@seams/wallet 0.7.1 → 0.7.3

package/dist/public/sdk/workers/device-linking-key.worker.js

@@ -782,6 +782,11 @@ function requireCanonicalBase64Url(value, label) {
   }
   return decoded;
 }
+function requireParsed(result, label) {
+  if (result.ok)
+    return result.value;
+  throw new Error(`${label} ${result.error.message}`);
+}
 function parseDigestField(value, label) {
   try {
     return parseDigestB64u(value);
@@ -946,11 +951,11 @@ function parseLinkedDeviceEd25519ExportRootPackageV1(raw) {
   }
   return {
     kind: "linked_device_ed25519_export_root_package_v1",
-    linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
-    walletId: parseRequired(parseWalletId(record.walletId), "walletId"),
-    walletKeyId: parseRequired(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
-    enrollmentId: parseRequired(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
-    deviceId: parseRequired(parseLinkedDeviceId(record.deviceId), "deviceId"),
+    linkSessionId: requireParsed(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
+    walletId: requireParsed(parseWalletId(record.walletId), "walletId"),
+    walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
+    enrollmentId: requireParsed(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
+    deviceId: requireParsed(parseLinkedDeviceId(record.deviceId), "deviceId"),
     transferAlg: LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1,
     applicationBindingDigestB64u: parseDigestField(record.applicationBindingDigestB64u, "applicationBindingDigestB64u"),
     registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "registeredPublicKeyB64u"),
@@ -1002,11 +1007,6 @@ function parseUnixMs2(value, label) {
   }
   return value;
 }
-function parseRequired(parsed, label) {
-  if (!parsed.ok)
-    throw new Error(`${label} ${parsed.error.message}`);
-  return parsed.value;
-}
 // ../shared-ts/src/device-linking/delegatedActivationPlan.ts
 var MANIFEST_FIELDS = ["kind", "keyFamilies", "signers"];
 var ED25519_SIGNER_FIELDS = [
@@ -1173,11 +1173,6 @@ function exactRecord3(raw, fields, label) {
   }
   return record;
 }
-function requireParsed(parsed, label) {
-  if (!parsed.ok)
-    throw new Error(`${label} ${parsed.error.message}`);
-  return parsed.value;
-}
 // ../shared-ts/src/utils/routerAbPublicKeyset.ts
 function requireRouterAbX25519PublicKey(value, label) {
   const publicKey = coerceNonEmptyString(value, label);
@@ -3005,7 +3000,7 @@ function parseEd25519Package(raw) {
   }
   const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a_client_package", "deriver_a");
   const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b_client_package", "deriver_b");
-  if (!sameBytes(activationReceipt.transcript, deriverA.transcript) || !sameBytes(activationReceipt.transcript, deriverB.transcript)) {
+  if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) {
     throw new Error("CommittedEd25519SignerPackageV1 receipt transcript does not match packages");
   }
   return {
@@ -3178,9 +3173,6 @@ function parseCommittedEcdsaSignerPackageWireV1(raw) {
 function inspectRawObject2(raw) {
   return raw !== null && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
 }
-function sameBytes(left, right) {
-  return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 function requireExactWireFields(record, keys, label) {
   const expected = new Set(keys);
   const actual = Object.keys(record);
@@ -3642,6 +3634,9 @@ function u642(value, label) {
 function lp322(value, label) {
   return concat([u322(value.length, `${label}.length`), value]);
 }
+// ../shared-ts/src/utils/emailOtpDomain.ts
+var EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 = "seams/email-otp/factor-release/v1";
+
 // ../../wasm/near_signer/pkg/wasm_signer_worker.js
 var wasm;
 var WASM_VECTOR_LEN = 0;
@@ -6822,9 +6817,17 @@ function parsePasskeyCustodyEnvelopeRecord(raw, label = "walletCustodyEnvelope")
     updatedAtMs
   });
 }
+// ../shared-ts/src/utils/exactKeys.ts
+function hasExactKeys(value, keys) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const actual = Object.keys(value);
+  return actual.length === keys.length && actual.every((key) => keys.includes(key));
