@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/shared-ts/src/signing-lanes/rotationParsers.d.ts

@@ -1,34 +1,14 @@
-import { type MpcMaterialActivationRef } from '../utils/domainIds';
-import { type SigningLaneId, type LaneShareEpoch } from './ids';
-import type { SigningLaneKind } from './records';
-import type { AggregateLaneActivationChildReceiptV1, AggregateLaneActivationReceiptV1, AggregateLaneRevocationReceiptV1, CommitLaneEnrollmentActivationV1, CommitLaneEnrollmentRevocationV1, CompleteSigningLaneRevocationV1, EcdsaAdditiveLaneHolderRoundV1, EcdsaAdditiveLaneServerRoundV1, EcdsaAdditiveLaneTranscriptPreambleV1, EcdsaAdditiveLaneTranscriptV1, EcdsaServerRetirementReceiptV1, Ed25519ServerRetirementReceiptV1, EcdsaTargetCapabilityBindingV1, LaneCreationTargetV1, LaneEnrollmentLifecycleV1, LaneEnrollmentPreparationResultV1, LaneEnrollmentManifestV1, LaneHolderDeliveryReceiptV1, LaneHolderPackageWireV1, LaneProductEpochActiveV1, LaneProductEpochPendingVisibilityV1, LaneProductEpochRevocationPendingV1, LaneProductEpochRecordV1, LaneProductEpochRetiredV1, LaneProductEpochRevokedV1, LaneProtocolCommitReceiptV1, LaneProtocolCasResultV1, LaneProtocolLifecycle, LaneProtocolRecordV1, LaneRefreshTargetV1, LaneRefreshPredecessorRetirementV1, LaneServerActivationReceiptV1, LaneServerRetirementReceiptV1, SigningWorkerLaneMaterialIdentityV1, RevokeLaneEnrollmentV1, RevokeSigningLaneV1, RotatableSigningLaneJobV1 } from './rotation';
-export declare function buildLaneCreationTargetV1(args: {
-    readonly laneId: SigningLaneId;
-    readonly laneShareEpoch: LaneShareEpoch;
-}): LaneCreationTargetV1;
-export declare function buildLaneRefreshTargetV1(args: {
-    readonly laneId: SigningLaneId;
-    readonly laneKind: Exclude<SigningLaneKind, 'delegated_execution'>;
-    readonly laneShareEpoch: LaneShareEpoch;
-    readonly priorMaterialActivation: MpcMaterialActivationRef;
-}): LaneRefreshTargetV1;
-export declare function parseEcdsaTargetCapabilityBindingV1(raw: unknown, label: string): EcdsaTargetCapabilityBindingV1;
-export declare function parseRotatableSigningLaneJobV1(raw: unknown, label?: string): RotatableSigningLaneJobV1;
-export declare function parseLaneHolderPackageWireV1(raw: unknown, label?: string): LaneHolderPackageWireV1;
-export declare const parseLaneProtocolJobV1: typeof parseRotatableSigningLaneJobV1;
+import type { AggregateLaneActivationReceiptV1, AggregateLaneRevocationReceiptV1, CommitLaneEnrollmentRevocationV1, CompleteSigningLaneRevocationV1, EcdsaServerRetirementReceiptV1, Ed25519ServerRetirementReceiptV1, LaneEnrollmentLifecycleV1, LaneEnrollmentManifestV1, LaneHolderDeliveryReceiptV1, LaneProductEpochPendingVisibilityV1, LaneProductEpochRecordV1, LaneProductEpochRevokedV1, LaneProtocolCommitReceiptV1, LaneProtocolLifecycle, LaneProtocolRecordV1, LaneRefreshPredecessorRetirementV1, LaneServerActivationReceiptV1, LaneServerRetirementReceiptV1, RevokeLaneEnrollmentV1, RevokeSigningLaneV1, RotatableSigningLaneJobV1 } from './rotation';
 export declare function parseLaneProtocolCommitReceiptV1(raw: unknown, label?: string): LaneProtocolCommitReceiptV1;
 export declare function parseLaneHolderDeliveryReceiptV1(raw: unknown, label?: string): LaneHolderDeliveryReceiptV1;
 export declare function parseLaneServerActivationReceiptV1(raw: unknown, label?: string): LaneServerActivationReceiptV1;
 export declare function parseLaneEnrollmentManifestV1(raw: unknown, label?: string): LaneEnrollmentManifestV1;
-export declare function buildAggregateLaneActivationChildReceiptV1(input: AggregateLaneActivationChildReceiptV1): AggregateLaneActivationChildReceiptV1;
 export declare function parseAggregateLaneActivationReceiptV1(raw: unknown, label?: string): AggregateLaneActivationReceiptV1;
-export declare function parseCommitLaneEnrollmentActivationV1(raw: unknown, label?: string): CommitLaneEnrollmentActivationV1;
 export declare function parseLaneRefreshPredecessorRetirementV1(raw: unknown, label?: string): LaneRefreshPredecessorRetirementV1;
 export declare function parseAggregateLaneRevocationReceiptV1(raw: unknown, label?: string): AggregateLaneRevocationReceiptV1;
 export declare function parseRevokeLaneEnrollmentV1(raw: unknown, label?: string): RevokeLaneEnrollmentV1;
 export declare function parseRevokeSigningLaneV1(raw: unknown, label?: string): RevokeSigningLaneV1;
 export declare function parseCompleteSigningLaneRevocationV1(raw: unknown, label?: string): CompleteSigningLaneRevocationV1;
-export declare function parseCommitLaneEnrollmentRevocationV1(raw: unknown, label?: string): CommitLaneEnrollmentRevocationV1;
