@seams/wallet-server 0.5.0

package/dist/types/shared-ts/src/utils/signingSessionSeal.d.ts

@@ -0,0 +1,153 @@
+import type { RouterAbEcdsaDerivationNormalSigningStateV1, RouterAbEcdsaDerivationPublicCapabilityV1 } from './routerAbEcdsaDerivation';
+import type { EmailOtpProvider, EmailOtpWalletAuthAuthority, WalletAuthAuthorityRef } from './walletAuthAuthority';
+import type { MpcMaterialActivationRef } from './domainIds';
+import { SIGNER_AUTH_METHODS, type SignerAuthMethod } from './signerDomain';
+export declare const SIGNING_SESSION_SEALED_RECORD_VERSION: 2;
+export declare const SIGNING_SESSION_SEAL_ALG: "shamir3pass-v2";
+export declare const SIGNING_SESSION_SEAL_GROUP_ID: "rfc2409-group2";
+export declare const SIGNING_SESSION_SEAL_STORAGE_SCOPE: "iframe_origin_indexeddb";
+export declare const SIGNING_SESSION_SECRET_KIND: "signing_session_secret32";
+export declare const ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND: "router_ab_ed25519_normal_signing_v1";
+export declare const ROUTER_AB_ED25519_HEALTH_PATH: "/router-ab/ed25519/healthz";
+export declare const ROUTER_AB_ED25519_WALLET_SESSION_PATH: "/router-ab/wallet-session/ed25519";
+export declare const ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH: "/router-ab/ed25519/sign/prepare";
+export declare const ROUTER_AB_ED25519_NORMAL_SIGNING_PATH: "/router-ab/ed25519/sign";
+export declare const WALLET_SESSION_SEAL_BASE_PATH: "/wallet-session/seal";
+export declare const PASSKEY_PRF_FIRST_SALT_V1: Uint8Array<ArrayBuffer>;
+export declare const PASSKEY_PRF_SECOND_SALT_V1: Uint8Array<ArrayBuffer>;
+export declare const EMAIL_OTP_HKDF_SALTS: {
+    readonly signingSessionSecret: "seams/email-otp/signing-session-secret/v1";
+    readonly signingSessionRestoreRoot: "seams/signing-session/restore-root/v1";
+    readonly thresholdEcdsaClientRoot: "seams/signing-session/threshold-ecdsa-client-root/v1";
+    readonly thresholdEd25519RestoreSeed: "seams/signing-session/threshold-ed25519-restore-seed/v1";
+};
+export type SigningSessionSealAuthMethod = Extract<SignerAuthMethod, typeof SIGNER_AUTH_METHODS.passkey | typeof SIGNER_AUTH_METHODS.emailOtp>;
+export type SigningSessionSealCurve = 'ed25519' | 'ecdsa';
+export type SigningSessionSealGroupId = typeof SIGNING_SESSION_SEAL_GROUP_ID;
+export type SigningSessionSealProtocol = {
+    algorithm: typeof SIGNING_SESSION_SEAL_ALG;
+    groupId: SigningSessionSealGroupId;
+};
+export type SealedSigningSessionEcdsaRestoreSource = 'login' | 'registration' | 'manual-bootstrap' | 'email_otp';
+export type RouterAbEd25519NormalSigningState = {
+    kind: typeof ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND;
+    signingWorkerId: string;
+};
+export declare function parseRouterAbEd25519NormalSigningState(value: unknown): RouterAbEd25519NormalSigningState | null;
+export declare function requireRouterAbEd25519NormalSigningState(value: unknown): RouterAbEd25519NormalSigningState;
+export type SealedSigningSessionEcdsaChainTarget = {
+    kind: 'tempo';
+    chainId: number;
+    networkSlug: string;
+} | {
+    kind: 'evm';
+    namespace: 'eip155';
+    chainId: number;
+    networkSlug: string;
+};
+type SealedSigningSessionEcdsaRestoreMetadataBase = {
+    chainTarget: SealedSigningSessionEcdsaChainTarget;
+    signingRootId: string;
+    signingRootVersion: string;
+    keyHandle: string;
+    ecdsaThresholdKeyId?: string;
+    ethereumAddress: string;
+    relayerKeyId: string;
+    clientVerifyingShareB64u?: string;
+    thresholdEcdsaPublicKeyB64u?: string;
+    participantIds: number[];
