@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/shared-ts/src/device-linking/requestProof.js

@@ -1,25 +1,7 @@
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { sha256DigestB64u } from "../utils/canonicalPrimitives.js";
 import "../utils/digestEncoding.js";
 //#region ../shared-ts/src/device-linking/requestProof.ts
-const LINKED_DEVICE_REQUEST_PROOF_HEADER_V1 = "x-seams-linked-device-proof-v1";
-const LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1 = 6e4;
 const LINKED_DEVICE_CLOCK_SKEW_TOLERANCE_MS_V1 = 6e4;
-async function computeLinkedDevicePublicKeyDigestV1(publicKeyB64u) {
-	return sha256DigestB64u(parseFixedB64u(publicKeyB64u, 32, "devicePublicKeyB64u"));
-}
-function parseFixedB64u(value, expectedBytes, label) {
-	if (typeof value !== "string" || value.length === 0 || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(`${label} is invalid`);
-	let bytes;
-	try {
-		bytes = base64UrlDecode(value);
-	} catch {
-		throw new Error(`${label} is invalid`);
-	}
-	if (bytes.length !== expectedBytes || base64UrlEncode(bytes) !== value) throw new Error(`${label} is invalid`);
-	return bytes;
-}
 //#endregion
-export { LINKED_DEVICE_CLOCK_SKEW_TOLERANCE_MS_V1, LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, computeLinkedDevicePublicKeyDigestV1 };
+export { LINKED_DEVICE_CLOCK_SKEW_TOLERANCE_MS_V1 };
 
 //# sourceMappingURL=requestProof.js.map

package/dist/esm/shared-ts/src/device-linking/sourceContribution.js

@@ -1,270 +1,14 @@
-import { mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseMpcMaterialActivationRef, parseWalletAuthorityId, parseWalletKeyId } from "../utils/domainIds.js";
-import { parseDeviceId } from "../authorization/capabilityKinds.js";
 import { requireRecordCopy } from "../utils/validation.js";
+import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef } from "../utils/domainIds.js";
+import { parseDeviceId } from "../authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
+import { parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../utils/routerAbNormalSigningIdentity.js";
-import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, sameRouterAbEd25519YaoByteSequence } from "../utils/routerAbEd25519Yao.js";
+import "../utils/routerAbEd25519Yao.js";
 import { parseSdkEcdsaDerivationThresholdKeyId } from "../threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { requireRouterAbEcdsaDerivationNormalSigningStateV1 } from "../utils/routerAbEcdsaDerivation.js";
 //#region ../shared-ts/src/device-linking/sourceContribution.ts
-/** Exact discriminator accepted by the ECDSA source-contribution core. */
-const LINKED_DEVICE_ECDSA_SOURCE_CONTRIBUTION_ENVELOPE_KIND_V1 = "seams/linked-device/ecdsa-source-contribution-envelope/v1";
-function parseLinkedDeviceOrdinaryMaterialSourceContributionV1(raw) {
-	const record = requireRecordCopy(raw, "linked-device ordinary source contribution");
-	switch (record.kind) {
-		case "linked_device_ed25519_source_contribution_v1": return parseEd25519Contribution(record);
-		case "linked_device_ecdsa_source_contribution_v1": return parseEcdsaContribution(record);
-		default: throw new Error("linked-device ordinary source contribution kind is invalid");
-	}
-}
-function parseLinkedDeviceEd25519SourcePreservingReservationV1(raw) {
-	const record = exactRecord(raw, [
-		"state",
-		"reservation_id",
-		"participant_ids",
-		"activation_receipt",
-		"deriver_a_client_package",
-		"deriver_b_client_package"
-	], "linked-device Ed25519 source-preserving reservation");
-	if (record.state !== "inactive") throw new Error("linked-device Ed25519 source-preserving reservation is not inactive");
-	const activationReceipt = parseRouterAbEd25519YaoActivationPublicReceiptV1(record.activation_receipt);
-	const participantIds = parseRouterAbEd25519YaoParticipantIdsV1(record.participant_ids);
-	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a");
-	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b");
-	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 reservation packages have mismatched transcripts");
-	return {
-		state: "inactive",
-		reservationId: requireText(record.reservation_id, "reservation_id"),
-		participantIds,
-		activationReceipt,
-		deriver_a_client_package: deriverA,
-		deriver_b_client_package: deriverB
-	};
-}
-function parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1(raw) {
-	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error("linked-device ordinary source contributions must contain one or two entries");
-	const contributions = raw.map(parseLinkedDeviceOrdinaryMaterialSourceContributionV1);
