@seams/wallet-server 0.5.0

package/dist/types/shared-ts/src/utils/base64.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Encodes binary data to standard base64 format.
+ * Uses standard base64 characters (+, /, =) rather than base64url encoding.
+ *
+ * Important: Avoids spreading large arrays into String.fromCharCode(...) which
+ * can overflow the JS call stack when encoding big WASM binaries.
+ *
+ * @param value - ArrayBufferLike or ArrayBufferView containing the binary data to encode
+ * @returns Standard base64-encoded string with padding
+ */
+export declare const base64Encode: (value: ArrayBufferLike | ArrayBufferView) => string;
+/**
+ * Decodes a standard base64-encoded string into a Uint8Array.
+ * Handles standard base64 format with +, /, and = characters.
+ *
+ * @param base64 - The base64-encoded string to decode
+ * @returns Uint8Array containing the decoded bytes
+ * @throws Error if decoding fails due to invalid base64 input
+ */
+export declare function base64Decode(base64: string): Uint8Array;
+/**
+ * Encodes an ArrayBuffer into a base64url string.
+ * Converts binary data to base64 then replaces standard base64 characters with URL-safe ones:
+ * + -> -
+ * / -> _
+ * Removes padding = characters
+ *
+ * Used for WebAuthn API compatibility in browser environments.
+ * Equivalent to Buffer.from(value).toString('base64url') in Node.js.
+ *
+ * @param value - The ArrayBufferLike or ArrayBufferView to encode
+ * @returns A base64url-encoded string without padding
+ */
+export declare const base64UrlEncode: (value: ArrayBufferLike | ArrayBufferView) => string;
+/**
+ * Decodes a base64url-encoded string into a Uint8Array.
+ * Handles base64url format by replacing URL-safe characters and adding padding.
+ *
+ * @param base64Url - The base64url-encoded string to decode
+ * @returns Uint8Array containing the decoded bytes
+ * @throws Error if decoding fails due to invalid base64url input
+ */
+export declare function base64UrlDecode(base64Url: string): Uint8Array;
+/**
+ * Converts an ArrayBuffer or ArrayBufferLike object to a plain number array for WASM compatibility.
+ * WASM bindings require plain number arrays rather than TypedArrays for memory safety and direct access.
+ * The resulting array contains values from 0-255 representing raw bytes.
+ *
+ * @param buffer - The source buffer to convert, either ArrayBuffer or ArrayBufferLike
+ * @returns A plain number[] array containing the buffer's bytes
+ */
+export declare const toWasmByteArray: (buffer: ArrayBuffer | ArrayBufferLike) => number[];
+//# sourceMappingURL=base64.d.ts.map

package/dist/types/shared-ts/src/utils/bigint.d.ts

@@ -0,0 +1,3 @@
+export declare function bytesToNumberBE(bytes: Uint8Array): bigint;
+export declare function numberToBytesBE(n: number | bigint, len: number): Uint8Array;
+//# sourceMappingURL=bigint.d.ts.map

package/dist/types/shared-ts/src/utils/canonicalPrimitives.d.ts

@@ -0,0 +1,12 @@
+type CanonicalPrimitiveBrand<TName extends string> = {
+    readonly __canonicalPrimitiveBrand: TName;
+};
+export type CorrelationId = string & CanonicalPrimitiveBrand<'CorrelationId'>;
+export type DigestB64u = string & CanonicalPrimitiveBrand<'DigestB64u'>;
+export type IsoTimestamp = string & CanonicalPrimitiveBrand<'IsoTimestamp'>;
+export declare function parseCorrelationId(value: unknown): CorrelationId;
+export declare function parseDigestB64u(value: unknown): DigestB64u;
+export declare function parseIsoTimestamp(value: unknown): IsoTimestamp;
+export declare function isoTimestampFromUnixMs(value: unknown): IsoTimestamp;
+export {};
+//# sourceMappingURL=canonicalPrimitives.d.ts.map

package/dist/types/shared-ts/src/utils/digests.d.ts

@@ -0,0 +1,6 @@
+export declare function alphabetizeStringify(input: unknown): string;
+export declare function sha256BytesUtf8(input: string): Promise<Uint8Array>;
+export declare function sha256Bytes(input: Uint8Array): Promise<Uint8Array>;
+export declare function bytesToUnprefixedHex(bytes: Uint8Array): string;
+export declare function sha256HexUtf8(input: string): Promise<string>;
+//# sourceMappingURL=digests.d.ts.map

