@seams/wallet-server 0.6.1 → 0.7.1

package/dist/types/shared-ts/src/signing-lanes/rotationWireFields.d.ts

@@ -0,0 +1,20 @@
+import { type MpcMaterialActivationRef } from '../utils/domainIds';
+import { type WireParser } from '../utils/wireSchema';
+import type { SigningLaneKind } from './records';
+import type { LaneOperationAuthorizationBindingV1 } from './rotation';
+export declare function requiredString(raw: unknown, label: string): string;
+export declare function requiredInteger(raw: unknown, label: string): number;
+export declare function parseLaneKind(raw: unknown, label: string): SigningLaneKind;
+export declare const laneOperationId: WireParser<import("./ids").LaneOperationId>;
+export declare const laneEnrollmentId: WireParser<import("./ids").LaneEnrollmentId>;
+export declare const walletId: WireParser<import("@server/core/registrationContracts").WalletId>;
+export declare const walletKeyId: WireParser<import("./ids").WalletKeyId>;
+export declare const signingLaneId: WireParser<import("./ids").SigningLaneId>;
+export declare const laneShareEpoch: WireParser<import("./ids").LaneShareEpoch>;
+export declare const materialActivationId: WireParser<import("../utils").MpcMaterialActivationId>;
+export declare const materialActivation: WireParser<MpcMaterialActivationRef>;
+export declare const laneParticipantBindingDigest: WireParser<import("./participants").LaneParticipantBindingDigestB64u>;
+export declare const digest: WireParser<import("../utils").DigestB64u>;
+export declare const digestString: WireParser<string>;
+export declare function parseAuthorization(raw: unknown, label: string): LaneOperationAuthorizationBindingV1;
+//# sourceMappingURL=rotationWireFields.d.ts.map

package/dist/types/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.d.ts

@@ -1,6 +1,4 @@
 import type { WalletId } from '../utils/domainIds';
-export declare const ECDSA_DERIVATION_ROLE_LOCAL_FIRST_BOOTSTRAP_ROOT_PROOF_VERSION: "ecdsa-derivation:role-local:first-bootstrap-root-proof:v2";
-export declare const ECDSA_DERIVATION_ROLE_LOCAL_PASSKEY_BOOTSTRAP_AUTH_VERSION: "ecdsa-derivation:role-local:passkey-bootstrap-auth:v2";
 export type EcdsaClientRootPublicKey33B64u = string & {
     readonly __brand: 'EcdsaClientRootPublicKey33B64u';
 };
@@ -21,33 +19,7 @@ export type SigningRootId = string & {
 export type SigningRootVersion = string & {
     readonly __brand: 'SigningRootVersion';
 };
-export type EcdsaDerivationRoleLocalFirstBootstrapRootProof = {
-    version: typeof ECDSA_DERIVATION_ROLE_LOCAL_FIRST_BOOTSTRAP_ROOT_PROOF_VERSION;
-    clientRootPublicKey33B64u: EcdsaClientRootPublicKey33B64u;
-    digest32B64u: string;
-    signature65B64u: string;
-};
-export type EcdsaDerivationRoleLocalBootstrapIdentity = {
-    walletId: string;
-    evmFamilySigningKeySlotId: string;
-    ecdsaThresholdKeyId: string;
-    signingRootId: string;
-    signingRootVersion: string;
-    keyScope: 'evm-family';
-    relayerKeyId: string;
-    derivationClientSharePublicKey33B64u: DerivationClientSharePublicKey33B64u;
-    clientShareRetryCounter: number;
-    contextBinding32B64u: string;
-    requestId: string;
-    sessionId: string;
-    ttlMs: number;
-    remainingUses: number;
-    participantIds: number[];
-};
-export type EcdsaDerivationRoleLocalPasskeyBootstrapIdentity = Omit<EcdsaDerivationRoleLocalBootstrapIdentity, 'derivationClientSharePublicKey33B64u' | 'clientShareRetryCounter' | 'contextBinding32B64u'> & {
-    rpId: string;
-};
-export type SdkEcdsaDerivationBindingFacts = {
+type SdkEcdsaDerivationBindingFacts = {
     walletId: WalletId;
     ecdsaThresholdKeyId: EcdsaThresholdKeyId;
     signingRootId: SigningRootId;
@@ -56,8 +28,6 @@ export type SdkEcdsaDerivationBindingFacts = {
 export declare function parseSdkEcdsaDerivationThresholdKeyId(value: unknown): EcdsaThresholdKeyId;
 export declare function parseSdkEcdsaDerivationSigningRootId(value: unknown): SigningRootId;
 export declare function parseSdkEcdsaDerivationSigningRootVersion(value: unknown): SigningRootVersion;
-export declare function encodeSdkEcdsaDerivationBindingFactsV1(input: SdkEcdsaDerivationBindingFacts): Uint8Array;
-export declare function computeSdkEcdsaDerivationApplicationBindingDigest32(input: SdkEcdsaDerivationBindingFacts): Promise<Uint8Array>;
 export declare function computeSdkEcdsaDerivationApplicationBindingDigestB64u(input: SdkEcdsaDerivationBindingFacts): Promise<string>;
 export declare function computeEcdsaDerivationRoleLocalThresholdKeyId(input: {
     walletId: string;
@@ -70,8 +40,5 @@ export declare function computeEcdsaDerivationRoleLocalRelayerKeyId(input: {
     signingRootId: string;
     signingRootVersion: string;
 }): Promise<string>;
-export declare function computeEcdsaDerivationRoleLocalFirstBootstrapRootProofDigest32(input: EcdsaDerivationRoleLocalBootstrapIdentity): Promise<Uint8Array>;
-export declare function computeEcdsaDerivationRoleLocalFirstBootstrapRootProofDigest32B64u(input: EcdsaDerivationRoleLocalBootstrapIdentity): Promise<string>;
-export declare function computeEcdsaDerivationRoleLocalPasskeyBootstrapAuthDigest32(input: EcdsaDerivationRoleLocalPasskeyBootstrapIdentity): Promise<Uint8Array>;
-export declare function computeEcdsaDerivationRoleLocalPasskeyBootstrapAuthDigest32B64u(input: EcdsaDerivationRoleLocalPasskeyBootstrapIdentity): Promise<string>;
+export {};
 //# sourceMappingURL=ecdsaDerivationRoleLocalBootstrap.d.ts.map