-	const families = contributions.map((entry) => entry.keyFamily);
-	if (new Set(families).size !== families.length) throw new Error("linked-device ordinary source contributions repeat a key family");
-	if (contributions.length === 2 && (contributions[0]?.keyFamily !== "ed25519" || contributions[1]?.keyFamily !== "ecdsa_secp256k1")) throw new Error("linked-device ordinary source contributions must be Ed25519 then ECDSA");
-	const first = contributions[0];
-	if (!first) throw new Error("linked-device ordinary source contributions are empty");
-	return [first, ...contributions.slice(1)];
-}
-function parseLinkedDeviceEcdsaSourceContributionPreparationV1(raw) {
-	const record = exactRecord(raw, [
-		"linkSessionId",
-		"enrollmentId",
-		"sourceAuthorityId",
-		"source",
-		"target"
-	], "linked-device ECDSA source contribution preparation");
-	const source = parseEcdsaSourceSigner(record.source);
-	const target = parseEcdsaTarget(record.target);
-	assertEcdsaSourceTargetActivations(source.activation, target.activation);
-	return {
-		linkSessionId: parseSessionId(record.linkSessionId),
-		enrollmentId: parseEnrollmentId(record.enrollmentId),
-		sourceAuthorityId: parseAuthorityId(record.sourceAuthorityId),
-		source,
-		target
-	};
-}
-function parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1(raw) {
-	const record = requireRecordCopy(raw, "linked-device ordinary source contribution preparation");
-	if (record.kind === "linked_device_ed25519_source_contribution_preparation_v1") return parseEd25519SourceContributionPreparation(record);
-	if (Object.prototype.hasOwnProperty.call(record, "source") && Object.prototype.hasOwnProperty.call(record, "target")) return parseLinkedDeviceEcdsaSourceContributionPreparationV1(record);
-	throw new Error("linked-device ordinary source contribution preparation family is invalid");
-}
-function parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1(raw) {
-	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error("linked-device ordinary source contribution preparations must contain one or two entries");
-	const preparations = raw.map(parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1);
-	const families = preparations.map((entry) => "kind" in entry ? "ed25519" : "ecdsa_secp256k1");
-	if (new Set(families).size !== families.length) throw new Error("linked-device ordinary source contribution preparations repeat a key family");
-	if (preparations.length === 2 && (families[0] !== "ed25519" || families[1] !== "ecdsa_secp256k1")) throw new Error("linked-device ordinary source contribution preparations must be ordered Ed25519 then ECDSA");
-	const first = preparations[0];
-	if (!first) throw new Error("linked-device ordinary source contribution preparation is empty");
-	return [first, ...preparations.slice(1)];
-}
-function parseEd25519SourceContributionPreparation(record) {
-	exactRecord(record, [
-		"kind",
-		"linkSessionId",
-		"enrollmentId",
-		"sourceAuthorityId",
-		"walletKeyId",
-		"targetDeviceId",
-		"targetFactorVerificationDigestB64u",
-		"sourceBinding",
-		"targetAdmission",
-		"applicationBinding",
-		"sourceRevocationEpoch",
-		"participantIds",
-		"targetMaterialActivation",
-		"targetClientRecipientPublicKeyB64u",
-		"targetSigningWorkerRecipientPublicKeyB64u",
-		"sourceRegisteredPublicKeyB64u"
-	], "linked-device Ed25519 source contribution preparation");
-	if (record.kind !== "linked_device_ed25519_source_contribution_preparation_v1") throw new Error("linked-device Ed25519 source contribution preparation kind is invalid");
-	const sourceBinding = parseRegistrationBinding(record.sourceBinding, "sourceBinding");
-	const targetAdmissionResult = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(record.targetAdmission);
-	if (!targetAdmissionResult.ok) throw new Error(`targetAdmission ${targetAdmissionResult.message}`);
-	const targetAdmission = targetAdmissionResult.value;
-	const applicationBinding = parseRouterAbEd25519YaoApplicationBindingFactsV1(record.applicationBinding);
-	if (typeof record.sourceRevocationEpoch !== "number" || !Number.isSafeInteger(record.sourceRevocationEpoch) || record.sourceRevocationEpoch < 0) throw new Error("sourceRevocationEpoch must be a non-negative safe integer");
-	const targetMaterialActivation = parseActivation(record.targetMaterialActivation, "targetMaterialActivation");
-	const linkSessionId = parseSessionId(record.linkSessionId);
-	const enrollmentId = parseEnrollmentId(record.enrollmentId);
-	const sourceAuthorityId = parseAuthorityId(record.sourceAuthorityId);
-	const walletKeyId = parseWalletKeyIdField(record.walletKeyId);
-	const targetDeviceId = parseDeviceIdField(record.targetDeviceId);