package/dist/types/shared-ts/src/utils/domainIds.d.ts

@@ -0,0 +1,140 @@
+export type DomainId<TBrand extends string> = string & {
+    readonly __domainIdBrand: TBrand;
+};
+export type DomainIdParseError = {
+    code: 'missing' | 'invalid';
+    message: string;
+};
+export type DomainIdParseResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: DomainIdParseError;
+};
+export type WalletId = DomainId<'WalletId'>;
+export type ProviderSubject = DomainId<'ProviderSubject'>;
+export type GoogleProviderSubject = ProviderSubject & {
+    readonly __googleProviderSubjectBrand: 'GoogleProviderSubject';
+};
+export type VerifiedGoogleEmail = DomainId<'VerifiedGoogleEmail'>;
+export type VerifiedEmailAddress = DomainId<'VerifiedEmailAddress'>;
+export type EmailOtpProviderUserId = DomainId<'EmailOtpProviderUserId'>;
+export type ChallengeSubjectId = DomainId<'ChallengeSubjectId'>;
+export type EmailOtpChallengeId = DomainId<'EmailOtpChallengeId'>;
+export type EmailOtpRegistrationAttemptId = DomainId<'EmailOtpRegistrationAttemptId'>;
+export type OrgId = DomainId<'OrgId'>;
+export type WebAuthnRpId = DomainId<'WebAuthnRpId'>;
+export type WebAuthnCredentialIdB64u = DomainId<'WebAuthnCredentialIdB64u'>;
+export type PasskeyEnvelopeId = DomainId<'PasskeyEnvelopeId'>;
+export type WalletAuthMethodId = DomainId<'WalletAuthMethodId'>;
+export type WalletAuthorityId = DomainId<'WalletAuthorityId'>;
+export type WalletAuthorityBindingDigest = DomainId<'WalletAuthorityBindingDigest'>;
+export type CapabilityInstanceRef = DomainId<'CapabilityInstanceRef'>;
+export type MpcMaterialOwnerRef = DomainId<'MpcMaterialOwnerRef'>;
+export type MpcCapabilityRuntimeRef = DomainId<'MpcCapabilityRuntimeRef'>;
+export type MpcMaterialActivationId = DomainId<'MpcMaterialActivationId'>;
+export type MpcSigningWorkerRef = DomainId<'MpcSigningWorkerRef'>;
+export type MpcKeyBindingRef = DomainId<'MpcKeyBindingRef'>;
+export type MpcLifecycleBindingRef = DomainId<'MpcLifecycleBindingRef'>;
+export type MpcReauthorizationPolicyRef = DomainId<'MpcReauthorizationPolicyRef'>;
+export type MpcRegisteredPublicKeyBindingRef = DomainId<'MpcRegisteredPublicKeyBindingRef'>;
+type MpcMaterialActivationRefFields = {
+    readonly activationId: MpcMaterialActivationId;
+    readonly capability: CapabilityInstanceRef;
+    readonly materialOwner: MpcMaterialOwnerRef;
+    readonly keyBinding: MpcKeyBindingRef;
+    readonly lifecycleBinding: MpcLifecycleBindingRef;
+    readonly signingWorker: MpcSigningWorkerRef;
+};
+declare class MpcMaterialActivationReference {
+    private retainProof;
+    readonly kind: 'mpc_material_activation_ref';
+    readonly activationId: MpcMaterialActivationId;
+    readonly capability: CapabilityInstanceRef;
+    readonly materialOwner: MpcMaterialOwnerRef;
+    readonly keyBinding: MpcKeyBindingRef;
+    readonly lifecycleBinding: MpcLifecycleBindingRef;
+    readonly signingWorker: MpcSigningWorkerRef;
+    constructor(fields: MpcMaterialActivationRefFields);
+}
+export type MpcMaterialActivationRef = MpcMaterialActivationReference;
+export type ThresholdEd25519SessionId = DomainId<'ThresholdEd25519SessionId'>;
+export type ThresholdEcdsaSessionId = DomainId<'ThresholdEcdsaSessionId'>;
+export type EcdsaActiveStateId = DomainId<'EcdsaActiveStateId'>;
+export type ThresholdSessionId = ThresholdEd25519SessionId | ThresholdEcdsaSessionId;
+export type RootShareEpoch = DomainId<'RootShareEpoch'>;
+export type WalletKeyId = DomainId<'WalletKeyId'>;
+export type SigningLaneId = DomainId<'SigningLaneId'>;
+export type LaneShareEpoch = DomainId<'LaneShareEpoch'>;
+export type LinkedDeviceId = DomainId<'LinkedDeviceId'>;
+export type LaneOperationId = DomainId<'LaneOperationId'>;
+export type LaneEnrollmentId = DomainId<'LaneEnrollmentId'>;
+export type LaneOperationIdempotencyKey = DomainId<'LaneOperationIdempotencyKey'>;
+export type LinkedDeviceEnrollmentId = DomainId<'LinkedDeviceEnrollmentId'>;
+export type WalletRecoveryOperationId = DomainId<'WalletRecoveryOperationId'>;
+export type Ed25519YaoSuiteId = DomainId<'Ed25519YaoSuiteId'>;
+export type EcdsaRelayerKeyId = DomainId<'EcdsaRelayerKeyId'>;
+export type LaneHolderRecipientHandleV1 = DomainId<'LaneHolderRecipientHandleV1'>;
+export type LinkDeviceSessionId = DomainId<'LinkDeviceSessionId'>;
+export declare function hasControlCharacter(value: string): boolean;
+export declare function hasWhitespaceOrControlCharacters(value: string): boolean;
+export declare function parseWalletId(raw: unknown): DomainIdParseResult<WalletId>;
+export declare function parseProviderSubject(raw: unknown): DomainIdParseResult<ProviderSubject>;
+export declare function parseGoogleProviderSubject(raw: unknown): DomainIdParseResult<GoogleProviderSubject>;
+export declare function parseVerifiedGoogleEmail(raw: unknown): DomainIdParseResult<VerifiedGoogleEmail>;
+export declare function parseVerifiedEmailAddress(raw: unknown): DomainIdParseResult<VerifiedEmailAddress>;
+export declare function parseEmailOtpProviderUserId(raw: unknown): DomainIdParseResult<EmailOtpProviderUserId>;
