@seams/wallet-server 0.7.1 → 0.8.0

package/dist/types/shared-ts/src/tenant-root/tenantRootIdentifier.d.ts

@@ -0,0 +1,3 @@
+export declare const TENANT_ROOT_IDENTITY_MAX_IDENTIFIER_BYTES_V1 = 256;
+export declare function hasControlCharacters(value: string): boolean;
+//# sourceMappingURL=tenantRootIdentifier.d.ts.map

package/dist/types/shared-ts/src/tenant-root/tenantRootOperationRecord.d.ts

@@ -5,7 +5,7 @@ export declare const TENANT_ROOT_OPERATION_MAX_LIFETIME_MS_V1 = 600000;
 /** Maximum authorization lifetime for a ciphertext download. */
 export declare const TENANT_ROOT_DOWNLOAD_MAX_LIFETIME_MS_V1 = 300000;
 /** One console operation on a tenant derivation root. */
-export type TenantRootOperationKindV1 = 'tenant_root_operational_share_rotation_v1' | 'tenant_root_recovery_governance_change_v1' | 'tenant_root_recovery_recipient_pair_enroll_v1' | 'tenant_root_recovery_recipient_pair_replace_v1' | 'tenant_root_recovery_backup_create_v1' | 'tenant_root_recovery_backup_replace_v1' | 'tenant_root_recovery_role_package_download_v1' | 'tenant_root_recovery_manifest_download_v1' | 'tenant_root_restore_session_start_v1' | 'tenant_root_restore_manifest_register_v1' | 'tenant_root_restore_role_import_key_issue_v1' | 'tenant_root_restore_role_import_v1' | 'tenant_root_restore_activate_v1' | 'tenant_root_source_lineage_retire_v1';
+export type TenantRootOperationKindV1 = (typeof TENANT_ROOT_OPERATION_KINDS_V1)[number];
 /** What one operation acts on. */
 export type TenantRootOperationSubjectV1 = {
     readonly kind: 'tenant_root';
@@ -157,6 +157,7 @@ export type TenantRootRestoreRoleImportKeyIssueOperationInputV1 = {
 };
 /** Inputs the console resolves before building a record. */
 export type TenantRootOperationRecordInputV1 = TenantRootOperationRecordInputWithActiveRootV1 | TenantRootRestoreRoleImportKeyIssueOperationInputV1;
+declare const TENANT_ROOT_OPERATION_KINDS_V1: readonly ["tenant_root_operational_share_rotation_v1", "tenant_root_recovery_governance_change_v1", "tenant_root_recovery_recipient_pair_enroll_v1", "tenant_root_recovery_recipient_pair_replace_v1", "tenant_root_recovery_backup_create_v1", "tenant_root_recovery_backup_replace_v1", "tenant_root_recovery_role_package_download_v1", "tenant_root_recovery_manifest_download_v1", "tenant_root_restore_session_start_v1", "tenant_root_restore_manifest_register_v1", "tenant_root_restore_role_import_key_issue_v1", "tenant_root_restore_role_import_v1", "tenant_root_restore_activate_v1", "tenant_root_source_lineage_retire_v1"];
 /** Returns the four operations that follow the tenant's recovery governance. */
 export declare function tenantRootOperationFollowsGovernanceV1(kind: TenantRootOperationKindV1): boolean;
 /** Returns the maximum authorization lifetime for one operation. */

package/dist/types/shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.d.ts

@@ -10,6 +10,12 @@ export declare function derivationClientSharePublicKey33B64uFromString(value: st
 export type EcdsaDerivationRelayerPublicKey33B64u = string & {
     readonly __brand: 'EcdsaDerivationRelayerPublicKey33B64u';
 };
+export type EcdsaDerivationRoleLocalPublicIdentity = {
+    derivationClientSharePublicKey33B64u: DerivationClientSharePublicKey33B64u;
+    relayerPublicKey33B64u: EcdsaDerivationRelayerPublicKey33B64u;
+    groupPublicKey33B64u: string;
+    ethereumAddress: string;
+};
 export type EcdsaThresholdKeyId = string & {
     readonly __brand: 'EcdsaThresholdKeyId';
 };

