@seams/wallet-server 0.6.1 → 0.7.1

package/dist/types/shared-ts/src/utils/routerAbPublicKeyset.d.ts

@@ -1,36 +1,36 @@
 export declare const ROUTER_AB_PUBLIC_KEYSET_VERSION_V2: "router_ab_keyset_v2";
 export declare const ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH: "/.well-known/router-ab/keyset";
 export declare const ROUTER_AB_PUBLIC_KEYSET_PATH: "/router-ab/keyset";
-export type RouterAbSignerRoleV1 = 'signer_a' | 'signer_b';
-export type RouterAbSignerEnvelopeHpkePublicKeyV1 = {
+type RouterAbSignerRoleV1 = 'signer_a' | 'signer_b';
+type RouterAbSignerEnvelopeHpkePublicKeyV1 = {
     role: RouterAbSignerRoleV1;
     key_epoch: string;
     public_key: string;
 };
-export type RouterAbSignerEnvelopeHpkePublicKeySetV1 = {
+type RouterAbSignerEnvelopeHpkePublicKeySetV1 = {
     deriver_a: RouterAbSignerEnvelopeHpkePublicKeyV1;
     deriver_b: RouterAbSignerEnvelopeHpkePublicKeyV1;
 };
-export type RouterAbSignerEnvelopeHpkeCurrentPublicKeySetV1 = {
+type RouterAbSignerEnvelopeHpkeCurrentPublicKeySetV1 = {
     current: RouterAbSignerEnvelopeHpkePublicKeySetV1;
     previous?: never;
     previous_retire_at_ms?: never;
 };
-export type RouterAbSignerEnvelopeHpkeRotatingPublicKeySetV1 = {
+type RouterAbSignerEnvelopeHpkeRotatingPublicKeySetV1 = {
     current: RouterAbSignerEnvelopeHpkePublicKeySetV1;
     previous: RouterAbSignerEnvelopeHpkePublicKeySetV1;
     previous_retire_at_ms: number;
 };
-export type RouterAbSignerEnvelopeHpkeRotationPublicKeySetV1 = RouterAbSignerEnvelopeHpkeCurrentPublicKeySetV1 | RouterAbSignerEnvelopeHpkeRotatingPublicKeySetV1;
-export type RouterAbSignerPeerVerifyingKeyHexV1 = {
+type RouterAbSignerEnvelopeHpkeRotationPublicKeySetV1 = RouterAbSignerEnvelopeHpkeCurrentPublicKeySetV1 | RouterAbSignerEnvelopeHpkeRotatingPublicKeySetV1;
+type RouterAbSignerPeerVerifyingKeyHexV1 = {
     role: RouterAbSignerRoleV1;
     verifying_key_hex: string;
 };
-export type RouterAbSignerPeerVerifyingKeyHexSetV1 = {
+type RouterAbSignerPeerVerifyingKeyHexSetV1 = {
     deriver_a: RouterAbSignerPeerVerifyingKeyHexV1;
     deriver_b: RouterAbSignerPeerVerifyingKeyHexV1;
 };
-export type RouterAbPublicHpkeKeyDescriptorV1 = {
+type RouterAbPublicHpkeKeyDescriptorV1 = {
     key_epoch: string;
     public_key: string;
 };
@@ -42,10 +42,5 @@ export type RouterAbPublicKeysetV2 = {
 };
 export declare function requireRouterAbX25519PublicKey(value: unknown, label: string): string;
 export declare function parseRouterAbPublicKeysetV2(value: unknown): RouterAbPublicKeysetV2;
-export declare function selectRouterAbSignerEnvelopeHpkeKeyForEpoch(args: {
-    keyset: RouterAbSignerEnvelopeHpkeRotationPublicKeySetV1;
-    role: RouterAbSignerRoleV1;
-    keyEpoch: string;
-    nowMs: number;
-}): RouterAbSignerEnvelopeHpkePublicKeyV1;
+export {};
 //# sourceMappingURL=routerAbPublicKeyset.d.ts.map

package/dist/types/shared-ts/src/utils/routerAbTraceContext.d.ts

@@ -3,7 +3,7 @@ export type RouterAbTraceContextV1 = {
     readonly kind: 'router_ab_trace_context_v1';
     readonly value: string;
 };
-export type RouterAbTraceContextParseResultV1 = {
+type RouterAbTraceContextParseResultV1 = {
     readonly ok: true;
     readonly value: RouterAbTraceContextV1;
 } | {
@@ -13,4 +13,5 @@ export type RouterAbTraceContextParseResultV1 = {
 };
 export declare function parseRouterAbTraceContextV1(raw: unknown): RouterAbTraceContextParseResultV1;
 export declare function createRouterAbTraceContextV1(): RouterAbTraceContextV1;
+export {};
 //# sourceMappingURL=routerAbTraceContext.d.ts.map

