wire-mesh-core 1.46.0 → 1.48.0

package/dist/adapters/frame-codec.d.cts

@@ -1,4 +1,4 @@
-import { N as Frame } from "../protocol-D8CU6s2_.cjs";
+import { N as Frame } from "../protocol-CNFRVx9w.cjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** A frame that fails schema validation, caught separately from a decode failure so it can be dropped without disconnecting. */

package/dist/adapters/frame-codec.d.mts

@@ -1,4 +1,4 @@
-import { N as Frame } from "../protocol-D8CU6s2_.mjs";
+import { N as Frame } from "../protocol-CNFRVx9w.mjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** A frame that fails schema validation, caught separately from a decode failure so it can be dropped without disconnecting. */

package/dist/adapters/node-fs-storage.cjs

@@ -1,30 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-//#region \0rolldown/runtime.js
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-		key = keys[i];
-		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-			get: ((k) => from[k]).bind(null, key),
-			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-		});
-	}
-	return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
-//#endregion
+const require_rolldown_runtime = require("../rolldown-runtime-VH7oDXx4.cjs");
 let node_fs_promises = require("node:fs/promises");
-node_fs_promises = __toESM(node_fs_promises, 1);
+node_fs_promises = require_rolldown_runtime.__toESM(node_fs_promises, 1);
 let node_path = require("node:path");
-node_path = __toESM(node_path, 1);
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
 //#region src/adapters/node-fs-storage.ts
 /** A Node filesystem-backed KeyValueStorage -- the durable Node-side counterpart to indexeddb-storage.ts's browser one, and memory-storage.ts's in-process one, satisfying the identical contract. Every key is treated directly as a relative path under the given directory (creating nested directories as needed), which every key this codebase constructs is already suited to: internally generated, ASCII, path-shaped by design (e.g. "data/<peer-hex>/entry/<seq>") rather than arbitrary untrusted input, matching the same assumption indexeddb-storage.ts's own comment already states for its key range bounds. */
 function isEnoent(error) {

package/dist/adapters/node-identity.d.cts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-D8CU6s2_.cjs";
-import { t as IdentityPort } from "../identity-DHf0J6IA.cjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-CNFRVx9w.cjs";
+import { t as IdentityPort } from "../identity-CUkDHCRK.cjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.d.mts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-D8CU6s2_.mjs";
-import { t as IdentityPort } from "../identity-Oelt3uEn.mjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-CNFRVx9w.mjs";
+import { t as IdentityPort } from "../identity-9TmmK7vP.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/tcp-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-BbSGNRFZ.cjs";
+import { r as Transport } from "../transport-De0zHlaA.cjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tcp-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-BNeF6kDe.mjs";
+import { r as Transport } from "../transport-C7KVkhgb.mjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/threshold-identity.cjs

@@ -0,0 +1,42 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_domain_threshold_subject = require("../domain/threshold-subject.cjs");
+const require_adapters_threshold_wasm = require("./threshold-wasm.cjs");
+const require_adapters_node_identity = require("./node-identity.cjs");
+//#region src/adapters/threshold-identity.ts
+const ALG_ED25519 = -8;
+const FIRST_SESSION_ID = 1n;
+const SESSION_ID_STEP = 1n;
+/**
+* Builds a group's threshold-backed `IdentityPort`. `deviceId`/ `identityKey` are the group's own (`group-device-id = SHA-256(group public key)`, the ordinary `identity.cddl` rule applied to the DKG's output) -- indistinguishable on the wire from any ordinary single-device Ed25519 identity, per this domain's own defining property.
+*/
+async function createThresholdIdentity(groupVerifyingKey, publicKeyPackage, threshold, participants, coordinator) {
+	const deviceId = await require_adapters_node_identity.deriveDeviceId(groupVerifyingKey);
+	const identityKey = {
+		alg: ALG_ED25519,
+		"public-key": Uint8Array.from(groupVerifyingKey)
+	};
+	let nextSessionId = FIRST_SESSION_ID;
+	return {
+		deviceId,
+		identityKey,
+		async sign() {
+			return Promise.reject(/* @__PURE__ */ new Error("ThresholdIdentity.sign requires a ThresholdSubject, not a bare message -- use signSubject"));
+		},
+		verify: require_adapters_node_identity.verifyWithPublicKey,
+		deriveDeviceId: require_adapters_node_identity.deriveDeviceId,
+		async signSubject(subject, deadlineUnixMs) {
+			const sessionId = nextSessionId;
+			nextSessionId += SESSION_ID_STEP;
+			const commitments = await coordinator.commitRound(sessionId, participants, subject, deadlineUnixMs);
+			if (commitments.length < threshold) throw new Error(`only ${String(commitments.length)} of ${String(threshold)} required participants committed`);
+			const shares = await coordinator.signRound(sessionId, commitments);
+			const message = require_domain_threshold_subject.toBeSigned(subject);
+			const signingPackage = require_adapters_threshold_wasm.signingBuildPackage(commitments, message);
+			const signature = require_adapters_threshold_wasm.signingAggregate(signingPackage, shares, publicKeyPackage);
+			if (!await require_adapters_node_identity.verifyWithPublicKey(identityKey, message, signature)) throw new Error("aggregate threshold signature failed to verify against the group's own key -- refusing to return it");
+			return signature;
+		}
+	};
+}
+//#endregion
+exports.createThresholdIdentity = createThresholdIdentity;