+}
+
 // src/core/signingEngine/workerManager/deviceLinkingPorts.ts
 function parseOrdinaryMaterialWorkerRequestV1(value) {
-  if (isOrdinaryMaterialRecipientPrepareRecordV1(value)) {
+  if (hasExactKeys(value, ["kind", "handleId", "requirements"])) {
     if (value.kind !== "device_linking_ordinary_signer_material_recipient_prepare_v1") {
       throw new Error("ordinary material worker request kind is unsupported");
     }
@@ -6834,7 +6837,7 @@ function parseOrdinaryMaterialWorkerRequestV1(value) {
       requirements: parseRecipientRequirementTuple(value.requirements)
     };
   }
-  if (isOrdinaryMaterialSealRecordV1(value)) {
+  if (hasExactKeys(value, ["kind", "handleId", "committed", "targetFactor", "resealedExportRoot"])) {
     if (value.kind !== "device_linking_ordinary_signer_material_seal_v1") {
       throw new Error("ordinary material worker request kind is unsupported");
     }
@@ -6857,7 +6860,15 @@ function parseOrdinaryMaterialWorkerRequestV1(value) {
   throw new Error("ordinary material worker request kind is unsupported");
 }
 function parseOrdinaryMaterialWorkerPrivateRequestV1(value) {
-  if (!isOrdinaryMaterialPrivateRequestRecordV1(value)) {
+  if (!hasExactKeys(value, [
+    "kind",
+    "handleId",
+    "targetFactor",
+    "preparations",
+    "recipientRequests",
+    "recipientInputs",
+    "factorSecret"
+  ])) {
     throw new Error("ordinary material private worker request has invalid fields");
   }
   if (value.kind !== "device_linking_ordinary_signer_material_prepare_private_v1") {
@@ -6914,7 +6925,7 @@ function assertOrdinaryExportRootResealingMatchesIdentityV1(input) {
 function parseOrdinaryResealedExportRootRecordV1(value) {
   if (value === null)
     return null;
-  if (!isOrdinaryResealedExportRootRecordV1(value)) {
+  if (!hasExactKeys(value, ["envelope"])) {
     throw new Error("ordinary material resealed export root has unsupported fields");
   }
   return {
@@ -6944,7 +6955,7 @@ function parseRecipientRequirementTuple(value) {
     throw new Error("ordinary signer material recipient requirements must contain one or two entries");
   }
   const requirements = value.map((entry, index) => {
-    if (!isOrdinaryRecipientRequirementRecordV1(entry)) {
+    if (!hasExactKeys(entry, ["kind", "keyFamily", "walletKeyId"])) {
       throw new Error(`ordinary recipient requirement ${index} has invalid fields`);
     }
     if (entry.kind !== "ordinary_signer_material_recipient_requirement_v1") {
@@ -6967,7 +6978,7 @@ function parseRecipientRequestTuple(value) {
     throw new Error("ordinary signer material recipient requests must contain one or two entries");
   }
   const requests = value.map((entry) => {
-    if (isOrdinaryEd25519RecipientRequestRecordV1(entry)) {
+    if (hasExactKeys(entry, ["kind", "keyFamily", "walletKeyId", "recipientPublicKeyB64u"])) {
       if (entry.kind !== "ordinary_ed25519_signer_material_recipient_request_v1" || entry.keyFamily !== "ed25519") {
         throw new Error("ordinary Ed25519 recipient request kind is invalid");
       }
@@ -6978,7 +6989,7 @@ function parseRecipientRequestTuple(value) {
         recipientPublicKeyB64u: parseB64u(entry.recipientPublicKeyB64u, "Ed25519 recipient public key")
       };
     }
-    if (isOrdinaryEcdsaRecipientRequestRecordV1(entry)) {
+    if (hasExactKeys(entry, ["kind", "keyFamily", "walletKeyId", "clientEphemeralPublicKey"])) {
       if (entry.kind !== "ordinary_ecdsa_signer_material_recipient_request_v1" || entry.keyFamily !== "ecdsa_secp256k1") {
         throw new Error("ordinary ECDSA recipient request kind is invalid");
       }
@@ -7002,7 +7013,7 @@ function parseRecipientInputTuple(value) {
     throw new Error("ordinary signer material recipient inputs must contain one or two entries");
   }
   const inputs = value.map((entry) => {
-    if (isOrdinaryEd25519RecipientInputRecordV1(entry)) {
+    if (hasExactKeys(entry, ["kind", "keyFamily", "walletKeyId", "recipientPrivateKey"])) {
       if (entry.kind !== "ordinary_ed25519_signer_material_recipient_input_v1" || entry.keyFamily !== "ed25519") {
         throw new Error("ordinary Ed25519 recipient input kind is invalid");