package/dist/types/shared-ts/src/threshold/ed25519OperationFingerprint.d.ts

@@ -4,20 +4,20 @@ type ThresholdEd25519CanonicalScope = {
     relayerKeyId: string;
     signerPublicKey: string;
 };
-export type ThresholdEd25519NearTransaction = {
+type ThresholdEd25519NearTransaction = {
     nearAccountId: string;
     receiverId: string;
     actions: readonly ThresholdEd25519NearAction[];
 };
-export type ThresholdEd25519NearPublicKey = {
+type ThresholdEd25519NearPublicKey = {
     keyType: number;
     keyData: readonly number[];
 };
-export type ThresholdEd25519NearSignature = {
+type ThresholdEd25519NearSignature = {
     keyType: number;
     signatureData: readonly number[];
 };
-export type ThresholdEd25519SignedDelegateAction = {
+type ThresholdEd25519SignedDelegateAction = {
     senderId: string;
     receiverId: string;
     actions: readonly ThresholdEd25519NearAction[];
@@ -70,20 +70,20 @@ export type ThresholdEd25519NearAction = {
     code_hash: string;
     account_id?: never;
 };
-export type ThresholdEd25519NearTransactionPlanningFingerprintInput = ThresholdEd25519CanonicalScope & {
+type ThresholdEd25519NearTransactionPlanningFingerprintInput = ThresholdEd25519CanonicalScope & {
     transactions: readonly ThresholdEd25519NearTransaction[];
 };
-export type ThresholdEd25519NearTransactionFingerprintInput = ThresholdEd25519NearTransactionPlanningFingerprintInput & {
+type ThresholdEd25519NearTransactionFingerprintInput = ThresholdEd25519NearTransactionPlanningFingerprintInput & {
     unsignedTransactionBorshB64u: string;
     signingDigestB64u: string;
 };
-export type ThresholdEd25519Nep413FingerprintInput = ThresholdEd25519CanonicalScope & {
+type ThresholdEd25519Nep413FingerprintInput = ThresholdEd25519CanonicalScope & {
     message: string;
     recipient: string;
     nonce: string;
     state?: string | null;
 };
-export type ThresholdEd25519DelegateActionFingerprintInput = ThresholdEd25519CanonicalScope & {
+type ThresholdEd25519DelegateActionFingerprintInput = ThresholdEd25519CanonicalScope & {
     delegate: {
         senderId: string;
         receiverId: string;
@@ -93,37 +93,10 @@ export type ThresholdEd25519DelegateActionFingerprintInput = ThresholdEd25519Can
         publicKey: string;
     };
 };
-type ThresholdEd25519FinalizeRequestIntegrityCommonInput = {
-    operation: {
-        kind: 'threshold_ed25519_signing_operation_v1';
-        operationId: string;
-        operationFingerprint: string;
-        purpose: 'near_transaction' | 'nep413_message' | 'delegate_action';
-    };
-    presignId: string;
-    relayerKeyId: string;
-    nearAccountId: string;
-    nearNetworkId: string;
-    expectedSignerPublicKey: string;
-    clientSignatureShareB64u: string;
-};
-export type ThresholdEd25519FinalizeRequestIntegrityInput = (ThresholdEd25519FinalizeRequestIntegrityCommonInput & {
-    kind: 'threshold_ed25519_finalize_signature_only_v1';
-    intent: unknown;
-}) | (ThresholdEd25519FinalizeRequestIntegrityCommonInput & {
-    kind: 'threshold_ed25519_finalize_and_dispatch_near_tx_v1';
-    transactions: unknown;
-    unsignedTransactionBorshB64u: string;
-    signingDigestB64u: string;
-    dispatch: {
-        kind: 'near_rpc_configured_default_v1';
-    };
-});
 export declare function thresholdEd25519NearTransactionPlanningOperationFingerprint(input: ThresholdEd25519NearTransactionPlanningFingerprintInput): Promise<string>;
 export declare function thresholdEd25519NearTransactionOperationFingerprint(input: ThresholdEd25519NearTransactionFingerprintInput): Promise<string>;
 export declare function thresholdEd25519Nep413OperationFingerprint(input: ThresholdEd25519Nep413FingerprintInput): Promise<string>;
 export declare function thresholdEd25519DelegateActionOperationFingerprint(input: ThresholdEd25519DelegateActionFingerprintInput): Promise<string>;
-export declare function thresholdEd25519FinalizeRequestIntegrityHash(input: ThresholdEd25519FinalizeRequestIntegrityInput): Promise<string>;
 export declare function parseThresholdEd25519NearTransaction(raw: unknown, label: string): ThresholdEd25519NearTransaction;
 export declare function parseThresholdEd25519NearAction(action: unknown, label: string): ThresholdEd25519NearAction;
 export {};

