@seams/wallet 0.7.1 → 0.7.3

package/dist/workers/ecdsa-derivation-client.worker.js

@@ -1934,6 +1934,11 @@ function requireCanonicalBase64Url(value, label) {
   }
   return decoded;
 }
+function requireParsed(result, label) {
+  if (result.ok)
+    return result.value;
+  throw new Error(`${label} ${result.error.message}`);
+}
 function parseDigestField(value, label) {
   try {
     return parseDigestB64u(value);
@@ -3198,6 +3203,9 @@ function parseRouterAbEcdsaRegistrationActivationReceiptV1(value) {
 function sameRouterAbServerIdentityV1(left, right) {
   return left.server_id === right.server_id && left.key_epoch === right.key_epoch && left.recipient_encryption_key === right.recipient_encryption_key;
 }
+function sameRouterAbEcdsaVerifiedClientActivationFactsV1(left, right) {
+  return left.registrationRequestDigestB64u === right.registrationRequestDigestB64u && left.proofTranscriptDigestB64u === right.proofTranscriptDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && left.derivationClientSharePublicKey33B64u === right.derivationClientSharePublicKey33B64u && left.clientShareRetryCounter === right.clientShareRetryCounter && left.participantId === right.participantId;
+}
 function sameRegistrationSignerSet(left, right) {
   return left.signer_set_id === right.signer_set_id && left.policy === right.policy && left.signer_a.role === right.signer_a.role && left.signer_a.signer_id === right.signer_a.signer_id && left.signer_a.key_epoch === right.signer_a.key_epoch && left.signer_b.role === right.signer_b.role && left.signer_b.signer_id === right.signer_b.signer_id && left.signer_b.key_epoch === right.signer_b.key_epoch && sameRouterAbServerIdentityV1(left.selected_server, right.selected_server);
 }
@@ -3691,11 +3699,6 @@ var OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
   "custodyKeyManifestDigestB64u",
   "sourceIdentityDigestB64u"
 ];
-function requireResult(result, label) {
-  if (result.ok)
-    return result.value;
-  throw new Error(`${label} ${result.error.message}`);
-}
 function parseWalletSignerId(raw, label = "walletSignerId") {
   if (typeof raw !== "string")
     throw new Error(`${label} must be a string`);
@@ -3729,7 +3732,7 @@ function buildOwnerLaneParticipantContinuityV1(args) {
     kind: "owner_lane_participant_continuity_v1",
     signerId: parseWalletSignerId(args.signerId),
     participantIds,
-    signingWorkerId: requireResult(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
+    signingWorkerId: requireParsed(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
     custodyKeyManifestDigestB64u: parseDigestField(args.custodyKeyManifestDigestB64u, "custodyKeyManifestDigestB64u"),
     sourceIdentityDigestB64u: parseDigestField(args.sourceIdentityDigestB64u, "sourceIdentityDigestB64u")
   };
@@ -3743,7 +3746,7 @@ function parseOwnerLaneParticipantContinuityV1(raw, label = "ownerParticipantCon
   return buildOwnerLaneParticipantContinuityV1({
     signerId: parseWalletSignerId(record.signerId, `${label}.signerId`),
     participantIds: parseParticipantIds(record.participantIds, `${label}.participantIds`),
-    signingWorkerId: requireResult(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
+    signingWorkerId: requireParsed(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
     custodyKeyManifestDigestB64u: parseDigestField(record.custodyKeyManifestDigestB64u, `${label}.custodyKeyManifestDigestB64u`),
     sourceIdentityDigestB64u: parseDigestField(record.sourceIdentityDigestB64u, `${label}.sourceIdentityDigestB64u`)
   });
@@ -4772,9 +4775,6 @@ function isAttachLinkedHolderToPresignPort(value) {
 }
 
 // src/core/signingEngine/threshold/crypto/ecdsaLaneWasm.ts
-function assertEcdsaHolderRound(value) {
-  return parseEcdsaAdditiveLaneHolderRoundV1(value);
-}
 function nonEmpty(value, label) {
   if (typeof value !== "string" || !value.trim())
     throw new Error(`${label} is required`);
@@ -4799,7 +4799,7 @@ function parseEcdsaAdditiveLaneHolderPreparationV1(value) {
