@seams/wallet-server 0.7.1 → 0.7.3

package/dist/types/shared-ts/src/passkey-custody/custodyEnvelope.d.ts

@@ -2,6 +2,7 @@ import type { PasskeyEnvelopeId, WalletAuthMethodId, WalletId, WebAuthnCredentia
 import type { DigestB64u } from '../utils/canonicalPrimitives';
 import type { PasskeyCustodySecretBinding } from './custodySecretBinding';
 import type { EnvelopeCiphertextB64u, EnvelopeNonceB64u, EnvelopeRevision } from './primitives';
+import type { ExclusiveUnion } from '../utils/variant';
 export declare const WALLET_CUSTODY_ENVELOPE_VERSION_V2: "wallet_custody_envelope_v2";
 declare const PASSKEY_PRF_KEK_VERSION_V1: "passkey_prf_kek_hkdf_sha256_v1";
 declare const EMAIL_OTP_FACTOR_KEK_VERSION_V1: "email_otp_factor_kek_hkdf_sha256_v1";
@@ -34,37 +35,29 @@ export type WalletCustodyEnvelopeOwnership = {
     readonly kind: 'method_bound';
     readonly walletAuthMethodId: WalletAuthMethodId;
 };
-export type WalletCustodyEnvelopeFactor = {
+export type WalletCustodyEnvelopeFactor = ExclusiveUnion<{
     kind: 'passkey';
     rpId: WebAuthnRpId;
     credentialIdB64u: WebAuthnCredentialIdB64u;
     kekVersion: PasskeyPrfKekVersion;
-    enrollmentId?: never;
-    enrollmentSealKeyVersion?: never;
 } | {
     kind: 'email_otp';
     enrollmentId: string;
     enrollmentSealKeyVersion: string;
     kekVersion: EmailOtpFactorKekVersion;
-    rpId?: never;
-    credentialIdB64u?: never;
-};
-export type PasskeyCustodyEnvelopeLifecycle = {
+}>;
+export type PasskeyCustodyEnvelopeLifecycle = ExclusiveUnion<{
     state: 'active';
     activatedAtMs: number;
-    retiredAtMs?: never;
-    revokedAtMs?: never;
 } | {
     state: 'retired';
     activatedAtMs: number;
     retiredAtMs: number;
-    revokedAtMs?: never;
 } | {
     state: 'revoked';
     activatedAtMs: number;
     revokedAtMs: number;
-    retiredAtMs?: never;
-};
+}>;
 /**
  * Ciphertext plus public binding data for one factor-sealed custody secret.
  *

package/dist/types/shared-ts/src/passkey-custody/primitives.d.ts

@@ -8,6 +8,15 @@ export type Ed25519PublicKeyB64u = string & PasskeyCustodyBrand<'Ed25519PublicKe
 export type Secp256k1CompressedPublicKeyB64u = string & PasskeyCustodyBrand<'Secp256k1CompressedPublicKeyB64u'>;
 export type KeyCreationSignerSlot = number & PasskeyCustodyBrand<'KeyCreationSignerSlot'>;
 export type EnvelopeRevision = number & PasskeyCustodyBrand<'EnvelopeRevision'>;
+export declare function requireParsed<T>(result: {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly error: {
+        readonly message: string;
+    };
+}, label: string): T;
 export declare function parseDigestField(value: unknown, label: string): DigestB64u;
 export declare function parseEnvelopeNonceB64u(value: unknown, label?: string): EnvelopeNonceB64u;
 export declare function parseEnvelopeCiphertextB64u(value: unknown, label?: string): EnvelopeCiphertextB64u;

package/dist/types/shared-ts/src/signing-lanes/execution.d.ts

@@ -1,8 +1,18 @@
 import type { AuthorizedOperationId, CapabilityId } from '../authorization/capabilityKinds';
 import type { CapabilityOperationFingerprintDigest } from '../authorization/operationFingerprint';
+import type { DigestB64u } from '../utils/canonicalPrimitives';
 import type { MpcMaterialActivationRef } from '../utils/domainIds';
 import type { LinkedDeviceEnrollmentId } from './ids';
-import type { ActiveSigningLaneReference } from './records';
+import type { ActiveSigningLaneReference, SigningLaneRecord, WalletKeyRecord } from './records';
+export type OwnerWalletExecutionLaneProjectionV1 = {
+    readonly kind: 'active_owner_wallet_execution_lane_projection_v1';
+    readonly walletKey: WalletKeyRecord;
+    readonly lane: Extract<SigningLaneRecord, {
+        readonly laneKind: 'owner_passkey' | 'owner_email_otp';
+    }>;
+    readonly materialActivation: MpcMaterialActivationRef;
+    readonly verifiedActivationReceiptDigestB64u: DigestB64u;
+};
 export type ClaimedWalletExecutionAuthorization = {
     readonly kind: 'claimed_wallet_execution_authorization_v1';
     readonly authorizedOperationId: AuthorizedOperationId;

