@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/shared-ts/src/utils/addWalletAuthMethod.typecheck.d.ts

@@ -1,11 +1,24 @@
 /**
- * Compile-time fixtures for the Refactor 109C addition contract.
+ * Compile-time fixtures for the same-device auth-method addition contract.
  *
- * Every `@ts-expect-error` below is a state R109C forbids. If one of them ever
+ * Every `@ts-expect-error` below is a state the contract forbids. If one ever
  * starts compiling, the branch union has been widened — a same-family
  * addition, a mixed target draft, an unverified value, or a cast has become
  * expressible — and this file fails the build rather than the behaviour
  * failing in a browser.
  */
-export {};
+import { type AddWalletAuthMethodIntentIdentityV1, type VerifiedAddWalletAuthMethodSourceProofV1, type VerifiedAddWalletAuthMethodTargetV1 } from './addWalletAuthMethod';
+export declare const intent: AddWalletAuthMethodIntentIdentityV1;
+export declare const passkeySourceProof: Extract<VerifiedAddWalletAuthMethodSourceProofV1, {
+    kind: 'verified_passkey_source_proof_v1';
+}>;
+export declare const emailOtpSourceProof: Extract<VerifiedAddWalletAuthMethodSourceProofV1, {
+    kind: 'verified_email_otp_source_proof_v1';
+}>;
+export declare const emailOtpTarget: Extract<VerifiedAddWalletAuthMethodTargetV1, {
+    kind: 'verified_email_otp_target_v1';
+}>;
+export declare const passkeyTarget: Extract<VerifiedAddWalletAuthMethodTargetV1, {
+    kind: 'verified_passkey_target_v1';
+}>;
 //# sourceMappingURL=addWalletAuthMethod.typecheck.d.ts.map

package/dist/types/shared-ts/src/utils/canonicalPrimitives.d.ts

@@ -8,5 +8,7 @@ export declare function parseCorrelationId(value: unknown): CorrelationId;
 export declare function parseDigestB64u(value: unknown): DigestB64u;
 export declare function parseIsoTimestamp(value: unknown): IsoTimestamp;
 export declare function isoTimestampFromUnixMs(value: unknown): IsoTimestamp;
+export declare function sha256DigestB64u(bytes: Uint8Array): Promise<DigestB64u>;
+export declare function sha256Utf8DigestB64u(text: string): Promise<DigestB64u>;
 export {};
 //# sourceMappingURL=canonicalPrimitives.d.ts.map

package/dist/types/shared-ts/src/utils/digestEncoding.d.ts

@@ -0,0 +1,9 @@
+import { type DigestB64u } from './canonicalPrimitives';
+export declare function concat(parts: readonly Uint8Array[]): Uint8Array;
+export declare function u32(value: number, label: string): Uint8Array;
+export declare function u64(value: number, label: string): Uint8Array;
+export declare function lp32(value: Uint8Array, label: string): Uint8Array;
+export declare function text(value: string, label: string): Uint8Array;
+export declare function rawDigest(value: DigestB64u, label: string): Uint8Array;
+export declare function rawPublicKey(value: string, label: string): Uint8Array;
+//# sourceMappingURL=digestEncoding.d.ts.map

package/dist/types/shared-ts/src/utils/domainIds.d.ts

@@ -1,7 +1,7 @@
 export type DomainId<TBrand extends string> = string & {
     readonly __domainIdBrand: TBrand;
 };
-export type DomainIdParseError = {
+type DomainIdParseError = {
     code: 'missing' | 'invalid';
     message: string;
 };
@@ -117,7 +117,6 @@ export declare function parseMpcRegisteredPublicKeyBindingRef(raw: unknown): Dom
 export declare function buildMpcMaterialActivationRef(fields: MpcMaterialActivationRefFields): MpcMaterialActivationRef;
 export declare function mpcMaterialActivationRefsEqual(left: MpcMaterialActivationRef, right: MpcMaterialActivationRef): boolean;
 export declare function parseMpcMaterialActivationRef(raw: unknown): DomainIdParseResult<MpcMaterialActivationRef>;
-export declare function formatWebAuthnRpIdForWire(value: WebAuthnRpId): string;
 export declare function parseThresholdEd25519SessionId(raw: unknown): DomainIdParseResult<ThresholdEd25519SessionId>;
 export declare function parseThresholdEcdsaSessionId(raw: unknown): DomainIdParseResult<ThresholdEcdsaSessionId>;
 export declare function parseEcdsaActiveStateId(raw: unknown): DomainIdParseResult<EcdsaActiveStateId>;

