidates, i as buildNearAccountRefs, n as resolveProfileAccountContextFromCandidates, o as inferNearChainIdKey, r as resolveProfileAccountProjection, t as getLastSelectedProfileAccountByChain } from "./profileAccountProjection-uZVJuBvS.js";
 //#region src/core/accountData/near/profileId.ts
 const NEAR_PROFILE_PREFIX = "near-profile";

package/dist/public/sdk/{adapters-B4JeK1nJ.js → adapters-Dli9XAZp.js}

@@ -6,7 +6,7 @@ import { c as resolveExplorerUrlForChainFamily } from "./chains-BMh3btVo.js";
 import { t as toAccountId } from "./accountIds-DhIPGOSN.js";
 import { p as nonceLeaseToRef } from "./nonceLaneKeys-C3c9lG6u.js";
 import { i as buildNearAccountRefs, n as resolveProfileAccountContextFromCandidates } from "./profileAccountProjection-uZVJuBvS.js";
-import { u as emitSigningSessionFlowTrace } from "./trace-rHe0wz7q.js";
+import { u as emitSigningSessionFlowTrace } from "./trace-DKLQZvec.js";
 import { a as toActionArgsWasm, i as isActionArgsWasm, r as fromTransactionInputsWasm, t as ActionType } from "./actions-CCvThiKe.js";
 import { i as orderActionForDigest, r as computeUiIntentDigestFromTxs } from "./intentDigest-CvOSNlCH.js";
 import { t as createWalletIframeSurfaceMeasurementReporter } from "./surface-measurement-reporter-CSTyRsMa.js";
@@ -630,30 +630,6 @@ const renderFallbackDisplayOperation = ({ operation, depth, path, renderChild })
 	};
 };
 //#endregion
-//#region src/core/signingEngine/uiConfirm/ui/transaction-display/renderers/near.ts
-function isNearDisplayOperation(operation) {
-	return operation.kind === "near.action";
-}
-const renderNearDisplayOperation = (args) => {
-	return renderFallbackDisplayOperation(args);
-};
-//#endregion
-//#region src/core/signingEngine/uiConfirm/ui/transaction-display/renderers/evm.ts
-function isEvmDisplayOperation(operation) {
-	return operation.kind === "generic.contractCall";
-}
-const renderEvmDisplayOperation = (args) => {
-	return renderFallbackDisplayOperation(args);
-};
-//#endregion
-//#region src/core/signingEngine/uiConfirm/ui/transaction-display/renderers/tempo.ts
-function isTempoDisplayOperation(operation) {
-	return operation.kind === "tempo.eip2718";
-}
-const renderTempoDisplayOperation = (args) => {
-	return renderFallbackDisplayOperation(args);
-};
-//#endregion
 //#region src/core/signingEngine/uiConfirm/ui/transaction-display/tree.ts
 function toChainLabel(chain) {
 	switch (chain) {
@@ -678,14 +654,8 @@ function buildWarningNodes(warnings) {
 		}))
 	}];
 }
-function selectOperationRenderer(operation) {
-	if (isNearDisplayOperation(operation)) return renderNearDisplayOperation;
-	if (isEvmDisplayOperation(operation)) return renderEvmDisplayOperation;
-	if (isTempoDisplayOperation(operation)) return renderTempoDisplayOperation;
-	return renderFallbackDisplayOperation;
-}
 function renderOperationNode(operation, depth, path) {
-	return selectOperationRenderer(operation)({
+	return renderFallbackDisplayOperation({
 		operation,
 		depth,
 		path,
@@ -3449,6 +3419,21 @@ var TransactionReceipt = class extends C {
 		if (row.ownerDocument.defaultView?.matchMedia("(prefers-reduced-motion: reduce)").matches) return;
 		const height = row.getBoundingClientRect().height;
 		row.dataset.opening = "";
+		const showLink = () => {
+			this.releaseExplorerRow();
+			link.animate([{
+				opacity: 0,
+				filter: "blur(4px)",
+				transform: "translateY(6px)"
+			}, {
+				opacity: 1,
+				filter: "blur(0)",
+				transform: "translateY(0)"
+			}], {
+				duration: EXPLORER_REVEAL_MS,
+				easing: EXPLORER_REVEAL_EASING
+			});
+		};
 		if (!announceClampedSurfaceResize({
 			reason: "receipt-explorer",
 			element: row,
@@ -3456,28 +3441,15 @@ var TransactionReceipt = class extends C {
 			toCssPx: height,
 			drivenClasses: ["seams-receipt-explorer-driven"],
 			setHeightCssPx: this.setExplorerRowHeight,
-			onSettled: this.releaseExplorerRow
+			onSettled: showLink
 		})) {
 			const opening = row.animate([{ height: "0px" }, { height: `${height}px` }], {
 				duration: EXPLORER_REVEAL_MS,
 				easing: EXPLORER_REVEAL_EASING
 			});
-			opening.onfinish = opening.oncancel = this.releaseExplorerRow;
+			opening.onfinish = showLink;
+			opening.oncancel = this.releaseExplorerRow;
 		}
-		link.animate([{
-			opacity: 0,
-			filter: "blur(4px)",
-			transform: "translateY(6px)"
-		}, {
-			opacity: 1,
-			filter: "blur(0)",
-			transform: "translateY(0)"
-		}], {
-			duration: EXPLORER_REVEAL_MS,
-			delay: 60,
-			easing: EXPLORER_REVEAL_EASING,
-			fill: "backwards"
-		});
 	}
 	render() {
 		const { receipt, data } = this.props;