package/dist/types/shared-ts/src/signing-lanes/ids.d.ts

@@ -4,15 +4,6 @@ export type EcdsaManifestIdentity = {
     manifestId: EcdsaCapabilityManifestId;
     manifestRevision: EcdsaCapabilityManifestRevision;
 };
-export type ThresholdEcdsaChainTarget = {
-    kind: 'evm';
-    namespace: 'eip155';
-    chainId: number;
-    networkSlug: string;
-} | {
-    kind: 'tempo';
-    chainId: number;
-    networkSlug: string;
-};
+export type { ThresholdEcdsaChainTarget } from '../utils/thresholdEcdsaChainTarget';
 export { parseLaneShareEpoch, parseLaneEnrollmentId, parseLaneOperationId, parseLaneOperationIdempotencyKey, parseLinkedDeviceId, parseLinkedDeviceEnrollmentId, parseLinkDeviceSessionId, parseSigningLaneId, parseWalletKeyId, parseEd25519YaoSuiteId, parseEcdsaRelayerKeyId, } from '../utils/domainIds';
 //# sourceMappingURL=ids.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/rotation.d.ts

@@ -10,6 +10,7 @@ import type { LaneHolderParticipantId, HpkePublicKeyB64u, HpkePublicKeyDigestB64
 import type { EvmFamilySigningKeySlotId } from './evmFamilySigningKeySlotId';
 import type { SigningLaneKind } from './records';
 import type { OwnerLaneParticipantContinuityV1 } from './ownerContinuity';
+import type { ExclusiveUnion } from '../utils/variant';
 export type LinkedDeviceLaneAuthorizationBindingV1 = {
     kind: 'linked_device_enrollment';
     authorizedOperationId: AuthorizedOperationId;
@@ -761,17 +762,14 @@ type LaneHolderRecipientDescriptorV1 = {
     hpkePublicKeyB64u: HpkePublicKeyB64u;
     hpkePublicKeyDigestB64u: HpkePublicKeyDigestB64u;
 };
-export type LaneHolderPackageWireV1 = {
+export type LaneHolderPackageWireV1 = ExclusiveUnion<{
     kind: 'ed25519_yao_lane_holder_package_set_v1';
     deriverAEncryptedPackageJson: string;
     deriverBEncryptedPackageJson: string;
-    ecdsaEncryptedMaterialEnvelopeJson?: never;
 } | {
     kind: 'ecdsa_additive_lane_holder_package_v1';
     ecdsaEncryptedMaterialEnvelopeJson: string;
-    deriverAEncryptedPackageJson?: never;
-    deriverBEncryptedPackageJson?: never;
-};
+}>;
 export type EcdsaAdditiveLaneHolderPreparationV1 = {
     kind: 'ecdsa_additive_lane_holder_preparation_v1';
     holderRound: EcdsaAdditiveLaneHolderRoundV1;

package/dist/types/shared-ts/src/tenant-root/tenantRootIdentifier.d.ts

@@ -0,0 +1,3 @@
+export declare const TENANT_ROOT_IDENTITY_MAX_IDENTIFIER_BYTES_V1 = 256;
+export declare function hasControlCharacters(value: string): boolean;
+//# sourceMappingURL=tenantRootIdentifier.d.ts.map