package/dist/types/shared-ts/src/utils/ecdsaKeyFactsInventory.d.ts

@@ -1,24 +1,14 @@
-type EcdsaInventoryChainTarget = {
-    kind: 'evm';
-    namespace: 'eip155';
-    chainId: number;
-    networkSlug?: string;
-} | {
-    kind: 'tempo';
-    chainId: number;
-    networkSlug?: string;
-};
-export type WalletEcdsaKeyFactsInventoryChallengeInput = {
+import { type ThresholdEcdsaChainTargetWire } from './thresholdEcdsaChainTarget';
+type WalletEcdsaKeyFactsInventoryChallengeInput = {
     walletId: string;
     rpId: string;
     keyTargets: readonly {
         keyHandle: string;
-        chainTarget: EcdsaInventoryChainTarget;
+        chainTarget: ThresholdEcdsaChainTargetWire;
     }[];
     runtimePolicyScope?: unknown;
     serverNonceB64u: string;
 };
-export declare function canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input: WalletEcdsaKeyFactsInventoryChallengeInput): string;
 export declare function computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u(input: WalletEcdsaKeyFactsInventoryChallengeInput): Promise<string>;
 export {};
 //# sourceMappingURL=ecdsaKeyFactsInventory.d.ts.map

package/dist/types/shared-ts/src/utils/eip1559TxWasmJson.d.ts

@@ -0,0 +1,16 @@
+/** The EIP-1559 transaction as the EVM crypto WASM reads it: amounts in decimal strings. */
+export type Eip1559TxWasmJson = {
+    chainId: number;
+    nonce: string;
+    maxPriorityFeePerGas: string;
+    maxFeePerGas: string;
+    gasLimit: string;
+    to?: string | null;
+    value: string;
+    data?: string;
+    accessList?: {
+        address: string;
+        storageKeys: string[];
+    }[];
+};
+//# sourceMappingURL=eip1559TxWasmJson.d.ts.map

package/dist/types/shared-ts/src/utils/emailOtpDomain.d.ts

@@ -1,14 +1,16 @@
 export declare const EMAIL_OTP_CHANNEL: "email_otp";
 export declare const EMAIL_OTP_INITIAL_ENROLLMENT_VERSION: "1";
 export declare function emailOtpDeviceEnrollmentId(walletId: string, providerSubject: string): string;
-export declare const WALLET_UNLOCK_BACKENDS: readonly ["passkey", "email_otp"];
+/** Domain label that opens the AAD binding a released Email OTP factor to its challenge. */
+export declare const EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 = "seams/email-otp/factor-release/v1";
+declare const WALLET_UNLOCK_BACKENDS: readonly ["passkey", "email_otp"];
 export type WalletUnlockBackend = (typeof WALLET_UNLOCK_BACKENDS)[number];
 export type WalletEmailOtpChannel = typeof EMAIL_OTP_CHANNEL;
-export declare const WALLET_EMAIL_OTP_LOGIN_OPERATIONS: readonly ["wallet_unlock", "transaction_sign", "export_key"];
+declare const WALLET_EMAIL_OTP_LOGIN_OPERATIONS: readonly ["wallet_unlock", "transaction_sign", "export_key"];
 export type WalletEmailOtpLoginOperation = (typeof WALLET_EMAIL_OTP_LOGIN_OPERATIONS)[number];
 export declare const WALLET_EMAIL_OTP_REGISTRATION_OPERATION: "registration";
-/** Linked-device enrollment (Refactor 103 Phase 6): prove control of the
- * wallet's enrolled email destination to complete one device link. */
+/** Linked-device enrollment: prove control of the wallet's enrolled email
+ * destination to complete one device link. */
 export declare const WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION: "device_link";
 export type WalletEmailOtpOperation = WalletEmailOtpLoginOperation | typeof WALLET_EMAIL_OTP_REGISTRATION_OPERATION | typeof WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION;
 export declare const WALLET_EMAIL_OTP_ACTIONS: {
@@ -24,7 +26,7 @@ export declare const WALLET_EMAIL_OTP_UNLOCK_OPERATION: "wallet_unlock";
 export declare const WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION: "transaction_sign";
 export type WalletEmailOtpExportOperation = typeof WALLET_EMAIL_OTP_EXPORT_OPERATION;
 export type WalletEmailOtpTransactionSignOperation = typeof WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION;
-export type WalletEmailOtpUnlockOperation = typeof WALLET_EMAIL_OTP_UNLOCK_OPERATION;
 export declare function isWalletUnlockBackend(value: string): value is WalletUnlockBackend;
 export declare function isWalletEmailOtpLoginOperation(value: string): value is WalletEmailOtpLoginOperation;
+export {};
 //# sourceMappingURL=emailOtpDomain.d.ts.map