+    runtimePolicyScope?: unknown;
+    routerAbEcdsaDerivationNormalSigning: RouterAbEcdsaDerivationNormalSigningStateV1;
+    publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
+};
+export type SealedSigningSessionEcdsaRoleLocalMaterialRef = {
+    kind: 'ecdsa_role_local_persisted_material_ref_v1';
+    durableMaterialRef: string;
+    bindingDigest: string;
+    materialActivation: MpcMaterialActivationRef;
+};
+export type SealedSigningSessionEcdsaRestoreMetadata = (SealedSigningSessionEcdsaRestoreMetadataBase & {
+    source: Exclude<SealedSigningSessionEcdsaRestoreSource, 'email_otp'>;
+    authority: WalletAuthAuthorityRef;
+    roleLocalMaterialRef: SealedSigningSessionEcdsaRoleLocalMaterialRef;
+    rpId: string;
+    credentialIdB64u: string;
+    providerSubjectId?: never;
+    authSubjectId?: never;
+}) | (SealedSigningSessionEcdsaRestoreMetadataBase & {
+    source: 'email_otp';
+    provider: EmailOtpProvider;
+    providerSubjectId: string;
+    emailHashHex: string;
+    authority: WalletAuthAuthorityRef;
+    emailOtpAuthority: EmailOtpWalletAuthAuthority;
+    authSubjectId?: never;
+    roleLocalMaterialRef: SealedSigningSessionEcdsaRoleLocalMaterialRef;
+    rpId?: never;
+    credentialIdB64u?: never;
+});
+type SealedSigningSessionEd25519RestoreMetadataBase = {
+    nearAccountId: string;
+    nearEd25519SigningKeyId: string;
+    rpId: string;
+    relayerKeyId: string;
+    participantIds: number[];
+    runtimePolicyScope?: unknown;
+    clientVerifyingShareB64u?: string;
+    signerSlot: number;
+    keyVersion?: string;
+    routerAbNormalSigning?: RouterAbEd25519NormalSigningState;
+};
+export type SealedSigningSessionEd25519RestoreMetadata = (SealedSigningSessionEd25519RestoreMetadataBase & {
+    credentialIdB64u: string;
+    materialActivation: MpcMaterialActivationRef;
+    providerSubjectId?: never;
+    authSubjectId?: never;
+}) | (SealedSigningSessionEd25519RestoreMetadataBase & {
+    providerSubjectId: string;
+    emailHashHex: string;
+    materialActivation: MpcMaterialActivationRef;
+    credentialIdB64u?: never;
+    authSubjectId?: never;
+});
+type SealedSigningSessionRecordBase = {
+    v: typeof SIGNING_SESSION_SEALED_RECORD_VERSION;
+    alg: typeof SIGNING_SESSION_SEAL_ALG;
+    storageScope: typeof SIGNING_SESSION_SEAL_STORAGE_SCOPE;
+    authMethod: SigningSessionSealAuthMethod;
+    secretKind: typeof SIGNING_SESSION_SECRET_KIND;
+    storeKey: string;
+    sealedSecretB64u: string;
+    walletId: string;
+    relayerUrl: string;
+    groupId: SigningSessionSealGroupId;
+    keyVersion: string;
+    issuedAtMs: number;
+    expiresAtMs: number;
+    remainingUses: number;
+    updatedAtMs: number;
+};
+export type SealedSigningSessionRecord = (SealedSigningSessionRecordBase & {
+    curve: 'ed25519';
+    thresholdSessionIds: {
+        ed25519: string;
+        ecdsa?: string;
+    };
+    signingRootId?: string;
+    signingRootVersion?: string;
+    ed25519Restore: SealedSigningSessionEd25519RestoreMetadata;
+    ecdsaRestore?: SealedSigningSessionEcdsaRestoreMetadata;
+}) | (SealedSigningSessionRecordBase & {
+    curve: 'ecdsa';
+    thresholdSessionIds: {
+        ed25519?: string;
+        ecdsa: string;
+    };
+    signingRootId?: never;
+    signingRootVersion?: never;
+    ecdsaRestore: SealedSigningSessionEcdsaRestoreMetadata;
+    ed25519Restore?: SealedSigningSessionEd25519RestoreMetadata;
+});
+export declare function encodeSigningSessionHkdfTuple(fields: readonly string[]): Uint8Array;
+export {};
+//# sourceMappingURL=signingSessionSeal.d.ts.map