package/dist/types/shared-ts/src/tenant-root/tenantRootOperationRecord.d.ts

@@ -5,7 +5,7 @@ export declare const TENANT_ROOT_OPERATION_MAX_LIFETIME_MS_V1 = 600000;
 /** Maximum authorization lifetime for a ciphertext download. */
 export declare const TENANT_ROOT_DOWNLOAD_MAX_LIFETIME_MS_V1 = 300000;
 /** One console operation on a tenant derivation root. */
-export type TenantRootOperationKindV1 = 'tenant_root_operational_share_rotation_v1' | 'tenant_root_recovery_governance_change_v1' | 'tenant_root_recovery_recipient_pair_enroll_v1' | 'tenant_root_recovery_recipient_pair_replace_v1' | 'tenant_root_recovery_backup_create_v1' | 'tenant_root_recovery_backup_replace_v1' | 'tenant_root_recovery_role_package_download_v1' | 'tenant_root_recovery_manifest_download_v1' | 'tenant_root_restore_session_start_v1' | 'tenant_root_restore_manifest_register_v1' | 'tenant_root_restore_role_import_key_issue_v1' | 'tenant_root_restore_role_import_v1' | 'tenant_root_restore_activate_v1' | 'tenant_root_source_lineage_retire_v1';
+export type TenantRootOperationKindV1 = (typeof TENANT_ROOT_OPERATION_KINDS_V1)[number];
 /** What one operation acts on. */
 export type TenantRootOperationSubjectV1 = {
     readonly kind: 'tenant_root';
@@ -157,6 +157,7 @@ export type TenantRootRestoreRoleImportKeyIssueOperationInputV1 = {
 };
 /** Inputs the console resolves before building a record. */
 export type TenantRootOperationRecordInputV1 = TenantRootOperationRecordInputWithActiveRootV1 | TenantRootRestoreRoleImportKeyIssueOperationInputV1;
+declare const TENANT_ROOT_OPERATION_KINDS_V1: readonly ["tenant_root_operational_share_rotation_v1", "tenant_root_recovery_governance_change_v1", "tenant_root_recovery_recipient_pair_enroll_v1", "tenant_root_recovery_recipient_pair_replace_v1", "tenant_root_recovery_backup_create_v1", "tenant_root_recovery_backup_replace_v1", "tenant_root_recovery_role_package_download_v1", "tenant_root_recovery_manifest_download_v1", "tenant_root_restore_session_start_v1", "tenant_root_restore_manifest_register_v1", "tenant_root_restore_role_import_key_issue_v1", "tenant_root_restore_role_import_v1", "tenant_root_restore_activate_v1", "tenant_root_source_lineage_retire_v1"];
 /** Returns the four operations that follow the tenant's recovery governance. */
 export declare function tenantRootOperationFollowsGovernanceV1(kind: TenantRootOperationKindV1): boolean;
 /** Returns the maximum authorization lifetime for one operation. */

package/dist/types/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.d.ts

@@ -10,6 +10,12 @@ export declare function derivationClientSharePublicKey33B64uFromString(value: st
 export type EcdsaDerivationRelayerPublicKey33B64u = string & {
     readonly __brand: 'EcdsaDerivationRelayerPublicKey33B64u';
 };
+export type EcdsaDerivationRoleLocalPublicIdentity = {
+    derivationClientSharePublicKey33B64u: DerivationClientSharePublicKey33B64u;
+    relayerPublicKey33B64u: EcdsaDerivationRelayerPublicKey33B64u;
+    groupPublicKey33B64u: string;
+    ethereumAddress: string;
+};
 export type EcdsaThresholdKeyId = string & {
     readonly __brand: 'EcdsaThresholdKeyId';
 };

package/dist/types/shared-ts/src/threshold/signingRootScope.d.ts

@@ -16,6 +16,7 @@ export declare function normalizeRuntimePolicyScope(input: unknown): RuntimePoli
 export declare function normalizeRuntimePolicyScopeFields(input: unknown): Omit<RuntimePolicyScope, 'signingRootVersion'> & {
     readonly signingRootVersion?: string;
 };
+export declare function sameRuntimePolicyScope(left: RuntimePolicyScope, right: RuntimePolicyScope): boolean;
 export declare function signingRootScopeFromRuntimePolicyScope(scope: RuntimePolicyScope): SigningRootScope;
 export {};
 //# sourceMappingURL=signingRootScope.d.ts.map

package/dist/types/shared-ts/src/utils/ecdsaKeyFactsInventory.d.ts

@@ -1,19 +1,10 @@
-type EcdsaInventoryChainTarget = {
-    kind: 'evm';
-    namespace: 'eip155';
-    chainId: number;
-    networkSlug?: string;
-} | {
-    kind: 'tempo';
-    chainId: number;
-    networkSlug?: string;
-};
+import { type ThresholdEcdsaChainTargetWire } from './thresholdEcdsaChainTarget';
 type WalletEcdsaKeyFactsInventoryChallengeInput = {
     walletId: string;
     rpId: string;
     keyTargets: readonly {
         keyHandle: string;
-        chainTarget: EcdsaInventoryChainTarget;
+        chainTarget: ThresholdEcdsaChainTargetWire;
     }[];
     runtimePolicyScope?: unknown;
     serverNonceB64u: string;

package/dist/types/shared-ts/src/utils/eip1559TxWasmJson.d.ts

@@ -0,0 +1,16 @@
+/** The EIP-1559 transaction as the EVM crypto WASM reads it: amounts in decimal strings. */
+export type Eip1559TxWasmJson = {
+    chainId: number;
+    nonce: string;
+    maxPriorityFeePerGas: string;
+    maxFeePerGas: string;
+    gasLimit: string;
+    to?: string | null;
+    value: string;
+    data?: string;
+    accessList?: {
+        address: string;
+        storageKeys: string[];
+    }[];
+};
+//# sourceMappingURL=eip1559TxWasmJson.d.ts.map