       }
@@ -7013,7 +7024,7 @@ function parseRecipientInputTuple(value) {
         recipientPrivateKey: parsePrivateKeyBuffer(entry.recipientPrivateKey, "Ed25519 recipient private key")
       };
     }
-    if (isOrdinaryEcdsaRecipientInputRecordV1(entry)) {
+    if (hasExactKeys(entry, ["kind", "keyFamily", "walletKeyId", "clientEphemeralPrivateKey"])) {
       if (entry.kind !== "ordinary_ecdsa_signer_material_recipient_input_v1" || entry.keyFamily !== "ecdsa_secp256k1") {
         throw new Error("ordinary ECDSA recipient input kind is invalid");
       }
@@ -7075,7 +7086,13 @@ function parsePreparation(value) {
   return parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1(value);
 }
 function parseTargetFactorBindingV1(value) {
-  if (isOrdinaryPasskeyTargetFactorRecordV1(value)) {
+  if (hasExactKeys(value, [
+    "kind",
+    "walletAuthMethodId",
+    "verificationDigestB64u",
+    "rpId",
+    "credentialIdB64u"
+  ])) {
     if (value.kind !== "passkey") {
       throw new Error("ordinary material target factor kind is unsupported");
     }
@@ -7091,7 +7108,13 @@ function parseTargetFactorBindingV1(value) {
       credentialIdB64u: parseB64u(value.credentialIdB64u, "ordinary target factor credentialIdB64u")
     };
   }
-  if (isOrdinaryEmailOtpTargetFactorRecordV1(value)) {
+  if (hasExactKeys(value, [
+    "kind",
+    "walletAuthMethodId",
+    "verificationDigestB64u",
+    "emailHashHex",
+    "registrationAuthorityId"
+  ])) {
     if (value.kind !== "email_otp") {
       throw new Error("ordinary material target factor kind is unsupported");
     }
@@ -7128,39 +7151,6 @@ function parseB64u(value, label) {
   decoded.fill(0);
   return encoded;
 }
-function isOrdinaryMaterialRecipientPrepareRecordV1(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "handleId|kind|requirements";
-}
-function isOrdinaryMaterialSealRecordV1(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "committed|handleId|kind|resealedExportRoot|targetFactor";
-}
-function isOrdinaryMaterialPrivateRequestRecordV1(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "factorSecret|handleId|kind|preparations|recipientInputs|recipientRequests|targetFactor";
-}
-function isOrdinaryResealedExportRootRecordV1(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "envelope";
-}
-function isOrdinaryRecipientRequirementRecordV1(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "keyFamily|kind|walletKeyId";
-}
-function isOrdinaryEd25519RecipientRequestRecordV1(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "keyFamily|kind|recipientPublicKeyB64u|walletKeyId";
-}
-function isOrdinaryEcdsaRecipientRequestRecordV1(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "clientEphemeralPublicKey|keyFamily|kind|walletKeyId";
-}
-function isOrdinaryEd25519RecipientInputRecordV1(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "keyFamily|kind|recipientPrivateKey|walletKeyId";
-}
-function isOrdinaryEcdsaRecipientInputRecordV1(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "clientEphemeralPrivateKey|keyFamily|kind|walletKeyId";
-}
-function isOrdinaryPasskeyTargetFactorRecordV1(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "credentialIdB64u|kind|rpId|verificationDigestB64u|walletAuthMethodId";
-}
-function isOrdinaryEmailOtpTargetFactorRecordV1(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "emailHashHex|kind|registrationAuthorityId|verificationDigestB64u|walletAuthMethodId";
-}
 
 // src/core/signingEngine/workerManager/workers/device-linking-key/ecdsaTargetShareHpke.ts
 var LINKED_DEVICE_ECDSA_SOURCE_CONTRIBUTION_HPKE_INFO_V1 = new TextEncoder().encode("seams/linked-device/ecdsa-source-contribution/hpke-x25519-hkdf-sha256-aes256gcm/v1");
@@ -7372,14 +7362,11 @@ function sameOrdinaryPreparations(left, right) {
   return true;
 }
 function sameOrdinaryEd25519SourceBinding(left, right) {