package/dist/adapters/threshold-identity.d.cts

@@ -0,0 +1,33 @@
+import { D as DeviceId } from "../protocol-CNFRVx9w.cjs";
+import { t as IdentityPort } from "../identity-CUkDHCRK.cjs";
+import { DeviceKeyed } from "./threshold-wasm.cjs";
+import { ThresholdSubject } from "../domain/threshold-subject.cjs";
+//#region src/adapters/threshold-identity.d.ts
+/** One participant's round-1 response: its FROST commitments, keyed by device-id. */
+export type SigningCommitmentEntry = DeviceKeyed;
+/** One participant's round-2 response: its signature share, keyed by device-id. */
+export type SignatureShareEntry = DeviceKeyed;
+/**
+ * The network side of threshold signing, supplied by the caller. Never assumes a specific transport, framing, or retry/timeout policy -- those are the caller's own concern, matching this project's async-contracts convention. A second implementation on a completely different transport (a different harness's own RPC, an in-process test double) satisfies this exact contract with zero changes to the contract or its callers.
+ */
+export interface ThresholdCoordinator {
+  /**
+   * Sends `threshold-commit` to every one of `participants` for `subject`, and collects at least `threshold` valid responses. Implementations decide their own quorum/timeout/retry policy; this call either returns enough commitments to proceed or rejects.
+   */
+  commitRound: (sessionId: bigint, participants: readonly DeviceId[], subject: ThresholdSubject, deadlineUnixMs: number) => Promise<SigningCommitmentEntry[]>;
+  /**
+   * Sends `threshold-sign` (the collected commitments, no subject) to every participant that committed, and collects their signature shares.
+   */
+  signRound: (sessionId: bigint, commitments: readonly SigningCommitmentEntry[]) => Promise<SignatureShareEntry[]>;
+}
+export interface ThresholdIdentity extends IdentityPort {
+  /**
+   * The real entry point: signs `subject` (never a bare hash -- `ThresholdSubject` always carries the full decoded content, per this domain's own non-negotiable security invariant), round-tripping through the coordinator for both FROST rounds, then verifying the aggregate signature before returning it.
+   */
+  signSubject: (subject: ThresholdSubject, deadlineUnixMs: number) => Promise<Uint8Array<ArrayBuffer>>;
+}
+/**
+ * Builds a group's threshold-backed `IdentityPort`. `deviceId`/ `identityKey` are the group's own (`group-device-id = SHA-256(group public key)`, the ordinary `identity.cddl` rule applied to the DKG's output) -- indistinguishable on the wire from any ordinary single-device Ed25519 identity, per this domain's own defining property.
+ */
+export declare function createThresholdIdentity(groupVerifyingKey: Uint8Array, publicKeyPackage: Uint8Array, threshold: number, participants: readonly DeviceId[], coordinator: Readonly<ThresholdCoordinator>): Promise<ThresholdIdentity>;
+//#endregion