-	const targetFactorVerificationDigestB64u = parseDigestField(record.targetFactorVerificationDigestB64u, "targetFactorVerificationDigestB64u");
-	const targetClientRecipientPublicKeyB64u = parseFixedBase64(record.targetClientRecipientPublicKeyB64u, 32, "targetClientRecipientPublicKeyB64u");
-	const targetSigningWorkerRecipientPublicKeyB64u = parseFixedBase64(record.targetSigningWorkerRecipientPublicKeyB64u, 32, "targetSigningWorkerRecipientPublicKeyB64u");
-	if (targetClientRecipientPublicKeyB64u === targetSigningWorkerRecipientPublicKeyB64u) throw new Error("linked-device Ed25519 source contribution recipients must differ");
-	const participantIds = parseRouterAbEd25519YaoParticipantIdsV1(record.participantIds);
-	assertSourceBindingContext(sourceBinding, linkSessionId, "sourceBinding");
-	if (!mpcMaterialActivationRefsEqual(targetMaterialActivation, routerAbMpcMaterialActivationRefFromWire(targetAdmission.binding.material_activation))) throw new Error("targetAdmission activation differs from targetMaterialActivation");
-	if (!sameEdStableIdentity(sourceBinding, targetAdmission.binding)) throw new Error("source and target Ed25519 contribution bindings differ");
-	if (sourceBinding.material_activation.activation_id === targetMaterialActivation.activationId) throw new Error("source and target Ed25519 contribution activations must differ");
-	return {
-		kind: "linked_device_ed25519_source_contribution_preparation_v1",
-		linkSessionId,
-		enrollmentId,
-		sourceAuthorityId,
-		walletKeyId,
-		targetDeviceId,
-		targetFactorVerificationDigestB64u,
-		sourceBinding,
-		targetAdmission,
-		applicationBinding,
-		sourceRevocationEpoch: record.sourceRevocationEpoch,
-		participantIds,
-		targetMaterialActivation,
-		targetClientRecipientPublicKeyB64u,
-		targetSigningWorkerRecipientPublicKeyB64u,
-		sourceRegisteredPublicKeyB64u: parseEd25519PublicKeyB64u(record.sourceRegisteredPublicKeyB64u, "sourceRegisteredPublicKeyB64u")
-	};
-}
-function parseEd25519Contribution(record) {
-	exactRecord(record, [
-		"kind",
-		"keyFamily",
-		"linkSessionId",
-		"enrollmentId",
-		"sourceAuthorityId",
-		"walletKeyId",
-		"targetDeviceId",
-		"targetFactorVerificationDigestB64u",
-		"targetMaterialActivation",
-		"targetClientRecipientPublicKeyB64u",
-		"targetSigningWorkerRecipientPublicKeyB64u",
-		"sourceBinding",
-		"reservationId",
-		"targetBinding",
-		"activationReceipt",
-		"participantIds",
-		"deriver_a_client_package",
-		"deriver_b_client_package",
-		"sourceRegisteredPublicKeyB64u"
-	], "linked-device Ed25519 source contribution");
-	if (record.kind !== "linked_device_ed25519_source_contribution_v1") throw new Error("linked-device Ed25519 source contribution kind is invalid");
-	if (record.keyFamily !== "ed25519") throw new Error("linked-device Ed25519 source contribution family is invalid");
-	const sourceBinding = parseRegistrationBinding(record.sourceBinding, "sourceBinding");
-	const targetMaterialActivation = parseActivation(record.targetMaterialActivation, "source contribution targetMaterialActivation");
-	const targetBinding = parseRegistrationBinding(record.targetBinding, "targetBinding");
-	const activationReceipt = parseRouterAbEd25519YaoActivationPublicReceiptV1(record.activationReceipt);
-	const reservationId = requireText(record.reservationId, "reservationId");
-	const participantIds = parseRouterAbEd25519YaoParticipantIdsV1(record.participantIds);
-	const linkSessionId = parseSessionId(record.linkSessionId);
-	const enrollmentId = parseEnrollmentId(record.enrollmentId);
-	const sourceAuthorityId = parseAuthorityId(record.sourceAuthorityId);
-	const walletKeyId = parseWalletKeyIdField(record.walletKeyId);
-	const targetDeviceId = parseDeviceIdField(record.targetDeviceId);
-	const targetFactorVerificationDigestB64u = parseDigestField(record.targetFactorVerificationDigestB64u, "targetFactorVerificationDigestB64u");
-	const targetClientRecipientPublicKeyB64u = parseFixedBase64(record.targetClientRecipientPublicKeyB64u, 32, "targetClientRecipientPublicKeyB64u");
-	const targetSigningWorkerRecipientPublicKeyB64u = parseFixedBase64(record.targetSigningWorkerRecipientPublicKeyB64u, 32, "targetSigningWorkerRecipientPublicKeyB64u");
-	if (targetClientRecipientPublicKeyB64u === targetSigningWorkerRecipientPublicKeyB64u) throw new Error("linked-device Ed25519 source contribution recipients must differ");
-	assertSourceBindingContext(sourceBinding, linkSessionId, "sourceBinding");
-	assertBindingContext(targetBinding, linkSessionId, targetMaterialActivation, "targetBinding");