package/dist/{esm/sdk/canonicalSignerErrorCode-CRoJMVpp.js → public/sdk/canonicalSignerErrorCode-BBIk365e.js}

@@ -15,20 +15,6 @@ const CANONICAL_SIGNER_CODES = new Set([
 	"rpc_request_failed",
 	"cancelled"
 ]);
-const SIGNER_BOUNDARY_REQUEST_TYPES = new Set([
-	"PM_SIGN_TEMPO",
-	"PM_REPORT_TEMPO_BROADCAST_ACCEPTED",
-	"PM_REPORT_TEMPO_BROADCAST_REJECTED",
-	"PM_REPORT_TEMPO_FINALIZED",
-	"PM_REPORT_TEMPO_DROPPED_OR_REPLACED",
-	"PM_RECONCILE_TEMPO_NONCE_LANE",
-	"PM_SIGN_TX_WITH_ACTIONS",
-	"PM_SIGN_AND_SEND_TX",
-	"PM_SEND_TRANSACTION",
-	"PM_EXECUTE_ACTION",
-	"PM_SIGN_DELEGATE_ACTION",
-	"PM_SIGN_NEP413"
-]);
 const THRESHOLD_ECDSA_REQUEST_TYPES = new Set([
 	"PM_SIGN_TEMPO",
 	"PM_REPORT_TEMPO_BROADCAST_ACCEPTED",
@@ -117,7 +103,7 @@ function inferCanonicalCodeFromMessage(args) {
 	return null;
 }
 function isWalletSignerBoundaryRequestType(value) {
-	return typeof value === "string" && SIGNER_BOUNDARY_REQUEST_TYPES.has(value);
+	return typeof value === "string" && (THRESHOLD_ECDSA_REQUEST_TYPES.has(value) || THRESHOLD_ED25519_REQUEST_TYPES.has(value));
 }
 function resolveCanonicalWalletSignerErrorCode(args) {
 	const fromMessage = isWalletSignerBoundaryRequestType(args.requestType) ? inferCanonicalCodeFromMessage({

package/dist/public/sdk/{challengeDelivery-Dd0586fo.js → challengeDelivery-DZtopOAG.js}

@@ -1,5 +1,5 @@
 import { y as requireTrimmedString } from "./validation-gat4LEKm.js";
-import { _t as parseSdkEcdsaDerivationSigningRootId, vt as parseSdkEcdsaDerivationSigningRootVersion, yt as parseSdkEcdsaDerivationThresholdKeyId } from "./ecdsaPresignLifecycle-BFOTNYCK.js";
+import { bt as parseSdkEcdsaDerivationSigningRootVersion, xt as parseSdkEcdsaDerivationThresholdKeyId, yt as parseSdkEcdsaDerivationSigningRootId } from "./ecdsaPresignLifecycle-Bfx2AQKb.js";
 //#region src/core/signingEngine/session/identity/emailOtpEcdsaDerivationIdentity.ts
 function requiredEmailOtpDerivationString(value, field) {
 	const normalized = String(value ?? "").trim();

package/dist/{esm/sdk/configHelpers-vAQCzUD0.js → public/sdk/configHelpers-D1EqxVxg.js}