package/dist/types/shared-ts/src/utils/emailOtpDomain.d.ts

@@ -1,6 +1,8 @@
 export declare const EMAIL_OTP_CHANNEL: "email_otp";
 export declare const EMAIL_OTP_INITIAL_ENROLLMENT_VERSION: "1";
 export declare function emailOtpDeviceEnrollmentId(walletId: string, providerSubject: string): string;
+/** Domain label that opens the AAD binding a released Email OTP factor to its challenge. */
+export declare const EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 = "seams/email-otp/factor-release/v1";
 declare const WALLET_UNLOCK_BACKENDS: readonly ["passkey", "email_otp"];
 export type WalletUnlockBackend = (typeof WALLET_UNLOCK_BACKENDS)[number];
 export type WalletEmailOtpChannel = typeof EMAIL_OTP_CHANNEL;

package/dist/types/shared-ts/src/utils/exactKeys.d.ts

@@ -0,0 +1,11 @@
+/**
+ * True when `value` is a non-array object whose own enumerable string keys are exactly `keys`.
+ *
+ * A key whose value is `undefined` still counts as present. Symbol, non-enumerable and inherited
+ * keys are not counted, and the prototype is not checked. A list that repeats a key never matches.
+ * Kept apart from validation.ts, which the wallet iframe's boot path loads.
+ */
+export declare function hasExactKeys<const K extends readonly string[]>(value: unknown, keys: K): value is {
+    readonly [P in K[number]]: unknown;
+};
+//# sourceMappingURL=exactKeys.d.ts.map

package/dist/types/shared-ts/src/utils/failure.d.ts

@@ -0,0 +1,12 @@
+export declare function failure<const C extends string>(code: C, message: string): {
+    ok: false;
+    code: C;
+    message: string;
+};
+export declare function failedVerification<const C extends string>(code: C, message: string): {
+    ok: false;
+    verified: false;
+    code: C;
+    message: string;
+};
+//# sourceMappingURL=failure.d.ts.map

package/dist/types/shared-ts/src/utils/jsonRpc.d.ts

@@ -1,3 +1,4 @@
+import type { ExclusiveUnion } from './variant';
 type JsonRpcId = string | number | null;
 export type JsonRpcErrorDetails = {
     code?: number | string;
@@ -6,17 +7,15 @@ export type JsonRpcErrorDetails = {
     data?: unknown;
     cause?: unknown;
 };
-export type JsonRpcEnvelope = {
+export type JsonRpcEnvelope = ExclusiveUnion<{
     kind: 'success';
     id: JsonRpcId;
     result: unknown;
-    error?: never;
 } | {
     kind: 'failure';
     id: JsonRpcId;
     error: JsonRpcErrorDetails;
-    result?: never;
-};
+}>;
 type JsonRpcEnvelopeDecodeResult = {
     ok: true;
     value: JsonRpcEnvelope;

package/dist/types/shared-ts/src/utils/nearRpcResults.d.ts

@@ -1,5 +1,6 @@
 import { ExecutionStatusBasic, FinalExecutionStatusBasic, type ExecutionError, type TxExecutionStatus } from '@near-js/types';
 export type NearRpcResultDecoder<T> = (value: unknown) => T;
+export type NearRpcErrorType = 'InvalidTxError' | 'ActionError' | 'TxExecutionError' | 'RpcError' | 'Failure' | 'Unknown';
 type DecodedNearFunctionCallPermission = {
     FunctionCall: {
         allowance: string;

package/dist/types/shared-ts/src/utils/registrationAuthMethodInput.d.ts

@@ -1,5 +1,6 @@
 import { type ChallengeSubjectId, type EmailOtpChallengeId, type OrgId, type ProviderSubject, type WalletId, type WebAuthnRpId } from './domainIds';
 import type { WebAuthnAuthenticatorDeviceInfo } from './webauthnDeviceInfo';
+import type { ExclusiveUnion } from './variant';
 export type RegisterWalletInput = {
     kind: 'server_allocated';
     walletId?: never;
@@ -135,7 +136,7 @@ export type RegistrationAuthority = {
     device?: never;
     rpId?: never;
 };
-export type EmailOtpRegistrationProof = {
+export type EmailOtpRegistrationProof = ExclusiveUnion<{
     version: 'email_otp_registration_proof_v1';
     proofKind: 'otp_challenge';
     providerSubject: string;
@@ -146,9 +147,6 @@ export type EmailOtpRegistrationProof = {
     otpChannel: 'email_otp';
     /** Registration intent digest that binds the OTP proof to the wallet-registration request. */
     registrationIntentDigestB64u: string;
-    googleEmailOtpRegistrationAttemptId?: never;
-    googleEmailOtpRegistrationOfferId?: never;
-    googleEmailOtpRegistrationCandidateId?: never;
 } | {
     version: 'email_otp_registration_proof_v1';
     proofKind: 'google_sso_registration';
@@ -158,10 +156,7 @@ export type EmailOtpRegistrationProof = {
     googleEmailOtpRegistrationOfferId: string;
     googleEmailOtpRegistrationCandidateId: string;
     registrationIntentDigestB64u: string;
-    challengeId?: never;
-    otpCode?: never;
-    otpChannel?: never;
-};
+}>;
 export declare function inspectRawObject(value: unknown): object | null;
 export declare function trimString(value: unknown): string;
 export declare function normalizeRegistrationAuthMethodInput(raw: unknown): RegistrationAuthMethodInput | null;