package/dist/adapters/threshold-identity.d.mts

@@ -0,0 +1,33 @@
+import { D as DeviceId } from "../protocol-CNFRVx9w.mjs";
+import { t as IdentityPort } from "../identity-9TmmK7vP.mjs";
+import { DeviceKeyed } from "./threshold-wasm.mjs";
+import { ThresholdSubject } from "../domain/threshold-subject.mjs";
+//#region src/adapters/threshold-identity.d.ts
+/** One participant's round-1 response: its FROST commitments, keyed by device-id. */
+export type SigningCommitmentEntry = DeviceKeyed;
+/** One participant's round-2 response: its signature share, keyed by device-id. */
+export type SignatureShareEntry = DeviceKeyed;
+/**
+ * The network side of threshold signing, supplied by the caller. Never assumes a specific transport, framing, or retry/timeout policy -- those are the caller's own concern, matching this project's async-contracts convention. A second implementation on a completely different transport (a different harness's own RPC, an in-process test double) satisfies this exact contract with zero changes to the contract or its callers.
+ */
+export interface ThresholdCoordinator {
+  /**
+   * Sends `threshold-commit` to every one of `participants` for `subject`, and collects at least `threshold` valid responses. Implementations decide their own quorum/timeout/retry policy; this call either returns enough commitments to proceed or rejects.
+   */
+  commitRound: (sessionId: bigint, participants: readonly DeviceId[], subject: ThresholdSubject, deadlineUnixMs: number) => Promise<SigningCommitmentEntry[]>;
+  /**
+   * Sends `threshold-sign` (the collected commitments, no subject) to every participant that committed, and collects their signature shares.
+   */
+  signRound: (sessionId: bigint, commitments: readonly SigningCommitmentEntry[]) => Promise<SignatureShareEntry[]>;
+}
+export interface ThresholdIdentity extends IdentityPort {
+  /**
+   * The real entry point: signs `subject` (never a bare hash -- `ThresholdSubject` always carries the full decoded content, per this domain's own non-negotiable security invariant), round-tripping through the coordinator for both FROST rounds, then verifying the aggregate signature before returning it.
+   */
+  signSubject: (subject: ThresholdSubject, deadlineUnixMs: number) => Promise<Uint8Array<ArrayBuffer>>;
+}
+/**
+ * Builds a group's threshold-backed `IdentityPort`. `deviceId`/ `identityKey` are the group's own (`group-device-id = SHA-256(group public key)`, the ordinary `identity.cddl` rule applied to the DKG's output) -- indistinguishable on the wire from any ordinary single-device Ed25519 identity, per this domain's own defining property.
+ */
+export declare function createThresholdIdentity(groupVerifyingKey: Uint8Array, publicKeyPackage: Uint8Array, threshold: number, participants: readonly DeviceId[], coordinator: Readonly<ThresholdCoordinator>): Promise<ThresholdIdentity>;
+//#endregion

package/dist/adapters/threshold-identity.mjs

@@ -0,0 +1,41 @@
+import { toBeSigned } from "../domain/threshold-subject.mjs";
+import { signingAggregate, signingBuildPackage } from "./threshold-wasm.mjs";
+import { deriveDeviceId, verifyWithPublicKey } from "./node-identity.mjs";
+//#region src/adapters/threshold-identity.ts
+const ALG_ED25519 = -8;
+const FIRST_SESSION_ID = 1n;
+const SESSION_ID_STEP = 1n;
+/**
+* Builds a group's threshold-backed `IdentityPort`. `deviceId`/ `identityKey` are the group's own (`group-device-id = SHA-256(group public key)`, the ordinary `identity.cddl` rule applied to the DKG's output) -- indistinguishable on the wire from any ordinary single-device Ed25519 identity, per this domain's own defining property.
+*/
+async function createThresholdIdentity(groupVerifyingKey, publicKeyPackage, threshold, participants, coordinator) {
+	const deviceId = await deriveDeviceId(groupVerifyingKey);
+	const identityKey = {
+		alg: ALG_ED25519,
+		"public-key": Uint8Array.from(groupVerifyingKey)
+	};
+	let nextSessionId = FIRST_SESSION_ID;
+	return {
+		deviceId,
+		identityKey,
+		async sign() {
+			return Promise.reject(/* @__PURE__ */ new Error("ThresholdIdentity.sign requires a ThresholdSubject, not a bare message -- use signSubject"));
+		},
+		verify: verifyWithPublicKey,
+		deriveDeviceId,
+		async signSubject(subject, deadlineUnixMs) {
+			const sessionId = nextSessionId;
+			nextSessionId += SESSION_ID_STEP;
+			const commitments = await coordinator.commitRound(sessionId, participants, subject, deadlineUnixMs);
+			if (commitments.length < threshold) throw new Error(`only ${String(commitments.length)} of ${String(threshold)} required participants committed`);
+			const shares = await coordinator.signRound(sessionId, commitments);
+			const message = toBeSigned(subject);
+			const signingPackage = signingBuildPackage(commitments, message);
+			const signature = signingAggregate(signingPackage, shares, publicKeyPackage);
+			if (!await verifyWithPublicKey(identityKey, message, signature)) throw new Error("aggregate threshold signature failed to verify against the group's own key -- refusing to return it");
+			return signature;
+		}
+	};
+}
+//#endregion
+export { createThresholdIdentity };