package/dist/types/shared-ts/src/utils/emailOtpRecoveryKey.d.ts

@@ -25,7 +25,5 @@ export declare function formatEmailOtpRecoveryKey(normalizedKey: string): EmailO
 export declare function buildEmailOtpRecoveryCodeSet(keys: readonly string[]): EmailOtpRecoveryCodeSet;
 export declare function normalizeEmailOtpRecoveryKey(input: string): string;
 export declare function decodeEmailOtpRecoveryKey(input: string): Uint8Array;
-export declare function generateEmailOtpRecoveryKey(): string;
-export declare function generateEmailOtpRecoveryKeySet(): EmailOtpRecoveryCodeSet;
 export {};
 //# sourceMappingURL=emailOtpRecoveryKey.d.ts.map

package/dist/types/shared-ts/src/utils/errors.d.ts

@@ -7,7 +7,6 @@ export { formatNearRpcError, getNearShortErrorMessage } from './near';
  * Always returns a string (may be empty when nothing usable can be derived).
  */
 export declare function errorMessage(err: unknown): string;
-export declare function redactSensitiveErrorText(input: string): string;
 export declare function safeErrorMessage(err: unknown): string;
 export declare function errorLogSummary(err: unknown): {
     name: string;
@@ -27,12 +26,6 @@ export declare function toError(e: unknown): Error;
 export declare function isTouchIdCancellationError(error: unknown): boolean;
 export declare function isWebAuthnRpIdOriginConfigurationError(error: unknown): boolean;
 export declare function isUserCancellationError(error: unknown): boolean;
-/**
- * Get a user-friendly error message for TouchID/FaceID cancellation
- * @param context - The context where the cancellation occurred (e.g., 'registration', 'login')
- * @returns A user-friendly error message
- */
-export declare function getTouchIdCancellationMessage(context: 'registration' | 'login'): string;
 /**
  * Transform an error message to be more user-friendly
  * @param error - The original error object or message

package/dist/types/shared-ts/src/utils/exactKeys.d.ts

@@ -0,0 +1,11 @@
+/**
+ * True when `value` is a non-array object whose own enumerable string keys are exactly `keys`.
+ *
+ * A key whose value is `undefined` still counts as present. Symbol, non-enumerable and inherited
+ * keys are not counted, and the prototype is not checked. A list that repeats a key never matches.
+ * Kept apart from validation.ts, which the wallet iframe's boot path loads.
+ */
+export declare function hasExactKeys<const K extends readonly string[]>(value: unknown, keys: K): value is {
+    readonly [P in K[number]]: unknown;
+};
+//# sourceMappingURL=exactKeys.d.ts.map

package/dist/types/shared-ts/src/utils/exactRecord.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Rejects every field outside this record's exact shape.
+ *
+ * `knownOnOtherBranches` names fields that are legitimate public bindings
+ * somewhere else in the same union. Those are reported as the branch mismatch
+ * they are; only genuinely unknown fields are classified as leaks, so a public
+ * key like `clientRootPublicKey33B64u` on the wrong branch is never mistaken
+ * for plaintext custody material.
+ */
+export declare function rejectUnknownFields(record: Record<string, unknown>, allowed: readonly string[], label: string, knownOnOtherBranches?: readonly string[]): void;
+export declare function exactRecord(raw: unknown, fields: readonly string[], label: string): Record<string, unknown>;
+//# sourceMappingURL=exactRecord.d.ts.map

