@seams/wallet-server 0.6.2 → 0.7.3

package/dist/types/shared-ts/src/utils/routerAbEd25519YaoDigests.d.ts

@@ -0,0 +1,38 @@
+import type { RouterAbEd25519YaoBytes32V1 } from './generated/routerAbEd25519YaoCore';
+import type { RouterAbEd25519YaoApplicationBindingFactsV1, RouterAbEd25519YaoExportAuthorizationIdentityV1 } from './routerAbEd25519Yao';
+import type { ReadonlyExclusiveUnion } from './variant';
+type RouterAbEd25519YaoExportAuthorityBindingV1 = ReadonlyExclusiveUnion<{
+    readonly kind: 'passkey';
+    readonly credentialIdB64u: string;
+} | {
+    readonly kind: 'email_otp';
+    readonly providerSubjectId: string;
+}>;
+export declare function requireVisibleIdentifier(value: unknown, label: string): string;
+export declare function requireBytes(value: unknown, label: string, minimumLength: number, maximumLength: number): number[];
+export declare function requireBytes32(value: unknown, label: string, nonzero: boolean): number[];
+export declare function equalBytes(left: readonly number[], right: readonly number[]): boolean;
+export declare function deriveRouterAbEd25519YaoApplicationBindingDigestV1(facts: RouterAbEd25519YaoApplicationBindingFactsV1): Promise<number[]>;
+export declare function deriveRouterAbEd25519YaoStableContextBindingV1(applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1, participantIds: readonly [number, number]): Promise<number[]>;
+export declare function deriveRouterAbEd25519YaoRuntimePolicyBindingV1(input: {
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+    readonly signingRootVersion: string;
+}): Promise<number[]>;
+export declare function deriveRouterAbEd25519YaoExportConfirmationDigestV1(input: {
+    readonly identity: RouterAbEd25519YaoExportAuthorizationIdentityV1;
+    readonly nonce: RouterAbEd25519YaoBytes32V1;
+    readonly issuedAtMs: number;
+    readonly expiresAtMs: number;
+}): Promise<number[]>;
+export declare function deriveRouterAbEd25519YaoExportAuthorizationDigestV1(input: {
+    readonly identity: RouterAbEd25519YaoExportAuthorizationIdentityV1;
+    readonly confirmationDigest: RouterAbEd25519YaoBytes32V1;
+    readonly nonce: RouterAbEd25519YaoBytes32V1;
+    readonly issuedAtMs: number;
+    readonly expiresAtMs: number;
+    readonly authority: RouterAbEd25519YaoExportAuthorityBindingV1;
+}): Promise<number[]>;
+export {};
+//# sourceMappingURL=routerAbEd25519YaoDigests.d.ts.map

package/dist/types/shared-ts/src/utils/routerAbNormalSigningIdentity.d.ts

@@ -1,4 +1,6 @@
 import { type MpcMaterialActivationRef } from './domainIds';
+import type { RouterAbEcdsaOperationStepUpPreparationV1Wire } from './routerAbEcdsaDerivation';
+import type { RouterAbMpcMaterialActivationRefV1 } from './generated/routerAbEd25519YaoCore';
 export type RouterAbNormalSigningAuthorizationWire = {
     readonly kind: 'reusable_wallet_session';
     readonly wallet_session_id: string;
@@ -7,15 +9,18 @@ export type RouterAbNormalSigningAuthorizationWire = {
     readonly evidence_set_digest?: never;
     readonly wallet_session_id?: never;
 };
-export type RouterAbMpcMaterialActivationRefWire = {
-    readonly kind: 'mpc_material_activation_ref';
-    readonly activation_id: string;
-    readonly capability: string;
-    readonly material_owner: string;
-    readonly key_binding: string;
-    readonly lifecycle_binding: string;
-    readonly signing_worker: string;
+export type RouterAbEcdsaDerivationPoolFillAuthorization = {
+    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
+        readonly kind: 'reusable_wallet_session';
+    }>;
+    readonly operation?: never;
+} | {
+    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
+        readonly kind: 'operation_step_up';
+    }>;
+    readonly operation: RouterAbEcdsaOperationStepUpPreparationV1Wire;
 };
+export type RouterAbMpcMaterialActivationRefWire = Readonly<RouterAbMpcMaterialActivationRefV1>;
 export type RouterAbEd25519OperationStepUpPreparationV1Wire = {
     readonly wallet_id: string;
     readonly operation_kind: 'near.sign_transaction' | 'near.sign_delegate_action' | 'near.sign_nep413_message';
@@ -29,6 +34,23 @@ export type RouterAbEd25519OperationStepUpPreparationV1Wire = {
     readonly participant_ids: readonly [number, number];
     readonly expires_at_ms: number;
 };
+export type RouterAbEd25519OperationStepUpMaterialRecoveryRequest = {
+    kind: 'not_requested';
+} | {
+    kind: 'email_otp_factor_release_v1';
+    workerEphemeralPublicKey65B64u: string;
+};
+export type RouterAbEd25519OperationStepUpMaterialRecoveryResponse = {
+    kind: 'not_requested';
+} | {
+    kind: 'email_otp_factor_release_v1';
+    challengeId: string;
+    enrollmentId: string;
+    enrollmentSealKeyVersion: string;
+    serverEphemeralPublicKey65B64u: string;
+    nonce12B64u: string;
+    ciphertextB64u: string;
+};
 export type RouterAbEd25519OwnerOperationAuthorizationDecisionV1Wire = {
     readonly kind: 'authorized';
     readonly operation: {