@@ -1,5 +1,5 @@
 import { B as normalizeTrimmedString } from "./domainIds-lcrFg6Sa.js";
-import { p as coerceThemeMode, s as parsePositiveSessionUses } from "./sessionPolicy-CHiilOAB.js";
+import { p as coerceThemeMode, s as parsePositiveSessionUses } from "./sessionPolicy-DO-MkL65.js";
 import { a as isNearChainNetwork, i as isEvmChainNetwork, o as isSeamsChainNetwork, s as isTempoChainNetwork } from "./chains-BMh3btVo.js";
 //#region src/core/config/configHelpers.ts
 function resolveIntegerInRange(args) {

package/dist/{esm/sdk/defaultConfigs-B3c16M_8.js → public/sdk/defaultConfigs-D_33pPT9.js}

@@ -1,8 +1,8 @@
 import { B as normalizeTrimmedString } from "./domainIds-lcrFg6Sa.js";
-import { n as DEFAULT_THRESHOLD_SESSION_TTL_MS } from "./sessionPolicy-CHiilOAB.js";
-import { n as UserVerificationPolicy } from "./ecdsaPresignLifecycle-BFOTNYCK.js";
+import { n as DEFAULT_THRESHOLD_SESSION_TTL_MS } from "./sessionPolicy-DO-MkL65.js";
+import { n as UserVerificationPolicy } from "./ecdsaPresignLifecycle-Bfx2AQKb.js";
 import { a as SIGNING_SESSION_SEAL_ALG, o as SIGNING_SESSION_SEAL_GROUP_ID } from "./signingSessionSeal-Cu-GHm6y.js";
-import { a as resolveIntegerInRange, i as resolveChains, n as resolveAppearanceTheme, o as resolveThemePalette, r as resolveBoolean, t as copyEcdsaSignerProvisioningDefaults } from "./configHelpers-vAQCzUD0.js";
+import { a as resolveIntegerInRange, i as resolveChains, n as resolveAppearanceTheme, o as resolveThemePalette, r as resolveBoolean, t as copyEcdsaSignerProvisioningDefaults } from "./configHelpers-D1EqxVxg.js";
 //#region src/core/browser/walletIframe/hostVariant.ts
 function normalizeWalletHostVariant(value) {
 	const normalized = String(value || "").trim().toLowerCase();

package/dist/public/sdk/{display-KdIL0ff7.js → display-P4nQF-yc.js}

@@ -1,5 +1,5 @@
 import { i as normalizeHexData } from "./bytes-qKxKn4gg.js";
-import { f as formatCompactGas, h as selectorFromHexData, m as resolveFunctionDisplayName, p as formatCalldataForDisplay } from "./signingFlow-rZfPegH9.js";
+import { f as formatCompactGas, h as selectorFromHexData, m as resolveFunctionDisplayName, p as formatCalldataForDisplay } from "./signingFlow-SZ8t_lxv.js";
 //#region src/core/signingEngine/chains/tempo/display.ts
 function toSafeJson(value) {
 	try {

package/dist/public/sdk/{ecdsaCapabilityManifest-kzO_fW09.js → ecdsaCapabilityManifest-DuMs0VtU.js}