package/dist/types/shared-ts/src/threshold/keyMaterialBrands.d.ts

@@ -0,0 +1,25 @@
+import type { EcdsaThresholdKeyId } from './ecdsaDerivationRoleLocalBootstrap';
+export type Brand<T, Name extends string> = T & {
+    readonly __brand: Name;
+};
+export type EcdsaDerivationKeyVersion = Brand<string, 'EcdsaDerivationKeyVersion'>;
+export type SigningSessionSealKeyVersion = Brand<string, 'SigningSessionSealKeyVersion'>;
+export type EcdsaClientVerifyingShareB64u = Brand<string, 'EcdsaClientVerifyingShareB64u'>;
+export type Ed25519RelayerKeyId = Brand<string, 'Ed25519RelayerKeyId'>;
+export type EcdsaRelayerKeyId = Brand<string, 'EcdsaRelayerKeyId'>;
+export type EcdsaKeyHandle = Brand<string, 'EcdsaKeyHandle'>;
+export declare function parseNonEmptyBrand<T extends string>(value: unknown, label: string): Brand<string, T>;
+export declare function parseEcdsaDerivationKeyVersion(value: unknown): EcdsaDerivationKeyVersion;
+export declare function parseSigningSessionSealKeyVersion(value: unknown): SigningSessionSealKeyVersion;
+export declare function parseEcdsaClientVerifyingShareB64u(value: unknown): EcdsaClientVerifyingShareB64u;
+export declare function parseEd25519RelayerKeyId(value: unknown): Ed25519RelayerKeyId;
+export declare function parseEcdsaRelayerKeyId(value: unknown): EcdsaRelayerKeyId;
+export declare function parseEcdsaKeyHandle(value: unknown): EcdsaKeyHandle;
+export declare function formatEcdsaDerivationKeyVersionForWire(value: EcdsaDerivationKeyVersion): string;
+export declare function formatSigningSessionSealKeyVersionForWire(value: SigningSessionSealKeyVersion): string;
+export declare function formatEcdsaClientVerifyingShareB64uForWire(value: EcdsaClientVerifyingShareB64u): string;
+export declare function formatEd25519RelayerKeyIdForWire(value: Ed25519RelayerKeyId): string;
+export declare function formatEcdsaRelayerKeyIdForWire(value: EcdsaRelayerKeyId): string;
+export declare function formatEcdsaThresholdKeyIdForWire(value: EcdsaThresholdKeyId): string;
+export declare function formatEcdsaKeyHandleForWire(value: EcdsaKeyHandle): string;
+//# sourceMappingURL=keyMaterialBrands.d.ts.map

package/dist/types/shared-ts/src/threshold/participants.d.ts

@@ -1,4 +1,4 @@
-export type ThresholdParticipantRole = 'client' | 'relayer';
+type ThresholdParticipantRole = 'client' | 'relayer';
 export declare const THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID: 1;
 export declare const THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID: 2;
 export declare const THRESHOLD_ED25519_2P_PARTICIPANT_IDS: readonly [1, 2];
@@ -6,7 +6,7 @@ export declare const THRESHOLD_ED25519_2P_PARTICIPANT_IDS: readonly [1, 2];
  * Metadata describing how a participant share is derived/stored.
  * This is informational in v1 and may be used for validation/policy later.
  */
-export type ThresholdEd25519ShareDerivation = 'prf_first_v1' | 'derived_master_secret_v1' | 'kv_random_v1' | 'unknown';
+type ThresholdEd25519ShareDerivation = 'prf_first_v1' | 'derived_master_secret_v1' | 'kv_random_v1' | 'unknown';
 export interface ThresholdEd25519ParticipantV1 {
     /** FROST identifier (1-indexed). */
     id: number;
@@ -17,15 +17,8 @@ export interface ThresholdEd25519ParticipantV1 {
     relayerKeyId?: string;
     shareDerivation?: ThresholdEd25519ShareDerivation;
 }
-export declare const THRESHOLD_ED25519_PARTICIPANT_SET_V1: "threshold_ed25519_participants_v1";
-export interface ThresholdEd25519ParticipantSetV1 {
-    version: typeof THRESHOLD_ED25519_PARTICIPANT_SET_V1;
-    groupPublicKey: string;
-    participants: ThresholdEd25519ParticipantV1[];
-}
 export declare function normalizeThresholdEd25519ParticipantId(id: unknown): number | null;
 export declare function normalizeThresholdEd25519ParticipantIds(input: unknown): number[] | null;
-export declare function areThresholdEd25519ParticipantIds2p(participantIds: number[] | null | undefined, expected?: readonly number[]): boolean;
 export declare function parseThresholdEd25519ParticipantsV1(input: unknown): ThresholdEd25519ParticipantV1[] | null;
 export declare function buildThresholdEd25519Participants2pV1(input: {
     clientParticipantId?: number | null;
@@ -35,4 +28,5 @@ export declare function buildThresholdEd25519Participants2pV1(input: {
     clientShareDerivation?: ThresholdEd25519ShareDerivation | null;
     relayerShareDerivation?: ThresholdEd25519ShareDerivation | null;
 }): ThresholdEd25519ParticipantV1[];
+export {};
 //# sourceMappingURL=participants.d.ts.map

