@seams/wallet-server 0.5.0

package/dist/types/shared-ts/src/device-linking/contracts.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=contracts.typecheck.d.ts.map

package/dist/types/shared-ts/src/device-linking/delegatedActivationPlan.d.ts

@@ -0,0 +1,37 @@
+import { type Ed25519PublicKeyB64u, type Secp256k1CompressedPublicKeyB64u } from '../passkey-custody/primitives';
+import { type WalletKeyId } from '../signing-lanes/ids';
+import { type WalletId } from '../utils/domainIds';
+export type ExactAdministeredSignerManifestV1 = {
+    readonly kind: 'exact_administered_signer_manifest_v1';
+    readonly keyFamilies: readonly ['ed25519'];
+    readonly signers: readonly [ExactAdministeredEd25519SignerV1];
+    readonly ecdsa?: never;
+} | {
+    readonly kind: 'exact_administered_signer_manifest_v1';
+    readonly keyFamilies: readonly ['ecdsa_secp256k1'];
+    readonly signers: readonly [ExactAdministeredEcdsaSignerV1];
+    readonly ed25519?: never;
+} | {
+    readonly kind: 'exact_administered_signer_manifest_v1';
+    readonly keyFamilies: readonly ['ed25519', 'ecdsa_secp256k1'];
+    readonly signers: readonly [ExactAdministeredEd25519SignerV1, ExactAdministeredEcdsaSignerV1];
+};
+export type ExactAdministeredEd25519SignerV1 = {
+    readonly kind: 'exact_administered_ed25519_signer_v1';
+    readonly keyFamily: 'ed25519';
+    readonly walletId: WalletId;
+    readonly walletKeyId: WalletKeyId;
+    readonly registeredPublicKeyB64u: Ed25519PublicKeyB64u;
+};
+export type ExactAdministeredEcdsaSignerV1 = {
+    readonly kind: 'exact_administered_ecdsa_signer_v1';
+    readonly keyFamily: 'ecdsa_secp256k1';
+    readonly walletId: WalletId;
+    readonly walletKeyId: WalletKeyId;
+    readonly thresholdPublicKey33B64u: Secp256k1CompressedPublicKeyB64u;
+    readonly evmAddress: string;
+};
+export type ExactAdministeredSignerV1 = ExactAdministeredEd25519SignerV1 | ExactAdministeredEcdsaSignerV1;
+export declare function buildExactAdministeredSignerManifestV1(signers: readonly ExactAdministeredSignerV1[]): ExactAdministeredSignerManifestV1;
+export declare function parseExactAdministeredSignerManifestV1(raw: unknown): ExactAdministeredSignerManifestV1;
+//# sourceMappingURL=delegatedActivationPlan.d.ts.map

package/dist/types/shared-ts/src/device-linking/digests.d.ts

@@ -0,0 +1,23 @@
+import { type DigestB64u } from '../utils/canonicalPrimitives';
+import type { LinkedDeviceApprovalV1, LinkedDeviceSessionClaimV1, LinkedDeviceTargetCredentialRegistrationV1, LinkedDeviceTargetPreparationV1, LinkedDevicePasskeyTargetConfigurationFieldsV1, LocalAuthorityInstallationReceiptV1, WalletSessionOperationCredentialV1 } from './contracts';
+export { computeCommittedSignerPackageDigestB64u, computeCommittedSignerPackageSetDigestB64u, } from './committedSignerPackages';
+/**
+ * The server stores this digest alongside the authorization. Hashing the
+ * opaque token directly keeps the browser binding identical to that row.
+ */
+export declare function computeWalletSessionOperationCredentialDigestB64u(credential: WalletSessionOperationCredentialV1): Promise<DigestB64u>;
+export declare function encodeWalletSessionInstallationReceiptV1(receipt: LocalAuthorityInstallationReceiptV1): string;
+export declare function computeWalletSessionInstallationReceiptDigestB64u(receipt: LocalAuthorityInstallationReceiptV1): Promise<DigestB64u>;
+export declare function encodeLinkedDevicePasskeyTargetConfigurationV1(value: LinkedDevicePasskeyTargetConfigurationFieldsV1): Uint8Array;
+export declare function computeLinkedDevicePasskeyTargetConfigurationDigestV1(value: LinkedDevicePasskeyTargetConfigurationFieldsV1): Promise<DigestB64u>;
+export declare function encodeLinkedDeviceSessionClaimV1(value: LinkedDeviceSessionClaimV1): Uint8Array;
+export declare function computeLinkedDeviceSessionClaimDigestV1(value: LinkedDeviceSessionClaimV1): Promise<DigestB64u>;
+export declare function encodeLinkedDeviceApprovalV1(value: LinkedDeviceApprovalV1): Uint8Array;
+export declare function computeLinkedDeviceApprovalDigestV1(value: LinkedDeviceApprovalV1): Promise<DigestB64u>;
+export declare function encodeLinkedDeviceTargetPreparationV1(value: LinkedDeviceTargetPreparationV1): Uint8Array;
+export declare function computeLinkedDeviceTargetPreparationDigestV1(value: LinkedDeviceTargetPreparationV1): Promise<DigestB64u>;
+export declare function assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1(input: {
+    readonly preparation: LinkedDeviceTargetPreparationV1;
+    readonly registration: LinkedDeviceTargetCredentialRegistrationV1;
+}): Promise<void>;
+//# sourceMappingURL=digests.d.ts.map