 export declare function parseLaneProductEpochRecordV1(raw: unknown, label?: string): LaneProductEpochRecordV1;
 export declare function parseLaneProtocolLifecycleV1(raw: unknown, label?: string): LaneProtocolLifecycle;
 export declare function parseLaneEnrollmentLifecycleV1(raw: unknown, label?: string): LaneEnrollmentLifecycleV1;
@@ -36,32 +16,12 @@ export declare function buildLaneProtocolRecordV1(args: {
     readonly job: RotatableSigningLaneJobV1;
     readonly lifecycle: LaneProtocolLifecycle;
 }): LaneProtocolRecordV1;
-export declare function parseLaneProtocolRecordV1(raw: unknown, label?: string): LaneProtocolRecordV1;
-export declare function parseLaneProtocolCasResultV1(raw: unknown, label?: string): LaneProtocolCasResultV1;
-export declare function parseLaneEnrollmentPreparationResultV1(raw: unknown, label?: string): LaneEnrollmentPreparationResultV1;
-export declare function buildRotatableSigningLaneJobV1(raw: unknown, label?: string): RotatableSigningLaneJobV1;
-export declare function buildLaneProtocolCommitReceiptV1(args: Omit<LaneProtocolCommitReceiptV1, 'kind'>): LaneProtocolCommitReceiptV1;
-export declare function buildLaneHolderDeliveryReceiptV1(args: Omit<LaneHolderDeliveryReceiptV1, 'kind'>): LaneHolderDeliveryReceiptV1;
-export declare function buildLaneServerActivationReceiptV1(args: Omit<LaneServerActivationReceiptV1, 'kind'>): LaneServerActivationReceiptV1;
-export declare function buildLaneEnrollmentManifestV1(args: Omit<LaneEnrollmentManifestV1, 'kind'>): LaneEnrollmentManifestV1;
-export declare function buildAggregateLaneActivationReceiptV1(args: Omit<AggregateLaneActivationReceiptV1, 'kind'>): AggregateLaneActivationReceiptV1;
-export declare function buildCommitLaneEnrollmentActivationV1(args: Omit<CommitLaneEnrollmentActivationV1, 'kind'>): CommitLaneEnrollmentActivationV1;
 export declare function buildAggregateLaneRevocationReceiptV1(args: Omit<AggregateLaneRevocationReceiptV1, 'kind'>): AggregateLaneRevocationReceiptV1;
-export declare function buildRevokeLaneEnrollmentV1(args: Omit<RevokeLaneEnrollmentV1, 'kind'>): RevokeLaneEnrollmentV1;
 export declare function buildRevokeSigningLaneV1(args: Omit<RevokeSigningLaneV1, 'kind'>): RevokeSigningLaneV1;
-export declare function buildCompleteSigningLaneRevocationV1(args: Omit<CompleteSigningLaneRevocationV1, 'kind'>): CompleteSigningLaneRevocationV1;
 export declare function buildCommitLaneEnrollmentRevocationV1(args: Omit<CommitLaneEnrollmentRevocationV1, 'kind'>): CommitLaneEnrollmentRevocationV1;
 export declare function buildLaneProductEpochPendingVisibilityV1(args: Omit<LaneProductEpochPendingVisibilityV1, 'kind' | 'state'>): LaneProductEpochPendingVisibilityV1;
-export declare function buildLaneProductEpochActiveV1(args: Omit<LaneProductEpochActiveV1, 'kind' | 'state'>): LaneProductEpochActiveV1;
-export declare function buildLaneProductEpochRetiredV1(args: Omit<LaneProductEpochRetiredV1, 'kind' | 'state'>): LaneProductEpochRetiredV1;
-export declare function buildLaneProductEpochRevocationPendingV1(args: Omit<LaneProductEpochRevocationPendingV1, 'kind' | 'state'>): LaneProductEpochRevocationPendingV1;
 export declare function buildLaneProductEpochRevokedV1(args: Omit<LaneProductEpochRevokedV1, 'kind' | 'state'>): LaneProductEpochRevokedV1;
-export declare function parseEcdsaAdditiveLaneTranscriptPreambleV1(raw: unknown, label?: string): EcdsaAdditiveLaneTranscriptPreambleV1;
-export declare function parseEcdsaAdditiveLaneHolderRoundV1(raw: unknown, label?: string): EcdsaAdditiveLaneHolderRoundV1;
-export declare function parseEcdsaAdditiveLaneServerRoundV1(raw: unknown, label?: string): EcdsaAdditiveLaneServerRoundV1;
-export declare function parseEcdsaAdditiveLaneTranscriptV1(raw: unknown, label?: string): EcdsaAdditiveLaneTranscriptV1;
 export declare function parseEcdsaServerRetirementReceiptV1(raw: unknown, label?: string): EcdsaServerRetirementReceiptV1;
-export declare function parseSigningWorkerLaneMaterialIdentityV1<TKeyFamily extends 'ed25519' | 'ecdsa_secp256k1'>(raw: unknown, expectedKeyFamily: TKeyFamily, label?: string): SigningWorkerLaneMaterialIdentityV1<TKeyFamily>;
 export declare function parseEd25519ServerRetirementReceiptV1(raw: unknown, label?: string): Ed25519ServerRetirementReceiptV1;
 export declare function parseLaneServerRetirementReceiptV1(raw: unknown, label?: string): LaneServerRetirementReceiptV1;
 //# sourceMappingURL=rotationParsers.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/rotationProtocolParsers.d.ts