package/dist/types/shared-ts/src/threshold/secp256k1.d.ts

@@ -1,39 +1,2 @@
-/**
- * secp256k1 group order `n`.
- *
- * This is the order of the prime-order subgroup generated by `G` (the base point),
- * as specified by SEC 2 (Recommended Elliptic Curve Domain Parameters).
- *
- * Important:
- * - This is **not** the field modulus `p` (used for x/y coordinate arithmetic).
- * - Scalars for secp256k1 signing/keygen are interpreted modulo `n`.
- *
- * Used by the threshold-secp256k1 ECDSA stack to reduce HKDF-derived bytes into a
- * non-zero scalar in `[1, n-1]`.
- */
-export declare const SECP256K1_ORDER: bigint;
-export type ThresholdSecp256k1Ecdsa2pTopologyV1 = {
-    readonly kind: 'threshold_secp256k1_ecdsa_2p_v1';
-};
-export type ThresholdSecp256k1Ecdsa2pTopologyParseResult = {
-    readonly ok: true;
-    readonly value: ThresholdSecp256k1Ecdsa2pTopologyV1;
-} | {
-    readonly ok: false;
-    readonly message: string;
-};
-export type ThresholdSecp256k1Ecdsa2pParticipantIdsParseResult = {
-    readonly ok: true;
-    readonly value: readonly [1, 2];
-} | {
-    readonly ok: false;
-    readonly message: string;
-};
-export declare const THRESHOLD_SECP256K1_ECDSA_2P_TOPOLOGY_V1: ThresholdSecp256k1Ecdsa2pTopologyV1;
-export declare const THRESHOLD_SECP256K1_ECDSA_2P_CLIENT_ID_V1: 1;
-export declare const THRESHOLD_SECP256K1_ECDSA_2P_RELAYER_ID_V1: 2;
-export declare const THRESHOLD_SECP256K1_ECDSA_2P_THRESHOLD_V1: 2;
 export declare const THRESHOLD_SECP256K1_ECDSA_2P_PARTICIPANT_IDS_V1: readonly [1, 2];
-export declare function parseThresholdSecp256k1Ecdsa2pTopologyV1(value: unknown): ThresholdSecp256k1Ecdsa2pTopologyParseResult;
-export declare function parseThresholdSecp256k1Ecdsa2pParticipantIdsV1(value: unknown): ThresholdSecp256k1Ecdsa2pParticipantIdsParseResult;
 //# sourceMappingURL=secp256k1.d.ts.map

package/dist/types/shared-ts/src/threshold/sessionPolicy.d.ts

@@ -1,5 +1,29 @@
+import type { WebAuthnRpId } from '../utils/domainIds';
 export declare const DEFAULT_WALLET_SESSION_TTL_MS: number;
 export declare const DEFAULT_WALLET_SESSION_REMAINING_USES = 3;
 export declare const MAX_WALLET_SESSION_TTL_MS: number;
 export declare const MAX_WALLET_SESSION_REMAINING_USES = 1000000;
+export type Ed25519AuthorityScope = {
+    kind: 'passkey_rp';
+    rpId: WebAuthnRpId;
+    proofKind?: never;
+    email?: never;
+    provider?: never;
+    providerUserId?: never;
+    challengeId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+} | {
+    kind: 'email_otp';
+    provider: 'google' | 'email';
+    providerUserId: string;
+    proofKind?: never;
+    rpId?: never;
+    email?: never;
+    challengeId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+};
 //# sourceMappingURL=sessionPolicy.d.ts.map

