@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/shared-ts/src/signing-lanes/recordParsers.js

@@ -1,479 +0,0 @@
-import { hasWhitespaceOrControlCharacters, parseLaneShareEpoch, parseLinkedDeviceId, parseSigningLaneId, parseWalletAuthMethodId, parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
-import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
-import { parseDigestField, parseEd25519PublicKeyB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs, requireParsed } from "../passkey-custody/primitives.js";
-import { parseNearEd25519SigningKeyId } from "../utils/registrationIds.js";
-import { requireEvmFamilySigningKeySlotId } from "./evmFamilySigningKeySlotId.js";
-import { parseLaneHolderParticipantRecordV1, parseLaneParticipantBindingDigestB64u, parseSigningWorkerParticipantRecordV1 } from "./participants.js";
-import { parseOwnerLaneParticipantContinuityV1 } from "./ownerContinuity.js";
-//#region ../shared-ts/src/signing-lanes/recordParsers.ts
-const WALLET_KEY_COMMON_FIELDS = [
-	"kind",
-	"keyFamily",
-	"walletId",
-	"walletKeyId",
-	"walletKeyVersion",
-	"lifecycle"
-];
-const ED25519_WALLET_KEY_FIELDS = [
-	...WALLET_KEY_COMMON_FIELDS,
-	"nearEd25519SigningKeyId",
-	"keyCreationSignerSlot",
-	"registeredPublicKeyB64u"
-];
-const EVM_WALLET_KEY_FIELDS = [
-	...WALLET_KEY_COMMON_FIELDS,
-	"evmFamilySigningKeySlotId",
-	"thresholdPublicKey33B64u",
-	"evmAddress"
-];
-const ALL_WALLET_KEY_FIELDS = Array.from(new Set([...ED25519_WALLET_KEY_FIELDS, ...EVM_WALLET_KEY_FIELDS]));
-const WALLET_KEY_LIFECYCLE_FIELDS = [
-	"state",
-	"activatedAtMs",
-	"retiredAtMs",
-	"compromisedAtMs"
-];
-const SIGNING_LANE_RECORD_BASE_FIELDS = [...[
-	"kind",
-	"walletId",
-	"walletKeyId",
-	"laneId",
-	"laneKind",
-	"laneShareEpoch",
-	"participantBindingDigestB64u"
-], "lifecycle"];
-const OWNER_AUTH_SIGNING_LANE_FIELDS = [
-	...SIGNING_LANE_RECORD_BASE_FIELDS,
-	"walletAuthMethodId",
-	"ownerParticipantContinuity"
-];
-const PRIVILEGED_OWNER_SIGNING_LANE_FIELDS = [...SIGNING_LANE_RECORD_BASE_FIELDS, "ownerParticipantContinuity"];
-const ROTATABLE_SIGNING_LANE_FIELDS = [
-	...SIGNING_LANE_RECORD_BASE_FIELDS,
-	"holderParticipant",
-	"serverParticipant"
-];
-const DELEGATED_SIGNING_LANE_FIELDS = [
-	...ROTATABLE_SIGNING_LANE_FIELDS,
-	"authorizationId",
-	"agentIdentityKeyId",
-	"custodyBindingId",
-	"authorizationBindingDigestB64u"
-];
-const LINKED_DEVICE_SIGNING_LANE_FIELDS = [...ROTATABLE_SIGNING_LANE_FIELDS, "linkedDeviceId"];
-const ALL_SIGNING_LANE_RECORD_FIELDS = Array.from(new Set([
-	...OWNER_AUTH_SIGNING_LANE_FIELDS,
-	...PRIVILEGED_OWNER_SIGNING_LANE_FIELDS,
-	...DELEGATED_SIGNING_LANE_FIELDS,
-	...LINKED_DEVICE_SIGNING_LANE_FIELDS
-]));
-const ALL_SIGNING_LANE_LIFECYCLE_FIELDS = [
-	"state",
-	"revocationEpoch",
-	"startedAtMs",
-	"deliveryDigestB64u",
-	"activatedAtMs",
-	"activationReceiptDigestB64u",
-	"revokedAtMs",
-	"revokeReason"
-];
-function signingLaneRecordFields(laneKind) {
-	switch (laneKind) {
-		case "owner_passkey":
-		case "owner_email_otp": return OWNER_AUTH_SIGNING_LANE_FIELDS;
-		case "recovery":
-		case "break_glass": return PRIVILEGED_OWNER_SIGNING_LANE_FIELDS;
-		case "linked_device": return LINKED_DEVICE_SIGNING_LANE_FIELDS;
-		case "delegated_execution": return DELEGATED_SIGNING_LANE_FIELDS;
-	}
-}
-function parseRequiredDomainId(raw, label) {
-	if (raw === void 0 || raw === null) throw new Error(`${label} is required`);
-	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
-	const value = raw.trim();
-	if (!value) throw new Error(`${label} is required`);
-	if (hasWhitespaceOrControlCharacters(value)) throw new Error(`${label} must not contain whitespace or control characters`);