   }
   return {
     kind,
-    holderRound: assertEcdsaHolderRound(Reflect.get(value, "holderRound")),
+    holderRound: parseEcdsaAdditiveLaneHolderRoundV1(Reflect.get(value, "holderRound")),
     holderPackage,
     encryptedDeltaPackageJson: nonEmpty(Reflect.get(value, "encryptedDeltaPackageJson"), "encryptedDeltaPackageJson")
   };
@@ -6842,12 +6842,6 @@ function assertDurableMaterialMatchesActivation(durableMaterial, activationBindi
     receipt: receipt.protocolReceipt
   });
 }
-function routerAbEcdsaPublicIdentitiesEqual(left, right) {
-  return left.context_binding_b64u === right.context_binding_b64u && left.derivation_client_share_public_key33_b64u === right.derivation_client_share_public_key33_b64u && left.server_public_key33_b64u === right.server_public_key33_b64u && left.threshold_public_key33_b64u === right.threshold_public_key33_b64u && left.ethereum_address20_b64u === right.ethereum_address20_b64u && left.client_share_retry_counter === right.client_share_retry_counter && left.server_share_retry_counter === right.server_share_retry_counter;
-}
-function routerAbServerIdentitiesEqual(left, right) {
-  return left.server_id === right.server_id && left.key_epoch === right.key_epoch && left.recipient_encryption_key === right.recipient_encryption_key;
-}
 function assertNormalSigningMatchesActivation(input) {
   const scope = input.normalSigning.scope;
   const facts = input.roleLocalPublicFacts;
@@ -6861,7 +6855,7 @@ function assertNormalSigningMatchesActivation(input) {
     lifecycleBinding: expectedMaterialActivation.lifecycleBinding,
     signingWorker: expectedMaterialActivation.signingWorker
   });
-  if (scope.wallet_id !== String(input.activationBinding.signer.walletId) || scope.ecdsa_threshold_key_id !== String(input.activationBinding.roleLocalBinding.ecdsaThresholdKeyId) || scope.signing_root_id !== String(input.activationBinding.signer.signingRootId) || scope.signing_root_version !== String(input.activationBinding.signer.signingRootVersion) || scope.context.application_binding_digest_b64u !== input.receipt.ecdsa_activation.context.application_binding_digest_b64u || !routerAbEcdsaPublicIdentitiesEqual(scope.public_identity, input.receipt.ecdsa_activation.public_identity) || !routerAbServerIdentitiesEqual(scope.signing_worker, input.receipt.ecdsa_activation.signing_worker) || scope.activation_epoch !== input.receipt.ecdsa_activation.activation_epoch || scope.public_identity.context_binding_b64u !== facts.contextBinding32B64u || scope.public_identity.derivation_client_share_public_key33_b64u !== facts.derivationClientSharePublicKey33B64u || scope.public_identity.server_public_key33_b64u !== facts.relayerPublicKey33B64u || scope.public_identity.threshold_public_key33_b64u !== facts.groupPublicKey33B64u || !sameRouterAbMpcMaterialActivationRef(scope.material_activation, expectedMaterialActivationWire)) {
+  if (scope.wallet_id !== String(input.activationBinding.signer.walletId) || scope.ecdsa_threshold_key_id !== String(input.activationBinding.roleLocalBinding.ecdsaThresholdKeyId) || scope.signing_root_id !== String(input.activationBinding.signer.signingRootId) || scope.signing_root_version !== String(input.activationBinding.signer.signingRootVersion) || scope.context.application_binding_digest_b64u !== input.receipt.ecdsa_activation.context.application_binding_digest_b64u || !sameRouterAbEcdsaDerivationPublicIdentityV1(scope.public_identity, input.receipt.ecdsa_activation.public_identity) || !sameRouterAbServerIdentityV1(scope.signing_worker, input.receipt.ecdsa_activation.signing_worker) || scope.activation_epoch !== input.receipt.ecdsa_activation.activation_epoch || scope.public_identity.context_binding_b64u !== facts.contextBinding32B64u || scope.public_identity.derivation_client_share_public_key33_b64u !== facts.derivationClientSharePublicKey33B64u || scope.public_identity.server_public_key33_b64u !== facts.relayerPublicKey33B64u || scope.public_identity.threshold_public_key33_b64u !== facts.groupPublicKey33B64u || !sameRouterAbMpcMaterialActivationRef(scope.material_activation, expectedMaterialActivationWire)) {