package/dist/types/shared-ts/src/threshold/keyMaterialBrands.d.ts

@@ -1,25 +1,15 @@
-import type { EcdsaThresholdKeyId } from './ecdsaDerivationRoleLocalBootstrap';
 export type Brand<T, Name extends string> = T & {
     readonly __brand: Name;
 };
-export type EcdsaDerivationKeyVersion = Brand<string, 'EcdsaDerivationKeyVersion'>;
 export type SigningSessionSealKeyVersion = Brand<string, 'SigningSessionSealKeyVersion'>;
 export type EcdsaClientVerifyingShareB64u = Brand<string, 'EcdsaClientVerifyingShareB64u'>;
-export type Ed25519RelayerKeyId = Brand<string, 'Ed25519RelayerKeyId'>;
 export type EcdsaRelayerKeyId = Brand<string, 'EcdsaRelayerKeyId'>;
 export type EcdsaKeyHandle = Brand<string, 'EcdsaKeyHandle'>;
 export declare function parseNonEmptyBrand<T extends string>(value: unknown, label: string): Brand<string, T>;
-export declare function parseEcdsaDerivationKeyVersion(value: unknown): EcdsaDerivationKeyVersion;
 export declare function parseSigningSessionSealKeyVersion(value: unknown): SigningSessionSealKeyVersion;
 export declare function parseEcdsaClientVerifyingShareB64u(value: unknown): EcdsaClientVerifyingShareB64u;
-export declare function parseEd25519RelayerKeyId(value: unknown): Ed25519RelayerKeyId;
 export declare function parseEcdsaRelayerKeyId(value: unknown): EcdsaRelayerKeyId;
 export declare function parseEcdsaKeyHandle(value: unknown): EcdsaKeyHandle;
-export declare function formatEcdsaDerivationKeyVersionForWire(value: EcdsaDerivationKeyVersion): string;
 export declare function formatSigningSessionSealKeyVersionForWire(value: SigningSessionSealKeyVersion): string;
-export declare function formatEcdsaClientVerifyingShareB64uForWire(value: EcdsaClientVerifyingShareB64u): string;
-export declare function formatEd25519RelayerKeyIdForWire(value: Ed25519RelayerKeyId): string;
-export declare function formatEcdsaRelayerKeyIdForWire(value: EcdsaRelayerKeyId): string;
-export declare function formatEcdsaThresholdKeyIdForWire(value: EcdsaThresholdKeyId): string;
 export declare function formatEcdsaKeyHandleForWire(value: EcdsaKeyHandle): string;
 //# sourceMappingURL=keyMaterialBrands.d.ts.map

package/dist/types/shared-ts/src/threshold/participants.d.ts

@@ -8,7 +8,7 @@ export declare const THRESHOLD_ED25519_2P_PARTICIPANT_IDS: readonly [1, 2];
  */
 type ThresholdEd25519ShareDerivation = 'prf_first_v1' | 'derived_master_secret_v1' | 'kv_random_v1' | 'unknown';
 export interface ThresholdEd25519ParticipantV1 {
-    /** FROST identifier (1-indexed). */
+    /** Participant identifier (1-indexed). */
     id: number;
     role: ThresholdParticipantRole;
     /** Optional relayer endpoint for this participant (future multi-relayer support). */

package/dist/types/shared-ts/src/threshold/signingRootScope.d.ts

@@ -16,6 +16,7 @@ export declare function normalizeRuntimePolicyScope(input: unknown): RuntimePoli
 export declare function normalizeRuntimePolicyScopeFields(input: unknown): Omit<RuntimePolicyScope, 'signingRootVersion'> & {
     readonly signingRootVersion?: string;
 };
+export declare function sameRuntimePolicyScope(left: RuntimePolicyScope, right: RuntimePolicyScope): boolean;
 export declare function signingRootScopeFromRuntimePolicyScope(scope: RuntimePolicyScope): SigningRootScope;
 export {};
 //# sourceMappingURL=signingRootScope.d.ts.map