@@ -1,11 +1,11 @@
 import { r as mpcMaterialActivationRefsEqual } from "./domainIds-lcrFg6Sa.js";
 import { i as base64UrlEncode, r as base64UrlDecode } from "./base64-Clm8C-e9.js";
-import { h as normalizeRuntimePolicyScope, m as deriveSigningRootId } from "./sessionPolicy-CHiilOAB.js";
-import { Ct as routerAbMpcMaterialActivationRefFromWire, E as parseRouterAbEcdsaRegistrationActivationReceiptV1, Tt as sameRouterAbMpcMaterialActivationRef, it as parseEcdsaActivationDigest, ut as parseEcdsaLifecycleId, v as parseRouterAbEcdsaDerivationPublicCapabilityV1, wt as routerAbMpcMaterialActivationRefToWire } from "./ecdsaPresignLifecycle-BFOTNYCK.js";
+import { h as normalizeRuntimePolicyScope, m as deriveSigningRootId } from "./sessionPolicy-DO-MkL65.js";
+import { Dt as sameRouterAbMpcMaterialActivationRef, E as parseRouterAbEcdsaRegistrationActivationReceiptV1, Et as routerAbMpcMaterialActivationRefToWire, G as sameRouterAbServerIdentityV1, H as sameRouterAbEcdsaDerivationPublicIdentityV1, L as sameRegistrationRecipientKeys, R as sameRegistrationSignerSet, Tt as routerAbMpcMaterialActivationRefFromWire, ft as parseEcdsaLifecycleId, ot as parseEcdsaActivationDigest, v as parseRouterAbEcdsaDerivationPublicCapabilityV1 } from "./ecdsaPresignLifecycle-Bfx2AQKb.js";
 import { t as isoTimestampFromUnixMs } from "./canonicalPrimitives-BTHWz80v.js";
 import { a as thresholdEcdsaChainTargetFromRequest, c as toWalletId, o as thresholdEcdsaChainTargetKey, s as thresholdEcdsaChainTargetsEqual } from "./ecdsaChainTarget-Bl-JWyuw.js";
-import { x as toRpId } from "./evmFamilyEcdsaIdentity-Co5XDcEA.js";
-import { a as toEcdsaDerivationThresholdKeyId, i as toEcdsaDerivationSigningRootVersion, o as toEmailOtpAuthSubjectId, r as toEcdsaDerivationSigningRootId } from "./challengeDelivery-Dd0586fo.js";
+import { x as toRpId } from "./evmFamilyEcdsaIdentity-CqGafQsI.js";
+import { a as toEcdsaDerivationThresholdKeyId, i as toEcdsaDerivationSigningRootVersion, o as toEmailOtpAuthSubjectId, r as toEcdsaDerivationSigningRootId } from "./challengeDelivery-DZtopOAG.js";
 //#region src/core/signingEngine/session/persistence/ecdsaRoleLocalRecords.ts
 function assertNever$1(value) {
 	throw new Error(`Unhandled ECDSA role-local branch: ${String(value)}`);
@@ -777,20 +777,8 @@ function assertDurableMaterialMatchesActivation(durableMaterial, activationBindi
 		receipt: receipt.protocolReceipt
 	});
 }
-function routerAbEcdsaPublicIdentitiesEqual(left, right) {
-	return left.context_binding_b64u === right.context_binding_b64u && left.derivation_client_share_public_key33_b64u === right.derivation_client_share_public_key33_b64u && left.server_public_key33_b64u === right.server_public_key33_b64u && left.threshold_public_key33_b64u === right.threshold_public_key33_b64u && left.ethereum_address20_b64u === right.ethereum_address20_b64u && left.client_share_retry_counter === right.client_share_retry_counter && left.server_share_retry_counter === right.server_share_retry_counter;
-}
-function routerAbServerIdentitiesEqual(left, right) {
-	return left.server_id === right.server_id && left.key_epoch === right.key_epoch && left.recipient_encryption_key === right.recipient_encryption_key;
-}
-function routerAbEcdsaSignerSetsEqual(left, right) {
-	return left.signer_set_id === right.signer_set_id && left.policy === right.policy && left.signer_a.role === right.signer_a.role && left.signer_a.signer_id === right.signer_a.signer_id && left.signer_a.key_epoch === right.signer_a.key_epoch && left.signer_b.role === right.signer_b.role && left.signer_b.signer_id === right.signer_b.signer_id && left.signer_b.key_epoch === right.signer_b.key_epoch && routerAbServerIdentitiesEqual(left.selected_server, right.selected_server);
-}
-function routerAbEcdsaRecipientKeysEqual(left, right) {
-	return left.deriver_a.role === right.deriver_a.role && left.deriver_a.key_epoch === right.deriver_a.key_epoch && left.deriver_a.public_key === right.deriver_a.public_key && left.deriver_b.role === right.deriver_b.role && left.deriver_b.key_epoch === right.deriver_b.key_epoch && left.deriver_b.public_key === right.deriver_b.public_key;
-}
 function routerAbEcdsaDerivationPublicCapabilitiesEqual(left, right) {
-	return left.kind === right.kind && left.context.application_binding_digest_b64u === right.context.application_binding_digest_b64u && routerAbEcdsaPublicIdentitiesEqual(left.public_identity, right.public_identity) && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation) && routerAbEcdsaSignerSetsEqual(left.signer_set, right.signer_set) && routerAbEcdsaRecipientKeysEqual(left.deriver_recipient_keys, right.deriver_recipient_keys) && left.router_id === right.router_id && left.client_id === right.client_id && left.activation_epoch === right.activation_epoch && left.registration_request_digest_b64u === right.registration_request_digest_b64u && left.proof_transcript_digest_b64u === right.proof_transcript_digest_b64u;
