@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/shared-ts/src/near/actions.js

@@ -23,9 +23,6 @@ let TxExecutionStatus = /* @__PURE__ */ function(TxExecutionStatus) {
 	TxExecutionStatus["EXECUTED_OPTIMISTIC"] = "EXECUTED_OPTIMISTIC";
 	return TxExecutionStatus;
 }({});
-function isActionArgsWasm(a) {
-	return isObject(a) && "action_type" in a;
-}
 function toActionArgsWasm(action) {
 	switch (action.type) {
 		case ActionType.Transfer: return {
@@ -221,16 +218,7 @@ function fromActionArgsWasm(a) {
 		default: throw new Error(`Unsupported wasm action_type: ${a?.action_type}`);
 	}
 }
-function fromTransactionInputWasm(tx) {
-	return {
-		receiverId: tx.receiverId,
-		actions: tx.actions.map(fromActionArgsWasm)
-	};
-}
-function fromTransactionInputsWasm(txs) {
-	return (txs || []).map(fromTransactionInputWasm);
-}
 //#endregion
-export { ActionType, TxExecutionStatus, fromActionArgsWasm, fromTransactionInputsWasm, isActionArgsWasm, toActionArgsWasm, validateActionArgsWasm };
+export { ActionType, TxExecutionStatus, fromActionArgsWasm, toActionArgsWasm, validateActionArgsWasm };
 
 //# sourceMappingURL=actions.js.map

package/dist/esm/shared-ts/src/near/nearClient.js

@@ -1,7 +1,7 @@
 import { isFunction } from "../utils/validation.js";
 import { base64Decode, base64Encode } from "../utils/base64.js";
-import { secureRandomId } from "../utils/secureRandomId.js";
 import { errorMessage } from "../utils/errors.js";
+import { secureRandomId } from "../utils/secureRandomId.js";
 import { decodeJsonRpcEnvelope } from "../utils/jsonRpc.js";
 import { decodeNearAccessKeyList, decodeNearAccessKeyView, decodeNearAccountView, decodeNearBlockReference, decodeNearCodeBase64, decodeNearContractCallResult, decodeNearFinalExecutionOutcome, parseNearContractResult } from "../utils/nearRpcResults.js";
 //#region ../shared-ts/src/near/nearClient.ts