-  return left.operation === right.operation && sameNumberArray(left.session_id, right.session_id) && sameNumberArray(left.stable_key_context_binding, right.stable_key_context_binding) && left.lifecycle.lifecycle_id === right.lifecycle.lifecycle_id && left.lifecycle.work_kind === right.lifecycle.work_kind && left.lifecycle.primitive_request_kind === right.lifecycle.primitive_request_kind && left.lifecycle.root_share_epoch === right.lifecycle.root_share_epoch && left.lifecycle.account_id === right.lifecycle.account_id && left.lifecycle.session_id === right.lifecycle.session_id && left.lifecycle.signer_set_id === right.lifecycle.signer_set_id && left.lifecycle.selected_server_id === right.lifecycle.selected_server_id && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation);
+  return left.operation === right.operation && sameRouterAbEd25519YaoByteSequence(left.session_id, right.session_id) && sameRouterAbEd25519YaoByteSequence(left.stable_key_context_binding, right.stable_key_context_binding) && left.lifecycle.lifecycle_id === right.lifecycle.lifecycle_id && left.lifecycle.work_kind === right.lifecycle.work_kind && left.lifecycle.primitive_request_kind === right.lifecycle.primitive_request_kind && left.lifecycle.root_share_epoch === right.lifecycle.root_share_epoch && left.lifecycle.account_id === right.lifecycle.account_id && left.lifecycle.session_id === right.lifecycle.session_id && left.lifecycle.signer_set_id === right.lifecycle.signer_set_id && left.lifecycle.selected_server_id === right.lifecycle.selected_server_id && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation);
 }
 function sameOrdinaryEd25519ApplicationBinding(left, right) {
   return left.wallet_id === right.wallet_id && left.near_ed25519_signing_key_id === right.near_ed25519_signing_key_id && left.signing_root_id === right.signing_root_id && left.key_creation_signer_slot === right.key_creation_signer_slot;
 }
-function sameNumberArray(left, right) {
-  return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 function sameOrdinaryTargetFactorAndPreparations(left, right) {
   return sameOrdinaryTargetFactor(left.targetFactor, right.targetFactor) && sameOrdinaryPreparations(left.preparations, right.preparations);
 }
@@ -7394,30 +7381,18 @@ function sameEcdsaTargetRecipientPreparation(left, right) {
 }
 
 // src/core/signingEngine/workerManager/workers/device-linking-key/requests.ts
-function isDeviceLinkingSignRequestRecordV1(value) {
-  return hasExactKeys(value, "bodyDigestB64u|canonicalPath|challengeB64u|devicePublicKeyDigestB64u|expiresAtMs|handleId|issuedAtMs|kind|linkSessionId|method");
-}
-function isDeviceLinkingCreateRequestRecordV1(value) {
-  return hasExactKeys(value, "kind");
-}
-function isDeviceLinkingHandleRequestRecordV1(value) {
-  return hasExactKeys(value, "handleId|kind");
-}
-function isDeviceLinkingEmailOtpFactorReleaseRequestRecordV1(value) {
-  return hasExactKeys(value, "baseWalletAuthMethodId|deviceId|enrollmentId|expectedChallengeId|factorRelease|handleId|kind|linkSessionId|targetPreparationDigestB64u|verificationGrant|walletAuthMethodId|walletId");
-}
-function isDeviceLinkingWalletSessionDeliveryRequestRecordV1(value) {
-  return hasExactKeys(value, "delivery|expected|handleId|kind");
-}
-function isDeviceLinkingWalletSessionExpectedRecordV1(value) {
-  return hasExactKeys(value, "authorityId|authorizationId|credentialDigestB64u|deliveryBinding|expiresAtMs|installationReceiptDigestB64u|issuedAtMs|linkSessionId|quotaId|recipientPublicKey65B64u|walletAuthMethodId|walletId|walletSessionId");
-}
-function isDeviceLinkingWorkerFrameRecordV1(value) {
-  return hasExactKeys(value, "id|request");
-}
-function hasExactKeys(value, sortedKeys) {
-  return isPlainObject(value) && Object.keys(value).sort().join("|") === sortedKeys;
-}
+var SIGN_REQUEST_FIELDS = [
+  "kind",
+  "handleId",
+  "linkSessionId",
+  "method",
+  "canonicalPath",
+  "bodyDigestB64u",
+  "devicePublicKeyDigestB64u",
+  "challengeB64u",
+  "issuedAtMs",
+  "expiresAtMs"
+];
 function parseHandleId(value) {
   const handleId = requireCanonicalString(value, "handleId", "is required");
   if (handleId.length > 256)
@@ -7468,7 +7443,7 @@ function parseTimestamp2(value, label) {
   return Number(value);
 }
 function parseSignRequest(value) {
-  if (!isDeviceLinkingSignRequestRecordV1(value)) {
+  if (!hasExactKeys(value, SIGN_REQUEST_FIELDS)) {
     throw new Error("device-linking sign request has invalid fields");