package/dist/adapters/threshold-wasm.cjs

@@ -0,0 +1,197 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../rolldown-runtime-VH7oDXx4.cjs");
+const require_generated_protocol = require("../generated/protocol.cjs");
+let wasm_dist_wire_mesh_threshold_wasm_js = require("../../wasm-dist/wire_mesh_threshold_wasm.js");
+wasm_dist_wire_mesh_threshold_wasm_js = require_rolldown_runtime.__toESM(wasm_dist_wire_mesh_threshold_wasm_js, 1);
+//#region src/adapters/threshold-wasm.ts
+/**
+* A typed TS wrapper over the WASM build of `wire-mesh-threshold` (the audited `frost-core`/`frost-ed25519` crates, ZcashFoundation, NCC-audited) -- wire-mesh#29's own chosen route for a TS FROST(Ed25519, SHA-512) participant, over a from-scratch reimplementation of the cryptography.
+*
+* Built by `scripts/build-threshold-wasm.sh` into `wasm-dist/` (gitignored, a genuine compiled build artifact like `dist/`, never committed) -- run it before importing this module, in dev and in CI alike. This module performs NO domain logic of its own, only re-typing the raw wasm bindings' `Uint8Array`/`Array<any>` surface against this package's own `DeviceId` type and Node-capable-device-only availability: FROST participation cannot use Web Crypto at all (raw scalar/point arithmetic is deliberately outside what Web Crypto exposes), so unlike `node-identity.ts`'s counterpart in `web-crypto-identity.ts`, this adapter has no browser-side equivalent in v1 -- per wire-mesh#29's own resolved design, a browser is a threshold-group BEARER only, never a SHAREHOLDER, in v1.
+*/
+function isUint8Array(value) {
+	return value instanceof Uint8Array;
+}
+/** Copies into a fresh, whole-buffer `Uint8Array<ArrayBuffer>` -- the wasm-bindgen-generated `.d.ts` declares its `Uint8Array` returns unparameterized (`Uint8Array<ArrayBufferLike>`), which callers such as `verifyWithPublicKey` (`node-identity.ts`) reject; this is the same normalisation that adapter's own `toBufferSource` already applies at its boundary. */
+function toBufferSource(bytes) {
+	return Uint8Array.from(bytes);
+}
+function toParallelArrays(entries) {
+	return [entries.map((e) => e.deviceId), entries.map((e) => e.value)];
+}
+function fromParallelArrays(ids, values) {
+	if (ids.length !== values.length) throw new Error(`wasm returned mismatched parallel arrays: ${String(ids.length)} ids, ${String(values.length)} values`);
+	const result = [];
+	for (let i = 0; i < ids.length; i += 1) {
+		const id = ids[i];
+		const value = values[i];
+		if (!isUint8Array(value)) throw new Error("wasm returned a non-Uint8Array value in a parallel array");
+		result.push({
+			deviceId: require_generated_protocol.deviceIdSchema.parse(id),
+			value: toBufferSource(value)
+		});
+	}
+	return result;
+}
+/** Round 1: samples this participant's own polynomial and commits to it. See `wire_mesh_threshold::dkg::round1`'s own doc comment for the full design. */
+function dkgRound1(ownDeviceId, maxSigners, minSigners) {
+	const out = wasm_dist_wire_mesh_threshold_wasm_js.dkg_round1(ownDeviceId, maxSigners, minSigners);
+	return {
+		secretPackage: toBufferSource(out.secretPackage),
+		package: toBufferSource(out.package)
+	};
+}
+/** Splits a serialized DKG round-1 package (dkgRound1's own `package` output) into `threshold-keygen-round1`'s own wire shape: the Feldman commitment as an array of independently-serialized coefficients (`commitment: [* bstr]`) and the Schnorr proof of knowledge as a separate byte string -- unlike frost-core's own combined-blob serialization. The inverse of combineRound1Package. */
+function splitRound1Package(serializedPackage) {
+	const out = wasm_dist_wire_mesh_threshold_wasm_js.split_round1_package(serializedPackage);
+	const commitment = [];
+	for (const coefficient of out.commitment) {
+		if (!isUint8Array(coefficient)) throw new Error("wasm returned a non-Uint8Array entry in split_round1_package's own commitment array");
+		commitment.push(toBufferSource(coefficient));
+	}
+	return {
+		commitment,
+		proofOfKnowledge: toBufferSource(out.proofOfKnowledge)
+	};
+}
+/** Reconstructs a serialized DKG round-1 package (the same combined-blob shape dkgRound2/dkgRound3/dkgTranscriptDigest expect) from the two independently-serialized wire fields `threshold-keygen-round1` carries. The inverse of splitRound1Package. */
+function combineRound1Package(commitment, proofOfKnowledge) {
+	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.combine_round1_package([...commitment], proofOfKnowledge));
+}
+/** Round 2: verifies every other participant's round-1 proof of knowledge and computes this participant's own pairwise sub-shares. `round1` MUST NOT include this participant's own package. */
+function dkgRound2(ownSecretPackage, round1) {
+	const [ids, packages] = toParallelArrays(round1);
+	const out = wasm_dist_wire_mesh_threshold_wasm_js.dkg_round2(ownSecretPackage, ids, packages);
+	return {
+		secretPackage: toBufferSource(out.secretPackage),
+		outgoing: fromParallelArrays(out.recipientIds, out.packages)