package/dist/types/shared-ts/src/utils/addWalletAuthMethod.d.ts

@@ -11,17 +11,8 @@
  * an attempt to add a family the authority already has is resolved as
  * `already_configured` at admission — before any target verification or local
  * write — rather than travelling through the operation as a rejected case.
- *
- * Every identity a branch depends on is required and branded. The raw wire and
- * storage values are parsed once by {@link parseAddWalletAuthMethodSourceV1}
- * and {@link parseAddWalletAuthMethodIntentIdentityV1} at their boundary; core
- * code below them receives branded identities and one verified branch, and
- * never compares raw identity strings.
  */
-import type { DeviceId, WalletSessionId } from '../authorization/capabilityKinds';
-import type { DigestB64u } from './canonicalPrimitives';
-import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from './domainIds';
-import type { ActiveWalletAuthMethodRecordV2, EmailOtpWalletAuthMethodDraftV1, PasskeyWalletAuthMethodDraftV1 } from './walletAuthMethodRecord';
+import type { ActiveWalletAuthMethodRecordV2 } from './walletAuthMethodRecord';
 import type { WalletAuthMethod } from './signerDomain';
 /**
  * The factor family a method belongs to.
@@ -40,120 +31,6 @@ export type WalletAuthMethodFamilyV1 = WalletAuthMethod;
  * target.
  */
 export type AddWalletAuthMethodBranchV1 = 'passkey_to_email_otp' | 'email_otp_to_passkey';
-/**
- * A validated authority generation. Branding it stops a revocation epoch from
- * being read as any other integer on the authority — a signer slot, a counter,
- * a timestamp — at the boundaries where all of them arrive as bare numbers.
- */
-type WalletAuthorityRevocationEpochV1 = number & {
-    readonly __walletAuthorityRevocationEpochBrand: 'WalletAuthorityRevocationEpochV1';
-};
-/**
- * One server-allocated addition ceremony. The server mints it, binds the
- * target method ID to it, and a client request can neither nominate nor
- * substitute one.
- */
-type AddWalletAuthMethodCeremonyIdV1 = string & {
-    readonly __addWalletAuthMethodCeremonyIdBrand: 'AddWalletAuthMethodCeremonyIdV1';
-};
-/**
- * Everything the active Wallet Session names about the source.
- *
- * The caller supplies none of it: the selected session names the exact source
- * method, and the server resolves the wallet, authority, device, digest, and
- * epoch from that method. Each field is required, so a branch cannot be built
- * from a partially resolved session.
- */
-export type AddWalletAuthMethodSourceV1 = {
-    readonly walletId: WalletId;
-    readonly walletAuthorityId: WalletAuthorityId;
-    readonly sourceWalletAuthMethodId: WalletAuthMethodId;
-    readonly sourceWalletSessionId: WalletSessionId;
-    readonly deviceId: DeviceId;
-    readonly authorityDigestB64u: DigestB64u;
-    readonly revocationEpoch: WalletAuthorityRevocationEpochV1;
-};
-/**
- * The intent identity every stage revalidates against.
- *
- * `targetWalletAuthMethodId` is allocated by the server during preparation and
- * bound into the Passkey creation options or the Email OTP grant, so a retry
- * that reuses this intent converges on the same target method instead of
- * creating a second one.
- */
-export type AddWalletAuthMethodIntentIdentityV1 = {
-    readonly addAuthMethodCeremonyId: AddWalletAuthMethodCeremonyIdV1;
-    readonly intentDigestB64u: DigestB64u;
-    readonly targetWalletAuthMethodId: WalletAuthMethodId;
-    readonly expiresAtMs: number;
-};
-/**
- * Fresh source authorization for this exact intent.
- *
- * Both variants carry the digest they were collected against, which is what
- * binds the proof to one wallet, authority, source method, source session,
- * target method ID, and authority state rather than to the operation kind.
- */
-export type VerifiedAddWalletAuthMethodSourceProofV1 = {
-    readonly kind: 'verified_passkey_source_proof_v1';
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly boundIntentDigestB64u: DigestB64u;
-    readonly verifiedAtMs: number;
-} | {
-    readonly kind: 'verified_email_otp_source_proof_v1';
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly boundIntentDigestB64u: DigestB64u;
-    readonly verifiedAtMs: number;
-};
-/**
- * The independently verified target factor plus its exact draft.
- *
- * A source proof can never appear here: the target is verified on its own
- * evidence — a created credential, or a consumed one-use Email OTP grant — and
- * the two are separate fields on the branch so neither can stand in for the
- * other.
- */
-export type VerifiedAddWalletAuthMethodTargetV1 = {
-    readonly kind: 'verified_passkey_target_v1';
-    readonly authMethod: PasskeyWalletAuthMethodDraftV1;
-    readonly verificationDigestB64u: DigestB64u;
-    readonly verifiedAtMs: number;
-} | {
-    readonly kind: 'verified_email_otp_target_v1';
-    readonly authMethod: EmailOtpWalletAuthMethodDraftV1;
-    readonly verificationDigestB64u: DigestB64u;
-    readonly verifiedAtMs: number;
-};
-type VerifiedPasskeySourceProofV1 = Extract<VerifiedAddWalletAuthMethodSourceProofV1, {
-    readonly kind: 'verified_passkey_source_proof_v1';
-}>;
-type VerifiedEmailOtpSourceProofV1 = Extract<VerifiedAddWalletAuthMethodSourceProofV1, {
-    readonly kind: 'verified_email_otp_source_proof_v1';
-}>;
-type VerifiedPasskeyTargetV1 = Extract<VerifiedAddWalletAuthMethodTargetV1, {
-    readonly kind: 'verified_passkey_target_v1';
-}>;
-type VerifiedEmailOtpTargetV1 = Extract<VerifiedAddWalletAuthMethodTargetV1, {
-    readonly kind: 'verified_email_otp_target_v1';
-}>;
-type AddWalletAuthMethodInputCommonV1 = {
-    readonly source: AddWalletAuthMethodSourceV1;
-    readonly intent: AddWalletAuthMethodIntentIdentityV1;
-};
-/**
- * What core code accepts after verification, and the only shape the activation
- * stage reads. The proof/target pairing is fixed per branch, so a verified
- * Passkey source cannot arrive alongside a verified Passkey target.
- */
-export type VerifiedAddWalletAuthMethodInputV1 = (AddWalletAuthMethodInputCommonV1 & {
-    readonly branch: 'passkey_to_email_otp';
-    readonly sourceProof: VerifiedPasskeySourceProofV1;
-    readonly target: VerifiedEmailOtpTargetV1;
-}) | (AddWalletAuthMethodInputCommonV1 & {
-    readonly branch: 'email_otp_to_passkey';
-    readonly sourceProof: VerifiedEmailOtpSourceProofV1;
-    readonly target: VerifiedPasskeyTargetV1;
-});
 /**
  * Admission: what the operation does before it verifies anything.
  *
@@ -164,17 +41,10 @@ export type VerifiedAddWalletAuthMethodInputV1 = (AddWalletAuthMethodInputCommon
  */
 type AddWalletAuthMethodAdmissionV1 = {
     readonly kind: 'proceed';
-    readonly branch: AddWalletAuthMethodBranchV1;
 } | {
     readonly kind: 'already_configured';
     readonly family: WalletAuthMethodFamilyV1;
-    readonly existingWalletAuthMethodId: WalletAuthMethodId;
 };
-export declare function unreachableAddWalletAuthMethodBranch(value: never): never;
-/** The family a branch fills in. */
-export declare function addWalletAuthMethodTargetFamily(branch: AddWalletAuthMethodBranchV1): WalletAuthMethodFamilyV1;
-/** The family the branch authorizes from. */
-export declare function addWalletAuthMethodSourceFamily(branch: AddWalletAuthMethodBranchV1): WalletAuthMethodFamilyV1;
 /**
  * Resolves the branch from the exact active inventory of one authority.
  *
@@ -188,7 +58,5 @@ export declare function admitAddWalletAuthMethod(input: {
     readonly targetFamily: WalletAuthMethodFamilyV1;
     readonly activeMethodsOnAuthority: readonly ActiveWalletAuthMethodRecordV2[];
 }): AddWalletAuthMethodAdmissionV1;
-export declare function parseWalletAuthorityRevocationEpochV1(value: unknown): WalletAuthorityRevocationEpochV1;
-export declare function parseAddWalletAuthMethodCeremonyIdV1(value: unknown): AddWalletAuthMethodCeremonyIdV1;
 export {};
 //# sourceMappingURL=addWalletAuthMethod.d.ts.map