   }
   if (value.kind !== "device_linking_request_sign_v1") {
@@ -7496,7 +7471,7 @@ function parseSignRequest(value) {
   };
 }
 function parseFrame(value) {
-  if (!isDeviceLinkingWorkerFrameRecordV1(value)) {
+  if (!hasExactKeys(value, ["id", "request"])) {
     throw new Error("device-linking worker frame has invalid fields");
   }
   const frame = value;
@@ -7506,13 +7481,13 @@ function parseFrame(value) {
   };
 }
 function parseRequest(value) {
-  if (isDeviceLinkingCreateRequestRecordV1(value)) {
+  if (hasExactKeys(value, ["kind"])) {
     if (value.kind !== "device_linking_key_material_create_v1") {
       throw new Error("device-linking worker request kind is unsupported");
     }
     return { kind: "device_linking_key_material_create_v1" };
   }
-  if (isDeviceLinkingHandleRequestRecordV1(value) && value.kind === "device_linking_key_material_discard_v1") {
+  if (hasExactKeys(value, ["kind", "handleId"]) && value.kind === "device_linking_key_material_discard_v1") {
     return {
       kind: "device_linking_key_material_discard_v1",
       handleId: parseHandleId(value.handleId)
@@ -7537,17 +7512,30 @@ function parseRequest(value) {
       throw error;
     }
   }
-  if (isDeviceLinkingHandleRequestRecordV1(value) && value.kind === "device_linking_email_otp_export_root_recipient_create_v1") {
+  if (hasExactKeys(value, ["kind", "handleId"]) && value.kind === "device_linking_email_otp_export_root_recipient_create_v1") {
     return {
       kind: "device_linking_email_otp_export_root_recipient_create_v1",
       handleId: parseHandleId(value.handleId)
     };
   }
-  if (isDeviceLinkingSignRequestRecordV1(value)) {
+  if (hasExactKeys(value, SIGN_REQUEST_FIELDS)) {
     const parsed = parseSignRequest(value);
     return { kind: "device_linking_request_sign_v1", ...parsed };
   }
-  if (isDeviceLinkingEmailOtpFactorReleaseRequestRecordV1(value)) {
+  if (hasExactKeys(value, [
+    "kind",
+    "handleId",
+    "walletId",
+    "linkSessionId",
+    "enrollmentId",
+    "deviceId",
+    "walletAuthMethodId",
+    "baseWalletAuthMethodId",
+    "targetPreparationDigestB64u",
+    "expectedChallengeId",
+    "verificationGrant",
+    "factorRelease"
+  ])) {
     if (value.kind !== "device_linking_email_otp_factor_release_open_v1") {
       throw new Error("device-linking worker request kind is unsupported");
     }
@@ -7584,11 +7572,25 @@ function parseRequest(value) {
       factorRelease: parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1(value.factorRelease)
     };
   }
-  if (isDeviceLinkingWalletSessionDeliveryRequestRecordV1(value)) {
+  if (hasExactKeys(value, ["kind", "handleId", "delivery", "expected"])) {
     if (value.kind !== "device_linking_wallet_session_credential_delivery_open_v1") {
       throw new Error("device-linking worker request kind is unsupported");
     }
-    if (!isDeviceLinkingWalletSessionExpectedRecordV1(value.expected)) {
+    if (!hasExactKeys(value.expected, [
+      "linkSessionId",
+      "walletId",
+      "authorityId",
+      "walletAuthMethodId",
+      "authorizationId",
+      "walletSessionId",
+      "quotaId",
+      "deliveryBinding",
+      "credentialDigestB64u",
+      "installationReceiptDigestB64u",
+      "recipientPublicKey65B64u",
+      "issuedAtMs",
+      "expiresAtMs"
+    ])) {
       throw new Error("device-linking Wallet Session credential delivery expected identity has invalid fields");
     }
     const expected = value.expected;
@@ -8070,7 +8072,7 @@ async function prepareOrdinarySignerMaterial(request) {
       })) {
         throw new Error("ordinary signer material preparation conflicts with the existing activation reference");
       }
-      if (!sameBytes2(factorSecret, existing.factorSecret)) {
+      if (!sameBytes(factorSecret, existing.factorSecret)) {
         throw new Error("ordinary signer material preparation conflicts with the existing factor secret");
       }
       factorSecret.fill(0);
@@ -8109,7 +8111,7 @@ function assertOrdinaryRecipientPreparationMatchesRequest(prepared, request) {
   }
   for (const expected of prepared.recipientInputs) {