+export declare function parseChallengeSubjectId(raw: unknown): DomainIdParseResult<ChallengeSubjectId>;
+export declare function parseEmailOtpChallengeId(raw: unknown): DomainIdParseResult<EmailOtpChallengeId>;
+export declare function parseEmailOtpRegistrationAttemptId(raw: unknown): DomainIdParseResult<EmailOtpRegistrationAttemptId>;
+export declare function parseOrgId(raw: unknown): DomainIdParseResult<OrgId>;
+export declare function parseWebAuthnRpId(raw: unknown): DomainIdParseResult<WebAuthnRpId>;
+export declare function parseWebAuthnCredentialIdB64u(raw: unknown): DomainIdParseResult<WebAuthnCredentialIdB64u>;
+export declare function parsePasskeyEnvelopeId(raw: unknown): DomainIdParseResult<PasskeyEnvelopeId>;
+/**
+ * Mints a wallet auth-method id.
+ *
+ * Server-side only, and there is exactly one of these because an auth method's
+ * identity is now authenticated data: it goes into the custody envelope's AAD,
+ * so an id minted to a second shape would seal envelopes the parsers reject.
+ * A client never chooses one — registration and every addition receive theirs
+ * from the intent that allocated it.
+ */
+export declare function allocateWalletAuthMethodId(randomSuffix: string): WalletAuthMethodId;
+export declare function parseWalletAuthMethodId(raw: unknown): DomainIdParseResult<WalletAuthMethodId>;
+export declare function parseWalletAuthorityId(raw: unknown): DomainIdParseResult<WalletAuthorityId>;
+export declare function parseWalletAuthorityBindingDigest(raw: unknown): DomainIdParseResult<WalletAuthorityBindingDigest>;
+export declare function parseCapabilityInstanceRef(raw: unknown): DomainIdParseResult<CapabilityInstanceRef>;
+export declare function parseMpcMaterialOwnerRef(raw: unknown): DomainIdParseResult<MpcMaterialOwnerRef>;
+export declare function parseMpcCapabilityRuntimeRef(raw: unknown): DomainIdParseResult<MpcCapabilityRuntimeRef>;
+export declare function parseMpcMaterialActivationId(raw: unknown): DomainIdParseResult<MpcMaterialActivationId>;
+export declare function parseMpcSigningWorkerRef(raw: unknown): DomainIdParseResult<MpcSigningWorkerRef>;
+export declare function parseMpcKeyBindingRef(raw: unknown): DomainIdParseResult<MpcKeyBindingRef>;
+export declare function parseMpcLifecycleBindingRef(raw: unknown): DomainIdParseResult<MpcLifecycleBindingRef>;
+export declare function parseMpcReauthorizationPolicyRef(raw: unknown): DomainIdParseResult<MpcReauthorizationPolicyRef>;
+export declare function parseMpcRegisteredPublicKeyBindingRef(raw: unknown): DomainIdParseResult<MpcRegisteredPublicKeyBindingRef>;
+export declare function buildMpcMaterialActivationRef(fields: MpcMaterialActivationRefFields): MpcMaterialActivationRef;
+export declare function mpcMaterialActivationRefsEqual(left: MpcMaterialActivationRef, right: MpcMaterialActivationRef): boolean;
+export declare function parseMpcMaterialActivationRef(raw: unknown): DomainIdParseResult<MpcMaterialActivationRef>;
+export declare function formatWebAuthnRpIdForWire(value: WebAuthnRpId): string;
+export declare function parseThresholdEd25519SessionId(raw: unknown): DomainIdParseResult<ThresholdEd25519SessionId>;
+export declare function parseThresholdEcdsaSessionId(raw: unknown): DomainIdParseResult<ThresholdEcdsaSessionId>;
+export declare function parseEcdsaActiveStateId(raw: unknown): DomainIdParseResult<EcdsaActiveStateId>;
+export declare function parseThresholdSessionId(raw: unknown): DomainIdParseResult<ThresholdSessionId>;
+export declare function parseRootShareEpoch(raw: unknown): DomainIdParseResult<RootShareEpoch>;
+export declare function parseWalletKeyId(raw: unknown): DomainIdParseResult<WalletKeyId>;
+export declare function parseSigningLaneId(raw: unknown): DomainIdParseResult<SigningLaneId>;
+export declare function parseLaneShareEpoch(raw: unknown): DomainIdParseResult<LaneShareEpoch>;
+export declare function parseLinkedDeviceId(raw: unknown): DomainIdParseResult<LinkedDeviceId>;
+export declare function parseLaneOperationId(raw: unknown): DomainIdParseResult<LaneOperationId>;
+export declare function parseLaneEnrollmentId(raw: unknown): DomainIdParseResult<LaneEnrollmentId>;
+export declare function parseLaneOperationIdempotencyKey(raw: unknown): DomainIdParseResult<LaneOperationIdempotencyKey>;
+export declare function parseLinkedDeviceEnrollmentId(raw: unknown): DomainIdParseResult<LinkedDeviceEnrollmentId>;
+export declare function parseWalletRecoveryOperationId(raw: unknown): DomainIdParseResult<WalletRecoveryOperationId>;
+export declare function parseEd25519YaoSuiteId(raw: unknown): DomainIdParseResult<Ed25519YaoSuiteId>;
+export declare function parseEcdsaRelayerKeyId(raw: unknown): DomainIdParseResult<EcdsaRelayerKeyId>;
+export declare function parseLaneHolderRecipientHandleV1(raw: unknown): DomainIdParseResult<LaneHolderRecipientHandleV1>;
+export declare function parseLinkDeviceSessionId(raw: unknown): DomainIdParseResult<LinkDeviceSessionId>;
+export {};
+//# sourceMappingURL=domainIds.d.ts.map