package/dist/types/shared-ts/src/device-linking/ed25519ExportRoot.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Authenticated relay records for the cross-device Ed25519 Yao Client export
+ * root. The relay sees only public routing facts and an encrypted root.
+ * Wallet-custody seed bindings deliberately have no representation here.
+ */
+import { type Ed25519PublicKeyB64u, type EnvelopeCiphertextB64u, type EnvelopeNonceB64u } from '../passkey-custody/primitives';
+import type { DigestB64u } from '../utils/canonicalPrimitives';
+import { type LinkedDeviceEnrollmentId, type LinkedDeviceId, type LinkDeviceSessionId, type WalletKeyId } from '../signing-lanes/ids';
+import { type WalletId } from '../utils/domainIds';
+import type { LinkedDeviceTargetFactorV1 } from './contracts';
+/** Frozen by signer-core's Ed25519 Yao Client-root transfer module. */
+export declare const LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1: "x25519-hkdf-sha256-chacha20poly1305-v1";
+/** One-use X25519 public key generated and retained by Device 2's worker. */
+export type LinkedDeviceEd25519ExportRootRecipientPublicKeyB64u = string & {
+    readonly __linkedDeviceEd25519ExportRootRecipientPublicKeyB64uBrand: 'LinkedDeviceEd25519ExportRootRecipientPublicKeyB64u';
+};
+/** Exact public facts authenticated by signer-core as transfer AAD. */
+export type LinkedDeviceEd25519ExportRootTransferBindingV1 = {
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly walletId: WalletId;
+    readonly walletKeyId: WalletKeyId;
+    readonly targetFactor: LinkedDeviceTargetFactorV1;
+    readonly enrollmentId: LinkedDeviceEnrollmentId;
+    readonly deviceId: LinkedDeviceId;
+    readonly revocationEpoch: number;
+    readonly applicationBindingDigestB64u: DigestB64u;
+    readonly registeredPublicKeyB64u: Ed25519PublicKeyB64u;
+    readonly recipientPublicKeyB64u: LinkedDeviceEd25519ExportRootRecipientPublicKeyB64u;
+};
+/** Device 2's authenticated recipient registration. */
+export type LinkedDeviceEd25519ExportRootRecipientV1 = {
+    readonly kind: 'linked_device_ed25519_export_root_recipient_v1';
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly walletId: WalletId;
+    readonly walletKeyId: WalletKeyId;
+    readonly enrollmentId: LinkedDeviceEnrollmentId;
+    readonly deviceId: LinkedDeviceId;
+    readonly transferAlg: typeof LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1;
+    readonly applicationBindingDigestB64u: DigestB64u;
+    readonly registeredPublicKeyB64u: Ed25519PublicKeyB64u;
+    readonly targetFactor: LinkedDeviceTargetFactorV1;
+    readonly revocationEpoch: number;
+    readonly recipientPublicKeyB64u: LinkedDeviceEd25519ExportRootRecipientPublicKeyB64u;
+    readonly registeredAtMs: number;
+};
+/** Device 1's encrypted export-root package. */
+export type LinkedDeviceEd25519ExportRootPackageV1 = {
+    readonly kind: 'linked_device_ed25519_export_root_package_v1';
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly walletId: WalletId;
+    readonly walletKeyId: WalletKeyId;
+    readonly enrollmentId: LinkedDeviceEnrollmentId;
+    readonly deviceId: LinkedDeviceId;
+    readonly transferAlg: typeof LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1;
+    readonly applicationBindingDigestB64u: DigestB64u;
+    readonly registeredPublicKeyB64u: Ed25519PublicKeyB64u;
+    readonly targetFactor: LinkedDeviceTargetFactorV1;
+    readonly revocationEpoch: number;
+    readonly recipientPublicKeyB64u: LinkedDeviceEd25519ExportRootRecipientPublicKeyB64u;
+    readonly ephemeralPublicKeyB64u: LinkedDeviceEd25519ExportRootRecipientPublicKeyB64u;
+    readonly nonceB64u: EnvelopeNonceB64u;
+    readonly sealedExportRootB64u: EnvelopeCiphertextB64u;
+    readonly bindingDigestB64u: DigestB64u;
+    readonly ciphertextDigestB64u: DigestB64u;
+    readonly sealedAtMs: number;
+};
+/** Device 1's authenticated submission of one package. */
+export type LinkedDeviceEd25519ExportRootSubmissionV1 = {
+    readonly kind: 'linked_device_ed25519_export_root_submission_v1';
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly package: LinkedDeviceEd25519ExportRootPackageV1;
+};
+export declare function parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u(value: unknown, label?: string): LinkedDeviceEd25519ExportRootRecipientPublicKeyB64u;
+export declare function buildLinkedDeviceEd25519ExportRootTransferBindingV1(input: {
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly walletId: WalletId;
+    readonly walletKeyId: WalletKeyId;
+    readonly targetFactor: LinkedDeviceTargetFactorV1;
+    readonly enrollmentId: LinkedDeviceEnrollmentId;
+    readonly deviceId: LinkedDeviceId;
+    readonly revocationEpoch: number;
+    readonly applicationBindingDigestB64u: DigestB64u;
+    readonly registeredPublicKeyB64u: Ed25519PublicKeyB64u;
+    readonly recipientPublicKeyB64u: LinkedDeviceEd25519ExportRootRecipientPublicKeyB64u;
+}): LinkedDeviceEd25519ExportRootTransferBindingV1;
+/** Serializes exactly the six fields accepted by signer-core's AAD binding. */
+export declare function serializeLinkedDeviceEd25519ExportRootTransferBindingV1(binding: LinkedDeviceEd25519ExportRootTransferBindingV1): string;
+export declare function parseLinkedDeviceEd25519ExportRootRecipientV1(raw: unknown): LinkedDeviceEd25519ExportRootRecipientV1;
+export declare function parseLinkedDeviceEd25519ExportRootPackageV1(raw: unknown): LinkedDeviceEd25519ExportRootPackageV1;
+export declare function parseLinkedDeviceEd25519ExportRootSubmissionV1(raw: unknown): LinkedDeviceEd25519ExportRootSubmissionV1;
+/** Ensures relay persistence cannot join two different root bindings. */
+export declare function linkedDeviceEd25519ExportRootMatchesRecipientV1(transferPackage: LinkedDeviceEd25519ExportRootPackageV1, recipient: LinkedDeviceEd25519ExportRootRecipientV1): boolean;
+//# sourceMappingURL=ed25519ExportRoot.d.ts.map

package/dist/types/shared-ts/src/device-linking/index.d.ts

@@ -0,0 +1,11 @@
+export * from './contracts';
+export * from './activeWalletSession';
+export * from './ed25519ExportRoot';
+export * from './delegatedActivationPlan';
+export * from './parsers';
+export * from './digests';
+export * from './requestProof';
+export * from './committedSignerPackages';
+export * from './sourceContribution';
+export * from './walletSessionCredentialDelivery';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/shared-ts/src/device-linking/parsers.d.ts

