@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.js

@@ -82,6 +82,6 @@ function destroySigningSessionSealLockKeyHandle(handle) {
 	return shamir3pass_destroy_lock_key_handle(handle);
 }
 //#endregion
-export { addSigningSessionSealLock, deriveSigningSessionSealLockKeyHandle, destroySigningSessionSealLockKeyHandle, ensureSigningSessionSealShamir3PassWasm, removeSigningSessionSealLock };
+export { addSigningSessionSealLock, deriveSigningSessionSealLockKeyHandle, destroySigningSessionSealLockKeyHandle, removeSigningSessionSealLock };
 
 //# sourceMappingURL=shamir3PassWasm.js.map

package/dist/esm/threshold/session/signingSessionSeal/idempotencyRecords.js

@@ -6,7 +6,6 @@ function toPositiveInt(value) {
 	if (!Number.isFinite(parsed) || parsed <= 0) return null;
 	return Math.floor(parsed);
 }
-const parseCurrentSigningSessionSealIdempotencyRecord = parseCurrentSigningSessionSealIdempotencyResultRecord;
 function parseCurrentSigningSessionSealIdempotencyResultRecord(raw) {
 	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
 	const obj = raw;
@@ -50,6 +49,6 @@ function parseCurrentSigningSessionSealIdempotencyRouteResult(raw) {
 	return parseCurrentSigningSessionSealIdempotencyResultRecord(raw);
 }
 //#endregion
-export { parseCurrentSigningSessionSealIdempotencyRecord, parseCurrentSigningSessionSealIdempotencyResultRecord, parseCurrentSigningSessionSealIdempotencyRouteResult, parseCurrentSigningSessionSealIdempotencyStoredEntry };
+export { parseCurrentSigningSessionSealIdempotencyRouteResult, parseCurrentSigningSessionSealIdempotencyStoredEntry };
 
 //# sourceMappingURL=idempotencyRecords.js.map

package/dist/esm/threshold/session/signingSessionSeal/options.js

@@ -3,7 +3,7 @@ import "../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import "../../../shared-ts/src/utils/validation.js";
 import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID } from "../../../shared-ts/src/utils/signingSessionSeal.js";
-import { parseSigningSessionSealKeyVersion } from "../../../core/keyMaterialBrands.js";
+import { parseSigningSessionSealKeyVersion } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { createSigningSessionSealShamir3PassCipherAdapter } from "./crypto/cipher.js";
 import { createSigningSessionSealRoutesOptions } from "./routesOptions.js";
 //#region src/threshold/session/signingSessionSeal/options.ts

package/dist/esm/threshold/session/signingSessionSeal/transport/shared.js

@@ -1,13 +1,9 @@
 import { parseThresholdSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { ensureLeadingSlash } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
+import { asRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { WALLET_SESSION_SEAL_BASE_PATH } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 //#region src/threshold/session/signingSessionSeal/transport/shared.ts
 const DEFAULT_BASE_PATH = WALLET_SESSION_SEAL_BASE_PATH;
-function asRecord(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-	return value;
-}
 function readRequiredString(obj, key) {
 	return typeof obj[key] === "string" ? String(obj[key] || "").trim() : "";
 }
@@ -56,35 +52,9 @@ function parseSigningSessionSealApplyBody(body) {
 		}
 	};
 }
+/** Removal takes the same body as apply. */
 function parseSigningSessionSealRemoveBody(body) {
-	const obj = asRecord(body);
-	if (!obj) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Request body must be a JSON object"
-	};
-	const thresholdSessionId = readRequiredString(obj, "thresholdSessionId");
-	const ciphertext = readRequiredString(obj, "ciphertext");
-	if (!thresholdSessionId || !ciphertext) return {
-		ok: false,
-		code: "invalid_body",
-		message: "thresholdSessionId and ciphertext are required"
-	};
-	const parsedThresholdSessionId = parseThresholdSessionId(thresholdSessionId);
-	if (!parsedThresholdSessionId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "thresholdSessionId is invalid"
-	};
-	return {
-		ok: true,
-		value: {
-			thresholdSessionId: parsedThresholdSessionId.value,
-			ciphertext,
-			keyVersion: readOptionalString(obj, "keyVersion"),
-			metadata: readOptionalMetadata(obj.metadata)
-		}
-	};
+	return parseSigningSessionSealApplyBody(body);
 }
 async function authorizeSigningSessionSealRequest(args) {
 	const authorize = args.authorize ?? args.options.authorize;
@@ -107,9 +77,9 @@ async function authorizeSigningSessionSealRequest(args) {
 		status: 501
 	};
 }
-function signingSessionSealStatusCode(result) {
-	if (result.ok) return 200;
-	switch (result.code) {
+/** The statuses route and authorization failures share, or null for a code only one of them has. */
+function sharedFailureStatusCode(code) {
+	switch (code) {
 		case "unauthorized":
 		case "wallet_session_missing":
 		case "wallet_session_signature_invalid":
@@ -120,38 +90,31 @@ function signingSessionSealStatusCode(result) {
 		case "wallet_session_scope_mismatch": return 403;
 		case "wallet_budget_exhausted": return 409;
 		case "wallet_session_unavailable": return 503;
-		case "not_found": return 404;
 		case "rate_limited": return 429;
+		case "sessions_disabled": return 501;
+		case "internal": return 500;
+		default: return null;
+	}
+}
+function signingSessionSealStatusCode(result) {
+	if (result.ok) return 200;
+	const shared = sharedFailureStatusCode(result.code);
+	if (shared !== null) return shared;
+	switch (result.code) {
+		case "not_found": return 404;
 		case "expired":
 		case "exhausted":
 		case "stale_session_state":
 		case "conflict": return 409;
 		case "not_configured": return 503;
-		case "sessions_disabled":
 		case "not_implemented": return 501;
-		case "internal": return 500;
 		default: return 400;
 	}
 }
 function signingSessionSealAuthorizeStatusCode(result) {
 	if (result.ok) return 200;
 	if (Number.isFinite(Number(result.status))) return Math.max(100, Math.floor(Number(result.status)));
-	switch (result.code) {
-		case "unauthorized":
-		case "wallet_session_missing":
-		case "wallet_session_signature_invalid":
-		case "wallet_session_claims_invalid":
-		case "wallet_session_invalid":
-		case "wallet_session_expired": return 401;
-		case "forbidden":
-		case "wallet_session_scope_mismatch": return 403;
-		case "wallet_budget_exhausted": return 409;
-		case "wallet_session_unavailable": return 503;
-		case "rate_limited": return 429;
-		case "sessions_disabled": return 501;
-		case "internal": return 500;
-		default: return 400;
-	}
+	return sharedFailureStatusCode(result.code) ?? 400;
 }
 //#endregion
 export { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode };

package/dist/esm/threshold/statusCodes.js

@@ -34,6 +34,6 @@ function thresholdEcdsaStatusCode(result) {
 	return thresholdStatusCode(result);
 }
 //#endregion
-export { thresholdEcdsaStatusCode, thresholdEd25519StatusCode, thresholdStatusCode };
+export { thresholdEcdsaStatusCode, thresholdEd25519StatusCode };
 
 //# sourceMappingURL=statusCodes.js.map

package/dist/esm/wasm/near_signer/pkg/wasm_signer_worker.js

@@ -200,7 +200,7 @@ function threshold_ed25519_decode_signed_near_tx_borsh(args) {
 function __wbg_adapter_52(arg0, arg1, arg2) {
 	wasm.closure67_externref_shim(arg0, arg1, arg2);
 }
-function __wbg_adapter_387(arg0, arg1, arg2, arg3) {
+function __wbg_adapter_388(arg0, arg1, arg2, arg3) {
 	wasm.closure60_externref_shim(arg0, arg1, arg2, arg3);
 }
 Object.freeze({
@@ -811,7 +811,7 @@ function __wbg_get_imports() {
 				const a = state0.a;
 				state0.a = 0;
 				try {
-					return __wbg_adapter_387(a, state0.b, arg0, arg1);
+					return __wbg_adapter_388(a, state0.b, arg0, arg1);
 				} finally {
 					state0.a = a;
 				}
@@ -978,7 +978,7 @@ function __wbg_get_imports() {
 		}
 		return false;
 	};
-	imports.wbg.__wbindgen_closure_wrapper2623 = function(arg0, arg1, arg2) {
+	imports.wbg.__wbindgen_closure_wrapper2627 = function(arg0, arg1, arg2) {
 		return makeMutClosure(arg0, arg1, 68, __wbg_adapter_52);
 	};
 	imports.wbg.__wbindgen_debug_string = function(arg0, arg1) {