+	return left.kind === right.kind && left.context.application_binding_digest_b64u === right.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(left.public_identity, right.public_identity) && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation) && sameRegistrationSignerSet(left.signer_set, right.signer_set) && sameRegistrationRecipientKeys(left.deriver_recipient_keys, right.deriver_recipient_keys) && left.router_id === right.router_id && left.client_id === right.client_id && left.activation_epoch === right.activation_epoch && left.registration_request_digest_b64u === right.registration_request_digest_b64u && left.proof_transcript_digest_b64u === right.proof_transcript_digest_b64u;
 }
 function assertNormalSigningMatchesActivation(input) {
 	const scope = input.normalSigning.scope;
@@ -805,7 +793,7 @@ function assertNormalSigningMatchesActivation(input) {
 		lifecycleBinding: expectedMaterialActivation.lifecycleBinding,
 		signingWorker: expectedMaterialActivation.signingWorker
 	});
-	if (scope.wallet_id !== String(input.activationBinding.signer.walletId) || scope.ecdsa_threshold_key_id !== String(input.activationBinding.roleLocalBinding.ecdsaThresholdKeyId) || scope.signing_root_id !== String(input.activationBinding.signer.signingRootId) || scope.signing_root_version !== String(input.activationBinding.signer.signingRootVersion) || scope.context.application_binding_digest_b64u !== input.receipt.ecdsa_activation.context.application_binding_digest_b64u || !routerAbEcdsaPublicIdentitiesEqual(scope.public_identity, input.receipt.ecdsa_activation.public_identity) || !routerAbServerIdentitiesEqual(scope.signing_worker, input.receipt.ecdsa_activation.signing_worker) || scope.activation_epoch !== input.receipt.ecdsa_activation.activation_epoch || scope.public_identity.context_binding_b64u !== facts.contextBinding32B64u || scope.public_identity.derivation_client_share_public_key33_b64u !== facts.derivationClientSharePublicKey33B64u || scope.public_identity.server_public_key33_b64u !== facts.relayerPublicKey33B64u || scope.public_identity.threshold_public_key33_b64u !== facts.groupPublicKey33B64u || !sameRouterAbMpcMaterialActivationRef(scope.material_activation, expectedMaterialActivationWire)) throw new Error("ECDSA normal-signing runtime does not match its activation");
+	if (scope.wallet_id !== String(input.activationBinding.signer.walletId) || scope.ecdsa_threshold_key_id !== String(input.activationBinding.roleLocalBinding.ecdsaThresholdKeyId) || scope.signing_root_id !== String(input.activationBinding.signer.signingRootId) || scope.signing_root_version !== String(input.activationBinding.signer.signingRootVersion) || scope.context.application_binding_digest_b64u !== input.receipt.ecdsa_activation.context.application_binding_digest_b64u || !sameRouterAbEcdsaDerivationPublicIdentityV1(scope.public_identity, input.receipt.ecdsa_activation.public_identity) || !sameRouterAbServerIdentityV1(scope.signing_worker, input.receipt.ecdsa_activation.signing_worker) || scope.activation_epoch !== input.receipt.ecdsa_activation.activation_epoch || scope.public_identity.context_binding_b64u !== facts.contextBinding32B64u || scope.public_identity.derivation_client_share_public_key33_b64u !== facts.derivationClientSharePublicKey33B64u || scope.public_identity.server_public_key33_b64u !== facts.relayerPublicKey33B64u || scope.public_identity.threshold_public_key33_b64u !== facts.groupPublicKey33B64u || !sameRouterAbMpcMaterialActivationRef(scope.material_activation, expectedMaterialActivationWire)) throw new Error("ECDSA normal-signing runtime does not match its activation");
 }
 function assertValidEcdsaReplacement(active, replacement) {
 	if (active.identity.manifestId === replacement.identity.manifestId || Number(replacement.identity.manifestRevision) !== Number(active.identity.manifestRevision) + 1 || active.signer.capability !== replacement.signer.capability || active.signer.signerId !== replacement.signer.signerId || active.signer.walletId !== replacement.signer.walletId || active.signer.authority.authorityDigest !== replacement.signer.authority.authorityDigest || active.signer.materialOwner !== replacement.signer.materialOwner || active.durableMaterial.durableMaterialRef === replacement.durableMaterial.durableMaterialRef || active.activation.serverActivation.serverGeneration === replacement.activation.serverActivation.serverGeneration) throw new Error("ECDSA replacement manifest does not exactly replace the active manifest");