package/dist/types/shared-ts/src/utils/registrationSignerPlan.d.ts

@@ -1,16 +1,15 @@
 import { type ImplicitNearAccountId, type NamedNearAccountId } from './near';
 import type { NearEd25519SigningKeyId } from './registrationIds';
-export type RegistrationNearAccountProvisioning = {
+import type { ThresholdEcdsaChainTargetWire } from './thresholdEcdsaChainTarget';
+import type { ExclusiveUnion } from './variant';
+export type RegistrationNearAccountProvisioning = ExclusiveUnion<{
     kind: 'implicit_account';
     accountIdSource: 'ed25519_public_key';
-    requestedAccountId?: never;
-    sponsor?: never;
 } | {
     kind: 'sponsored_named_account';
     requestedAccountId: NamedNearAccountId;
     sponsor: 'relayer';
-    accountIdSource?: never;
-};
+}>;
 export type ResolvedRegistrationNearAccount = {
     kind: 'implicit_account';
     nearAccountId: ImplicitNearAccountId;
@@ -38,16 +37,7 @@ export type ThresholdEd25519AddSignerSpec = {
     keyVersion: string;
     derivationVersion: number;
 };
-export type ThresholdEcdsaAddSignerChainTarget = {
-    readonly kind: 'evm';
-    readonly namespace: 'eip155';
-    readonly chainId: number;
-    readonly networkSlug?: string;
-} | {
-    readonly kind: 'tempo';
-    readonly chainId: number;
-    readonly networkSlug?: string;
-};
+export type ThresholdEcdsaAddSignerChainTarget = Readonly<ThresholdEcdsaChainTargetWire>;
 export type ThresholdEcdsaAddSignerSpec = {
     chainTargets: readonly ThresholdEcdsaAddSignerChainTarget[];
     participantIds: number[];
@@ -102,15 +92,13 @@ export type RegistrationSignerPlan = {
     kind: 'signer_set';
     branches: readonly RegistrationSignerPlanBranch[];
 };
-export type AddSignerSelection = {
+export type AddSignerSelection = ExclusiveUnion<{
     mode: 'ed25519';
     ed25519: ThresholdEd25519AddSignerSpec;
-    ecdsa?: never;
 } | {
     mode: 'ecdsa';
     ecdsa: ThresholdEcdsaAddSignerSpec;
-    ed25519?: never;
-};
+}>;
 export declare function implicitNearAccountProvisioning(): RegistrationNearAccountProvisioning;
 export declare function sponsoredNamedNearAccountProvisioning(requestedAccountId: NamedNearAccountId): RegistrationNearAccountProvisioning;
 type NormalizeSignerSelectionResult<TSelection> = {