package/dist/types/shared-ts/src/utils/addWalletAuthMethod.typecheck.d.ts

@@ -2,23 +2,9 @@
  * Compile-time fixtures for the same-device auth-method addition contract.
  *
  * Every `@ts-expect-error` below is a state the contract forbids. If one ever
- * starts compiling, the branch union has been widened — a same-family
- * addition, a mixed target draft, an unverified value, or a cast has become
- * expressible — and this file fails the build rather than the behaviour
- * failing in a browser.
+ * starts compiling, the branch union has been widened — a same-family addition
+ * has become expressible — and this file fails the build rather than the
+ * behaviour failing in a browser.
  */
-import { type AddWalletAuthMethodIntentIdentityV1, type VerifiedAddWalletAuthMethodSourceProofV1, type VerifiedAddWalletAuthMethodTargetV1 } from './addWalletAuthMethod';
-export declare const intent: AddWalletAuthMethodIntentIdentityV1;
-export declare const passkeySourceProof: Extract<VerifiedAddWalletAuthMethodSourceProofV1, {
-    kind: 'verified_passkey_source_proof_v1';
-}>;
-export declare const emailOtpSourceProof: Extract<VerifiedAddWalletAuthMethodSourceProofV1, {
-    kind: 'verified_email_otp_source_proof_v1';
-}>;
-export declare const emailOtpTarget: Extract<VerifiedAddWalletAuthMethodTargetV1, {
-    kind: 'verified_email_otp_target_v1';
-}>;
-export declare const passkeyTarget: Extract<VerifiedAddWalletAuthMethodTargetV1, {
-    kind: 'verified_passkey_target_v1';
-}>;
+export {};
 //# sourceMappingURL=addWalletAuthMethod.typecheck.d.ts.map