package/dist/{esm/sdk/ecdsaPresignLifecycle-BFOTNYCK.js → public/sdk/ecdsaPresignLifecycle-Bfx2AQKb.js}

@@ -1,7 +1,7 @@
 import { D as parseWalletAuthorityId, E as parseWalletAuthorityBindingDigest, M as parseWebAuthnRpId, O as parseWalletId, T as parseWalletAuthMethodId, a as parseEcdsaActiveStateId, d as parseLinkedDeviceId, h as parseMpcMaterialActivationRef, j as parseWebAuthnCredentialIdB64u, k as parseWalletKeyId, l as parseLinkDeviceSessionId, r as mpcMaterialActivationRefsEqual, s as parseEmailOtpProviderUserId, u as parseLinkedDeviceEnrollmentId, w as parseVerifiedEmailAddress, x as parseThresholdEcdsaSessionId, y as parseRootShareEpoch } from "./domainIds-lcrFg6Sa.js";
 import { _ as requireRecord, i as coerceNonEmptyString } from "./validation-gat4LEKm.js";
 import { i as base64UrlEncode, r as base64UrlDecode } from "./base64-Clm8C-e9.js";
-import { A as parseDelegatedWalletAuthorityV1, E as parseUnixMs, N as exactRecord, P as rejectUnknownFields, _ as deriveEvmFamilySigningKeySlotId, h as normalizeRuntimePolicyScope } from "./sessionPolicy-CHiilOAB.js";
+import { D as parseUnixMs, F as exactRecord, I as rejectUnknownFields, M as parseDelegatedWalletAuthorityV1, h as normalizeRuntimePolicyScope, v as deriveEvmFamilySigningKeySlotId } from "./sessionPolicy-DO-MkL65.js";
 import { d as parseMpcWalletSigningQuotaId, g as parseWalletSessionMintId, h as parseWalletSessionId, l as parseDeviceId, m as parseWalletSessionAuthorizationId, n as EVM_ECDSA_MPC_OPERATION_KINDS, u as parseEcdsaAuthorizationSessionId } from "./capabilityKinds-hvYqa6S_.js";
 import { f as alphabetizeStringify, m as sha256BytesUtf8 } from "./chains-BMh3btVo.js";
 import { n as parseCorrelationId, r as parseDigestB64u } from "./canonicalPrimitives-BTHWz80v.js";
@@ -1980,4 +1980,4 @@ function cloneAuthenticatorOptions(options) {
 //#region src/core/signingEngine/workerManager/ecdsaPresignLifecycle.ts
 const MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS = 2160 * 60 * 6e4;
 //#endregion
-export { parseWalletAuthAuthority as $, wireObject as $t, parseRouterAbEcdsaVerifiedClientActivationFactsV1 as A, walletSessionPreservesCapabilities as At, sameRouterAbEcdsaDerivationPublicIdentityV1 as B, parseNonNegativeSafeInteger as Bt, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1 as C, routerAbMpcMaterialActivationRefFromWire as Ct, parseRouterAbEcdsaRegistrationPublicActivationReceiptV1 as D, activeWalletSessionV1RecordsEqual as Dt, parseRouterAbEcdsaRegistrationActivationReceiptV1 as E, requireRouterAbX25519PublicKey as Et, routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1 as F, keyLabeled as Ft, buildPasskeyWalletAuthAuthority as G, walletAuthMethodId as Gt, sameRouterAbEcdsaVerifiedClientActivationFactsV1 as H, parseUnixTime as Ht, routerAbEcdsaRerandomizationClientCommitmentV1 as I, linkedDeviceId as It, emailOtpWalletAuthAuthorityProviderUserId as J, walletKeyId as Jt, emailOtpWalletAuthAuthorityEmailHashHex as K, walletAuthorityId as Kt, sameRouterAbEcdsaDerivationNormalSigningScopeV1 as L, nullableToken as Lt, routerAbEcdsaDerivationActiveStateId as M, credentialId as Mt, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1 as N, digest as Nt, parseRouterAbEcdsaRegistrationRequestFactsV1 as O, parseActiveWalletSessionV1 as Ot, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1 as P, enrollmentId as Pt, parsePasskeyWalletAuthAuthority as Q, wireNullable as Qt, sameRouterAbEcdsaDerivationNormalSigningStateV1 as R, parseDelegatedWalletAuthority as Rt, parseRouterAbEcdsaOperationStepUpPreparationV1 as S, parseRouterAbNormalSigningAuthorization as St, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1 as T, sameRouterAbMpcMaterialActivationRef as Tt, sameRouterAbServerIdentityV1 as U, rpId as Ut, sameRouterAbEcdsaRegistrationActivationReceiptV1 as V, parseTargetEmail as Vt, buildEmailOtpWalletAuthAuthority as W, sessionId as Wt, isPasskeyWalletAuthAuthority as X, walletSessionId as Xt, isEmailOtpWalletAuthAuthority as Y, walletSessionAuthorizationId as Yt, parseEmailOtpWalletAuthAuthority as Z, wireLiteral as Zt, parseRouterAbEcdsaDerivationNormalSigningStateV1 as _, parseSdkEcdsaDerivationSigningRootId as _t, ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH as a, parseEcdsaCapabilityManifestId as at, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1 as b, canonicalRouterAbMpcMaterialActivationRefBytes as bt, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH as c, parseEcdsaCiphertextDigest as ct, buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1 as d, parseEcdsaMaterialSealingKeyId as dt, wireUnion as en, parseWalletAuthAuthorityRef as et, computeRouterAbEcdsaOperationStepUpChallengeB64u as f, parseEcdsaPendingCiphertextDigest as ft, parseRouterAbEcdsaDerivationNormalSigningScopeV1 as g, ecdsaClientRootPublicKey33B64uFromString as gt, parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreRequestV1 as h, computeEcdsaDerivationRoleLocalRelayerKeyId as ht, ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH as i, parseEcdsaActivationDigest as it, requireRouterAbEcdsaDerivationNormalSigningStateV1 as j, authorizationDeviceId as jt, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1 as k, parseWalletSessionOperationCredentialV1 as kt, ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS as l, parseEcdsaIv12B64u as lt, parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1 as m, parseEvmFamilyEcdsaSignerId as mt, UserVerificationPolicy as n, walletAuthAuthorityRef as nt, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH as o, parseEcdsaCapabilityManifestRevision as ot, parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1 as