package/dist/types/shared-ts/src/utils/routerAbPublicKeyset.d.ts

@@ -1,36 +1,36 @@
 export declare const ROUTER_AB_PUBLIC_KEYSET_VERSION_V2: "router_ab_keyset_v2";
 export declare const ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH: "/.well-known/router-ab/keyset";
 export declare const ROUTER_AB_PUBLIC_KEYSET_PATH: "/router-ab/keyset";
-export type RouterAbSignerRoleV1 = 'signer_a' | 'signer_b';
-export type RouterAbSignerEnvelopeHpkePublicKeyV1 = {
+type RouterAbSignerRoleV1 = 'signer_a' | 'signer_b';
+type RouterAbSignerEnvelopeHpkePublicKeyV1 = {
     role: RouterAbSignerRoleV1;
     key_epoch: string;
     public_key: string;
 };
-export type RouterAbSignerEnvelopeHpkePublicKeySetV1 = {
+type RouterAbSignerEnvelopeHpkePublicKeySetV1 = {
     deriver_a: RouterAbSignerEnvelopeHpkePublicKeyV1;
     deriver_b: RouterAbSignerEnvelopeHpkePublicKeyV1;
 };
-export type RouterAbSignerEnvelopeHpkeCurrentPublicKeySetV1 = {
+type RouterAbSignerEnvelopeHpkeCurrentPublicKeySetV1 = {
     current: RouterAbSignerEnvelopeHpkePublicKeySetV1;
     previous?: never;
     previous_retire_at_ms?: never;
 };
-export type RouterAbSignerEnvelopeHpkeRotatingPublicKeySetV1 = {
+type RouterAbSignerEnvelopeHpkeRotatingPublicKeySetV1 = {
     current: RouterAbSignerEnvelopeHpkePublicKeySetV1;
     previous: RouterAbSignerEnvelopeHpkePublicKeySetV1;
     previous_retire_at_ms: number;
 };
-export type RouterAbSignerEnvelopeHpkeRotationPublicKeySetV1 = RouterAbSignerEnvelopeHpkeCurrentPublicKeySetV1 | RouterAbSignerEnvelopeHpkeRotatingPublicKeySetV1;
-export type RouterAbSignerPeerVerifyingKeyHexV1 = {
+type RouterAbSignerEnvelopeHpkeRotationPublicKeySetV1 = RouterAbSignerEnvelopeHpkeCurrentPublicKeySetV1 | RouterAbSignerEnvelopeHpkeRotatingPublicKeySetV1;
+type RouterAbSignerPeerVerifyingKeyHexV1 = {
     role: RouterAbSignerRoleV1;
     verifying_key_hex: string;
 };
-export type RouterAbSignerPeerVerifyingKeyHexSetV1 = {
+type RouterAbSignerPeerVerifyingKeyHexSetV1 = {
     deriver_a: RouterAbSignerPeerVerifyingKeyHexV1;
     deriver_b: RouterAbSignerPeerVerifyingKeyHexV1;
 };
-export type RouterAbPublicHpkeKeyDescriptorV1 = {
+type RouterAbPublicHpkeKeyDescriptorV1 = {
     key_epoch: string;
     public_key: string;
 };
@@ -42,10 +42,5 @@ export type RouterAbPublicKeysetV2 = {
 };
 export declare function requireRouterAbX25519PublicKey(value: unknown, label: string): string;
 export declare function parseRouterAbPublicKeysetV2(value: unknown): RouterAbPublicKeysetV2;
-export declare function selectRouterAbSignerEnvelopeHpkeKeyForEpoch(args: {
-    keyset: RouterAbSignerEnvelopeHpkeRotationPublicKeySetV1;
-    role: RouterAbSignerRoleV1;
-    keyEpoch: string;
-    nowMs: number;
-}): RouterAbSignerEnvelopeHpkePublicKeyV1;
+export {};
 //# sourceMappingURL=routerAbPublicKeyset.d.ts.map