     throw new Error("ECDSA normal-signing runtime does not match its activation");
   }
 }
@@ -9697,9 +9691,6 @@ function requireNonEmptyCanonicalString(value, label) {
   }
   return value;
 }
-function verifiedClientActivationFactsEqual(left, right) {
-  return left.registrationRequestDigestB64u === right.registrationRequestDigestB64u && left.proofTranscriptDigestB64u === right.proofTranscriptDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && left.derivationClientSharePublicKey33B64u === right.derivationClientSharePublicKey33B64u && left.clientShareRetryCounter === right.clientShareRetryCounter && left.participantId === right.participantId;
-}
 function requireExactKeys4(record, label, keys) {
   const actual = Object.keys(record).sort();
   const expected = [...keys].sort();
@@ -9766,7 +9757,7 @@ function assertCanonicalRequestMatchesVerifiedCeremony(input) {
       throw new Error("ECDSA activation operation requires an idempotency key");
     }
     const publicFacts = parseRouterAbEcdsaVerifiedClientActivationFactsV1(request.publicFacts);
-    if (!verifiedClientActivationFactsEqual(publicFacts, input.clientActivation)) {
+    if (!sameRouterAbEcdsaVerifiedClientActivationFactsV1(publicFacts, input.clientActivation)) {
       throw new Error("ECDSA activation operation changed the verified client facts");
     }
     return;
@@ -9776,7 +9767,7 @@ function assertCanonicalRequestMatchesVerifiedCeremony(input) {
       throw new Error("ECDSA activation operation changed the activation correlation");
     }
     const publicFacts = parseRouterAbEcdsaVerifiedClientActivationFactsV1(request.publicFacts);
-    if (!verifiedClientActivationFactsEqual(publicFacts, input.clientActivation)) {
+    if (!sameRouterAbEcdsaVerifiedClientActivationFactsV1(publicFacts, input.clientActivation)) {
       throw new Error("ECDSA activation operation changed the verified client facts");
     }
     return;
@@ -9798,7 +9789,7 @@ function assertCanonicalRequestMatchesVerifiedCeremony(input) {
     throw new Error("ECDSA activation commit request changed the prepared request digest");
   }
   const publicFacts = parseRouterAbEcdsaVerifiedClientActivationFactsV1(ecdsa.publicFacts);
-  if (!verifiedClientActivationFactsEqual(publicFacts, input.clientActivation)) {
+  if (!sameRouterAbEcdsaVerifiedClientActivationFactsV1(publicFacts, input.clientActivation)) {
     throw new Error("ECDSA activation commit request changed the verified client facts");
   }
 }

package/dist/workers/ecdsa-presign-client.worker.js

@@ -604,8 +604,7 @@ var opaqueMaterials = new Map;
 var pendingOpaqueAuthorities = new Map;
 var opaqueSessionPorts = new Map;
 var opaqueSessionBindings = new Map;
-var derivationPort = null;
-var linkedHolderPort = null;
+var authorityChannel = null;
 var onlinePort = null;
 var messageQueue = Promise.resolve();
 function randomHandle(prefix) {
@@ -692,14 +691,16 @@ async function initializeSession(payload) {
   if (materialExpiresAtMs < ceremonyExpiresAtMs) {
     throw new Error("ECDSA presign material expiry must cover the ceremony");
   }
+  const channel = authorityChannel;
+  const requestId = randomHandle("ecdsa-presign-init");
+  const groupPublicKeyBuffer = groupPublicKey33.slice().buffer;
+  let request;
   switch (payload.authority.kind) {
-    case "role_local_derivation_handle": {
-      if (!derivationPort) {
+    case "role_local_derivation_handle":
+      if (channel?.kind !== "role_local_derivation_handle") {
         throw new Error("ECDSA presign client has no derivation material channel");
       }
-      const requestId = randomHandle("ecdsa-role-local-presign");
-      const groupPublicKeyBuffer = groupPublicKey33.slice().buffer;
-      const result = await requestOpaqueAuthority(derivationPort, {