package/dist/esm/shared-ts/src/passkey-custody/custodyEnvelope.js

@@ -1,7 +1,7 @@
-import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
 import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseUnixMs } from "./primitives.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { parsePasskeyCustodySecretBinding } from "./custodySecretBinding.js";
 //#region ../shared-ts/src/passkey-custody/custodyEnvelope.ts
 const WALLET_CUSTODY_ENVELOPE_VERSION_V2 = "wallet_custody_envelope_v2";
@@ -27,62 +27,6 @@ function parseWalletCustodyEnvelopeOwnership(raw, label) {
 		default: throw new Error(`${label}.kind must be unbound or method_bound`);
 	}
 }
-/**
-* The exact JSON `signer_core::PasskeyCustodyEnvelopeBindingV1` deserialises.
-*
-* Every caller that hands a binding to wasm must build it here. The Rust struct
-* uses `deny_unknown_fields` and now requires `ownership`, so a hand-rolled
-* object that omits it fails to deserialise — and that failure surfaces as an
-* unopenable envelope, not a type error.
-*/
-function custodyEnvelopeBindingJsonV1(envelope) {
-	return JSON.stringify({
-		walletId: envelope.walletId,
-		envelopeId: envelope.envelopeId,
-		factor: envelope.factor,
-		envelopeRevision: envelope.envelopeRevision,
-		binding: envelope.binding,
-		ownership: custodyEnvelopeOwnershipWireV1(envelope.ownership)
-	});
-}
-/**
-* Reads the serde shape back — the inverse of `custodyEnvelopeOwnershipWireV1`.
-*
-* The record shape and the wire shape are deliberately different: one is
-* TypeScript's tagged union, the other is what `serde` emits for a Rust enum.
-* Anything that came out of wasm carries the wire shape, and passing it to the
-* record parser would reject a perfectly valid ownership for having no `kind`.
-*/
-function parseWalletCustodyEnvelopeOwnershipWireV1(raw, label) {
-	if (raw === "unbound") return { kind: "unbound" };
-	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error(`${label} must be "unbound" or a methodBound object`);
-	const record = raw;
-	rejectUnknownFields(record, ["methodBound"], label);
-	const methodBound = record.methodBound;
-	if (typeof methodBound !== "object" || methodBound === null || Array.isArray(methodBound)) throw new Error(`${label}.methodBound must be an object`);
-	const fields = methodBound;
-	rejectUnknownFields(fields, ["walletAuthMethodId"], `${label}.methodBound`);
-	const parsed = parseWalletAuthMethodId(fields.walletAuthMethodId);
-	if (!parsed.ok) throw new Error(`${label}.methodBound.walletAuthMethodId ${parsed.error.message}`);
-	return {
-		kind: "method_bound",
-		walletAuthMethodId: parsed.value
-	};
-}
-/** Serde's shape for the ownership enum: a bare string, or a one-key object. */
-function custodyEnvelopeOwnershipWireV1(ownership) {
-	switch (ownership.kind) {
-		case "unbound": return "unbound";
-		case "method_bound": return { methodBound: { walletAuthMethodId: String(ownership.walletAuthMethodId) } };
-		default: throw new Error(`Unhandled custody envelope ownership: ${String(ownership)}`);
-	}
-}
-function buildMethodBoundEnvelopeOwnership(walletAuthMethodId) {
-	return {
-		kind: "method_bound",
-		walletAuthMethodId
-	};
-}
 function buildPasskeyEnvelopeFactor(args) {
 	return {
 		kind: "passkey",
@@ -273,6 +217,6 @@ function sameWalletCustodyEnvelopeOwnership(left, right) {
 	return right.kind === "method_bound" && String(left.walletAuthMethodId) === String(right.walletAuthMethodId);
 }
 //#endregion
-export { WALLET_CUSTODY_ENVELOPE_VERSION_V2, buildActiveEnvelopeLifecycle, buildEmailOtpEnvelopeFactor, buildMethodBoundEnvelopeOwnership, buildPasskeyCustodyEnvelopeRecord, buildPasskeyEnvelopeFactor, buildRevokedEnvelopeLifecycle, custodyEnvelopeBindingJsonV1, custodyEnvelopeOwnershipWireV1, parsePasskeyCustodyEnvelopeRecord, parseWalletCustodyEnvelopeFactor, parseWalletCustodyEnvelopeOwnershipWireV1, sameWalletCustodyEnvelopeOwnership };
+export { WALLET_CUSTODY_ENVELOPE_VERSION_V2, buildActiveEnvelopeLifecycle, buildEmailOtpEnvelopeFactor, buildPasskeyCustodyEnvelopeRecord, buildPasskeyEnvelopeFactor, buildRevokedEnvelopeLifecycle, parsePasskeyCustodyEnvelopeRecord, parseWalletCustodyEnvelopeFactor, sameWalletCustodyEnvelopeOwnership };
 
 //# sourceMappingURL=custodyEnvelope.js.map

package/dist/esm/shared-ts/src/passkey-custody/custodySecretBinding.js

@@ -1,16 +1,12 @@
-import { parseLaneShareEpoch, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseSigningLaneId, parseThresholdEcdsaSessionId, parseWalletKeyId } from "../utils/domainIds.js";
 import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { parseLaneShareEpoch, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseSigningLaneId, parseThresholdEcdsaSessionId, parseWalletKeyId } from "../utils/domainIds.js";
 import { parseDigestField, parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "./primitives.js";
-import { parseNearEd25519SigningKeyId } from "../utils/registrationIds.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
 import { requireEvmFamilySigningKeySlotId } from "../signing-lanes/evmFamilySigningKeySlotId.js";
+import { parseNearEd25519SigningKeyId } from "../utils/registrationIds.js";
 //#region ../shared-ts/src/passkey-custody/custodySecretBinding.ts
 /** The only derivation scheme owner custody supports. */
 const WALLET_SEED_DERIVATION_SCHEME_V1 = "wallet_seed_parallel_hkdf_sha256_v1";
-/** True when this binding covers owner custody rather than one lane's share. */
-function isWalletCustodySeedBinding(binding) {
-	return binding.kind === "wallet_custody_seed_v1";
-}
 function buildWalletCustodySeedBinding() {
 	return {
 		kind: "wallet_custody_seed_v1",
@@ -176,6 +172,6 @@ function parsePasskeyCustodySecretBinding(raw, label = "passkeyCustodySecretBind
 	}
 }
 //#endregion
-export { buildEd25519YaoClientRootBinding, isWalletCustodySeedBinding, parsePasskeyCustodySecretBinding };
+export { buildEd25519YaoClientRootBinding, parsePasskeyCustodySecretBinding };
 
