@seams/wallet-server 0.5.0

package/dist/types/shared-ts/src/utils/registrationIntent.d.ts

@@ -0,0 +1,621 @@
+import type { ChallengeSubjectId, EmailOtpChallengeId, EmailOtpProviderUserId, OrgId, ProviderSubject, WalletAuthorityId, WalletAuthMethodId, WalletId, WebAuthnCredentialIdB64u, WebAuthnRpId } from './domainIds';
+import { type DigestB64u } from './canonicalPrimitives';
+import type { EmailOtpProvider } from './walletAuthAuthority';
+import type { WebAuthnAuthenticatorDeviceInfo } from './webauthnDeviceInfo';
+import { type ImplicitNearAccountId, type NamedNearAccountId } from './near';
+export type { WalletId, WebAuthnRpId } from './domainIds';
+export type { ImplicitNearAccountId, NamedNearAccountId, NearAccountId } from './near';
+export type RegistrationIntentGrant = string & {
+    readonly __registrationIntentGrantBrand: unique symbol;
+};
+export type AddAuthMethodIntentGrant = string & {
+    readonly __addAuthMethodIntentGrantBrand: unique symbol;
+};
+export type AddSignerIntentGrant = string & {
+    readonly __addSignerIntentGrantBrand: unique symbol;
+};
+export type ServerAllocatedWalletId = WalletId & {
+    readonly __serverAllocatedWalletIdBrand: unique symbol;
+};
+export type NearEd25519SigningKeyId = string & {
+    readonly __nearEd25519SigningKeyIdBrand: unique symbol;
+};
+export type RegisterWalletInput = {
+    kind: 'server_allocated';
+    walletId?: never;
+} | {
+    kind: 'provided';
+    walletId: WalletId;
+};
+export type PasskeyRegistrationAuthMethodInput = {
+    kind: 'passkey';
+    rpId: WebAuthnRpId;
+    authenticatorOptions?: unknown;
+    email?: never;
+    otpCode?: never;
+    challengeId?: never;
+};
+export type EmailOtpRegistrationAuthMethodInput = {
+    kind: 'email_otp';
+    proofKind: 'otp_challenge';
+    email: string;
+    providerSubject: string;
+    otpCode: string;
+    challengeId?: string;
+    rpId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+    authenticatorOptions?: never;
+} | {
+    kind: 'email_otp';
+    proofKind: 'google_sso_registration';
+    email: string;
+    providerSubject: string;
+    googleEmailOtpRegistrationAttemptId: string;
+    googleEmailOtpRegistrationOfferId: string;
+    googleEmailOtpRegistrationCandidateId: string;
+    rpId?: never;
+    otpCode?: never;
+    challengeId?: never;
+    authenticatorOptions?: never;
+};
+export type RegistrationAuthMethodInput = PasskeyRegistrationAuthMethodInput | EmailOtpRegistrationAuthMethodInput;
+export type AddAuthMethodInput = {
+    kind: 'passkey';
+    rpId: WebAuthnRpId;
+    email?: never;
+    otpCode?: never;
+    challengeId?: never;
+    authenticatorOptions?: never;
+} | {
+    kind: 'email_otp';
+    email: string;
+    rpId?: never;
+    otpCode?: never;
+    challengeId?: never;
+    authenticatorOptions?: never;
+};
+export type WalletAuthMethodRevocationProof = {
+    readonly kind: 'webauthn_assertion';
+    rpId: WebAuthnRpId;
+    credential: unknown;
+    expectedChallengeDigestB64u: string;
+} | {
+    readonly kind: 'email_otp';
+    readonly challengeId: string;
+    readonly otpCode: string;
+    readonly ownerProofBindingDigest: string;
+};
+export declare function computeWalletAuthMethodRevokeOperationFingerprintV1(input: {
+    readonly walletId: WalletId;
+    readonly targetWalletAuthMethodId: WalletAuthMethodId;
+    readonly requestedAtMs: number;
+}): Promise<DigestB64u>;
+export type RegistrationAuthority = {
+    kind: 'passkey';
+    walletId: WalletId;
+    rpId: WebAuthnRpId;
+    credentialIdB64u: string;