package/dist/types/shared-ts/src/utils/routerAbTraceContext.d.ts

@@ -3,7 +3,7 @@ export type RouterAbTraceContextV1 = {
     readonly kind: 'router_ab_trace_context_v1';
     readonly value: string;
 };
-export type RouterAbTraceContextParseResultV1 = {
+type RouterAbTraceContextParseResultV1 = {
     readonly ok: true;
     readonly value: RouterAbTraceContextV1;
 } | {
@@ -13,4 +13,5 @@ export type RouterAbTraceContextParseResultV1 = {
 };
 export declare function parseRouterAbTraceContextV1(raw: unknown): RouterAbTraceContextParseResultV1;
 export declare function createRouterAbTraceContextV1(): RouterAbTraceContextV1;
+export {};
 //# sourceMappingURL=routerAbTraceContext.d.ts.map

package/dist/types/shared-ts/src/utils/routerApiKeyAuth.d.ts

@@ -0,0 +1,2 @@
+export type RouterApiKeyAuthFailureCode = 'secret_key_missing' | 'secret_key_invalid' | 'secret_key_revoked' | 'secret_key_forbidden_scope' | 'secret_key_ip_blocked' | 'secret_key_environment_mismatch';
+//# sourceMappingURL=routerApiKeyAuth.d.ts.map

package/dist/types/shared-ts/src/utils/secureRandomId.d.ts

@@ -1,6 +1,4 @@
-export declare function secureRandomBytes(length?: number, label?: string): Uint8Array;
 export declare function secureRandomBase64Url(byteLength?: number, label?: string): string;
 export declare function secureRandomId(prefix: string, byteLength?: number, label?: string): string;
-export declare function secureRandomUintBelow(maxExclusive: number, label?: string): number;
 export declare function secureRandomBase36(length: number, label?: string): string;
 //# sourceMappingURL=secureRandomId.d.ts.map

package/dist/types/shared-ts/src/utils/signerDomain.d.ts

@@ -15,31 +15,12 @@ export declare const WALLET_AUTH_METHODS: {
 };
 /** Authentication methods that can be enrolled on a wallet. */
 export type WalletAuthMethod = (typeof WALLET_AUTH_METHODS)[keyof typeof WALLET_AUTH_METHODS];
-export type WalletAuthMethodSignerResolution = {
-    kind: 'supported';
-    walletAuthMethod: typeof WALLET_AUTH_METHODS.passkey;
-    signerAuthMethod: typeof SIGNER_AUTH_METHODS.passkey;
-} | {
-    kind: 'supported';
-    walletAuthMethod: typeof WALLET_AUTH_METHODS.emailOtp;
-    signerAuthMethod: typeof SIGNER_AUTH_METHODS.emailOtp;
-} | {
-    kind: 'unsupported';
-    walletAuthMethod: Exclude<WalletAuthMethod, SignerAuthMethod>;
-    signerAuthMethod?: never;
-};
-export declare const WALLET_AUTH_PROOF_METHODS: {
-    readonly passkey: "passkey";
-    readonly emailOtp: "email_otp";
-    readonly session: "session";
-};
-export type WalletAuthProofMethod = (typeof WALLET_AUTH_PROOF_METHODS)[keyof typeof WALLET_AUTH_PROOF_METHODS];
-export declare const SIGNING_SESSION_RETENTIONS: {
+declare const SIGNING_SESSION_RETENTIONS: {
     readonly session: "session";
     readonly singleUse: "single_use";
 };
 export type SigningSessionRetention = (typeof SIGNING_SESSION_RETENTIONS)[keyof typeof SIGNING_SESSION_RETENTIONS];
-export declare const SIGNING_SESSION_POLICIES: {
+declare const SIGNING_SESSION_POLICIES: {
     readonly session: "session";
     readonly perOperation: "per_operation";
 };
@@ -57,19 +38,6 @@ export declare const SIGNER_SOURCES: {
     readonly selfHostedImport: "self_hosted_import";
 };
 export type SignerSource = (typeof SIGNER_SOURCES)[keyof typeof SIGNER_SOURCES];
-export declare const SIGNER_KIND_VALUES: readonly SignerKind[];
-export declare const SIGNER_AUTH_METHOD_VALUES: readonly SignerAuthMethod[];
-export declare const WALLET_AUTH_METHOD_VALUES: readonly WalletAuthMethod[];
-export declare const WALLET_AUTH_PROOF_METHOD_VALUES: readonly WalletAuthProofMethod[];
-export declare const SIGNER_SOURCE_VALUES: readonly SignerSource[];
-export declare const SIGNING_SESSION_POLICY_VALUES: readonly SigningSessionPolicy[];
-export declare const SENSITIVE_OPERATION_POLICY_VALUES: readonly SensitiveOperationPolicy[];
-export declare function isSignerKind(value: unknown): value is SignerKind;
-export declare function isSignerAuthMethod(value: unknown): value is SignerAuthMethod;
 export declare function isWalletAuthMethod(value: unknown): value is WalletAuthMethod;
-export declare function resolveSignerAuthMethodForWalletAuthMethod(walletAuthMethod: WalletAuthMethod): WalletAuthMethodSignerResolution;
-export declare function isWalletAuthProofMethod(value: unknown): value is WalletAuthProofMethod;
-export declare function isSignerSource(value: unknown): value is SignerSource;
-export declare function isSigningSessionPolicy(value: unknown): value is SigningSessionPolicy;
-export declare function isSensitiveOperationPolicy(value: unknown): value is SensitiveOperationPolicy;
+export {};
 //# sourceMappingURL=signerDomain.d.ts.map