 //# sourceMappingURL=custodySecretBinding.js.map

package/dist/esm/shared-ts/src/passkey-custody/index.js

@@ -1,4 +1,3 @@
 import "./primitives.js";
 import "./custodySecretBinding.js";
 import "./custodyEnvelope.js";
-import "./ceremonyCommitPayload.js";

package/dist/esm/shared-ts/src/signing-lanes/index.js

@@ -1,5 +1,4 @@
 import "../utils/domainIds.js";
 import "./evmFamilySigningKeySlotId.js";
-import "./participants.js";
 import "./participantDigest.js";
 import "./ownerContinuity.js";

package/dist/esm/shared-ts/src/signing-lanes/ownerContinuity.js

@@ -1,61 +1,2 @@
-import { hasWhitespaceOrControlCharacters, parseMpcSigningWorkerRef } from "../utils/domainIds.js";
-import { requireRecord } from "../utils/validation.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
-import { parseDigestField, requireParsed } from "../passkey-custody/primitives.js";
 import "../utils/digestEncoding.js";
 import "./participantDigest.js";
-//#region ../shared-ts/src/signing-lanes/ownerContinuity.ts
-const OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
-	"kind",
-	"signerId",
-	"participantIds",
-	"signingWorkerId",
-	"custodyKeyManifestDigestB64u",
-	"sourceIdentityDigestB64u"
-];
-/** Parse the owner signer identity without widening it into a generic string. */
-function parseWalletSignerId(raw, label = "walletSignerId") {
-	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
-	const value = raw.trim();
-	if (!value) throw new Error(`${label} is required`);
-	if (hasWhitespaceOrControlCharacters(value)) throw new Error(`${label} must not contain whitespace or control characters`);
-	return value;
-}
-function parseParticipantId(raw, label) {
-	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw <= 0) throw new Error(`${label} must be a positive safe integer`);
-	return raw;
-}
-function parseParticipantIds(raw, label) {
-	if (!Array.isArray(raw) || raw.length !== 2) throw new Error(`${label} must contain exactly two participant ids`);
-	const first = parseParticipantId(raw[0], `${label}[0]`);
-	const second = parseParticipantId(raw[1], `${label}[1]`);
-	if (first === second) throw new Error(`${label} must contain distinct participant ids`);
-	return [first, second];
-}
-function buildOwnerLaneParticipantContinuityV1(args) {
-	const participantIds = parseParticipantIds(args.participantIds, "participantIds");
-	return {
-		kind: "owner_lane_participant_continuity_v1",
-		signerId: parseWalletSignerId(args.signerId),
-		participantIds,
-		signingWorkerId: requireParsed(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
-		custodyKeyManifestDigestB64u: parseDigestField(args.custodyKeyManifestDigestB64u, "custodyKeyManifestDigestB64u"),
-		sourceIdentityDigestB64u: parseDigestField(args.sourceIdentityDigestB64u, "sourceIdentityDigestB64u")
-	};
-}
-function parseOwnerLaneParticipantContinuityV1(raw, label = "ownerParticipantContinuity") {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS, label);
-	if (record.kind !== "owner_lane_participant_continuity_v1") throw new Error(`${label}.kind must be owner_lane_participant_continuity_v1`);
-	return buildOwnerLaneParticipantContinuityV1({
-		signerId: parseWalletSignerId(record.signerId, `${label}.signerId`),
-		participantIds: parseParticipantIds(record.participantIds, `${label}.participantIds`),
-		signingWorkerId: requireParsed(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
-		custodyKeyManifestDigestB64u: parseDigestField(record.custodyKeyManifestDigestB64u, `${label}.custodyKeyManifestDigestB64u`),
-		sourceIdentityDigestB64u: parseDigestField(record.sourceIdentityDigestB64u, `${label}.sourceIdentityDigestB64u`)
-	});
-}
-//#endregion
-export { buildOwnerLaneParticipantContinuityV1, parseOwnerLaneParticipantContinuityV1, parseWalletSignerId };
-
-//# sourceMappingURL=ownerContinuity.js.map

package/dist/esm/shared-ts/src/threshold/ed25519OperationFingerprint.js

@@ -33,7 +33,7 @@ async function thresholdEd25519Nep413OperationFingerprint(input) {
 			message: coerceNonEmptyString(input.message, "message"),
 			recipient: coerceNonEmptyString(input.recipient, "recipient"),
 			nonce: coerceNonEmptyString(input.nonce, "nonce"),
-			state: input.state ? String(input.state) : null
+			callbackUrl: input.callbackUrl
 		}
 	});
 }