package/dist/types/shared-ts/src/utils/domainIds.d.ts

@@ -22,7 +22,6 @@ export type VerifiedEmailAddress = DomainId<'VerifiedEmailAddress'>;
 export type EmailOtpProviderUserId = DomainId<'EmailOtpProviderUserId'>;
 export type ChallengeSubjectId = DomainId<'ChallengeSubjectId'>;
 export type EmailOtpChallengeId = DomainId<'EmailOtpChallengeId'>;
-export type EmailOtpRegistrationAttemptId = DomainId<'EmailOtpRegistrationAttemptId'>;
 export type OrgId = DomainId<'OrgId'>;
 export type WebAuthnRpId = DomainId<'WebAuthnRpId'>;
 export type WebAuthnCredentialIdB64u = DomainId<'WebAuthnCredentialIdB64u'>;
@@ -68,14 +67,9 @@ export type WalletKeyId = DomainId<'WalletKeyId'>;
 export type SigningLaneId = DomainId<'SigningLaneId'>;
 export type LaneShareEpoch = DomainId<'LaneShareEpoch'>;
 export type LinkedDeviceId = DomainId<'LinkedDeviceId'>;
-export type LaneOperationId = DomainId<'LaneOperationId'>;
-export type LaneEnrollmentId = DomainId<'LaneEnrollmentId'>;
-export type LaneOperationIdempotencyKey = DomainId<'LaneOperationIdempotencyKey'>;
 export type LinkedDeviceEnrollmentId = DomainId<'LinkedDeviceEnrollmentId'>;
 export type WalletRecoveryOperationId = DomainId<'WalletRecoveryOperationId'>;
-export type Ed25519YaoSuiteId = DomainId<'Ed25519YaoSuiteId'>;
 export type EcdsaRelayerKeyId = DomainId<'EcdsaRelayerKeyId'>;
-export type LaneHolderRecipientHandleV1 = DomainId<'LaneHolderRecipientHandleV1'>;
 export type LinkDeviceSessionId = DomainId<'LinkDeviceSessionId'>;
 export declare function hasControlCharacter(value: string): boolean;
 export declare function hasWhitespaceOrControlCharacters(value: string): boolean;
@@ -87,7 +81,6 @@ export declare function parseVerifiedEmailAddress(raw: unknown): DomainIdParseRe
 export declare function parseEmailOtpProviderUserId(raw: unknown): DomainIdParseResult<EmailOtpProviderUserId>;
 export declare function parseChallengeSubjectId(raw: unknown): DomainIdParseResult<ChallengeSubjectId>;
 export declare function parseEmailOtpChallengeId(raw: unknown): DomainIdParseResult<EmailOtpChallengeId>;
-export declare function parseEmailOtpRegistrationAttemptId(raw: unknown): DomainIdParseResult<EmailOtpRegistrationAttemptId>;
 export declare function parseOrgId(raw: unknown): DomainIdParseResult<OrgId>;
 export declare function parseWebAuthnRpId(raw: unknown): DomainIdParseResult<WebAuthnRpId>;
 export declare function parseWebAuthnCredentialIdB64u(raw: unknown): DomainIdParseResult<WebAuthnCredentialIdB64u>;
@@ -126,14 +119,9 @@ export declare function parseWalletKeyId(raw: unknown): DomainIdParseResult<Wall
 export declare function parseSigningLaneId(raw: unknown): DomainIdParseResult<SigningLaneId>;
 export declare function parseLaneShareEpoch(raw: unknown): DomainIdParseResult<LaneShareEpoch>;
 export declare function parseLinkedDeviceId(raw: unknown): DomainIdParseResult<LinkedDeviceId>;
-export declare function parseLaneOperationId(raw: unknown): DomainIdParseResult<LaneOperationId>;
-export declare function parseLaneEnrollmentId(raw: unknown): DomainIdParseResult<LaneEnrollmentId>;
-export declare function parseLaneOperationIdempotencyKey(raw: unknown): DomainIdParseResult<LaneOperationIdempotencyKey>;
 export declare function parseLinkedDeviceEnrollmentId(raw: unknown): DomainIdParseResult<LinkedDeviceEnrollmentId>;
 export declare function parseWalletRecoveryOperationId(raw: unknown): DomainIdParseResult<WalletRecoveryOperationId>;
-export declare function parseEd25519YaoSuiteId(raw: unknown): DomainIdParseResult<Ed25519YaoSuiteId>;
 export declare function parseEcdsaRelayerKeyId(raw: unknown): DomainIdParseResult<EcdsaRelayerKeyId>;
-export declare function parseLaneHolderRecipientHandleV1(raw: unknown): DomainIdParseResult<LaneHolderRecipientHandleV1>;
 export declare function parseLinkDeviceSessionId(raw: unknown): DomainIdParseResult<LinkDeviceSessionId>;
 export {};
 //# sourceMappingURL=domainIds.d.ts.map

package/dist/types/shared-ts/src/utils/ecdsaKeyFactsInventory.d.ts

@@ -1,19 +1,10 @@
-type EcdsaInventoryChainTarget = {
-    kind: 'evm';
-    namespace: 'eip155';
-    chainId: number;
-    networkSlug?: string;
-} | {
-    kind: 'tempo';
-    chainId: number;
-    networkSlug?: string;
-};
+import { type ThresholdEcdsaChainTargetWire } from './thresholdEcdsaChainTarget';
 type WalletEcdsaKeyFactsInventoryChallengeInput = {
     walletId: string;
     rpId: string;
     keyTargets: readonly {
         keyHandle: string;
-        chainTarget: EcdsaInventoryChainTarget;
+        chainTarget: ThresholdEcdsaChainTargetWire;
     }[];
     runtimePolicyScope?: unknown;
     serverNonceB64u: string;

package/dist/types/shared-ts/src/utils/eip1559TxWasmJson.d.ts

@@ -0,0 +1,16 @@
+/** The EIP-1559 transaction as the EVM crypto WASM reads it: amounts in decimal strings. */
+export type Eip1559TxWasmJson = {
+    chainId: number;
+    nonce: string;
+    maxPriorityFeePerGas: string;
+    maxFeePerGas: string;
+    gasLimit: string;
+    to?: string | null;
+    value: string;
+    data?: string;
+    accessList?: {
+        address: string;
+        storageKeys: string[];
+    }[];
+};
+//# sourceMappingURL=eip1559TxWasmJson.d.ts.map

package/dist/types/shared-ts/src/utils/emailOtpDomain.d.ts

@@ -1,6 +1,8 @@
 export declare const EMAIL_OTP_CHANNEL: "email_otp";
 export declare const EMAIL_OTP_INITIAL_ENROLLMENT_VERSION: "1";
 export declare function emailOtpDeviceEnrollmentId(walletId: string, providerSubject: string): string;
+/** Domain label that opens the AAD binding a released Email OTP factor to its challenge. */
+export declare const EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 = "seams/email-otp/factor-release/v1";
 declare const WALLET_UNLOCK_BACKENDS: readonly ["passkey", "email_otp"];
 export type WalletUnlockBackend = (typeof WALLET_UNLOCK_BACKENDS)[number];
 export type WalletEmailOtpChannel = typeof EMAIL_OTP_CHANNEL;

package/dist/types/shared-ts/src/utils/errors.d.ts

@@ -1,7 +1,3 @@
-/**
- * Centralized error handling utilities for the Passkey SDK
- */
-export { formatNearRpcError, getNearShortErrorMessage } from './near';
 /**
  * Best-effort error message extractor without relying on `any`.
  * Always returns a string (may be empty when nothing usable can be derived).