package/dist/types/shared-ts/src/authorization/capabilityKinds.d.ts

@@ -1,5 +1,5 @@
 import type { DomainId } from '../utils/domainIds';
-export type AuthorizationParseError = {
+type AuthorizationParseError = {
     readonly code: 'missing' | 'invalid';
     readonly message: string;
 };
@@ -15,12 +15,12 @@ export declare const CAPABILITY_KINDS: {
     readonly nearEd25519MpcSigning: "near_ed25519_mpc_signing";
     readonly evmEcdsaMpcSigning: "evm_ecdsa_mpc_signing";
 };
-export type CapabilityKind = (typeof CAPABILITY_KINDS)[keyof typeof CAPABILITY_KINDS];
+type CapabilityKind = (typeof CAPABILITY_KINDS)[keyof typeof CAPABILITY_KINDS];
 export declare const VAULT_OPERATION_KINDS: {
     readonly proxyUse: "vault.proxy_use";
     readonly reveal: "vault.reveal";
 };
-export type VaultOperationKind = (typeof VAULT_OPERATION_KINDS)[keyof typeof VAULT_OPERATION_KINDS];
+type VaultOperationKind = (typeof VAULT_OPERATION_KINDS)[keyof typeof VAULT_OPERATION_KINDS];
 export declare const NEAR_ED25519_MPC_OPERATION_KINDS: {
     readonly signTransaction: "near.sign_transaction";
     readonly signDelegateAction: "near.sign_delegate_action";
@@ -33,8 +33,7 @@ export declare const EVM_ECDSA_MPC_OPERATION_KINDS: {
     readonly exportKey: "evm.export_key";
 };
 export type EvmEcdsaMpcOperationKind = (typeof EVM_ECDSA_MPC_OPERATION_KINDS)[keyof typeof EVM_ECDSA_MPC_OPERATION_KINDS];
-export type CapabilityOperationKind = VaultOperationKind | NearEd25519MpcOperationKind | EvmEcdsaMpcOperationKind;
-export type CapabilityOperationKindByCapability = {
+type CapabilityOperationKindByCapability = {
     readonly vault_access: VaultOperationKind;
     readonly near_ed25519_mpc_signing: NearEd25519MpcOperationKind;
     readonly evm_ecdsa_mpc_signing: EvmEcdsaMpcOperationKind;
@@ -49,14 +48,13 @@ export declare const AUTH_FACTOR_KINDS: {
     readonly passkey: "passkey";
     readonly emailOtp: "email_otp";
 };
-export type AuthFactorKind = (typeof AUTH_FACTOR_KINDS)[keyof typeof AUTH_FACTOR_KINDS];
 export declare const AUTHORIZATION_EVIDENCE_KINDS: {
     readonly seamsSession: "seams_session";
     readonly passkeyAssertion: "passkey_assertion";
     readonly emailOtp: "email_otp";
 };
-export type SessionAuthorizationEvidenceKind = typeof AUTHORIZATION_EVIDENCE_KINDS.seamsSession;
-export type InteractiveAuthorizationEvidenceKind = typeof AUTHORIZATION_EVIDENCE_KINDS.passkeyAssertion | typeof AUTHORIZATION_EVIDENCE_KINDS.emailOtp;
+type SessionAuthorizationEvidenceKind = typeof AUTHORIZATION_EVIDENCE_KINDS.seamsSession;
+type InteractiveAuthorizationEvidenceKind = typeof AUTHORIZATION_EVIDENCE_KINDS.passkeyAssertion | typeof AUTHORIZATION_EVIDENCE_KINDS.emailOtp;
 export type AuthorizationEvidenceKind = SessionAuthorizationEvidenceKind | InteractiveAuthorizationEvidenceKind;
 export type AuthorizationEvidenceRequirement = {
     readonly mode: 'all' | 'any';
@@ -65,20 +63,13 @@ export type AuthorizationEvidenceRequirement = {
 export type TenantId = DomainId<'TenantId'>;
 export type PrincipalId = DomainId<'PrincipalId'>;
 export type EcdsaAuthorizationSessionId = DomainId<'EcdsaAuthorizationSessionId'>;
-export type SeamsSession = DomainId<'SeamsSession'>;
 export type HostedWalletSessionExchangeCodeId = DomainId<'HostedWalletSessionExchangeCodeId'>;
-export type SessionClientId = DomainId<'SessionClientId'>;
 export type DeviceId = DomainId<'DeviceId'>;
 export type AuthFactorId = DomainId<'AuthFactorId'>;
 export type CapabilityId = DomainId<'CapabilityId'>;
-export type CapabilityBindingId = DomainId<'CapabilityBindingId'>;
 export type CapabilityOperationId = DomainId<'CapabilityOperationId'>;
 export type WalletSessionAuthorizationId = DomainId<'WalletSessionAuthorizationId'>;
-export declare const AUTHORIZATION_GRANT_KINDS: {
-    readonly walletSession: "wallet_session_authorization";
-};
-export type AuthorizationGrantKind = (typeof AUTHORIZATION_GRANT_KINDS)[keyof typeof AUTHORIZATION_GRANT_KINDS];
-export type WalletSessionAuthorizationRef = {
+type WalletSessionAuthorizationRef = {
     readonly kind: 'wallet_session_authorization';
     readonly authorizationId: WalletSessionAuthorizationId;
 };
@@ -90,13 +81,9 @@ export type MpcWalletSigningQuotaId = DomainId<'MpcWalletSigningQuotaId'>;
 export type WalletSessionMintId = DomainId<'WalletSessionMintId'>;
 export type AuthorizationEvidenceId = DomainId<'AuthorizationEvidenceId'>;
 export type AuthorizationEvidenceSetId = DomainId<'AuthorizationEvidenceSetId'>;
-export type GrantChallengeId = DomainId<'GrantChallengeId'>;
-export type PolicyId = DomainId<'PolicyId'>;
 export type AuthorizationAuditEventId = DomainId<'AuthorizationAuditEventId'>;
 export type VaultId = DomainId<'VaultId'>;
 export type VaultItemId = DomainId<'VaultItemId'>;
-export type CapabilityOperationResultStorageRef = DomainId<'CapabilityOperationResultStorageRef'>;
-export declare function isCapabilityKind(value: unknown): value is CapabilityKind;
 export declare function isAuthorizationEvidenceKind(value: unknown): value is AuthorizationEvidenceKind;
 export declare function buildVaultOperationRef<TOperationKind extends VaultOperationKind>(operationKind: TOperationKind): Extract<CapabilityOperationRef, {
     readonly capabilityKind: 'vault_access';
@@ -121,13 +108,10 @@ export declare function buildAuthorizationEvidenceRequirement(input: {
 export declare function parseTenantId(value: unknown): AuthorizationParseResult<TenantId>;
 export declare function parsePrincipalId(value: unknown): AuthorizationParseResult<PrincipalId>;
 export declare function parseEcdsaAuthorizationSessionId(value: unknown): AuthorizationParseResult<EcdsaAuthorizationSessionId>;
-export declare function parseSeamsSession(value: unknown): AuthorizationParseResult<SeamsSession>;
 export declare function parseHostedWalletSessionExchangeCodeId(value: unknown): AuthorizationParseResult<HostedWalletSessionExchangeCodeId>;
-export declare function parseSessionClientId(value: unknown): AuthorizationParseResult<SessionClientId>;
 export declare function parseDeviceId(value: unknown): AuthorizationParseResult<DeviceId>;
 export declare function parseAuthFactorId(value: unknown): AuthorizationParseResult<AuthFactorId>;
 export declare function parseCapabilityId(value: unknown): AuthorizationParseResult<CapabilityId>;
-export declare function parseCapabilityBindingId(value: unknown): AuthorizationParseResult<CapabilityBindingId>;
 export declare function parseCapabilityOperationId(value: unknown): AuthorizationParseResult<CapabilityOperationId>;
 export declare function parseAuthorizationGrantRef(value: unknown): AuthorizationParseResult<AuthorizationGrantRef>;
 export declare function buildAuthorizationGrantRef(authorizationId: WalletSessionAuthorizationId): WalletSessionAuthorizationRef;
@@ -138,10 +122,8 @@ export declare function parseMpcWalletSigningQuotaId(value: unknown): Authorizat
 export declare function parseWalletSessionMintId(value: unknown): AuthorizationParseResult<WalletSessionMintId>;
 export declare function parseAuthorizationEvidenceId(value: unknown): AuthorizationParseResult<AuthorizationEvidenceId>;
 export declare function parseAuthorizationEvidenceSetId(value: unknown): AuthorizationParseResult<AuthorizationEvidenceSetId>;
-export declare function parseGrantChallengeId(value: unknown): AuthorizationParseResult<GrantChallengeId>;
-export declare function parsePolicyId(value: unknown): AuthorizationParseResult<PolicyId>;
 export declare function parseAuthorizationAuditEventId(value: unknown): AuthorizationParseResult<AuthorizationAuditEventId>;
 export declare function parseVaultId(value: unknown): AuthorizationParseResult<VaultId>;
 export declare function parseVaultItemId(value: unknown): AuthorizationParseResult<VaultItemId>;
-export declare function parseCapabilityOperationResultStorageRef(value: unknown): AuthorizationParseResult<CapabilityOperationResultStorageRef>;
+export {};
 //# sourceMappingURL=capabilityKinds.d.ts.map