+    credentialPublicKeyB64u: string;
+    counter: number;
+    /** Device metadata captured at registration verification (UA + attestation). */
+    device: WebAuthnAuthenticatorDeviceInfo;
+    registrationIntentDigestB64u: string;
+    providerSubject?: never;
+    challengeSubjectId?: never;
+    email?: never;
+    emailHashHex?: never;
+    registrationAuthorityId?: never;
+    challengeId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    originalWalletId?: never;
+    finalWalletId?: never;
+    orgId?: never;
+    challengePurpose?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+} | {
+    kind: 'email_otp';
+    proofKind: 'otp_challenge';
+    walletId: WalletId;
+    /** OIDC provider subject verified for the OTP registration proof. */
+    providerSubject: ProviderSubject;
+    /** Challenge owner verified against the OTP challenge record. */
+    challengeSubjectId: ChallengeSubjectId;
+    /** Normalized email address that received and verified the OTP. */
+    email: string;
+    emailHashHex: string;
+    challengeId: EmailOtpChallengeId;
+    registrationAuthorityId: EmailOtpChallengeId;
+    /** Wallet id attached to the original OTP challenge before any name reroll. */
+    originalWalletId: WalletId;
+    /** Final wallet id selected for registration. */
+    finalWalletId: WalletId;
+    /** Tenant scope verified against the OTP challenge record. */
+    orgId: OrgId;
+    /** Operation-bound owner proof digest verified against the OTP challenge record. */
+    ownerProofBindingDigest: string;
+    challengePurpose: 'registration' | 'registration_reroll';
+    registrationIntentDigestB64u: string;
+    credentialIdB64u?: never;
+    credentialPublicKeyB64u?: never;
+    counter?: never;
+    device?: never;
+    rpId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+} | {
+    kind: 'email_otp';
+    proofKind: 'google_sso_registration';
+    walletId: WalletId;
+    providerSubject: ProviderSubject;
+    email: string;
+    emailHashHex: string;
+    googleEmailOtpRegistrationAttemptId: string;
+    googleEmailOtpRegistrationOfferId: string;
+    googleEmailOtpRegistrationCandidateId: string;
+    registrationAuthorityId: string;
+    finalWalletId: WalletId;
+    orgId: OrgId;
+    ownerProofBindingDigest: string;
+    registrationIntentDigestB64u: string;
+    challengeSubjectId?: never;
+    challengeId?: never;
+    originalWalletId?: never;
+    challengePurpose?: never;
+    credentialIdB64u?: never;
+    credentialPublicKeyB64u?: never;
+    counter?: never;
+    device?: never;
+    rpId?: never;
+};
+export type EmailOtpRegistrationProof = {
+    version: 'email_otp_registration_proof_v1';
+    proofKind: 'otp_challenge';
+    providerSubject: string;
+    /** Normalized email address that received the OTP. */
+    email: string;
+    challengeId: string;
+    otpCode: string;
+    otpChannel: 'email_otp';
+    /** Registration intent digest that binds the OTP proof to the wallet-registration request. */
+    registrationIntentDigestB64u: string;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+} | {
+    version: 'email_otp_registration_proof_v1';
+    proofKind: 'google_sso_registration';
+    providerSubject: string;
+    email: string;
+    googleEmailOtpRegistrationAttemptId: string;
+    googleEmailOtpRegistrationOfferId: string;
+    googleEmailOtpRegistrationCandidateId: string;
+    registrationIntentDigestB64u: string;
+    challengeId?: never;
+    otpCode?: never;
+    otpChannel?: never;
+};
+export type WalletAuthMethodRecord = {