@@ -0,0 +1,124 @@
+import { type DelegatedWalletAuthorityV1 } from '../authorization/delegatedAuthority';
+import { type WalletSessionAuthorizationId, type WalletSessionId } from '../authorization/capabilityKinds';
+import { type LinkedDeviceEnrollmentId, type LinkedDeviceId, type LinkDeviceSessionId } from '../signing-lanes/ids';
+import { type WalletAuthMethodId, type WalletId, type VerifiedEmailAddress } from '../utils/domainIds';
+import { type LinkedDeviceApprovalV1, type LinkedDeviceApprovalDeliveryV1, type LinkedDeviceApprovalResultV1, type LinkedDeviceListRequestV1, type LinkedDeviceListResultV1, type OwnerDeviceSummaryV1, type LinkedDeviceRevokeRequestV1, type LinkedDeviceRevokeResultV1, type LinkedDeviceSummaryV1, type LinkedDeviceOwnerAuthorizationSourceV1, type LinkedDeviceOwnerAuthorizationRequestV1, type LinkedDeviceSessionClaimRequestV1, type LinkedDeviceSessionClaimV1, type LinkSessionProjectionV1, type LinkSessionStateV1, type LinkSessionTransportEventV1, type LinkedDeviceSessionTransportRequestV1, type LinkedDeviceTargetCredentialRegistrationV1, type LinkedDeviceTargetCredentialRegistrationResultV1, type LinkedDeviceTargetPreparationRequestV1, type LinkedDeviceEmailOtpVerificationGrantV1, type LinkedDeviceEmailOtpFactorReleaseEnvelopeV1, type LinkedDeviceEmailOtpChallengeStartRequestV1, type LinkedDeviceEmailOtpChallengeResendRequestV1, type LinkedDeviceEmailOtpChallengeVerifyRequestV1, type LinkedDeviceEmailOtpChallengeResultV1, type LinkedDeviceEmailOtpVerificationResultV1, type LinkedDeviceTargetPreparationV1, type LinkDevicePublicKeyB64u, type QrLinkedDeviceSessionPayloadV5, type LinkedDeviceEmailOtpBaseFactorRequestV1, type LinkedDeviceEmailOtpBaseFactorResolutionV1, type LinkedDeviceEmailOtpBaseFactorResolutionResultV1, type ActiveWalletSessionV1, type ActivateInstalledAuthorityResultV1, type LocalAuthorityActivationFinalAckV1, type LocalAuthorityInstallationReceiptV1, type WalletSessionOperationCredentialV1 } from './contracts';
+export { parseCommittedSignerPackageSetDigestB64u, parseCommittedSignerPackageSetV1, } from './committedSignerPackages';
+export declare function parseLinkDevicePublicKeyB64u(raw: unknown): LinkDevicePublicKeyB64u;
+export declare function parseLinkedDeviceSummaryV1(raw: unknown): LinkedDeviceSummaryV1;
+export declare function parseLinkedDeviceListRequestV1(raw: unknown): LinkedDeviceListRequestV1;
+export declare function buildLinkedDeviceListRequestV1(args: {
+    readonly walletId: WalletId;
+    readonly limit: number;
+    readonly cursor: string | null;
+}): LinkedDeviceListRequestV1;
+export declare function parseOwnerDeviceSummaryV1(raw: unknown): OwnerDeviceSummaryV1;
+export declare function parseLinkedDeviceListResultV1(raw: unknown): LinkedDeviceListResultV1;
+export declare function buildLinkedDeviceListResultV1(args: {
+    readonly devices: readonly LinkedDeviceSummaryV1[];
+    readonly ownerDevices: readonly OwnerDeviceSummaryV1[];
+    readonly nextCursor: string | null;
+}): LinkedDeviceListResultV1;
+export declare function parseLinkedDeviceRevokeRequestV1(raw: unknown): LinkedDeviceRevokeRequestV1;
+export declare function buildLinkedDeviceRevokeRequestV1(args: {
+    readonly walletId: WalletId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly requestedAtMs: number;
+}): LinkedDeviceRevokeRequestV1;
+export declare function parseLinkedDeviceRevokeResultV1(raw: unknown): LinkedDeviceRevokeResultV1;
+export declare function buildLinkedDeviceRevokeResultV1(value: LinkedDeviceRevokeResultV1): LinkedDeviceRevokeResultV1;
+export declare function parseQrLinkedDeviceSessionPayloadV5(raw: unknown): QrLinkedDeviceSessionPayloadV5;
+export declare function serializeQrLinkedDeviceSessionPayloadV5(payload: QrLinkedDeviceSessionPayloadV5): string;
+export declare function parseQrLinkedDeviceSessionTextV5(raw: string): QrLinkedDeviceSessionPayloadV5;
+export declare function parseLinkedDeviceOwnerAuthorizationRequestV1(raw: unknown): LinkedDeviceOwnerAuthorizationRequestV1;
+export declare function parseLinkSessionStateV1(raw: unknown): LinkSessionStateV1;
+export declare function parseLinkSessionProjectionV1(raw: unknown): LinkSessionProjectionV1;
+export declare function parseLinkSessionTransportEventV1(raw: unknown): LinkSessionTransportEventV1;
+export declare function parseLinkedDeviceApprovalResultV1(raw: unknown): LinkedDeviceApprovalResultV1;
+export declare function parseLinkedDeviceSessionClaimRequestV1(raw: unknown): LinkedDeviceSessionClaimRequestV1;
+export declare function parseLinkedDeviceSessionClaimV1(raw: unknown): LinkedDeviceSessionClaimV1;
+export declare function parseLinkedDeviceOwnerAuthorizationSourceV1(raw: unknown, label?: string): LinkedDeviceOwnerAuthorizationSourceV1;
+export declare function parseLinkedDeviceApprovalV1(raw: unknown): LinkedDeviceApprovalV1;
+export declare function parseLinkedDeviceApprovalDeliveryV1(raw: unknown): LinkedDeviceApprovalDeliveryV1;
+export declare function parseLinkedDeviceTargetPreparationV1(raw: unknown): LinkedDeviceTargetPreparationV1;
+export declare function parseLinkedDeviceTargetPreparationRequestV1(raw: unknown): LinkedDeviceTargetPreparationRequestV1;
+export declare function parseLinkedDeviceEmailOtpBaseFactorRequestV1(raw: unknown): LinkedDeviceEmailOtpBaseFactorRequestV1;