package/dist/esm/shared-ts/src/threshold/keyMaterialBrands.js

@@ -4,9 +4,6 @@ function parseNonEmptyBrand(value, label) {
 	if (!normalized) throw new Error(`${label} must be a non-empty string`);
 	return normalized;
 }
-function parseSigningSessionSealKeyVersion(value) {
-	return parseNonEmptyBrand(value, "signing-session seal key version");
-}
 function parseEcdsaClientVerifyingShareB64u(value) {
 	return parseNonEmptyBrand(value, "ECDSA client verifying share");
 }
@@ -20,6 +17,6 @@ function formatEcdsaKeyHandleForWire(value) {
 	return value;
 }
 //#endregion
-export { formatEcdsaKeyHandleForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseNonEmptyBrand, parseSigningSessionSealKeyVersion };
+export { formatEcdsaKeyHandleForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseNonEmptyBrand };
 
 //# sourceMappingURL=keyMaterialBrands.js.map

package/dist/esm/shared-ts/src/threshold/participants.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../utils/normalize.js";
-const THRESHOLD_ED25519_2P_PARTICIPANT_IDS = [1, 2];
 function normalizeThresholdEd25519ParticipantId(id) {
 	const n = Number(id);
 	if (!Number.isSafeInteger(n) || n < 1 || n > 65535) return null;
@@ -61,6 +60,6 @@ function buildThresholdEd25519Participants2pV1(input) {
 	}];
 }
 //#endregion
-export { THRESHOLD_ED25519_2P_PARTICIPANT_IDS, buildThresholdEd25519Participants2pV1, normalizeThresholdEd25519ParticipantIds, parseThresholdEd25519ParticipantsV1 };
+export { buildThresholdEd25519Participants2pV1, normalizeThresholdEd25519ParticipantIds, parseThresholdEd25519ParticipantsV1 };
 
 //# sourceMappingURL=participants.js.map

package/dist/esm/shared-ts/src/threshold/signingRootScope.js

@@ -27,9 +27,6 @@ function normalizeRuntimePolicyScopeFields(input) {
 		...normalizeOptionalTrimmedString(scope.signingRootVersion) ? { signingRootVersion: normalizeOptionalTrimmedString(scope.signingRootVersion) } : {}
 	};
 }
-function sameRuntimePolicyScope(left, right) {
-	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
 function signingRootScopeFromRuntimePolicyScope(scope) {
 	return {
 		signingRootId: deriveSigningRootId(scope),
@@ -37,6 +34,6 @@ function signingRootScopeFromRuntimePolicyScope(scope) {
 	};
 }
 //#endregion
-export { deriveSigningRootId, normalizeRuntimePolicyScope, sameRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope };
+export { deriveSigningRootId, normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope };
 
 //# sourceMappingURL=signingRootScope.js.map

package/dist/esm/shared-ts/src/utils/authenticatorOptions.js

@@ -5,18 +5,7 @@ let UserVerificationPolicy = /* @__PURE__ */ function(UserVerificationPolicy) {
 	UserVerificationPolicy["Discouraged"] = "discouraged";
 	return UserVerificationPolicy;
 }({});
-function cloneAuthenticatorOptions(options) {
-	const multiple = options.originPolicy?.multiple;
-	return {
-		userVerification: options.userVerification,
-		originPolicy: {
-			single: options.originPolicy?.single,
-			all_subdomains: options.originPolicy?.all_subdomains,
-			multiple: Array.isArray(multiple) ? [...multiple] : void 0
-		}
-	};
-}
 //#endregion
-export { UserVerificationPolicy, cloneAuthenticatorOptions };
+export { UserVerificationPolicy };
 
 //# sourceMappingURL=authenticatorOptions.js.map

package/dist/esm/shared-ts/src/utils/canonicalPrimitives.js

@@ -1,5 +1,5 @@
 import { base64UrlDecode, base64UrlEncode } from "./base64.js";
-import { sha256Bytes, sha256BytesUtf8 } from "./digests.js";
+import { sha256BytesUtf8 } from "./digests.js";
 //#region ../shared-ts/src/utils/canonicalPrimitives.ts
 function parseCorrelationId(value) {
 	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error("correlation id must be a non-empty canonical string");
@@ -26,13 +26,10 @@ function isoTimestampFromUnixMs(value) {
 	if (!Number.isSafeInteger(value) || Number(value) <= 0) throw new Error("timestamp milliseconds must be a positive safe integer");
 	return parseIsoTimestamp(new Date(Number(value)).toISOString());
 }
-async function sha256DigestB64u(bytes) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(bytes)));
-}
 async function sha256Utf8DigestB64u(text) {
 	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(text)));
 }
 //#endregion
-export { isoTimestampFromUnixMs, parseCorrelationId, parseDigestB64u, parseIsoTimestamp, sha256DigestB64u, sha256Utf8DigestB64u };
+export { isoTimestampFromUnixMs, parseCorrelationId, parseDigestB64u, parseIsoTimestamp, sha256Utf8DigestB64u };
 