package/dist/types/shared-ts/src/utils/routerAbEcdsaDerivation.d.ts

@@ -33,7 +33,7 @@ export type RouterAbEcdsaDerivationPublicIdentityV1 = {
     client_share_retry_counter: number;
     server_share_retry_counter: number;
 };
-export type RouterAbServerIdentityV1 = {
+type RouterAbServerIdentityV1 = {
     server_id: string;
     key_epoch: string;
     recipient_encryption_key: string;
@@ -583,6 +583,7 @@ export declare function parseRouterAbEcdsaRegistrationActivationReceiptV1(value:
 export declare function parseRouterAbEcdsaRegistrationPublicActivationReceiptV1(value: unknown): RouterAbEcdsaRegistrationPublicActivationReceiptV1;
 export declare function sameRouterAbServerIdentityV1(left: RouterAbServerIdentityV1, right: RouterAbServerIdentityV1): boolean;
 export declare function sameRouterAbEcdsaVerifiedClientActivationFactsV1(left: RouterAbEcdsaVerifiedClientActivationFactsV1, right: RouterAbEcdsaVerifiedClientActivationFactsV1): boolean;
+export declare function sameRegistrationSignerSet(left: RouterAbEcdsaDerivationSignerSetV1, right: RouterAbEcdsaDerivationSignerSetV1): boolean;
 export declare function sameRouterAbEcdsaRegistrationRequestFactsV1(left: RouterAbEcdsaRegistrationRequestFactsV1, right: RouterAbEcdsaRegistrationRequestFactsV1): boolean;
 export declare function assertRouterAbEcdsaRegistrationFactsMatchRequestV1(input: {
     facts: RouterAbEcdsaRegistrationRequestFactsV1;
@@ -605,6 +606,7 @@ export declare function parseRouterAbEcdsaDerivationExplicitExportProtocolReques
 export declare function parseRouterAbEcdsaDerivationActivationRefreshRequestV1(value: unknown): RouterAbEcdsaDerivationActivationRefreshRequestV1;
 export declare function parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1(value: unknown): RouterAbEcdsaDerivationActivationRefreshCommitRequestV1;
 export declare function sameRouterAbPublicDigest32V1Wire(left: RouterAbPublicDigest32V1Wire, right: RouterAbPublicDigest32V1Wire): boolean;
+export declare function sameRegistrationRecipientKeys(left: RouterAbEcdsaRegistrationRecipientKeysV1, right: RouterAbEcdsaRegistrationRecipientKeysV1): boolean;
 export declare function sameRouterAbEcdsaRegistrationActivationReceiptV1(left: RouterAbEcdsaRegistrationActivationReceiptV1, right: RouterAbEcdsaRegistrationActivationReceiptV1): boolean;
 export declare function sameRouterAbEcdsaDerivationNormalSigningStateV1(left: RouterAbEcdsaDerivationNormalSigningStateV1, right: RouterAbEcdsaDerivationNormalSigningStateV1): boolean;
 export declare function sameRouterAbEcdsaDerivationPublicCapabilityV1(left: RouterAbEcdsaDerivationPublicCapabilityV1, right: RouterAbEcdsaDerivationPublicCapabilityV1): boolean;

package/dist/types/shared-ts/src/utils/routerAbEd25519Yao.d.ts

@@ -104,6 +104,7 @@ export type RouterAbEd25519YaoActivationBindingV1<Operation extends RouterAbEd25
     operation: Operation;
 } : never;
 export declare function sameRouterAbEd25519YaoActivationBindingV1(left: RouterAbEd25519YaoActivationBindingV1, right: RouterAbEd25519YaoActivationBindingV1): boolean;
+export declare function sameRouterAbEd25519YaoByteSequence(left: readonly number[], right: readonly number[]): boolean;
 export declare function sameRouterAbEd25519YaoRegistrationAdmissionRequestV1(left: RouterAbEd25519YaoRegistrationAdmissionRequestV1, right: RouterAbEd25519YaoRegistrationAdmissionRequestV1): boolean;
 export declare function sameRouterAbEd25519YaoRecoveryAdmissionRequestV1(left: RouterAbEd25519YaoRecoveryAdmissionRequestV1, right: RouterAbEd25519YaoRecoveryAdmissionRequestV1): boolean;
 export declare function sameRouterAbEd25519YaoActivationKeysetV1(left: RouterAbEd25519YaoActivationKeysetV1, right: RouterAbEd25519YaoActivationKeysetV1): boolean;

package/dist/types/shared-ts/src/utils/routerAbEd25519YaoDigests.d.ts

@@ -1,14 +1,13 @@
 import type { RouterAbEd25519YaoBytes32V1 } from './generated/routerAbEd25519YaoCore';
 import type { RouterAbEd25519YaoApplicationBindingFactsV1, RouterAbEd25519YaoExportAuthorizationIdentityV1 } from './routerAbEd25519Yao';
-type RouterAbEd25519YaoExportAuthorityBindingV1 = {
+import type { ReadonlyExclusiveUnion } from './variant';
+type RouterAbEd25519YaoExportAuthorityBindingV1 = ReadonlyExclusiveUnion<{
     readonly kind: 'passkey';
     readonly credentialIdB64u: string;
-    readonly providerSubjectId?: never;
 } | {
     readonly kind: 'email_otp';
     readonly providerSubjectId: string;
-    readonly credentialIdB64u?: never;
-};
+}>;
 export declare function requireVisibleIdentifier(value: unknown, label: string): string;
 export declare function requireBytes(value: unknown, label: string, minimumLength: number, maximumLength: number): number[];
 export declare function requireBytes32(value: unknown, label: string, nonzero: boolean): number[];