package/dist/types/shared-ts/src/utils/signingSessionSeal.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=signingSessionSeal.typecheck.d.ts.map

package/dist/types/shared-ts/src/utils/theme.d.ts

@@ -0,0 +1,2 @@
+export declare function coerceThemeMode(input: unknown): 'light' | 'dark' | undefined;
+//# sourceMappingURL=theme.d.ts.map

package/dist/types/shared-ts/src/utils/thresholdEcdsaKeyHandle.d.ts

@@ -0,0 +1,11 @@
+export type ThresholdEcdsaKeyHandle = string & {
+    readonly __brand: 'ThresholdEcdsaKeyHandle';
+};
+export declare function parseThresholdEcdsaKeyHandle(value: unknown): ThresholdEcdsaKeyHandle;
+export type ThresholdEcdsaKeyHandleInput = {
+    ecdsaThresholdKeyId: unknown;
+    signingRootId: unknown;
+    signingRootVersion: unknown;
+};
+export declare function deriveThresholdEcdsaKeyHandle(input: ThresholdEcdsaKeyHandleInput): Promise<ThresholdEcdsaKeyHandle>;
+//# sourceMappingURL=thresholdEcdsaKeyHandle.d.ts.map

package/dist/types/shared-ts/src/utils/validation.d.ts

@@ -0,0 +1,35 @@
+export interface ValidationResult {
+    valid: boolean;
+    error?: string;
+}
+export type { NearAccountValidationOptions } from './near';
+export { ensureEd25519Prefix, validateNearAccountId, isValidAccountId } from './near';
+export { normalizeOptionalString as toOptionalString, normalizeOptionalTrimmedString as toOptionalTrimmedString, normalizeTrimmedString as toTrimmedString, stripTrailingSlashes, ensureLeadingSlash, toBasePath, toOriginOrUndefined, toRorOriginOrNull, toSingleLine, normalizeInteger, normalizePositiveInteger, } from './normalize';
+export declare function requireTrimmedString(value: unknown, label: string, message?: string): string;
+export declare function toOptionalTrimmedNonEmptyString(value: unknown): string | undefined;
+export declare function isObject(x: unknown): x is Record<string, unknown>;
+export declare function isPlainObject(x: unknown): x is Record<string, unknown>;
+export declare function toOptionalRecordString(record: unknown, key: string): string | undefined;
+export declare function isString(x: unknown): x is string;
+export declare function isNonEmptyString(x: unknown): x is string;
+export declare function isNumber(x: unknown): x is number;
+export declare function isFiniteNumber(x: unknown): x is number;
+export declare function isFunction(x: unknown): x is (...args: unknown[]) => unknown;
+export declare function isBoolean(x: unknown): x is boolean;
+export declare function isArray<T = unknown>(x: unknown): x is T[];
+export declare function assertString(val: unknown, name?: string): string;
+export declare function assertNumber(val: unknown, name?: string): number;
+export declare function assertBoolean(val: unknown, name?: string): boolean;
+export declare function assertObject<T extends Record<string, unknown> = Record<string, unknown>>(val: unknown, name?: string): T;
+export declare function assertArray<T = unknown>(val: unknown, name?: string): T[];
+export declare function stripFunctionsShallow<T extends Record<string, unknown>>(obj?: T): Partial<T> | undefined;
+export interface PlainSignedTransactionLike {
+    transaction: unknown;
+    signature: unknown;
+    borsh_bytes?: unknown;
+    borshBytes?: unknown;
+    base64Encode?: unknown;
+}
+export declare function isPlainSignedTransactionLike(x: unknown): x is PlainSignedTransactionLike;
+export declare function extractBorshBytesFromPlainSignedTx(x: PlainSignedTransactionLike): number[];
+//# sourceMappingURL=validation.d.ts.map