-	return value;
-}
-function parseNonEmptyString(raw, label) {
-	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
-	const value = raw.trim();
-	if (!value) throw new Error(`${label} is required`);
-	if (hasWhitespaceOrControlCharacters(value)) throw new Error(`${label} must not contain whitespace or control characters`);
-	return value;
-}
-function parseNonNegativeSafeInteger(raw, label) {
-	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	return raw;
-}
-function parseWalletKeyVersion(raw, label = "walletKeyVersion") {
-	return parseRequiredDomainId(raw, label);
-}
-function parseAgentIdentityKeyId(raw, label) {
-	return parseRequiredDomainId(raw, label);
-}
-function parseAgentCustodyBindingId(raw, label) {
-	return parseRequiredDomainId(raw, label);
-}
-function parseDelegatedSpendAuthorizationId(raw, label) {
-	return parseRequiredDomainId(raw, label);
-}
-function parseSigningLaneKind(raw, label) {
-	switch (raw) {
-		case "owner_passkey":
-		case "owner_email_otp":
-		case "linked_device":
-		case "delegated_execution":
-		case "recovery":
-		case "break_glass": return raw;
-		default: throw new Error(`${label} must be a known signing lane kind`);
-	}
-}
-function parseWalletKeyLifecycleState(raw, label) {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, WALLET_KEY_LIFECYCLE_FIELDS, label, WALLET_KEY_LIFECYCLE_FIELDS);
-	switch (record.state) {
-		case "active":
-			if (record.retiredAtMs !== void 0 || record.compromisedAtMs !== void 0) throw new Error(`${label} cannot be active and carry a retired or compromised timestamp`);
-			return buildActiveWalletKeyLifecycle({ activatedAtMs: parseUnixMs(record.activatedAtMs, `${label}.activatedAtMs`) });
-		case "retired":
-			if (record.activatedAtMs !== void 0 || record.compromisedAtMs !== void 0) throw new Error(`${label} cannot be retired and carry an active or compromised timestamp`);
-			return buildRetiredWalletKeyLifecycle({ retiredAtMs: parseUnixMs(record.retiredAtMs, `${label}.retiredAtMs`) });
-		case "compromised":
-			if (record.activatedAtMs !== void 0 || record.retiredAtMs !== void 0) throw new Error(`${label} cannot be compromised and carry an active or retired timestamp`);
-			return buildCompromisedWalletKeyLifecycle({ compromisedAtMs: parseUnixMs(record.compromisedAtMs, `${label}.compromisedAtMs`) });
-		default: throw new Error(`${label}.state must be active, retired, or compromised`);
-	}
-}
-function parseSigningLaneLifecycleState(raw, label) {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, ALL_SIGNING_LANE_LIFECYCLE_FIELDS, label);
-	const revocationEpoch = parseNonNegativeSafeInteger(record.revocationEpoch, `${label}.revocationEpoch`);
-	switch (record.state) {
-		case "provisioning":
-			if (record.deliveryDigestB64u !== void 0 || record.activatedAtMs !== void 0 || record.activationReceiptDigestB64u !== void 0 || record.revokedAtMs !== void 0 || record.revokeReason !== void 0) throw new Error(`${label} provisioning state carries fields from another lifecycle state`);
-			return buildProvisioningSigningLaneLifecycle({
-				revocationEpoch,
-				startedAtMs: parseUnixMs(record.startedAtMs, `${label}.startedAtMs`)
-			});
-		case "pending_receipt":
-			if (record.activatedAtMs !== void 0 || record.activationReceiptDigestB64u !== void 0 || record.revokedAtMs !== void 0 || record.revokeReason !== void 0) throw new Error(`${label} pending_receipt state carries fields from another lifecycle state`);
-			return buildPendingReceiptSigningLaneLifecycle({
-				revocationEpoch,
-				startedAtMs: parseUnixMs(record.startedAtMs, `${label}.startedAtMs`),