package/dist/types/shared-ts/src/utils/failure.d.ts

@@ -0,0 +1,12 @@
+export declare function failure<const C extends string>(code: C, message: string): {
+    ok: false;
+    code: C;
+    message: string;
+};
+export declare function failedVerification<const C extends string>(code: C, message: string): {
+    ok: false;
+    verified: false;
+    code: C;
+    message: string;
+};
+//# sourceMappingURL=failure.d.ts.map

package/dist/types/shared-ts/src/utils/index.d.ts

@@ -11,13 +11,15 @@ export * from './theme';
 export * from './keccak';
 export * from './jsonRpc';
 export * from './nearRpcResults';
-export * from './recoveryDomain';
-export * from './paillier';
 export * from './signingSessionSeal';
 export * from './emailOtpRecoveryKey';
 export * from './addAuthMethodRegistration';
 export * from './addWalletAuthMethod';
 export * from './registrationIntent';
+export * from './walletAuthMethodRecord';
+export * from './registrationIds';
+export * from './registrationSignerPlan';
+export { normalizeAddAuthMethodInput, normalizeEmailOtpRegistrationProof, normalizeRegistrationAuthMethodInput, type AddAuthMethodInput, type EmailOtpRegistrationAuthMethodInput, type EmailOtpRegistrationProof, type PasskeyRegistrationAuthMethodInput, type RegisterWalletInput, type RegistrationAuthMethodInput, type RegistrationAuthority, type WalletAddAuthMethodEmailOtpTargetV1, type WalletEmailOtpEnrollmentMaterialV1, } from './registrationAuthMethodInput';
 export * from './domainIds';
 export * from './webauthnDeviceInfo';
 export * from './walletCapabilityBindings';
@@ -27,6 +29,7 @@ export * from './secureRandomId';
 export * from './routerAbPublicKeyset';
 export * from './routerAbEcdsaDerivation';
 export * from './routerAbEd25519Yao';
+export { deriveRouterAbEd25519YaoApplicationBindingDigestV1, deriveRouterAbEd25519YaoExportAuthorizationDigestV1, deriveRouterAbEd25519YaoExportConfirmationDigestV1, deriveRouterAbEd25519YaoRuntimePolicyBindingV1, deriveRouterAbEd25519YaoStableContextBindingV1, } from './routerAbEd25519YaoDigests';
 export * from './routerAbTraceContext';
 export * from './authenticatorOptions';
 export * from './canonicalPrimitives';

package/dist/types/shared-ts/src/utils/jsonRpc.d.ts

@@ -1,4 +1,5 @@
-export type JsonRpcId = string | number | null;
+import type { ExclusiveUnion } from './variant';
+type JsonRpcId = string | number | null;
 export type JsonRpcErrorDetails = {
     code?: number | string;
     name?: string;
@@ -6,18 +7,16 @@ export type JsonRpcErrorDetails = {
     data?: unknown;
     cause?: unknown;
 };
-export type JsonRpcEnvelope = {
+export type JsonRpcEnvelope = ExclusiveUnion<{
     kind: 'success';
     id: JsonRpcId;
     result: unknown;
-    error?: never;
 } | {
     kind: 'failure';
     id: JsonRpcId;
     error: JsonRpcErrorDetails;
-    result?: never;
-};
-export type JsonRpcEnvelopeDecodeResult = {
+}>;
+type JsonRpcEnvelopeDecodeResult = {
     ok: true;
     value: JsonRpcEnvelope;
     error?: never;
@@ -27,4 +26,5 @@ export type JsonRpcEnvelopeDecodeResult = {
     value?: never;
 };
 export declare function decodeJsonRpcEnvelope(value: unknown): JsonRpcEnvelopeDecodeResult;
+export {};
 //# sourceMappingURL=jsonRpc.d.ts.map

