wire-mesh-core 1.47.0 → 1.48.0

package/dist/adapters/threshold-wasm.cjs

@@ -41,6 +41,23 @@ function dkgRound1(ownDeviceId, maxSigners, minSigners) {
 		package: toBufferSource(out.package)
 	};
 }
+/** Splits a serialized DKG round-1 package (dkgRound1's own `package` output) into `threshold-keygen-round1`'s own wire shape: the Feldman commitment as an array of independently-serialized coefficients (`commitment: [* bstr]`) and the Schnorr proof of knowledge as a separate byte string -- unlike frost-core's own combined-blob serialization. The inverse of combineRound1Package. */
+function splitRound1Package(serializedPackage) {
+	const out = wasm_dist_wire_mesh_threshold_wasm_js.split_round1_package(serializedPackage);
+	const commitment = [];
+	for (const coefficient of out.commitment) {
+		if (!isUint8Array(coefficient)) throw new Error("wasm returned a non-Uint8Array entry in split_round1_package's own commitment array");
+		commitment.push(toBufferSource(coefficient));
+	}
+	return {
+		commitment,
+		proofOfKnowledge: toBufferSource(out.proofOfKnowledge)
+	};
+}
+/** Reconstructs a serialized DKG round-1 package (the same combined-blob shape dkgRound2/dkgRound3/dkgTranscriptDigest expect) from the two independently-serialized wire fields `threshold-keygen-round1` carries. The inverse of splitRound1Package. */
+function combineRound1Package(commitment, proofOfKnowledge) {
+	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.combine_round1_package([...commitment], proofOfKnowledge));
+}
 /** Round 2: verifies every other participant's round-1 proof of knowledge and computes this participant's own pairwise sub-shares. `round1` MUST NOT include this participant's own package. */
 function dkgRound2(ownSecretPackage, round1) {
 	const [ids, packages] = toParallelArrays(round1);
@@ -84,6 +101,18 @@ function signingRound1Commit(ownKeyPackage) {
 		commitments: toBufferSource(out.commitments)
 	};
 }
+/** Splits a serialized SigningCommitments blob (signingRound1Commit's own `commitments` output) into the two independently-serialized halves `threshold-commitment`'s wire shape carries (`hiding: bstr, binding: bstr`) -- unlike frost-core's own combined-blob serialization, which is opaque and not spec-shaped. The inverse of combineCommitments. */
+function splitCommitments(commitments) {
+	const out = wasm_dist_wire_mesh_threshold_wasm_js.split_commitments(commitments);
+	return {
+		hiding: toBufferSource(out.hiding),
+		binding: toBufferSource(out.binding)
+	};
+}
+/** Reconstructs a serialized SigningCommitments blob (the same combined-blob shape signingBuildPackage/signingRound2Sign expect) from the two independently-serialized halves `threshold-commitment` carries on the wire. The inverse of splitCommitments. */
+function combineCommitments(hiding, binding) {
+	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.combine_commitments(hiding, binding));
+}
 /** Coordinator-side: builds the signing-package bytes every participant's round 2 is computed against. */
 function signingBuildPackage(commitments, message) {
 	const [ids, values] = toParallelArrays(commitments);
@@ -110,30 +139,59 @@ function reshareRound1(ownDeviceId, ownOldSigningShare, survivorDeviceIds, newPa
 		outgoing: fromParallelArrays(out.recipientIds, out.shares)
 	};
 }
+/** Splits a survivor's serialized broadcast commitment (reshareRound1's own `commitment` output) into `threshold-keygen-round1`'s own wire shape: an array of independently-serialized coefficients (`commitment: [* bstr]`) -- unlike reshareRound1's own whole-blob serialization. The inverse of reshareCombineCommitmentParts. */
+function reshareSplitCommitment(commitment) {
+	const out = [];
+	for (const part of wasm_dist_wire_mesh_threshold_wasm_js.reshare_split_commitment(commitment)) {
+		if (!isUint8Array(part)) throw new Error("wasm returned a non-Uint8Array entry in reshare_split_commitment's own output array");
+		out.push(toBufferSource(part));
+	}
+	return out;
+}