package/dist/types/shared-ts/src/utils/domainIds.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=domainIds.typecheck.d.ts.map

package/dist/types/shared-ts/src/utils/ecdsaCapabilityActivation.d.ts

@@ -0,0 +1,29 @@
+type EcdsaCapabilityBrand<TName extends string> = {
+    readonly __ecdsaCapabilityBrand: TName;
+};
+export type EvmFamilyEcdsaSignerId = string & EcdsaCapabilityBrand<'EvmFamilyEcdsaSignerId'>;
+export type EcdsaServerGeneration = string & EcdsaCapabilityBrand<'EcdsaServerGeneration'>;
+export type EcdsaCapabilityManifestId = string & EcdsaCapabilityBrand<'EcdsaCapabilityManifestId'>;
+export type EcdsaCapabilityManifestRevision = number & EcdsaCapabilityBrand<'EcdsaCapabilityManifestRevision'>;
+export type EcdsaCiphertextDigest = string & EcdsaCapabilityBrand<'EcdsaCiphertextDigest'>;
+export type EcdsaPendingCiphertextDigest = string & EcdsaCapabilityBrand<'EcdsaPendingCiphertextDigest'>;
+export type EcdsaActivationDigest = string & EcdsaCapabilityBrand<'EcdsaActivationDigest'>;
+export type EcdsaLifecycleId = string & EcdsaCapabilityBrand<'EcdsaLifecycleId'>;
+export type EcdsaMaterialSealingKeyId = string & EcdsaCapabilityBrand<'EcdsaMaterialSealingKeyId'>;
+export type EcdsaIv12B64u = string & EcdsaCapabilityBrand<'EcdsaIv12B64u'>;
+export type EcdsaCiphertextB64u = string & EcdsaCapabilityBrand<'EcdsaCiphertextB64u'>;
+export type CanonicalEcdsaServerActivationRequest = string & EcdsaCapabilityBrand<'CanonicalEcdsaServerActivationRequest'>;
+export declare function parseEvmFamilyEcdsaSignerId(value: unknown): EvmFamilyEcdsaSignerId;
+export declare function parseEcdsaServerGeneration(value: unknown): EcdsaServerGeneration;
+export declare function parseEcdsaCapabilityManifestId(value: unknown): EcdsaCapabilityManifestId;
+export declare function parseEcdsaCapabilityManifestRevision(value: unknown): EcdsaCapabilityManifestRevision;
+export declare function parseEcdsaCiphertextDigest(value: unknown): EcdsaCiphertextDigest;
+export declare function parseEcdsaPendingCiphertextDigest(value: unknown): EcdsaPendingCiphertextDigest;
+export declare function parseEcdsaActivationDigest(value: unknown): EcdsaActivationDigest;
+export declare function parseEcdsaLifecycleId(value: unknown): EcdsaLifecycleId;
+export declare function parseEcdsaMaterialSealingKeyId(value: unknown): EcdsaMaterialSealingKeyId;
+export declare function parseEcdsaIv12B64u(value: unknown): EcdsaIv12B64u;
+export declare function parseEcdsaCiphertextB64u(value: unknown): EcdsaCiphertextB64u;
+export declare function parseCanonicalEcdsaServerActivationRequest(value: unknown): CanonicalEcdsaServerActivationRequest;
+export {};
+//# sourceMappingURL=ecdsaCapabilityActivation.d.ts.map