package/dist/types/shared-ts/src/utils/walletAddSignerActivation.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The canonical wallet add-signer ECDSA activation command — the add-signer
+ * counterpart of registration's `wallet_registration_activate_v2` command.
+ *
+ * The client computes the activation request digest locally over this exact
+ * alphabetized JSON and journals both before calling activate; the server
+ * recomputes the digest from the same coordinates and rejects a mismatch
+ * before claiming the activation. Both sides import this one builder so the
+ * encoding cannot drift. Unlike the registration command there is no
+ * `idempotencyKey` member: add-signer finalize owns idempotency on its own
+ * route, and the activate claim is keyed by these coordinates alone.
+ */
+import { type CanonicalEcdsaServerActivationRequest } from './ecdsaCapabilityActivation';
+import type { RouterAbEcdsaVerifiedClientActivationFactsV1 } from './routerAbEcdsaDerivation';
+export declare const WALLET_ADD_SIGNER_ECDSA_ACTIVATE_OPERATION = "wallet_add_signer_activate_v2";
+export type WalletAddSignerEcdsaActivationCommandInput = {
+    readonly addSignerCeremonyId: string;
+    readonly activationCorrelationId: string;
+    readonly publicFacts: RouterAbEcdsaVerifiedClientActivationFactsV1;
+};
+export declare function buildCanonicalWalletAddSignerEcdsaActivationRequest(input: WalletAddSignerEcdsaActivationCommandInput): CanonicalEcdsaServerActivationRequest;
+export declare function computeWalletAddSignerEcdsaActivationRequestDigestB64u(input: WalletAddSignerEcdsaActivationCommandInput): Promise<string>;
+//# sourceMappingURL=walletAddSignerActivation.d.ts.map