p, parseEcdsaServerGeneration as pt, emailOtpWalletAuthAuthorityProvider as q, walletId as qt, cloneAuthenticatorOptions as r, parseCanonicalEcdsaServerActivationRequest as rt, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH as s, parseEcdsaCiphertextB64u as st, MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS as t, walletAuthAuthoritiesMatch as tt, buildRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1 as u, parseEcdsaLifecycleId as ut, parseRouterAbEcdsaDerivationPublicCapabilityV1 as v, parseSdkEcdsaDerivationSigningRootVersion as vt, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1 as w, routerAbMpcMaterialActivationRefToWire as wt, parseRouterAbEcdsaOperationStepUpAuthorizationResponseV1 as x, parseRouterAbMpcMaterialActivationRef as xt, parseRouterAbEcdsaExplicitExportForwardedResponseV1 as y, parseSdkEcdsaDerivationThresholdKeyId as yt, sameRouterAbEcdsaDerivationPublicCapabilityV1 as z, parseNonEmptyToken as zt };
+export { parseEmailOtpWalletAuthAuthority as $, wireLiteral as $t, parseRouterAbEcdsaVerifiedClientActivationFactsV1 as A, parseActiveWalletSessionV1 as At, sameRouterAbEcdsaDerivationNormalSigningStateV1 as B, parseDelegatedWalletAuthority as Bt, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1 as C, parseRouterAbMpcMaterialActivationRef as Ct, parseRouterAbEcdsaRegistrationPublicActivationReceiptV1 as D, sameRouterAbMpcMaterialActivationRef as Dt, parseRouterAbEcdsaRegistrationActivationReceiptV1 as E, routerAbMpcMaterialActivationRefToWire as Et, routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1 as F, digest as Ft, sameRouterAbServerIdentityV1 as G, rpId as Gt, sameRouterAbEcdsaDerivationPublicIdentityV1 as H, parseNonNegativeSafeInteger as Ht, routerAbEcdsaRerandomizationClientCommitmentV1 as I, enrollmentId as It, emailOtpWalletAuthAuthorityEmailHashHex as J, walletAuthorityId as Jt, buildEmailOtpWalletAuthAuthority as K, sessionId as Kt, sameRegistrationRecipientKeys as L, keyLabeled as Lt, routerAbEcdsaDerivationActiveStateId as M, walletSessionPreservesCapabilities as Mt, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1 as N, authorizationDeviceId as Nt, parseRouterAbEcdsaRegistrationRequestFactsV1 as O, requireRouterAbX25519PublicKey as Ot, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1 as P, credentialId as Pt, isPasskeyWalletAuthAuthority as Q, walletSessionId as Qt, sameRegistrationSignerSet as R, linkedDeviceId as Rt, parseRouterAbEcdsaOperationStepUpPreparationV1 as S, canonicalRouterAbMpcMaterialActivationRefBytes as St, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1 as T, routerAbMpcMaterialActivationRefFromWire as Tt, sameRouterAbEcdsaRegistrationActivationReceiptV1 as U, parseTargetEmail as Ut, sameRouterAbEcdsaDerivationPublicCapabilityV1 as V, parseNonEmptyToken as Vt, sameRouterAbEcdsaVerifiedClientActivationFactsV1 as W, parseUnixTime as Wt, emailOtpWalletAuthAuthorityProviderUserId as X, walletKeyId as Xt, emailOtpWalletAuthAuthorityProvider as Y, walletId as Yt, isEmailOtpWalletAuthAuthority as Z, walletSessionAuthorizationId as Zt, parseRouterAbEcdsaDerivationNormalSigningStateV1 as _, computeEcdsaDerivationRoleLocalRelayerKeyId as _t, ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH as a, parseCanonicalEcdsaServerActivationRequest as at, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1 as b, parseSdkEcdsaDerivationSigningRootVersion as bt, ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH as c, parseEcdsaCapabilityManifestRevision as ct, buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1 as d, parseEcdsaIv12B64u as dt, wireNullable as en, parsePasskeyWalletAuthAuthority as et, computeRouterAbEcdsaOperationStepUpChallengeB64u as f, parseEcdsaLifecycleId as ft, parseRouterAbEcdsaDerivationNormalSigningScopeV1 as g, parseEvmFamilyEcdsaSignerId as gt, parseRouterAbEcdsaDerivationEvmDigestSigningResponseForCoreRequestV1 as h, parseEcdsaServerGeneration as ht, ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH as i, walletAuthAuthorityRef as it, requireRouterAbEcdsaDerivationNormalSigningStateV1 as j, parseWalletSessionOperationCredentialV1 as jt, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1 as k, activeWalletSessionV1RecordsEqual as kt, ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS as l, parseEcdsaCiphertextB64u as lt, parseRouterAbEcdsaDerivationEvmDigestSigningPrepareResponseForRequestV1 as m, parseEcdsaPendingCiphertextDigest as mt, UserVerificationPolicy as n, wireResult as nn, parseWalletAuthAuthorityRef as nt, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH as o, parseEcdsaActivationDigest as ot, parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1 as p, parseEcdsaMaterialSealingKeyId as pt, buildPasskeyWalletAuthAuthority as q, walletAuthMethodId as qt, cloneAuthenticatorOptions as r, wireUnion as rn, walletAuthAuthoritiesMatch as rt, ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH as s, parseEcdsaCapabilityManifestId as st, MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS as t, wireObject as tn, parseWalletAuthAuthority as tt, buildRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1 as u, parseEcdsaCiphertextDigest as ut, parseRouterAbEcdsaDerivationPublicCapabilityV1 as v, ecdsaClientRootPublicKey33B64uFromString as vt, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1 as w, parseRouterAbNormalSigningAuthorization as wt, parseRouterAbEcdsaOperationStepUpAuthorizationResponseV1 as x, parseSdkEcdsaDerivationThresholdKeyId as xt, parseRouterAbEcdsaExplicitExportForwardedResponseV1 as y, parseSdkEcdsaDerivationSigningRootId as yt, sameRouterAbEcdsaDerivationNormalSigningScopeV1 as z, nullableToken as zt };