package/dist/types/shared-ts/src/utils/secureRandomId.d.ts

@@ -1,6 +1,4 @@
-export declare function secureRandomBytes(length?: number, label?: string): Uint8Array;
 export declare function secureRandomBase64Url(byteLength?: number, label?: string): string;
 export declare function secureRandomId(prefix: string, byteLength?: number, label?: string): string;
-export declare function secureRandomUintBelow(maxExclusive: number, label?: string): number;
 export declare function secureRandomBase36(length: number, label?: string): string;
 //# sourceMappingURL=secureRandomId.d.ts.map

package/dist/types/shared-ts/src/utils/signerDomain.d.ts

@@ -15,31 +15,12 @@ export declare const WALLET_AUTH_METHODS: {
 };
 /** Authentication methods that can be enrolled on a wallet. */
 export type WalletAuthMethod = (typeof WALLET_AUTH_METHODS)[keyof typeof WALLET_AUTH_METHODS];
-export type WalletAuthMethodSignerResolution = {
-    kind: 'supported';
-    walletAuthMethod: typeof WALLET_AUTH_METHODS.passkey;
-    signerAuthMethod: typeof SIGNER_AUTH_METHODS.passkey;
-} | {
-    kind: 'supported';
-    walletAuthMethod: typeof WALLET_AUTH_METHODS.emailOtp;
-    signerAuthMethod: typeof SIGNER_AUTH_METHODS.emailOtp;
-} | {
-    kind: 'unsupported';
-    walletAuthMethod: Exclude<WalletAuthMethod, SignerAuthMethod>;
-    signerAuthMethod?: never;
-};
-export declare const WALLET_AUTH_PROOF_METHODS: {
-    readonly passkey: "passkey";
-    readonly emailOtp: "email_otp";
-    readonly session: "session";
-};
-export type WalletAuthProofMethod = (typeof WALLET_AUTH_PROOF_METHODS)[keyof typeof WALLET_AUTH_PROOF_METHODS];
-export declare const SIGNING_SESSION_RETENTIONS: {
+declare const SIGNING_SESSION_RETENTIONS: {
     readonly session: "session";
     readonly singleUse: "single_use";
 };
 export type SigningSessionRetention = (typeof SIGNING_SESSION_RETENTIONS)[keyof typeof SIGNING_SESSION_RETENTIONS];
-export declare const SIGNING_SESSION_POLICIES: {
+declare const SIGNING_SESSION_POLICIES: {
     readonly session: "session";
     readonly perOperation: "per_operation";
 };
@@ -57,19 +38,6 @@ export declare const SIGNER_SOURCES: {
     readonly selfHostedImport: "self_hosted_import";
 };
 export type SignerSource = (typeof SIGNER_SOURCES)[keyof typeof SIGNER_SOURCES];
-export declare const SIGNER_KIND_VALUES: readonly SignerKind[];
-export declare const SIGNER_AUTH_METHOD_VALUES: readonly SignerAuthMethod[];
-export declare const WALLET_AUTH_METHOD_VALUES: readonly WalletAuthMethod[];
-export declare const WALLET_AUTH_PROOF_METHOD_VALUES: readonly WalletAuthProofMethod[];
-export declare const SIGNER_SOURCE_VALUES: readonly SignerSource[];
-export declare const SIGNING_SESSION_POLICY_VALUES: readonly SigningSessionPolicy[];
-export declare const SENSITIVE_OPERATION_POLICY_VALUES: readonly SensitiveOperationPolicy[];
-export declare function isSignerKind(value: unknown): value is SignerKind;
-export declare function isSignerAuthMethod(value: unknown): value is SignerAuthMethod;
 export declare function isWalletAuthMethod(value: unknown): value is WalletAuthMethod;
-export declare function resolveSignerAuthMethodForWalletAuthMethod(walletAuthMethod: WalletAuthMethod): WalletAuthMethodSignerResolution;
-export declare function isWalletAuthProofMethod(value: unknown): value is WalletAuthProofMethod;
-export declare function isSignerSource(value: unknown): value is SignerSource;
-export declare function isSigningSessionPolicy(value: unknown): value is SigningSessionPolicy;
-export declare function isSensitiveOperationPolicy(value: unknown): value is SensitiveOperationPolicy;
+export {};
 //# sourceMappingURL=signerDomain.d.ts.map

package/dist/types/shared-ts/src/utils/signerSlot.d.ts

@@ -4,8 +4,4 @@ export type SignerSlot = number & {
 export declare function parseSignerSlot(value: unknown, options?: {
     min?: number;
 }): SignerSlot | null;
-export declare function coerceSignerSlot(value: unknown, options?: {
-    min?: number;
-    fallback?: number;
-}): number;
 //# sourceMappingURL=signerSlot.d.ts.map