+/** Reconstructs a survivor's serialized broadcast commitment (the same whole-blob shape reshareCombineCommitments expects each entry of its own commitments array to be) from the wire's own per-coefficient array. The inverse of reshareSplitCommitment. */
+function reshareCombineCommitmentParts(parts) {
+	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.reshare_combine_commitment_parts([...parts]));
+}
 /** Sums T survivors' broadcast commitment vectors into the one combined VSS commitment `reshareDerivePublicKeyPackage` needs. */
 function reshareCombineCommitments(commitments) {
 	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.reshare_combine_commitments([...commitments]));
 }
-/** The group's derived public key given the combined commitment and the new participant set -- reused directly by `threshold-keygen-confirm`'s own group-key check (MUST equal the group's `existing-group-key` for a reshare). */
+/** The echo-broadcast transcript digest a member of the new participant set sends on threshold-keygen-confirm for a reshare -- the reshare analogue of dkgTranscriptDigest, structurally distinct because a reshare's own survivor commitment carries no proof-of-knowledge component: deserializing one as a DKG round-1 package fails outright, since the two are different wire shapes entirely. `survivorCommitments` entries are each the same whole-blob shape reshareRound1's own `commitment` output is (NOT the wire's own split [* bstr] parts -- combine those first via reshareCombineCommitmentParts if collected off the wire). */
+function reshareTranscriptDigest(survivorCommitments, groupVerifyingKey) {
+	const [ids, commitments] = toParallelArrays(survivorCommitments);
+	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.reshare_transcript_digest(ids, commitments, groupVerifyingKey));
+}
+/** The group's derived public key package given the combined commitment and the new participant set. `groupVerifyingKey` is what `threshold-keygen-confirm`'s own `group-key` field carries and what a reshare's own verifier obligation checks against `existing-group-key` (MUST equal it -- a reshare that changes the group key is a takeover, not a reshare). */
 function reshareDerivePublicKeyPackage(combinedCommitment, newParticipantDeviceIds) {
-	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.reshare_derive_public_key_package(combinedCommitment, [...newParticipantDeviceIds]));
+	const out = wasm_dist_wire_mesh_threshold_wasm_js.reshare_derive_public_key_package(combinedCommitment, [...newParticipantDeviceIds]);
+	return {
+		publicKeyPackage: toBufferSource(out.publicKeyPackage),
+		groupVerifyingKey: toBufferSource(out.groupVerifyingKey)
+	};
 }
 /** New-participant side (local): verifies each received share against its own embedded commitment, sums the validated shares, and builds this participant's final key package. */
 function reshareCombineReceivedShares(ownDeviceId, received, publicKeyPackage, newMinSigners) {
 	return toBufferSource(wasm_dist_wire_mesh_threshold_wasm_js.reshare_combine_received_shares(ownDeviceId, [...received], publicKeyPackage, newMinSigners));
 }
 //#endregion
+exports.combineCommitments = combineCommitments;
+exports.combineRound1Package = combineRound1Package;
 exports.dkgConfirmMatches = dkgConfirmMatches;
 exports.dkgRound1 = dkgRound1;
 exports.dkgRound2 = dkgRound2;
 exports.dkgRound3 = dkgRound3;
 exports.dkgTranscriptDigest = dkgTranscriptDigest;
 exports.keyPackageSigningShare = keyPackageSigningShare;
+exports.reshareCombineCommitmentParts = reshareCombineCommitmentParts;
 exports.reshareCombineCommitments = reshareCombineCommitments;
 exports.reshareCombineReceivedShares = reshareCombineReceivedShares;
 exports.reshareDerivePublicKeyPackage = reshareDerivePublicKeyPackage;
 exports.reshareRound1 = reshareRound1;
+exports.reshareSplitCommitment = reshareSplitCommitment;
+exports.reshareTranscriptDigest = reshareTranscriptDigest;
 exports.signingAggregate = signingAggregate;
 exports.signingBuildPackage = signingBuildPackage;