+    version: 'wallet_auth_method_v1';
+    kind: 'passkey';
+    status: 'active' | 'revoked';
+    walletId: WalletId;
+    rpId: WebAuthnRpId;
+    credentialIdB64u: string;
+    credentialPublicKeyB64u: string;
+    counter: number;
+    createdAtMs: number;
+    updatedAtMs: number;
+    emailHashHex?: never;
+    challengeId?: never;
+} | {
+    version: 'wallet_auth_method_v1';
+    kind: 'email_otp';
+    status: 'active' | 'revoked';
+    walletId: WalletId;
+    emailHashHex: string;
+    registrationAuthorityId: string;
+    createdAtMs: number;
+    updatedAtMs: number;
+    rpId?: never;
+    credentialIdB64u?: never;
+    credentialPublicKeyB64u?: never;
+    counter?: never;
+};
+export type WalletAuthMethodLifecycleV1 = {
+    readonly status: 'pending_local_install';
+    readonly activatedAtMs?: never;
+    readonly revokedAtMs?: never;
+} | {
+    readonly status: 'active';
+    readonly activatedAtMs: number;
+    readonly revokedAtMs?: never;
+} | {
+    readonly status: 'revoked';
+    readonly activatedAtMs: number;
+    readonly revokedAtMs: number;
+};
+type WalletAuthMethodDraftCommonV1 = {
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly walletId: WalletId;
+    readonly createdAtMs: number;
+};
+export type PasskeyWalletAuthMethodDraftV1 = WalletAuthMethodDraftCommonV1 & {
+    readonly kind: 'passkey';
+    readonly rpId: WebAuthnRpId;
+    readonly credentialIdB64u: WebAuthnCredentialIdB64u;
+    readonly credentialPublicKeyB64u: string;
+    readonly counter: number;
+    readonly emailHashHex?: never;
+    readonly registrationAuthorityId?: never;
+};
+export type EmailOtpWalletAuthMethodDraftV1 = WalletAuthMethodDraftCommonV1 & {
+    readonly kind: 'email_otp';
+    readonly emailHashHex: string;
+    readonly registrationAuthorityId: string;
+    readonly rpId?: never;
+    readonly credentialIdB64u?: never;
+    readonly credentialPublicKeyB64u?: never;
+    readonly counter?: never;
+};
+export type WalletAuthMethodCommonV1 = {
+    readonly version: 'wallet_auth_method_v2';
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly walletId: WalletId;
+    readonly walletAuthorityId: WalletAuthorityId;
+    readonly createdAtMs: number;
+    readonly updatedAtMs: number;
+};
+export type WalletAuthMethodRecordV2 = WalletAuthMethodCommonV1 & ((PasskeyWalletAuthMethodDraftV1 & WalletAuthMethodLifecycleV1) | (EmailOtpWalletAuthMethodDraftV1 & WalletAuthMethodLifecycleV1));
+export declare function sameWalletAuthMethodRecordV2(left: WalletAuthMethodRecordV2, right: WalletAuthMethodRecordV2): boolean;
+export declare function buildWalletAuthMethodRecordV2(input: WalletAuthMethodRecordV2): WalletAuthMethodRecordV2;
+export declare function parseWalletAuthMethodRecordV2(raw: unknown): WalletAuthMethodRecordV2 | null;
+export declare function walletAuthMethodRecordId(record: WalletAuthMethodRecord): WalletAuthMethodId;
+export type RegistrationNearAccountProvisioning = {
+    kind: 'implicit_account';
+    accountIdSource: 'ed25519_public_key';
+    requestedAccountId?: never;
+    sponsor?: never;
+} | {
+    kind: 'sponsored_named_account';
+    requestedAccountId: NamedNearAccountId;
+    sponsor: 'relayer';
+    accountIdSource?: never;
+};
+export type ResolvedRegistrationNearAccount = {
+    kind: 'implicit_account';
+    nearAccountId: ImplicitNearAccountId;
+    nearEd25519SigningKeyId: NearEd25519SigningKeyId;
+    transactionHash?: never;
+} | {
+    kind: 'sponsored_named_account';
+    nearAccountId: NamedNearAccountId;