package/dist/types/shared-ts/src/utils/signerSlot.d.ts

@@ -4,8 +4,4 @@ export type SignerSlot = number & {
 export declare function parseSignerSlot(value: unknown, options?: {
     min?: number;
 }): SignerSlot | null;
-export declare function coerceSignerSlot(value: unknown, options?: {
-    min?: number;
-    fallback?: number;
-}): number;
 //# sourceMappingURL=signerSlot.d.ts.map

package/dist/types/shared-ts/src/utils/signingSessionSeal.d.ts

@@ -1,6 +1,7 @@
 import type { RouterAbEcdsaDerivationNormalSigningStateV1, RouterAbEcdsaDerivationPublicCapabilityV1 } from './routerAbEcdsaDerivation';
 import type { EmailOtpProvider, EmailOtpWalletAuthAuthority, WalletAuthAuthorityRef } from './walletAuthAuthority';
 import type { MpcMaterialActivationRef } from './domainIds';
+import type { ThresholdEcdsaChainTarget } from './thresholdEcdsaChainTarget';
 import { SIGNER_AUTH_METHODS, type SignerAuthMethod } from './signerDomain';
 export declare const SIGNING_SESSION_SEALED_RECORD_VERSION: 2;
 export declare const SIGNING_SESSION_SEAL_ALG: "shamir3pass-v2";
@@ -16,12 +17,6 @@ export declare const WALLET_SESSION_SEAL_BASE_PATH: "/wallet-session/seal";
 export declare function decodeSigningSessionSecret32(plaintext: Uint8Array): Uint8Array | null;
 export declare const PASSKEY_PRF_FIRST_SALT_V1: Uint8Array<ArrayBuffer>;
 export declare const PASSKEY_PRF_SECOND_SALT_V1: Uint8Array<ArrayBuffer>;
-export declare const EMAIL_OTP_HKDF_SALTS: {
-    readonly signingSessionSecret: "seams/email-otp/signing-session-secret/v1";
-    readonly signingSessionRestoreRoot: "seams/signing-session/restore-root/v1";
-    readonly thresholdEcdsaClientRoot: "seams/signing-session/threshold-ecdsa-client-root/v1";
-    readonly thresholdEd25519RestoreSeed: "seams/signing-session/threshold-ed25519-restore-seed/v1";
-};
 export type SigningSessionSealAuthMethod = Extract<SignerAuthMethod, typeof SIGNER_AUTH_METHODS.passkey | typeof SIGNER_AUTH_METHODS.emailOtp>;
 export type SigningSessionSealCurve = 'ed25519' | 'ecdsa';
 export type SigningSessionSealGroupId = typeof SIGNING_SESSION_SEAL_GROUP_ID;
@@ -29,6 +24,14 @@ export type SigningSessionSealProtocol = {
     algorithm: typeof SIGNING_SESSION_SEAL_ALG;
     groupId: SigningSessionSealGroupId;
 };
+/** The signing-session seal capabilities a relayer publishes in its well-known document. */
+export type WellKnownSigningSessionSealCapabilities = {
+    mode: 'none';
+} | {
+    mode: 'sealed_refresh_v1';
+    protocol: SigningSessionSealProtocol;
+    currentKeyVersion: string;
+};
 export type SealedSigningSessionEcdsaRestoreSource = 'login' | 'registration' | 'manual-bootstrap' | 'email_otp';
 export type RouterAbEd25519NormalSigningState = {
     kind: typeof ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND;
@@ -36,18 +39,8 @@ export type RouterAbEd25519NormalSigningState = {
 };
 export declare function parseRouterAbEd25519NormalSigningState(value: unknown): RouterAbEd25519NormalSigningState | null;
 export declare function requireRouterAbEd25519NormalSigningState(value: unknown): RouterAbEd25519NormalSigningState;
-export type SealedSigningSessionEcdsaChainTarget = {
-    kind: 'tempo';
-    chainId: number;
-    networkSlug: string;
-} | {
-    kind: 'evm';
-    namespace: 'eip155';
-    chainId: number;
-    networkSlug: string;
-};
 type SealedSigningSessionEcdsaRestoreMetadataBase = {
-    chainTarget: SealedSigningSessionEcdsaChainTarget;
+    chainTarget: ThresholdEcdsaChainTarget;
     signingRootId: string;
     signingRootVersion: string;
     keyHandle: string;

