@seams/wallet 0.13.1 → 0.15.0

package/dist/public/wallet-service/index.html

@@ -5,14 +5,14 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Web3Authn Wallet Service</title>
     <!-- Surface styles are external so strict CSP can keep style-src 'self' -->
-    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.13.1" />
+    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.15.0" />
     <!-- Minimal shims some ESM bundles expect (externalized to enable strict CSP) -->
-    <script src="/sdk/wallet-shims.js?v=0.13.1"></script>
+    <script src="/sdk/wallet-shims.js?v=0.15.0"></script>
     <!-- Hint the browser to fetch the host script earlier -->
-    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.13.1" crossorigin>
+    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.15.0" crossorigin>
   </head>
   <body>
     <!-- sdkBasePath points to the SDK root (e.g. '/sdk'). Load the host directly. -->
-    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.13.1"></script>
+    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.15.0"></script>
   </body>
 </html>

package/dist/types/shared-ts/src/device-linking/contracts.d.ts

@@ -698,12 +698,6 @@ export type LocalAuthorityInstallationReceiptV1 = {
     readonly targetFactorVerificationDigestB64u: DigestB64u;
     readonly installedAtMs: number;
 };
-type RelinkRequiredReasonV1 = {
-    readonly kind: 'incomplete_migrated_enrollment';
-} | {
-    readonly kind: 'missing_canonical_local_material';
-    readonly activation: MpcMaterialActivationRef;
-};
 export type LinkIntegrityFailureV1 = {
     readonly kind: 'authority_id_mismatch';
     readonly expectedAuthorityId: WalletAuthorityId;
@@ -749,9 +743,6 @@ export type LinkedAuthorityActivationResultV1 = {
 } | {
     readonly kind: 'failed_before_commit';
     readonly reason: LinkPrecommitFailureV1;
-} | {
-    readonly kind: 'relink_required';
-    readonly reason: RelinkRequiredReasonV1;
 } | {
     readonly kind: 'integrity_error';
     readonly reason: LinkIntegrityFailureV1;

package/dist/types/shared-ts/src/utils/routerAbEcdsaDerivation.d.ts

@@ -611,7 +611,6 @@ export declare function sameRouterAbEcdsaRegistrationActivationReceiptV1(left: R
 export declare function sameRouterAbEcdsaDerivationNormalSigningStateV1(left: RouterAbEcdsaDerivationNormalSigningStateV1, right: RouterAbEcdsaDerivationNormalSigningStateV1): boolean;
 export declare function sameRouterAbEcdsaDerivationPublicCapabilityV1(left: RouterAbEcdsaDerivationPublicCapabilityV1, right: RouterAbEcdsaDerivationPublicCapabilityV1): boolean;
 export declare function routerAbEcdsaRerandomizationClientCommitmentV1(contribution32: Uint8Array): Promise<Uint8Array>;
-export declare function routerAbEcdsaDerivationContextBindingB64uV1(context: RouterAbEcdsaDerivationStableKeyContextV1): Promise<string>;
 export declare function routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1(scope: RouterAbEcdsaDerivationNormalSigningScopeV1): Uint8Array;
 export declare function sameRouterAbEcdsaDerivationNormalSigningScopeV1(left: RouterAbEcdsaDerivationNormalSigningScopeV1, right: RouterAbEcdsaDerivationNormalSigningScopeV1): boolean;
 export declare function routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1(request: RouterAbEcdsaDerivationEvmDigestSigningRequestV1Wire): Promise<RouterAbPublicDigest32V1Wire>;

package/dist/types/wallet/src/SeamsWeb/operations/auth/login.d.ts

@@ -8,7 +8,7 @@ import type { ActiveWalletSessionV1, WalletSessionOperationCredentialV1 } from '
 import { type WalletAuthMethodId } from '../../../../../shared-ts/src/utils/domainIds';
 import { type EmailOtpWalletAuthAuthority, type EmailOtpProvider } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { ActiveEmailOtpWalletAuthMethodRecordV2, ActivePasskeyWalletAuthMethodRecordV2, ActiveWalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/walletAuthMethodRecord';
-import type { LocalWalletAuthMethodProjectionV2, WalletAuthorityExportRootRecordV1, WalletAuthoritySignerMaterialRecordV1, WalletSelectionRecordV1 } from '../../../core/indexedDB/passkeyClientDB.types';
+import type { WalletAuthorityExportRootRecordV1, WalletAuthoritySignerMaterialRecordV1, WalletSelectionRecordV1 } from '../../../core/indexedDB/passkeyClientDB.types';
 import { type WalletId } from '../../../core/signingEngine/interfaces/ecdsaChainTarget';
 import { type WalletUnlockSubjectSet } from './walletUnlockSubject';
 export declare function resolveExactLinkedEmailOtpAuthority(args: {
@@ -122,7 +122,6 @@ export type LocalLoginAuthMethod = {
     readonly authMethod: 'email_otp';
     readonly emailAddress: string | null;
 };
-export declare function projectLocalLoginAuthMethods(projections: readonly LocalWalletAuthMethodProjectionV2[]): LocalLoginAuthMethod[];
 export declare function listLocalLoginAuthMethods(): Promise<LocalLoginAuthMethod[]>;
 /** Lock clears authentication and volatile signing material. */
 export type LockOperationContext = {