+    nearEd25519SigningKeyId: NearEd25519SigningKeyId;
+    transactionHash: string;
+};
+export type ThresholdEd25519RegistrationSpec = {
+    accountProvisioning: RegistrationNearAccountProvisioning;
+    signerSlot: number;
+    participantIds: number[];
+    keyPurpose: string;
+    keyVersion: string;
+    derivationVersion: number;
+};
+export type ThresholdEcdsaRegistrationSpec = {
+    chainTargets: unknown[];
+    participantIds: number[];
+};
+export type ThresholdEd25519AddSignerSpec = {
+    mode: 'create_implicit_near_account';
+    signerSlot: number;
+    participantIds: number[];
+    keyPurpose: string;
+    keyVersion: string;
+    derivationVersion: number;
+};
+export type ThresholdEcdsaAddSignerChainTarget = {
+    readonly kind: 'evm';
+    readonly namespace: 'eip155';
+    readonly chainId: number;
+    readonly networkSlug?: string;
+} | {
+    readonly kind: 'tempo';
+    readonly chainId: number;
+    readonly networkSlug?: string;
+};
+export type ThresholdEcdsaAddSignerSpec = {
+    chainTargets: readonly ThresholdEcdsaAddSignerChainTarget[];
+    participantIds: number[];
+};
+export type RegistrationSignerBranchKey = string & {
+    readonly __registrationSignerBranchKeyBrand: unique symbol;
+};
+export type RegistrationNearEd25519SignerRequest = {
+    kind: 'near_ed25519';
+    accountProvisioning: RegistrationNearAccountProvisioning;
+    signerSlot: number;
+    participantIds: readonly number[];
+    derivationVersion: number;
+    keyPurpose?: never;
+    keyVersion?: never;
+    chainTargets?: never;
+};
+export type RegistrationEvmFamilyEcdsaSignerRequest = {
+    kind: 'evm_family_ecdsa';
+    participantIds: readonly number[];
+    chainTargets: readonly unknown[];
+    accountProvisioning?: never;
+    signerSlot?: never;
+    keyPurpose?: never;
+    keyVersion?: never;
+    derivationVersion?: never;
+};
+export type RegistrationSignerRequest = RegistrationNearEd25519SignerRequest | RegistrationEvmFamilyEcdsaSignerRequest;
+export type RegistrationSignerSetSelection = {
+    kind: 'signer_set';
+    signers: readonly RegistrationSignerRequest[];
+    mode?: never;
+    ed25519?: never;
+    ecdsa?: never;
+};
+export type RegistrationNearEd25519SignerPlan = {
+    kind: 'near_ed25519';
+    branchKey: RegistrationSignerBranchKey;
+    accountProvisioning: RegistrationNearAccountProvisioning;
+    signerSlot: number;
+    participantIds: readonly number[];
+    keyPurpose: string;
+    keyVersion: string;
+    derivationVersion: number;
+    chainTargets?: never;
+};
+export type RegistrationEvmFamilyEcdsaSignerPlan = RegistrationEvmFamilyEcdsaSignerRequest & {
+    branchKey: RegistrationSignerBranchKey;
+};
+export type RegistrationSignerPlanBranch = RegistrationNearEd25519SignerPlan | RegistrationEvmFamilyEcdsaSignerPlan;
+export type RegistrationSignerPlan = {
+    kind: 'signer_set';
+    branches: readonly RegistrationSignerPlanBranch[];
+};
+export type AddSignerSelection = {
+    mode: 'ed25519';
+    ed25519: ThresholdEd25519AddSignerSpec;
+    ecdsa?: never;
+} | {
+    mode: 'ecdsa';
+    ecdsa: ThresholdEcdsaAddSignerSpec;
+    ed25519?: never;
+};
+export type RuntimePolicyScopeLike = {
+    orgId: string;
+    projectId: string;
+    envId: string;
+    signingRootVersion?: string;
+};
+export type RegistrationIntentV1 = {
+    version: 'registration_intent_v1';
+    walletId: WalletId;
+    authMethod: RegistrationAuthMethodInput;
+    signerSelection: RegistrationSignerSetSelection;
+    /**
+     * The wallet's first auth method, allocated with the intent.