+	};
+}
+/** Round 3 (local, no wire traffic): verifies every received round-2 package and sums them into this participant's own long-term key package. `round1`/`round2` MUST NOT include this participant's own packages. */
+function dkgRound3(ownSecretPackage, round1, round2) {
+	const [ids1, packages1] = toParallelArrays(round1);
+	const [ids2, packages2] = toParallelArrays(round2);
+	const out = wasm_dist_wire_mesh_threshold_wasm_js.dkg_round3(ownSecretPackage, ids1, packages1, ids2, packages2);
+	return {
+		keyPackage: toBufferSource(out.keyPackage),
+		publicKeyPackage: toBufferSource(out.publicKeyPackage),
+		groupVerifyingKey: toBufferSource(out.groupVerifyingKey)
+	};
+}
+/** The echo-broadcast transcript digest this participant sends on `threshold-keygen-confirm` -- SHA-256 over the FULL ordered set of every round-1 package (including this participant's own), so two honest participants' digests are directly comparable. */
+function dkgTranscriptDigest(allRound1, groupVerifyingKey) {
+	const [ids, packages] = toParallelArrays(allRound1);
+	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.dkg_transcript_digest(ids, packages, groupVerifyingKey));
+}
+/** Verifies this participant's own transcript digest/group key against what a peer reported. A mismatch means the ceremony MUST abort, never be repaired in place. */
+function dkgConfirmMatches(ownDigest, ownGroupKey, peerDigest, peerGroupKey) {
+	return wasm_dist_wire_mesh_threshold_wasm_js.dkg_confirm_matches(ownDigest, ownGroupKey, peerDigest, peerGroupKey);
+}
+/** Extracts a key package's own signing-share bytes -- what `reshareRound1` needs as `ownOldSigningShare`. */
+function keyPackageSigningShare(keyPackage) {
+	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.key_package_signing_share(keyPackage));
+}
+/**
+* The pure-crypto half of round 1: generates a fresh nonce pair and its commitments. Persisting `nonces` durably before this participant's own round-1 response leaves the device is the CALLER's own obligation -- nonce reuse across two released signature shares discloses this participant's long-term key share outright. This function has no storage dependency and cannot enforce that obligation itself.
+*/
+function signingRound1Commit(ownKeyPackage) {
+	const out = wasm_dist_wire_mesh_threshold_wasm_js.signing_round1_commit(ownKeyPackage);
+	return {
+		nonces: toBufferSource(out.nonces),
+		commitments: toBufferSource(out.commitments)
+	};
+}
+/** Splits a serialized SigningCommitments blob (signingRound1Commit's own `commitments` output) into the two independently-serialized halves `threshold-commitment`'s wire shape carries (`hiding: bstr, binding: bstr`) -- unlike frost-core's own combined-blob serialization, which is opaque and not spec-shaped. The inverse of combineCommitments. */
+function splitCommitments(commitments) {
+	const out = wasm_dist_wire_mesh_threshold_wasm_js.split_commitments(commitments);
+	return {
+		hiding: toBufferSource(out.hiding),
+		binding: toBufferSource(out.binding)
+	};
+}
+/** Reconstructs a serialized SigningCommitments blob (the same combined-blob shape signingBuildPackage/signingRound2Sign expect) from the two independently-serialized halves `threshold-commitment` carries on the wire. The inverse of splitCommitments. */
+function combineCommitments(hiding, binding) {
+	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.combine_commitments(hiding, binding));
+}
+/** Coordinator-side: builds the signing-package bytes every participant's round 2 is computed against. */
+function signingBuildPackage(commitments, message) {
+	const [ids, values] = toParallelArrays(commitments);
+	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.signing_build_package(ids, values, message));
+}
+/** Round 2: releases this participant's signature share. The CALLER MUST have already taken (one-shot) `nonces` from its own durable nonce store before calling this. */
+function signingRound2Sign(nonces, signingPackage, ownKeyPackage) {
+	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.signing_round2_sign(nonces, signingPackage, ownKeyPackage));
+}
+/**
+* Coordinator-side: sums and verifies the collected shares into the final aggregate signature -- an ordinary 64-byte Ed25519 signature. Throws if verification fails (a malformed or forged share); a caller MUST treat any thrown error here as "publish nothing".
+*/
+function signingAggregate(signingPackage, shares, publicKeyPackage) {
+	const [ids, values] = toParallelArrays(shares);
+	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.signing_aggregate(signingPackage, ids, values, publicKeyPackage));
+}
+/**
+* Survivor side: re-shares this device's own Lagrange-weighted sub-share of the group secret across a new (possibly different) participant set. See `wire_mesh_threshold::reshare`'s own module doc comment (Rust side) for the full design rationale -- deliberately not built on a zero-secret "refresh" delta, which cannot onboard a device with no prior share or safely change the threshold.