package/dist/types/shared-ts/src/utils/ecdsaKeyFactsInventory.d.ts

@@ -0,0 +1,24 @@
+type EcdsaInventoryChainTarget = {
+    kind: 'evm';
+    namespace: 'eip155';
+    chainId: number;
+    networkSlug?: string;
+} | {
+    kind: 'tempo';
+    chainId: number;
+    networkSlug?: string;
+};
+export type WalletEcdsaKeyFactsInventoryChallengeInput = {
+    walletId: string;
+    rpId: string;
+    keyTargets: readonly {
+        keyHandle: string;
+        chainTarget: EcdsaInventoryChainTarget;
+    }[];
+    runtimePolicyScope?: unknown;
+    serverNonceB64u: string;
+};
+export declare function canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input: WalletEcdsaKeyFactsInventoryChallengeInput): string;
+export declare function computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u(input: WalletEcdsaKeyFactsInventoryChallengeInput): Promise<string>;
+export {};
+//# sourceMappingURL=ecdsaKeyFactsInventory.d.ts.map

package/dist/types/shared-ts/src/utils/emailOtpDomain.d.ts

@@ -0,0 +1,30 @@
+export declare const EMAIL_OTP_CHANNEL: "email_otp";
+export declare const EMAIL_OTP_INITIAL_ENROLLMENT_VERSION: "1";
+export declare function emailOtpDeviceEnrollmentId(walletId: string, providerSubject: string): string;
+export declare const WALLET_UNLOCK_BACKENDS: readonly ["passkey", "email_otp"];
+export type WalletUnlockBackend = (typeof WALLET_UNLOCK_BACKENDS)[number];
+export type WalletEmailOtpChannel = typeof EMAIL_OTP_CHANNEL;
+export declare const WALLET_EMAIL_OTP_LOGIN_OPERATIONS: readonly ["wallet_unlock", "transaction_sign", "export_key"];
+export type WalletEmailOtpLoginOperation = (typeof WALLET_EMAIL_OTP_LOGIN_OPERATIONS)[number];
+export declare const WALLET_EMAIL_OTP_REGISTRATION_OPERATION: "registration";
+/** Linked-device enrollment (Refactor 103 Phase 6): prove control of the
+ * wallet's enrolled email destination to complete one device link. */
+export declare const WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION: "device_link";
+export type WalletEmailOtpOperation = WalletEmailOtpLoginOperation | typeof WALLET_EMAIL_OTP_REGISTRATION_OPERATION | typeof WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION;
+export declare const WALLET_EMAIL_OTP_ACTIONS: {
+    readonly login: "wallet_email_otp_login";
+    readonly registration: "wallet_email_otp_registration";
+    readonly recoveryBootstrap: "wallet_email_otp_recovery_bootstrap";
+    readonly unseal: "wallet_email_otp_unseal";
+    readonly deviceLink: "wallet_email_otp_device_link";
+};
+export type WalletEmailOtpAction = (typeof WALLET_EMAIL_OTP_ACTIONS)[keyof typeof WALLET_EMAIL_OTP_ACTIONS];
+export declare const WALLET_EMAIL_OTP_EXPORT_OPERATION: "export_key";
+export declare const WALLET_EMAIL_OTP_UNLOCK_OPERATION: "wallet_unlock";
+export declare const WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION: "transaction_sign";
+export type WalletEmailOtpExportOperation = typeof WALLET_EMAIL_OTP_EXPORT_OPERATION;
+export type WalletEmailOtpTransactionSignOperation = typeof WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION;
+export type WalletEmailOtpUnlockOperation = typeof WALLET_EMAIL_OTP_UNLOCK_OPERATION;
+export declare function isWalletUnlockBackend(value: string): value is WalletUnlockBackend;
+export declare function isWalletEmailOtpLoginOperation(value: string): value is WalletEmailOtpLoginOperation;
+//# sourceMappingURL=emailOtpDomain.d.ts.map