package/dist/types/shared-ts/src/utils/exactKeys.d.ts

@@ -0,0 +1,11 @@
+/**
+ * True when `value` is a non-array object whose own enumerable string keys are exactly `keys`.
+ *
+ * A key whose value is `undefined` still counts as present. Symbol, non-enumerable and inherited
+ * keys are not counted, and the prototype is not checked. A list that repeats a key never matches.
+ * Kept apart from validation.ts, which the wallet iframe's boot path loads.
+ */
+export declare function hasExactKeys<const K extends readonly string[]>(value: unknown, keys: K): value is {
+    readonly [P in K[number]]: unknown;
+};
+//# sourceMappingURL=exactKeys.d.ts.map

package/dist/types/shared-ts/src/utils/failure.d.ts

@@ -0,0 +1,12 @@
+export declare function failure<const C extends string>(code: C, message: string): {
+    ok: false;
+    code: C;
+    message: string;
+};
+export declare function failedVerification<const C extends string>(code: C, message: string): {
+    ok: false;
+    verified: false;
+    code: C;
+    message: string;
+};
+//# sourceMappingURL=failure.d.ts.map

package/dist/types/shared-ts/src/utils/jsonRpc.d.ts

@@ -1,3 +1,4 @@
+import type { ExclusiveUnion } from './variant';
 type JsonRpcId = string | number | null;
 export type JsonRpcErrorDetails = {
     code?: number | string;
@@ -6,17 +7,15 @@ export type JsonRpcErrorDetails = {
     data?: unknown;
     cause?: unknown;
 };
-export type JsonRpcEnvelope = {
+export type JsonRpcEnvelope = ExclusiveUnion<{
     kind: 'success';
     id: JsonRpcId;
     result: unknown;
-    error?: never;
 } | {
     kind: 'failure';
     id: JsonRpcId;
     error: JsonRpcErrorDetails;
-    result?: never;
-};
+}>;
 type JsonRpcEnvelopeDecodeResult = {
     ok: true;
     value: JsonRpcEnvelope;

package/dist/types/shared-ts/src/utils/near.d.ts

@@ -52,26 +52,6 @@ export declare function parseImplicitNearAccountId(raw: unknown): NearAccountIdP
 export declare function parseNamedNearAccountId(raw: unknown): NearAccountIdParseResult<NamedNearAccountId>;
 export declare function parseNearAccountId(raw: unknown): NearAccountIdParseResult<NearAccountId>;
 export declare function deriveImplicitNearAccountIdFromEd25519PublicKey(publicKey: string): ImplicitNearAccountId;
-/**
- * Format a NEAR JSON-RPC error into a concise, human-friendly message while
- * preserving the original error payload on `details`.
- *
- * The function is defensive and only relies on structural checks. It does not
- * require concrete NEAR types to avoid tight coupling with providers.
- */
-export declare function formatNearRpcError(operationName: string, rpc: {
-    error?: {
-        code?: number;
-        name?: string;
-        message?: string;
-        data?: unknown;
-    };
-}): {
-    message: string;
-    code?: number;
-    name?: string;
-    details?: unknown;
-};
 /**
  * Extract a short NEAR error label for UI display, e.g.:
  *   "InvalidTxError: UnsuitableStakingKey"

package/dist/types/shared-ts/src/utils/nearRpcResults.d.ts

@@ -1,5 +1,6 @@
 import { ExecutionStatusBasic, FinalExecutionStatusBasic, type ExecutionError, type TxExecutionStatus } from '@near-js/types';
 export type NearRpcResultDecoder<T> = (value: unknown) => T;
+export type NearRpcErrorType = 'InvalidTxError' | 'ActionError' | 'TxExecutionError' | 'RpcError' | 'Failure' | 'Unknown';
 type DecodedNearFunctionCallPermission = {
     FunctionCall: {
         allowance: string;

package/dist/types/shared-ts/src/utils/normalize.d.ts

@@ -48,6 +48,4 @@ export declare function toOriginOrUndefined(input?: string): string | undefined;
  * - Normalizes hostname casing.
  */
 export declare function toRorOriginOrNull(value: unknown): string | null;
-/** Collapse a string into a single line by normalizing whitespace. */
-export declare function toSingleLine(value: unknown): string;
 //# sourceMappingURL=normalize.d.ts.map