package/dist/types/wallet/src/SeamsWeb/publicApi/types.d.ts

@@ -62,6 +62,13 @@ export interface EventsCapability {
     subscribe(listener: SdkLifecycleEventListener): () => void;
 }
 export interface AuthMenuCapability {
+    /**
+     * Downloads the wallet's sign-in code in the background. A signed-out page does
+     * not load it until a sign-in starts. Call this on sign-in intent, such as
+     * pointer, focus or touch on your sign-in control, so that `open` starts sooner.
+     * It never throws; `open` reports any failure.
+     */
+    prepare(): void;
     open(request: HostedAuthMenuOpenRequest, anchorElement?: HTMLElement): Promise<HostedAuthMenuOutcome>;
     cancel(args: {
         authMenuSessionId: HostedAuthMenuSessionId;
@@ -687,17 +694,11 @@ export interface DevicesCapability {
 }
 type KeyExportUiOptions = SigningEngineExportKeypairWithUIInput['options'];
 /**
- * What `exportKey` did.
- *
- * `relink_required` is a real, reachable state — the wallet has no canonical
- * owner binding on this device — and is returned rather than thrown so the
- * caller can route the person to re-link instead of showing a generic error.
+ * What `exportKey` did. A missing export lane or material rejects with an exact
+ * export-lane or material error instead.
  */
 export type KeyExportOutcome = {
     kind: 'exported';
-} | {
-    kind: 'relink_required';
-    reason: 'missing_canonical_owner_binding';
 };
 export type ExportKeyInput = ExclusiveUnion<{
     kind: 'ed25519';
@@ -717,9 +718,6 @@ export type ExportKeyInput = ExclusiveUnion<{
 export interface KeyExportCapability {
     /**
      * Resolve the exact export lane, then open the wallet-origin export viewer.
-     *
-     * One call: the lane resolution feeds straight into the export, and the
-     * `relink_required` lane comes back as a result instead of an exception.
      */
     exportKey(input: ExportKeyInput): Promise<KeyExportOutcome>;
 }

package/dist/types/wallet/src/SeamsWeb/walletIframe/client/router.d.ts

@@ -73,6 +73,7 @@ export declare class WalletIframeRouter {
     private exactSessionState;
     private sessionSelectionGeneration;
     private sessionObservationRevision;
+    private walletRuntimePreparedConnectionId;
     private lastPreferencesChangedPayload;
     private mirroredConfirmationUiMode;
     private progressBus;
@@ -392,6 +393,8 @@ export declare class WalletIframeRouter {
     }): Promise<ActionResult>;
     resolveExactKeyExportLane(input: ResolveExactKeyExportLaneInput): Promise<ResolveExactKeyExportLaneResult>;
     exportKeypairWithUI(input: ExportKeypairWithUIInput): Promise<void>;
+    /** Asks the wallet host to download its runtime once per connection, ahead of sign-in. */
+    prepareWalletHostRuntime(): Promise<void>;
     openHostedAuthMenu(request: HostedAuthMenuOpenRequest, anchorElement?: HTMLElement): Promise<HostedAuthMenuOutcome>;
     cancelHostedAuthMenu(args: {
         authMenuSessionId: HostedAuthMenuSessionId;

package/dist/types/wallet/src/SeamsWeb/walletIframe/coordinator.d.ts

@@ -54,6 +54,7 @@ export declare class WalletIframeCoordinator {
     private initializeConnection;
     private assertConnecting;
     getExactSessionState(): Promise<WalletIframeExactSessionState>;
+    prepareHostedAuthMenu(): void;
     openHostedAuthMenu(request: HostedAuthMenuOpenRequest, anchorElement?: HTMLElement): Promise<HostedAuthMenuOutcome>;
     cancelHostedAuthMenu(args: {
         authMenuSessionId: HostedAuthMenuSessionId;