+      request = {
         kind: "opaque_ecdsa_presign_session_init_v1",
         requestId,
         sessionId,
@@ -712,33 +713,13 @@ async function initializeSession(payload) {
         groupPublicKey33: groupPublicKeyBuffer,
         ceremonyExpiresAtMs,
         materialExpiresAtMs
-      }, [groupPublicKeyBuffer]);
-      const progress = requireOpaqueProgress(result);
-      retainCompletedMaterial({
-        progress,
-        authorityPort: derivationPort,
-        poolIdentity,
-        groupPublicKey33,
-        expiresAtMs: materialExpiresAtMs
-      });
-      if (progress.event !== "presign_done") {
-        opaqueSessionPorts.set(sessionId, derivationPort);
-        opaqueSessionBindings.set(sessionId, {
-          poolIdentity,
-          groupPublicKey33: groupPublicKey33.slice(),
-          ceremonyExpiresAtMs,
-          materialExpiresAtMs
-        });
-      }
-      return { authority: { kind: "role_local_derivation_handle" }, progress };
-    }
-    case "linked_holder_signing_material": {
-      if (!linkedHolderPort) {
+      };
+      break;
+    case "linked_holder_signing_material":
+      if (channel?.kind !== "linked_holder_signing_material") {
         throw new Error("ECDSA presign client has no linked holder material channel");
       }
-      const requestId = randomHandle("linked-holder-ecdsa-presign");
-      const groupPublicKeyBuffer = groupPublicKey33.slice().buffer;
-      const result = await requestOpaqueAuthority(linkedHolderPort, {
+      request = {
         kind: "opaque_ecdsa_presign_session_init_v1",
         requestId,
         sessionId,
@@ -750,30 +731,39 @@ async function initializeSession(payload) {
         groupPublicKey33: groupPublicKeyBuffer,
         ceremonyExpiresAtMs,
         materialExpiresAtMs
-      }, [groupPublicKeyBuffer]);
-      const progress = requireOpaqueProgress(result);
-      retainCompletedMaterial({
-        progress,
-        authorityPort: linkedHolderPort,
-        poolIdentity,
-        groupPublicKey33,
-        expiresAtMs: materialExpiresAtMs
-      });
-      if (progress.event !== "presign_done") {
-        opaqueSessionPorts.set(sessionId, linkedHolderPort);
-        opaqueSessionBindings.set(sessionId, {
-          poolIdentity,
-          groupPublicKey33: groupPublicKey33.slice(),
-          ceremonyExpiresAtMs,
-          materialExpiresAtMs
-        });
-      }
-      return { authority: { kind: "linked_holder_signing_material" }, progress };
-    }
+      };
+      break;
     default:
       payload.authority;
       throw new Error("Unsupported ECDSA presign authority");
   }
+  const result = await requestOpaqueAuthority(channel.port, request, [groupPublicKeyBuffer]);
+  const progress = requireOpaqueProgress(result);
+  retainCompletedMaterial({
+    progress,
+    authorityPort: channel.port,
+    poolIdentity,
+    groupPublicKey33,
+    expiresAtMs: materialExpiresAtMs
+  });
+  if (progress.event !== "presign_done") {
+    opaqueSessionPorts.set(sessionId, channel.port);
+    opaqueSessionBindings.set(sessionId, {
+      poolIdentity,
+      groupPublicKey33: groupPublicKey33.slice(),
+      ceremonyExpiresAtMs,
+      materialExpiresAtMs
+    });
+  }
+  switch (request.authority.kind) {
+    case "role_local_derivation_handle":
+      return { authority: { kind: "role_local_derivation_handle" }, progress };
+    case "linked_holder_signing_material":
+      return { authority: { kind: "linked_holder_signing_material" }, progress };
+    default:
+      request.authority;
+      throw new Error("Unsupported ECDSA presign authority");
+  }
 }
 async function stepSession(payload) {
   const sessionId = coerceNonNullishString(payload.sessionId, "sessionId");
@@ -1132,8 +1122,9 @@ async function listAvailablePresignatures(payload) {
       expiresAtMs: entry.expiresAtMs
     });
   }
-  if (derivationPort) {
-    const result = await requestOpaqueAuthority(derivationPort, {