+export declare function parseLinkedDeviceEmailOtpBaseFactorResolutionV1(raw: unknown): LinkedDeviceEmailOtpBaseFactorResolutionV1;
+export declare function parseLinkedDeviceEmailOtpBaseFactorResolutionResultV1(raw: unknown): LinkedDeviceEmailOtpBaseFactorResolutionResultV1;
+export declare function parseLinkedDeviceTargetCredentialRegistrationV1(raw: unknown): LinkedDeviceTargetCredentialRegistrationV1;
+export declare function parseLinkedDeviceTargetCredentialRegistrationResultV1(raw: unknown): LinkedDeviceTargetCredentialRegistrationResultV1;
+export declare function parseLinkedDeviceEmailOtpVerificationGrantV1(raw: unknown): LinkedDeviceEmailOtpVerificationGrantV1;
+export declare function parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1(raw: unknown): LinkedDeviceEmailOtpFactorReleaseEnvelopeV1;
+export declare function parseLinkedDeviceEmailOtpChallengeStartRequestV1(raw: unknown): LinkedDeviceEmailOtpChallengeStartRequestV1;
+export declare function parseLinkedDeviceEmailOtpChallengeResendRequestV1(raw: unknown): LinkedDeviceEmailOtpChallengeResendRequestV1;
+export declare function parseLinkedDeviceEmailOtpChallengeVerifyRequestV1(raw: unknown): LinkedDeviceEmailOtpChallengeVerifyRequestV1;
+export declare function parseLinkedDeviceEmailOtpChallengeResultV1(raw: unknown): LinkedDeviceEmailOtpChallengeResultV1;
+export declare function parseLinkedDeviceEmailOtpVerificationResultV1(raw: unknown): LinkedDeviceEmailOtpVerificationResultV1;
+export declare function parseLinkedDeviceSessionTransportRequestV1(raw: unknown): LinkedDeviceSessionTransportRequestV1;
+type BuildQrLinkedDeviceSessionPayloadV5Args = {
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly linkPublicKeyB64u: LinkDevicePublicKeyB64u;
+    readonly devicePublicKeyB64u: LinkDevicePublicKeyB64u;
+    readonly requestedPermission: DelegatedWalletAuthorityV1;
+} & ({
+    readonly targetFactor: {
+        readonly kind: 'passkey_prf';
+    };
+    readonly targetEmail?: never;
+} | {
+    readonly targetFactor: {
+        readonly kind: 'email_otp';
+    };
+    readonly targetEmail: VerifiedEmailAddress;
+}) & {
+    readonly issuedAtMs: number;
+    readonly expiresAtMs: number;
+};
+export declare function buildQrLinkedDeviceSessionPayloadV5(args: BuildQrLinkedDeviceSessionPayloadV5Args): QrLinkedDeviceSessionPayloadV5;
+export declare function buildLinkedDeviceSessionClaimRequestV1(payload: QrLinkedDeviceSessionPayloadV5): LinkedDeviceSessionClaimRequestV1;
+export declare function buildLinkedDeviceSessionClaimV1(args: Omit<LinkedDeviceSessionClaimV1, 'kind'>): LinkedDeviceSessionClaimV1;
+export declare function buildWalletSessionLinkedDeviceOwnerAuthorizationV1(args: {
+    readonly walletSessionId: WalletSessionId;
+    readonly authorizationId: WalletSessionAuthorizationId;
+}): LinkedDeviceOwnerAuthorizationSourceV1;
+export declare function buildLinkedDeviceApprovalV1(args: Omit<LinkedDeviceApprovalV1, 'kind'>): LinkedDeviceApprovalV1;
+type LinkedDeviceTargetPreparationBuildInputV1 = Omit<Extract<LinkedDeviceTargetPreparationV1, {
+    readonly targetFactor: {
+        readonly kind: 'passkey_prf';
+    };
+}>, 'kind'> | Omit<Extract<LinkedDeviceTargetPreparationV1, {
+    readonly targetFactor: {
+        readonly kind: 'email_otp';
+    };
+}>, 'kind'>;
+export declare function buildLinkedDeviceTargetPreparationV1(args: LinkedDeviceTargetPreparationBuildInputV1): LinkedDeviceTargetPreparationV1;
+export declare function buildLinkedDeviceTargetCredentialRegistrationV1(args: Omit<LinkedDeviceTargetCredentialRegistrationV1, 'kind'>): LinkedDeviceTargetCredentialRegistrationV1;
+export declare function buildLinkedDeviceSessionCancelUnclaimedRequestV1(args: {
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly requestedAtMs: number;
+}): Extract<LinkedDeviceSessionTransportRequestV1, {
+    readonly kind: 'linked_device_session_cancel_unclaimed_request_v1';
+}>;
+export declare function buildLinkedDeviceSessionCancelClaimedRequestV1(args: {
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly enrollmentId: LinkedDeviceEnrollmentId;
+    readonly deviceId: LinkedDeviceId;
+    readonly reason: 'user_cancelled' | 'expired' | 'revoked';
+    readonly requestedAtMs: number;
+}): Extract<LinkedDeviceSessionTransportRequestV1, {
+    readonly kind: 'linked_device_session_cancel_claimed_request_v1';
+}>;
+export declare function buildLinkedDeviceSessionRetryCommittedDeliveryRequestV1(args: {
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly enrollmentId: LinkedDeviceEnrollmentId;
+    readonly deviceId: LinkedDeviceId;
+    readonly requestedAtMs: number;
+}): Extract<LinkedDeviceSessionTransportRequestV1, {
+    readonly kind: 'linked_device_session_retry_committed_delivery_request_v1';
+}>;
+export declare function parseLocalAuthorityInstallationReceiptV1(raw: unknown): LocalAuthorityInstallationReceiptV1;
+export declare function parseWalletSessionOperationCredentialV1(raw: unknown): WalletSessionOperationCredentialV1;
+export declare function parseActiveWalletSessionV1(raw: unknown): ActiveWalletSessionV1;
+export declare function parseLocalAuthorityActivationFinalAckV1(raw: unknown): LocalAuthorityActivationFinalAckV1;
+export declare function parseActivateInstalledAuthorityResultV1(raw: unknown): ActivateInstalledAuthorityResultV1;
+//# sourceMappingURL=parsers.d.ts.map