package/dist/types/shared-ts/src/utils/walletAuthAuthority.d.ts

@@ -0,0 +1,150 @@
+import { type EmailOtpChallengeId, type EmailOtpProviderUserId, type VerifiedEmailAddress, type WalletAuthorityBindingDigest, type WalletAuthMethodId, type WalletId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from './domainIds';
+export type EmailOtpProvider = 'google' | 'email';
+export type PasskeyFactorIdentity = {
+    kind: 'passkey';
+    credentialIdB64u: WebAuthnCredentialIdB64u;
+    rpId?: never;
+    provider?: never;
+    providerUserId?: never;
+};
+export type EmailOtpFactorIdentity = {
+    kind: 'email_otp';
+    provider: EmailOtpProvider;
+    providerUserId: EmailOtpProviderUserId;
+    rpId?: never;
+    credentialIdB64u?: never;
+};
+export type AuthFactorIdentity = PasskeyFactorIdentity | EmailOtpFactorIdentity;
+export type PasskeyWalletAuthAuthority = {
+    walletId: WalletId;
+    factor: PasskeyFactorIdentity;
+    verifier: {
+        kind: 'webauthn';
+        rpId: WebAuthnRpId;
+    };
+    bindingId: WalletAuthMethodId;
+    kind?: never;
+    rpId?: never;
+    credentialIdB64u?: never;
+    provider?: never;
+    providerUserId?: never;
+};
+export type EmailOtpWalletAuthAuthority = {
+    walletId: WalletId;
+    factor: EmailOtpFactorIdentity;
+    verifier: {
+        kind: 'email_otp_wallet_auth_method';
+        emailHashHex: string;
+    };
+    bindingId: WalletAuthMethodId;
+    kind?: never;
+    rpId?: never;
+    credentialIdB64u?: never;
+    provider?: never;
+    providerUserId?: never;
+};
+export type WalletAuthAuthority = PasskeyWalletAuthAuthority | EmailOtpWalletAuthAuthority;
+export declare function isPasskeyWalletAuthAuthority(authority: WalletAuthAuthority): authority is PasskeyWalletAuthAuthority;
+export declare function isEmailOtpWalletAuthAuthority(authority: WalletAuthAuthority): authority is EmailOtpWalletAuthAuthority;
+export declare function walletAuthAuthoritiesMatch(left: WalletAuthAuthority, right: WalletAuthAuthority): boolean;
+export type EmailOtpFactorProfile = {
+    factor: EmailOtpFactorIdentity;
+    email: VerifiedEmailAddress;
+};
+export type WalletAuthAuthorityRef = {
+    kind: 'wallet_auth_authority_ref';
+    walletId: WalletId;
+    authorityDigest: WalletAuthorityBindingDigest;
+    /**
+     * Which wallet auth method issued this authority.
+     *
+     * The digest already proves *what* the authority was, but proving is not
+     * addressing: revoking or pausing one credential has to select every session
+     * that credential issued, and a digest can only be recomputed and compared
+     * one candidate at a time. Carrying the binding id makes that selection a
+     * lookup. It is always derived from the authority rather than supplied, so a
+     * ref whose id disagrees with its digest cannot be built.
+     */
+    walletAuthMethodId: WalletAuthMethodId;
+};
+export declare function parseWalletAuthAuthorityRef(raw: unknown): WalletAuthAuthorityRef | null;
+export type AuthOperationPurpose = 'registration' | 'unlock' | 'step_up' | 'recovery' | 'key_export';
+export type AuthMethodProof = {
+    kind: 'passkey_registration_credential';
+    webauthnRegistration: unknown;
+} | {
+    kind: 'passkey_assertion';
+    assertion: unknown;
+} | {
+    kind: 'email_otp_challenge';