+  const channel = authorityChannel;
+  if (channel?.kind === "role_local_derivation_handle") {
+    const result = await requestOpaqueAuthority(channel.port, {
       kind: "opaque_ecdsa_presign_material_list_v1",
       requestId: randomHandle("opaque-ecdsa-presign-list"),
       poolIdentity
@@ -1155,7 +1146,7 @@ async function listAvailablePresignatures(payload) {
         continue;
       }
       opaqueMaterials.set(materialHandle, {
-        authorityPort: derivationPort,
+        authorityPort: channel.port,
         poolIdentity,
         groupPublicKey33,
         bigR33: bigR33.buffer,
@@ -1177,29 +1168,23 @@ async function listAvailablePresignatures(payload) {
   }
   return refs.sort((left, right) => left.createdAtMs - right.createdAtMs);
 }
+function replaceAuthorityChannel(channel) {
+  if (authorityChannel) {
+    purgeAuthorityPort(authorityChannel.port, "ECDSA presign authority channel was replaced");
+    authorityChannel.port.close();
+  }
+  authorityChannel = channel;
+  channel.port.onmessage = handleOpaqueAuthorityResponse.bind(null, channel.port);
+  channel.port.onmessageerror = purgeAuthorityPort.bind(null, channel.port, "ECDSA presign authority channel failed");
+  channel.port.start();
+}
 function attachControlChannel(value) {
   if (isAttachEcdsaDerivationToPresignPort(value)) {
-    if (derivationPort) {
-      purgeAuthorityPort(derivationPort, "ECDSA derivation presign authority channel was replaced");
-    }
-    derivationPort?.close();
-    derivationPort = value.port;
-    derivationPort.onmessage = (event) => handleOpaqueAuthorityResponse(value.port, event);
-    derivationPort.onmessageerror = () => purgeAuthorityPort(value.port, "ECDSA derivation presign authority channel failed");
-    derivationPort.start();
+    replaceAuthorityChannel({ kind: "role_local_derivation_handle", port: value.port });
     return true;
   }
   if (isAttachLinkedHolderToPresignPort(value)) {
-    if (linkedHolderPort) {
-      purgeAuthorityPort(linkedHolderPort, "Linked holder ECDSA presign authority channel was replaced");
-    }
-    linkedHolderPort?.close();
-    linkedHolderPort = value.port;
-    linkedHolderPort.onmessage = (event) => handleOpaqueAuthorityResponse(value.port, event);
-    linkedHolderPort.onmessageerror = () => {
-      purgeAuthorityPort(value.port, "Linked holder ECDSA presign authority channel failed");
-    };
-    linkedHolderPort.start();
+    replaceAuthorityChannel({ kind: "linked_holder_signing_material", port: value.port });
     return true;
   }
   if (isAttachPresignToOnlinePort(value)) {

package/dist/workers/email-otp.worker.js

@@ -5,6 +5,7 @@ var WorkerControlMessage = {
 
 // ../shared-ts/src/utils/emailOtpDomain.ts
 var EMAIL_OTP_CHANNEL = "email_otp";
+var EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 = "seams/email-otp/factor-release/v1";
 var WALLET_EMAIL_OTP_LOGIN_OPERATIONS = [
   "wallet_unlock",
   "transaction_sign",
@@ -109,6 +110,11 @@ function requireCanonicalBase64Url(value, label) {
   }
   return decoded;
 }
+function requireParsed(result, label) {
+  if (result.ok)
+    return result.value;
+  throw new Error(`${label} ${result.error.message}`);
+}
 function parseDigestField(value, label) {
   try {
     return parseDigestB64u(value);
@@ -5025,11 +5031,6 @@ function exactRecord2(raw, fields, label) {
   }
   return record;
 }
-function requireParsed(parsed, label) {
-  if (!parsed.ok)
-    throw new Error(`${label} ${parsed.error.message}`);
-  return parsed.value;
-}
 // ../shared-ts/src/utils/routerAbPublicKeyset.ts
 function requireRouterAbX25519PublicKey(value, label) {
   const publicKey = coerceNonEmptyString(value, label);
@@ -5086,6 +5087,9 @@ function normalizeRuntimePolicyScopeFields(input) {
     ...normalizeOptionalTrimmedString(scope.signingRootVersion) ? { signingRootVersion: normalizeOptionalTrimmedString(scope.signingRootVersion) } : {}
   };
 }
+function sameRuntimePolicyScope(left, right) {