+*/
+function reshareRound1(ownDeviceId, ownOldSigningShare, survivorDeviceIds, newParticipantDeviceIds, newMinSigners) {
+	const out = wasm_dist_wire_mesh_threshold_wasm_js.reshare_round1(ownDeviceId, ownOldSigningShare, [...survivorDeviceIds], [...newParticipantDeviceIds], newMinSigners);
+	return {
+		commitment: toBufferSource(out.commitment),
+		outgoing: fromParallelArrays(out.recipientIds, out.shares)
+	};
+}
+/** Splits a survivor's serialized broadcast commitment (reshareRound1's own `commitment` output) into `threshold-keygen-round1`'s own wire shape: an array of independently-serialized coefficients (`commitment: [* bstr]`) -- unlike reshareRound1's own whole-blob serialization. The inverse of reshareCombineCommitmentParts. */
+function reshareSplitCommitment(commitment) {
+	const out = [];
+	for (const part of wasm_dist_wire_mesh_threshold_wasm_js.reshare_split_commitment(commitment)) {
+		if (!isUint8Array(part)) throw new Error("wasm returned a non-Uint8Array entry in reshare_split_commitment's own output array");
+		out.push(toBufferSource(part));
+	}
+	return out;
+}
+/** Reconstructs a survivor's serialized broadcast commitment (the same whole-blob shape reshareCombineCommitments expects each entry of its own commitments array to be) from the wire's own per-coefficient array. The inverse of reshareSplitCommitment. */
+function reshareCombineCommitmentParts(parts) {
+	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.reshare_combine_commitment_parts([...parts]));
+}
+/** Sums T survivors' broadcast commitment vectors into the one combined VSS commitment `reshareDerivePublicKeyPackage` needs. */
+function reshareCombineCommitments(commitments) {
+	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.reshare_combine_commitments([...commitments]));
+}
+/** The echo-broadcast transcript digest a member of the new participant set sends on threshold-keygen-confirm for a reshare -- the reshare analogue of dkgTranscriptDigest, structurally distinct because a reshare's own survivor commitment carries no proof-of-knowledge component: deserializing one as a DKG round-1 package fails outright, since the two are different wire shapes entirely. `survivorCommitments` entries are each the same whole-blob shape reshareRound1's own `commitment` output is (NOT the wire's own split [* bstr] parts -- combine those first via reshareCombineCommitmentParts if collected off the wire). */
+function reshareTranscriptDigest(survivorCommitments, groupVerifyingKey) {
+	const [ids, commitments] = toParallelArrays(survivorCommitments);
+	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.reshare_transcript_digest(ids, commitments, groupVerifyingKey));
+}
+/** The group's derived public key package given the combined commitment and the new participant set. `groupVerifyingKey` is what `threshold-keygen-confirm`'s own `group-key` field carries and what a reshare's own verifier obligation checks against `existing-group-key` (MUST equal it -- a reshare that changes the group key is a takeover, not a reshare). */
+function reshareDerivePublicKeyPackage(combinedCommitment, newParticipantDeviceIds) {
+	const out = wasm_dist_wire_mesh_threshold_wasm_js.reshare_derive_public_key_package(combinedCommitment, [...newParticipantDeviceIds]);
+	return {
+		publicKeyPackage: toBufferSource(out.publicKeyPackage),
+		groupVerifyingKey: toBufferSource(out.groupVerifyingKey)
+	};
+}
+/** New-participant side (local): verifies each received share against its own embedded commitment, sums the validated shares, and builds this participant's final key package. */
+function reshareCombineReceivedShares(ownDeviceId, received, publicKeyPackage, newMinSigners) {
+	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.reshare_combine_received_shares(ownDeviceId, [...received], publicKeyPackage, newMinSigners));
+}
+//#endregion
+exports.combineCommitments = combineCommitments;
+exports.combineRound1Package = combineRound1Package;
+exports.dkgConfirmMatches = dkgConfirmMatches;
+exports.dkgRound1 = dkgRound1;
+exports.dkgRound2 = dkgRound2;
+exports.dkgRound3 = dkgRound3;
+exports.dkgTranscriptDigest = dkgTranscriptDigest;
+exports.keyPackageSigningShare = keyPackageSigningShare;
+exports.reshareCombineCommitmentParts = reshareCombineCommitmentParts;
+exports.reshareCombineCommitments = reshareCombineCommitments;
+exports.reshareCombineReceivedShares = reshareCombineReceivedShares;
+exports.reshareDerivePublicKeyPackage = reshareDerivePublicKeyPackage;
+exports.reshareRound1 = reshareRound1;
+exports.reshareSplitCommitment = reshareSplitCommitment;
+exports.reshareTranscriptDigest = reshareTranscriptDigest;
+exports.signingAggregate = signingAggregate;
+exports.signingBuildPackage = signingBuildPackage;
+exports.signingRound1Commit = signingRound1Commit;
+exports.signingRound2Sign = signingRound2Sign;
+exports.splitCommitments = splitCommitments;
+exports.splitRound1Package = splitRound1Package;