+    challengeId: EmailOtpChallengeId;
+    otpCode: string;
+} | {
+    kind: 'google_sso_registration';
+    registrationAttemptId: string;
+    registrationOfferId: string;
+    registrationCandidateId: string;
+};
+export type AuthBoundaryProof = {
+    purpose: AuthOperationPurpose;
+    proof: AuthMethodProof;
+};
+export type ProofFor<P extends AuthOperationPurpose> = AuthBoundaryProof & {
+    readonly __authOperationPurpose?: P;
+};
+export type AuthBoundaryProofPurposeRejectionReason = 'registration_requires_registration_proof' | 'recovery_requires_email_otp_challenge' | 'interactive_operation_requires_assertion_or_email_otp_challenge';
+export type AuthBoundaryProofPurposeValidation = {
+    ok: true;
+    proof: AuthBoundaryProof;
+} | {
+    ok: false;
+    reason: AuthBoundaryProofPurposeRejectionReason;
+    proof: AuthBoundaryProof;
+};
+export declare function validateAuthBoundaryProofPurpose(proof: AuthBoundaryProof): AuthBoundaryProofPurposeValidation;
+export type RegistrationWalletCandidate = {
+    kind: 'registration_wallet_candidate';
+    walletId: WalletId;
+    registrationAttemptId: string;
+};
+export declare function buildPasskeyWalletAuthAuthority(args: {
+    walletId: unknown;
+    rpId: unknown;
+    credentialIdB64u: unknown;
+}): PasskeyWalletAuthAuthority;
+export declare function buildPasskeyFactorIdentity(args: {
+    credentialIdB64u: unknown;
+}): PasskeyFactorIdentity;
+export declare function buildEmailOtpFactorIdentity(args: {
+    provider: unknown;
+    providerUserId: unknown;
+}): EmailOtpFactorIdentity;
+export declare function buildEmailOtpWalletAuthAuthority(args: {
+    walletId: unknown;
+    provider: unknown;
+    providerUserId: unknown;
+    emailHashHex: unknown;
+}): EmailOtpWalletAuthAuthority;
+export declare function emailOtpWalletAuthAuthorityProvider(authority: EmailOtpWalletAuthAuthority): EmailOtpProvider;
+export declare function emailOtpWalletAuthAuthorityProviderUserId(authority: EmailOtpWalletAuthAuthority): EmailOtpProviderUserId;
+export declare function emailOtpWalletAuthAuthorityEmailHashHex(authority: EmailOtpWalletAuthAuthority): string;
+export declare function parseAuthFactorIdentity(raw: unknown): AuthFactorIdentity | null;
+export declare function parsePasskeyFactorIdentity(raw: unknown): PasskeyFactorIdentity | null;
+export declare function parseEmailOtpFactorIdentity(raw: unknown): EmailOtpFactorIdentity | null;
+export declare function parseWalletAuthAuthority(raw: unknown): WalletAuthAuthority | null;
+export declare function parseEmailOtpWalletAuthAuthority(raw: unknown): EmailOtpWalletAuthAuthority | null;
+export declare function parsePasskeyWalletAuthAuthority(raw: unknown): PasskeyWalletAuthAuthority | null;
+export declare function emailOtpFactorProfile(args: {
+    factor: EmailOtpFactorIdentity;
+    email: unknown;
+}): EmailOtpFactorProfile;
+export declare function canonicalWalletAuthorityBindingDigestInput(args: {
+    authority: WalletAuthAuthority;
+}): string;
+export declare function walletAuthorityBindingDigest(args: {
+    authority: WalletAuthAuthority;
+}): Promise<WalletAuthorityBindingDigest>;
+export declare function walletAuthAuthorityRef(args: {
+    authority: WalletAuthAuthority;
+}): Promise<WalletAuthAuthorityRef>;
+//# sourceMappingURL=walletAuthAuthority.d.ts.map