 exports.signingRound1Commit = signingRound1Commit;
 exports.signingRound2Sign = signingRound2Sign;
+exports.splitCommitments = splitCommitments;
+exports.splitRound1Package = splitRound1Package;

package/dist/adapters/threshold-wasm.d.cts

@@ -11,6 +11,14 @@ export interface DkgRound1Result {
 }
 /** Round 1: samples this participant's own polynomial and commits to it. See `wire_mesh_threshold::dkg::round1`'s own doc comment for the full design. */
 export declare function dkgRound1(ownDeviceId: DeviceId, maxSigners: number, minSigners: number): DkgRound1Result;
+export interface SplitRound1PackageResult {
+  commitment: Uint8Array<ArrayBuffer>[];
+  proofOfKnowledge: Uint8Array<ArrayBuffer>;
+}
+/** Splits a serialized DKG round-1 package (dkgRound1's own `package` output) into `threshold-keygen-round1`'s own wire shape: the Feldman commitment as an array of independently-serialized coefficients (`commitment: [* bstr]`) and the Schnorr proof of knowledge as a separate byte string -- unlike frost-core's own combined-blob serialization. The inverse of combineRound1Package. */
+export declare function splitRound1Package(serializedPackage: Uint8Array): SplitRound1PackageResult;
+/** Reconstructs a serialized DKG round-1 package (the same combined-blob shape dkgRound2/dkgRound3/dkgTranscriptDigest expect) from the two independently-serialized wire fields `threshold-keygen-round1` carries. The inverse of splitRound1Package. */
+export declare function combineRound1Package(commitment: readonly Uint8Array[], proofOfKnowledge: Uint8Array): Uint8Array<ArrayBuffer>;
 export interface DkgRound2Result {
   secretPackage: Uint8Array<ArrayBuffer>;
   outgoing: DeviceKeyed[];
@@ -38,6 +46,14 @@ export interface SigningRound1Result {
  * The pure-crypto half of round 1: generates a fresh nonce pair and its commitments. Persisting `nonces` durably before this participant's own round-1 response leaves the device is the CALLER's own obligation -- nonce reuse across two released signature shares discloses this participant's long-term key share outright. This function has no storage dependency and cannot enforce that obligation itself.
  */
 export declare function signingRound1Commit(ownKeyPackage: Uint8Array): SigningRound1Result;
+export interface SplitCommitmentsResult {
+  hiding: Uint8Array<ArrayBuffer>;
+  binding: Uint8Array<ArrayBuffer>;
+}
+/** Splits a serialized SigningCommitments blob (signingRound1Commit's own `commitments` output) into the two independently-serialized halves `threshold-commitment`'s wire shape carries (`hiding: bstr, binding: bstr`) -- unlike frost-core's own combined-blob serialization, which is opaque and not spec-shaped. The inverse of combineCommitments. */
+export declare function splitCommitments(commitments: Uint8Array): SplitCommitmentsResult;
+/** Reconstructs a serialized SigningCommitments blob (the same combined-blob shape signingBuildPackage/signingRound2Sign expect) from the two independently-serialized halves `threshold-commitment` carries on the wire. The inverse of splitCommitments. */
+export declare function combineCommitments(hiding: Uint8Array, binding: Uint8Array): Uint8Array<ArrayBuffer>;
 /** Coordinator-side: builds the signing-package bytes every participant's round 2 is computed against. */
 export declare function signingBuildPackage(commitments: readonly DeviceKeyed[], message: Uint8Array): Uint8Array<ArrayBuffer>;
 /** Round 2: releases this participant's signature share. The CALLER MUST have already taken (one-shot) `nonces` from its own durable nonce store before calling this. */
@@ -54,10 +70,20 @@ export interface ReshareRound1Result {
  * Survivor side: re-shares this device's own Lagrange-weighted sub-share of the group secret across a new (possibly different) participant set. See `wire_mesh_threshold::reshare`'s own module doc comment (Rust side) for the full design rationale -- deliberately not built on a zero-secret "refresh" delta, which cannot onboard a device with no prior share or safely change the threshold.