-				deliveryDigestB64u: parseDigestField(record.deliveryDigestB64u, `${label}.deliveryDigestB64u`)
-			});
-		case "active":
-			if (record.startedAtMs !== void 0 || record.deliveryDigestB64u !== void 0 || record.revokedAtMs !== void 0 || record.revokeReason !== void 0) throw new Error(`${label} active state carries fields from another lifecycle state`);
-			return buildActiveSigningLaneLifecycle({
-				revocationEpoch,
-				activatedAtMs: parseUnixMs(record.activatedAtMs, `${label}.activatedAtMs`),
-				activationReceiptDigestB64u: parseDigestField(record.activationReceiptDigestB64u, `${label}.activationReceiptDigestB64u`)
-			});
-		case "revoked": {
-			if (record.startedAtMs !== void 0 || record.deliveryDigestB64u !== void 0 || record.activatedAtMs !== void 0 || record.activationReceiptDigestB64u !== void 0) throw new Error(`${label} revoked state carries fields from another lifecycle state`);
-			const revokeReason = record.revokeReason;
-			if (revokeReason !== "user_revoked" && revokeReason !== "device_compromise" && revokeReason !== "agent_compromise" && revokeReason !== "rotation") throw new Error(`${label}.revokeReason is invalid`);
-			return buildRevokedSigningLaneLifecycle({
-				revocationEpoch,
-				revokedAtMs: parseUnixMs(record.revokedAtMs, `${label}.revokedAtMs`),
-				revokeReason
-			});
-		}
-		default: throw new Error(`${label}.state must be provisioning, pending_receipt, active, or revoked`);
-	}
-}
-function parseSigningLaneReferenceFields(record, label) {
-	if (record.kind !== "signing_lane_reference_v1") throw new Error(`${label}.kind must be signing_lane_reference_v1`);
-	return buildSigningLaneReference({
-		walletId: requireParsed(parseWalletId(record.walletId), `${label}.walletId`),
-		walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
-		laneId: requireParsed(parseSigningLaneId(record.laneId), `${label}.laneId`),
-		laneShareEpoch: requireParsed(parseLaneShareEpoch(record.laneShareEpoch), `${label}.laneShareEpoch`),
-		laneKind: parseSigningLaneKind(record.laneKind, `${label}.laneKind`),
-		participantBindingDigestB64u: requireParsed(parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u), `${label}.participantBindingDigestB64u`)
-	});
-}
-function parseSigningLaneRecordCommon(record, label) {
-	const reference = parseSigningLaneReferenceFields(record, label);
-	return {
-		walletId: reference.walletId,
-		walletKeyId: reference.walletKeyId,
-		laneId: reference.laneId,
-		laneShareEpoch: reference.laneShareEpoch,
-		participantBindingDigestB64u: reference.participantBindingDigestB64u,
-		lifecycle: parseSigningLaneLifecycleState(record.lifecycle, `${label}.lifecycle`)
-	};
-}
-function parseOwnerAuthSigningLaneRecordBase(record, label) {
-	const common = parseSigningLaneRecordCommon(record, label);
-	const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
-	return {
-		...common,
-		walletAuthMethodId: requireParsed(walletAuthMethodId, `${label}.walletAuthMethodId`),
-		ownerParticipantContinuity: parseOwnerLaneParticipantContinuityV1(record.ownerParticipantContinuity, `${label}.ownerParticipantContinuity`)
-	};
-}
-function parsePrivilegedOwnerSigningLaneRecordBase(record, label) {
-	return {
-		...parseSigningLaneRecordCommon(record, label),
-		ownerParticipantContinuity: parseOwnerLaneParticipantContinuityV1(record.ownerParticipantContinuity, `${label}.ownerParticipantContinuity`)
-	};
-}
-function parseRotatableSigningLaneRecordBase(record, label) {
-	return {
-		...parseSigningLaneRecordCommon(record, label),
-		holderParticipant: parseLaneHolderParticipantRecordV1(record.holderParticipant, `${label}.holderParticipant`),