package/dist/types/shared-ts/src/utils/routerAbNormalSigningIdentity.d.ts

@@ -1,4 +1,6 @@
 import { type MpcMaterialActivationRef } from './domainIds';
+import type { RouterAbEcdsaOperationStepUpPreparationV1Wire } from './routerAbEcdsaDerivation';
+import type { RouterAbMpcMaterialActivationRefV1 } from './generated/routerAbEd25519YaoCore';
 export type RouterAbNormalSigningAuthorizationWire = {
     readonly kind: 'reusable_wallet_session';
     readonly wallet_session_id: string;
@@ -7,15 +9,18 @@ export type RouterAbNormalSigningAuthorizationWire = {
     readonly evidence_set_digest?: never;
     readonly wallet_session_id?: never;
 };
-export type RouterAbMpcMaterialActivationRefWire = {
-    readonly kind: 'mpc_material_activation_ref';
-    readonly activation_id: string;
-    readonly capability: string;
-    readonly material_owner: string;
-    readonly key_binding: string;
-    readonly lifecycle_binding: string;
-    readonly signing_worker: string;
+export type RouterAbEcdsaDerivationPoolFillAuthorization = {
+    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
+        readonly kind: 'reusable_wallet_session';
+    }>;
+    readonly operation?: never;
+} | {
+    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
+        readonly kind: 'operation_step_up';
+    }>;
+    readonly operation: RouterAbEcdsaOperationStepUpPreparationV1Wire;
 };
+export type RouterAbMpcMaterialActivationRefWire = Readonly<RouterAbMpcMaterialActivationRefV1>;
 export type RouterAbEd25519OperationStepUpPreparationV1Wire = {
     readonly wallet_id: string;
     readonly operation_kind: 'near.sign_transaction' | 'near.sign_delegate_action' | 'near.sign_nep413_message';
@@ -29,6 +34,23 @@ export type RouterAbEd25519OperationStepUpPreparationV1Wire = {
     readonly participant_ids: readonly [number, number];
     readonly expires_at_ms: number;
 };
+export type RouterAbEd25519OperationStepUpMaterialRecoveryRequest = {
+    kind: 'not_requested';
+} | {
+    kind: 'email_otp_factor_release_v1';
+    workerEphemeralPublicKey65B64u: string;
+};
+export type RouterAbEd25519OperationStepUpMaterialRecoveryResponse = {
+    kind: 'not_requested';
+} | {
+    kind: 'email_otp_factor_release_v1';
+    challengeId: string;
+    enrollmentId: string;
+    enrollmentSealKeyVersion: string;
+    serverEphemeralPublicKey65B64u: string;
+    nonce12B64u: string;
+    ciphertextB64u: string;
+};
 export type RouterAbEd25519OwnerOperationAuthorizationDecisionV1Wire = {
     readonly kind: 'authorized';
     readonly operation: {

package/dist/types/shared-ts/src/utils/routerApiKeyAuth.d.ts

@@ -0,0 +1,2 @@
+export type RouterApiKeyAuthFailureCode = 'secret_key_missing' | 'secret_key_invalid' | 'secret_key_revoked' | 'secret_key_forbidden_scope' | 'secret_key_ip_blocked' | 'secret_key_environment_mismatch';
+//# sourceMappingURL=routerApiKeyAuth.d.ts.map

package/dist/types/shared-ts/src/utils/signingSessionSeal.d.ts

@@ -1,6 +1,7 @@
 import type { RouterAbEcdsaDerivationNormalSigningStateV1, RouterAbEcdsaDerivationPublicCapabilityV1 } from './routerAbEcdsaDerivation';
 import type { EmailOtpProvider, EmailOtpWalletAuthAuthority, WalletAuthAuthorityRef } from './walletAuthAuthority';
 import type { MpcMaterialActivationRef } from './domainIds';
+import type { ThresholdEcdsaChainTarget } from './thresholdEcdsaChainTarget';
 import { SIGNER_AUTH_METHODS, type SignerAuthMethod } from './signerDomain';
 export declare const SIGNING_SESSION_SEALED_RECORD_VERSION: 2;
 export declare const SIGNING_SESSION_SEAL_ALG: "shamir3pass-v2";
@@ -23,6 +24,14 @@ export type SigningSessionSealProtocol = {
     algorithm: typeof SIGNING_SESSION_SEAL_ALG;
     groupId: SigningSessionSealGroupId;
 };
+/** The signing-session seal capabilities a relayer publishes in its well-known document. */
+export type WellKnownSigningSessionSealCapabilities = {
+    mode: 'none';
+} | {
+    mode: 'sealed_refresh_v1';
+    protocol: SigningSessionSealProtocol;
+    currentKeyVersion: string;
+};
 export type SealedSigningSessionEcdsaRestoreSource = 'login' | 'registration' | 'manual-bootstrap' | 'email_otp';
 export type RouterAbEd25519NormalSigningState = {
     kind: typeof ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND;
@@ -30,18 +39,8 @@ export type RouterAbEd25519NormalSigningState = {
 };
 export declare function parseRouterAbEd25519NormalSigningState(value: unknown): RouterAbEd25519NormalSigningState | null;
 export declare function requireRouterAbEd25519NormalSigningState(value: unknown): RouterAbEd25519NormalSigningState;
-type SealedSigningSessionEcdsaChainTarget = {
-    kind: 'tempo';
-    chainId: number;
-    networkSlug: string;
-} | {
-    kind: 'evm';
-    namespace: 'eip155';
-    chainId: number;
-    networkSlug: string;
-};
 type SealedSigningSessionEcdsaRestoreMetadataBase = {
-    chainTarget: SealedSigningSessionEcdsaChainTarget;
+    chainTarget: ThresholdEcdsaChainTarget;
     signingRootId: string;
     signingRootVersion: string;
     keyHandle: string;