     const actual = request.recipientInputs.find((input) => input.keyFamily === expected.keyFamily && input.walletKeyId === expected.walletKeyId);
-    if (!actual || !sameBytes2(recipientPrivateBytes(expected), recipientPrivateBytes(actual))) {
+    if (!actual || !sameBytes(recipientPrivateBytes(expected), recipientPrivateBytes(actual))) {
       throw new Error("ordinary signer material recipient input changed before preparation");
     }
   }
@@ -8117,7 +8119,7 @@ function assertOrdinaryRecipientPreparationMatchesRequest(prepared, request) {
 function recipientPrivateBytes(input) {
   return new Uint8Array(input.kind === "ordinary_ed25519_signer_material_recipient_input_v1" ? input.recipientPrivateKey : input.clientEphemeralPrivateKey);
 }
-function sameBytes2(left, right) {
+function sameBytes(left, right) {
   if (left.length !== right.length)
     return false;
   let difference = 0;
@@ -8264,7 +8266,6 @@ async function createEmailOtpEd25519ExportRootRecipient(handleId) {
   slot.emailOtpExportRootRecipient = recipient;
   return { recipientPublicKeyB64u: recipient.public_key_b64u() };
 }
-var EMAIL_OTP_FACTOR_RELEASE_AAD_PREFIX = "seams/email-otp/factor-release/v1";
 async function decryptEmailOtpFactorReleaseEnvelope(input) {
   const release = input.factorRelease;
   if (input.expectedChallengeId !== release.challengeId) {
@@ -8273,7 +8274,7 @@ async function decryptEmailOtpFactorReleaseEnvelope(input) {
   const factorSecret = await openDeliveryRecipientEnvelope({
     slot: input.slot,
     envelope: release,
-    aad: () => `${EMAIL_OTP_FACTOR_RELEASE_AAD_PREFIX}\x00${input.walletId}\x00${release.enrollmentId}\x00${release.enrollmentSealKeyVersion}\x00${release.challengeId}`
+    aad: () => `${EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1}\x00${input.walletId}\x00${release.enrollmentId}\x00${release.enrollmentSealKeyVersion}\x00${release.challengeId}`
   });
   if (factorSecret.length !== 32) {
     factorSecret.fill(0);

package/dist/public/sdk/workers/ecdsa-derivation-client.worker.js

@@ -1934,6 +1934,11 @@ function requireCanonicalBase64Url(value, label) {
   }
   return decoded;
 }
+function requireParsed(result, label) {
+  if (result.ok)
+    return result.value;
+  throw new Error(`${label} ${result.error.message}`);
+}
 function parseDigestField(value, label) {
   try {
     return parseDigestB64u(value);
@@ -3198,6 +3203,9 @@ function parseRouterAbEcdsaRegistrationActivationReceiptV1(value) {
 function sameRouterAbServerIdentityV1(left, right) {
   return left.server_id === right.server_id && left.key_epoch === right.key_epoch && left.recipient_encryption_key === right.recipient_encryption_key;
 }
+function sameRouterAbEcdsaVerifiedClientActivationFactsV1(left, right) {
+  return left.registrationRequestDigestB64u === right.registrationRequestDigestB64u && left.proofTranscriptDigestB64u === right.proofTranscriptDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && left.derivationClientSharePublicKey33B64u === right.derivationClientSharePublicKey33B64u && left.clientShareRetryCounter === right.clientShareRetryCounter && left.participantId === right.participantId;
+}
 function sameRegistrationSignerSet(left, right) {
   return left.signer_set_id === right.signer_set_id && left.policy === right.policy && left.signer_a.role === right.signer_a.role && left.signer_a.signer_id === right.signer_a.signer_id && left.signer_a.key_epoch === right.signer_a.key_epoch && left.signer_b.role === right.signer_b.role && left.signer_b.signer_id === right.signer_b.signer_id && left.signer_b.key_epoch === right.signer_b.key_epoch && sameRouterAbServerIdentityV1(left.selected_server, right.selected_server);
 }
@@ -3691,11 +3699,6 @@ var OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
   "custodyKeyManifestDigestB64u",
   "sourceIdentityDigestB64u"
 ];
-function requireResult(result, label) {
-  if (result.ok)
-    return result.value;
-  throw new Error(`${label} ${result.error.message}`);
-}
 function parseWalletSignerId(raw, label = "walletSignerId") {
   if (typeof raw !== "string")
     throw new Error(`${label} must be a string`);
@@ -3729,7 +3732,7 @@ function buildOwnerLaneParticipantContinuityV1(args) {