package/dist/types/shared-ts/src/utils/signingSessionSeal.d.ts

@@ -16,12 +16,6 @@ export declare const WALLET_SESSION_SEAL_BASE_PATH: "/wallet-session/seal";
 export declare function decodeSigningSessionSecret32(plaintext: Uint8Array): Uint8Array | null;
 export declare const PASSKEY_PRF_FIRST_SALT_V1: Uint8Array<ArrayBuffer>;
 export declare const PASSKEY_PRF_SECOND_SALT_V1: Uint8Array<ArrayBuffer>;
-export declare const EMAIL_OTP_HKDF_SALTS: {
-    readonly signingSessionSecret: "seams/email-otp/signing-session-secret/v1";
-    readonly signingSessionRestoreRoot: "seams/signing-session/restore-root/v1";
-    readonly thresholdEcdsaClientRoot: "seams/signing-session/threshold-ecdsa-client-root/v1";
-    readonly thresholdEd25519RestoreSeed: "seams/signing-session/threshold-ed25519-restore-seed/v1";
-};
 export type SigningSessionSealAuthMethod = Extract<SignerAuthMethod, typeof SIGNER_AUTH_METHODS.passkey | typeof SIGNER_AUTH_METHODS.emailOtp>;
 export type SigningSessionSealCurve = 'ed25519' | 'ecdsa';
 export type SigningSessionSealGroupId = typeof SIGNING_SESSION_SEAL_GROUP_ID;
@@ -36,7 +30,7 @@ export type RouterAbEd25519NormalSigningState = {
 };
 export declare function parseRouterAbEd25519NormalSigningState(value: unknown): RouterAbEd25519NormalSigningState | null;
 export declare function requireRouterAbEd25519NormalSigningState(value: unknown): RouterAbEd25519NormalSigningState;
-export type SealedSigningSessionEcdsaChainTarget = {
+type SealedSigningSessionEcdsaChainTarget = {
     kind: 'tempo';
     chainId: number;
     networkSlug: string;

package/dist/types/shared-ts/src/utils/validation.d.ts

@@ -1,27 +1,27 @@
-export interface ValidationResult {
-    valid: boolean;
-    error?: string;
-}
 export type { NearAccountValidationOptions } from './near';
 export { ensureEd25519Prefix, validateNearAccountId, isValidAccountId } from './near';
 export { normalizeOptionalString as toOptionalString, normalizeOptionalTrimmedString as toOptionalTrimmedString, normalizeTrimmedString as toTrimmedString, stripTrailingSlashes, ensureLeadingSlash, toBasePath, toOriginOrUndefined, toRorOriginOrNull, toSingleLine, normalizeInteger, normalizePositiveInteger, } from './normalize';
 export declare function requireTrimmedString(value: unknown, label: string, message?: string): string;
 export declare function toOptionalTrimmedNonEmptyString(value: unknown): string | undefined;
+export declare function requireNonEmptyString(value: unknown, label: string): string;
+export declare function requireCanonicalString(value: unknown, label: string, message?: string): string;
+export declare function coerceNonEmptyString(value: unknown, label: string): string;
+export declare function coerceNonNullishString(value: unknown, label: string): string;
 export declare function isObject(x: unknown): x is Record<string, unknown>;
 export declare function isPlainObject(x: unknown): x is Record<string, unknown>;
-export declare function toOptionalRecordString(record: unknown, key: string): string | undefined;
 export declare function isString(x: unknown): x is string;
 export declare function isNonEmptyString(x: unknown): x is string;
-export declare function isNumber(x: unknown): x is number;
 export declare function isFiniteNumber(x: unknown): x is number;
 export declare function isFunction(x: unknown): x is (...args: unknown[]) => unknown;
 export declare function isBoolean(x: unknown): x is boolean;
 export declare function isArray<T = unknown>(x: unknown): x is T[];
+export declare function asRecord(value: unknown): Record<string, unknown> | null;
+export declare function asRecordOrArray(value: unknown): Record<string, unknown> | null;
+export declare function requireRecord(value: unknown, label: string): Record<string, unknown>;
+export declare function requireRecordOrArray(value: unknown, label: string): Record<string, unknown>;
+export declare function requireRecordCopy(value: unknown, label: string): Record<string, unknown>;
+export declare function requireArray(value: unknown, label: string): readonly unknown[];
 export declare function assertString(val: unknown, name?: string): string;
-export declare function assertNumber(val: unknown, name?: string): number;
-export declare function assertBoolean(val: unknown, name?: string): boolean;
-export declare function assertObject<T extends Record<string, unknown> = Record<string, unknown>>(val: unknown, name?: string): T;
-export declare function assertArray<T = unknown>(val: unknown, name?: string): T[];
 export declare function stripFunctionsShallow<T extends Record<string, unknown>>(obj?: T): Partial<T> | undefined;
 export interface PlainSignedTransactionLike {
     transaction: unknown;