package/dist/types/shared-ts/src/device-linking/requestProof.d.ts

@@ -0,0 +1,26 @@
+import { type LinkDeviceSessionId } from '../signing-lanes/ids';
+import { type DigestB64u } from '../utils/canonicalPrimitives';
+import type { LinkDevicePublicKeyB64u } from './contracts';
+export declare const LINKED_DEVICE_REQUEST_PROOF_DOMAIN_V1 = "seams/linked-device/request-proof/v1";
+export declare const LINKED_DEVICE_REQUEST_PROOF_HEADER_V1 = "x-seams-linked-device-proof-v1";
+export declare const LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1 = 60000;
+export declare const LINKED_DEVICE_CLOCK_SKEW_TOLERANCE_MS_V1 = 60000;
+export declare const LINKED_DEVICE_REQUEST_PROOF_NONCE_BYTES_V1 = 32;
+export declare const LINKED_DEVICE_REQUEST_PROOF_SIGNATURE_BYTES_V1 = 64;
+export declare const LINK_DEVICE_PUBLIC_KEY_BYTES_V1 = 32;
+export type LinkedDeviceRequestProofV1 = {
+    readonly kind: 'linked_device_request_proof_v1';
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly devicePublicKeyDigestB64u: DigestB64u;
+    readonly requestNonceB64u: string;
+    readonly method: 'GET' | 'POST';
+    readonly canonicalPath: string;
+    readonly bodyDigestB64u: DigestB64u;
+    readonly issuedAtMs: number;
+    readonly expiresAtMs: number;
+    readonly signatureB64u: string;
+};
+export declare function encodeLinkedDeviceRequestProofV1(proof: LinkedDeviceRequestProofV1): Uint8Array;
+export declare function computeLinkedDeviceRequestProofDigestV1(proof: LinkedDeviceRequestProofV1): Promise<DigestB64u>;
+export declare function computeLinkedDevicePublicKeyDigestV1(publicKeyB64u: LinkDevicePublicKeyB64u | string): Promise<DigestB64u>;
+//# sourceMappingURL=requestProof.d.ts.map