package/dist/types/shared-ts/src/authorization/delegatedAuthority.d.ts

@@ -1,7 +1,5 @@
 import type { AuthorizationParseResult } from './capabilityKinds';
 export type DelegatedWalletPermissionV1 = 'sign' | 'export_keys' | 'link_devices' | 'revoke_devices';
-export declare const FULL_OWNER_PERMISSIONS: readonly ["export_keys", "link_devices", "revoke_devices", "sign"];
-export declare const SIGNING_ONLY_PERMISSIONS: readonly ["sign"];
 type CanonicalPermissionTuple = readonly [
     DelegatedWalletPermissionV1,
     ...DelegatedWalletPermissionV1[]
@@ -19,14 +17,12 @@ export type DelegatedWalletAuthorityV1 = {
     readonly kind: 'delegated_wallet_authority_v1';
     readonly permissions: CanonicalDelegatedWalletPermissionSetV1;
 };
-export declare function isDelegatedWalletPermissionV1(value: unknown): value is DelegatedWalletPermissionV1;
 export declare function parseDelegatedWalletPermissionSetV1(raw: unknown): AuthorizationParseResult<CanonicalDelegatedWalletPermissionSetV1>;
 export declare function buildDelegatedWalletAuthorityV1(input: {
     readonly permissions: CanonicalDelegatedWalletPermissionSetV1;
 }): DelegatedWalletAuthorityV1;
 export declare function parseDelegatedWalletAuthorityV1(raw: unknown): AuthorizationParseResult<DelegatedWalletAuthorityV1>;
 export declare function buildFullOwnerPermissionsV1(): CanonicalDelegatedWalletPermissionSetV1;
-export declare function buildSigningOnlyPermissionsV1(): CanonicalDelegatedWalletPermissionSetV1;
 export declare function buildFullOwnerDelegatedWalletAuthorityV1(): DelegatedWalletAuthorityV1;
 export declare function buildSigningOnlyDelegatedWalletAuthorityV1(): DelegatedWalletAuthorityV1;
 export declare function hasDelegatedWalletPermissionV1(authority: DelegatedWalletAuthorityV1, permission: DelegatedWalletPermissionV1): boolean;
@@ -36,9 +32,5 @@ export declare function validateDelegatedWalletAuthorityAttenuationV1(input: {
     readonly parent: DelegatedWalletAuthorityV1;
     readonly child: DelegatedWalletAuthorityV1;
 }): AuthorizationParseResult<true>;
-export declare function assertDelegatedWalletAuthorityAttenuationV1(input: {
-    readonly parent: DelegatedWalletAuthorityV1;
-    readonly child: DelegatedWalletAuthorityV1;
-}): void;
 export {};
 //# sourceMappingURL=delegatedAuthority.d.ts.map

package/dist/types/shared-ts/src/authorization/operationFingerprint.d.ts

@@ -1,5 +1,5 @@
 import type { DigestB64u } from '../utils/canonicalPrimitives';
-import { type AuthorizationParseResult, type CapabilityId, type CapabilityOperationId, type CapabilityOperationRef, type PrincipalId, type TenantId } from './capabilityKinds';
+import type { CapabilityId, CapabilityOperationId, CapabilityOperationRef, PrincipalId, TenantId } from './capabilityKinds';
 declare const capabilityOperationFingerprintDigestBrand: unique symbol;
 export type CapabilityOperationFingerprintDigest = DigestB64u & {
     readonly [capabilityOperationFingerprintDigestBrand]: true;
@@ -29,8 +29,6 @@ declare class CapabilityOperationEnvelopeProof<TOperation extends CapabilityOper
 }
 export type CapabilityOperationEnvelope<TOperation extends CapabilityOperationRef = CapabilityOperationRef> = CapabilityOperationEnvelopeProof<TOperation>;
 export declare function buildCapabilityOperationEnvelope<TOperation extends CapabilityOperationRef>(fields: CapabilityOperationEnvelopeFields<TOperation>): CapabilityOperationEnvelope<TOperation>;
-export declare function parseCapabilityOperationEnvelope(raw: unknown): AuthorizationParseResult<CapabilityOperationEnvelope>;
-export declare function parseOperationDigestSet(raw: unknown): AuthorizationParseResult<OperationDigestSet>;
 export declare function canonicalCapabilityOperationFingerprintPreimageV1(envelope: CapabilityOperationEnvelope): string;
 export declare function computeCapabilityOperationFingerprintDigest(envelope: CapabilityOperationEnvelope): Promise<CapabilityOperationFingerprintDigest>;
 export declare function parseCapabilityOperationFingerprintDigest(value: unknown): CapabilityOperationFingerprintDigest;