+     *
+     * It has to exist before the custody ceremony runs, because every envelope
+     * the ceremony seals names the method that owns it inside its AAD. Allocated
+     * at finalize — where the record is written — it would be a name the seal
+     * could not have used, and the wallet would register with an envelope owned
+     * by nobody.
+     *
+     * Server-allocated and part of the intent digest, so a client can neither
+     * choose it nor swap it between the seal and the commit.
+     */
+    foundingWalletAuthMethodId: WalletAuthMethodId;
+    runtimePolicyScope?: RuntimePolicyScopeLike;
+    nonceB64u: string;
+};
+export type AddSignerIntentV1 = {
+    version: 'add_signer_intent_v1';
+    walletId: WalletId;
+    signerSelection: AddSignerSelection;
+    runtimePolicyScope?: RuntimePolicyScopeLike;
+    nonceB64u: string;
+};
+/**
+ * Who is starting the ceremony, and therefore what the source has to present.
+ *
+ * One endpoint serves two operations. Refactor 109C's same-device addition
+ * requires a fresh operation-specific source proof; Refactor 103E's
+ * linked-device ceremony start deliberately does not, because Device 1's owner
+ * Wallet Session is the authority and Device 2 holds the factor. Without this
+ * discriminator the endpoint could not tell them apart, so the weaker
+ * requirement applied to both and a same-device addition could be authorized
+ * by a reusable bearer credential.
+ *
+ * The branch lives on the intent rather than the start request because the
+ * intent is what the source proof signs: a caller cannot present a fresh proof
+ * over a same-device intent and then start a linked-device ceremony with it.
+ */
+export type AddAuthMethodIntentSourceV1 = {
+    readonly walletAuthorityId: WalletAuthorityId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly walletSessionId: string;
+    readonly authorityDigestB64u: string;
+    readonly revocationEpoch: number;
+};
+type AddAuthMethodIntentCommonV1 = {
+    version: 'add_auth_method_intent_v1';
+    walletId: WalletId;
+    authMethod: AddAuthMethodInput;
+    /**
+     * Allocated by the server when the intent is minted, not when the ceremony
+     * starts.
+     *
+     * A source proof has to name the method it is authorizing the creation of.
+     * While this was allocated in `start` — after the source had already been
+     * authenticated — no proof could bind it, and one authorization could have
+     * been replayed against a different target.
+     */
+    targetWalletAuthMethodId: WalletAuthMethodId;
+    runtimePolicyScope?: RuntimePolicyScopeLike;
+    nonceB64u: string;
+};
+export type AddAuthMethodIntentV1 = AddAuthMethodIntentCommonV1 & ({
+    readonly caller: 'same_device_addition';
+    readonly source: AddAuthMethodIntentSourceV1;
+} | {
+    readonly caller: 'linked_device_ceremony';
+    readonly source?: never;
+});
+export declare function walletIdFromString(value: string): WalletId;
+export type ServerAllocatedWalletIdParseResult = {
+    ok: true;
+    value: ServerAllocatedWalletId;
+} | {
+    ok: false;
+    error: {
+        code: 'missing' | 'invalid';
+        message: string;
+    };
+};
+export declare function createServerAllocatedWalletId(): ServerAllocatedWalletId;
+export declare function createReadableWalletId(): WalletId;
+export declare function parseServerAllocatedWalletId(raw: unknown): ServerAllocatedWalletIdParseResult;
+export declare function requireServerAllocatedWalletId(value: unknown): ServerAllocatedWalletId;
+export declare function nearEd25519SigningKeyIdFromString(value: string): NearEd25519SigningKeyId;
+export declare function parseNearEd25519SigningKeyId(value: unknown): NearEd25519SigningKeyId;
+export declare function formatNearEd25519SigningKeyIdForWire(value: NearEd25519SigningKeyId): string;