package/dist/types/shared-ts/src/threshold/signingRootScope.d.ts

@@ -4,7 +4,7 @@ export type RuntimePolicyScope = {
     readonly envId: string;
     readonly signingRootVersion: string;
 };
-export type SigningRootScope = {
+type SigningRootScope = {
     readonly signingRootId: string;
     readonly signingRootVersion?: string;
 };
@@ -17,8 +17,5 @@ export declare function normalizeRuntimePolicyScopeFields(input: unknown): Omit<
     readonly signingRootVersion?: string;
 };
 export declare function signingRootScopeFromRuntimePolicyScope(scope: RuntimePolicyScope): SigningRootScope;
-export declare function normalizeSigningRootScope(input: {
-    readonly signingRootId: unknown;
-    readonly signingRootVersion?: unknown;
-}): SigningRootScope;
+export {};
 //# sourceMappingURL=signingRootScope.d.ts.map

package/dist/types/shared-ts/src/utils/addAuthMethodRegistration.d.ts

@@ -3,10 +3,9 @@
  *
  * This lives in the shared package because three parties read the same record:
  * the server that mints it, the browser that passes it to
- * `navigator.credentials.create`, and — since Refactor 103 Phase 8 — the
- * linked-device target preparation that carries it to Device 2. One
- * declaration, so a change to the ceremony cannot silently diverge from what a
- * linked device creates its passkey against.
+ * `navigator.credentials.create`, and the linked-device target preparation that
+ * carries it to Device 2. One declaration, so a change to the ceremony cannot
+ * silently diverge from what a linked device creates its passkey against.
  *
  * Everything here is fixed by the canonical add-auth-method ceremony: two
  * algorithms in a fixed order, a resident key, no attestation, and PRF