package/dist/types/shared-ts/src/authorization/walletAuthority.d.ts

@@ -3,7 +3,7 @@ import { type CanonicalDelegatedWalletPermissionSetV1 } from './delegatedAuthori
 import { type AuthorizationParseResult, type DeviceId } from './capabilityKinds';
 import { type ExactAdministeredEd25519SignerV1, type ExactAdministeredEcdsaSignerV1, type ExactAdministeredSignerManifestV1 } from '../device-linking/delegatedActivationPlan';
 import { type LinkDeviceSessionId, type LinkedDeviceEnrollmentId, type MpcMaterialActivationRef, type WalletAuthorityId, type WalletId, type WalletRecoveryOperationId } from '../utils/domainIds';
-export type WalletAuthorityPrincipalV1 = {
+type WalletAuthorityPrincipalV1 = {
     readonly kind: 'owner_device';
     readonly deviceId: DeviceId;
 };
@@ -55,7 +55,7 @@ export type WalletSignerActivationSetV1 = {
     readonly ed25519: WalletEd25519SignerActivationV1;
     readonly ecdsa: WalletEcdsaSignerActivationV1;
 };
-export type WalletSignerActivationMaterialsV1 = {
+type WalletSignerActivationMaterialsV1 = {
     readonly keyFamilies: readonly ['ed25519'];
     readonly ed25519: MpcMaterialActivationRef;
     readonly ecdsa?: never;
@@ -68,11 +68,11 @@ export type WalletSignerActivationMaterialsV1 = {
     readonly ed25519: MpcMaterialActivationRef;
     readonly ecdsa: MpcMaterialActivationRef;
 };
-export type WalletSignerActivationSetBuilderInputV1 = {
+type WalletSignerActivationSetBuilderInputV1 = {
     readonly manifest: ExactAdministeredSignerManifestV1;
     readonly materialActivations: WalletSignerActivationMaterialsV1;
 };
-export type WalletAuthorityCommonV1 = {
+type WalletAuthorityCommonV1 = {
     readonly kind: 'wallet_authority_v1';
     readonly authorityId: WalletAuthorityId;
     readonly walletId: WalletId;
@@ -136,11 +136,8 @@ export type ActiveCombinedWalletAuthorityV1 = Omit<ActiveWalletAuthorityV1, 'sig
 };
 export declare function isCombinedWalletSignerActivationSetV1(value: WalletSignerActivationSetV1): value is CombinedWalletSignerActivationSetV1;
 export declare function isActiveEcdsaWalletAuthorityV1(value: ActiveWalletAuthorityV1): value is ActiveEcdsaWalletAuthorityV1;
+export declare function isActiveEd25519WalletAuthorityV1(value: ActiveWalletAuthorityV1): value is ActiveEd25519WalletAuthorityV1;
 export declare function isActiveRecoveredWalletAuthorityV1(value: ActiveWalletAuthorityV1): value is ActiveRecoveredWalletAuthorityV1;
-export declare function buildWalletEd25519SignerActivationV1(input: {
-    readonly signer: ExactAdministeredEd25519SignerV1;
-    readonly materialActivation: MpcMaterialActivationRef;
-}): WalletEd25519SignerActivationV1;
 export declare function buildWalletEcdsaSignerActivationV1(input: {
     readonly signer: ExactAdministeredEcdsaSignerV1;
     readonly materialActivation: MpcMaterialActivationRef;
@@ -149,8 +146,6 @@ export declare function buildWalletSignerActivationSetV1(input: WalletSignerActi
 export declare function parseWalletSignerActivationSetV1(raw: unknown): AuthorizationParseResult<WalletSignerActivationSetV1>;
 export declare function encodeWalletSignerActivationSetV1(value: WalletSignerActivationSetV1): Uint8Array;
 export declare function computeWalletSignerActivationSetDigestB64u(value: WalletSignerActivationSetV1): Promise<DigestB64u>;
-export declare function parseWalletSignerActivationSetDigestB64u(raw: unknown): DigestB64u;
-export declare function buildWalletAuthorityV1(input: WalletAuthorityV1): WalletAuthorityV1;
 export declare function buildPendingWalletAuthorityV1(input: PendingWalletAuthorityV1): PendingWalletAuthorityV1;
 export declare function buildActiveWalletAuthorityV1(input: ActiveWalletAuthorityV1): ActiveWalletAuthorityV1;
 export declare function replaceActiveWalletAuthorityEd25519MaterialActivationV1(input: {
@@ -161,15 +156,33 @@ export declare function replaceActiveWalletAuthorityEd25519MaterialActivationV1(
 export declare function buildActiveCombinedWalletAuthorityV1(input: ActiveCombinedWalletAuthorityV1): ActiveCombinedWalletAuthorityV1;
 export declare function buildRevokedWalletAuthorityV1(input: RevokedWalletAuthorityV1): RevokedWalletAuthorityV1;
 export declare function parseWalletAuthorityV1(raw: unknown): AuthorizationParseResult<WalletAuthorityV1>;
-export declare function encodeWalletAuthorityV1(value: WalletAuthorityV1): Uint8Array;
 export declare function computeWalletAuthorityDigestB64u(value: WalletAuthorityV1): Promise<DigestB64u>;
-export declare function parseWalletAuthorityDigestB64u(raw: unknown): DigestB64u;
 export declare function walletAuthorityDigestsMatchV1(value: WalletAuthorityV1): Promise<boolean>;
+/**
+ * True when both authorities' stored digests verify and agree. The authority digest does not
+ * cover the timestamps, so those must agree too.
+ */
+export declare function sameVerifiedActiveWalletAuthorityV1(left: ActiveWalletAuthorityV1, right: ActiveWalletAuthorityV1): Promise<boolean>;
 export declare function extendEcdsaWalletAuthorityWithEd25519(input: {
     readonly authority: ActiveEcdsaWalletAuthorityV1;
     readonly ed25519: WalletEd25519SignerActivationV1;
     readonly now: number;
 }): Promise<ActiveCombinedWalletAuthorityV1>;
+/**
+ * An authority holding only a NEAR signer gains the ECDSA signer its owner
+ * added. The NEAR activation, identity and lifecycle stay as they were.
+ */
+export declare function extendEd25519WalletAuthorityWithEcdsa(input: {
+    readonly authority: ActiveEd25519WalletAuthorityV1;
+    readonly ecdsa: WalletEcdsaSignerActivationV1;
+    readonly now: number;
+}): Promise<ActiveCombinedWalletAuthorityV1>;
+/**
+ * Whether `next` is `previous` with an added ECDSA signer and nothing else
+ * changed. Both projections have already passed digest validation.
+ */
+export declare function isEcdsaExtensionOfEd25519WalletAuthority(previous: ActiveWalletAuthorityV1, next: ActiveWalletAuthorityV1): boolean;
 /** Both projections have already passed digest validation at their boundaries. */
 export declare function isEd25519ExtensionOfEcdsaWalletAuthority(previous: ActiveWalletAuthorityV1, next: ActiveWalletAuthorityV1): boolean;
+export {};
 //# sourceMappingURL=walletAuthority.d.ts.map