package/dist/types/shared-ts/src/utils/variant.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The members of union `U` whose `K` field is `V`.
+ *
+ * A bare `Extract<U, { K: V }>` accepts any `V` and quietly becomes `never` when
+ * nothing matches, so a misspelled or renamed discriminant only fails later, at
+ * some distant use. Here `V` must be one of the values `U[K]` already has.
+ */
+export type Variant<U, K extends keyof U, V extends U[K]> = Extract<U, {
+    readonly [P in K]: V;
+}>;
+//# sourceMappingURL=variant.d.ts.map

package/dist/types/shared-ts/src/utils/variant.typecheck.d.ts

@@ -0,0 +1,22 @@
+import type { Variant } from './variant';
+type Method = {
+    readonly kind: 'passkey';
+    readonly status: 'active';
+    readonly credentialId: string;
+} | {
+    readonly kind: 'passkey';
+    readonly status: 'revoked';
+    readonly credentialId: string;
+} | {
+    readonly kind: 'email_otp';
+    readonly status: 'active';
+    readonly email: string;
+};
+type ActivePasskey = Variant<Variant<Method, 'status', 'active'>, 'kind', 'passkey'>;
+export declare const activePasskey: ActivePasskey;
+export declare const activeMethods: readonly Variant<Method, 'status', 'active'>[];
+export declare const revokedPasskey: ActivePasskey;
+export type MisspelledKind = Variant<Method, 'kind', 'pass_key'>;
+export type NotADiscriminant = Variant<Method, 'email', string>;
+export {};
+//# sourceMappingURL=variant.typecheck.d.ts.map

package/dist/types/shared-ts/src/utils/walletAddSignerActivation.d.ts

@@ -12,12 +12,12 @@
  */
 import { type CanonicalEcdsaServerActivationRequest } from './ecdsaCapabilityActivation';
 import type { RouterAbEcdsaVerifiedClientActivationFactsV1 } from './routerAbEcdsaDerivation';
-export declare const WALLET_ADD_SIGNER_ECDSA_ACTIVATE_OPERATION = "wallet_add_signer_activate_v2";
-export type WalletAddSignerEcdsaActivationCommandInput = {
+type WalletAddSignerEcdsaActivationCommandInput = {
     readonly addSignerCeremonyId: string;
     readonly activationCorrelationId: string;
     readonly publicFacts: RouterAbEcdsaVerifiedClientActivationFactsV1;
 };
 export declare function buildCanonicalWalletAddSignerEcdsaActivationRequest(input: WalletAddSignerEcdsaActivationCommandInput): CanonicalEcdsaServerActivationRequest;
 export declare function computeWalletAddSignerEcdsaActivationRequestDigestB64u(input: WalletAddSignerEcdsaActivationCommandInput): Promise<string>;
+export {};
 //# sourceMappingURL=walletAddSignerActivation.d.ts.map