@@ -0,0 +1,6 @@
+import type { EcdsaAdditiveLaneHolderRoundV1, LaneHolderPackageWireV1, RotatableSigningLaneJobV1 } from './rotation';
+export declare function parseRotatableSigningLaneJobV1(raw: unknown, label?: string): RotatableSigningLaneJobV1;
+export declare const parseLaneProtocolJobV1: typeof parseRotatableSigningLaneJobV1;
+export declare function parseLaneHolderPackageWireV1(raw: unknown, label?: string): LaneHolderPackageWireV1;
+export declare function parseEcdsaAdditiveLaneHolderRoundV1(raw: unknown, label?: string): EcdsaAdditiveLaneHolderRoundV1;
+//# sourceMappingURL=rotationProtocolParsers.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/rotationWireFields.d.ts

@@ -0,0 +1,20 @@
+import { type MpcMaterialActivationRef } from '../utils/domainIds';
+import { type WireParser } from '../utils/wireSchema';
+import type { SigningLaneKind } from './records';
+import type { LaneOperationAuthorizationBindingV1 } from './rotation';
+export declare function requiredString(raw: unknown, label: string): string;
+export declare function requiredInteger(raw: unknown, label: string): number;
+export declare function parseLaneKind(raw: unknown, label: string): SigningLaneKind;
+export declare const laneOperationId: WireParser<import("./ids").LaneOperationId>;
+export declare const laneEnrollmentId: WireParser<import("./ids").LaneEnrollmentId>;
+export declare const walletId: WireParser<import("@server/core/registrationContracts").WalletId>;
+export declare const walletKeyId: WireParser<import("./ids").WalletKeyId>;
+export declare const signingLaneId: WireParser<import("./ids").SigningLaneId>;
+export declare const laneShareEpoch: WireParser<import("./ids").LaneShareEpoch>;
+export declare const materialActivationId: WireParser<import("../utils").MpcMaterialActivationId>;
+export declare const materialActivation: WireParser<MpcMaterialActivationRef>;
+export declare const laneParticipantBindingDigest: WireParser<import("./participants").LaneParticipantBindingDigestB64u>;
+export declare const digest: WireParser<import("../utils").DigestB64u>;
+export declare const digestString: WireParser<string>;
+export declare function parseAuthorization(raw: unknown, label: string): LaneOperationAuthorizationBindingV1;
+//# sourceMappingURL=rotationWireFields.d.ts.map

package/dist/types/shared-ts/src/tenant-root/tenantRootIdentifier.d.ts

@@ -0,0 +1,3 @@
+export declare const TENANT_ROOT_IDENTITY_MAX_IDENTIFIER_BYTES_V1 = 256;
+export declare function hasControlCharacters(value: string): boolean;
+//# sourceMappingURL=tenantRootIdentifier.d.ts.map

package/dist/types/shared-ts/src/tenant-root/tenantRootOperationRecord.d.ts

@@ -5,7 +5,7 @@ export declare const TENANT_ROOT_OPERATION_MAX_LIFETIME_MS_V1 = 600000;
 /** Maximum authorization lifetime for a ciphertext download. */
 export declare const TENANT_ROOT_DOWNLOAD_MAX_LIFETIME_MS_V1 = 300000;
 /** One console operation on a tenant derivation root. */
-export type TenantRootOperationKindV1 = 'tenant_root_operational_share_rotation_v1' | 'tenant_root_recovery_governance_change_v1' | 'tenant_root_recovery_recipient_pair_enroll_v1' | 'tenant_root_recovery_recipient_pair_replace_v1' | 'tenant_root_recovery_backup_create_v1' | 'tenant_root_recovery_backup_replace_v1' | 'tenant_root_recovery_role_package_download_v1' | 'tenant_root_recovery_manifest_download_v1' | 'tenant_root_restore_session_start_v1' | 'tenant_root_restore_manifest_register_v1' | 'tenant_root_restore_role_import_key_issue_v1' | 'tenant_root_restore_role_import_v1' | 'tenant_root_restore_activate_v1' | 'tenant_root_source_lineage_retire_v1';
+export type TenantRootOperationKindV1 = (typeof TENANT_ROOT_OPERATION_KINDS_V1)[number];
 /** What one operation acts on. */
 export type TenantRootOperationSubjectV1 = {
     readonly kind: 'tenant_root';
@@ -157,6 +157,7 @@ export type TenantRootRestoreRoleImportKeyIssueOperationInputV1 = {
 };
 /** Inputs the console resolves before building a record. */
 export type TenantRootOperationRecordInputV1 = TenantRootOperationRecordInputWithActiveRootV1 | TenantRootRestoreRoleImportKeyIssueOperationInputV1;
+declare const TENANT_ROOT_OPERATION_KINDS_V1: readonly ["tenant_root_operational_share_rotation_v1", "tenant_root_recovery_governance_change_v1", "tenant_root_recovery_recipient_pair_enroll_v1", "tenant_root_recovery_recipient_pair_replace_v1", "tenant_root_recovery_backup_create_v1", "tenant_root_recovery_backup_replace_v1", "tenant_root_recovery_role_package_download_v1", "tenant_root_recovery_manifest_download_v1", "tenant_root_restore_session_start_v1", "tenant_root_restore_manifest_register_v1", "tenant_root_restore_role_import_key_issue_v1", "tenant_root_restore_role_import_v1", "tenant_root_restore_activate_v1", "tenant_root_source_lineage_retire_v1"];
 /** Returns the four operations that follow the tenant's recovery governance. */
 export declare function tenantRootOperationFollowsGovernanceV1(kind: TenantRootOperationKindV1): boolean;
 /** Returns the maximum authorization lifetime for one operation. */