package/dist/public/sdk/{ecdsaWalletRecords-Cz4m6bIz.js → ecdsaWalletRecords-D42rtA9z.js}

@@ -1,9 +1,9 @@
 import "./validation-gat4LEKm.js";
 import "./signerDomain-IEAVrOrc.js";
-import { C as storeWalletEcdsaSignerRecords, D as storeWalletEmailOtpEcdsaSignerRecords, E as storeWalletEmailOtpEcdsaRegistrationData, S as storeWalletEcdsaRecoverySignerRecords, n as finalizeWalletEcdsaRegistration } from "./accountLifecycle-BAGG_rbk.js";
+import { C as storeWalletEcdsaSignerRecords, D as storeWalletEmailOtpEcdsaSignerRecords, E as storeWalletEmailOtpEcdsaRegistrationData, S as storeWalletEcdsaRecoverySignerRecords, n as finalizeWalletEcdsaRegistration } from "./accountLifecycle-zthG08aC.js";
 import "./encoders-D8d07vpx.js";
 import "./registrationIds-DLSdEKSv.js";
-import "./registrationSignerPlan-CAikVZZQ.js";
+import "./registrationSignerPlan-DhV8VAob.js";
 //#region src/core/signingEngine/flows/registration/services/ecdsaWalletRecords.ts
 function createEcdsaWalletRecordsService(deps) {
 	return {