 //# sourceMappingURL=canonicalPrimitives.js.map

package/dist/esm/shared-ts/src/utils/domainIds.js

@@ -120,9 +120,6 @@ function parseCapabilityInstanceRef(raw) {
 function parseMpcMaterialOwnerRef(raw) {
 	return parseDomainId(raw, "mpcMaterialOwnerRef");
 }
-function parseMpcCapabilityRuntimeRef(raw) {
-	return parseDomainId(raw, "mpcCapabilityRuntimeRef");
-}
 function parseMpcMaterialActivationId(raw) {
 	return parseDomainId(raw, "mpcMaterialActivationId");
 }
@@ -224,9 +221,6 @@ function parseThresholdEcdsaSessionId(raw) {
 function parseEcdsaActiveStateId(raw) {
 	return parseDomainId(raw, "ecdsaActiveStateId");
 }
-function parseThresholdSessionId(raw) {
-	return parseDomainId(raw, "thresholdSessionId");
-}
 function parseRootShareEpoch(raw) {
 	return parseDomainId(raw, "rootShareEpoch");
 }
@@ -252,6 +246,6 @@ function parseLinkDeviceSessionId(raw) {
 	return parseDomainId(raw, "linkDeviceSessionId");
 }
 //#endregion
-export { buildMpcMaterialActivationRef, hasControlCharacter, hasWhitespaceOrControlCharacters, mpcMaterialActivationRefsEqual, parseCapabilityInstanceRef, parseEcdsaActiveStateId, parseEmailOtpChallengeId, parseEmailOtpProviderUserId, parseLaneShareEpoch, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcCapabilityRuntimeRef, parseMpcKeyBindingRef, parseMpcLifecycleBindingRef, parseMpcMaterialActivationId, parseMpcMaterialActivationRef, parseMpcMaterialOwnerRef, parseMpcSigningWorkerRef, parsePasskeyEnvelopeId, parseRootShareEpoch, parseSigningLaneId, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseThresholdSessionId, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId };
+export { buildMpcMaterialActivationRef, hasControlCharacter, hasWhitespaceOrControlCharacters, mpcMaterialActivationRefsEqual, parseCapabilityInstanceRef, parseEcdsaActiveStateId, parseEmailOtpChallengeId, parseEmailOtpProviderUserId, parseLaneShareEpoch, parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseMpcKeyBindingRef, parseMpcLifecycleBindingRef, parseMpcMaterialActivationId, parseMpcMaterialActivationRef, parseMpcMaterialOwnerRef, parseMpcSigningWorkerRef, parsePasskeyEnvelopeId, parseRootShareEpoch, parseSigningLaneId, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityBindingDigest, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId };
 
 //# sourceMappingURL=domainIds.js.map

package/dist/esm/shared-ts/src/utils/ecdsaCapabilityActivation.js

@@ -1,5 +1,4 @@
 import { base64UrlDecode, base64UrlEncode } from "./base64.js";
-import { alphabetizeStringify } from "./digests.js";
 //#region ../shared-ts/src/utils/ecdsaCapabilityActivation.ts
 function parseNonEmptyString(value, label) {
 	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error(`${label} must be a non-empty canonical string`);
@@ -32,9 +31,6 @@ function parseEcdsaCapabilityManifestRevision(value) {
 function parseEcdsaCiphertextDigest(value) {
 	return parseCanonicalBase64Url(value, "ECDSA ciphertext digest", 32);
 }
-function parseEcdsaPendingCiphertextDigest(value) {
-	return parseCanonicalBase64Url(value, "ECDSA pending ciphertext digest", 32);
-}
 function parseEcdsaActivationDigest(value) {
 	return parseCanonicalBase64Url(value, "ECDSA activation digest", 32);
 }
@@ -50,18 +46,7 @@ function parseEcdsaIv12B64u(value) {
 function parseEcdsaCiphertextB64u(value) {
 	return parseCanonicalBase64Url(value, "ECDSA ciphertext", null);
 }
-function parseCanonicalEcdsaServerActivationRequest(value) {
-	if (typeof value !== "string" || value.trim() !== value) throw new Error("ECDSA server activation request must be canonical JSON");
-	let parsed;
-	try {
-		parsed = JSON.parse(value);
-	} catch {
-		throw new Error("ECDSA server activation request must be canonical JSON");
-	}
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed) || alphabetizeStringify(parsed) !== value) throw new Error("ECDSA server activation request must be a canonical JSON object");
-	return value;
-}
 //#endregion
-export { parseCanonicalEcdsaServerActivationRequest, parseEcdsaActivationDigest, parseEcdsaCapabilityManifestId, parseEcdsaCapabilityManifestRevision, parseEcdsaCiphertextB64u, parseEcdsaCiphertextDigest, parseEcdsaIv12B64u, parseEcdsaLifecycleId, parseEcdsaMaterialSealingKeyId, parseEcdsaPendingCiphertextDigest, parseEcdsaServerGeneration, parseEvmFamilyEcdsaSignerId };
+export { parseEcdsaActivationDigest, parseEcdsaCapabilityManifestId, parseEcdsaCapabilityManifestRevision, parseEcdsaCiphertextB64u, parseEcdsaCiphertextDigest, parseEcdsaIv12B64u, parseEcdsaLifecycleId, parseEcdsaMaterialSealingKeyId, parseEcdsaServerGeneration, parseEvmFamilyEcdsaSignerId };
 