package/dist/types/shared-ts/src/utils/near.d.ts

@@ -38,7 +38,7 @@ export declare function validateNearAccountId(nearAccountId: string, options?: N
  * - chars: lowercase letters, digits, `_`, `.`, `-`
  */
 export declare function isValidAccountId(accountId: unknown): accountId is string;
-export type NearAccountIdParseResult<T> = {
+type NearAccountIdParseResult<T> = {
     ok: true;
     value: T;
 } | {
@@ -78,4 +78,5 @@ export declare function formatNearRpcError(operationName: string, rpc: {
  * Falls back to undefined when structure is not recognized.
  */
 export declare function getNearShortErrorMessage(error: unknown): string | undefined;
+export {};
 //# sourceMappingURL=near.d.ts.map

package/dist/types/shared-ts/src/utils/nearRpcResults.d.ts

@@ -1,19 +1,20 @@
 import { ExecutionStatusBasic, FinalExecutionStatusBasic, type ExecutionError, type TxExecutionStatus } from '@near-js/types';
 export type NearRpcResultDecoder<T> = (value: unknown) => T;
-export type DecodedNearFunctionCallPermission = {
+export type NearRpcErrorType = 'InvalidTxError' | 'ActionError' | 'TxExecutionError' | 'RpcError' | 'Failure' | 'Unknown';
+type DecodedNearFunctionCallPermission = {
     FunctionCall: {
         allowance: string;
         receiver_id: string;
         method_names: string[];
     };
 };
-export type DecodedNearAccessKeyView = {
+type DecodedNearAccessKeyView = {
     block_height: number;
     block_hash: string;
     nonce: bigint;
     permission: 'FullAccess' | DecodedNearFunctionCallPermission;
 };
-export type DecodedNearAccessKeyList = {
+type DecodedNearAccessKeyList = {
     block_height: number;
     block_hash: string;
     keys: Array<{
@@ -21,7 +22,7 @@ export type DecodedNearAccessKeyList = {
         access_key: DecodedNearAccessKeyView;
     }>;
 };
-export type DecodedNearAccountView = {
+type DecodedNearAccountView = {
     block_height: number;
     block_hash: string;
     amount: bigint;
@@ -36,7 +37,7 @@ export type DecodedNearBlockReference = {
         height: number;
     };
 };
-export type DecodedNearContractCallResult = {
+type DecodedNearContractCallResult = {
     block_height: number;
     block_hash: string;
     logs: string[];
@@ -46,14 +47,14 @@ type DecodedNearExecutionError = ExecutionError & {
     InvalidTxError?: unknown;
     ActionError?: unknown;
 };
-export type DecodedNearFinalExecutionStatus = {
+type DecodedNearFinalExecutionStatus = {
     SuccessValue: string;
     Failure?: never;
 } | {
     Failure: DecodedNearExecutionError;
     SuccessValue?: never;
 } | FinalExecutionStatusBasic;
-export type DecodedNearExecutionStatus = {
+type DecodedNearExecutionStatus = {
     SuccessValue: string;
     SuccessReceiptId?: never;
     Failure?: never;

package/dist/types/shared-ts/src/utils/normalize.d.ts

@@ -11,10 +11,6 @@ export declare function normalizeOptionalTrimmedString(value: unknown): string;
 export declare function normalizeTrimmedString(value: unknown): string;
 /** String coercion + trimming + lowercase. */
 export declare function normalizeLowercaseString(value: unknown): string;
-/** String coercion + trimming + uppercase. */
-export declare function normalizeUppercaseString(value: unknown): string;
-/** Normalize session kind into the canonical `'jwt' | 'cookie'` token. */
-export declare function normalizeJwtCookieSessionKind(value: unknown): 'jwt' | 'cookie';
 /** String coercion + trimming; empty => undefined. */
 export declare function normalizeOptionalNonEmptyString(value: unknown): string | undefined;
 /** Convert unknown to finite number; non-finite => null. */