package/dist/adapters/threshold-wasm.d.cts

@@ -0,0 +1,89 @@
+import { D as DeviceId } from "../protocol-CNFRVx9w.cjs";
+//#region src/adapters/threshold-wasm.d.ts
+/** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
+export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {
+  deviceId: DeviceId;
+  value: T;
+}
+export interface DkgRound1Result {
+  secretPackage: Uint8Array<ArrayBuffer>;
+  package: Uint8Array<ArrayBuffer>;
+}
+/** Round 1: samples this participant's own polynomial and commits to it. See `wire_mesh_threshold::dkg::round1`'s own doc comment for the full design. */
+export declare function dkgRound1(ownDeviceId: DeviceId, maxSigners: number, minSigners: number): DkgRound1Result;
+export interface SplitRound1PackageResult {
+  commitment: Uint8Array<ArrayBuffer>[];
+  proofOfKnowledge: Uint8Array<ArrayBuffer>;
+}
+/** Splits a serialized DKG round-1 package (dkgRound1's own `package` output) into `threshold-keygen-round1`'s own wire shape: the Feldman commitment as an array of independently-serialized coefficients (`commitment: [* bstr]`) and the Schnorr proof of knowledge as a separate byte string -- unlike frost-core's own combined-blob serialization. The inverse of combineRound1Package. */
+export declare function splitRound1Package(serializedPackage: Uint8Array): SplitRound1PackageResult;
+/** Reconstructs a serialized DKG round-1 package (the same combined-blob shape dkgRound2/dkgRound3/dkgTranscriptDigest expect) from the two independently-serialized wire fields `threshold-keygen-round1` carries. The inverse of splitRound1Package. */
+export declare function combineRound1Package(commitment: readonly Uint8Array[], proofOfKnowledge: Uint8Array): Uint8Array<ArrayBuffer>;
+export interface DkgRound2Result {
+  secretPackage: Uint8Array<ArrayBuffer>;
+  outgoing: DeviceKeyed[];
+}
+/** Round 2: verifies every other participant's round-1 proof of knowledge and computes this participant's own pairwise sub-shares. `round1` MUST NOT include this participant's own package. */
+export declare function dkgRound2(ownSecretPackage: Uint8Array, round1: readonly DeviceKeyed[]): DkgRound2Result;
+export interface DkgRound3Result {
+  keyPackage: Uint8Array<ArrayBuffer>;
+  publicKeyPackage: Uint8Array<ArrayBuffer>;
+  groupVerifyingKey: Uint8Array<ArrayBuffer>;
+}
+/** Round 3 (local, no wire traffic): verifies every received round-2 package and sums them into this participant's own long-term key package. `round1`/`round2` MUST NOT include this participant's own packages. */
+export declare function dkgRound3(ownSecretPackage: Uint8Array, round1: readonly DeviceKeyed[], round2: readonly DeviceKeyed[]): DkgRound3Result;
+/** The echo-broadcast transcript digest this participant sends on `threshold-keygen-confirm` -- SHA-256 over the FULL ordered set of every round-1 package (including this participant's own), so two honest participants' digests are directly comparable. */
+export declare function dkgTranscriptDigest(allRound1: readonly DeviceKeyed[], groupVerifyingKey: Uint8Array): Uint8Array<ArrayBuffer>;
+/** Verifies this participant's own transcript digest/group key against what a peer reported. A mismatch means the ceremony MUST abort, never be repaired in place. */
+export declare function dkgConfirmMatches(ownDigest: Uint8Array, ownGroupKey: Uint8Array, peerDigest: Uint8Array, peerGroupKey: Uint8Array): boolean;
+/** Extracts a key package's own signing-share bytes -- what `reshareRound1` needs as `ownOldSigningShare`. */
+export declare function keyPackageSigningShare(keyPackage: Uint8Array): Uint8Array<ArrayBuffer>;
+export interface SigningRound1Result {
+  nonces: Uint8Array<ArrayBuffer>;
+  commitments: Uint8Array<ArrayBuffer>;
+}
+/**
+ * The pure-crypto half of round 1: generates a fresh nonce pair and its commitments. Persisting `nonces` durably before this participant's own round-1 response leaves the device is the CALLER's own obligation -- nonce reuse across two released signature shares discloses this participant's long-term key share outright. This function has no storage dependency and cannot enforce that obligation itself.
+ */
+export declare function signingRound1Commit(ownKeyPackage: Uint8Array): SigningRound1Result;
+export interface SplitCommitmentsResult {
+  hiding: Uint8Array<ArrayBuffer>;
+  binding: Uint8Array<ArrayBuffer>;
+}
+/** Splits a serialized SigningCommitments blob (signingRound1Commit's own `commitments` output) into the two independently-serialized halves `threshold-commitment`'s wire shape carries (`hiding: bstr, binding: bstr`) -- unlike frost-core's own combined-blob serialization, which is opaque and not spec-shaped. The inverse of combineCommitments. */
+export declare function splitCommitments(commitments: Uint8Array): SplitCommitmentsResult;