 //# sourceMappingURL=ecdsaCapabilityActivation.js.map

package/dist/esm/shared-ts/src/utils/ecdsaServerTiming.js

@@ -1,5 +1,9 @@
 //#region ../shared-ts/src/utils/ecdsaServerTiming.ts
 const ECDSA_TIMING_METRICS = new Set([
+	"wallet_gateway_binding",
+	"wallet_gateway_total",
+	"wallet_console_binding_d1",
+	"wallet_console_binding_sql",
 	"ecdsa_sign_authorize",
 	"ecdsa_sign_admit",
 	"ecdsa_sign_proxy",
@@ -12,7 +16,8 @@ const ECDSA_TIMING_METRICS = new Set([
 	"ecdsa_presign_total",
 	"ecdsa_presign_sw_material",
 	"ecdsa_presign_sw_session",
-	"ecdsa_presign_sw_do_total",
+	"ecdsa_presign_sw_do_response_headers",
+	"ecdsa_presign_sw_do_response_body",
 	"ecdsa_presign_sw_admit",
 	"ecdsa_presign_sw_total"
 ]);

package/dist/esm/shared-ts/src/utils/emailOtpDomain.js

@@ -1,28 +1,6 @@
 //#region ../shared-ts/src/utils/emailOtpDomain.ts
 const EMAIL_OTP_CHANNEL = "email_otp";
-const WALLET_EMAIL_OTP_LOGIN_OPERATIONS = [
-	"wallet_unlock",
-	"transaction_sign",
-	"export_key"
-];
-const WALLET_EMAIL_OTP_REGISTRATION_OPERATION = "registration";
-/** Linked-device enrollment: prove control of the wallet's enrolled email
-* destination to complete one device link. */
-const WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION = "device_link";
-const WALLET_EMAIL_OTP_ACTIONS = {
-	login: "wallet_email_otp_login",
-	registration: "wallet_email_otp_registration",
-	recoveryBootstrap: "wallet_email_otp_recovery_bootstrap",
-	unseal: "wallet_email_otp_unseal",
-	deviceLink: "wallet_email_otp_device_link"
-};
-const WALLET_EMAIL_OTP_EXPORT_OPERATION = "export_key";
-const WALLET_EMAIL_OTP_UNLOCK_OPERATION = "wallet_unlock";
-const WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION = "transaction_sign";
-function isWalletEmailOtpLoginOperation(value) {
-	return WALLET_EMAIL_OTP_LOGIN_OPERATIONS.includes(value);
-}
 //#endregion
-export { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation };
+export { EMAIL_OTP_CHANNEL };
 