+export declare function nearEd25519SigningKeyIdFromWalletId(walletId: WalletId): NearEd25519SigningKeyId;
+export type GeneratedImplicitNearEd25519SigningKeyDigestInput = {
+    kind: 'generated_implicit_near_ed25519_signing_key_v1';
+    walletId: ServerAllocatedWalletId;
+    authorityScope: RegistrationEd25519AuthorityScope;
+    signingRootId: string;
+    signingRootVersion: string;
+    signerSlot: number;
+    participantIds: readonly number[];
+    keyPurpose: string;
+    keyVersion: string;
+    derivationVersion: number;
+};
+export declare function computeGeneratedImplicitNearEd25519SigningKeyId(input: GeneratedImplicitNearEd25519SigningKeyDigestInput): Promise<NearEd25519SigningKeyId>;
+export declare function computeAddSignerNearEd25519SigningKeyId(input: {
+    kind: 'wallet_add_signer_implicit_near_ed25519_key_v1';
+    walletId: WalletId;
+    signingRootId: string;
+    signingRootVersion: string;
+    signerSlot: number;
+    participantIds: readonly number[];
+    keyPurpose: string;
+    keyVersion: string;
+    derivationVersion: number;
+}): Promise<NearEd25519SigningKeyId>;
+export type RegistrationEd25519AuthorityScope = {
+    kind: 'passkey';
+    rpId: WebAuthnRpId;
+    proofKind?: never;
+    email?: never;
+    challengeId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+} | {
+    kind: 'email_otp';
+    provider: EmailOtpProvider;
+    providerUserId: EmailOtpProviderUserId;
+    proofKind?: never;
+    rpId?: never;
+    email?: never;
+    challengeId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+};
+export declare function registrationEd25519AuthorityScope(authMethod: Extract<RegistrationAuthMethodInput, {
+    kind: 'passkey';
+}>): Extract<RegistrationEd25519AuthorityScope, {
+    kind: 'passkey';
+}>;
+export declare function registrationEd25519AuthorityScopeFromAuthority(authority: RegistrationAuthority): RegistrationEd25519AuthorityScope;
+export declare function computeRegistrationNearEd25519SigningKeyId(input: {
+    walletId: WalletId;
+    authorityScope: RegistrationEd25519AuthorityScope;
+    signingRootId: string;
+    signingRootVersion: string;
+    ed25519: ThresholdEd25519RegistrationSpec;
+}): Promise<NearEd25519SigningKeyId>;
+export declare function implicitNearAccountProvisioning(): RegistrationNearAccountProvisioning;
+export declare function sponsoredNamedNearAccountProvisioning(requestedAccountId: NamedNearAccountId): RegistrationNearAccountProvisioning;
+export declare function registrationProvisioningScopeKey(provisioning: RegistrationNearAccountProvisioning): string;
+export declare function registrationIntentGrantFromString(value: string): RegistrationIntentGrant;
+export declare function addAuthMethodIntentGrantFromString(value: string): AddAuthMethodIntentGrant;
+export declare function addSignerIntentGrantFromString(value: string): AddSignerIntentGrant;
+export declare function serializeRegistrationIntentV1(intent: RegistrationIntentV1): string;
+export declare function serializeAddSignerIntentV1(intent: AddSignerIntentV1): string;
+export declare function serializeAddAuthMethodIntentV1(intent: AddAuthMethodIntentV1): string;
+export declare function computeRegistrationIntentDigestB64u(intent: RegistrationIntentV1): Promise<string>;
+export declare function computeAddSignerIntentDigestB64u(intent: AddSignerIntentV1): Promise<string>;
+export declare function computeAddAuthMethodIntentDigestB64u(intent: AddAuthMethodIntentV1): Promise<string>;
+export type NormalizeSignerSelectionResult<TSelection> = {
+    ok: true;
+    value: TSelection;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export type NormalizeAddSignerSelectionOptions = {
+    readonly normalizeEcdsaChainTarget: (target: unknown) => ThresholdEcdsaAddSignerChainTarget | null;