package/dist/types/shared-ts/src/utils/walletAuthAuthority.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=walletAuthAuthority.typecheck.d.ts.map

package/dist/types/shared-ts/src/utils/walletCapabilityBindings.d.ts

@@ -0,0 +1,106 @@
+import { type WalletAuthMethodId, type WalletId, type WebAuthnRpId } from './domainIds';
+import { type ImplicitNearAccountId, type NamedNearAccountId } from './near';
+import { type NearEd25519SigningKeyId } from './registrationIntent';
+export type { WebAuthnRpId };
+export type RpId = WebAuthnRpId;
+export type WalletIdentity = {
+    readonly walletId: WalletId;
+};
+export type PasskeyAuthScope = {
+    readonly wallet: WalletIdentity;
+    readonly rpId: RpId;
+};
+export type WalletAuthMethodBinding = {
+    readonly kind: 'passkey';
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly scope: PasskeyAuthScope;
+    readonly credentialIdB64u: string;
+} | {
+    readonly kind: 'email_otp';
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly wallet: WalletIdentity;
+    readonly emailHashHex: string;
+    readonly registrationAuthorityId: string;
+    readonly rpId?: never;
+};
+export type CurrentWalletAuthMethod = {
+    readonly kind: 'none';
+} | {
+    readonly kind: 'selected';
+    readonly binding: WalletAuthMethodBinding;
+};
+export type NearAccountBinding = {
+    readonly kind: 'implicit_near_account';
+    readonly wallet: WalletIdentity;
+    readonly nearAccountId: ImplicitNearAccountId;
+} | {
+    readonly kind: 'named_near_account';
+    readonly wallet: WalletIdentity;
+    readonly nearAccountId: NamedNearAccountId;
+};
+export type NearEd25519SignerBinding = {
+    readonly kind: 'near_ed25519_signer';
+    readonly account: NearAccountBinding;
+    readonly nearEd25519SigningKeyId: NearEd25519SigningKeyId;
+    readonly signerSlot: number;
+};
+export type WalletCapabilityBindingParseError = {
+    readonly code: 'missing' | 'invalid';
+    readonly message: string;
+};
+export type WalletCapabilityBindingParseResult<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly error: WalletCapabilityBindingParseError;
+};
+export declare function parseRpId(raw: unknown): WalletCapabilityBindingParseResult<RpId>;
+export declare function formatRpIdForWire(value: RpId): string;
+export declare function walletIdentityFromRaw(raw: unknown): WalletCapabilityBindingParseResult<WalletIdentity>;
+export declare function buildWalletIdentity(args: {
+    walletId: WalletId;
+}): WalletIdentity;
+export declare function passkeyAuthScopeFromRaw(raw: unknown): WalletCapabilityBindingParseResult<PasskeyAuthScope>;
+export declare function buildPasskeyAuthScope(args: {
+    wallet: WalletIdentity;
+    rpId: RpId;
+}): PasskeyAuthScope;
+export declare function buildPasskeyWalletAuthMethodBinding(args: {
+    walletAuthMethodId: WalletAuthMethodId;
+    scope: PasskeyAuthScope;
+    credentialIdB64u: string;
+}): WalletAuthMethodBinding;
+export declare function buildEmailOtpWalletAuthMethodBinding(args: {
+    walletAuthMethodId: WalletAuthMethodId;
+    wallet: WalletIdentity;
+    emailHashHex: string;
+    registrationAuthorityId: string;
+}): WalletAuthMethodBinding;
+export declare function walletAuthMethodBindingId(binding: WalletAuthMethodBinding): WalletAuthMethodId;
+export declare function walletAuthMethodBindingFromRaw(raw: unknown): WalletCapabilityBindingParseResult<WalletAuthMethodBinding>;
+export declare function currentWalletAuthMethodFromRaw(raw: unknown): WalletCapabilityBindingParseResult<CurrentWalletAuthMethod>;
+export declare function buildNoCurrentWalletAuthMethod(): Extract<CurrentWalletAuthMethod, {
+    kind: 'none';
+}>;
+export declare function buildSelectedCurrentWalletAuthMethod(args: {
+    binding: WalletAuthMethodBinding;
+}): Extract<CurrentWalletAuthMethod, {
+    kind: 'selected';
+}>;
+export declare function buildImplicitNearAccountBinding(args: {
+    wallet: WalletIdentity;
+    nearAccountId: ImplicitNearAccountId;
+}): NearAccountBinding;
+export declare function buildNamedNearAccountBinding(args: {
+    wallet: WalletIdentity;
+    nearAccountId: NamedNearAccountId;
+}): NearAccountBinding;
+export declare function nearAccountBindingFromRaw(raw: unknown): WalletCapabilityBindingParseResult<NearAccountBinding>;
+export declare function buildNearEd25519SignerBinding(args: {
+    account: NearAccountBinding;
+    nearEd25519SigningKeyId: NearEd25519SigningKeyId;
+    signerSlot: number;
+}): NearEd25519SignerBinding;
+export declare function nearEd25519SignerBindingFromRaw(raw: unknown): WalletCapabilityBindingParseResult<NearEd25519SignerBinding>;
+//# sourceMappingURL=walletCapabilityBindings.d.ts.map