  */
 export declare function reshareRound1(ownDeviceId: DeviceId, ownOldSigningShare: Uint8Array, survivorDeviceIds: readonly DeviceId[], newParticipantDeviceIds: readonly DeviceId[], newMinSigners: number): ReshareRound1Result;
+/** Splits a survivor's serialized broadcast commitment (reshareRound1's own `commitment` output) into `threshold-keygen-round1`'s own wire shape: an array of independently-serialized coefficients (`commitment: [* bstr]`) -- unlike reshareRound1's own whole-blob serialization. The inverse of reshareCombineCommitmentParts. */
+export declare function reshareSplitCommitment(commitment: Uint8Array): Uint8Array<ArrayBuffer>[];
+/** Reconstructs a survivor's serialized broadcast commitment (the same whole-blob shape reshareCombineCommitments expects each entry of its own commitments array to be) from the wire's own per-coefficient array. The inverse of reshareSplitCommitment. */
+export declare function reshareCombineCommitmentParts(parts: readonly Uint8Array[]): Uint8Array<ArrayBuffer>;
 /** Sums T survivors' broadcast commitment vectors into the one combined VSS commitment `reshareDerivePublicKeyPackage` needs. */
 export declare function reshareCombineCommitments(commitments: readonly Uint8Array[]): Uint8Array<ArrayBuffer>;
-/** The group's derived public key given the combined commitment and the new participant set -- reused directly by `threshold-keygen-confirm`'s own group-key check (MUST equal the group's `existing-group-key` for a reshare). */
-export declare function reshareDerivePublicKeyPackage(combinedCommitment: Uint8Array, newParticipantDeviceIds: readonly DeviceId[]): Uint8Array<ArrayBuffer>;
+/** The echo-broadcast transcript digest a member of the new participant set sends on threshold-keygen-confirm for a reshare -- the reshare analogue of dkgTranscriptDigest, structurally distinct because a reshare's own survivor commitment carries no proof-of-knowledge component: deserializing one as a DKG round-1 package fails outright, since the two are different wire shapes entirely. `survivorCommitments` entries are each the same whole-blob shape reshareRound1's own `commitment` output is (NOT the wire's own split [* bstr] parts -- combine those first via reshareCombineCommitmentParts if collected off the wire). */
+export declare function reshareTranscriptDigest(survivorCommitments: readonly DeviceKeyed[], groupVerifyingKey: Uint8Array): Uint8Array<ArrayBuffer>;
+export interface ReshareDerivePublicKeyPackageResult {
+  publicKeyPackage: Uint8Array<ArrayBuffer>;
+  groupVerifyingKey: Uint8Array<ArrayBuffer>;
+}
+/** The group's derived public key package given the combined commitment and the new participant set. `groupVerifyingKey` is what `threshold-keygen-confirm`'s own `group-key` field carries and what a reshare's own verifier obligation checks against `existing-group-key` (MUST equal it -- a reshare that changes the group key is a takeover, not a reshare). */
+export declare function reshareDerivePublicKeyPackage(combinedCommitment: Uint8Array, newParticipantDeviceIds: readonly DeviceId[]): ReshareDerivePublicKeyPackageResult;
 /** New-participant side (local): verifies each received share against its own embedded commitment, sums the validated shares, and builds this participant's final key package. */
 export declare function reshareCombineReceivedShares(ownDeviceId: DeviceId, received: readonly Uint8Array[], publicKeyPackage: Uint8Array, newMinSigners: number): Uint8Array<ArrayBuffer>;
 //#endregion

package/dist/adapters/threshold-wasm.d.mts

@@ -11,6 +11,14 @@ export interface DkgRound1Result {
 }
 /** Round 1: samples this participant's own polynomial and commits to it. See `wire_mesh_threshold::dkg::round1`'s own doc comment for the full design. */
 export declare function dkgRound1(ownDeviceId: DeviceId, maxSigners: number, minSigners: number): DkgRound1Result;
+export interface SplitRound1PackageResult {
+  commitment: Uint8Array<ArrayBuffer>[];
+  proofOfKnowledge: Uint8Array<ArrayBuffer>;
+}
+/** Splits a serialized DKG round-1 package (dkgRound1's own `package` output) into `threshold-keygen-round1`'s own wire shape: the Feldman commitment as an array of independently-serialized coefficients (`commitment: [* bstr]`) and the Schnorr proof of knowledge as a separate byte string -- unlike frost-core's own combined-blob serialization. The inverse of combineRound1Package. */
+export declare function splitRound1Package(serializedPackage: Uint8Array): SplitRound1PackageResult;
+/** Reconstructs a serialized DKG round-1 package (the same combined-blob shape dkgRound2/dkgRound3/dkgTranscriptDigest expect) from the two independently-serialized wire fields `threshold-keygen-round1` carries. The inverse of splitRound1Package. */
+export declare function combineRound1Package(commitment: readonly Uint8Array[], proofOfKnowledge: Uint8Array): Uint8Array<ArrayBuffer>;
 export interface DkgRound2Result {
   secretPackage: Uint8Array<ArrayBuffer>;
   outgoing: DeviceKeyed[];
@@ -38,6 +46,14 @@ export interface SigningRound1Result {
  * The pure-crypto half of round 1: generates a fresh nonce pair and its commitments. Persisting `nonces` durably before this participant's own round-1 response leaves the device is the CALLER's own obligation -- nonce reuse across two released signature shares discloses this participant's long-term key share outright. This function has no storage dependency and cannot enforce that obligation itself.