+};
+export type RegistrationSignerSetSelectionFromPlanOptions = {
+    readonly normalizeEcdsaChainTarget?: (target: unknown) => unknown | null;
+};
+export declare const NEAR_ED25519_YAO_KEY_VERSION_V1 = "router-ab-ed25519-yao-v1";
+export declare const REGISTRATION_NEAR_ED25519_YAO_DERIVATION_VERSION = 1;
+export declare function registrationSignerBranchKeyFromString(value: string): RegistrationSignerBranchKey;
+export declare function registrationNearEd25519BranchKey(signerSlot: number): RegistrationSignerBranchKey;
+export declare function registrationEvmFamilyEcdsaBranchKey(chainTargets: readonly unknown[]): RegistrationSignerBranchKey;
+export declare function normalizeRegistrationSignerPlan(raw: unknown): NormalizeSignerSelectionResult<RegistrationSignerPlan>;
+export declare function registrationSignerPlanFromSelection(selection: RegistrationSignerSetSelection): NormalizeSignerSelectionResult<RegistrationSignerPlan>;
+export declare function findRegistrationSignerPlanNearEd25519Branch(plan: RegistrationSignerPlan): RegistrationNearEd25519SignerPlan | null;
+export declare function findRegistrationSignerPlanEvmFamilyEcdsaBranch(plan: RegistrationSignerPlan): RegistrationEvmFamilyEcdsaSignerPlan | null;
+export declare function registrationSignerSetSelectionFromPlan(plan: RegistrationSignerPlan, options?: RegistrationSignerSetSelectionFromPlanOptions): NormalizeSignerSelectionResult<RegistrationSignerSetSelection>;
+export declare function normalizeAddSignerSelection(raw: unknown, options: NormalizeAddSignerSelectionOptions): NormalizeSignerSelectionResult<AddSignerSelection>;
+export declare function normalizeRegistrationAuthMethodInput(raw: unknown): RegistrationAuthMethodInput | null;
+export declare function normalizeAddAuthMethodInput(raw: unknown): AddAuthMethodInput | null;
+/**
+ * Parses the caller branch once, at the boundary. Core code below this receives
+ * a branch whose identities are branded and complete, never a partially filled
+ * source it has to re-check.
+ */
+export type AddAuthMethodIntentCallerV1 = {
+    readonly caller: 'same_device_addition';
+    readonly source: AddAuthMethodIntentSourceV1;
+} | {
+    readonly caller: 'linked_device_ceremony';
+};
+export declare function normalizeAddAuthMethodIntentCaller(raw: unknown): AddAuthMethodIntentCallerV1 | null;
+/** True when the two source claims name the same session on the same authority. */
+export declare function sameAddAuthMethodIntentSourceV1(left: AddAuthMethodIntentSourceV1, right: AddAuthMethodIntentSourceV1): boolean;
+export declare function parseAddSignerIntentV1(raw: unknown): AddSignerIntentV1;
+export declare function parseAddAuthMethodIntentV1(raw: unknown): AddAuthMethodIntentV1;
+export declare function sameAddSignerIntentV1(left: AddSignerIntentV1, right: AddSignerIntentV1): boolean;
+export declare function sameAddAuthMethodIntentV1(left: AddAuthMethodIntentV1, right: AddAuthMethodIntentV1): boolean;
+export declare function normalizeEmailOtpRegistrationProof(raw: unknown): EmailOtpRegistrationProof | null;
+/** What a client sends to create a wallet's shared Email OTP enrollment. */
+export type WalletEmailOtpEnrollmentMaterialV1 = {
+    enrollmentSealKeyVersion: string;
+    clientUnlockPublicKeyB64u: string;
+    unlockKeyVersion: string;
+    serverSealedFactorCiphertextB64u: string;
+};
+export type WalletAddAuthMethodEmailOtpTargetV1 = {
+    readonly kind: 'existing_enrollment';
+    readonly enrollment?: never;
+} | {
+    readonly kind: 'new_enrollment';
+    readonly enrollment: WalletEmailOtpEnrollmentMaterialV1;
+};
+//# sourceMappingURL=registrationIntent.d.ts.map

package/dist/types/shared-ts/src/utils/registrationIntent.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=registrationIntent.typecheck.d.ts.map