package/dist/types/shared-ts/src/utils/registrationAuthMethodInput.d.ts

@@ -0,0 +1,179 @@
+import { type ChallengeSubjectId, type EmailOtpChallengeId, type OrgId, type ProviderSubject, type WalletId, type WebAuthnRpId } from './domainIds';
+import type { WebAuthnAuthenticatorDeviceInfo } from './webauthnDeviceInfo';
+import type { ExclusiveUnion } from './variant';
+export type RegisterWalletInput = {
+    kind: 'server_allocated';
+    walletId?: never;
+} | {
+    kind: 'provided';
+    walletId: WalletId;
+};
+export type PasskeyRegistrationAuthMethodInput = {
+    kind: 'passkey';
+    rpId: WebAuthnRpId;
+    authenticatorOptions?: unknown;
+    email?: never;
+    otpCode?: never;
+    challengeId?: never;
+};
+export type EmailOtpRegistrationAuthMethodInput = {
+    kind: 'email_otp';
+    proofKind: 'otp_challenge';
+    email: string;
+    providerSubject: string;
+    otpCode: string;
+    challengeId?: string;
+    rpId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+    authenticatorOptions?: never;
+} | {
+    kind: 'email_otp';
+    proofKind: 'google_sso_registration';
+    email: string;
+    providerSubject: string;
+    googleEmailOtpRegistrationAttemptId: string;
+    googleEmailOtpRegistrationOfferId: string;
+    googleEmailOtpRegistrationCandidateId: string;
+    rpId?: never;
+    otpCode?: never;
+    challengeId?: never;
+    authenticatorOptions?: never;
+};
+export type RegistrationAuthMethodInput = PasskeyRegistrationAuthMethodInput | EmailOtpRegistrationAuthMethodInput;
+export type AddAuthMethodInput = {
+    kind: 'passkey';
+    rpId: WebAuthnRpId;
+    email?: never;
+    otpCode?: never;
+    challengeId?: never;
+    authenticatorOptions?: never;
+} | {
+    kind: 'email_otp';
+    email: string;
+    rpId?: never;
+    otpCode?: never;
+    challengeId?: never;
+    authenticatorOptions?: never;
+};
+export type RegistrationAuthority = {
+    kind: 'passkey';
+    walletId: WalletId;
+    rpId: WebAuthnRpId;
+    credentialIdB64u: string;
+    credentialPublicKeyB64u: string;
+    counter: number;
+    /** Device metadata captured at registration verification (UA + attestation). */
+    device: WebAuthnAuthenticatorDeviceInfo;
+    registrationIntentDigestB64u: string;
+    providerSubject?: never;
+    challengeSubjectId?: never;
+    email?: never;
+    emailHashHex?: never;
+    registrationAuthorityId?: never;
+    challengeId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    originalWalletId?: never;
+    finalWalletId?: never;
+    orgId?: never;
+    challengePurpose?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+} | {
+    kind: 'email_otp';
+    proofKind: 'otp_challenge';
+    walletId: WalletId;
+    /** OIDC provider subject verified for the OTP registration proof. */
+    providerSubject: ProviderSubject;
+    /** Challenge owner verified against the OTP challenge record. */
+    challengeSubjectId: ChallengeSubjectId;
+    /** Normalized email address that received and verified the OTP. */
+    email: string;
+    emailHashHex: string;
+    challengeId: EmailOtpChallengeId;
+    registrationAuthorityId: EmailOtpChallengeId;
+    /** Wallet id attached to the original OTP challenge before any name reroll. */