package/dist/types/shared-ts/src/utils/emailOtpRecoveryKey.d.ts

@@ -0,0 +1,31 @@
+export declare const EMAIL_OTP_RECOVERY_KEY_COUNT: 10;
+export declare const EMAIL_OTP_RECOVERY_KEY_BYTE_LENGTH: 20;
+export declare const EMAIL_OTP_RECOVERY_KEY_CHAR_LENGTH: 32;
+export declare const EMAIL_OTP_RECOVERY_KEY_GROUP_COUNT: 8;
+export declare const EMAIL_OTP_RECOVERY_KEY_GROUP_LENGTH: 4;
+export declare const EMAIL_OTP_RECOVERY_KEY_ALPHABET: "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+declare const emailOtpRecoveryCodeBrand: unique symbol;
+export type EmailOtpRecoveryCode = string & {
+    readonly [emailOtpRecoveryCodeBrand]: 'EmailOtpRecoveryCode';
+};
+export type EmailOtpRecoveryCodeSet = readonly [
+    EmailOtpRecoveryCode,
+    EmailOtpRecoveryCode,
+    EmailOtpRecoveryCode,
+    EmailOtpRecoveryCode,
+    EmailOtpRecoveryCode,
+    EmailOtpRecoveryCode,
+    EmailOtpRecoveryCode,
+    EmailOtpRecoveryCode,
+    EmailOtpRecoveryCode,
+    EmailOtpRecoveryCode
+];
+export declare function encodeEmailOtpRecoveryKeyBytes(bytes: Uint8Array): string;
+export declare function formatEmailOtpRecoveryKey(normalizedKey: string): EmailOtpRecoveryCode;
+export declare function buildEmailOtpRecoveryCodeSet(keys: readonly string[]): EmailOtpRecoveryCodeSet;
+export declare function normalizeEmailOtpRecoveryKey(input: string): string;
+export declare function decodeEmailOtpRecoveryKey(input: string): Uint8Array;
+export declare function generateEmailOtpRecoveryKey(): string;
+export declare function generateEmailOtpRecoveryKeySet(): EmailOtpRecoveryCodeSet;
+export {};
+//# sourceMappingURL=emailOtpRecoveryKey.d.ts.map

package/dist/types/shared-ts/src/utils/encoders.d.ts

@@ -0,0 +1,3 @@
+export { base64Encode, base64Decode, base64UrlEncode, base64UrlDecode } from './base64';
+export { base58Decode, base58Encode } from './base58';
+//# sourceMappingURL=encoders.d.ts.map

package/dist/types/shared-ts/src/utils/errors.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Centralized error handling utilities for the Passkey SDK
+ */
+export { formatNearRpcError, getNearShortErrorMessage } from './near';
+/**
+ * Best-effort error message extractor without relying on `any`.
+ * Always returns a string (may be empty when nothing usable can be derived).
+ */
+export declare function errorMessage(err: unknown): string;
+export declare function redactSensitiveErrorText(input: string): string;
+export declare function safeErrorMessage(err: unknown): string;
+export declare function errorLogSummary(err: unknown): {
+    name: string;
+    message: string;
+};
+/**
+ * Normalize any thrown value into an Error instance.
+ * - preserves message/name/stack when available
+ * - best-effort copies optional code/details properties if present
+ */
+export declare function toError(e: unknown): Error;
+/**
+ * Check if an error is related to user cancellation of TouchID/FaceID prompt
+ * @param error - The error object or error message string
+ * @returns true if the error indicates user cancellation
+ */
+export declare function isTouchIdCancellationError(error: unknown): boolean;
+export declare function isWebAuthnRpIdOriginConfigurationError(error: unknown): boolean;
+export declare function isUserCancellationError(error: unknown): boolean;
+/**
+ * Get a user-friendly error message for TouchID/FaceID cancellation
+ * @param context - The context where the cancellation occurred (e.g., 'registration', 'login')
+ * @returns A user-friendly error message
+ */
+export declare function getTouchIdCancellationMessage(context: 'registration' | 'login'): string;
+/**
+ * Transform an error message to be more user-friendly
+ * @param error - The original error object or message
+ * @param context - The context where the error occurred
+ * @param accountId - Optional account ID for context-specific messages
+ * @returns A user-friendly error message
+ */
+export declare function getUserFriendlyErrorMessage(error: unknown, context?: 'registration' | 'login', accountId?: string): string;
+//# sourceMappingURL=errors.d.ts.map