 //# sourceMappingURL=emailOtpDomain.js.map

package/dist/esm/shared-ts/src/utils/emailOtpRecoveryKey.js

@@ -11,47 +11,6 @@ function isDecimalOnly(value) {
 	}
 	return true;
 }
-function encodeEmailOtpRecoveryKeyBytes(bytes) {
-	if (bytes.byteLength !== 20) throw new Error("Email OTP recovery key bytes must be exactly 20 bytes");
-	let bitBuffer = 0;
-	let bitsAvailable = 0;
-	let normalized = "";
-	for (let i = 0; i < bytes.byteLength; i++) {
-		bitBuffer = bitBuffer << 8 | bytes[i];
-		bitsAvailable += 8;
-		while (bitsAvailable >= 5) {
-			bitsAvailable -= 5;
-			normalized += EMAIL_OTP_RECOVERY_KEY_ALPHABET[bitBuffer >> bitsAvailable & 31];
-			bitBuffer &= (1 << bitsAvailable) - 1;
-		}
-	}
-	return normalized;
-}
-function formatEmailOtpRecoveryKey(normalizedKey) {
-	const normalized = normalizeEmailOtpRecoveryKey(normalizedKey);
-	const groups = [];
-	let offset = 0;
-	for (let i = 0; i < 8; i++) {
-		groups.push(normalized.slice(offset, offset + 4));
-		offset += 4;
-	}
-	return groups.join("-");
-}
-function buildEmailOtpRecoveryCodeSet(keys) {
-	if (keys.length !== 10) throw new Error(`Email OTP recovery code set must contain 10 keys`);
-	return [
-		formatEmailOtpRecoveryKey(keys[0]),
-		formatEmailOtpRecoveryKey(keys[1]),
-		formatEmailOtpRecoveryKey(keys[2]),
-		formatEmailOtpRecoveryKey(keys[3]),
-		formatEmailOtpRecoveryKey(keys[4]),
-		formatEmailOtpRecoveryKey(keys[5]),
-		formatEmailOtpRecoveryKey(keys[6]),
-		formatEmailOtpRecoveryKey(keys[7]),
-		formatEmailOtpRecoveryKey(keys[8]),
-		formatEmailOtpRecoveryKey(keys[9])
-	];
-}
 function normalizeEmailOtpRecoveryKey(input) {
 	const normalized = String(input || "").replace(/[\s-]/g, "").toUpperCase();
 	if (normalized.length !== 32) throw new Error("Email OTP recovery key must be 32 Crockford Base32 characters");
@@ -78,6 +37,6 @@ function decodeEmailOtpRecoveryKey(input) {
 	return out;
 }
 //#endregion
-export { EMAIL_OTP_RECOVERY_KEY_ALPHABET, buildEmailOtpRecoveryCodeSet, decodeEmailOtpRecoveryKey, encodeEmailOtpRecoveryKeyBytes, formatEmailOtpRecoveryKey, normalizeEmailOtpRecoveryKey };
+export { EMAIL_OTP_RECOVERY_KEY_ALPHABET, decodeEmailOtpRecoveryKey, normalizeEmailOtpRecoveryKey };
 