     kind: "owner_lane_participant_continuity_v1",
     signerId: parseWalletSignerId(args.signerId),
     participantIds,
-    signingWorkerId: requireResult(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
+    signingWorkerId: requireParsed(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
     custodyKeyManifestDigestB64u: parseDigestField(args.custodyKeyManifestDigestB64u, "custodyKeyManifestDigestB64u"),
     sourceIdentityDigestB64u: parseDigestField(args.sourceIdentityDigestB64u, "sourceIdentityDigestB64u")
   };
@@ -3743,7 +3746,7 @@ function parseOwnerLaneParticipantContinuityV1(raw, label = "ownerParticipantCon
   return buildOwnerLaneParticipantContinuityV1({
     signerId: parseWalletSignerId(record.signerId, `${label}.signerId`),
     participantIds: parseParticipantIds(record.participantIds, `${label}.participantIds`),
-    signingWorkerId: requireResult(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
+    signingWorkerId: requireParsed(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
     custodyKeyManifestDigestB64u: parseDigestField(record.custodyKeyManifestDigestB64u, `${label}.custodyKeyManifestDigestB64u`),
     sourceIdentityDigestB64u: parseDigestField(record.sourceIdentityDigestB64u, `${label}.sourceIdentityDigestB64u`)
   });
@@ -4772,9 +4775,6 @@ function isAttachLinkedHolderToPresignPort(value) {
 }
 
 // src/core/signingEngine/threshold/crypto/ecdsaLaneWasm.ts
-function assertEcdsaHolderRound(value) {
-  return parseEcdsaAdditiveLaneHolderRoundV1(value);
-}
 function nonEmpty(value, label) {
   if (typeof value !== "string" || !value.trim())
     throw new Error(`${label} is required`);
@@ -4799,7 +4799,7 @@ function parseEcdsaAdditiveLaneHolderPreparationV1(value) {
   }
   return {
     kind,
-    holderRound: assertEcdsaHolderRound(Reflect.get(value, "holderRound")),
+    holderRound: parseEcdsaAdditiveLaneHolderRoundV1(Reflect.get(value, "holderRound")),
     holderPackage,
     encryptedDeltaPackageJson: nonEmpty(Reflect.get(value, "encryptedDeltaPackageJson"), "encryptedDeltaPackageJson")
   };
@@ -6842,12 +6842,6 @@ function assertDurableMaterialMatchesActivation(durableMaterial, activationBindi
     receipt: receipt.protocolReceipt
   });
 }
-function routerAbEcdsaPublicIdentitiesEqual(left, right) {
-  return left.context_binding_b64u === right.context_binding_b64u && left.derivation_client_share_public_key33_b64u === right.derivation_client_share_public_key33_b64u && left.server_public_key33_b64u === right.server_public_key33_b64u && left.threshold_public_key33_b64u === right.threshold_public_key33_b64u && left.ethereum_address20_b64u === right.ethereum_address20_b64u && left.client_share_retry_counter === right.client_share_retry_counter && left.server_share_retry_counter === right.server_share_retry_counter;
-}
-function routerAbServerIdentitiesEqual(left, right) {
-  return left.server_id === right.server_id && left.key_epoch === right.key_epoch && left.recipient_encryption_key === right.recipient_encryption_key;
-}
 function assertNormalSigningMatchesActivation(input) {
   const scope = input.normalSigning.scope;
   const facts = input.roleLocalPublicFacts;
@@ -6861,7 +6855,7 @@ function assertNormalSigningMatchesActivation(input) {
     lifecycleBinding: expectedMaterialActivation.lifecycleBinding,
     signingWorker: expectedMaterialActivation.signingWorker
   });
-  if (scope.wallet_id !== String(input.activationBinding.signer.walletId) || scope.ecdsa_threshold_key_id !== String(input.activationBinding.roleLocalBinding.ecdsaThresholdKeyId) || scope.signing_root_id !== String(input.activationBinding.signer.signingRootId) || scope.signing_root_version !== String(input.activationBinding.signer.signingRootVersion) || scope.context.application_binding_digest_b64u !== input.receipt.ecdsa_activation.context.application_binding_digest_b64u || !routerAbEcdsaPublicIdentitiesEqual(scope.public_identity, input.receipt.ecdsa_activation.public_identity) || !routerAbServerIdentitiesEqual(scope.signing_worker, input.receipt.ecdsa_activation.signing_worker) || scope.activation_epoch !== input.receipt.ecdsa_activation.activation_epoch || scope.public_identity.context_binding_b64u !== facts.contextBinding32B64u || scope.public_identity.derivation_client_share_public_key33_b64u !== facts.derivationClientSharePublicKey33B64u || scope.public_identity.server_public_key33_b64u !== facts.relayerPublicKey33B64u || scope.public_identity.threshold_public_key33_b64u !== facts.groupPublicKey33B64u || !sameRouterAbMpcMaterialActivationRef(scope.material_activation, expectedMaterialActivationWire)) {