  */
 export declare function signingRound1Commit(ownKeyPackage: Uint8Array): SigningRound1Result;
+export interface SplitCommitmentsResult {
+  hiding: Uint8Array<ArrayBuffer>;
+  binding: Uint8Array<ArrayBuffer>;
+}
+/** Splits a serialized SigningCommitments blob (signingRound1Commit's own `commitments` output) into the two independently-serialized halves `threshold-commitment`'s wire shape carries (`hiding: bstr, binding: bstr`) -- unlike frost-core's own combined-blob serialization, which is opaque and not spec-shaped. The inverse of combineCommitments. */
+export declare function splitCommitments(commitments: Uint8Array): SplitCommitmentsResult;
+/** Reconstructs a serialized SigningCommitments blob (the same combined-blob shape signingBuildPackage/signingRound2Sign expect) from the two independently-serialized halves `threshold-commitment` carries on the wire. The inverse of splitCommitments. */
+export declare function combineCommitments(hiding: Uint8Array, binding: Uint8Array): Uint8Array<ArrayBuffer>;
 /** Coordinator-side: builds the signing-package bytes every participant's round 2 is computed against. */
 export declare function signingBuildPackage(commitments: readonly DeviceKeyed[], message: Uint8Array): Uint8Array<ArrayBuffer>;
 /** Round 2: releases this participant's signature share. The CALLER MUST have already taken (one-shot) `nonces` from its own durable nonce store before calling this. */
@@ -54,10 +70,20 @@ export interface ReshareRound1Result {
  * Survivor side: re-shares this device's own Lagrange-weighted sub-share of the group secret across a new (possibly different) participant set. See `wire_mesh_threshold::reshare`'s own module doc comment (Rust side) for the full design rationale -- deliberately not built on a zero-secret "refresh" delta, which cannot onboard a device with no prior share or safely change the threshold.
  */
 export declare function reshareRound1(ownDeviceId: DeviceId, ownOldSigningShare: Uint8Array, survivorDeviceIds: readonly DeviceId[], newParticipantDeviceIds: readonly DeviceId[], newMinSigners: number): ReshareRound1Result;
+/** Splits a survivor's serialized broadcast commitment (reshareRound1's own `commitment` output) into `threshold-keygen-round1`'s own wire shape: an array of independently-serialized coefficients (`commitment: [* bstr]`) -- unlike reshareRound1's own whole-blob serialization. The inverse of reshareCombineCommitmentParts. */
+export declare function reshareSplitCommitment(commitment: Uint8Array): Uint8Array<ArrayBuffer>[];
+/** Reconstructs a survivor's serialized broadcast commitment (the same whole-blob shape reshareCombineCommitments expects each entry of its own commitments array to be) from the wire's own per-coefficient array. The inverse of reshareSplitCommitment. */
+export declare function reshareCombineCommitmentParts(parts: readonly Uint8Array[]): Uint8Array<ArrayBuffer>;
 /** Sums T survivors' broadcast commitment vectors into the one combined VSS commitment `reshareDerivePublicKeyPackage` needs. */
 export declare function reshareCombineCommitments(commitments: readonly Uint8Array[]): Uint8Array<ArrayBuffer>;
-/** The group's derived public key given the combined commitment and the new participant set -- reused directly by `threshold-keygen-confirm`'s own group-key check (MUST equal the group's `existing-group-key` for a reshare). */
-export declare function reshareDerivePublicKeyPackage(combinedCommitment: Uint8Array, newParticipantDeviceIds: readonly DeviceId[]): Uint8Array<ArrayBuffer>;
+/** The echo-broadcast transcript digest a member of the new participant set sends on threshold-keygen-confirm for a reshare -- the reshare analogue of dkgTranscriptDigest, structurally distinct because a reshare's own survivor commitment carries no proof-of-knowledge component: deserializing one as a DKG round-1 package fails outright, since the two are different wire shapes entirely. `survivorCommitments` entries are each the same whole-blob shape reshareRound1's own `commitment` output is (NOT the wire's own split [* bstr] parts -- combine those first via reshareCombineCommitmentParts if collected off the wire). */
+export declare function reshareTranscriptDigest(survivorCommitments: readonly DeviceKeyed[], groupVerifyingKey: Uint8Array): Uint8Array<ArrayBuffer>;