package/dist/types/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.d.ts

@@ -1,6 +1,4 @@
 import type { WalletId } from '../utils/domainIds';
-export declare const ECDSA_DERIVATION_ROLE_LOCAL_FIRST_BOOTSTRAP_ROOT_PROOF_VERSION: "ecdsa-derivation:role-local:first-bootstrap-root-proof:v2";
-export declare const ECDSA_DERIVATION_ROLE_LOCAL_PASSKEY_BOOTSTRAP_AUTH_VERSION: "ecdsa-derivation:role-local:passkey-bootstrap-auth:v2";
 export type EcdsaClientRootPublicKey33B64u = string & {
     readonly __brand: 'EcdsaClientRootPublicKey33B64u';
 };
@@ -12,6 +10,12 @@ export declare function derivationClientSharePublicKey33B64uFromString(value: st
 export type EcdsaDerivationRelayerPublicKey33B64u = string & {
     readonly __brand: 'EcdsaDerivationRelayerPublicKey33B64u';
 };
+export type EcdsaDerivationRoleLocalPublicIdentity = {
+    derivationClientSharePublicKey33B64u: DerivationClientSharePublicKey33B64u;
+    relayerPublicKey33B64u: EcdsaDerivationRelayerPublicKey33B64u;
+    groupPublicKey33B64u: string;
+    ethereumAddress: string;
+};
 export type EcdsaThresholdKeyId = string & {
     readonly __brand: 'EcdsaThresholdKeyId';
 };
@@ -21,33 +25,7 @@ export type SigningRootId = string & {
 export type SigningRootVersion = string & {
     readonly __brand: 'SigningRootVersion';
 };
-export type EcdsaDerivationRoleLocalFirstBootstrapRootProof = {
-    version: typeof ECDSA_DERIVATION_ROLE_LOCAL_FIRST_BOOTSTRAP_ROOT_PROOF_VERSION;
-    clientRootPublicKey33B64u: EcdsaClientRootPublicKey33B64u;
-    digest32B64u: string;
-    signature65B64u: string;
-};
-export type EcdsaDerivationRoleLocalBootstrapIdentity = {
-    walletId: string;
-    evmFamilySigningKeySlotId: string;
-    ecdsaThresholdKeyId: string;
-    signingRootId: string;
-    signingRootVersion: string;
-    keyScope: 'evm-family';
-    relayerKeyId: string;
-    derivationClientSharePublicKey33B64u: DerivationClientSharePublicKey33B64u;
-    clientShareRetryCounter: number;
-    contextBinding32B64u: string;
-    requestId: string;
-    sessionId: string;
-    ttlMs: number;
-    remainingUses: number;
-    participantIds: number[];
-};
-export type EcdsaDerivationRoleLocalPasskeyBootstrapIdentity = Omit<EcdsaDerivationRoleLocalBootstrapIdentity, 'derivationClientSharePublicKey33B64u' | 'clientShareRetryCounter' | 'contextBinding32B64u'> & {
-    rpId: string;
-};
-export type SdkEcdsaDerivationBindingFacts = {
+type SdkEcdsaDerivationBindingFacts = {
     walletId: WalletId;
     ecdsaThresholdKeyId: EcdsaThresholdKeyId;
     signingRootId: SigningRootId;
@@ -56,8 +34,6 @@ export type SdkEcdsaDerivationBindingFacts = {
 export declare function parseSdkEcdsaDerivationThresholdKeyId(value: unknown): EcdsaThresholdKeyId;
 export declare function parseSdkEcdsaDerivationSigningRootId(value: unknown): SigningRootId;
 export declare function parseSdkEcdsaDerivationSigningRootVersion(value: unknown): SigningRootVersion;
-export declare function encodeSdkEcdsaDerivationBindingFactsV1(input: SdkEcdsaDerivationBindingFacts): Uint8Array;
-export declare function computeSdkEcdsaDerivationApplicationBindingDigest32(input: SdkEcdsaDerivationBindingFacts): Promise<Uint8Array>;
 export declare function computeSdkEcdsaDerivationApplicationBindingDigestB64u(input: SdkEcdsaDerivationBindingFacts): Promise<string>;
 export declare function computeEcdsaDerivationRoleLocalThresholdKeyId(input: {
     walletId: string;
@@ -70,8 +46,5 @@ export declare function computeEcdsaDerivationRoleLocalRelayerKeyId(input: {
     signingRootId: string;
     signingRootVersion: string;
 }): Promise<string>;
-export declare function computeEcdsaDerivationRoleLocalFirstBootstrapRootProofDigest32(input: EcdsaDerivationRoleLocalBootstrapIdentity): Promise<Uint8Array>;
-export declare function computeEcdsaDerivationRoleLocalFirstBootstrapRootProofDigest32B64u(input: EcdsaDerivationRoleLocalBootstrapIdentity): Promise<string>;
-export declare function computeEcdsaDerivationRoleLocalPasskeyBootstrapAuthDigest32(input: EcdsaDerivationRoleLocalPasskeyBootstrapIdentity): Promise<Uint8Array>;
-export declare function computeEcdsaDerivationRoleLocalPasskeyBootstrapAuthDigest32B64u(input: EcdsaDerivationRoleLocalPasskeyBootstrapIdentity): Promise<string>;
+export {};
 //# sourceMappingURL=ecdsaDerivationRoleLocalBootstrap.d.ts.map