-		serverParticipant: parseSigningWorkerParticipantRecordV1(record.serverParticipant, `${label}.serverParticipant`)
-	};
-}
-function buildActiveWalletKeyLifecycle(args) {
-	return {
-		state: "active",
-		activatedAtMs: args.activatedAtMs
-	};
-}
-function buildRetiredWalletKeyLifecycle(args) {
-	return {
-		state: "retired",
-		retiredAtMs: args.retiredAtMs
-	};
-}
-function buildCompromisedWalletKeyLifecycle(args) {
-	return {
-		state: "compromised",
-		compromisedAtMs: args.compromisedAtMs
-	};
-}
-function buildEd25519WalletKeyRecord(args) {
-	return {
-		kind: "wallet_key_record_v1",
-		keyFamily: "ed25519",
-		walletId: args.walletId,
-		walletKeyId: args.walletKeyId,
-		walletKeyVersion: args.walletKeyVersion,
-		nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
-		keyCreationSignerSlot: args.keyCreationSignerSlot,
-		registeredPublicKeyB64u: args.registeredPublicKeyB64u,
-		lifecycle: args.lifecycle
-	};
-}
-function buildEvmFamilyWalletKeyRecord(args) {
-	return {
-		kind: "wallet_key_record_v1",
-		keyFamily: "ecdsa_secp256k1",
-		walletId: args.walletId,
-		walletKeyId: args.walletKeyId,
-		walletKeyVersion: args.walletKeyVersion,
-		evmFamilySigningKeySlotId: args.evmFamilySigningKeySlotId,
-		thresholdPublicKey33B64u: args.thresholdPublicKey33B64u,
-		evmAddress: args.evmAddress,
-		lifecycle: args.lifecycle
-	};
-}
-function buildSigningLaneReference(args) {
-	return {
-		kind: "signing_lane_reference_v1",
-		walletId: args.walletId,
-		walletKeyId: args.walletKeyId,
-		laneId: args.laneId,
-		laneKind: args.laneKind,
-		laneShareEpoch: args.laneShareEpoch,
-		participantBindingDigestB64u: args.participantBindingDigestB64u
-	};
-}
-function buildProvisioningSigningLaneLifecycle(args) {
-	return {
-		state: "provisioning",
-		revocationEpoch: args.revocationEpoch,
-		startedAtMs: args.startedAtMs
-	};
-}
-function buildPendingReceiptSigningLaneLifecycle(args) {
-	return {
-		state: "pending_receipt",
-		revocationEpoch: args.revocationEpoch,
-		startedAtMs: args.startedAtMs,
-		deliveryDigestB64u: args.deliveryDigestB64u
-	};
-}
-function buildActiveSigningLaneLifecycle(args) {
-	return {
-		state: "active",
-		revocationEpoch: args.revocationEpoch,
-		activatedAtMs: args.activatedAtMs,
-		activationReceiptDigestB64u: args.activationReceiptDigestB64u
-	};
-}
-function buildRevokedSigningLaneLifecycle(args) {
-	return {
-		state: "revoked",
-		revocationEpoch: args.revocationEpoch,
-		revokedAtMs: args.revokedAtMs,
-		revokeReason: args.revokeReason
-	};
-}
-function buildOwnerPasskeySigningLaneRecord(args) {
-	return {
-		kind: "signing_lane_reference_v1",
-		walletId: args.walletId,
-		walletKeyId: args.walletKeyId,
-		laneId: args.laneId,
-		laneKind: "owner_passkey",
-		laneShareEpoch: args.laneShareEpoch,
-		participantBindingDigestB64u: args.participantBindingDigestB64u,
-		walletAuthMethodId: args.walletAuthMethodId,
-		ownerParticipantContinuity: args.ownerParticipantContinuity,
-		lifecycle: args.lifecycle
-	};
-}
-function buildOwnerEmailOtpSigningLaneRecord(args) {
-	return {
-		kind: "signing_lane_reference_v1",
-		walletId: args.walletId,
-		walletKeyId: args.walletKeyId,
-		laneId: args.laneId,
-		laneKind: "owner_email_otp",
-		laneShareEpoch: args.laneShareEpoch,
-		participantBindingDigestB64u: args.participantBindingDigestB64u,
-		walletAuthMethodId: args.walletAuthMethodId,
-		ownerParticipantContinuity: args.ownerParticipantContinuity,
-		lifecycle: args.lifecycle
-	};
-}
-function buildLinkedDeviceSigningLaneRecord(args) {
-	return {
-		kind: "signing_lane_reference_v1",
-		walletId: args.walletId,
-		walletKeyId: args.walletKeyId,
-		laneId: args.laneId,
-		laneKind: "linked_device",