package/dist/types/shared-ts/src/utils/walletAuthAuthority.d.ts

@@ -1,4 +1,4 @@
-import { type EmailOtpChallengeId, type EmailOtpProviderUserId, type VerifiedEmailAddress, type WalletAuthorityBindingDigest, type WalletAuthMethodId, type WalletId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from './domainIds';
+import { type EmailOtpProviderUserId, type WalletAuthorityBindingDigest, type WalletAuthMethodId, type WalletId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from './domainIds';
 export type EmailOtpProvider = 'google' | 'email';
 export type PasskeyFactorIdentity = {
     kind: 'passkey';
@@ -47,10 +47,6 @@ export type WalletAuthAuthority = PasskeyWalletAuthAuthority | EmailOtpWalletAut
 export declare function isPasskeyWalletAuthAuthority(authority: WalletAuthAuthority): authority is PasskeyWalletAuthAuthority;
 export declare function isEmailOtpWalletAuthAuthority(authority: WalletAuthAuthority): authority is EmailOtpWalletAuthAuthority;
 export declare function walletAuthAuthoritiesMatch(left: WalletAuthAuthority, right: WalletAuthAuthority): boolean;
-export type EmailOtpFactorProfile = {
-    factor: EmailOtpFactorIdentity;
-    email: VerifiedEmailAddress;
-};
 export type WalletAuthAuthorityRef = {
     kind: 'wallet_auth_authority_ref';
     walletId: WalletId;
@@ -68,57 +64,11 @@ export type WalletAuthAuthorityRef = {
     walletAuthMethodId: WalletAuthMethodId;
 };
 export declare function parseWalletAuthAuthorityRef(raw: unknown): WalletAuthAuthorityRef | null;
-export type AuthOperationPurpose = 'registration' | 'unlock' | 'step_up' | 'recovery' | 'key_export';
-export type AuthMethodProof = {
-    kind: 'passkey_registration_credential';
-    webauthnRegistration: unknown;
-} | {
-    kind: 'passkey_assertion';
-    assertion: unknown;
-} | {
-    kind: 'email_otp_challenge';
-    challengeId: EmailOtpChallengeId;
-    otpCode: string;
-} | {
-    kind: 'google_sso_registration';
-    registrationAttemptId: string;
-    registrationOfferId: string;
-    registrationCandidateId: string;
-};
-export type AuthBoundaryProof = {
-    purpose: AuthOperationPurpose;
-    proof: AuthMethodProof;
-};
-export type ProofFor<P extends AuthOperationPurpose> = AuthBoundaryProof & {
-    readonly __authOperationPurpose?: P;
-};
-export type AuthBoundaryProofPurposeRejectionReason = 'registration_requires_registration_proof' | 'recovery_requires_email_otp_challenge' | 'interactive_operation_requires_assertion_or_email_otp_challenge';
-export type AuthBoundaryProofPurposeValidation = {
-    ok: true;
-    proof: AuthBoundaryProof;
-} | {
-    ok: false;
-    reason: AuthBoundaryProofPurposeRejectionReason;
-    proof: AuthBoundaryProof;
-};
-export declare function validateAuthBoundaryProofPurpose(proof: AuthBoundaryProof): AuthBoundaryProofPurposeValidation;
-export type RegistrationWalletCandidate = {
-    kind: 'registration_wallet_candidate';
-    walletId: WalletId;
-    registrationAttemptId: string;
-};
 export declare function buildPasskeyWalletAuthAuthority(args: {
     walletId: unknown;
     rpId: unknown;
     credentialIdB64u: unknown;
 }): PasskeyWalletAuthAuthority;
-export declare function buildPasskeyFactorIdentity(args: {
-    credentialIdB64u: unknown;
-}): PasskeyFactorIdentity;
-export declare function buildEmailOtpFactorIdentity(args: {
-    provider: unknown;
-    providerUserId: unknown;
-}): EmailOtpFactorIdentity;
 export declare function buildEmailOtpWalletAuthAuthority(args: {
     walletId: unknown;
     provider: unknown;
@@ -128,16 +78,9 @@ export declare function buildEmailOtpWalletAuthAuthority(args: {
 export declare function emailOtpWalletAuthAuthorityProvider(authority: EmailOtpWalletAuthAuthority): EmailOtpProvider;
 export declare function emailOtpWalletAuthAuthorityProviderUserId(authority: EmailOtpWalletAuthAuthority): EmailOtpProviderUserId;
 export declare function emailOtpWalletAuthAuthorityEmailHashHex(authority: EmailOtpWalletAuthAuthority): string;
-export declare function parseAuthFactorIdentity(raw: unknown): AuthFactorIdentity | null;
-export declare function parsePasskeyFactorIdentity(raw: unknown): PasskeyFactorIdentity | null;
-export declare function parseEmailOtpFactorIdentity(raw: unknown): EmailOtpFactorIdentity | null;
 export declare function parseWalletAuthAuthority(raw: unknown): WalletAuthAuthority | null;
 export declare function parseEmailOtpWalletAuthAuthority(raw: unknown): EmailOtpWalletAuthAuthority | null;
 export declare function parsePasskeyWalletAuthAuthority(raw: unknown): PasskeyWalletAuthAuthority | null;
-export declare function emailOtpFactorProfile(args: {
-    factor: EmailOtpFactorIdentity;
-    email: unknown;
-}): EmailOtpFactorProfile;
 export declare function canonicalWalletAuthorityBindingDigestInput(args: {
     authority: WalletAuthAuthority;
 }): string;