+  return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
+}
 function signingRootScopeFromRuntimePolicyScope(scope) {
   return {
     signingRootId: deriveSigningRootId(scope),
@@ -6889,9 +6893,6 @@ function readThresholdEd25519SessionId(value, label) {
   }
   return parsed.value;
 }
-function readEvmFamilySigningKeySlotId(value, label) {
-  return requireEvmFamilySigningKeySlotId(value, label);
-}
 function readNumber(value, label) {
   const normalized = Number(value);
   if (!Number.isFinite(normalized)) {
@@ -7097,7 +7098,7 @@ function parseOptionalWorkerEcdsaSessionHandleBinding(value) {
       throw new Error("Email OTP wallet-registration ECDSA handle binding requires evm-family keyScope");
     }
     return {
-      evmFamilySigningKeySlotId: String(readEvmFamilySigningKeySlotId(obj.evmFamilySigningKeySlotId, "ecdsaSessionHandleBinding.evmFamilySigningKeySlotId")),
+      evmFamilySigningKeySlotId: String(requireEvmFamilySigningKeySlotId(obj.evmFamilySigningKeySlotId, "ecdsaSessionHandleBinding.evmFamilySigningKeySlotId")),
       authSubjectId: readString(obj.authSubjectId, "ecdsaSessionHandleBinding.authSubjectId"),
       action: "wallet_registration_ecdsa_prepare",
       operation: "registration",
@@ -9731,7 +9732,6 @@ async function addClientSealFromBytes(args) {
     keyHandle: args.keyHandle
   }), "wrappedCiphertext");
 }
-var EMAIL_OTP_FACTOR_RELEASE_AAD_PREFIX = "seams/email-otp/factor-release/v1";
 async function generateEmailOtpFactorReleaseKeyPair(label) {
   const subtle = globalThis.crypto?.subtle;
   if (!subtle)
@@ -9755,7 +9755,7 @@ async function openEmailOtpFactorReleaseCiphertext(args) {
     const aesKey = await args.subtle.importKey("raw", sharedSecret, { name: "AES-GCM" }, false, [
       "decrypt"
     ]);
-    aad = new TextEncoder().encode(`${EMAIL_OTP_FACTOR_RELEASE_AAD_PREFIX}\x00${args.walletId}\x00${args.enrollmentId}\x00${args.enrollmentSealKeyVersion}\x00${args.challengeId}`);
+    aad = new TextEncoder().encode(`${EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1}\x00${args.walletId}\x00${args.enrollmentId}\x00${args.enrollmentSealKeyVersion}\x00${args.challengeId}`);
     factorSecret32 = new Uint8Array(await args.subtle.decrypt({ name: "AES-GCM", iv: args.nonce, additionalData: aad, tagLength: 128 }, aesKey, args.ciphertext));
     if (factorSecret32.length !== 32) {
       throw new Error("Email OTP factor release plaintext must contain exactly 32 bytes");
@@ -11746,9 +11746,6 @@ function bytesToLowerHex(bytes) {
     output += byte.toString(16).padStart(2, "0");
   return output;
 }
-function sameEmailOtpRuntimePolicyScope(left, right) {
-  return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
 function walletSessionHasEcdsaActivation(args) {
   const materialActivation = routerAbMpcMaterialActivationRefFromWire(args.activation.public_capability.material_activation);
   let matchCount = 0;
@@ -12057,7 +12054,7 @@ async function restoreEmailOtpEcdsaMaterialFromCustody(args) {
       throw new Error("Email OTP ECDSA custody continuity does not match the requested key set");
     }
     for (const signer of args.continuity.signers) {
-      if (signer.walletKey.walletId !== args.projection.walletId || signer.walletKey.keyHandle !== first.walletKey.keyHandle || signer.walletKey.ecdsaThresholdKeyId !== first.walletKey.ecdsaThresholdKeyId || signer.walletKey.signingRootId !== first.walletKey.signingRootId || signer.walletKey.signingRootVersion !== first.walletKey.signingRootVersion || signer.walletKey.relayerKeyId !== first.walletKey.relayerKeyId || !sameRouterAbEcdsaDerivationPublicCapabilityV1(signer.walletKey.publicCapability, first.walletKey.publicCapability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(signer.activationReceipt, first.activationReceipt) || !sameEmailOtpRuntimePolicyScope(signer.runtimePolicyScope, first.runtimePolicyScope)) {