-		laneShareEpoch: args.laneShareEpoch,
-		participantBindingDigestB64u: args.participantBindingDigestB64u,
-		holderParticipant: args.holderParticipant,
-		serverParticipant: args.serverParticipant,
-		lifecycle: args.lifecycle,
-		linkedDeviceId: args.linkedDeviceId
-	};
-}
-function buildDelegatedExecutionSigningLaneRecord(args) {
-	return {
-		kind: "signing_lane_reference_v1",
-		walletId: args.walletId,
-		walletKeyId: args.walletKeyId,
-		laneId: args.laneId,
-		laneKind: "delegated_execution",
-		laneShareEpoch: args.laneShareEpoch,
-		participantBindingDigestB64u: args.participantBindingDigestB64u,
-		holderParticipant: args.holderParticipant,
-		serverParticipant: args.serverParticipant,
-		lifecycle: args.lifecycle,
-		authorizationId: args.authorizationId,
-		agentIdentityKeyId: args.agentIdentityKeyId,
-		custodyBindingId: args.custodyBindingId,
-		authorizationBindingDigestB64u: args.authorizationBindingDigestB64u
-	};
-}
-function buildRecoverySigningLaneRecord(args) {
-	return {
-		kind: "signing_lane_reference_v1",
-		walletId: args.walletId,
-		walletKeyId: args.walletKeyId,
-		laneId: args.laneId,
-		laneKind: "recovery",
-		laneShareEpoch: args.laneShareEpoch,
-		participantBindingDigestB64u: args.participantBindingDigestB64u,
-		ownerParticipantContinuity: args.ownerParticipantContinuity,
-		lifecycle: args.lifecycle
-	};
-}
-function buildBreakGlassSigningLaneRecord(args) {
-	return {
-		kind: "signing_lane_reference_v1",
-		walletId: args.walletId,
-		walletKeyId: args.walletKeyId,
-		laneId: args.laneId,
-		laneKind: "break_glass",
-		laneShareEpoch: args.laneShareEpoch,
-		participantBindingDigestB64u: args.participantBindingDigestB64u,
-		ownerParticipantContinuity: args.ownerParticipantContinuity,
-		lifecycle: args.lifecycle
-	};
-}
-function parseWalletKeyRecord(raw, label = "walletKeyRecord") {
-	const record = requireRecord(raw, label);
-	if (record.kind !== "wallet_key_record_v1") throw new Error(`${label}.kind must be wallet_key_record_v1`);
-	if (record.keyFamily === "ed25519") {
-		rejectUnknownFields(record, ED25519_WALLET_KEY_FIELDS, label, ALL_WALLET_KEY_FIELDS);
-		return buildEd25519WalletKeyRecord({
-			walletId: requireParsed(parseWalletId(record.walletId), `${label}.walletId`),
-			walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
-			walletKeyVersion: parseWalletKeyVersion(record.walletKeyVersion, `${label}.walletKeyVersion`),
-			nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(record.nearEd25519SigningKeyId),
-			keyCreationSignerSlot: parseKeyCreationSignerSlot(record.keyCreationSignerSlot, `${label}.keyCreationSignerSlot`),
-			registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, `${label}.registeredPublicKeyB64u`),
-			lifecycle: parseWalletKeyLifecycleState(record.lifecycle, `${label}.lifecycle`)
-		});
-	}
-	if (record.keyFamily === "ecdsa_secp256k1") {
-		rejectUnknownFields(record, EVM_WALLET_KEY_FIELDS, label, ALL_WALLET_KEY_FIELDS);
-		return buildEvmFamilyWalletKeyRecord({
-			walletId: requireParsed(parseWalletId(record.walletId), `${label}.walletId`),
-			walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
-			walletKeyVersion: parseWalletKeyVersion(record.walletKeyVersion, `${label}.walletKeyVersion`),
-			evmFamilySigningKeySlotId: requireEvmFamilySigningKeySlotId(record.evmFamilySigningKeySlotId, `${label}.evmFamilySigningKeySlotId`),
-			thresholdPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.thresholdPublicKey33B64u, `${label}.thresholdPublicKey33B64u`),
-			evmAddress: parseNonEmptyString(record.evmAddress, `${label}.evmAddress`),
-			lifecycle: parseWalletKeyLifecycleState(record.lifecycle, `${label}.lifecycle`)