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/emptyWalletStoreReads.d.ts

@@ -0,0 +1,19 @@
+import type { RuntimeWalletHostRoute } from './requestRouter';
+/**
+ * The reads a parent sends when it connects. While this origin stores no wallet,
+ * the boot answers them with the values the wallet runtime would return, so a
+ * signed-out visitor does not download the runtime.
+ */
+export type EmptyWalletStoreRead = RuntimeWalletHostRoute & {
+    readonly type: 'PM_GET_EXACT_WALLET_SESSION_STATE' | 'PM_GET_RECENT_UNLOCKS' | 'PM_GET_CONFIRMATION_CONFIG';
+};
+export declare function isEmptyWalletStoreRead(route: RuntimeWalletHostRoute): route is EmptyWalletStoreRead;
+export declare function answerEmptyWalletStoreRead(read: EmptyWalletStoreRead): unknown;
+/**
+ * Resolves true only when this origin provably stores no wallet: the wallet
+ * database is absent, or every store in it is empty. Any doubt resolves false,
+ * and the request goes to the wallet runtime. The probe never creates the
+ * database.
+ */
+export declare function walletStoreIsEmpty(): Promise<boolean>;
+//# sourceMappingURL=emptyWalletStoreReads.d.ts.map

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/requestRouter.d.ts

@@ -2,7 +2,7 @@ import type { ParentToChildEnvelope, ParentToChildType } from '../shared/message
 type WalletHostRequest<T extends ParentToChildType> = ParentToChildEnvelope & {
     type: T;
 };
-type BootWalletRequestType = 'PM_ACTIVATE_TRANSACTION_REVIEW' | 'PING' | 'PM_SET_CONFIG' | 'PM_CANCEL' | 'PM_SET_TRANSACTION_VIEW' | 'PM_TRANSACTION_BROADCAST_STARTED';
+type BootWalletRequestType = 'PM_ACTIVATE_TRANSACTION_REVIEW' | 'PING' | 'PM_PREPARE_WALLET_RUNTIME' | 'PM_SET_CONFIG' | 'PM_CANCEL' | 'PM_SET_TRANSACTION_VIEW' | 'PM_TRANSACTION_BROADCAST_STARTED';
 type NearWalletRequestType = 'PM_REGISTER_WALLET' | 'PM_ADD_WALLET_SIGNER' | 'PM_ADD_PASSKEY' | 'PM_ADD_EMAIL_OTP' | 'PM_REVOKE_AUTH_METHOD' | 'PM_GET_NEAR_PROVISIONING_STATE' | 'PM_SIGN_TX_WITH_ACTIONS' | 'PM_SIGN_AND_SEND_TX' | 'PM_SEND_TRANSACTION' | 'PM_SIGN_DELEGATE_ACTION' | 'PM_SIGN_NEP413';
 type AuthWalletRequestType = 'PM_OPEN_AUTH_MENU' | 'PM_CANCEL_AUTH_MENU' | 'PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH' | 'PM_UNLOCK' | 'PM_LOCK' | 'PM_LOCK_EXACT_WALLET_SESSION' | 'PM_GET_LAST_WALLET_MOVE_REQUEST' | 'PM_MOVE_WALLET' | 'PM_GET_WALLET_MOVE' | 'PM_GET_WALLET_PLACEMENT' | 'PM_GET_WALLET_SESSION' | 'PM_GET_EXACT_WALLET_SESSION_STATE' | 'PM_GET_RECENT_UNLOCKS';
 type EcdsaWalletRequestType = 'PM_SIGN_TEMPO' | 'PM_REPORT_TEMPO_BROADCAST_ACCEPTED' | 'PM_REPORT_TEMPO_BROADCAST_REJECTED' | 'PM_REPORT_TEMPO_FINALIZED' | 'PM_REPORT_TEMPO_DROPPED_OR_REPLACED' | 'PM_RECONCILE_TEMPO_NONCE_LANE';

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/runtimeLoader.d.ts

@@ -1,6 +1,11 @@
 import type { RuntimeWalletHostRoute } from './requestRouter';
 type WalletHostRuntimeModule = typeof import('./runtime');
 export declare function loadWalletHostRuntime(route: RuntimeWalletHostRoute): Promise<WalletHostRuntimeModule>;
+/**
+ * Downloads the auth runtime ahead of its first request, on sign-in intent. Every
+ * runtime kind shares most of its code, so this covers the other kinds too.
+ */
+export declare function preloadWalletHostRuntime(): void;
 export declare function preloadWalletHostRecoveryCodeSurface(): Promise<void>;
 export {};
 //# sourceMappingURL=runtimeLoader.d.ts.map