package/dist/types/shared-ts/src/device-linking/sourceContribution.d.ts

@@ -0,0 +1,182 @@
+import { type DeviceId } from '../authorization/capabilityKinds';
+import { type LinkedDeviceEnrollmentId, type LinkDeviceSessionId, type WalletKeyId } from '../signing-lanes/ids';
+import { type MpcMaterialActivationRef, type WalletAuthorityId } from '../utils/domainIds';
+import { type DigestB64u } from '../utils/canonicalPrimitives';
+import { type Ed25519PublicKeyB64u, type Secp256k1CompressedPublicKeyB64u } from '../passkey-custody/primitives';
+import { type RouterAbEd25519YaoCeremonyBindingV1, type RouterAbEd25519YaoActivationAdmissionReceiptV1, type RouterAbEd25519YaoActivationPublicReceiptV1, type RouterAbEd25519YaoApplicationBindingFactsV1, type RouterAbEd25519YaoActivationClientPackageV1 } from '../utils/routerAbEd25519Yao';
+import { type EcdsaThresholdKeyId } from '../threshold/ecdsaDerivationRoleLocalBootstrap';
+import { type RouterAbEcdsaDerivationNormalSigningStateV1 } from '../utils/routerAbEcdsaDerivation';
+/** Exact discriminator accepted by the ECDSA source-contribution core. */
+export declare const LINKED_DEVICE_ECDSA_SOURCE_CONTRIBUTION_ENVELOPE_KIND_V1: "seams/linked-device/ecdsa-source-contribution-envelope/v1";
+/** Source derivation facts required by the Cloudflare ECDSA reservation wire. */
+export type LinkedDeviceEcdsaSourceDerivationV1 = {
+    readonly applicationBindingDigestB64u: DigestB64u;
+    readonly clientShareRetryCounter: number;
+    readonly ecdsaThresholdKeyId: EcdsaThresholdKeyId;
+    readonly sourceNormalSigning: RouterAbEcdsaDerivationNormalSigningStateV1;
+};
+/** Public ECDSA source identity copied from the family protocol wire. */
+export type LinkedDeviceEcdsaSourceSignerIdentityV1 = {
+    /** Exact activation object expected by the ECDSA WASM protocol. */
+    readonly activation: MpcMaterialActivationRef;
+    readonly clientPublicKey33B64u: Secp256k1CompressedPublicKeyB64u;
+    readonly relayerPublicKey33B64u: Secp256k1CompressedPublicKeyB64u;
+    readonly thresholdPublicKey33B64u: Secp256k1CompressedPublicKeyB64u;
+    readonly thresholdEthereumAddress20B64u: string;
+};
+/** Exact Device 2 ECDSA recipient/factor preparation copied from Rust. */
+export type LinkedDeviceEcdsaTargetRecipientPreparationV1 = {
+    /** Exact fresh target activation object expected by the ECDSA WASM protocol. */
+    readonly activation: MpcMaterialActivationRef;
+    readonly targetDeviceId: DeviceId;
+    readonly targetFactorVerificationDigestB64u: DigestB64u;
+    readonly clientRecipientPublicKeyB64u: string;
+    readonly signingWorkerRecipientPublicKeyB64u: string;
+};
+/** Public source/target input that Device 2 sends before Device 1 seals. */
+export type LinkedDeviceEcdsaSourceContributionPreparationV1 = {
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly enrollmentId: LinkedDeviceEnrollmentId;
+    readonly sourceAuthorityId: WalletAuthorityId;
+    readonly source: LinkedDeviceEcdsaSourceSignerIdentityV1;
+    readonly target: LinkedDeviceEcdsaTargetRecipientPreparationV1;
+};
+/** Public Ed25519 source-preserving request published after target-factor verification. */
+export type LinkedDeviceEd25519SourceContributionPreparationV1 = {
+    readonly kind: 'linked_device_ed25519_source_contribution_preparation_v1';
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly enrollmentId: LinkedDeviceEnrollmentId;
+    readonly sourceAuthorityId: WalletAuthorityId;
+    readonly walletKeyId: WalletKeyId;
+    readonly targetDeviceId: DeviceId;
+    readonly targetFactorVerificationDigestB64u: DigestB64u;
+    readonly sourceBinding: RouterAbEd25519YaoCeremonyBindingV1;
+    readonly targetAdmission: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+    readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
+    readonly sourceRevocationEpoch: number;
+    readonly participantIds: readonly [number, number];
+    readonly targetMaterialActivation: MpcMaterialActivationRef;
+    readonly targetClientRecipientPublicKeyB64u: string;
+    readonly targetSigningWorkerRecipientPublicKeyB64u: string;
+    readonly sourceRegisteredPublicKeyB64u: Ed25519PublicKeyB64u;
+};
+/** Exact ECDSA binding accepted by the family protocol. */
+export type LinkedDeviceEcdsaSourceContributionBindingV1 = {
+    readonly linkSessionId: string;
+    readonly enrollmentId: string;
+    readonly sourceAuthorityId: string;
+    readonly source: LinkedDeviceEcdsaSourceSignerIdentityV1;
+    readonly target: LinkedDeviceEcdsaTargetRecipientPreparationV1;
+    readonly targetClientPublicKey33B64u: Secp256k1CompressedPublicKeyB64u;
+};
+export type LinkedDeviceEcdsaEncryptedSourceContributionV1 = {
+    readonly kind: typeof LINKED_DEVICE_ECDSA_SOURCE_CONTRIBUTION_ENVELOPE_KIND_V1;
+    readonly recipientPublicKeyB64u: string;
+    readonly bindingDigestB64u: DigestB64u;
+    readonly encappedKeyB64u: string;
+    readonly ciphertextB64u: string;
+};
+/** The package contains ciphertext only; plaintext delta/share never has a TS shape. */
+export type LinkedDeviceEcdsaSourceContributionPackageV1 = {
+    readonly binding: LinkedDeviceEcdsaSourceContributionBindingV1;
+    readonly encryptedDelta: LinkedDeviceEcdsaEncryptedSourceContributionV1;
+    readonly encryptedTargetClientShare: LinkedDeviceEcdsaEncryptedSourceContributionV1;
+};
+/** Public inactive receipt returned by the source-preserving ECDSA worker. */
+export type LinkedDeviceEcdsaSourcePreservingActivationReceiptV1 = {
+    readonly state: 'inactive';
+    readonly binding: LinkedDeviceEcdsaSourceContributionBindingV1;
+    readonly sourceDerivation: LinkedDeviceEcdsaSourceDerivationV1;
+    readonly targetRelayerPublicKey33B64u: Secp256k1CompressedPublicKeyB64u;
+    readonly thresholdPublicKey33B64u: Secp256k1CompressedPublicKeyB64u;
+    readonly thresholdEthereumAddress20B64u: string;
+    readonly normalSigning: RouterAbEcdsaDerivationNormalSigningStateV1;
+};