package/dist/types/shared-ts/src/utils/evmRpcResults.d.ts

@@ -0,0 +1,31 @@
+export type EvmTransactionReceipt = {
+    blockNumber?: string | null;
+    status?: string | null;
+    gasUsed?: string | null;
+    effectiveGasPrice?: string | null;
+    gasPrice?: string | null;
+};
+export type EvmTransactionByHash = {
+    blockNumber?: string | null;
+    from?: string | null;
+    nonce?: string | null;
+    to?: string | null;
+    input?: string | null;
+    value?: string | null;
+    calls?: readonly {
+        to?: string | null;
+        input?: string | null;
+        data?: string | null;
+        value?: string | null;
+    }[] | null;
+};
+export type EvmBlockHeader = {
+    number?: string | null;
+    baseFeePerGas?: string | null;
+};
+export declare function parseRpcHexQuantity(value: unknown, label: string): bigint;
+export declare function decodeEvmTransactionReceipt(value: unknown): EvmTransactionReceipt | null;
+export declare function decodeEvmBlockHeader(value: unknown): EvmBlockHeader | null;
+export declare function decodeEvmTransactionCall(value: unknown): NonNullable<EvmTransactionByHash['calls']>[number];
+export declare function decodeEvmTransactionByHash(value: unknown): EvmTransactionByHash | null;
+//# sourceMappingURL=evmRpcResults.d.ts.map

package/dist/types/shared-ts/src/utils/generated/routerAbEd25519YaoCore.d.ts

@@ -0,0 +1,128 @@
+export type RouterAbEd25519YaoBytes32V1 = readonly number[];
+export type RouterAbEd25519YaoSessionIdV1 = RouterAbEd25519YaoBytes32V1;
+export type RouterAbEd25519YaoStableKeyContextBindingV1 = RouterAbEd25519YaoBytes32V1;
+export type RouterAbEd25519YaoRootShareEpochV1 = string;
+export type RouterAbEd25519YaoPrimitiveRequestKindV1 = "registration" | "recovery" | "export" | "refresh";
+export type RouterAbEd25519YaoWorkKindV1 = "registration_prepare" | "key_export" | "recovery" | "server_share_refresh";
+export type RouterAbRequestPolicyClaimsV1 = {
+    /**
+     * Deployment policy revision used to admit the request.
+     */
+    policyVersion: string;
+    /**
+     * Protected work class.
+     */
+    workKind: RouterAbEd25519YaoWorkKindV1;
+    /**
+     * Canonical digest of the request carried to Router.
+     */
+    requestDigest: RouterAbEd25519YaoPublicDigestV1;
+};
+export type RouterAbEd25519YaoAdmittedLifecycleV1 = {
+    /**
+     * Router-assigned lifecycle id.
+     */
+    lifecycle_id: string;
+    /**
+     * Product-level protected work kind.
+     */
+    work_kind: RouterAbEd25519YaoWorkKindV1;
+    /**
+     * Primitive derivation request kind.
+     */
+    primitive_request_kind: RouterAbEd25519YaoPrimitiveRequestKindV1;
+    /**
+     * Public signing-root share epoch used by this ceremony.
+     */
+    root_share_epoch: RouterAbEd25519YaoRootShareEpochV1;
+    /**
+     * Canonical account or wallet id.
+     */
+    account_id: string;
+    /**
+     * Canonical session id.
+     */
+    session_id: string;
+    /**
+     * Signer set id bound into the transcript.
+     */
+    signer_set_id: string;
+    /**
+     * Selected server identity.
+     */
+    selected_server_id: string;
+};
+export type RouterAbMpcMaterialActivationRefKindV1 = "mpc_material_activation_ref";
+export type RouterAbMpcMaterialActivationRefV1 = {
+    /**
+     * Wire discriminant.
+     */
+    kind: RouterAbMpcMaterialActivationRefKindV1;
+    /**
+     * Opaque activation id.
+     */
+    activation_id: string;
+    /**
+     * Activated capability instance.
+     */
+    capability: string;
+    /**
+     * Owner of the activated material.
+     */
+    material_owner: string;
+    /**
+     * Public-key binding.
+     */
+    key_binding: string;
+    /**
+     * Lifecycle binding.
+     */
+    lifecycle_binding: string;
+    /**
+     * SigningWorker that owns the live material.
+     */
+    signing_worker: string;
+};
+export type RouterAbEd25519YaoCircuitFamilyV1 = "activation" | "export" | "lane_materialization";
+export type RouterAbEd25519YaoOperationV1 = "registration" | "recovery" | "refresh" | "export" | "lane_provisioning" | "lane_refresh";
+export type RouterAbEd25519YaoCeremonyBindingV1 = {
+    /**
+     * Product lifecycle and authenticated application scope.
+     */
+    lifecycle: RouterAbEd25519YaoAdmittedLifecycleV1;
+    /**
+     * Lifecycle operation selecting one fixed circuit family.
+     */
+    operation: RouterAbEd25519YaoOperationV1;
+    /**
+     * Transcript session id derived from the admitted request.
+     */
+    session_id: RouterAbEd25519YaoSessionIdV1;
+    /**
+     * Canonical stable KDF-context binding admitted by the Router.
+     */
+    stable_key_context_binding: RouterAbEd25519YaoStableKeyContextBindingV1;
+    material_activation: RouterAbMpcMaterialActivationRefV1;
+};
+export type RouterAbEd25519YaoCircuitIdV1 = "activation_v1" | "export_v1" | "lane_materialization_v1";
+export type RouterAbEd25519YaoProtocolIdV1 = "v1";
+export type RouterAbEd25519YaoCeremonyIdentityV1 = {
+    binding: RouterAbEd25519YaoCeremonyBindingV1;
+    circuit: RouterAbEd25519YaoCircuitIdV1;
+    protocol: RouterAbEd25519YaoProtocolIdV1;
+};
+export type RouterAbEd25519YaoPublicDigestV1 = {
+    /**
+     * Digest bytes.
+     */
+    bytes: RouterAbEd25519YaoBytes32V1;
+};
+export type RouterAbEd25519YaoInputPairBindingV1 = {
+    ceremony: RouterAbEd25519YaoCeremonyIdentityV1;
+    deriver_a_input_digest: RouterAbEd25519YaoPublicDigestV1;
+    deriver_b_input_digest: RouterAbEd25519YaoPublicDigestV1;
+    recipient_set_digest: RouterAbEd25519YaoPublicDigestV1;
+    authorization_digest: RouterAbEd25519YaoPublicDigestV1;
+    pair_digest: RouterAbEd25519YaoPublicDigestV1;
+};
+//# sourceMappingURL=routerAbEd25519YaoCore.d.ts.map