package/dist/types/shared-ts/src/utils/thresholdEcdsaChainTarget.d.ts

@@ -0,0 +1,25 @@
+export type EvmEip155ChainTarget = {
+    kind: 'evm';
+    namespace: 'eip155';
+    chainId: number;
+    networkSlug: string;
+};
+export type TempoChainTarget = {
+    kind: 'tempo';
+    chainId: number;
+    networkSlug: string;
+};
+export type ThresholdEcdsaChainTarget = EvmEip155ChainTarget | TempoChainTarget;
+/** A chain target as requests carry it: the network slug may still be unresolved. */
+export type ThresholdEcdsaChainTargetWire = {
+    kind: 'evm';
+    namespace: 'eip155';
+    chainId: number;
+    networkSlug?: string;
+} | {
+    kind: 'tempo';
+    chainId: number;
+    networkSlug?: string;
+};
+export declare function thresholdEcdsaChainTargetKey(target: ThresholdEcdsaChainTargetWire): string;
+//# sourceMappingURL=thresholdEcdsaChainTarget.d.ts.map

package/dist/types/shared-ts/src/utils/validation.d.ts

@@ -1,27 +1,27 @@
-export interface ValidationResult {
-    valid: boolean;
-    error?: string;
-}
 export type { NearAccountValidationOptions } from './near';
 export { ensureEd25519Prefix, validateNearAccountId, isValidAccountId } from './near';
 export { normalizeOptionalString as toOptionalString, normalizeOptionalTrimmedString as toOptionalTrimmedString, normalizeTrimmedString as toTrimmedString, stripTrailingSlashes, ensureLeadingSlash, toBasePath, toOriginOrUndefined, toRorOriginOrNull, toSingleLine, normalizeInteger, normalizePositiveInteger, } from './normalize';
 export declare function requireTrimmedString(value: unknown, label: string, message?: string): string;
 export declare function toOptionalTrimmedNonEmptyString(value: unknown): string | undefined;
+export declare function requireNonEmptyString(value: unknown, label: string): string;
+export declare function requireCanonicalString(value: unknown, label: string, message?: string): string;
+export declare function coerceNonEmptyString(value: unknown, label: string): string;
+export declare function coerceNonNullishString(value: unknown, label: string): string;
 export declare function isObject(x: unknown): x is Record<string, unknown>;
 export declare function isPlainObject(x: unknown): x is Record<string, unknown>;
-export declare function toOptionalRecordString(record: unknown, key: string): string | undefined;
 export declare function isString(x: unknown): x is string;
 export declare function isNonEmptyString(x: unknown): x is string;
-export declare function isNumber(x: unknown): x is number;
 export declare function isFiniteNumber(x: unknown): x is number;
 export declare function isFunction(x: unknown): x is (...args: unknown[]) => unknown;
 export declare function isBoolean(x: unknown): x is boolean;
 export declare function isArray<T = unknown>(x: unknown): x is T[];
+export declare function asRecord(value: unknown): Record<string, unknown> | null;
+export declare function asRecordOrArray(value: unknown): Record<string, unknown> | null;
+export declare function requireRecord(value: unknown, label: string): Record<string, unknown>;
+export declare function requireRecordOrArray(value: unknown, label: string): Record<string, unknown>;
+export declare function requireRecordCopy(value: unknown, label: string): Record<string, unknown>;
+export declare function requireArray(value: unknown, label: string): readonly unknown[];
 export declare function assertString(val: unknown, name?: string): string;
-export declare function assertNumber(val: unknown, name?: string): number;
-export declare function assertBoolean(val: unknown, name?: string): boolean;
-export declare function assertObject<T extends Record<string, unknown> = Record<string, unknown>>(val: unknown, name?: string): T;
-export declare function assertArray<T = unknown>(val: unknown, name?: string): T[];
 export declare function stripFunctionsShallow<T extends Record<string, unknown>>(obj?: T): Partial<T> | undefined;
 export interface PlainSignedTransactionLike {
     transaction: unknown;