+/** Final ECDSA contribution returned by Device 1's worker boundary. */
+export type LinkedDeviceEcdsaSourceContributionV1 = {
+    readonly kind: 'linked_device_ecdsa_source_contribution_v1';
+    readonly keyFamily: 'ecdsa_secp256k1';
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly enrollmentId: LinkedDeviceEnrollmentId;
+    readonly sourceAuthorityId: WalletAuthorityId;
+    readonly walletKeyId: WalletKeyId;
+    readonly targetDeviceId: DeviceId;
+    readonly targetFactorVerificationDigestB64u: DigestB64u;
+    readonly sourceSigner: LinkedDeviceEcdsaSourceSignerIdentityV1;
+    readonly sourceDerivation: LinkedDeviceEcdsaSourceDerivationV1;
+    readonly target: LinkedDeviceEcdsaTargetRecipientPreparationV1;
+    readonly package: LinkedDeviceEcdsaSourceContributionPackageV1;
+};
+export type LinkedDeviceEd25519SourceContributionV1 = {
+    readonly kind: 'linked_device_ed25519_source_contribution_v1';
+    readonly keyFamily: 'ed25519';
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly enrollmentId: LinkedDeviceEnrollmentId;
+    readonly sourceAuthorityId: WalletAuthorityId;
+    readonly walletKeyId: WalletKeyId;
+    readonly targetDeviceId: DeviceId;
+    readonly targetFactorVerificationDigestB64u: DigestB64u;
+    readonly targetMaterialActivation: MpcMaterialActivationRef;
+    readonly targetClientRecipientPublicKeyB64u: string;
+    readonly targetSigningWorkerRecipientPublicKeyB64u: string;
+    readonly sourceRegisteredPublicKeyB64u: Ed25519PublicKeyB64u;
+    readonly sourceBinding: RouterAbEd25519YaoCeremonyBindingV1;
+    /** Exact inactive reservation returned by Router source-preserving execution. */
+    readonly reservationId: string;
+    readonly targetBinding: RouterAbEd25519YaoCeremonyBindingV1;
+    readonly activationReceipt: RouterAbEd25519YaoActivationPublicReceiptV1;
+    readonly participantIds: readonly [number, number];
+    readonly deriver_a_client_package: RouterAbEd25519YaoActivationClientPackageV1<'deriver_a'>;
+    readonly deriver_b_client_package: RouterAbEd25519YaoActivationClientPackageV1<'deriver_b'>;
+};
+export type LinkedDeviceEd25519SourcePreservingReservationV1 = {
+    readonly state: 'inactive';
+    readonly reservationId: string;
+    readonly participantIds: readonly [number, number];
+    readonly activationReceipt: RouterAbEd25519YaoActivationPublicReceiptV1;
+    readonly deriver_a_client_package: RouterAbEd25519YaoActivationClientPackageV1<'deriver_a'>;
+    readonly deriver_b_client_package: RouterAbEd25519YaoActivationClientPackageV1<'deriver_b'>;
+};
+export type LinkedDeviceOrdinaryMaterialSourceContributionV1 = LinkedDeviceEd25519SourceContributionV1 | LinkedDeviceEcdsaSourceContributionV1;
+export type LinkedDeviceOrdinaryMaterialSourceContributionPreparationV1 = LinkedDeviceEd25519SourceContributionPreparationV1 | LinkedDeviceEcdsaSourceContributionPreparationV1;
+/** Durable public target preparation retained while Device 1 seals contributions. */
+export type LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 = readonly [
+    LinkedDeviceOrdinaryMaterialSourceContributionPreparationV1,
+    ...LinkedDeviceOrdinaryMaterialSourceContributionPreparationV1[]
+];
+export type LinkedDeviceOrdinaryMaterialSourceContributionTupleV1 = readonly [
+    LinkedDeviceOrdinaryMaterialSourceContributionV1,
+    ...LinkedDeviceOrdinaryMaterialSourceContributionV1[]
+];
+export declare function parseLinkedDeviceOrdinaryMaterialSourceContributionV1(raw: unknown): LinkedDeviceOrdinaryMaterialSourceContributionV1;
+export declare function parseLinkedDeviceEd25519SourcePreservingReservationV1(raw: unknown): LinkedDeviceEd25519SourcePreservingReservationV1;
+export declare function parseLinkedDeviceOrdinaryMaterialSourceContributionTupleV1(raw: unknown): LinkedDeviceOrdinaryMaterialSourceContributionTupleV1;
+export declare function parseLinkedDeviceEcdsaSourceContributionPreparationV1(raw: unknown): LinkedDeviceEcdsaSourceContributionPreparationV1;
+export declare function parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1(raw: unknown): LinkedDeviceOrdinaryMaterialSourceContributionPreparationV1;
+export declare function parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1(raw: unknown): LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1;
+export declare function assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1(input: {
+    readonly contribution: LinkedDeviceOrdinaryMaterialSourceContributionV1;
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly enrollmentId: LinkedDeviceEnrollmentId;
+    readonly sourceAuthorityId: WalletAuthorityId;
+    readonly walletKeyId: WalletKeyId;
+    readonly targetDeviceId: DeviceId;
+    readonly targetFactorVerificationDigestB64u: DigestB64u;
+    readonly sourceMaterialActivation: MpcMaterialActivationRef;
+    readonly targetMaterialActivation: MpcMaterialActivationRef;
+    readonly sourceSigner: {
+        readonly keyFamily: 'ed25519';
+        readonly walletKeyId: WalletKeyId;
+        readonly registeredPublicKeyB64u: Ed25519PublicKeyB64u;
+    } | {
+        readonly keyFamily: 'ecdsa_secp256k1';
+        readonly walletKeyId: WalletKeyId;
+        readonly thresholdPublicKey33B64u: Secp256k1CompressedPublicKeyB64u;
+    };
+}): void;
+export declare function parseLinkedDeviceEcdsaSourceDerivationV1(raw: unknown): LinkedDeviceEcdsaSourceDerivationV1;
+export declare function parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1(raw: unknown): LinkedDeviceEcdsaSourcePreservingActivationReceiptV1;
+export declare function parseLinkedDeviceEcdsaSourceContributionPackageV1(raw: unknown): LinkedDeviceEcdsaSourceContributionPackageV1;
+export declare function parseLinkedDeviceEcdsaSourceContributionBindingV1(raw: unknown): LinkedDeviceEcdsaSourceContributionBindingV1;
+export declare function parseLinkedDeviceEcdsaEncryptedSourceContributionV1(raw: unknown, label: string): LinkedDeviceEcdsaEncryptedSourceContributionV1;
+//# sourceMappingURL=sourceContribution.d.ts.map