package/dist/types/shared-ts/src/threshold/ed25519OperationFingerprint.d.ts

@@ -4,20 +4,20 @@ type ThresholdEd25519CanonicalScope = {
     relayerKeyId: string;
     signerPublicKey: string;
 };
-export type ThresholdEd25519NearTransaction = {
+type ThresholdEd25519NearTransaction = {
     nearAccountId: string;
     receiverId: string;
     actions: readonly ThresholdEd25519NearAction[];
 };
-export type ThresholdEd25519NearPublicKey = {
+type ThresholdEd25519NearPublicKey = {
     keyType: number;
     keyData: readonly number[];
 };
-export type ThresholdEd25519NearSignature = {
+type ThresholdEd25519NearSignature = {
     keyType: number;
     signatureData: readonly number[];
 };
-export type ThresholdEd25519SignedDelegateAction = {
+type ThresholdEd25519SignedDelegateAction = {
     senderId: string;
     receiverId: string;
     actions: readonly ThresholdEd25519NearAction[];
@@ -70,20 +70,20 @@ export type ThresholdEd25519NearAction = {
     code_hash: string;
     account_id?: never;
 };
-export type ThresholdEd25519NearTransactionPlanningFingerprintInput = ThresholdEd25519CanonicalScope & {
+type ThresholdEd25519NearTransactionPlanningFingerprintInput = ThresholdEd25519CanonicalScope & {
     transactions: readonly ThresholdEd25519NearTransaction[];
 };
-export type ThresholdEd25519NearTransactionFingerprintInput = ThresholdEd25519NearTransactionPlanningFingerprintInput & {
+type ThresholdEd25519NearTransactionFingerprintInput = ThresholdEd25519NearTransactionPlanningFingerprintInput & {
     unsignedTransactionBorshB64u: string;
     signingDigestB64u: string;
 };
-export type ThresholdEd25519Nep413FingerprintInput = ThresholdEd25519CanonicalScope & {
+type ThresholdEd25519Nep413FingerprintInput = ThresholdEd25519CanonicalScope & {
     message: string;
     recipient: string;
     nonce: string;
     state?: string | null;
 };
-export type ThresholdEd25519DelegateActionFingerprintInput = ThresholdEd25519CanonicalScope & {
+type ThresholdEd25519DelegateActionFingerprintInput = ThresholdEd25519CanonicalScope & {
     delegate: {
         senderId: string;
         receiverId: string;
@@ -93,37 +93,10 @@ export type ThresholdEd25519DelegateActionFingerprintInput = ThresholdEd25519Can
         publicKey: string;
     };
 };
-type ThresholdEd25519FinalizeRequestIntegrityCommonInput = {
-    operation: {
-        kind: 'threshold_ed25519_signing_operation_v1';
-        operationId: string;
-        operationFingerprint: string;
-        purpose: 'near_transaction' | 'nep413_message' | 'delegate_action';
-    };
-    presignId: string;
-    relayerKeyId: string;
-    nearAccountId: string;
-    nearNetworkId: string;
-    expectedSignerPublicKey: string;
-    clientSignatureShareB64u: string;
-};
-export type ThresholdEd25519FinalizeRequestIntegrityInput = (ThresholdEd25519FinalizeRequestIntegrityCommonInput & {
-    kind: 'threshold_ed25519_finalize_signature_only_v1';
-    intent: unknown;
-}) | (ThresholdEd25519FinalizeRequestIntegrityCommonInput & {
-    kind: 'threshold_ed25519_finalize_and_dispatch_near_tx_v1';
-    transactions: unknown;
-    unsignedTransactionBorshB64u: string;
-    signingDigestB64u: string;
-    dispatch: {
-        kind: 'near_rpc_configured_default_v1';
-    };
-});
 export declare function thresholdEd25519NearTransactionPlanningOperationFingerprint(input: ThresholdEd25519NearTransactionPlanningFingerprintInput): Promise<string>;
 export declare function thresholdEd25519NearTransactionOperationFingerprint(input: ThresholdEd25519NearTransactionFingerprintInput): Promise<string>;
 export declare function thresholdEd25519Nep413OperationFingerprint(input: ThresholdEd25519Nep413FingerprintInput): Promise<string>;
 export declare function thresholdEd25519DelegateActionOperationFingerprint(input: ThresholdEd25519DelegateActionFingerprintInput): Promise<string>;
-export declare function thresholdEd25519FinalizeRequestIntegrityHash(input: ThresholdEd25519FinalizeRequestIntegrityInput): Promise<string>;
 export declare function parseThresholdEd25519NearTransaction(raw: unknown, label: string): ThresholdEd25519NearTransaction;
 export declare function parseThresholdEd25519NearAction(action: unknown, label: string): ThresholdEd25519NearAction;
 export {};

package/dist/types/shared-ts/src/threshold/keyMaterialBrands.d.ts

@@ -0,0 +1,25 @@
+import type { EcdsaThresholdKeyId } from './ecdsaDerivationRoleLocalBootstrap';
+export type Brand<T, Name extends string> = T & {
+    readonly __brand: Name;
+};
+export type EcdsaDerivationKeyVersion = Brand<string, 'EcdsaDerivationKeyVersion'>;
+export type SigningSessionSealKeyVersion = Brand<string, 'SigningSessionSealKeyVersion'>;
+export type EcdsaClientVerifyingShareB64u = Brand<string, 'EcdsaClientVerifyingShareB64u'>;
+export type Ed25519RelayerKeyId = Brand<string, 'Ed25519RelayerKeyId'>;
+export type EcdsaRelayerKeyId = Brand<string, 'EcdsaRelayerKeyId'>;
+export type EcdsaKeyHandle = Brand<string, 'EcdsaKeyHandle'>;
+export declare function parseNonEmptyBrand<T extends string>(value: unknown, label: string): Brand<string, T>;
+export declare function parseEcdsaDerivationKeyVersion(value: unknown): EcdsaDerivationKeyVersion;
+export declare function parseSigningSessionSealKeyVersion(value: unknown): SigningSessionSealKeyVersion;
+export declare function parseEcdsaClientVerifyingShareB64u(value: unknown): EcdsaClientVerifyingShareB64u;
+export declare function parseEd25519RelayerKeyId(value: unknown): Ed25519RelayerKeyId;
+export declare function parseEcdsaRelayerKeyId(value: unknown): EcdsaRelayerKeyId;
+export declare function parseEcdsaKeyHandle(value: unknown): EcdsaKeyHandle;
+export declare function formatEcdsaDerivationKeyVersionForWire(value: EcdsaDerivationKeyVersion): string;
+export declare function formatSigningSessionSealKeyVersionForWire(value: SigningSessionSealKeyVersion): string;
+export declare function formatEcdsaClientVerifyingShareB64uForWire(value: EcdsaClientVerifyingShareB64u): string;
+export declare function formatEd25519RelayerKeyIdForWire(value: Ed25519RelayerKeyId): string;
+export declare function formatEcdsaRelayerKeyIdForWire(value: EcdsaRelayerKeyId): string;
+export declare function formatEcdsaThresholdKeyIdForWire(value: EcdsaThresholdKeyId): string;
+export declare function formatEcdsaKeyHandleForWire(value: EcdsaKeyHandle): string;
+//# sourceMappingURL=keyMaterialBrands.d.ts.map