-	if (!sameEdStableIdentity(sourceBinding, targetBinding)) throw new Error("linked-device Ed25519 source contribution stable identity differs");
-	if (!mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(activationReceipt.material_activation), targetMaterialActivation)) throw new Error("linked-device Ed25519 source contribution receipt activation differs");
-	const sourceRegisteredPublicKeyB64u = parseEd25519PublicKeyB64u(record.sourceRegisteredPublicKeyB64u, "sourceRegisteredPublicKeyB64u");
-	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.registered_public_key, Array.from(base64UrlDecode(sourceRegisteredPublicKeyB64u)))) throw new Error("linked-device Ed25519 source contribution receipt public key differs");
-	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a");
-	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b");
-	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 source contribution package transcript differs");
-	if (sourceBinding.material_activation.activation_id === targetMaterialActivation.activationId) throw new Error("linked-device Ed25519 source contribution reuses the source activation");
-	return {
-		kind: "linked_device_ed25519_source_contribution_v1",
-		keyFamily: "ed25519",
-		linkSessionId,
-		enrollmentId,
-		sourceAuthorityId,
-		walletKeyId,
-		targetDeviceId,
-		targetFactorVerificationDigestB64u,
-		targetMaterialActivation,
-		targetClientRecipientPublicKeyB64u,
-		targetSigningWorkerRecipientPublicKeyB64u,
-		sourceBinding,
-		reservationId,
-		targetBinding,
-		activationReceipt,
-		participantIds,
-		deriver_a_client_package: deriverA,
-		deriver_b_client_package: deriverB,
-		sourceRegisteredPublicKeyB64u
-	};
-}
-function parseEcdsaContribution(record) {
-	exactRecord(record, [
-		"kind",
-		"keyFamily",
-		"linkSessionId",
-		"enrollmentId",
-		"sourceAuthorityId",
-		"walletKeyId",
-		"targetDeviceId",
-		"targetFactorVerificationDigestB64u",
-		"sourceSigner",
-		"sourceDerivation",
-		"target",
-		"package"
-	], "linked-device ECDSA source contribution");
-	if (record.kind !== "linked_device_ecdsa_source_contribution_v1") throw new Error("linked-device ECDSA source contribution kind is invalid");
-	if (record.keyFamily !== "ecdsa_secp256k1") throw new Error("linked-device ECDSA source contribution family is invalid");
-	const linkSessionId = parseSessionId(record.linkSessionId);
-	const enrollmentId = parseEnrollmentId(record.enrollmentId);
-	const sourceAuthorityId = parseAuthorityId(record.sourceAuthorityId);
-	const walletKeyId = parseWalletKeyIdField(record.walletKeyId);
-	const targetDeviceId = parseDeviceIdField(record.targetDeviceId);
-	const targetFactorVerificationDigestB64u = parseDigestField(record.targetFactorVerificationDigestB64u, "targetFactorVerificationDigestB64u");
-	const sourceSigner = parseEcdsaSourceSigner(record.sourceSigner);
-	const sourceDerivation = parseLinkedDeviceEcdsaSourceDerivationV1(record.sourceDerivation);
-	const target = parseEcdsaTarget(record.target);
-	assertEcdsaSourceTargetActivations(sourceSigner.activation, target.activation);
-	const packageValue = parseLinkedDeviceEcdsaSourceContributionPackageV1(record.package);
-	if (packageValue.binding.linkSessionId !== linkSessionId || packageValue.binding.enrollmentId !== enrollmentId || packageValue.binding.sourceAuthorityId !== sourceAuthorityId || packageValue.binding.target.targetDeviceId !== targetDeviceId || packageValue.binding.target.targetFactorVerificationDigestB64u !== targetFactorVerificationDigestB64u) throw new Error("linked-device ECDSA source contribution package binding differs");
-	if (!sameEcdsaSourceSigner(packageValue.binding.source, sourceSigner)) throw new Error("linked-device ECDSA source contribution signer differs from package binding");
-	if (!sameEcdsaTarget(packageValue.binding.target, target)) throw new Error("linked-device ECDSA source contribution target differs from package binding");
-	return {
-		kind: "linked_device_ecdsa_source_contribution_v1",
-		keyFamily: "ecdsa_secp256k1",
-		linkSessionId,
-		enrollmentId,
-		sourceAuthorityId,
-		walletKeyId,
-		targetDeviceId,
-		targetFactorVerificationDigestB64u,
-		sourceSigner,
-		sourceDerivation,
-		target,
-		package: packageValue
-	};
-}
 function parseLinkedDeviceEcdsaSourceDerivationV1(raw) {
 	const record = exactRecord(raw, [
 		"applicationBindingDigestB64u",
@@ -332,49 +76,6 @@ function routerAbX25519PublicKeyFromB64u(value) {
 	for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
 	return `x25519:${hex}`;
 }
-function parseEd25519ClientPackage(raw, role) {
-	const packageValue = parseRouterPackage(raw, `${role} client package`);