package/dist/types/shared-ts/src/utils/variant.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The members of union `U` whose `K` field is `V`.
+ *
+ * A bare `Extract<U, { K: V }>` accepts any `V` and quietly becomes `never` when
+ * nothing matches, so a misspelled or renamed discriminant only fails later, at
+ * some distant use. Here `V` must be one of the values `U[K]` already has.
+ */
+export type Variant<U, K extends keyof U, V extends U[K]> = Extract<U, {
+    readonly [P in K]: V;
+}>;
+type KeysOfUnion<U> = U extends unknown ? keyof U : never;
+type Flatten<T> = {
+    [K in keyof T]: T[K];
+};
+/**
+ * Union `U` with each member's missing keys added as `?: never`, where the missing keys are
+ * those that other members declare. The members stay mutually exclusive, and code can read any
+ * member's key without narrowing first (it reads as `undefined` on the members that lack it).
+ * `K` holds every member's keys, taken before `U` distributes.
+ */
+export type ExclusiveUnion<U, K extends PropertyKey = KeysOfUnion<U>> = U extends unknown ? Flatten<U & {
+    [P in Exclude<K, keyof U>]?: never;
+}> : never;
+/** `ExclusiveUnion` for readonly members: the added keys are `readonly` too. */
+export type ReadonlyExclusiveUnion<U, K extends PropertyKey = KeysOfUnion<U>> = U extends unknown ? Flatten<U & {
+    readonly [P in Exclude<K, keyof U>]?: never;
+}> : never;
+export {};
+//# sourceMappingURL=variant.d.ts.map

package/dist/types/shared-ts/src/utils/variant.typecheck.d.ts

@@ -0,0 +1,22 @@
+import type { Variant } from './variant';
+type Method = {
+    readonly kind: 'passkey';
+    readonly status: 'active';
+    readonly credentialId: string;
+} | {
+    readonly kind: 'passkey';
+    readonly status: 'revoked';
+    readonly credentialId: string;
+} | {
+    readonly kind: 'email_otp';
+    readonly status: 'active';
+    readonly email: string;
+};
+type ActivePasskey = Variant<Variant<Method, 'status', 'active'>, 'kind', 'passkey'>;
+export declare const activePasskey: ActivePasskey;
+export declare const activeMethods: readonly Variant<Method, 'status', 'active'>[];
+export declare const revokedPasskey: ActivePasskey;
+export type MisspelledKind = Variant<Method, 'kind', 'pass_key'>;
+export type NotADiscriminant = Variant<Method, 'email', string>;
+export {};
+//# sourceMappingURL=variant.typecheck.d.ts.map

package/dist/types/shared-ts/src/utils/walletAddSignerActivation.d.ts

@@ -12,12 +12,12 @@
  */
 import { type CanonicalEcdsaServerActivationRequest } from './ecdsaCapabilityActivation';
 import type { RouterAbEcdsaVerifiedClientActivationFactsV1 } from './routerAbEcdsaDerivation';
-export declare const WALLET_ADD_SIGNER_ECDSA_ACTIVATE_OPERATION = "wallet_add_signer_activate_v2";
-export type WalletAddSignerEcdsaActivationCommandInput = {
+type WalletAddSignerEcdsaActivationCommandInput = {
     readonly addSignerCeremonyId: string;
     readonly activationCorrelationId: string;
     readonly publicFacts: RouterAbEcdsaVerifiedClientActivationFactsV1;
 };
 export declare function buildCanonicalWalletAddSignerEcdsaActivationRequest(input: WalletAddSignerEcdsaActivationCommandInput): CanonicalEcdsaServerActivationRequest;
 export declare function computeWalletAddSignerEcdsaActivationRequestDigestB64u(input: WalletAddSignerEcdsaActivationCommandInput): Promise<string>;
+export {};
 //# sourceMappingURL=walletAddSignerActivation.d.ts.map