package/dist/types/shared-ts/src/threshold/participants.d.ts

@@ -1,4 +1,4 @@
-export type ThresholdParticipantRole = 'client' | 'relayer';
+type ThresholdParticipantRole = 'client' | 'relayer';
 export declare const THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID: 1;
 export declare const THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID: 2;
 export declare const THRESHOLD_ED25519_2P_PARTICIPANT_IDS: readonly [1, 2];
@@ -6,7 +6,7 @@ export declare const THRESHOLD_ED25519_2P_PARTICIPANT_IDS: readonly [1, 2];
  * Metadata describing how a participant share is derived/stored.
  * This is informational in v1 and may be used for validation/policy later.
  */
-export type ThresholdEd25519ShareDerivation = 'prf_first_v1' | 'derived_master_secret_v1' | 'kv_random_v1' | 'unknown';
+type ThresholdEd25519ShareDerivation = 'prf_first_v1' | 'derived_master_secret_v1' | 'kv_random_v1' | 'unknown';
 export interface ThresholdEd25519ParticipantV1 {
     /** FROST identifier (1-indexed). */
     id: number;
@@ -17,15 +17,8 @@ export interface ThresholdEd25519ParticipantV1 {
     relayerKeyId?: string;
     shareDerivation?: ThresholdEd25519ShareDerivation;
 }
-export declare const THRESHOLD_ED25519_PARTICIPANT_SET_V1: "threshold_ed25519_participants_v1";
-export interface ThresholdEd25519ParticipantSetV1 {
-    version: typeof THRESHOLD_ED25519_PARTICIPANT_SET_V1;
-    groupPublicKey: string;
-    participants: ThresholdEd25519ParticipantV1[];
-}
 export declare function normalizeThresholdEd25519ParticipantId(id: unknown): number | null;
 export declare function normalizeThresholdEd25519ParticipantIds(input: unknown): number[] | null;
-export declare function areThresholdEd25519ParticipantIds2p(participantIds: number[] | null | undefined, expected?: readonly number[]): boolean;
 export declare function parseThresholdEd25519ParticipantsV1(input: unknown): ThresholdEd25519ParticipantV1[] | null;
 export declare function buildThresholdEd25519Participants2pV1(input: {
     clientParticipantId?: number | null;
@@ -35,4 +28,5 @@ export declare function buildThresholdEd25519Participants2pV1(input: {
     clientShareDerivation?: ThresholdEd25519ShareDerivation | null;
     relayerShareDerivation?: ThresholdEd25519ShareDerivation | null;
 }): ThresholdEd25519ParticipantV1[];
+export {};
 //# sourceMappingURL=participants.d.ts.map

package/dist/types/shared-ts/src/threshold/secp256k1.d.ts

@@ -1,39 +1,2 @@
-/**
- * secp256k1 group order `n`.
- *
- * This is the order of the prime-order subgroup generated by `G` (the base point),
- * as specified by SEC 2 (Recommended Elliptic Curve Domain Parameters).
- *
- * Important:
- * - This is **not** the field modulus `p` (used for x/y coordinate arithmetic).
- * - Scalars for secp256k1 signing/keygen are interpreted modulo `n`.
- *
- * Used by the threshold-secp256k1 ECDSA stack to reduce HKDF-derived bytes into a
- * non-zero scalar in `[1, n-1]`.
- */
-export declare const SECP256K1_ORDER: bigint;
-export type ThresholdSecp256k1Ecdsa2pTopologyV1 = {
-    readonly kind: 'threshold_secp256k1_ecdsa_2p_v1';
-};
-export type ThresholdSecp256k1Ecdsa2pTopologyParseResult = {
-    readonly ok: true;
-    readonly value: ThresholdSecp256k1Ecdsa2pTopologyV1;
-} | {
-    readonly ok: false;
-    readonly message: string;
-};
-export type ThresholdSecp256k1Ecdsa2pParticipantIdsParseResult = {
-    readonly ok: true;
-    readonly value: readonly [1, 2];
-} | {
-    readonly ok: false;
-    readonly message: string;
-};
-export declare const THRESHOLD_SECP256K1_ECDSA_2P_TOPOLOGY_V1: ThresholdSecp256k1Ecdsa2pTopologyV1;
-export declare const THRESHOLD_SECP256K1_ECDSA_2P_CLIENT_ID_V1: 1;
-export declare const THRESHOLD_SECP256K1_ECDSA_2P_RELAYER_ID_V1: 2;
-export declare const THRESHOLD_SECP256K1_ECDSA_2P_THRESHOLD_V1: 2;
 export declare const THRESHOLD_SECP256K1_ECDSA_2P_PARTICIPANT_IDS_V1: readonly [1, 2];
-export declare function parseThresholdSecp256k1Ecdsa2pTopologyV1(value: unknown): ThresholdSecp256k1Ecdsa2pTopologyParseResult;
-export declare function parseThresholdSecp256k1Ecdsa2pParticipantIdsV1(value: unknown): ThresholdSecp256k1Ecdsa2pParticipantIdsParseResult;
 //# sourceMappingURL=secp256k1.d.ts.map