package/dist/types/shared-ts/src/utils/addWalletAuthMethod.d.ts

@@ -1,5 +1,5 @@
 /**
- * Refactor 109C — the internal contract for same-device auth-method addition.
+ * The internal contract for same-device auth-method addition.
  *
  * One product action ("Add authentication method") has exactly two branches:
  * a Passkey-only authority adds Email OTP, or an Email-OTP-only authority adds
@@ -21,7 +21,7 @@
 import type { DeviceId, WalletSessionId } from '../authorization/capabilityKinds';
 import type { DigestB64u } from './canonicalPrimitives';
 import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from './domainIds';
-import type { EmailOtpWalletAuthMethodDraftV1, PasskeyWalletAuthMethodDraftV1, WalletAuthMethodRecordV2 } from './registrationIntent';
+import type { ActiveWalletAuthMethodRecordV2, EmailOtpWalletAuthMethodDraftV1, PasskeyWalletAuthMethodDraftV1 } from './walletAuthMethodRecord';
 import type { WalletAuthMethod } from './signerDomain';
 /**
  * The factor family a method belongs to.
@@ -45,7 +45,7 @@ export type AddWalletAuthMethodBranchV1 = 'passkey_to_email_otp' | 'email_otp_to
  * being read as any other integer on the authority — a signer slot, a counter,
  * a timestamp — at the boundaries where all of them arrive as bare numbers.
  */
-export type WalletAuthorityRevocationEpochV1 = number & {
+type WalletAuthorityRevocationEpochV1 = number & {
     readonly __walletAuthorityRevocationEpochBrand: 'WalletAuthorityRevocationEpochV1';
 };
 /**
@@ -53,7 +53,7 @@ export type WalletAuthorityRevocationEpochV1 = number & {
  * target method ID to it, and a client request can neither nominate nor
  * substitute one.
  */
-export type AddWalletAuthMethodCeremonyIdV1 = string & {
+type AddWalletAuthMethodCeremonyIdV1 = string & {
     readonly __addWalletAuthMethodCeremonyIdBrand: 'AddWalletAuthMethodCeremonyIdV1';
 };
 /**
@@ -154,49 +154,6 @@ export type VerifiedAddWalletAuthMethodInputV1 = (AddWalletAuthMethodInputCommon
     readonly sourceProof: VerifiedEmailOtpSourceProofV1;
     readonly target: VerifiedPasskeyTargetV1;
 });
-export type AddWalletAuthMethodFailureReasonV1 = 'source_session_not_selected' | 'source_method_not_active' | 'source_authority_not_active' | 'source_authority_not_full_owner' | 'source_authority_changed' | 'local_installation_incomplete' | 'source_proof_rejected' | 'target_factor_rejected' | 'target_family_present' | 'intent_expired' | 'intent_digest_mismatch' | 'identity_mismatch' | 'custody_reseal_failed' | 'local_persistence_failed' | 'activation_conflict';
-/**
- * The one result union both SDK entry points return. UI control flow switches
- * on `kind`; `reason` and `message` are display and diagnostic data and never
- * select a code path.
- */
-export type AddWalletAuthMethodResultV1 = {
-    readonly kind: 'active';
-    readonly branch: AddWalletAuthMethodBranchV1;
-    readonly walletId: WalletId;
-    readonly walletAuthorityId: WalletAuthorityId;
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly family: WalletAuthMethodFamilyV1;
-    readonly sourceWalletAuthMethodId: WalletAuthMethodId;
-    readonly sourceWalletSessionId: WalletSessionId;
-} | {
-    readonly kind: 'already_configured';
-    readonly walletId: WalletId;
-    readonly walletAuthorityId: WalletAuthorityId;
-    readonly family: WalletAuthMethodFamilyV1;
-    readonly existingWalletAuthMethodId: WalletAuthMethodId;
-} | {
-    readonly kind: 'cancelled';
-    readonly branch: AddWalletAuthMethodBranchV1;
-} | {
-    readonly kind: 'expired';
-    readonly branch: AddWalletAuthMethodBranchV1;
-} | {
-    readonly kind: 'unauthorized';
-    readonly branch: AddWalletAuthMethodBranchV1;
-    readonly reason: AddWalletAuthMethodFailureReasonV1;
-    readonly message: string;
-} | {
-    readonly kind: 'target_verification_failed';
-    readonly branch: AddWalletAuthMethodBranchV1;
-    readonly reason: AddWalletAuthMethodFailureReasonV1;
-    readonly message: string;
-} | {
-    readonly kind: 'integrity_error';
-    readonly branch: AddWalletAuthMethodBranchV1;
-    readonly reason: AddWalletAuthMethodFailureReasonV1;
-    readonly message: string;
-};
 /**
  * Admission: what the operation does before it verifies anything.
  *
@@ -205,7 +162,7 @@ export type AddWalletAuthMethodResultV1 = {
  * holds. Resolving it here is what keeps the promise that a present family
  * never reaches target verification or a local write.
  */
-export type AddWalletAuthMethodAdmissionV1 = {
+type AddWalletAuthMethodAdmissionV1 = {
     readonly kind: 'proceed';
     readonly branch: AddWalletAuthMethodBranchV1;
 } | {
@@ -227,69 +184,11 @@ export declare function addWalletAuthMethodSourceFamily(branch: AddWalletAuthMet
  * which is why the operation needs no same-family rejection of its own.
  */
 export declare function admitAddWalletAuthMethod(input: {
-    readonly sourceMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly sourceMethod: ActiveWalletAuthMethodRecordV2;
     readonly targetFamily: WalletAuthMethodFamilyV1;
-    readonly activeMethodsOnAuthority: readonly Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>[];
+    readonly activeMethodsOnAuthority: readonly ActiveWalletAuthMethodRecordV2[];
 }): AddWalletAuthMethodAdmissionV1;
 export declare function parseWalletAuthorityRevocationEpochV1(value: unknown): WalletAuthorityRevocationEpochV1;
 export declare function parseAddWalletAuthMethodCeremonyIdV1(value: unknown): AddWalletAuthMethodCeremonyIdV1;
-/**
- * The one place raw source identity becomes branded. Every field is read from
- * the resolved session and authority, so a caller cannot widen the source by
- * supplying an extra one.
- */
-export declare function parseAddWalletAuthMethodSourceV1(raw: {
-    readonly walletId: unknown;
-    readonly walletAuthorityId: unknown;
-    readonly sourceWalletAuthMethodId: unknown;
-    readonly sourceWalletSessionId: unknown;
-    readonly deviceId: unknown;
-    readonly authorityDigestB64u: unknown;
-    readonly revocationEpoch: unknown;
-}): AddWalletAuthMethodSourceV1;
-export declare function parseAddWalletAuthMethodIntentIdentityV1(raw: {
-    readonly addAuthMethodCeremonyId: unknown;
-    readonly intentDigestB64u: unknown;
-    readonly targetWalletAuthMethodId: unknown;
-    readonly expiresAtMs: unknown;
-}): AddWalletAuthMethodIntentIdentityV1;
-/**
- * Branch-specific builders rather than one constructor with a `branch`
- * parameter: each accepts only the proof and target its branch can hold, so a
- * mismatched pair is a compile error at the call site instead of a runtime
- * check inside the operation.
- */
-export declare function buildPasskeyToEmailOtpAdditionV1(input: {
-    readonly source: AddWalletAuthMethodSourceV1;
-    readonly intent: AddWalletAuthMethodIntentIdentityV1;
-    readonly sourceProof: VerifiedPasskeySourceProofV1;
-    readonly target: VerifiedEmailOtpTargetV1;
-}): Extract<VerifiedAddWalletAuthMethodInputV1, {
-    readonly branch: 'passkey_to_email_otp';
-}>;
-export declare function buildEmailOtpToPasskeyAdditionV1(input: {
-    readonly source: AddWalletAuthMethodSourceV1;
-    readonly intent: AddWalletAuthMethodIntentIdentityV1;
-    readonly sourceProof: VerifiedEmailOtpSourceProofV1;
-    readonly target: VerifiedPasskeyTargetV1;
-}): Extract<VerifiedAddWalletAuthMethodInputV1, {
-    readonly branch: 'email_otp_to_passkey';
-}>;
-/**
- * The exact active record the activation stage inserts.
- *
- * It reuses the source authority and the server-allocated target method ID,
- * and it is built from the verified target draft alone — no field is carried
- * across from the source method, which is what keeps addition from copying
- * permissions, activations, or credential identity onto the new method.
- */
-export declare function buildAddedWalletAuthMethodRecordV2Input(input: {
-    readonly verified: VerifiedAddWalletAuthMethodInputV1;
-    readonly nowMs: number;
-}): WalletAuthMethodRecordV2;
 export {};
 //# sourceMappingURL=addWalletAuthMethod.d.ts.map