 //# sourceMappingURL=emailOtpRecoveryKey.js.map

package/dist/esm/shared-ts/src/utils/errors.js

@@ -33,18 +33,6 @@ function toError(e) {
 	} catch {}
 	return err;
 }
-/**
-* Check if an error is related to user cancellation of TouchID/FaceID prompt
-* @param error - The error object or error message string
-* @returns true if the error indicates user cancellation
-*/
-function isTouchIdCancellationError(error) {
-	const msg = errorMessage(error);
-	if (isWebAuthnRpIdOriginConfigurationError(error)) return false;
-	if (isUserCancellationError(error)) return true;
-	const lower = msg.toLowerCase();
-	return msg.includes("The operation either timed out or was not allowed") || msg.includes("NotAllowedError") || msg.includes("AbortError") || lower.includes("user cancelled") || lower.includes("user canceled") || lower.includes("user aborted") || lower.includes("was cancelled") || lower.includes("was canceled");
-}
 function isWebAuthnRpIdOriginConfigurationError(error) {
 	const lower = errorMessage(error).toLowerCase();
 	return lower.includes("relying party id") || lower.includes("registrable domain suffix") || lower.includes("claimed rp id") || lower.includes("/.well-known/webauthn") || lower.includes(".well-known/webauthn");
@@ -58,37 +46,7 @@ function isUserCancellationError(error) {
 	const code = String(codeRaw || "").trim().toLowerCase().replace(/[\s-]+/g, "_");
 	return codeRaw === 4001 || code === "4001" || code === "cancelled" || code === "canceled" || code === "abort_error" || code === "user_cancelled" || code === "user_canceled" || code === "user_rejected" || code === "action_rejected" || code === "request_rejected" || name === "NotAllowedError" || name === "AbortError" || lower.includes("user cancelled") || lower.includes("user canceled") || lower.includes("user rejected") || lower.includes("request cancelled") || lower.includes("request canceled") || lower.includes("operation cancelled") || lower.includes("operation canceled");
 }
-/**
-* Get a user-friendly error message for TouchID/FaceID cancellation
-* @param context - The context where the cancellation occurred (e.g., 'registration', 'login')
-* @returns A user-friendly error message
-*/
-function getTouchIdCancellationMessage(context) {
-	switch (context) {
-		case "registration": return `Registration was cancelled. Please try again when you're ready to set up your passkey.`;
-		case "login": return `Login was cancelled. Please try again when you're ready to authenticate.`;
-		default: return `Operation was cancelled. Please try again when you're ready.`;
-	}
-}
-/**
-* Transform an error message to be more user-friendly
-* @param error - The original error object or message
-* @param context - The context where the error occurred
-* @param accountId - Optional account ID for context-specific messages
-* @returns A user-friendly error message
-*/
-function getUserFriendlyErrorMessage(error, context = "registration", accountId) {
-	const msg = errorMessage(error);
-	if (isWebAuthnRpIdOriginConfigurationError(error)) return `${context === "registration" ? "Registration" : "Login"} failed because the configured WebAuthn RP ID is not valid for this app origin. Check VITE_RP_ID_BASE and the /.well-known/webauthn related-origin configuration for this environment.`;
-	if (isTouchIdCancellationError(error)) return getTouchIdCancellationMessage(context);
-	if (msg.includes("PRF outputs missing")) return `${context === "registration" ? "Registration" : "Login"} failed because your browser did not return the required passkey PRF results. On some mobile browsers this is not available for create(); try updating your browser or use a desktop browser. We’re working on an alternate path for broader device support.`;
-	if (msg.includes("one of the credentials already registered")) return `A passkey for '${accountId || "this account"}' already exists. Please try logging in instead.`;
-	if (msg.includes("Cannot deserialize the contract state")) return `Contract state deserialization failed. This may be due to a contract upgrade. Please try again or contact support.`;
-	if (msg.includes("Web3Authn contract registration check failed")) return `Contract registration check failed: ${msg.replace("Web3Authn contract registration check failed: ", "")}`;
-	if (msg.includes("Unknown error occurred")) return `${context === "registration" ? "Registration" : "Login"} failed due to an unknown error. Please check your connection and try again.`;
-	return msg;
-}
 //#endregion
-export { errorMessage, getUserFriendlyErrorMessage, isTouchIdCancellationError, isUserCancellationError, isWebAuthnRpIdOriginConfigurationError, toError };
+export { errorMessage, isUserCancellationError, isWebAuthnRpIdOriginConfigurationError, toError };
 
 //# sourceMappingURL=errors.js.map

package/dist/esm/shared-ts/src/utils/index.js

@@ -1,37 +1,33 @@
-import "./domainIds.js";
 import "./normalize.js";
 import "./validation.js";
+import "./domainIds.js";
 import "./base64.js";
 import "./digests.js";
 import "./canonicalPrimitives.js";
-import "./signingSessionSeal.js";
-import "./base58.js";
-import "./near.js";
-import "./emailOtpDomain.js";
-import "./signerDomain.js";
-import "./registrationIds.js";
-import "./walletCapabilityBindings.js";
+import "./errors.js";
+import "./authenticatorOptions.js";
 import "./secureRandomId.js";
-import "./signerSlot.js";
-import "./emailOtpRecoveryKey.js";
+import "./theme.js";
+import "./signingSessionSeal.js";
+import "./jsonRpc.js";
+import "./nearRpcResults.js";
+import "./routerAbPublicKeyset.js";
 import "./routerAbEd25519YaoDigests.js";
 import "./routerAbEd25519Yao.js";
-import "./routerAbTraceContext.js";
-import "./walletAuthAuthority.js";
-import "./routerAbPublicKeyset.js";
 import "./ecdsaCapabilityActivation.js";
+import "./walletAuthAuthority.js";
 import "./routerAbEcdsaDerivation.js";
-import "./addAuthMethodRegistration.js";
-import "./registrationAuthMethodInput.js";
 import "./walletAuthMethodRecord.js";
 import "./webauthnDeviceInfo.js";
-import "./encoders.js";
-import "./errors.js";
-import "./theme.js";
+import "./base58.js";
+import "./near.js";
+import "./emailOtpDomain.js";
+import "./signerDomain.js";
+import "./registrationIds.js";
+import "./signerSlot.js";
+import "./walletCapabilityBindings.js";
 import "./keccak.js";
-import "./jsonRpc.js";
-import "./nearRpcResults.js";
+import "./encoders.js";
+import "./emailOtpRecoveryKey.js";
 import "./registrationSignerPlan.js";
 import "./registrationIntent.js";
-import "./ecdsaKeyFactsInventory.js";
-import "./authenticatorOptions.js";