package/dist/types/shared-ts/src/authorization/walletSessionIssuance.d.ts

@@ -16,7 +16,7 @@ export type WalletSessionCommittedIdentityV1 = {
     readonly quotaId: MpcWalletSigningQuotaId;
 };
 /** The credential-free retry signal shared by issuer response boundaries. */
-export type WalletSessionAlreadyCommittedResponseV1 = {
+type WalletSessionAlreadyCommittedResponseV1 = {
     readonly ok: false;
     readonly code: 'already_committed';
     readonly message: string;
@@ -25,4 +25,5 @@ export type WalletSessionAlreadyCommittedResponseV1 = {
 };
 export declare function parseWalletSessionAlreadyCommittedResponseV1(value: unknown): WalletSessionAlreadyCommittedResponseV1 | null;
 export declare function parseWalletUnlockAlreadyCommittedResponseV1(value: unknown): WalletSessionAlreadyCommittedResponseV1 | null;
+export {};
 //# sourceMappingURL=walletSessionIssuance.d.ts.map

package/dist/types/shared-ts/src/device-linking/activeWalletSession.d.ts

@@ -1,5 +1,6 @@
-import type { ActiveWalletSessionV1, WalletCapabilitySubjectV1 } from './contracts';
+import type { ActiveWalletSessionV1, WalletSessionOperationCredentialV1 } from './contracts';
 export declare function activeWalletSessionV1RecordsEqual(left: ActiveWalletSessionV1, right: ActiveWalletSessionV1): boolean;
-export declare function walletCapabilitySubjectsEqual(left: WalletCapabilitySubjectV1, right: WalletCapabilitySubjectV1): boolean;
 export declare function walletSessionPreservesCapabilities(previous: ActiveWalletSessionV1, next: ActiveWalletSessionV1): boolean;
+export declare function parseWalletSessionOperationCredentialV1(raw: unknown): WalletSessionOperationCredentialV1;
+export declare function parseActiveWalletSessionV1(raw: unknown): ActiveWalletSessionV1;
 //# sourceMappingURL=activeWalletSession.d.ts.map

package/dist/types/shared-ts/src/device-linking/authorityActivation.d.ts

@@ -0,0 +1,5 @@
+import { type ActivateInstalledAuthorityResultV1, type LocalAuthorityActivationFinalAckV1, type LocalAuthorityInstallationReceiptV1 } from './contracts';
+export declare function parseLocalAuthorityInstallationReceiptV1(raw: unknown): LocalAuthorityInstallationReceiptV1;
+export declare function parseLocalAuthorityActivationFinalAckV1(raw: unknown): LocalAuthorityActivationFinalAckV1;
+export declare function parseActivateInstalledAuthorityResultV1(raw: unknown): ActivateInstalledAuthorityResultV1;
+//# sourceMappingURL=authorityActivation.d.ts.map

package/dist/types/shared-ts/src/device-linking/committedSignerPackages.d.ts

@@ -3,7 +3,7 @@ import type { CanonicalDelegatedWalletPermissionSetV1 } from '../authorization/d
 import type { PendingWalletAuthorityV1 } from '../authorization/walletAuthority';
 import { type LinkDeviceSessionId, type LinkedDeviceEnrollmentId, type MpcMaterialActivationRef, type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../utils/domainIds';
 import { type DigestB64u } from '../utils/canonicalPrimitives';
-import { type WalletAuthMethodRecordV2 } from '../utils/registrationIntent';
+import { type PendingWalletAuthMethodRecordV2 } from '../utils/walletAuthMethodRecord';
 import { type LinkedDeviceEd25519ExportRootPackageV1 } from './ed25519ExportRoot';
 import { type LinkedDeviceEcdsaEncryptedSourceContributionV1, type LinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from './sourceContribution';
 import { type RouterAbEd25519YaoApplicationBindingFactsV1, type RouterAbEd25519YaoActivationPublicReceiptV1, type RouterAbEd25519YaoActivationClientPackageV1, type RouterAbEd25519YaoCeremonyBindingV1 } from '../utils/routerAbEd25519Yao';
@@ -39,13 +39,10 @@ export type CommittedSignerPackageSetV1 = {
     readonly ed25519: CommittedEd25519SignerPackageV1;
     readonly ecdsa: CommittedEcdsaSignerPackageV1;
 };
-export type PendingWalletAuthMethodRecordV1 = Extract<WalletAuthMethodRecordV2, {
-    readonly status: 'pending_local_install';
-}>;
 export type CommittedAuthorityPackagesV1 = {
     readonly kind: 'committed_authority_packages_v1';
     readonly authority: PendingWalletAuthorityV1;
-    readonly authMethod: PendingWalletAuthMethodRecordV1;
+    readonly authMethod: PendingWalletAuthMethodRecordV2;
     readonly signerPackages: CommittedSignerPackageSetV1;
     readonly ed25519ExportRootPackage: LinkedDeviceEd25519ExportRootPackageV1 | null;
     readonly packageSetDigestB64u: DigestB64u;