+    originalWalletId: WalletId;
+    /** Final wallet id selected for registration. */
+    finalWalletId: WalletId;
+    /** Tenant scope verified against the OTP challenge record. */
+    orgId: OrgId;
+    /** Operation-bound owner proof digest verified against the OTP challenge record. */
+    ownerProofBindingDigest: string;
+    challengePurpose: 'registration' | 'registration_reroll';
+    registrationIntentDigestB64u: string;
+    credentialIdB64u?: never;
+    credentialPublicKeyB64u?: never;
+    counter?: never;
+    device?: never;
+    rpId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+} | {
+    kind: 'email_otp';
+    proofKind: 'google_sso_registration';
+    walletId: WalletId;
+    providerSubject: ProviderSubject;
+    email: string;
+    emailHashHex: string;
+    googleEmailOtpRegistrationAttemptId: string;
+    googleEmailOtpRegistrationOfferId: string;
+    googleEmailOtpRegistrationCandidateId: string;
+    registrationAuthorityId: string;
+    finalWalletId: WalletId;
+    orgId: OrgId;
+    ownerProofBindingDigest: string;
+    registrationIntentDigestB64u: string;
+    challengeSubjectId?: never;
+    challengeId?: never;
+    originalWalletId?: never;
+    challengePurpose?: never;
+    credentialIdB64u?: never;
+    credentialPublicKeyB64u?: never;
+    counter?: never;
+    device?: never;
+    rpId?: never;
+};
+export type EmailOtpRegistrationProof = ExclusiveUnion<{
+    version: 'email_otp_registration_proof_v1';
+    proofKind: 'otp_challenge';
+    providerSubject: string;
+    /** Normalized email address that received the OTP. */
+    email: string;
+    challengeId: string;
+    otpCode: string;
+    otpChannel: 'email_otp';
+    /** Registration intent digest that binds the OTP proof to the wallet-registration request. */
+    registrationIntentDigestB64u: string;
+} | {
+    version: 'email_otp_registration_proof_v1';
+    proofKind: 'google_sso_registration';
+    providerSubject: string;
+    email: string;
+    googleEmailOtpRegistrationAttemptId: string;
+    googleEmailOtpRegistrationOfferId: string;
+    googleEmailOtpRegistrationCandidateId: string;
+    registrationIntentDigestB64u: string;
+}>;
+export declare function inspectRawObject(value: unknown): object | null;
+export declare function trimString(value: unknown): string;
+export declare function normalizeRegistrationAuthMethodInput(raw: unknown): RegistrationAuthMethodInput | null;
+export declare function normalizeAddAuthMethodInput(raw: unknown): AddAuthMethodInput | null;
+export declare function normalizeEmailOtpRegistrationProof(raw: unknown): EmailOtpRegistrationProof | null;
+/** What a client sends to create a wallet's shared Email OTP enrollment. */
+export type WalletEmailOtpEnrollmentMaterialV1 = {
+    enrollmentSealKeyVersion: string;
+    clientUnlockPublicKeyB64u: string;
+    unlockKeyVersion: string;
+    serverSealedFactorCiphertextB64u: string;
+};
+export type WalletAddAuthMethodEmailOtpTargetV1 = {
+    readonly kind: 'existing_enrollment';
+    readonly enrollment?: never;
+} | {
+    readonly kind: 'new_enrollment';
+    readonly enrollment: WalletEmailOtpEnrollmentMaterialV1;
+};
+//# sourceMappingURL=registrationAuthMethodInput.d.ts.map