package/dist/types/shared-ts/src/utils/walletAuthMethodRecord.d.ts

@@ -0,0 +1,104 @@
+import { type DigestB64u } from './canonicalPrimitives';
+import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from './domainIds';
+import type { Variant } from './variant';
+export type WalletAuthMethodRevocationProof = {
+    readonly kind: 'webauthn_assertion';
+    rpId: WebAuthnRpId;
+    credential: unknown;
+    expectedChallengeDigestB64u: string;
+} | {
+    readonly kind: 'email_otp';
+    readonly challengeId: string;
+    readonly otpCode: string;
+    readonly ownerProofBindingDigest: string;
+};
+export declare function computeWalletAuthMethodRevokeOperationFingerprintV1(input: {
+    readonly walletId: WalletId;
+    readonly targetWalletAuthMethodId: WalletAuthMethodId;
+    readonly requestedAtMs: number;
+}): Promise<DigestB64u>;
+export type WalletAuthMethodRecord = {
+    version: 'wallet_auth_method_v1';
+    kind: 'passkey';
+    status: 'active' | 'revoked';
+    walletId: WalletId;
+    rpId: WebAuthnRpId;
+    credentialIdB64u: string;
+    credentialPublicKeyB64u: string;
+    counter: number;
+    createdAtMs: number;
+    updatedAtMs: number;
+    emailHashHex?: never;
+    challengeId?: never;
+} | {
+    version: 'wallet_auth_method_v1';
+    kind: 'email_otp';
+    status: 'active' | 'revoked';
+    walletId: WalletId;
+    emailHashHex: string;
+    registrationAuthorityId: string;
+    createdAtMs: number;
+    updatedAtMs: number;
+    rpId?: never;
+    credentialIdB64u?: never;
+    credentialPublicKeyB64u?: never;
+    counter?: never;
+};
+type WalletAuthMethodLifecycleV1 = {
+    readonly status: 'pending_local_install';
+    readonly activatedAtMs?: never;
+    readonly revokedAtMs?: never;
+} | {
+    readonly status: 'active';
+    readonly activatedAtMs: number;
+    readonly revokedAtMs?: never;
+} | {
+    readonly status: 'revoked';
+    readonly activatedAtMs: number;
+    readonly revokedAtMs: number;
+};
+type WalletAuthMethodDraftCommonV1 = {
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly walletId: WalletId;
+    readonly createdAtMs: number;
+};
+export type PasskeyWalletAuthMethodDraftV1 = WalletAuthMethodDraftCommonV1 & {
+    readonly kind: 'passkey';
+    readonly rpId: WebAuthnRpId;
+    readonly credentialIdB64u: WebAuthnCredentialIdB64u;
+    readonly credentialPublicKeyB64u: string;
+    readonly counter: number;
+    readonly emailHashHex?: never;
+    readonly registrationAuthorityId?: never;
+};
+export type EmailOtpWalletAuthMethodDraftV1 = WalletAuthMethodDraftCommonV1 & {
+    readonly kind: 'email_otp';
+    readonly emailHashHex: string;
+    readonly registrationAuthorityId: string;
+    readonly rpId?: never;
+    readonly credentialIdB64u?: never;
+    readonly credentialPublicKeyB64u?: never;
+    readonly counter?: never;
+};
+type WalletAuthMethodCommonV1 = {
+    readonly version: 'wallet_auth_method_v2';
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly walletId: WalletId;
+    readonly walletAuthorityId: WalletAuthorityId;
+    readonly createdAtMs: number;
+    readonly updatedAtMs: number;
+};
+export type WalletAuthMethodRecordV2 = WalletAuthMethodCommonV1 & ((PasskeyWalletAuthMethodDraftV1 & WalletAuthMethodLifecycleV1) | (EmailOtpWalletAuthMethodDraftV1 & WalletAuthMethodLifecycleV1));
+export type PasskeyWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'kind', 'passkey'>;
+export type EmailOtpWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'kind', 'email_otp'>;
+export type PendingWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'status', 'pending_local_install'>;
+export type ActiveWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'status', 'active'>;
+export type RevokedWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'status', 'revoked'>;
+export type ActivePasskeyWalletAuthMethodRecordV2 = Variant<ActiveWalletAuthMethodRecordV2, 'kind', 'passkey'>;
+export type ActiveEmailOtpWalletAuthMethodRecordV2 = Variant<ActiveWalletAuthMethodRecordV2, 'kind', 'email_otp'>;
+export declare function sameWalletAuthMethodRecordV2(left: WalletAuthMethodRecordV2, right: WalletAuthMethodRecordV2): boolean;
+export declare function buildWalletAuthMethodRecordV2(input: WalletAuthMethodRecordV2): WalletAuthMethodRecordV2;
+export declare function parseWalletAuthMethodRecordV2(raw: unknown): WalletAuthMethodRecordV2 | null;
+export declare function walletAuthMethodRecordId(record: WalletAuthMethodRecord): WalletAuthMethodId;
+export {};
+//# sourceMappingURL=walletAuthMethodRecord.d.ts.map