+      if (signer.walletKey.walletId !== args.projection.walletId || signer.walletKey.keyHandle !== first.walletKey.keyHandle || signer.walletKey.ecdsaThresholdKeyId !== first.walletKey.ecdsaThresholdKeyId || signer.walletKey.signingRootId !== first.walletKey.signingRootId || signer.walletKey.signingRootVersion !== first.walletKey.signingRootVersion || signer.walletKey.relayerKeyId !== first.walletKey.relayerKeyId || !sameRouterAbEcdsaDerivationPublicCapabilityV1(signer.walletKey.publicCapability, first.walletKey.publicCapability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(signer.activationReceipt, first.activationReceipt) || !sameRuntimePolicyScope(signer.runtimePolicyScope, first.runtimePolicyScope)) {
         throw new Error("Email OTP ECDSA custody continuity conflicts across targets");
       }
     }
@@ -12843,7 +12840,7 @@ function assertEmailOtpEd25519YaoExportCapabilityContinuity(args) {
   if (!signingRoot) {
     throw new Error("Email OTP Ed25519 Yao export runtime policy scope is invalid");
   }
-  if (capability.nearAccountId !== args.nearAccountId || capability.applicationBinding.wallet_id !== args.walletId || capability.applicationBinding.near_ed25519_signing_key_id !== args.nearEd25519SigningKeyId || capability.applicationBinding.key_creation_signer_slot !== args.signerSlot || capability.applicationBinding.signing_root_id !== signingRoot.signingRootId || capability.lifecycle.accountId !== args.walletId || capability.lifecycle.rootShareEpoch !== args.runtimePolicyScope.signingRootVersion || !sameEmailOtpRuntimePolicyScope(capability.runtimePolicyScope, args.runtimePolicyScope)) {
+  if (capability.nearAccountId !== args.nearAccountId || capability.applicationBinding.wallet_id !== args.walletId || capability.applicationBinding.near_ed25519_signing_key_id !== args.nearEd25519SigningKeyId || capability.applicationBinding.key_creation_signer_slot !== args.signerSlot || capability.applicationBinding.signing_root_id !== signingRoot.signingRootId || capability.lifecycle.accountId !== args.walletId || capability.lifecycle.rootShareEpoch !== args.runtimePolicyScope.signingRootVersion || !sameRuntimePolicyScope(capability.runtimePolicyScope, args.runtimePolicyScope)) {
     throw new Error("Email OTP Ed25519 Yao export capability changed the exact durable lane");
   }
   const nearAccountId = args.nearAccountId.trim().toLowerCase();

package/dist/workers/wallet-custody-ceremony.worker.js

@@ -3796,6 +3796,11 @@ function requireCanonicalBase64Url(value, label) {
   }
   return decoded;
 }
+function requireParsed(result, label) {
+  if (result.ok)
+    return result.value;
+  throw new Error(`${label} ${result.error.message}`);
+}
 function parseDigestField(value, label) {
   try {
     return parseDigestB64u(value);
@@ -4771,11 +4776,6 @@ var OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
   "custodyKeyManifestDigestB64u",
   "sourceIdentityDigestB64u"
 ];
-function requireResult(result, label) {
-  if (result.ok)
-    return result.value;
-  throw new Error(`${label} ${result.error.message}`);
-}
 function parseWalletSignerId(raw, label = "walletSignerId") {
   if (typeof raw !== "string")
     throw new Error(`${label} must be a string`);
@@ -4809,7 +4809,7 @@ function buildOwnerLaneParticipantContinuityV1(args) {
     kind: "owner_lane_participant_continuity_v1",
     signerId: parseWalletSignerId(args.signerId),
     participantIds,
-    signingWorkerId: requireResult(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
+    signingWorkerId: requireParsed(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
     custodyKeyManifestDigestB64u: parseDigestField(args.custodyKeyManifestDigestB64u, "custodyKeyManifestDigestB64u"),
     sourceIdentityDigestB64u: parseDigestField(args.sourceIdentityDigestB64u, "sourceIdentityDigestB64u")
   };
@@ -4823,7 +4823,7 @@ function parseOwnerLaneParticipantContinuityV1(raw, label = "ownerParticipantCon
   return buildOwnerLaneParticipantContinuityV1({
     signerId: parseWalletSignerId(record.signerId, `${label}.signerId`),