package/dist/types/shared-ts/src/threshold/sessionPolicy.d.ts

@@ -1,5 +1,29 @@
+import type { WebAuthnRpId } from '../utils/domainIds';
 export declare const DEFAULT_WALLET_SESSION_TTL_MS: number;
 export declare const DEFAULT_WALLET_SESSION_REMAINING_USES = 3;
 export declare const MAX_WALLET_SESSION_TTL_MS: number;
 export declare const MAX_WALLET_SESSION_REMAINING_USES = 1000000;
+export type Ed25519AuthorityScope = {
+    kind: 'passkey_rp';
+    rpId: WebAuthnRpId;
+    proofKind?: never;
+    email?: never;
+    provider?: never;
+    providerUserId?: never;
+    challengeId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+} | {
+    kind: 'email_otp';
+    provider: 'google' | 'email';
+    providerUserId: string;
+    proofKind?: never;
+    rpId?: never;
+    email?: never;
+    challengeId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+};
 //# sourceMappingURL=sessionPolicy.d.ts.map

package/dist/types/shared-ts/src/threshold/signingRootScope.d.ts

@@ -4,7 +4,7 @@ export type RuntimePolicyScope = {
     readonly envId: string;
     readonly signingRootVersion: string;
 };
-export type SigningRootScope = {
+type SigningRootScope = {
     readonly signingRootId: string;
     readonly signingRootVersion?: string;
 };
@@ -16,9 +16,7 @@ export declare function normalizeRuntimePolicyScope(input: unknown): RuntimePoli
 export declare function normalizeRuntimePolicyScopeFields(input: unknown): Omit<RuntimePolicyScope, 'signingRootVersion'> & {
     readonly signingRootVersion?: string;
 };
+export declare function sameRuntimePolicyScope(left: RuntimePolicyScope, right: RuntimePolicyScope): boolean;
 export declare function signingRootScopeFromRuntimePolicyScope(scope: RuntimePolicyScope): SigningRootScope;
-export declare function normalizeSigningRootScope(input: {
-    readonly signingRootId: unknown;
-    readonly signingRootVersion?: unknown;
-}): SigningRootScope;
+export {};
 //# sourceMappingURL=signingRootScope.d.ts.map

package/dist/types/shared-ts/src/utils/addAuthMethodRegistration.d.ts

@@ -3,10 +3,9 @@
  *
  * This lives in the shared package because three parties read the same record:
  * the server that mints it, the browser that passes it to
- * `navigator.credentials.create`, and — since Refactor 103 Phase 8 — the
- * linked-device target preparation that carries it to Device 2. One
- * declaration, so a change to the ceremony cannot silently diverge from what a
- * linked device creates its passkey against.
+ * `navigator.credentials.create`, and the linked-device target preparation that
+ * carries it to Device 2. One declaration, so a change to the ceremony cannot
+ * silently diverge from what a linked device creates its passkey against.
  *
  * Everything here is fixed by the canonical add-auth-method ceremony: two
  * algorithms in a fixed order, a resident key, no attestation, and PRF