package/dist/types/shared-ts/src/utils/walletCapabilityBindings.d.ts

@@ -1,6 +1,6 @@
 import { type WalletAuthMethodId, type WalletId, type WebAuthnRpId } from './domainIds';
 import { type ImplicitNearAccountId, type NamedNearAccountId } from './near';
-import { type NearEd25519SigningKeyId } from './registrationIntent';
+import { type NearEd25519SigningKeyId } from './registrationIds';
 export type { WebAuthnRpId };
 export type RpId = WebAuthnRpId;
 export type WalletIdentity = {
@@ -44,11 +44,11 @@ export type NearEd25519SignerBinding = {
     readonly nearEd25519SigningKeyId: NearEd25519SigningKeyId;
     readonly signerSlot: number;
 };
-export type WalletCapabilityBindingParseError = {
+type WalletCapabilityBindingParseError = {
     readonly code: 'missing' | 'invalid';
     readonly message: string;
 };
-export type WalletCapabilityBindingParseResult<T> = {
+type WalletCapabilityBindingParseResult<T> = {
     readonly ok: true;
     readonly value: T;
 } | {
@@ -56,12 +56,9 @@ export type WalletCapabilityBindingParseResult<T> = {
     readonly error: WalletCapabilityBindingParseError;
 };
 export declare function parseRpId(raw: unknown): WalletCapabilityBindingParseResult<RpId>;
-export declare function formatRpIdForWire(value: RpId): string;
-export declare function walletIdentityFromRaw(raw: unknown): WalletCapabilityBindingParseResult<WalletIdentity>;
 export declare function buildWalletIdentity(args: {
     walletId: WalletId;
 }): WalletIdentity;
-export declare function passkeyAuthScopeFromRaw(raw: unknown): WalletCapabilityBindingParseResult<PasskeyAuthScope>;
 export declare function buildPasskeyAuthScope(args: {
     wallet: WalletIdentity;
     rpId: RpId;
@@ -79,7 +76,6 @@ export declare function buildEmailOtpWalletAuthMethodBinding(args: {
 }): WalletAuthMethodBinding;
 export declare function walletAuthMethodBindingId(binding: WalletAuthMethodBinding): WalletAuthMethodId;
 export declare function walletAuthMethodBindingFromRaw(raw: unknown): WalletCapabilityBindingParseResult<WalletAuthMethodBinding>;
-export declare function currentWalletAuthMethodFromRaw(raw: unknown): WalletCapabilityBindingParseResult<CurrentWalletAuthMethod>;
 export declare function buildNoCurrentWalletAuthMethod(): Extract<CurrentWalletAuthMethod, {
     kind: 'none';
 }>;

package/dist/types/shared-ts/src/utils/webauthnDeviceInfo.d.ts

@@ -10,8 +10,8 @@
  * Stored on the authenticator row and returned by the authenticators listing
  * so profile UIs can label signers ("Chrome on macOS", "iCloud Keychain").
  */
-export type WebAuthnDeviceBrowser = 'chrome' | 'safari' | 'firefox' | 'edge' | 'other';
-export type WebAuthnDeviceOs = 'macos' | 'ios' | 'windows' | 'android' | 'linux' | 'other';
+type WebAuthnDeviceBrowser = 'chrome' | 'safari' | 'firefox' | 'edge' | 'other';
+type WebAuthnDeviceOs = 'macos' | 'ios' | 'windows' | 'android' | 'linux' | 'other';
 export type WebAuthnAuthenticatorDeviceInfo = {
     /** Display-ready label, e.g. "Chrome on macOS". Never empty. */
     label: string;
@@ -26,8 +26,6 @@ export type WebAuthnAuthenticatorDeviceInfo = {
     /** Display name for the provider, e.g. "iCloud Keychain". */
     providerLabel?: string;
 };
-export declare function webAuthnDeviceBrowserFromUserAgent(userAgent: string): WebAuthnDeviceBrowser;
-export declare function webAuthnDeviceOsFromUserAgent(userAgent: string): WebAuthnDeviceOs;
 export declare function deriveWebAuthnAuthenticatorDeviceInfo(input: {
     userAgent?: string;
     aaguid?: string;
@@ -45,4 +43,5 @@ export declare function parseWebAuthnAuthenticatorDeviceInfoJson(raw: unknown):
 /** Strict parse of a stored/transported device-info record; null when the
  * shape is not a valid WebAuthnAuthenticatorDeviceInfo. */
 export declare function parseWebAuthnAuthenticatorDeviceInfo(raw: unknown): WebAuthnAuthenticatorDeviceInfo | null;
+export {};
 //# sourceMappingURL=webauthnDeviceInfo.d.ts.map