+  if (scope.wallet_id !== String(input.activationBinding.signer.walletId) || scope.ecdsa_threshold_key_id !== String(input.activationBinding.roleLocalBinding.ecdsaThresholdKeyId) || scope.signing_root_id !== String(input.activationBinding.signer.signingRootId) || scope.signing_root_version !== String(input.activationBinding.signer.signingRootVersion) || scope.context.application_binding_digest_b64u !== input.receipt.ecdsa_activation.context.application_binding_digest_b64u || !sameRouterAbEcdsaDerivationPublicIdentityV1(scope.public_identity, input.receipt.ecdsa_activation.public_identity) || !sameRouterAbServerIdentityV1(scope.signing_worker, input.receipt.ecdsa_activation.signing_worker) || scope.activation_epoch !== input.receipt.ecdsa_activation.activation_epoch || scope.public_identity.context_binding_b64u !== facts.contextBinding32B64u || scope.public_identity.derivation_client_share_public_key33_b64u !== facts.derivationClientSharePublicKey33B64u || scope.public_identity.server_public_key33_b64u !== facts.relayerPublicKey33B64u || scope.public_identity.threshold_public_key33_b64u !== facts.groupPublicKey33B64u || !sameRouterAbMpcMaterialActivationRef(scope.material_activation, expectedMaterialActivationWire)) {
     throw new Error("ECDSA normal-signing runtime does not match its activation");
   }
 }
@@ -9697,9 +9691,6 @@ function requireNonEmptyCanonicalString(value, label) {
   }
   return value;
 }
-function verifiedClientActivationFactsEqual(left, right) {
-  return left.registrationRequestDigestB64u === right.registrationRequestDigestB64u && left.proofTranscriptDigestB64u === right.proofTranscriptDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && left.derivationClientSharePublicKey33B64u === right.derivationClientSharePublicKey33B64u && left.clientShareRetryCounter === right.clientShareRetryCounter && left.participantId === right.participantId;
-}
 function requireExactKeys4(record, label, keys) {
   const actual = Object.keys(record).sort();
   const expected = [...keys].sort();
@@ -9766,7 +9757,7 @@ function assertCanonicalRequestMatchesVerifiedCeremony(input) {
       throw new Error("ECDSA activation operation requires an idempotency key");
     }
     const publicFacts = parseRouterAbEcdsaVerifiedClientActivationFactsV1(request.publicFacts);
-    if (!verifiedClientActivationFactsEqual(publicFacts, input.clientActivation)) {
+    if (!sameRouterAbEcdsaVerifiedClientActivationFactsV1(publicFacts, input.clientActivation)) {
       throw new Error("ECDSA activation operation changed the verified client facts");
     }
     return;
@@ -9776,7 +9767,7 @@ function assertCanonicalRequestMatchesVerifiedCeremony(input) {
       throw new Error("ECDSA activation operation changed the activation correlation");
     }
     const publicFacts = parseRouterAbEcdsaVerifiedClientActivationFactsV1(request.publicFacts);
-    if (!verifiedClientActivationFactsEqual(publicFacts, input.clientActivation)) {
+    if (!sameRouterAbEcdsaVerifiedClientActivationFactsV1(publicFacts, input.clientActivation)) {
       throw new Error("ECDSA activation operation changed the verified client facts");
     }
     return;
@@ -9798,7 +9789,7 @@ function assertCanonicalRequestMatchesVerifiedCeremony(input) {
     throw new Error("ECDSA activation commit request changed the prepared request digest");
   }
   const publicFacts = parseRouterAbEcdsaVerifiedClientActivationFactsV1(ecdsa.publicFacts);
-  if (!verifiedClientActivationFactsEqual(publicFacts, input.clientActivation)) {
+  if (!sameRouterAbEcdsaVerifiedClientActivationFactsV1(publicFacts, input.clientActivation)) {
     throw new Error("ECDSA activation commit request changed the verified client facts");
   }
 }