+export interface ReshareDerivePublicKeyPackageResult {
+  publicKeyPackage: Uint8Array<ArrayBuffer>;
+  groupVerifyingKey: Uint8Array<ArrayBuffer>;
+}
+/** The group's derived public key package given the combined commitment and the new participant set. `groupVerifyingKey` is what `threshold-keygen-confirm`'s own `group-key` field carries and what a reshare's own verifier obligation checks against `existing-group-key` (MUST equal it -- a reshare that changes the group key is a takeover, not a reshare). */
+export declare function reshareDerivePublicKeyPackage(combinedCommitment: Uint8Array, newParticipantDeviceIds: readonly DeviceId[]): ReshareDerivePublicKeyPackageResult;
 /** New-participant side (local): verifies each received share against its own embedded commitment, sums the validated shares, and builds this participant's final key package. */
 export declare function reshareCombineReceivedShares(ownDeviceId: DeviceId, received: readonly Uint8Array[], publicKeyPackage: Uint8Array, newMinSigners: number): Uint8Array<ArrayBuffer>;
 //#endregion

package/dist/adapters/threshold-wasm.mjs

@@ -38,6 +38,23 @@ function dkgRound1(ownDeviceId, maxSigners, minSigners) {
 		package: toBufferSource(out.package)
 	};
 }
+/** Splits a serialized DKG round-1 package (dkgRound1's own `package` output) into `threshold-keygen-round1`'s own wire shape: the Feldman commitment as an array of independently-serialized coefficients (`commitment: [* bstr]`) and the Schnorr proof of knowledge as a separate byte string -- unlike frost-core's own combined-blob serialization. The inverse of combineRound1Package. */
+function splitRound1Package(serializedPackage) {
+	const out = wasm.split_round1_package(serializedPackage);
+	const commitment = [];
+	for (const coefficient of out.commitment) {
+		if (!isUint8Array(coefficient)) throw new Error("wasm returned a non-Uint8Array entry in split_round1_package's own commitment array");
+		commitment.push(toBufferSource(coefficient));
+	}
+	return {
+		commitment,
+		proofOfKnowledge: toBufferSource(out.proofOfKnowledge)
+	};
+}
+/** Reconstructs a serialized DKG round-1 package (the same combined-blob shape dkgRound2/dkgRound3/dkgTranscriptDigest expect) from the two independently-serialized wire fields `threshold-keygen-round1` carries. The inverse of splitRound1Package. */
+function combineRound1Package(commitment, proofOfKnowledge) {
+	return toBufferSource(wasm.combine_round1_package([...commitment], proofOfKnowledge));
+}
 /** Round 2: verifies every other participant's round-1 proof of knowledge and computes this participant's own pairwise sub-shares. `round1` MUST NOT include this participant's own package. */
 function dkgRound2(ownSecretPackage, round1) {
 	const [ids, packages] = toParallelArrays(round1);
@@ -81,6 +98,18 @@ function signingRound1Commit(ownKeyPackage) {
 		commitments: toBufferSource(out.commitments)
 	};
 }
+/** Splits a serialized SigningCommitments blob (signingRound1Commit's own `commitments` output) into the two independently-serialized halves `threshold-commitment`'s wire shape carries (`hiding: bstr, binding: bstr`) -- unlike frost-core's own combined-blob serialization, which is opaque and not spec-shaped. The inverse of combineCommitments. */
+function splitCommitments(commitments) {
+	const out = wasm.split_commitments(commitments);
+	return {
+		hiding: toBufferSource(out.hiding),
+		binding: toBufferSource(out.binding)
+	};
+}
+/** Reconstructs a serialized SigningCommitments blob (the same combined-blob shape signingBuildPackage/signingRound2Sign expect) from the two independently-serialized halves `threshold-commitment` carries on the wire. The inverse of splitCommitments. */
+function combineCommitments(hiding, binding) {
+	return toBufferSource(wasm.combine_commitments(hiding, binding));
+}
 /** Coordinator-side: builds the signing-package bytes every participant's round 2 is computed against. */
 function signingBuildPackage(commitments, message) {
 	const [ids, values] = toParallelArrays(commitments);
@@ -107,17 +136,39 @@ function reshareRound1(ownDeviceId, ownOldSigningShare, survivorDeviceIds, newPa
 		outgoing: fromParallelArrays(out.recipientIds, out.shares)
 	};
 }