-		});
-	}
-	throw new Error(`${label}.keyFamily must be ed25519 or ecdsa_secp256k1`);
-}
-function parseSigningLaneRecord(raw, label = "signingLaneRecord") {
-	const record = requireRecord(raw, label);
-	if (record.kind !== "signing_lane_reference_v1") throw new Error(`${label}.kind must be signing_lane_reference_v1`);
-	const laneKind = parseSigningLaneKind(record.laneKind, `${label}.laneKind`);
-	rejectUnknownFields(record, signingLaneRecordFields(laneKind), label, ALL_SIGNING_LANE_RECORD_FIELDS);
-	switch (laneKind) {
-		case "owner_passkey": return buildOwnerPasskeySigningLaneRecord(parseOwnerAuthSigningLaneRecordBase(record, label));
-		case "owner_email_otp": return buildOwnerEmailOtpSigningLaneRecord(parseOwnerAuthSigningLaneRecordBase(record, label));
-		case "linked_device": {
-			const base = parseRotatableSigningLaneRecordBase(record, label);
-			return buildLinkedDeviceSigningLaneRecord({
-				walletId: base.walletId,
-				walletKeyId: base.walletKeyId,
-				laneId: base.laneId,
-				laneShareEpoch: base.laneShareEpoch,
-				participantBindingDigestB64u: base.participantBindingDigestB64u,
-				holderParticipant: base.holderParticipant,
-				serverParticipant: base.serverParticipant,
-				lifecycle: base.lifecycle,
-				linkedDeviceId: requireParsed(parseLinkedDeviceId(record.linkedDeviceId), `${label}.linkedDeviceId`)
-			});
-		}
-		case "delegated_execution": {
-			const base = parseRotatableSigningLaneRecordBase(record, label);
-			return buildDelegatedExecutionSigningLaneRecord({
-				walletId: base.walletId,
-				walletKeyId: base.walletKeyId,
-				laneId: base.laneId,
-				laneShareEpoch: base.laneShareEpoch,
-				participantBindingDigestB64u: base.participantBindingDigestB64u,
-				holderParticipant: base.holderParticipant,
-				serverParticipant: base.serverParticipant,
-				lifecycle: base.lifecycle,
-				authorizationId: parseDelegatedSpendAuthorizationId(record.authorizationId, `${label}.authorizationId`),
-				agentIdentityKeyId: parseAgentIdentityKeyId(record.agentIdentityKeyId, `${label}.agentIdentityKeyId`),
-				custodyBindingId: parseAgentCustodyBindingId(record.custodyBindingId, `${label}.custodyBindingId`),
-				authorizationBindingDigestB64u: parseDigestField(record.authorizationBindingDigestB64u, `${label}.authorizationBindingDigestB64u`)
-			});
-		}
-		case "recovery": return buildRecoverySigningLaneRecord(parsePrivilegedOwnerSigningLaneRecordBase(record, label));
-		case "break_glass": return buildBreakGlassSigningLaneRecord(parsePrivilegedOwnerSigningLaneRecordBase(record, label));
-	}
-}
-//#endregion
-export { parseSigningLaneRecord, parseWalletKeyRecord };
-
-//# sourceMappingURL=recordParsers.js.map

package/dist/esm/shared-ts/src/threshold/secp256k1.js

@@ -1,6 +0,0 @@
-//#region ../shared-ts/src/threshold/secp256k1.ts
-const THRESHOLD_SECP256K1_ECDSA_2P_PARTICIPANT_IDS_V1 = [1, 2];
-//#endregion
-export { THRESHOLD_SECP256K1_ECDSA_2P_PARTICIPANT_IDS_V1 };
-
-//# sourceMappingURL=secp256k1.js.map

package/dist/esm/shared-ts/src/utils/addAuthMethodRegistration.js

@@ -1,103 +0,0 @@
-import { parseWebAuthnRpId } from "./domainIds.js";
-//#region ../shared-ts/src/utils/addAuthMethodRegistration.ts
-/**
-* The canonical WebAuthn registration options for adding a wallet auth method.
-*
-* This lives in the shared package because three parties read the same record:
-* the server that mints it, the browser that passes it to
-* `navigator.credentials.create`, and the linked-device target preparation that
-* carries it to Device 2. One declaration, so a change to the ceremony cannot
-* silently diverge from what a linked device creates its passkey against.