-	if (packageValue.kind !== "activation_client" || packageValue.deriver !== role) throw new Error(`${role} client package is not an activation client package`);
-	if (role === "deriver_a") return {
-		kind: "activation_client",
-		deriver: "deriver_a",
-		session: packageValue.session,
-		transcript: packageValue.transcript,
-		encapsulated_key: packageValue.encapsulated_key,
-		ciphertext: packageValue.ciphertext
-	};
-	return {
-		kind: "activation_client",
-		deriver: "deriver_b",
-		session: packageValue.session,
-		transcript: packageValue.transcript,
-		encapsulated_key: packageValue.encapsulated_key,
-		ciphertext: packageValue.ciphertext
-	};
-}
-function parseRouterPackage(raw, label) {
-	const parsed = parseRouterAbEd25519YaoEncryptedPackageV1(raw);
-	if (!parsed.ok) throw new Error(`${label} ${parsed.message}`);
-	return parsed.value;
-}
-function parseLinkedDeviceEcdsaSourceContributionPackageV1(raw) {
-	const record = exactRecord(raw, [
-		"binding",
-		"encryptedDelta",
-		"encryptedTargetClientShare"
-	], "linked-device ECDSA source contribution package");
-	const binding = parseLinkedDeviceEcdsaSourceContributionBindingV1(record.binding);
-	const encryptedDelta = parseLinkedDeviceEcdsaEncryptedSourceContributionV1(record.encryptedDelta, "encryptedDelta");
-	const encryptedTargetClientShare = parseLinkedDeviceEcdsaEncryptedSourceContributionV1(record.encryptedTargetClientShare, "encryptedTargetClientShare");
-	const bindingDigest = encryptedDelta.bindingDigestB64u;
-	if (encryptedTargetClientShare.bindingDigestB64u !== bindingDigest) throw new Error("linked-device ECDSA source contribution envelope bindings differ");
-	if (encryptedDelta.recipientPublicKeyB64u !== binding.target.signingWorkerRecipientPublicKeyB64u || encryptedTargetClientShare.recipientPublicKeyB64u !== binding.target.clientRecipientPublicKeyB64u) throw new Error("linked-device ECDSA source contribution envelope recipients differ");
-	return {
-		binding,
-		encryptedDelta,
-		encryptedTargetClientShare
-	};
-}
 function parseLinkedDeviceEcdsaSourceContributionBindingV1(raw) {
 	const record = exactRecord(raw, [
 		"linkSessionId",
@@ -431,40 +132,6 @@ function parseEcdsaTarget(raw) {
 		signingWorkerRecipientPublicKeyB64u
 	};
 }
-function parseLinkedDeviceEcdsaEncryptedSourceContributionV1(raw, label) {
-	const record = exactRecord(raw, [
-		"kind",
-		"recipientPublicKeyB64u",
-		"bindingDigestB64u",
-		"encappedKeyB64u",
-		"ciphertextB64u"
-	], `linked-device ECDSA ${label}`);
-	if (record.kind !== LINKED_DEVICE_ECDSA_SOURCE_CONTRIBUTION_ENVELOPE_KIND_V1) throw new Error(`${label}.kind is invalid`);
-	return {
-		kind: LINKED_DEVICE_ECDSA_SOURCE_CONTRIBUTION_ENVELOPE_KIND_V1,
-		recipientPublicKeyB64u: parseFixedBase64(record.recipientPublicKeyB64u, 32, `${label}.recipientPublicKeyB64u`),
-		bindingDigestB64u: parseDigestField(record.bindingDigestB64u, `${label}.bindingDigestB64u`),
-		encappedKeyB64u: parseFixedBase64(record.encappedKeyB64u, 32, `${label}.encappedKeyB64u`),
-		ciphertextB64u: parseEnvelopeCiphertextB64u(record.ciphertextB64u, `${label}.ciphertextB64u`)
-	};
-}
-function parseRegistrationBinding(raw, label) {
-	const binding = parseRouterAbEd25519YaoCeremonyBindingV1(raw);
-	if (binding.operation !== "registration") throw new Error(`${label} must use the registration operation`);
-	return binding;
-}
-function assertBindingContext(binding, linkSessionId, targetMaterialActivation, label) {
-	if (binding.material_activation.activation_id !== targetMaterialActivation.activationId) throw new Error(`${label} activation does not match the target activation`);
-	if (binding.material_activation.material_owner !== targetMaterialActivation.materialOwner) throw new Error(`${label} material owner does not match the target activation`);
-	if (binding.material_activation.signing_worker !== targetMaterialActivation.signingWorker) throw new Error(`${label} signing worker does not match the target activation`);
-	if (binding.session_id.length !== 32 || String(linkSessionId).length === 0) throw new Error(`${label} link binding is invalid`);
-}
-function assertSourceBindingContext(binding, linkSessionId, label) {
-	if (binding.session_id.length !== 32 || String(linkSessionId).length === 0) throw new Error(`${label} link binding is invalid`);
-}
-function sameEdStableIdentity(left, right) {