package/dist/types/shared-ts/src/device-linking/contracts.d.ts

@@ -6,15 +6,16 @@ import type { WebAuthnAuthenticatorDeviceInfo } from '../utils/webauthnDeviceInf
 import type { DigestB64u } from '../utils/canonicalPrimitives';
 import type { WalletAddAuthMethodRegistrationOptions } from '../utils/addAuthMethodRegistration';
 import type { Ed25519PublicKeyB64u } from '../passkey-custody/primitives';
-import type { ActiveWalletAuthorityV1, WalletAuthorityV1, WalletSignerActivationSetV1 } from '../authorization/walletAuthority';
+import type { ActiveWalletAuthorityV1, WalletSignerActivationSetV1 } from '../authorization/walletAuthority';
 import type { CanonicalDelegatedWalletPermissionSetV1 } from '../authorization/delegatedAuthority';
 import type { ExactAdministeredSignerManifestV1 } from './delegatedActivationPlan';
-import type { EmailOtpWalletAuthMethodDraftV1, PasskeyWalletAuthMethodDraftV1, WalletAuthMethodRecordV2, WalletEmailOtpEnrollmentMaterialV1 } from '../utils/registrationIntent';
+import type { ActiveWalletAuthMethodRecordV2, EmailOtpWalletAuthMethodDraftV1, PasskeyWalletAuthMethodDraftV1 } from '../utils/walletAuthMethodRecord';
+import type { WalletEmailOtpEnrollmentMaterialV1 } from '../utils/registrationAuthMethodInput';
 import type { VerifiedEmailAddress } from '../utils/domainIds';
 import type { LinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, LinkedDeviceOrdinaryMaterialSourceContributionTupleV1 } from './sourceContribution';
 import type { LinkedDeviceWalletSessionCredentialDeliveryBindingV1, LinkedDeviceWalletSessionCredentialDeliveryV1 } from './walletSessionCredentialDelivery';
 export type { LinkedDeviceEcdsaSourceContributionBindingV1, LinkedDeviceEcdsaSourceContributionPackageV1, LinkedDeviceEcdsaSourceContributionPreparationV1, LinkedDeviceEcdsaSourceDerivationV1, LinkedDeviceEcdsaSourcePreservingActivationReceiptV1, LinkedDeviceEcdsaSourceContributionV1, LinkedDeviceEcdsaSourceSignerIdentityV1, LinkedDeviceEcdsaTargetRecipientPreparationV1, LinkedDeviceEd25519SourceContributionPreparationV1, LinkedDeviceEd25519SourceContributionV1, LinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, LinkedDeviceOrdinaryMaterialSourceContributionTupleV1, LinkedDeviceOrdinaryMaterialSourceContributionV1, } from './sourceContribution';
-export type { CommittedAuthorityPackagesV1, CommittedEd25519SignerPackageV1, CommittedEcdsaSignerPackageV1, PendingWalletAuthMethodRecordV1, CommittedSignerPackageSetDigestInputV1, CommittedSignerPackageSetV1, } from './committedSignerPackages';
+export type { CommittedAuthorityPackagesV1, CommittedEd25519SignerPackageV1, CommittedEcdsaSignerPackageV1, CommittedSignerPackageSetDigestInputV1, CommittedSignerPackageSetV1, } from './committedSignerPackages';
 /** Public key bytes carried by the link session, encoded as canonical base64url. */
 export type LinkDevicePublicKeyB64u = string & {
     readonly __linkDevicePublicKeyB64uBrand: 'LinkDevicePublicKeyB64u';
@@ -468,7 +469,7 @@ export type OwnerDeviceSummaryV1 = {
     /**
      * The authority this method belongs to.
      *
-     * R109C puts both factor families on one founding authority and lists one
+     * A founding authority can hold both factor families, and the list gives one
      * entry per active method, so a reader needs this to group the entries it was
      * given — to decide which family is still missing on THIS authority, and to
      * know which sibling would remain if one were removed. Grouping by wallet
@@ -745,7 +746,7 @@ export type LocalAuthorityInstallationReceiptV1 = {
     readonly targetFactorVerificationDigestB64u: DigestB64u;
     readonly installedAtMs: number;
 };
-export type RelinkRequiredReasonV1 = {
+type RelinkRequiredReasonV1 = {
     readonly kind: 'incomplete_migrated_enrollment';
 } | {
     readonly kind: 'missing_canonical_local_material';
@@ -772,12 +773,8 @@ export type ActivationRetryReasonV1 = {
 };
 export type ActivateInstalledAuthorityResultV1 = {
     readonly kind: 'active';
-    readonly authority: Extract<WalletAuthorityV1, {
-        readonly state: 'active';
-    }>;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly walletSession: ActiveWalletSessionV1;
     readonly deliveryBinding: LinkedDeviceWalletSessionCredentialDeliveryBindingV1;
     readonly sealedDelivery: LinkedDeviceWalletSessionCredentialDeliveryV1;