-*
-* Everything here is fixed by the canonical add-auth-method ceremony: two
-* algorithms in a fixed order, a resident key, no attestation, and PRF
-* evaluation. Encoding them as literal types rather than open unions is what
-* makes a registration that drifted from the ceremony fail to parse instead of
-* producing a credential nothing can finalize.
-*/
-function record(value, label) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-function token(value, label) {
-	if (typeof value !== "string") throw new Error(`${label} must be a string`);
-	const trimmed = value.trim();
-	if (!trimmed) throw new Error(`${label} must not be empty`);
-	if (trimmed !== value) throw new Error(`${label} must not be padded with whitespace`);
-	return trimmed;
-}
-/**
-* The relying party is branded at the boundary rather than at each use, so a
-* consumer cannot verify a credential against an unvalidated host string.
-*/
-function rpId(value, label) {
-	const parsed = parseWebAuthnRpId(token(value, label));
-	if (!parsed.ok) throw new Error(`${label} is invalid: ${parsed.error.message}`);
-	return parsed.value;
-}
-function literal(value, expected, label) {
-	if (value !== expected) throw new Error(`${label} must be ${String(expected)}`);
-	return expected;
-}
-/**
-* Throws on anything that is not exactly a canonical add-auth-method
-* registration. Callers that need a nullable result wrap this rather than
-* writing a second, looser reading of the same record.
-*/
-function parseWalletAddAuthMethodRegistrationOptions(raw) {
-	const label = "WalletAddAuthMethodRegistrationOptions";
-	const value = record(raw, label);
-	literal(value.kind, "webauthn_add_auth_method_registration_v1", `${label}.kind`);
-	const user = record(value.user, `${label}.user`);
-	const selection = record(value.authenticatorSelection, `${label}.authenticatorSelection`);
-	const prfEval = record(record(record(value.extensions, `${label}.extensions`).prf, `${label}.extensions.prf`).eval, `${label}.extensions.prf.eval`);
-	if (!Array.isArray(value.pubKeyCredParams) || value.pubKeyCredParams.length !== 2) throw new Error(`${label}.pubKeyCredParams must list exactly two algorithms`);
-	const [first, second] = value.pubKeyCredParams;
-	literal(record(first, `${label}.pubKeyCredParams[0]`).type, "public-key", `${label}.pubKeyCredParams[0].type`);
-	literal(record(first, `${label}.pubKeyCredParams[0]`).alg, -7, `${label}.pubKeyCredParams[0].alg`);
-	literal(record(second, `${label}.pubKeyCredParams[1]`).type, "public-key", `${label}.pubKeyCredParams[1].type`);
-	literal(record(second, `${label}.pubKeyCredParams[1]`).alg, -257, `${label}.pubKeyCredParams[1].alg`);
-	if (!Array.isArray(value.excludeCredentials)) throw new Error(`${label}.excludeCredentials must be an array`);
-	const excludeCredentials = value.excludeCredentials.map((entry, index) => {
-		const credential = record(entry, `${label}.excludeCredentials[${index}]`);
-		return {
-			type: literal(credential.type, "public-key", `${label}.excludeCredentials[${index}].type`),
-			id: token(credential.id, `${label}.excludeCredentials[${index}].id`)
-		};
-	});
-	const timeoutMs = value.timeoutMs;
-	if (typeof timeoutMs !== "number" || !Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new Error(`${label}.timeoutMs must be a positive safe integer`);
-	return {
-		kind: "webauthn_add_auth_method_registration_v1",
-		challengeId: token(value.challengeId, `${label}.challengeId`),
-		challengeB64u: token(value.challengeB64u, `${label}.challengeB64u`),
-		rpId: rpId(value.rpId, `${label}.rpId`),
-		user: {
-			idB64u: token(user.idB64u, `${label}.user.idB64u`),
-			name: token(user.name, `${label}.user.name`),
-			displayName: token(user.displayName, `${label}.user.displayName`)
-		},
-		pubKeyCredParams: [{
-			type: "public-key",
-			alg: -7
-		}, {
-			type: "public-key",
-			alg: -257
-		}],
-		authenticatorSelection: {
-			residentKey: literal(selection.residentKey, "required", `${label}.authenticatorSelection.residentKey`),
-			userVerification: literal(selection.userVerification, "preferred", `${label}.authenticatorSelection.userVerification`)
-		},