-	return left.operation === right.operation && left.stable_key_context_binding.every((value, index) => value === right.stable_key_context_binding[index]) && left.material_activation.capability === right.material_activation.capability && left.material_activation.material_owner === right.material_activation.material_owner && left.material_activation.key_binding === right.material_activation.key_binding && left.material_activation.lifecycle_binding === right.material_activation.lifecycle_binding && left.material_activation.signing_worker === right.material_activation.signing_worker && left.lifecycle.root_share_epoch === right.lifecycle.root_share_epoch && left.lifecycle.account_id === right.lifecycle.account_id && left.lifecycle.signer_set_id === right.lifecycle.signer_set_id && left.lifecycle.selected_server_id === right.lifecycle.selected_server_id;
-}
 function sameEcdsaSourceSigner(left, right) {
 	return mpcMaterialActivationRefsEqual(left.activation, right.activation) && left.clientPublicKey33B64u === right.clientPublicKey33B64u && left.relayerPublicKey33B64u === right.relayerPublicKey33B64u && left.thresholdPublicKey33B64u === right.thresholdPublicKey33B64u && left.thresholdEthereumAddress20B64u === right.thresholdEthereumAddress20B64u;
 }
@@ -479,26 +146,6 @@ function parseActivation(raw, label) {
 	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
 	return parsed.value;
 }
-function parseSessionId(raw) {
-	const parsed = parseLinkDeviceSessionId(requireText(raw, "linkSessionId"));
-	if (!parsed.ok) throw new Error(`linkSessionId ${parsed.error.message}`);
-	return parsed.value;
-}
-function parseEnrollmentId(raw) {
-	const parsed = parseLinkedDeviceEnrollmentId(requireText(raw, "enrollmentId"));
-	if (!parsed.ok) throw new Error(`enrollmentId ${parsed.error.message}`);
-	return parsed.value;
-}
-function parseAuthorityId(raw) {
-	const parsed = parseWalletAuthorityId(requireText(raw, "sourceAuthorityId"));
-	if (!parsed.ok) throw new Error(`sourceAuthorityId ${parsed.error.message}`);
-	return parsed.value;
-}
-function parseWalletKeyIdField(raw) {
-	const parsed = parseWalletKeyId(requireText(raw, "walletKeyId"));
-	if (!parsed.ok) throw new Error(`walletKeyId ${parsed.error.message}`);
-	return parsed.value;
-}
 function parseDeviceIdField(raw) {
 	const parsed = parseDeviceId(requireText(raw, "targetDeviceId"));
 	if (!parsed.ok) throw new Error(`targetDeviceId ${parsed.error.message}`);
@@ -537,6 +184,6 @@ function exactRecord(raw, keys, label) {
 	return record;
 }
 //#endregion
-export { parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourceContributionBindingV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceContributionPreparationV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1, parseLinkedDeviceEd25519SourcePreservingReservationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1, parseLinkedDeviceOrdinaryMaterialSourceContributionV1, sameEcdsaSourceSigner, sameEcdsaTarget };
+export { parseLinkedDeviceEcdsaSourceContributionBindingV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1, sameEcdsaSourceSigner, sameEcdsaTarget };
 
 //# sourceMappingURL=sourceContribution.js.map

package/dist/esm/shared-ts/src/device-linking/walletSessionCredentialDelivery.js

@@ -1,173 +1,2 @@
-import { parseLinkDeviceSessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../utils/domainIds.js";
-import { parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { alphabetizeStringify } from "../utils/digests.js";
-import { parseDigestB64u, sha256Utf8DigestB64u } from "../utils/canonicalPrimitives.js";
+import "../authorization/capabilityKinds.js";
 import "./parsers.js";
-//#region ../shared-ts/src/device-linking/walletSessionCredentialDelivery.ts
-const DELIVERY_AAD_DOMAIN = "seams/linked-device/wallet-session-credential-delivery-aad/v1";
-const DELIVERY_ENVELOPE_DOMAIN = "seams/linked-device/wallet-session-credential-delivery-envelope/v1";
-function encodeLinkedDeviceWalletSessionCredentialDeliveryAadV1(aad) {
-	return alphabetizeStringify({
-		domain: DELIVERY_AAD_DOMAIN,
-		aad
-	});
-}
-function parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"namespace",
-		"orgId",
-		"projectId",
-		"envId",
-		"tenantId",
-		"principalId"
-	], "LinkedDeviceWalletSessionCredentialDeliveryBindingV1");
-	if (record.kind !== "linked_device_wallet_session_credential_delivery_binding_v1") throw new Error("LinkedDeviceWalletSessionCredentialDeliveryBindingV1.kind is invalid");
-	return {
-		kind: "linked_device_wallet_session_credential_delivery_binding_v1",
-		namespace: nonEmpty(record.namespace, "namespace"),
-		orgId: nonEmpty(record.orgId, "orgId"),
-		projectId: nonEmpty(record.projectId, "projectId"),
-		envId: nonEmpty(record.envId, "envId"),
-		tenantId: parsed(parseTenantId(record.tenantId)),
-		principalId: parsed(parsePrincipalId(record.principalId))
-	};
-}