package/dist/types/shared-ts/src/utils/addWalletAuthMethod.d.ts

@@ -1,5 +1,5 @@
 /**
- * Refactor 109C — the internal contract for same-device auth-method addition.
+ * The internal contract for same-device auth-method addition.
  *
  * One product action ("Add authentication method") has exactly two branches:
  * a Passkey-only authority adds Email OTP, or an Email-OTP-only authority adds
@@ -21,7 +21,7 @@
 import type { DeviceId, WalletSessionId } from '../authorization/capabilityKinds';
 import type { DigestB64u } from './canonicalPrimitives';
 import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from './domainIds';
-import type { EmailOtpWalletAuthMethodDraftV1, PasskeyWalletAuthMethodDraftV1, WalletAuthMethodRecordV2 } from './registrationIntent';
+import type { ActiveWalletAuthMethodRecordV2, EmailOtpWalletAuthMethodDraftV1, PasskeyWalletAuthMethodDraftV1 } from './walletAuthMethodRecord';
 import type { WalletAuthMethod } from './signerDomain';
 /**
  * The factor family a method belongs to.
@@ -45,7 +45,7 @@ export type AddWalletAuthMethodBranchV1 = 'passkey_to_email_otp' | 'email_otp_to
  * being read as any other integer on the authority — a signer slot, a counter,
  * a timestamp — at the boundaries where all of them arrive as bare numbers.
  */
-export type WalletAuthorityRevocationEpochV1 = number & {
+type WalletAuthorityRevocationEpochV1 = number & {
     readonly __walletAuthorityRevocationEpochBrand: 'WalletAuthorityRevocationEpochV1';
 };
 /**
@@ -53,7 +53,7 @@ export type WalletAuthorityRevocationEpochV1 = number & {
  * target method ID to it, and a client request can neither nominate nor
  * substitute one.
  */
-export type AddWalletAuthMethodCeremonyIdV1 = string & {
+type AddWalletAuthMethodCeremonyIdV1 = string & {
     readonly __addWalletAuthMethodCeremonyIdBrand: 'AddWalletAuthMethodCeremonyIdV1';
 };
 /**
@@ -154,49 +154,6 @@ export type VerifiedAddWalletAuthMethodInputV1 = (AddWalletAuthMethodInputCommon
     readonly sourceProof: VerifiedEmailOtpSourceProofV1;
     readonly target: VerifiedPasskeyTargetV1;
 });
-export type AddWalletAuthMethodFailureReasonV1 = 'source_session_not_selected' | 'source_method_not_active' | 'source_authority_not_active' | 'source_authority_not_full_owner' | 'source_authority_changed' | 'local_installation_incomplete' | 'source_proof_rejected' | 'target_factor_rejected' | 'target_family_present' | 'intent_expired' | 'intent_digest_mismatch' | 'identity_mismatch' | 'custody_reseal_failed' | 'local_persistence_failed' | 'activation_conflict';
-/**
- * The one result union both SDK entry points return. UI control flow switches
- * on `kind`; `reason` and `message` are display and diagnostic data and never
- * select a code path.
- */
-export type AddWalletAuthMethodResultV1 = {
-    readonly kind: 'active';
-    readonly branch: AddWalletAuthMethodBranchV1;
-    readonly walletId: WalletId;
-    readonly walletAuthorityId: WalletAuthorityId;
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly family: WalletAuthMethodFamilyV1;
-    readonly sourceWalletAuthMethodId: WalletAuthMethodId;
-    readonly sourceWalletSessionId: WalletSessionId;
-} | {
-    readonly kind: 'already_configured';
-    readonly walletId: WalletId;
-    readonly walletAuthorityId: WalletAuthorityId;
-    readonly family: WalletAuthMethodFamilyV1;
-    readonly existingWalletAuthMethodId: WalletAuthMethodId;
-} | {
-    readonly kind: 'cancelled';
-    readonly branch: AddWalletAuthMethodBranchV1;
-} | {
-    readonly kind: 'expired';
-    readonly branch: AddWalletAuthMethodBranchV1;
-} | {
-    readonly kind: 'unauthorized';
-    readonly branch: AddWalletAuthMethodBranchV1;
-    readonly reason: AddWalletAuthMethodFailureReasonV1;
-    readonly message: string;
-} | {
-    readonly kind: 'target_verification_failed';
-    readonly branch: AddWalletAuthMethodBranchV1;
-    readonly reason: AddWalletAuthMethodFailureReasonV1;
-    readonly message: string;
-} | {
-    readonly kind: 'integrity_error';
-    readonly branch: AddWalletAuthMethodBranchV1;
-    readonly reason: AddWalletAuthMethodFailureReasonV1;
-    readonly message: string;
-};
 /**
  * Admission: what the operation does before it verifies anything.
  *
@@ -205,7 +162,7 @@ export type AddWalletAuthMethodResultV1 = {
  * holds. Resolving it here is what keeps the promise that a present family
  * never reaches target verification or a local write.
  */
-export type AddWalletAuthMethodAdmissionV1 = {
+type AddWalletAuthMethodAdmissionV1 = {
     readonly kind: 'proceed';
     readonly branch: AddWalletAuthMethodBranchV1;
 } | {
@@ -227,69 +184,11 @@ export declare function addWalletAuthMethodSourceFamily(branch: AddWalletAuthMet
  * which is why the operation needs no same-family rejection of its own.
  */
 export declare function admitAddWalletAuthMethod(input: {
-    readonly sourceMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly sourceMethod: ActiveWalletAuthMethodRecordV2;
     readonly targetFamily: WalletAuthMethodFamilyV1;
-    readonly activeMethodsOnAuthority: readonly Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>[];
+    readonly activeMethodsOnAuthority: readonly ActiveWalletAuthMethodRecordV2[];
 }): AddWalletAuthMethodAdmissionV1;
 export declare function parseWalletAuthorityRevocationEpochV1(value: unknown): WalletAuthorityRevocationEpochV1;
 export declare function parseAddWalletAuthMethodCeremonyIdV1(value: unknown): AddWalletAuthMethodCeremonyIdV1;
-/**
- * The one place raw source identity becomes branded. Every field is read from
- * the resolved session and authority, so a caller cannot widen the source by
- * supplying an extra one.
- */
-export declare function parseAddWalletAuthMethodSourceV1(raw: {
-    readonly walletId: unknown;
-    readonly walletAuthorityId: unknown;
-    readonly sourceWalletAuthMethodId: unknown;
-    readonly sourceWalletSessionId: unknown;
-    readonly deviceId: unknown;
-    readonly authorityDigestB64u: unknown;
-    readonly revocationEpoch: unknown;
-}): AddWalletAuthMethodSourceV1;
-export declare function parseAddWalletAuthMethodIntentIdentityV1(raw: {
-    readonly addAuthMethodCeremonyId: unknown;
-    readonly intentDigestB64u: unknown;
-    readonly targetWalletAuthMethodId: unknown;
-    readonly expiresAtMs: unknown;
-}): AddWalletAuthMethodIntentIdentityV1;
-/**
- * Branch-specific builders rather than one constructor with a `branch`
- * parameter: each accepts only the proof and target its branch can hold, so a
- * mismatched pair is a compile error at the call site instead of a runtime
- * check inside the operation.
- */
-export declare function buildPasskeyToEmailOtpAdditionV1(input: {
-    readonly source: AddWalletAuthMethodSourceV1;
-    readonly intent: AddWalletAuthMethodIntentIdentityV1;
-    readonly sourceProof: VerifiedPasskeySourceProofV1;
-    readonly target: VerifiedEmailOtpTargetV1;
-}): Extract<VerifiedAddWalletAuthMethodInputV1, {
-    readonly branch: 'passkey_to_email_otp';
-}>;
-export declare function buildEmailOtpToPasskeyAdditionV1(input: {
-    readonly source: AddWalletAuthMethodSourceV1;
-    readonly intent: AddWalletAuthMethodIntentIdentityV1;
-    readonly sourceProof: VerifiedEmailOtpSourceProofV1;
-    readonly target: VerifiedPasskeyTargetV1;
-}): Extract<VerifiedAddWalletAuthMethodInputV1, {
-    readonly branch: 'email_otp_to_passkey';
-}>;
-/**
- * The exact active record the activation stage inserts.
- *
- * It reuses the source authority and the server-allocated target method ID,
- * and it is built from the verified target draft alone — no field is carried
- * across from the source method, which is what keeps addition from copying
- * permissions, activations, or credential identity onto the new method.
- */
-export declare function buildAddedWalletAuthMethodRecordV2Input(input: {
-    readonly verified: VerifiedAddWalletAuthMethodInputV1;
-    readonly nowMs: number;
-}): WalletAuthMethodRecordV2;
 export {};
 //# sourceMappingURL=addWalletAuthMethod.d.ts.map