+/** Splits a survivor's serialized broadcast commitment (reshareRound1's own `commitment` output) into `threshold-keygen-round1`'s own wire shape: an array of independently-serialized coefficients (`commitment: [* bstr]`) -- unlike reshareRound1's own whole-blob serialization. The inverse of reshareCombineCommitmentParts. */
+function reshareSplitCommitment(commitment) {
+	const out = [];
+	for (const part of wasm.reshare_split_commitment(commitment)) {
+		if (!isUint8Array(part)) throw new Error("wasm returned a non-Uint8Array entry in reshare_split_commitment's own output array");
+		out.push(toBufferSource(part));
+	}
+	return out;
+}
+/** Reconstructs a survivor's serialized broadcast commitment (the same whole-blob shape reshareCombineCommitments expects each entry of its own commitments array to be) from the wire's own per-coefficient array. The inverse of reshareSplitCommitment. */
+function reshareCombineCommitmentParts(parts) {
+	return toBufferSource(wasm.reshare_combine_commitment_parts([...parts]));
+}
 /** Sums T survivors' broadcast commitment vectors into the one combined VSS commitment `reshareDerivePublicKeyPackage` needs. */
 function reshareCombineCommitments(commitments) {
 	return toBufferSource(wasm.reshare_combine_commitments([...commitments]));
 }
-/** The group's derived public key given the combined commitment and the new participant set -- reused directly by `threshold-keygen-confirm`'s own group-key check (MUST equal the group's `existing-group-key` for a reshare). */
+/** The echo-broadcast transcript digest a member of the new participant set sends on threshold-keygen-confirm for a reshare -- the reshare analogue of dkgTranscriptDigest, structurally distinct because a reshare's own survivor commitment carries no proof-of-knowledge component: deserializing one as a DKG round-1 package fails outright, since the two are different wire shapes entirely. `survivorCommitments` entries are each the same whole-blob shape reshareRound1's own `commitment` output is (NOT the wire's own split [* bstr] parts -- combine those first via reshareCombineCommitmentParts if collected off the wire). */
+function reshareTranscriptDigest(survivorCommitments, groupVerifyingKey) {
+	const [ids, commitments] = toParallelArrays(survivorCommitments);
+	return toBufferSource(wasm.reshare_transcript_digest(ids, commitments, groupVerifyingKey));
+}
+/** The group's derived public key package given the combined commitment and the new participant set. `groupVerifyingKey` is what `threshold-keygen-confirm`'s own `group-key` field carries and what a reshare's own verifier obligation checks against `existing-group-key` (MUST equal it -- a reshare that changes the group key is a takeover, not a reshare). */
 function reshareDerivePublicKeyPackage(combinedCommitment, newParticipantDeviceIds) {
-	return toBufferSource(wasm.reshare_derive_public_key_package(combinedCommitment, [...newParticipantDeviceIds]));
+	const out = wasm.reshare_derive_public_key_package(combinedCommitment, [...newParticipantDeviceIds]);
+	return {
+		publicKeyPackage: toBufferSource(out.publicKeyPackage),
+		groupVerifyingKey: toBufferSource(out.groupVerifyingKey)
+	};
 }
 /** New-participant side (local): verifies each received share against its own embedded commitment, sums the validated shares, and builds this participant's final key package. */
 function reshareCombineReceivedShares(ownDeviceId, received, publicKeyPackage, newMinSigners) {
 	return toBufferSource(wasm.reshare_combine_received_shares(ownDeviceId, [...received], publicKeyPackage, newMinSigners));
 }
 //#endregion
-export { dkgConfirmMatches, dkgRound1, dkgRound2, dkgRound3, dkgTranscriptDigest, keyPackageSigningShare, reshareCombineCommitments, reshareCombineReceivedShares, reshareDerivePublicKeyPackage, reshareRound1, signingAggregate, signingBuildPackage, signingRound1Commit, signingRound2Sign };
+export { combineCommitments, combineRound1Package, dkgConfirmMatches, dkgRound1, dkgRound2, dkgRound3, dkgTranscriptDigest, keyPackageSigningShare, reshareCombineCommitmentParts, reshareCombineCommitments, reshareCombineReceivedShares, reshareDerivePublicKeyPackage, reshareRound1, reshareSplitCommitment, reshareTranscriptDigest, signingAggregate, signingBuildPackage, signingRound1Commit, signingRound2Sign, splitCommitments, splitRound1Package };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "1.47.0",
+  "version": "1.48.0",
   "dependencies": {
     "cbor2": "2.3.0",
     "cddl.js": "1.0.1",