     participantIds: parseParticipantIds(record.participantIds, `${label}.participantIds`),
-    signingWorkerId: requireResult(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
+    signingWorkerId: requireParsed(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
     custodyKeyManifestDigestB64u: parseDigestField(record.custodyKeyManifestDigestB64u, `${label}.custodyKeyManifestDigestB64u`),
     sourceIdentityDigestB64u: parseDigestField(record.sourceIdentityDigestB64u, `${label}.sourceIdentityDigestB64u`)
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "type": "module",
   "description": "Seams web and runtime TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",

package/dist/esm/components/AccountMenuButton/HaloBorder/HaloBorder.css

@@ -1,101 +0,0 @@
-/* Translucent outer shell wrapping solid content */
-.seams-halo-border-root {
-  background: transparent;
-  border-radius: 2rem;
-  padding: 0px;
-  max-width: 860px;
-  box-sizing: border-box;
-  box-shadow: var(--seams-halo__border-shadow, none);
-  /* width: 100%; */
-  width: fit-content;
-  height: fit-content;
-}
-
-.seams-halo-border-inner {
-  background: transparent;
-  border: 1px solid transparent;
-  border-radius: 2rem;
-  padding: var(--seams-halo__padding, 1rem);
-  position: relative;
-}
-
-.seams-halo-border-content {
-  background: var(--seams-halo__inner-background, var(--seams-colors-colorBackground));
-  /* border: 1px solid var(--seams-colors-borderPrimary); */
-  border-radius: var(--seams-halo__ring-border-radius, 2rem);
-  padding: var(--seams-halo__inner-padding, 2rem);
-  position: relative;
-  z-index: 2; /* keep content above the ring */
-}
-
-/* Rotating border container using pseudo-elements */
-.seams-rotating-border-container {
-  position: relative;
-  border-radius: 2rem;
-  overflow: visible; /* allow the outside ring to show */
-}
-
-/*
-  Rotating floating ring using a conic-gradient + mask.
-  - --seams-halo__ring-gap   : distance between the content edge and the ring
-  - --seams-halo__ring-width : thickness of the ring
-  - --seams-halo__ring-border-radius : border radius of the rotating arc
-  - --seams-halo__border-shadow : box shadow of the rotating ring
-  - --seams-halo__padding : outer padding of the container
-  - --seams-halo__inner-padding : inner border padding of the container
-  - --seams-halo__inner-background : inner background color of the container
-
-  Technique:
-  The ::before pseudo-element is inset by the gap, then we use a mask with
-  content-box/xor to keep only the padding area (i.e. the ring width).
-*/
-.seams-rotating-border-container::before {
-  content: '';
-  position: absolute;
-  /* Extend outside the box so the ring is OUTSIDE */
-  inset: calc(-1 * (var(--seams-halo__ring-gap, 8px) + var(--seams-halo__ring-width, 2px)));
-  border-radius: calc(
-    var(--seams-halo__ring-border-radius) + var(--seams-halo__ring-gap, 8px) +
-      var(--seams-halo__ring-width, 2px)
-  );
-  pointer-events: none;
-  z-index: 3; /* sit above content so it's visible */
-
-  /* Animated conic gradient arc */
-  background: conic-gradient(
-    from var(--seams-ring-angle, 0deg),
-    transparent 0%,
-    #4daffe 10%,
-    #4daffe 25%,
-    transparent 35%
-  );
-
-  /* Keep only the padding area = ring width */
-  padding: var(--seams-halo__ring-width, 2px);
-  -webkit-mask:
-    linear-gradient(#000 0 0) content-box,
-    linear-gradient(#000 0 0);
-  -webkit-mask-composite: xor;
-  mask-composite: exclude;
-
-  animation: seams-ring-rotate 1.15s linear infinite;
-}
-
-/* Make the custom angle property animatable */
-@property --seams-ring-angle {
-  syntax: '<angle>';
-  initial-value: 0deg;
-  inherits: false;
-}
-
-@keyframes seams-ring-rotate {
-  from {
-    --seams-ring-angle: 0deg;
-  }
-  to {
-    --seams-ring-angle: 360deg;
-  }
-}
-
-/* Legacy styles removed: the new ring implementation supersedes
-   the older conic-gradient border approach. */