package/dist/types/shared-ts/src/utils/addWalletAuthMethod.typecheck.d.ts

@@ -1,11 +1,24 @@
 /**
- * Compile-time fixtures for the Refactor 109C addition contract.
+ * Compile-time fixtures for the same-device auth-method addition contract.
  *
- * Every `@ts-expect-error` below is a state R109C forbids. If one of them ever
+ * Every `@ts-expect-error` below is a state the contract forbids. If one ever
  * starts compiling, the branch union has been widened — a same-family
  * addition, a mixed target draft, an unverified value, or a cast has become
  * expressible — and this file fails the build rather than the behaviour
  * failing in a browser.
  */
-export {};
+import { type AddWalletAuthMethodIntentIdentityV1, type VerifiedAddWalletAuthMethodSourceProofV1, type VerifiedAddWalletAuthMethodTargetV1 } from './addWalletAuthMethod';
+export declare const intent: AddWalletAuthMethodIntentIdentityV1;
+export declare const passkeySourceProof: Extract<VerifiedAddWalletAuthMethodSourceProofV1, {
+    kind: 'verified_passkey_source_proof_v1';
+}>;
+export declare const emailOtpSourceProof: Extract<VerifiedAddWalletAuthMethodSourceProofV1, {
+    kind: 'verified_email_otp_source_proof_v1';
+}>;
+export declare const emailOtpTarget: Extract<VerifiedAddWalletAuthMethodTargetV1, {
+    kind: 'verified_email_otp_target_v1';
+}>;
+export declare const passkeyTarget: Extract<VerifiedAddWalletAuthMethodTargetV1, {
+    kind: 'verified_passkey_target_v1';
+}>;
 //# sourceMappingURL=addWalletAuthMethod.typecheck.d.ts.map

package/dist/types/shared-ts/src/utils/canonicalPrimitives.d.ts

@@ -8,5 +8,7 @@ export declare function parseCorrelationId(value: unknown): CorrelationId;
 export declare function parseDigestB64u(value: unknown): DigestB64u;
 export declare function parseIsoTimestamp(value: unknown): IsoTimestamp;
 export declare function isoTimestampFromUnixMs(value: unknown): IsoTimestamp;
+export declare function sha256DigestB64u(bytes: Uint8Array): Promise<DigestB64u>;
+export declare function sha256Utf8DigestB64u(text: string): Promise<DigestB64u>;
 export {};
 //# sourceMappingURL=canonicalPrimitives.d.ts.map

package/dist/types/shared-ts/src/utils/digestEncoding.d.ts

@@ -0,0 +1,9 @@
+import { type DigestB64u } from './canonicalPrimitives';
+export declare function concat(parts: readonly Uint8Array[]): Uint8Array;
+export declare function u32(value: number, label: string): Uint8Array;
+export declare function u64(value: number, label: string): Uint8Array;
+export declare function lp32(value: Uint8Array, label: string): Uint8Array;
+export declare function text(value: string, label: string): Uint8Array;
+export declare function rawDigest(value: DigestB64u, label: string): Uint8Array;
+export declare function rawPublicKey(value: string, label: string): Uint8Array;
+//# sourceMappingURL=digestEncoding.d.ts.map

package/dist/types/shared-ts/src/utils/domainIds.d.ts

@@ -1,7 +1,7 @@
 export type DomainId<TBrand extends string> = string & {
     readonly __domainIdBrand: TBrand;
 };
-export type DomainIdParseError = {
+type DomainIdParseError = {
     code: 'missing' | 'invalid';
     message: string;
 };
@@ -117,7 +117,6 @@ export declare function parseMpcRegisteredPublicKeyBindingRef(raw: unknown): Dom
 export declare function buildMpcMaterialActivationRef(fields: MpcMaterialActivationRefFields): MpcMaterialActivationRef;
 export declare function mpcMaterialActivationRefsEqual(left: MpcMaterialActivationRef, right: MpcMaterialActivationRef): boolean;
 export declare function parseMpcMaterialActivationRef(raw: unknown): DomainIdParseResult<MpcMaterialActivationRef>;
-export declare function formatWebAuthnRpIdForWire(value: WebAuthnRpId): string;
 export declare function parseThresholdEd25519SessionId(raw: unknown): DomainIdParseResult<ThresholdEd25519SessionId>;
 export declare function parseThresholdEcdsaSessionId(raw: unknown): DomainIdParseResult<ThresholdEcdsaSessionId>;
 export declare function parseEcdsaActiveStateId(raw: unknown): DomainIdParseResult<EcdsaActiveStateId>;

package/dist/types/shared-ts/src/utils/ecdsaKeyFactsInventory.d.ts

@@ -8,7 +8,7 @@ type EcdsaInventoryChainTarget = {
     chainId: number;
     networkSlug?: string;
 };
-export type WalletEcdsaKeyFactsInventoryChallengeInput = {
+type WalletEcdsaKeyFactsInventoryChallengeInput = {
     walletId: string;
     rpId: string;
     keyTargets: readonly {
@@ -18,7 +18,6 @@ export type WalletEcdsaKeyFactsInventoryChallengeInput = {
     runtimePolicyScope?: unknown;
     serverNonceB64u: string;
 };
-export declare function canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input: WalletEcdsaKeyFactsInventoryChallengeInput): string;
 export declare function computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u(input: WalletEcdsaKeyFactsInventoryChallengeInput): Promise<string>;
 export {};
 //# sourceMappingURL=ecdsaKeyFactsInventory.d.ts.map