package/dist/types/shared-ts/src/utils/walletCapabilityBindings.typecheck.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=walletCapabilityBindings.typecheck.d.ts.map

package/dist/types/shared-ts/src/utils/walletSessionFailure.d.ts

@@ -0,0 +1,13 @@
+export declare const WALLET_SESSION_FAILURE_CODES: {
+    readonly missing: "wallet_session_missing";
+    readonly signatureInvalid: "wallet_session_signature_invalid";
+    readonly claimsInvalid: "wallet_session_claims_invalid";
+    readonly invalid: "wallet_session_invalid";
+    readonly expired: "wallet_session_expired";
+    readonly scopeMismatch: "wallet_session_scope_mismatch";
+    readonly unavailable: "wallet_session_unavailable";
+    readonly budgetExhausted: "wallet_budget_exhausted";
+};
+export type WalletSessionFailureCode = (typeof WALLET_SESSION_FAILURE_CODES)[keyof typeof WALLET_SESSION_FAILURE_CODES];
+export declare function isWalletSessionFailureCode(value: unknown): value is WalletSessionFailureCode;
+//# sourceMappingURL=walletSessionFailure.d.ts.map

package/dist/types/shared-ts/src/utils/webauthnDeviceInfo.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Device metadata captured when a WebAuthn credential is registered.
+ *
+ * Derived once, server-side, at registration verification time from three
+ * sources the router already receives:
+ * - the `User-Agent` header of the registration request (browser/os),
+ * - the verified attestation (AAGUID -> passkey provider, BE flag -> synced),
+ * - the credential response transports.
+ *
+ * Stored on the authenticator row and returned by the authenticators listing
+ * so profile UIs can label signers ("Chrome on macOS", "iCloud Keychain").
+ */
+export type WebAuthnDeviceBrowser = 'chrome' | 'safari' | 'firefox' | 'edge' | 'other';
+export type WebAuthnDeviceOs = 'macos' | 'ios' | 'windows' | 'android' | 'linux' | 'other';
+export type WebAuthnAuthenticatorDeviceInfo = {
+    /** Display-ready label, e.g. "Chrome on macOS". Never empty. */
+    label: string;
+    browser: WebAuthnDeviceBrowser;
+    os: WebAuthnDeviceOs;
+    /** BE (backup eligible) flag: true for synced passkeys (iCloud Keychain, GPM). */
+    synced: boolean;
+    /** Credential response transports, e.g. ["internal"], ["hybrid"]. */
+    transports: string[];
+    /** Passkey provider id from the AAGUID map, when the AAGUID is known. */
+    provider?: string;
+    /** Display name for the provider, e.g. "iCloud Keychain". */
+    providerLabel?: string;
+};
+export declare function webAuthnDeviceBrowserFromUserAgent(userAgent: string): WebAuthnDeviceBrowser;
+export declare function webAuthnDeviceOsFromUserAgent(userAgent: string): WebAuthnDeviceOs;
+export declare function deriveWebAuthnAuthenticatorDeviceInfo(input: {
+    userAgent?: string;
+    aaguid?: string;
+    backedUp?: boolean;
+    transports?: readonly string[];
+}): WebAuthnAuthenticatorDeviceInfo;
+/** Fallback for authenticator rows written before device capture existed. */
+export declare function unknownWebAuthnAuthenticatorDeviceInfo(): WebAuthnAuthenticatorDeviceInfo;
+/**
+ * Boundary parse of a persisted `device_info_json` column. A row written before
+ * device capture existed (empty string, `'{}'`, or an unreadable value) becomes
+ * `Unknown device` rather than failing the surrounding read.
+ */
+export declare function parseWebAuthnAuthenticatorDeviceInfoJson(raw: unknown): WebAuthnAuthenticatorDeviceInfo;
+/** Strict parse of a stored/transported device-info record; null when the
+ * shape is not a valid WebAuthnAuthenticatorDeviceInfo. */
+export declare function parseWebAuthnAuthenticatorDeviceInfo(raw: unknown): WebAuthnAuthenticatorDeviceInfo | null;
+//# sourceMappingURL=webauthnDeviceInfo.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/backupAcknowledgement.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Whether the user has confirmed they saved their recovery codes.
+ *
+ * **A sibling of the recovery set, never a field on it.** Acknowledging a
+ * backup is a UI action, and the recovery set is the record that gates
+ * recovery: putting them together would mean a button press writes to the
+ * record holding the wraps, and a version conflict between an acknowledgement
+ * and a concurrent code spend would make one of them fail for no reason a user
+ * could understand. Worse, a bug in the cosmetic path could corrupt the
+ * critical one.
+ *
+ * It carries no secret and no authority. Nothing consults it to decide whether
+ * a recovery may proceed — a user who never acknowledged still has working
+ * codes, and one who acknowledged without saving them does not. It exists so
+ * the product can stop nagging, and that is all it may ever mean.
+ */
+export type WalletRecoveryBackupAcknowledgementV1 = {
+    readonly kind: 'wallet_recovery_backup_acknowledgement_v1';
+    readonly walletId: string;
+    /**
+     * Which issuance was acknowledged.
+     *
+     * Rotation issues a new set, and an acknowledgement of the old one must not
+     * silently cover it — otherwise rotating codes would leave the user never
+     * prompted to save the ones they now depend on.
+     */
+    readonly issuedAtMs: number;
+    readonly acknowledgedAtMs: number;
+};
+export type WalletRecoveryBackupAcknowledgementParseResult = {
+    readonly ok: true;
+    readonly record: WalletRecoveryBackupAcknowledgementV1;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+export declare function parseWalletRecoveryBackupAcknowledgementV1(raw: unknown, options: {
+    readonly expectedWalletId: string;
+}): WalletRecoveryBackupAcknowledgementParseResult;
+/**
+ * Whether the user should still be asked to save their codes.
+ *
+ * Takes the set's own `issuedAtMs` rather than trusting the acknowledgement
+ * alone, so a rotation re-arms the prompt: the stored acknowledgement names
+ * the issuance it covered, and a newer set is by definition unacknowledged.
+ */
+export declare function walletRecoveryBackupIsOutstanding(input: {
+    readonly setIssuedAtMs: number;
+    readonly acknowledgement: WalletRecoveryBackupAcknowledgementV1 | null;
+}): boolean;
+export declare function buildWalletRecoveryBackupAcknowledgementV1(input: {
+    readonly walletId: string;
+    readonly issuedAtMs: number;
+    readonly acknowledgedAtMs: number;
+}): WalletRecoveryBackupAcknowledgementV1;
+//# sourceMappingURL=backupAcknowledgement.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/index.d.ts

@@ -0,0 +1,10 @@
+export * from './recoveryCodes';
+export * from './recoveryEnvelopes';
+export * from './recoveryCodeReservation';
+export * from './recoveryCodeLocator';
+export * from './recoveryKekContext';
+export * from './walletRecoveryEnvelopeSet';
+export * from './walletRecoveryRotation';
+export * from './walletRecoveryEcdsaPossession';
+export * from './walletRecoveryCommittedProjection';
+//# sourceMappingURL=index.d.ts.map