package/dist/types/shared-ts/src/utils/thresholdEcdsaChainTarget.d.ts

@@ -0,0 +1,25 @@
+export type EvmEip155ChainTarget = {
+    kind: 'evm';
+    namespace: 'eip155';
+    chainId: number;
+    networkSlug: string;
+};
+export type TempoChainTarget = {
+    kind: 'tempo';
+    chainId: number;
+    networkSlug: string;
+};
+export type ThresholdEcdsaChainTarget = EvmEip155ChainTarget | TempoChainTarget;
+/** A chain target as requests carry it: the network slug may still be unresolved. */
+export type ThresholdEcdsaChainTargetWire = {
+    kind: 'evm';
+    namespace: 'eip155';
+    chainId: number;
+    networkSlug?: string;
+} | {
+    kind: 'tempo';
+    chainId: number;
+    networkSlug?: string;
+};
+export declare function thresholdEcdsaChainTargetKey(target: ThresholdEcdsaChainTargetWire): string;
+//# sourceMappingURL=thresholdEcdsaChainTarget.d.ts.map

package/dist/types/shared-ts/src/utils/variant.d.ts

@@ -8,4 +8,22 @@
 export type Variant<U, K extends keyof U, V extends U[K]> = Extract<U, {
     readonly [P in K]: V;
 }>;
+type KeysOfUnion<U> = U extends unknown ? keyof U : never;
+type Flatten<T> = {
+    [K in keyof T]: T[K];
+};
+/**
+ * Union `U` with each member's missing keys added as `?: never`, where the missing keys are
+ * those that other members declare. The members stay mutually exclusive, and code can read any
+ * member's key without narrowing first (it reads as `undefined` on the members that lack it).
+ * `K` holds every member's keys, taken before `U` distributes.
+ */
+export type ExclusiveUnion<U, K extends PropertyKey = KeysOfUnion<U>> = U extends unknown ? Flatten<U & {
+    [P in Exclude<K, keyof U>]?: never;
+}> : never;
+/** `ExclusiveUnion` for readonly members: the added keys are `readonly` too. */
+export type ReadonlyExclusiveUnion<U, K extends PropertyKey = KeysOfUnion<U>> = U extends unknown ? Flatten<U & {
+    readonly [P in Exclude<K, keyof U>]?: never;
+}> : never;
+export {};
 //# sourceMappingURL=variant.d.ts.map

package/dist/types/shared-ts/src/utils/walletAuthMethodRecord.d.ts

@@ -1,6 +1,6 @@
 import { type DigestB64u } from './canonicalPrimitives';
 import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from './domainIds';
-import type { Variant } from './variant';
+import type { Variant, ReadonlyExclusiveUnion } from './variant';
 export type WalletAuthMethodRevocationProof = {
     readonly kind: 'webauthn_assertion';
     rpId: WebAuthnRpId;
@@ -44,19 +44,16 @@ export type WalletAuthMethodRecord = {
     credentialPublicKeyB64u?: never;
     counter?: never;
 };
-type WalletAuthMethodLifecycleV1 = {
+type WalletAuthMethodLifecycleV1 = ReadonlyExclusiveUnion<{
     readonly status: 'pending_local_install';
-    readonly activatedAtMs?: never;
-    readonly revokedAtMs?: never;
 } | {
     readonly status: 'active';
     readonly activatedAtMs: number;
-    readonly revokedAtMs?: never;
 } | {
     readonly status: 'revoked';
     readonly activatedAtMs: number;
     readonly revokedAtMs: number;
-};
+}>;
 type WalletAuthMethodDraftCommonV1 = {
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly walletId: WalletId;