package/dist/types/shared-ts/src/utils/registrationAuthMethodInput.d.ts

@@ -1,5 +1,6 @@
 import { type ChallengeSubjectId, type EmailOtpChallengeId, type OrgId, type ProviderSubject, type WalletId, type WebAuthnRpId } from './domainIds';
 import type { WebAuthnAuthenticatorDeviceInfo } from './webauthnDeviceInfo';
+import type { ExclusiveUnion } from './variant';
 export type RegisterWalletInput = {
     kind: 'server_allocated';
     walletId?: never;
@@ -135,7 +136,7 @@ export type RegistrationAuthority = {
     device?: never;
     rpId?: never;
 };
-export type EmailOtpRegistrationProof = {
+export type EmailOtpRegistrationProof = ExclusiveUnion<{
     version: 'email_otp_registration_proof_v1';
     proofKind: 'otp_challenge';
     providerSubject: string;
@@ -146,9 +147,6 @@ export type EmailOtpRegistrationProof = {
     otpChannel: 'email_otp';
     /** Registration intent digest that binds the OTP proof to the wallet-registration request. */
     registrationIntentDigestB64u: string;
-    googleEmailOtpRegistrationAttemptId?: never;
-    googleEmailOtpRegistrationOfferId?: never;
-    googleEmailOtpRegistrationCandidateId?: never;
 } | {
     version: 'email_otp_registration_proof_v1';
     proofKind: 'google_sso_registration';
@@ -158,10 +156,7 @@ export type EmailOtpRegistrationProof = {
     googleEmailOtpRegistrationOfferId: string;
     googleEmailOtpRegistrationCandidateId: string;
     registrationIntentDigestB64u: string;
-    challengeId?: never;
-    otpCode?: never;
-    otpChannel?: never;
-};
+}>;
 export declare function inspectRawObject(value: unknown): object | null;
 export declare function trimString(value: unknown): string;
 export declare function normalizeRegistrationAuthMethodInput(raw: unknown): RegistrationAuthMethodInput | null;

package/dist/types/shared-ts/src/utils/registrationSetupOperation.d.ts

@@ -0,0 +1,3 @@
+export declare function parseRegistrationSetupOperationId(value: unknown): string | null;
+export declare function createRegistrationSetupOperationId(): string;
+//# sourceMappingURL=registrationSetupOperation.d.ts.map

package/dist/types/shared-ts/src/utils/registrationSignerPlan.d.ts

@@ -1,16 +1,15 @@
 import { type ImplicitNearAccountId, type NamedNearAccountId } from './near';
 import type { NearEd25519SigningKeyId } from './registrationIds';
-export type RegistrationNearAccountProvisioning = {
+import type { ThresholdEcdsaChainTargetWire } from './thresholdEcdsaChainTarget';
+import type { ExclusiveUnion } from './variant';
+export type RegistrationNearAccountProvisioning = ExclusiveUnion<{
     kind: 'implicit_account';
     accountIdSource: 'ed25519_public_key';
-    requestedAccountId?: never;
-    sponsor?: never;
 } | {
     kind: 'sponsored_named_account';
     requestedAccountId: NamedNearAccountId;
     sponsor: 'relayer';
-    accountIdSource?: never;
-};
+}>;
 export type ResolvedRegistrationNearAccount = {
     kind: 'implicit_account';
     nearAccountId: ImplicitNearAccountId;
@@ -38,16 +37,7 @@ export type ThresholdEd25519AddSignerSpec = {
     keyVersion: string;
     derivationVersion: number;
 };
-export type ThresholdEcdsaAddSignerChainTarget = {
-    readonly kind: 'evm';
-    readonly namespace: 'eip155';
-    readonly chainId: number;
-    readonly networkSlug?: string;
-} | {
-    readonly kind: 'tempo';
-    readonly chainId: number;
-    readonly networkSlug?: string;
-};
+export type ThresholdEcdsaAddSignerChainTarget = Readonly<ThresholdEcdsaChainTargetWire>;
 export type ThresholdEcdsaAddSignerSpec = {
     chainTargets: readonly ThresholdEcdsaAddSignerChainTarget[];
     participantIds: number[];
@@ -102,15 +92,13 @@ export type RegistrationSignerPlan = {
     kind: 'signer_set';
     branches: readonly RegistrationSignerPlanBranch[];
 };
-export type AddSignerSelection = {
+export type AddSignerSelection = ExclusiveUnion<{
     mode: 'ed25519';
     ed25519: ThresholdEd25519AddSignerSpec;
-    ecdsa?: never;
 } | {
     mode: 'ecdsa';
     ecdsa: ThresholdEcdsaAddSignerSpec;
-    ed25519?: never;
-};
+}>;
 export declare function implicitNearAccountProvisioning(): RegistrationNearAccountProvisioning;
 export declare function sponsoredNamedNearAccountProvisioning(requestedAccountId: NamedNearAccountId): RegistrationNearAccountProvisioning;
 type NormalizeSignerSelectionResult<TSelection> = {