package/dist/types/shared-ts/src/utils/index.d.ts

@@ -0,0 +1,34 @@
+export * from './encoders';
+export * from './signerSlot';
+export * from './normalize';
+export * from './validation';
+export * from './errors';
+export * from './emailOtpDomain';
+export * from './signerDomain';
+export * from './near';
+export * from './digests';
+export * from './theme';
+export * from './keccak';
+export * from './jsonRpc';
+export * from './nearRpcResults';
+export * from './recoveryDomain';
+export * from './paillier';
+export * from './signingSessionSeal';
+export * from './emailOtpRecoveryKey';
+export * from './addAuthMethodRegistration';
+export * from './addWalletAuthMethod';
+export * from './registrationIntent';
+export * from './domainIds';
+export * from './webauthnDeviceInfo';
+export * from './walletCapabilityBindings';
+export * from './walletAuthAuthority';
+export * from './ecdsaKeyFactsInventory';
+export * from './secureRandomId';
+export * from './routerAbPublicKeyset';
+export * from './routerAbEcdsaDerivation';
+export * from './routerAbEd25519Yao';
+export * from './routerAbTraceContext';
+export * from './authenticatorOptions';
+export * from './canonicalPrimitives';
+export * from './ecdsaCapabilityActivation';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/shared-ts/src/utils/jsonRpc.d.ts

@@ -0,0 +1,30 @@
+export type JsonRpcId = string | number | null;
+export type JsonRpcErrorDetails = {
+    code?: number | string;
+    name?: string;
+    message: string;
+    data?: unknown;
+    cause?: unknown;
+};
+export type JsonRpcEnvelope = {
+    kind: 'success';
+    id: JsonRpcId;
+    result: unknown;
+    error?: never;
+} | {
+    kind: 'failure';
+    id: JsonRpcId;
+    error: JsonRpcErrorDetails;
+    result?: never;
+};
+export type JsonRpcEnvelopeDecodeResult = {
+    ok: true;
+    value: JsonRpcEnvelope;
+    error?: never;
+} | {
+    ok: false;
+    error: string;
+    value?: never;
+};
+export declare function decodeJsonRpcEnvelope(value: unknown): JsonRpcEnvelopeDecodeResult;
+//# sourceMappingURL=jsonRpc.d.ts.map

package/dist/types/shared-ts/src/utils/keccak.d.ts

@@ -0,0 +1,2 @@
+export declare function keccak256Bytes(input: Uint8Array): Uint8Array;
+//# sourceMappingURL=keccak.d.ts.map