package/dist/types/shared-ts/src/utils/registrationContracts.d.ts

@@ -0,0 +1,76 @@
+import type { MpcWalletSigningQuotaId, WalletSessionAuthorizationId, WalletSessionId } from '../authorization/capabilityKinds';
+import type { WalletSessionOperationCredentialV1 } from '../device-linking/contracts';
+import type { Ed25519AuthorityScope } from '../threshold/sessionPolicy';
+import type { RuntimePolicyScope } from '../threshold/signingRootScope';
+import type { WalletId } from './registrationIntent';
+import type { RegistrationSignerSetSelection } from './registrationSignerPlan';
+import type { RegisterWalletInput, RegistrationAuthMethodInput } from './registrationAuthMethodInput';
+import type { RouterAbEd25519YaoActivationAdmissionReceiptV1, RouterAbEd25519YaoBytes32V1, RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from './routerAbEd25519Yao';
+import type { WALLET_AUTH_METHODS } from './signerDomain';
+import type { RouterAbEd25519NormalSigningState } from './signingSessionSeal';
+import type { Variant } from './variant';
+export type CreateRegistrationIntentRequest = {
+    wallet: RegisterWalletInput;
+    authMethod: RegistrationAuthMethodInput;
+    signerSelection: RegistrationSignerSetSelection;
+};
+export type WalletRegistrationEd25519YaoStart = {
+    admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+    admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+};
+export type WalletRegistrationEd25519YaoActivationReference = {
+    kind: 'router_ab_ed25519_yao_activation_reference_v1';
+    lifecycle_id: string;
+    session_id: RouterAbEd25519YaoBytes32V1;
+};
+export type WalletRegistrationFinalizeAuthMethod = {
+    kind: typeof WALLET_AUTH_METHODS.passkey;
+    credentialIdB64u: string;
+    credentialPublicKeyB64u: string;
+} | {
+    kind: typeof WALLET_AUTH_METHODS.emailOtp;
+    registrationAuthorityId: string;
+};
+export type PasskeyWalletRegistrationFinalizeAuthMethod = Variant<WalletRegistrationFinalizeAuthMethod, 'kind', typeof WALLET_AUTH_METHODS.passkey>;
+export type EmailOtpWalletRegistrationFinalizeAuthMethod = Variant<WalletRegistrationFinalizeAuthMethod, 'kind', typeof WALLET_AUTH_METHODS.emailOtp>;
+export type WalletRegistrationEd25519YaoSignerRuntimeBootstrap = {
+    walletId: WalletId;
+    nearAccountId: string;
+    nearEd25519SigningKeyId: string;
+    authorityScope: Ed25519AuthorityScope;
+    thresholdSessionId: string;
+    authorizationId: WalletSessionAuthorizationId;
+    walletSessionId: WalletSessionId;
+    quotaId: MpcWalletSigningQuotaId;
+    expiresAtMs: number;
+    participantIds: readonly [number, number];
+    remainingUses: number;
+    signingRootId: string;
+    signingRootVersion: string;
+    runtimePolicyScope: RuntimePolicyScope;
+    routerAbNormalSigning: RouterAbEd25519NormalSigningState;
+};
+/**
+ * The Ed25519 Yao view of one exact Wallet Session. A session this response
+ * just issued carries its own primary operation credential; a session it
+ * reuses carries none, because the credential was delivered once by the
+ * issuing response and a committed digest cannot reproduce plaintext.
+ */
+export type WalletRegistrationEd25519YaoBootstrapSession = (WalletRegistrationEd25519YaoSignerRuntimeBootstrap & {
+    sessionKind: 'issued_exact_wallet_session';
+    operationCredential: WalletSessionOperationCredentialV1;
+}) | (WalletRegistrationEd25519YaoSignerRuntimeBootstrap & {
+    sessionKind: 'already_committed_exact_wallet_session';
+    operationCredential?: never;
+});
+export type WalletEd25519YaoSignerPublicResult = {
+    signerSlot: number;
+    nearAccountId: string;
+    nearEd25519SigningKeyId: string;
+    publicKey: string;
+    relayerKeyId: string;
+    keyVersion: string;
+    recoveryExportCapable: true;
+    participantIds: readonly [number, number];
+};
+//# sourceMappingURL=registrationContracts.d.ts.map

package/dist/types/shared-ts/src/utils/registrationEstablishedSession.d.ts

@@ -3,7 +3,7 @@ import { type WalletId } from './domainIds';
 import type { MpcMaterialActivationRef, ThresholdEcdsaSessionId, ThresholdEd25519SessionId } from './domainIds';
 import { type ThresholdEcdsaKeyHandle } from './thresholdEcdsaKeyHandle';
 import { type NearAccountId } from './near';
-import { type NearEd25519SigningKeyId } from './registrationIntent';
+import { type NearEd25519SigningKeyId } from './registrationIds';
 import { type RuntimePolicyScope } from '../threshold/signingRootScope';
 import { type RouterAbEd25519NormalSigningState } from './signingSessionSeal';
 import { type RouterAbEcdsaDerivationNormalSigningStateV1 } from './routerAbEcdsaDerivation';
@@ -80,6 +80,5 @@ export type RegistrationEstablishedSessionResultV2 = {
     readonly next: 'unlock_exact_method';
 };
 export declare function parseRegistrationEstablishedSessionResultV2(raw: unknown): RegistrationEstablishedSessionResultV2 | null;
-export declare function parseRegistrationEstablishedSessionV2(raw: unknown): RegistrationEstablishedSessionV2 | null;
 export declare function parseRegistrationEstablishedSessionProjectionV2(raw: unknown): RegistrationEstablishedSessionProjectionV2 | null;
 //# sourceMappingURL=registrationEstablishedSession.d.ts.map