package/dist/types/shared-ts/src/utils/routerAbEcdsaDerivation.d.ts

@@ -33,7 +33,7 @@ export type RouterAbEcdsaDerivationPublicIdentityV1 = {
     client_share_retry_counter: number;
     server_share_retry_counter: number;
 };
-export type RouterAbServerIdentityV1 = {
+type RouterAbServerIdentityV1 = {
     server_id: string;
     key_epoch: string;
     recipient_encryption_key: string;
@@ -583,6 +583,7 @@ export declare function parseRouterAbEcdsaRegistrationActivationReceiptV1(value:
 export declare function parseRouterAbEcdsaRegistrationPublicActivationReceiptV1(value: unknown): RouterAbEcdsaRegistrationPublicActivationReceiptV1;
 export declare function sameRouterAbServerIdentityV1(left: RouterAbServerIdentityV1, right: RouterAbServerIdentityV1): boolean;
 export declare function sameRouterAbEcdsaVerifiedClientActivationFactsV1(left: RouterAbEcdsaVerifiedClientActivationFactsV1, right: RouterAbEcdsaVerifiedClientActivationFactsV1): boolean;
+export declare function sameRegistrationSignerSet(left: RouterAbEcdsaDerivationSignerSetV1, right: RouterAbEcdsaDerivationSignerSetV1): boolean;
 export declare function sameRouterAbEcdsaRegistrationRequestFactsV1(left: RouterAbEcdsaRegistrationRequestFactsV1, right: RouterAbEcdsaRegistrationRequestFactsV1): boolean;
 export declare function assertRouterAbEcdsaRegistrationFactsMatchRequestV1(input: {
     facts: RouterAbEcdsaRegistrationRequestFactsV1;
@@ -605,6 +606,7 @@ export declare function parseRouterAbEcdsaDerivationExplicitExportProtocolReques
 export declare function parseRouterAbEcdsaDerivationActivationRefreshRequestV1(value: unknown): RouterAbEcdsaDerivationActivationRefreshRequestV1;
 export declare function parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1(value: unknown): RouterAbEcdsaDerivationActivationRefreshCommitRequestV1;
 export declare function sameRouterAbPublicDigest32V1Wire(left: RouterAbPublicDigest32V1Wire, right: RouterAbPublicDigest32V1Wire): boolean;
+export declare function sameRegistrationRecipientKeys(left: RouterAbEcdsaRegistrationRecipientKeysV1, right: RouterAbEcdsaRegistrationRecipientKeysV1): boolean;
 export declare function sameRouterAbEcdsaRegistrationActivationReceiptV1(left: RouterAbEcdsaRegistrationActivationReceiptV1, right: RouterAbEcdsaRegistrationActivationReceiptV1): boolean;
 export declare function sameRouterAbEcdsaDerivationNormalSigningStateV1(left: RouterAbEcdsaDerivationNormalSigningStateV1, right: RouterAbEcdsaDerivationNormalSigningStateV1): boolean;
 export declare function sameRouterAbEcdsaDerivationPublicCapabilityV1(left: RouterAbEcdsaDerivationPublicCapabilityV1, right: RouterAbEcdsaDerivationPublicCapabilityV1): boolean;

package/dist/types/shared-ts/src/utils/routerAbEd25519Yao.d.ts

@@ -104,6 +104,7 @@ export type RouterAbEd25519YaoActivationBindingV1<Operation extends RouterAbEd25
     operation: Operation;
 } : never;
 export declare function sameRouterAbEd25519YaoActivationBindingV1(left: RouterAbEd25519YaoActivationBindingV1, right: RouterAbEd25519YaoActivationBindingV1): boolean;
+export declare function sameRouterAbEd25519YaoByteSequence(left: readonly number[], right: readonly number[]): boolean;
 export declare function sameRouterAbEd25519YaoRegistrationAdmissionRequestV1(left: RouterAbEd25519YaoRegistrationAdmissionRequestV1, right: RouterAbEd25519YaoRegistrationAdmissionRequestV1): boolean;
 export declare function sameRouterAbEd25519YaoRecoveryAdmissionRequestV1(left: RouterAbEd25519YaoRecoveryAdmissionRequestV1, right: RouterAbEd25519YaoRecoveryAdmissionRequestV1): boolean;
 export declare function sameRouterAbEd25519YaoActivationKeysetV1(left: RouterAbEd25519YaoActivationKeysetV1, right: RouterAbEd25519YaoActivationKeysetV1): boolean;

package/dist/types/shared-ts/src/utils/routerAbEd25519YaoDigests.d.ts

@@ -1,14 +1,13 @@
 import type { RouterAbEd25519YaoBytes32V1 } from './generated/routerAbEd25519YaoCore';
 import type { RouterAbEd25519YaoApplicationBindingFactsV1, RouterAbEd25519YaoExportAuthorizationIdentityV1 } from './routerAbEd25519Yao';
-type RouterAbEd25519YaoExportAuthorityBindingV1 = {
+import type { ReadonlyExclusiveUnion } from './variant';
+type RouterAbEd25519YaoExportAuthorityBindingV1 = ReadonlyExclusiveUnion<{
     readonly kind: 'passkey';
     readonly credentialIdB64u: string;
-    readonly providerSubjectId?: never;
 } | {
     readonly kind: 'email_otp';
     readonly providerSubjectId: string;
-    readonly credentialIdB64u?: never;
-};
+}>;
 export declare function requireVisibleIdentifier(value: unknown, label: string): string;
 export declare function requireBytes(value: unknown, label: string, minimumLength: number, maximumLength: number): number[];
 export declare function requireBytes32(value: unknown, label: string, nonzero: boolean): number[];