package/dist/types/shared-ts/src/utils/walletAuthAuthority.d.ts

@@ -1,4 +1,4 @@
-import { type EmailOtpChallengeId, type EmailOtpProviderUserId, type VerifiedEmailAddress, type WalletAuthorityBindingDigest, type WalletAuthMethodId, type WalletId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from './domainIds';
+import { type EmailOtpProviderUserId, type WalletAuthorityBindingDigest, type WalletAuthMethodId, type WalletId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from './domainIds';
 export type EmailOtpProvider = 'google' | 'email';
 export type PasskeyFactorIdentity = {
     kind: 'passkey';
@@ -47,10 +47,6 @@ export type WalletAuthAuthority = PasskeyWalletAuthAuthority | EmailOtpWalletAut
 export declare function isPasskeyWalletAuthAuthority(authority: WalletAuthAuthority): authority is PasskeyWalletAuthAuthority;
 export declare function isEmailOtpWalletAuthAuthority(authority: WalletAuthAuthority): authority is EmailOtpWalletAuthAuthority;
 export declare function walletAuthAuthoritiesMatch(left: WalletAuthAuthority, right: WalletAuthAuthority): boolean;
-export type EmailOtpFactorProfile = {
-    factor: EmailOtpFactorIdentity;
-    email: VerifiedEmailAddress;
-};
 export type WalletAuthAuthorityRef = {
     kind: 'wallet_auth_authority_ref';
     walletId: WalletId;
@@ -68,57 +64,11 @@ export type WalletAuthAuthorityRef = {
     walletAuthMethodId: WalletAuthMethodId;
 };
 export declare function parseWalletAuthAuthorityRef(raw: unknown): WalletAuthAuthorityRef | null;
-export type AuthOperationPurpose = 'registration' | 'unlock' | 'step_up' | 'recovery' | 'key_export';
-export type AuthMethodProof = {
-    kind: 'passkey_registration_credential';
-    webauthnRegistration: unknown;
-} | {
-    kind: 'passkey_assertion';
-    assertion: unknown;
-} | {
-    kind: 'email_otp_challenge';
-    challengeId: EmailOtpChallengeId;
-    otpCode: string;
-} | {
-    kind: 'google_sso_registration';
-    registrationAttemptId: string;
-    registrationOfferId: string;
-    registrationCandidateId: string;
-};
-export type AuthBoundaryProof = {
-    purpose: AuthOperationPurpose;
-    proof: AuthMethodProof;
-};
-export type ProofFor<P extends AuthOperationPurpose> = AuthBoundaryProof & {
-    readonly __authOperationPurpose?: P;
-};
-export type AuthBoundaryProofPurposeRejectionReason = 'registration_requires_registration_proof' | 'recovery_requires_email_otp_challenge' | 'interactive_operation_requires_assertion_or_email_otp_challenge';
-export type AuthBoundaryProofPurposeValidation = {
-    ok: true;
-    proof: AuthBoundaryProof;
-} | {
-    ok: false;
-    reason: AuthBoundaryProofPurposeRejectionReason;
-    proof: AuthBoundaryProof;
-};
-export declare function validateAuthBoundaryProofPurpose(proof: AuthBoundaryProof): AuthBoundaryProofPurposeValidation;
-export type RegistrationWalletCandidate = {
-    kind: 'registration_wallet_candidate';
-    walletId: WalletId;
-    registrationAttemptId: string;
-};
 export declare function buildPasskeyWalletAuthAuthority(args: {
     walletId: unknown;
     rpId: unknown;
     credentialIdB64u: unknown;
 }): PasskeyWalletAuthAuthority;
-export declare function buildPasskeyFactorIdentity(args: {
-    credentialIdB64u: unknown;
-}): PasskeyFactorIdentity;
-export declare function buildEmailOtpFactorIdentity(args: {
-    provider: unknown;
-    providerUserId: unknown;
-}): EmailOtpFactorIdentity;
 export declare function buildEmailOtpWalletAuthAuthority(args: {
     walletId: unknown;
     provider: unknown;
@@ -128,16 +78,9 @@ export declare function buildEmailOtpWalletAuthAuthority(args: {
 export declare function emailOtpWalletAuthAuthorityProvider(authority: EmailOtpWalletAuthAuthority): EmailOtpProvider;
 export declare function emailOtpWalletAuthAuthorityProviderUserId(authority: EmailOtpWalletAuthAuthority): EmailOtpProviderUserId;
 export declare function emailOtpWalletAuthAuthorityEmailHashHex(authority: EmailOtpWalletAuthAuthority): string;
-export declare function parseAuthFactorIdentity(raw: unknown): AuthFactorIdentity | null;
-export declare function parsePasskeyFactorIdentity(raw: unknown): PasskeyFactorIdentity | null;
-export declare function parseEmailOtpFactorIdentity(raw: unknown): EmailOtpFactorIdentity | null;
 export declare function parseWalletAuthAuthority(raw: unknown): WalletAuthAuthority | null;
 export declare function parseEmailOtpWalletAuthAuthority(raw: unknown): EmailOtpWalletAuthAuthority | null;
 export declare function parsePasskeyWalletAuthAuthority(raw: unknown): PasskeyWalletAuthAuthority | null;
-export declare function emailOtpFactorProfile(args: {
-    factor: EmailOtpFactorIdentity;
-    email: unknown;
-}): EmailOtpFactorProfile;
 export declare function canonicalWalletAuthorityBindingDigestInput(args: {
     authority: WalletAuthAuthority;
 }): string;