package/dist/types/shared-ts/src/device-linking/walletSessionCredentialDelivery.d.ts

@@ -0,0 +1,84 @@
+import { type DigestB64u } from '../utils/canonicalPrimitives';
+import { type MpcWalletSigningQuotaId, type PrincipalId, type TenantId, type WalletSessionAuthorizationId, type WalletSessionId } from '../authorization/capabilityKinds';
+import type { LinkDevicePublicKeyB64u } from './contracts';
+import { type LinkDeviceSessionId } from '../signing-lanes/ids';
+import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../utils/domainIds';
+export type LinkedDeviceWalletSessionCredentialDeliveryAadV1 = {
+    readonly kind: 'linked_device_wallet_session_credential_delivery_aad_v1';
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly walletId: WalletId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly authorizationId: WalletSessionAuthorizationId;
+    readonly walletSessionId: WalletSessionId;
+    readonly quotaId: MpcWalletSigningQuotaId;
+    readonly credentialDigestB64u: DigestB64u;
+    readonly recipientPublicKey65B64u: string;
+    readonly issuedAtMs: number;
+    readonly expiresAtMs: number;
+};
+/**
+ * Scope authenticated by the activation response and checked independently
+ * from the sealed envelope before Device 2 decrypts its credential.
+ */
+export type LinkedDeviceWalletSessionCredentialDeliveryBindingV1 = {
+    readonly kind: 'linked_device_wallet_session_credential_delivery_binding_v1';
+    readonly namespace: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+    readonly tenantId: TenantId;
+    readonly principalId: PrincipalId;
+};
+export type LinkedDeviceWalletSessionCredentialEnvelopeV1 = {
+    readonly kind: 'linked_device_wallet_session_credential_envelope_v1';
+    readonly algorithm: 'p256-ecdh-aes256gcm-v1';
+    readonly serverEphemeralPublicKey65B64u: string;
+    readonly nonce12B64u: string;
+    readonly ciphertextB64u: string;
+};
+export type LinkedDeviceWalletSessionCredentialDeliveryV1 = {
+    readonly kind: 'linked_device_wallet_session_credential_delivery_v1';
+    readonly aad: LinkedDeviceWalletSessionCredentialDeliveryAadV1;
+    readonly aadDigestB64u: DigestB64u;
+    readonly recipientBindingDigestB64u: DigestB64u;
+    readonly envelope: LinkedDeviceWalletSessionCredentialEnvelopeV1;
+    readonly envelopeDigestB64u: DigestB64u;
+    readonly installationReceiptDigestB64u: DigestB64u;
+};
+/**
+ * Durable binding retained after acknowledgement. It is the only identity
+ * needed to authenticate a retry once the live link-session row is gone.
+ */
+export type LinkedDeviceActivationCleanupReceiptV1 = {
+    readonly kind: 'linked_device_activation_cleanup_receipt_v1';
+    readonly devicePublicKeyB64u: LinkDevicePublicKeyB64u;
+    readonly devicePublicKeyDigestB64u: DigestB64u;
+    readonly linkSessionId: LinkDeviceSessionId;
+    readonly walletId: WalletId;
+    readonly authorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly packageSetDigestB64u: DigestB64u;
+    readonly authorizationId: WalletSessionAuthorizationId;
+    readonly walletSessionId: WalletSessionId;
+    readonly credentialDigestB64u: DigestB64u;
+    readonly installationReceiptDigestB64u: DigestB64u;
+    readonly acknowledgedAtMs: number;
+    readonly expiresAtMs: number;
+};
+export declare function encodeLinkedDeviceWalletSessionCredentialDeliveryAadV1(aad: LinkedDeviceWalletSessionCredentialDeliveryAadV1): string;
+export declare function buildLinkedDeviceWalletSessionCredentialDeliveryBindingV1(aad: LinkedDeviceWalletSessionCredentialDeliveryAadV1): LinkedDeviceWalletSessionCredentialDeliveryBindingV1;
+export declare function parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1(raw: unknown): LinkedDeviceWalletSessionCredentialDeliveryBindingV1;
+export declare function computeLinkedDeviceWalletSessionCredentialDeliveryAadDigestB64u(aad: LinkedDeviceWalletSessionCredentialDeliveryAadV1): Promise<DigestB64u>;
+export declare function computeLinkedDeviceWalletSessionCredentialEnvelopeDigestB64u(envelope: LinkedDeviceWalletSessionCredentialEnvelopeV1): Promise<DigestB64u>;
+export declare function computeLinkedDeviceActivationCleanupReceiptDigestB64u(receipt: LinkedDeviceActivationCleanupReceiptV1): Promise<DigestB64u>;
+export declare function parseLinkedDeviceActivationCleanupReceiptV1(raw: unknown): LinkedDeviceActivationCleanupReceiptV1;
+export declare function assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1(delivery: LinkedDeviceWalletSessionCredentialDeliveryV1): Promise<void>;
+export declare function parseLinkedDeviceWalletSessionCredentialDeliveryV1(raw: unknown): LinkedDeviceWalletSessionCredentialDeliveryV1;
+//# sourceMappingURL=walletSessionCredentialDelivery.d.ts.map

package/dist/types/shared-ts/src/index.d.ts

@@ -0,0 +1,10 @@
+export * as authorization from './authorization/index';
+export * as near from './near/index';
+export * as passkeyCustody from './passkey-custody/index';
+export * as signingLanes from './signing-lanes/index';
+export * as threshold from './threshold/index';
+export * as deviceLinking from './device-linking/index';
+export * as utils from './utils/index';
+export * as walletRecovery from './wallet-recovery/index';
+export * as tenantRoot from './tenant-root/index';
+//# sourceMappingURL=index.d.ts.map