-		timeoutMs,
-		attestation: literal(value.attestation, "none", `${label}.attestation`),
-		extensions: { prf: { eval: {
-			firstB64u: token(prfEval.firstB64u, `${label}.extensions.prf.eval.firstB64u`),
-			secondB64u: token(prfEval.secondB64u, `${label}.extensions.prf.eval.secondB64u`)
-		} } },
-		excludeCredentials
-	};
-}
-//#endregion
-export { parseWalletAddAuthMethodRegistrationOptions };
-
-//# sourceMappingURL=addAuthMethodRegistration.js.map

package/dist/esm/shared-ts/src/utils/ecdsaKeyFactsInventory.js

@@ -1,43 +0,0 @@
-import { base64UrlEncode } from "./base64.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
-import { thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
-//#region ../shared-ts/src/utils/ecdsaKeyFactsInventory.ts
-function normalizeChainTarget(target) {
-	if (target.kind === "evm") return {
-		kind: "evm",
-		namespace: "eip155",
-		chainId: target.chainId,
-		...target.networkSlug ? { networkSlug: target.networkSlug } : {}
-	};
-	return {
-		kind: "tempo",
-		chainId: target.chainId,
-		...target.networkSlug ? { networkSlug: target.networkSlug } : {}
-	};
-}
-function canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input) {
-	const keyTargets = input.keyTargets.map((target) => ({
-		keyHandle: target.keyHandle,
-		chainTarget: normalizeChainTarget(target.chainTarget),
-		targetKey: thresholdEcdsaChainTargetKey(target.chainTarget)
-	})).sort((left, right) => {
-		const leftKey = `${left.keyHandle}:${left.targetKey}`;
-		const rightKey = `${right.keyHandle}:${right.targetKey}`;
-		return leftKey.localeCompare(rightKey);
-	});
-	return alphabetizeStringify({
-		version: "wallet-ecdsa-key-facts-inventory:v1",
-		walletId: input.walletId,
-		rpId: input.rpId,
-		keyTargets,
-		...input.runtimePolicyScope ? { runtimePolicyScope: input.runtimePolicyScope } : {},
-		serverNonceB64u: input.serverNonceB64u
-	});
-}
-async function computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u(input) {
-	return base64UrlEncode(await sha256BytesUtf8(canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input)));
-}
-//#endregion
-export { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u };
-
-//# sourceMappingURL=ecdsaKeyFactsInventory.js.map

package/dist/esm/shared-ts/src/utils/exactKeys.js

@@ -1,17 +0,0 @@
-//#region ../shared-ts/src/utils/exactKeys.ts
-/**
-* True when `value` is a non-array object whose own enumerable string keys are exactly `keys`.
-*
-* A key whose value is `undefined` still counts as present. Symbol, non-enumerable and inherited
-* keys are not counted, and the prototype is not checked. A list that repeats a key never matches.
-* Kept apart from validation.ts, which the wallet iframe's boot path loads.
-*/
-function hasExactKeys(value, keys) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	const actual = Object.keys(value);
-	return actual.length === keys.length && actual.every((key) => keys.includes(key));
-}
-//#endregion
-export { hasExactKeys };
-
-//# sourceMappingURL=exactKeys.js.map

package/dist/esm/shared-ts/src/utils/routerAbTraceContext.js

@@ -1,36 +0,0 @@
-//#region ../shared-ts/src/utils/routerAbTraceContext.ts
-const ROUTER_AB_TRACE_ID_HEADER_V1 = "x-seams-trace-id";
-const TRACE_ID_PATTERN = /^[0-9a-f]{32}$/;
-function parseRouterAbTraceContextV1(raw) {
-	if (raw === null || raw === void 0 || raw === "") return {
-		ok: false,
-		reason: "missing",
-		message: "Router trace ID is missing"
-	};
-	if (typeof raw !== "string" || !TRACE_ID_PATTERN.test(raw)) return {
-		ok: false,
-		reason: "invalid",
-		message: "Router trace ID must be 32 lowercase hexadecimal characters"
-	};
-	return {
-		ok: true,
-		value: {
-			kind: "router_ab_trace_context_v1",
-			value: raw
-		}
-	};
-}
-function createRouterAbTraceContextV1() {
-	const bytes = new Uint8Array(16);
-	globalThis.crypto.getRandomValues(bytes);
-	let value = "";
-	for (const byte of bytes) value += byte.toString(16).padStart(2, "0");
-	return {
-		kind: "router_ab_trace_context_v1",
-		value
-	};
-}
-//#endregion
-export { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 };
-
-//# sourceMappingURL=routerAbTraceContext.js.map