package/dist/types/shared-ts/src/utils/wireSchema.d.ts

@@ -0,0 +1,60 @@
+/** Parses one wire value; `label` is the value's path, for its error messages. */
+export type WireParser<T> = (raw: unknown, label: string) => T;
+type WireType<P> = P extends WireParser<infer T> ? T : never;
+type WireShape = Record<string, WireParser<unknown>>;
+type WireObjectType<S extends WireShape> = {
+    -readonly [K in keyof S]: WireType<S[K]>;
+};
+type ParseResult<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly error: {
+        readonly message: string;
+    };
+};
+type Equal<A, B> = (<T>() => T extends A ? 1 : 2) extends <T>() => T extends B ? 1 : 2 ? true : false;
+type NeverPaddingKeys<T> = {
+    [K in keyof T]-?: [T[K]] extends [undefined] ? K : never;
+}[keyof T];
+type Writable<T> = T extends string | number | boolean | bigint | symbol | null | undefined ? T : {
+    -readonly [K in keyof T]: Writable<T[K]>;
+};
+/**
+ * Whether parser `P`, or the parser that function `P` builds, produces exactly `T`, apart
+ * from `T`'s `?: never` padding and readonly markers.
+ */
+export type ParsesExactly<P, T> = Equal<Writable<P extends () => infer Built ? WireType<Built> : WireType<P>>, Writable<T extends unknown ? Omit<T, NeverPaddingKeys<T>> : never>>;
+/** Compiles only when every check holds; the error shows which entry is false. */
+export type AllTrue<T extends readonly true[]> = T;
+/** One of the given strings. */
+export declare function wireLiteral<V extends string>(...literals: V[]): WireParser<V> & {
+    readonly literals: readonly V[];
+};
+/**
+ * An object with exactly the fields of `shape`, all required, returned in the shape's order.
+ * Checks run in this order: exact keys, then literals (they say which record this is), then
+ * the other fields in declaration order, then `refine`'s cross-field rules.
+ */
+export declare function wireObject<S extends WireShape>(shape: S, refine?: (value: WireObjectType<S>, label: string) => void): WireParser<WireObjectType<S>> & {
+    readonly shape: S;
+};
+/** One of `variants`, chosen by the literal each declares for field `tag`. */
+export declare function wireUnion<K extends string, V extends WireParser<unknown> & {
+    readonly shape: {
+        readonly [P in K]: {
+            readonly literals: readonly string[];
+        };
+    };
+}>(tag: K, variants: readonly V[]): WireParser<WireType<V>>;
+/** `null`, or a value `parse` accepts. */
+export declare function wireNullable<T>(parse: WireParser<T>): WireParser<T | null>;
+/** A non-empty array of `item`; `refine` checks rules that span the items. */
+export declare function wireNonEmptyArray<T>(item: WireParser<T>, refine?: (items: readonly [T, ...T[]], label: string) => void): WireParser<readonly [T, ...T[]]>;
+/** Adapts a parser that returns a result, putting the field's label before its error. */
+export declare function wireResult<T>(parse: (raw: unknown) => ParseResult<T>): WireParser<T>;
+/** Adapts a parser that throws, putting the field's label before its error. */
+export declare function wireLabeled<T>(parse: (raw: unknown) => T): WireParser<T>;
+export {};
+//# sourceMappingURL=wireSchema.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/backupAcknowledgement.d.ts

@@ -27,7 +27,7 @@ export type WalletRecoveryBackupAcknowledgementV1 = {
     readonly issuedAtMs: number;
     readonly acknowledgedAtMs: number;
 };
-export type WalletRecoveryBackupAcknowledgementParseResult = {
+type WalletRecoveryBackupAcknowledgementParseResult = {
     readonly ok: true;
     readonly record: WalletRecoveryBackupAcknowledgementV1;
 } | {
@@ -53,4 +53,5 @@ export declare function buildWalletRecoveryBackupAcknowledgementV1(input: {
     readonly issuedAtMs: number;
     readonly acknowledgedAtMs: number;
 }): WalletRecoveryBackupAcknowledgementV1;
+export {};
 //# sourceMappingURL=backupAcknowledgement.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/index.d.ts

@@ -2,7 +2,6 @@ export * from './recoveryCodes';
 export * from './recoveryEnvelopes';
 export * from './recoveryCodeReservation';
 export * from './recoveryCodeLocator';
-export * from './recoveryKekContext';
 export * from './walletRecoveryEnvelopeSet';
 export * from './walletRecoveryRotation';
 export * from './walletRecoveryEcdsaPossession';

package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeLocator.d.ts

@@ -1,22 +1,6 @@
 import { type DigestB64u } from '../utils/canonicalPrimitives';
-import type { DerivedWalletRecoveryKeyId } from './recoveryKeyId';
 /** The code-only digest used to locate a wallet recovery set. */
 export type RecoveryCodeLocatorV1 = DigestB64u;
-export type WalletRecoveryCodeLocatorRecordV1 = {
-    readonly locatorB64u: RecoveryCodeLocatorV1;
-    readonly recoveryKeyId: DerivedWalletRecoveryKeyId;
-};
 export declare function parseRecoveryCodeLocatorV1(value: unknown, label?: string): RecoveryCodeLocatorV1;
-/**
- * Derives the code-only locator from the normalized recovery code.
- *
- * The locator identifies a set for lookup. It never replaces the existing
- * wallet-bound recovery-key derivation that authenticates a wrap.
- */
-export declare function deriveRecoveryCodeLocatorV1(recoveryCode: string): Promise<RecoveryCodeLocatorV1>;
 export declare function deriveRecoveryCodeLocatorV1FromBytes(codeBytes: Uint8Array): Promise<RecoveryCodeLocatorV1>;
-export declare function deriveRecoveryCodeLocatorRecordsV1(inputs: readonly {
-    readonly codeBytes: Uint8Array;
-    readonly recoveryKeyId: DerivedWalletRecoveryKeyId;
-}[]): Promise<readonly WalletRecoveryCodeLocatorRecordV1[]>;
 //# sourceMappingURL=recoveryCodeLocator.d.ts.map