-async function computeLinkedDeviceWalletSessionCredentialDeliveryAadDigestB64u(aad) {
-	return sha256Utf8DigestB64u(encodeLinkedDeviceWalletSessionCredentialDeliveryAadV1(aad));
-}
-async function computeLinkedDeviceWalletSessionCredentialEnvelopeDigestB64u(envelope) {
-	return sha256Utf8DigestB64u(alphabetizeStringify({
-		domain: DELIVERY_ENVELOPE_DOMAIN,
-		envelope
-	}));
-}
-async function assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1(delivery) {
-	if (await computeLinkedDeviceWalletSessionCredentialDeliveryAadDigestB64u(delivery.aad) !== delivery.aadDigestB64u) throw new Error("linked-device Wallet Session credential delivery AAD digest is invalid");
-	if (await computeLinkedDeviceWalletSessionCredentialEnvelopeDigestB64u(delivery.envelope) !== delivery.envelopeDigestB64u) throw new Error("linked-device Wallet Session credential delivery envelope digest is invalid");
-	if (await sha256Utf8DigestB64u(alphabetizeStringify({
-		domain: "seams/linked-device/delivery-recipient/v1",
-		recipientPublicKey65B64u: delivery.aad.recipientPublicKey65B64u
-	})) !== delivery.recipientBindingDigestB64u) throw new Error("linked-device Wallet Session credential delivery recipient binding is invalid");
-}
-function parseLinkedDeviceWalletSessionCredentialDeliveryV1(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"aad",
-		"aadDigestB64u",
-		"recipientBindingDigestB64u",
-		"envelope",
-		"envelopeDigestB64u",
-		"installationReceiptDigestB64u"
-	], "LinkedDeviceWalletSessionCredentialDeliveryV1");
-	if (record.kind !== "linked_device_wallet_session_credential_delivery_v1") throw new Error("LinkedDeviceWalletSessionCredentialDeliveryV1.kind is invalid");
-	return {
-		kind: "linked_device_wallet_session_credential_delivery_v1",
-		aad: parseDeliveryAad(record.aad),
-		aadDigestB64u: parseDigestB64u(record.aadDigestB64u),
-		recipientBindingDigestB64u: parseDigestB64u(record.recipientBindingDigestB64u),
-		envelope: parseDeliveryEnvelope(record.envelope),
-		envelopeDigestB64u: parseDigestB64u(record.envelopeDigestB64u),
-		installationReceiptDigestB64u: parseDigestB64u(record.installationReceiptDigestB64u)
-	};
-}
-function parseDeliveryAad(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"namespace",
-		"orgId",
-		"projectId",
-		"envId",
-		"tenantId",
-		"principalId",
-		"linkSessionId",
-		"walletId",
-		"authorityId",
-		"walletAuthMethodId",
-		"authorizationId",
-		"walletSessionId",
-		"quotaId",
-		"credentialDigestB64u",
-		"recipientPublicKey65B64u",
-		"issuedAtMs",
-		"expiresAtMs"
-	], "LinkedDeviceWalletSessionCredentialDeliveryAadV1");
-	if (record.kind !== "linked_device_wallet_session_credential_delivery_aad_v1") throw new Error("LinkedDeviceWalletSessionCredentialDeliveryAadV1.kind is invalid");
-	const issuedAtMs = positiveInteger(record.issuedAtMs, "issuedAtMs");
-	const expiresAtMs = positiveInteger(record.expiresAtMs, "expiresAtMs");
-	if (expiresAtMs <= issuedAtMs) throw new Error("expiresAtMs must be after issuedAtMs");
-	return {
-		kind: "linked_device_wallet_session_credential_delivery_aad_v1",
-		namespace: nonEmpty(record.namespace, "namespace"),
-		orgId: nonEmpty(record.orgId, "orgId"),
-		projectId: nonEmpty(record.projectId, "projectId"),
-		envId: nonEmpty(record.envId, "envId"),
-		tenantId: parsed(parseTenantId(record.tenantId)),
-		principalId: parsed(parsePrincipalId(record.principalId)),
-		linkSessionId: parsed(parseLinkDeviceSessionId(record.linkSessionId)),
-		walletId: parsed(parseWalletId(record.walletId)),
-		authorityId: parsed(parseWalletAuthorityId(record.authorityId)),
-		walletAuthMethodId: parsed(parseWalletAuthMethodId(record.walletAuthMethodId)),
-		authorizationId: parsed(parseWalletSessionAuthorizationId(record.authorizationId)),
-		walletSessionId: parsed(parseWalletSessionId(record.walletSessionId)),
-		quotaId: parsed(parseMpcWalletSigningQuotaId(record.quotaId)),
-		credentialDigestB64u: parseDigestB64u(record.credentialDigestB64u),
-		recipientPublicKey65B64u: fixedBase64Url(record.recipientPublicKey65B64u, 65),
-		issuedAtMs,
-		expiresAtMs
-	};
-}
-function parseDeliveryEnvelope(raw) {
-	const record = exactRecord(raw, [
-		"kind",
-		"algorithm",
-		"serverEphemeralPublicKey65B64u",
-		"nonce12B64u",
-		"ciphertextB64u"
-	], "LinkedDeviceWalletSessionCredentialEnvelopeV1");
-	if (record.kind !== "linked_device_wallet_session_credential_envelope_v1" || record.algorithm !== "p256-ecdh-aes256gcm-v1") throw new Error("LinkedDeviceWalletSessionCredentialEnvelopeV1 identity is invalid");
-	return {
-		kind: "linked_device_wallet_session_credential_envelope_v1",
-		algorithm: "p256-ecdh-aes256gcm-v1",