package/dist/types/shared-ts/src/device-linking/contracts.typecheck.d.ts

@@ -1,2 +1,3 @@
-export {};
+import type { LinkedDeviceOwnerAuthorizationSourceV1 } from './contracts';
+export declare const invalidStepUpOwnerAuthorization: LinkedDeviceOwnerAuthorizationSourceV1;
 //# sourceMappingURL=contracts.typecheck.d.ts.map

package/dist/types/shared-ts/src/device-linking/deviceManagement.d.ts

@@ -0,0 +1,7 @@
+import { type LinkedDeviceListRequestV1, type LinkedDeviceListResultV1, type LinkedDeviceRevokeRequestV1, type LinkedDeviceRevokeResultV1, type LinkedDeviceSummaryV1 } from './contracts';
+export declare function parseLinkedDeviceSummaryV1(raw: unknown): LinkedDeviceSummaryV1;
+export declare function parseLinkedDeviceListRequestV1(raw: unknown): LinkedDeviceListRequestV1;
+export declare function parseLinkedDeviceListResultV1(raw: unknown): LinkedDeviceListResultV1;
+export declare function parseLinkedDeviceRevokeRequestV1(raw: unknown): LinkedDeviceRevokeRequestV1;
+export declare function parseLinkedDeviceRevokeResultV1(raw: unknown): LinkedDeviceRevokeResultV1;
+//# sourceMappingURL=deviceManagement.d.ts.map

package/dist/types/shared-ts/src/device-linking/digests.d.ts

@@ -6,15 +6,10 @@ export { computeCommittedSignerPackageDigestB64u, computeCommittedSignerPackageS
  * opaque token directly keeps the browser binding identical to that row.
  */
 export declare function computeWalletSessionOperationCredentialDigestB64u(credential: WalletSessionOperationCredentialV1): Promise<DigestB64u>;
-export declare function encodeWalletSessionInstallationReceiptV1(receipt: LocalAuthorityInstallationReceiptV1): string;
 export declare function computeWalletSessionInstallationReceiptDigestB64u(receipt: LocalAuthorityInstallationReceiptV1): Promise<DigestB64u>;
-export declare function encodeLinkedDevicePasskeyTargetConfigurationV1(value: LinkedDevicePasskeyTargetConfigurationFieldsV1): Uint8Array;
 export declare function computeLinkedDevicePasskeyTargetConfigurationDigestV1(value: LinkedDevicePasskeyTargetConfigurationFieldsV1): Promise<DigestB64u>;
-export declare function encodeLinkedDeviceSessionClaimV1(value: LinkedDeviceSessionClaimV1): Uint8Array;
 export declare function computeLinkedDeviceSessionClaimDigestV1(value: LinkedDeviceSessionClaimV1): Promise<DigestB64u>;
-export declare function encodeLinkedDeviceApprovalV1(value: LinkedDeviceApprovalV1): Uint8Array;
 export declare function computeLinkedDeviceApprovalDigestV1(value: LinkedDeviceApprovalV1): Promise<DigestB64u>;
-export declare function encodeLinkedDeviceTargetPreparationV1(value: LinkedDeviceTargetPreparationV1): Uint8Array;
 export declare function computeLinkedDeviceTargetPreparationDigestV1(value: LinkedDeviceTargetPreparationV1): Promise<DigestB64u>;
 export declare function assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1(input: {
     readonly preparation: LinkedDeviceTargetPreparationV1;

package/dist/types/shared-ts/src/device-linking/ed25519ExportRoot.d.ts

@@ -11,11 +11,11 @@ import type { LinkedDeviceTargetFactorV1 } from './contracts';
 /** Frozen by signer-core's Ed25519 Yao Client-root transfer module. */
 export declare const LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1: "x25519-hkdf-sha256-chacha20poly1305-v1";
 /** One-use X25519 public key generated and retained by Device 2's worker. */
-export type LinkedDeviceEd25519ExportRootRecipientPublicKeyB64u = string & {
+type LinkedDeviceEd25519ExportRootRecipientPublicKeyB64u = string & {
     readonly __linkedDeviceEd25519ExportRootRecipientPublicKeyB64uBrand: 'LinkedDeviceEd25519ExportRootRecipientPublicKeyB64u';
 };
 /** Exact public facts authenticated by signer-core as transfer AAD. */
-export type LinkedDeviceEd25519ExportRootTransferBindingV1 = {
+type LinkedDeviceEd25519ExportRootTransferBindingV1 = {
     readonly linkSessionId: LinkDeviceSessionId;
     readonly walletId: WalletId;
     readonly walletKeyId: WalletKeyId;
@@ -90,4 +90,5 @@ export declare function parseLinkedDeviceEd25519ExportRootPackageV1(raw: unknown
 export declare function parseLinkedDeviceEd25519ExportRootSubmissionV1(raw: unknown): LinkedDeviceEd25519ExportRootSubmissionV1;
 /** Ensures relay persistence cannot join two different root bindings. */
 export declare function linkedDeviceEd25519ExportRootMatchesRecipientV1(transferPackage: LinkedDeviceEd25519ExportRootPackageV1, recipient: LinkedDeviceEd25519ExportRootRecipientV1): boolean;
+export {};
 //# sourceMappingURL=ed25519ExportRoot.d.ts.map

package/dist/types/shared-ts/src/device-linking/index.d.ts

@@ -3,6 +3,8 @@ export * from './activeWalletSession';
 export * from './ed25519ExportRoot';
 export * from './delegatedActivationPlan';
 export * from './parsers';
+export * from './deviceManagement';
+export * from './authorityActivation';
 export * from './digests';
 export * from './requestProof';
 export * from './committedSignerPackages';