package/dist/types/shared-ts/src/utils/walletAuthMethodRecord.d.ts

@@ -0,0 +1,101 @@
+import { type DigestB64u } from './canonicalPrimitives';
+import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from './domainIds';
+import type { Variant, ReadonlyExclusiveUnion } from './variant';
+export type WalletAuthMethodRevocationProof = {
+    readonly kind: 'webauthn_assertion';
+    rpId: WebAuthnRpId;
+    credential: unknown;
+    expectedChallengeDigestB64u: string;
+} | {
+    readonly kind: 'email_otp';
+    readonly challengeId: string;
+    readonly otpCode: string;
+    readonly ownerProofBindingDigest: string;
+};
+export declare function computeWalletAuthMethodRevokeOperationFingerprintV1(input: {
+    readonly walletId: WalletId;
+    readonly targetWalletAuthMethodId: WalletAuthMethodId;
+    readonly requestedAtMs: number;
+}): Promise<DigestB64u>;
+export type WalletAuthMethodRecord = {
+    version: 'wallet_auth_method_v1';
+    kind: 'passkey';
+    status: 'active' | 'revoked';
+    walletId: WalletId;
+    rpId: WebAuthnRpId;
+    credentialIdB64u: string;
+    credentialPublicKeyB64u: string;
+    counter: number;
+    createdAtMs: number;
+    updatedAtMs: number;
+    emailHashHex?: never;
+    challengeId?: never;
+} | {
+    version: 'wallet_auth_method_v1';
+    kind: 'email_otp';
+    status: 'active' | 'revoked';
+    walletId: WalletId;
+    emailHashHex: string;
+    registrationAuthorityId: string;
+    createdAtMs: number;
+    updatedAtMs: number;
+    rpId?: never;
+    credentialIdB64u?: never;
+    credentialPublicKeyB64u?: never;
+    counter?: never;
+};
+type WalletAuthMethodLifecycleV1 = ReadonlyExclusiveUnion<{
+    readonly status: 'pending_local_install';
+} | {
+    readonly status: 'active';
+    readonly activatedAtMs: number;
+} | {
+    readonly status: 'revoked';
+    readonly activatedAtMs: number;
+    readonly revokedAtMs: number;
+}>;
+type WalletAuthMethodDraftCommonV1 = {
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly walletId: WalletId;
+    readonly createdAtMs: number;
+};
+export type PasskeyWalletAuthMethodDraftV1 = WalletAuthMethodDraftCommonV1 & {
+    readonly kind: 'passkey';
+    readonly rpId: WebAuthnRpId;
+    readonly credentialIdB64u: WebAuthnCredentialIdB64u;
+    readonly credentialPublicKeyB64u: string;
+    readonly counter: number;
+    readonly emailHashHex?: never;
+    readonly registrationAuthorityId?: never;
+};
+export type EmailOtpWalletAuthMethodDraftV1 = WalletAuthMethodDraftCommonV1 & {
+    readonly kind: 'email_otp';
+    readonly emailHashHex: string;
+    readonly registrationAuthorityId: string;
+    readonly rpId?: never;
+    readonly credentialIdB64u?: never;
+    readonly credentialPublicKeyB64u?: never;
+    readonly counter?: never;
+};
+type WalletAuthMethodCommonV1 = {
+    readonly version: 'wallet_auth_method_v2';
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly walletId: WalletId;
+    readonly walletAuthorityId: WalletAuthorityId;
+    readonly createdAtMs: number;
+    readonly updatedAtMs: number;
+};
+export type WalletAuthMethodRecordV2 = WalletAuthMethodCommonV1 & ((PasskeyWalletAuthMethodDraftV1 & WalletAuthMethodLifecycleV1) | (EmailOtpWalletAuthMethodDraftV1 & WalletAuthMethodLifecycleV1));
+export type PasskeyWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'kind', 'passkey'>;
+export type EmailOtpWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'kind', 'email_otp'>;
+export type PendingWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'status', 'pending_local_install'>;
+export type ActiveWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'status', 'active'>;
+export type RevokedWalletAuthMethodRecordV2 = Variant<WalletAuthMethodRecordV2, 'status', 'revoked'>;
+export type ActivePasskeyWalletAuthMethodRecordV2 = Variant<ActiveWalletAuthMethodRecordV2, 'kind', 'passkey'>;
+export type ActiveEmailOtpWalletAuthMethodRecordV2 = Variant<ActiveWalletAuthMethodRecordV2, 'kind', 'email_otp'>;
+export declare function sameWalletAuthMethodRecordV2(left: WalletAuthMethodRecordV2, right: WalletAuthMethodRecordV2): boolean;
+export declare function buildWalletAuthMethodRecordV2(input: WalletAuthMethodRecordV2): WalletAuthMethodRecordV2;
+export declare function parseWalletAuthMethodRecordV2(raw: unknown): WalletAuthMethodRecordV2 | null;
+export declare function walletAuthMethodRecordId(record: WalletAuthMethodRecord): WalletAuthMethodId;
+export {};
+//# sourceMappingURL=walletAuthMethodRecord.d.ts.map