package/dist/types/shared-ts/src/utils/emailOtpDomain.d.ts

@@ -1,14 +1,14 @@
 export declare const EMAIL_OTP_CHANNEL: "email_otp";
 export declare const EMAIL_OTP_INITIAL_ENROLLMENT_VERSION: "1";
 export declare function emailOtpDeviceEnrollmentId(walletId: string, providerSubject: string): string;
-export declare const WALLET_UNLOCK_BACKENDS: readonly ["passkey", "email_otp"];
+declare const WALLET_UNLOCK_BACKENDS: readonly ["passkey", "email_otp"];
 export type WalletUnlockBackend = (typeof WALLET_UNLOCK_BACKENDS)[number];
 export type WalletEmailOtpChannel = typeof EMAIL_OTP_CHANNEL;
-export declare const WALLET_EMAIL_OTP_LOGIN_OPERATIONS: readonly ["wallet_unlock", "transaction_sign", "export_key"];
+declare const WALLET_EMAIL_OTP_LOGIN_OPERATIONS: readonly ["wallet_unlock", "transaction_sign", "export_key"];
 export type WalletEmailOtpLoginOperation = (typeof WALLET_EMAIL_OTP_LOGIN_OPERATIONS)[number];
 export declare const WALLET_EMAIL_OTP_REGISTRATION_OPERATION: "registration";
-/** Linked-device enrollment (Refactor 103 Phase 6): prove control of the
- * wallet's enrolled email destination to complete one device link. */
+/** Linked-device enrollment: prove control of the wallet's enrolled email
+ * destination to complete one device link. */
 export declare const WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION: "device_link";
 export type WalletEmailOtpOperation = WalletEmailOtpLoginOperation | typeof WALLET_EMAIL_OTP_REGISTRATION_OPERATION | typeof WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION;
 export declare const WALLET_EMAIL_OTP_ACTIONS: {
@@ -24,7 +24,7 @@ export declare const WALLET_EMAIL_OTP_UNLOCK_OPERATION: "wallet_unlock";
 export declare const WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION: "transaction_sign";
 export type WalletEmailOtpExportOperation = typeof WALLET_EMAIL_OTP_EXPORT_OPERATION;
 export type WalletEmailOtpTransactionSignOperation = typeof WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION;
-export type WalletEmailOtpUnlockOperation = typeof WALLET_EMAIL_OTP_UNLOCK_OPERATION;
 export declare function isWalletUnlockBackend(value: string): value is WalletUnlockBackend;
 export declare function isWalletEmailOtpLoginOperation(value: string): value is WalletEmailOtpLoginOperation;
+export {};
 //# sourceMappingURL=emailOtpDomain.d.ts.map

package/dist/types/shared-ts/src/utils/emailOtpRecoveryKey.d.ts

@@ -25,7 +25,5 @@ export declare function formatEmailOtpRecoveryKey(normalizedKey: string): EmailO
 export declare function buildEmailOtpRecoveryCodeSet(keys: readonly string[]): EmailOtpRecoveryCodeSet;
 export declare function normalizeEmailOtpRecoveryKey(input: string): string;
 export declare function decodeEmailOtpRecoveryKey(input: string): Uint8Array;
-export declare function generateEmailOtpRecoveryKey(): string;
-export declare function generateEmailOtpRecoveryKeySet(): EmailOtpRecoveryCodeSet;
 export {};
 //# sourceMappingURL=emailOtpRecoveryKey.d.ts.map

package/dist/types/shared-ts/src/utils/errors.d.ts

@@ -7,7 +7,6 @@ export { formatNearRpcError, getNearShortErrorMessage } from './near';
  * Always returns a string (may be empty when nothing usable can be derived).
  */
 export declare function errorMessage(err: unknown): string;
-export declare function redactSensitiveErrorText(input: string): string;
 export declare function safeErrorMessage(err: unknown): string;
 export declare function errorLogSummary(err: unknown): {
     name: string;
@@ -27,12 +26,6 @@ export declare function toError(e: unknown): Error;
 export declare function isTouchIdCancellationError(error: unknown): boolean;
 export declare function isWebAuthnRpIdOriginConfigurationError(error: unknown): boolean;
 export declare function isUserCancellationError(error: unknown): boolean;
-/**
- * Get a user-friendly error message for TouchID/FaceID cancellation
- * @param context - The context where the cancellation occurred (e.g., 'registration', 'login')
- * @returns A user-friendly error message
- */
-export declare function getTouchIdCancellationMessage(context: 'registration' | 'login'): string;
 /**
  * Transform an error message to be more user-friendly
  * @param error - The original error object or message