+/** Reconstructs a serialized SigningCommitments blob (the same combined-blob shape signingBuildPackage/signingRound2Sign expect) from the two independently-serialized halves `threshold-commitment` carries on the wire. The inverse of splitCommitments. */
+export declare function combineCommitments(hiding: Uint8Array, binding: Uint8Array): Uint8Array<ArrayBuffer>;
+/** Coordinator-side: builds the signing-package bytes every participant's round 2 is computed against. */
+export declare function signingBuildPackage(commitments: readonly DeviceKeyed[], message: Uint8Array): Uint8Array<ArrayBuffer>;
+/** Round 2: releases this participant's signature share. The CALLER MUST have already taken (one-shot) `nonces` from its own durable nonce store before calling this. */
+export declare function signingRound2Sign(nonces: Uint8Array, signingPackage: Uint8Array, ownKeyPackage: Uint8Array): Uint8Array<ArrayBuffer>;
+/**
+ * Coordinator-side: sums and verifies the collected shares into the final aggregate signature -- an ordinary 64-byte Ed25519 signature. Throws if verification fails (a malformed or forged share); a caller MUST treat any thrown error here as "publish nothing".
+ */
+export declare function signingAggregate(signingPackage: Uint8Array, shares: readonly DeviceKeyed[], publicKeyPackage: Uint8Array): Uint8Array<ArrayBuffer>;
+export interface ReshareRound1Result {
+  commitment: Uint8Array<ArrayBuffer>;
+  outgoing: DeviceKeyed[];
+}
+/**
+ * Survivor side: re-shares this device's own Lagrange-weighted sub-share of the group secret across a new (possibly different) participant set. See `wire_mesh_threshold::reshare`'s own module doc comment (Rust side) for the full design rationale -- deliberately not built on a zero-secret "refresh" delta, which cannot onboard a device with no prior share or safely change the threshold.
+ */
+export declare function reshareRound1(ownDeviceId: DeviceId, ownOldSigningShare: Uint8Array, survivorDeviceIds: readonly DeviceId[], newParticipantDeviceIds: readonly DeviceId[], newMinSigners: number): ReshareRound1Result;
+/** Splits a survivor's serialized broadcast commitment (reshareRound1's own `commitment` output) into `threshold-keygen-round1`'s own wire shape: an array of independently-serialized coefficients (`commitment: [* bstr]`) -- unlike reshareRound1's own whole-blob serialization. The inverse of reshareCombineCommitmentParts. */
+export declare function reshareSplitCommitment(commitment: Uint8Array): Uint8Array<ArrayBuffer>[];
+/** Reconstructs a survivor's serialized broadcast commitment (the same whole-blob shape reshareCombineCommitments expects each entry of its own commitments array to be) from the wire's own per-coefficient array. The inverse of reshareSplitCommitment. */
+export declare function reshareCombineCommitmentParts(parts: readonly Uint8Array[]): Uint8Array<ArrayBuffer>;
+/** Sums T survivors' broadcast commitment vectors into the one combined VSS commitment `reshareDerivePublicKeyPackage` needs. */
+export declare function reshareCombineCommitments(commitments: readonly Uint8Array[]): Uint8Array<ArrayBuffer>;
+/** The echo-broadcast transcript digest a member of the new participant set sends on threshold-keygen-confirm for a reshare -- the reshare analogue of dkgTranscriptDigest, structurally distinct because a reshare's own survivor commitment carries no proof-of-knowledge component: deserializing one as a DKG round-1 package fails outright, since the two are different wire shapes entirely. `survivorCommitments` entries are each the same whole-blob shape reshareRound1's own `commitment` output is (NOT the wire's own split [* bstr] parts -- combine those first via reshareCombineCommitmentParts if collected off the wire). */
+export declare function reshareTranscriptDigest(survivorCommitments: readonly DeviceKeyed[], groupVerifyingKey: Uint8Array): Uint8Array<ArrayBuffer>;
+export interface ReshareDerivePublicKeyPackageResult {
+  publicKeyPackage: Uint8Array<ArrayBuffer>;
+  groupVerifyingKey: Uint8Array<ArrayBuffer>;
+}
+/** The group's derived public key package given the combined commitment and the new participant set. `groupVerifyingKey` is what `threshold-keygen-confirm`'s own `group-key` field carries and what a reshare's own verifier obligation checks against `existing-group-key` (MUST equal it -- a reshare that changes the group key is a takeover, not a reshare). */
+export declare function reshareDerivePublicKeyPackage(combinedCommitment: Uint8Array, newParticipantDeviceIds: readonly DeviceId[]): ReshareDerivePublicKeyPackageResult;
+/** New-participant side (local): verifies each received share against its own embedded commitment, sums the validated shares, and builds this participant's final key package. */
+export declare function reshareCombineReceivedShares(ownDeviceId: DeviceId, received: readonly Uint8Array[], publicKeyPackage: Uint8Array, newMinSigners: number): Uint8Array<ArrayBuffer>;
+//#endregion