-		serverEphemeralPublicKey65B64u: fixedBase64Url(record.serverEphemeralPublicKey65B64u, 65),
-		nonce12B64u: fixedBase64Url(record.nonce12B64u, 12),
-		ciphertextB64u: canonicalBase64Url(record.ciphertextB64u)
-	};
-}
-function exactRecord(raw, fields, label) {
-	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error(`${label} must be an object`);
-	const record = raw;
-	const expected = new Set(fields);
-	for (const field of Object.keys(record)) if (!expected.has(field)) throw new Error(`${label}.${field} is not supported`);
-	for (const field of fields) if (!(field in record)) throw new Error(`${label}.${field} is required`);
-	return record;
-}
-function nonEmpty(raw, label) {
-	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw) throw new Error(`${label} is required`);
-	return raw;
-}
-function positiveInteger(raw, label) {
-	if (!Number.isSafeInteger(raw) || Number(raw) <= 0) throw new Error(`${label} is invalid`);
-	return Number(raw);
-}
-function canonicalBase64Url(raw) {
-	const encoded = nonEmpty(raw, "base64url");
-	if (base64UrlEncode(base64UrlDecode(encoded)) !== encoded) throw new Error("base64url is not canonical");
-	return encoded;
-}
-function fixedBase64Url(raw, length) {
-	const encoded = canonicalBase64Url(raw);
-	const bytes = base64UrlDecode(encoded);
-	if (bytes.length !== length) throw new Error(`base64url must contain ${length} bytes`);
-	if (length === 65 && bytes[0] !== 4) throw new Error("P-256 public key is invalid");
-	return encoded;
-}
-function parsed(result) {
-	if (!result.ok) throw new Error(result.error.message);
-	return result.value;
-}
-//#endregion
-export { assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1, computeLinkedDeviceWalletSessionCredentialDeliveryAadDigestB64u, computeLinkedDeviceWalletSessionCredentialEnvelopeDigestB64u, encodeLinkedDeviceWalletSessionCredentialDeliveryAadV1, parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1, parseLinkedDeviceWalletSessionCredentialDeliveryV1 };
-
-//# sourceMappingURL=walletSessionCredentialDelivery.js.map

package/dist/esm/shared-ts/src/device-linking/wireFields.js

@@ -1,9 +1,9 @@
-import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationRef, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
-import { parseDeviceId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
-import { wireLabeled, wireNullable, wireResult } from "../utils/wireSchema.js";
 import { parseDelegatedWalletAuthorityV1 } from "../authorization/delegatedAuthority.js";
+import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcMaterialActivationRef, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWebAuthnCredentialIdB64u } from "../utils/domainIds.js";
+import { parseDeviceId, parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { parseUnixMs } from "../passkey-custody/primitives.js";
+import { wireLabeled, wireNullable, wireResult } from "../utils/wireSchema.js";
 //#region ../shared-ts/src/device-linking/wireFields.ts
 const sessionId = /* @__PURE__ */ wireResult(parseLinkDeviceSessionId);
 const walletId = /* @__PURE__ */ wireResult(parseWalletId);
@@ -16,7 +16,6 @@ const walletSessionAuthorizationId = /* @__PURE__ */ wireResult(parseWalletSessi
 const walletAuthMethodId = /* @__PURE__ */ wireResult(parseWalletAuthMethodId);
 const walletAuthorityId = /* @__PURE__ */ wireResult(parseWalletAuthorityId);
 const credentialId = /* @__PURE__ */ wireResult(parseWebAuthnCredentialIdB64u);
-const rpId = /* @__PURE__ */ wireResult(parseWebAuthnRpId);
 const quotaId = /* @__PURE__ */ wireResult(parseMpcWalletSigningQuotaId);
 const materialActivation = /* @__PURE__ */ wireResult(parseMpcMaterialActivationRef);
 const digest = /* @__PURE__ */ wireLabeled(parseDigestB64u);
@@ -54,6 +53,6 @@ function parseTargetEmail(raw, label) {
 	return parsed.value;
 }
 //#endregion
-export { authorizationDeviceId, credentialId, digest, enrollmentId, keyLabeled, linkedDeviceId, materialActivation, nullableToken, parseDelegatedWalletAuthority, parseNonEmptyToken, parseNonNegativeSafeInteger, parseTargetEmail, parseUnixTime, quotaId, rpId, sessionId, walletAuthMethodId, walletAuthorityId, walletId, walletKeyId, walletSessionAuthorizationId, walletSessionId };
+export { authorizationDeviceId, credentialId, digest, enrollmentId, keyLabeled, linkedDeviceId, materialActivation, nullableToken, parseDelegatedWalletAuthority, parseNonNegativeSafeInteger, parseTargetEmail, parseUnixTime, quotaId, sessionId, walletAuthMethodId, walletAuthorityId, walletId, walletKeyId, walletSessionAuthorizationId, walletSessionId };
 
 //# sourceMappingURL=wireFields.js.map