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/sessionObservationRevision.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The parent accepts a session snapshot or lifecycle event only when its revision
+ * is newer than the last one it saw. The boot reads and the wallet runtime share
+ * this one counter, so a runtime that loads after a boot answer stays in order.
+ */
+export declare function nextSessionObservationRevision(): number;
+//# sourceMappingURL=sessionObservationRevision.d.ts.map

package/dist/types/wallet/src/SeamsWeb/walletIframe/shared/messages.d.ts

@@ -189,10 +189,10 @@ export declare function buildHostedAuthMenuCancelPayload(args: {
     reason: HostedAuthMenuCancelReason;
 }): HostedAuthMenuCancelPayload;
 export declare function parseHostedAuthMenuOutcome(value: unknown): HostedAuthMenuOutcome | null;
-export declare const WALLET_PROTOCOL_VERSION: "15.0.0";
+export declare const WALLET_PROTOCOL_VERSION: "16.0.0";
 export declare const WALLET_IFRAME_PROTOCOL_VERSION_MISMATCH: "WALLET_IFRAME_PROTOCOL_VERSION_MISMATCH";
 export type WalletProtocolVersion = typeof WALLET_PROTOCOL_VERSION;
-export type ParentToChildType = 'PM_SET_TRANSACTION_VIEW' | 'PM_TRANSACTION_BROADCAST_STARTED' | 'PING' | 'PM_SET_CONFIG' | 'PM_ACTIVATE_TRANSACTION_REVIEW' | 'PM_CANCEL' | 'PM_OPEN_AUTH_MENU' | 'PM_CANCEL_AUTH_MENU' | 'PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH' | 'PM_REDEEM_HOSTED_WALLET_SEAMS_SESSION' | 'PM_REGISTER_WALLET' | 'PM_ADD_WALLET_SIGNER' | 'PM_ADD_PASSKEY' | 'PM_ADD_EMAIL_OTP' | 'PM_REVOKE_AUTH_METHOD' | 'PM_UNLOCK' | 'PM_LOCK' | 'PM_LOCK_EXACT_WALLET_SESSION' | 'PM_GET_LAST_WALLET_MOVE_REQUEST' | 'PM_MOVE_WALLET' | 'PM_GET_WALLET_MOVE' | 'PM_GET_WALLET_PLACEMENT' | 'PM_GET_WALLET_SESSION' | 'PM_GET_EXACT_WALLET_SESSION_STATE' | 'PM_GET_NEAR_PROVISIONING_STATE' | 'PM_REQUEST_EMAIL_OTP_CHALLENGE' | 'PM_BEGIN_GOOGLE_EMAIL_OTP_WALLET_AUTH' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_RESEND' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_REROLL_WALLET_ID' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_SUBMIT' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_COMPLETE_REGISTRATION' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_CANCEL' | 'PM_GET_WALLET_RECOVERY_CODE_STATUS' | 'PM_ACKNOWLEDGE_WALLET_RECOVERY_CODE_BACKUP' | 'PM_ROTATE_WALLET_RECOVERY_CODES' | 'PM_REQUEST_WALLET_CUSTODY_EMAIL_OTP_CHALLENGE' | 'PM_SIGN_TX_WITH_ACTIONS' | 'PM_SIGN_AND_SEND_TX' | 'PM_SEND_TRANSACTION' | 'PM_SIGN_DELEGATE_ACTION' | 'PM_SIGN_NEP413' | 'PM_SIGN_TEMPO' | 'PM_REPORT_TEMPO_BROADCAST_ACCEPTED' | 'PM_REPORT_TEMPO_BROADCAST_REJECTED' | 'PM_REPORT_TEMPO_FINALIZED' | 'PM_REPORT_TEMPO_DROPPED_OR_REPLACED' | 'PM_RECONCILE_TEMPO_NONCE_LANE' | 'PM_RESOLVE_EXACT_KEY_EXPORT_LANE' | 'PM_EXPORT_KEYPAIR_UI' | 'PM_GET_RECENT_UNLOCKS' | 'PM_SET_CONFIRM_BEHAVIOR' | 'PM_SET_CONFIRMATION_CONFIG' | 'PM_GET_CONFIRMATION_CONFIG' | 'PM_HAS_PASSKEY' | 'PM_LIST_LINKED_DEVICES' | 'PM_REVOKE_LINKED_DEVICE' | 'PM_SCAN_AND_LINK_DEVICE' | 'PM_START_DEVICE2_LINKING_FLOW' | 'PM_DEVICE_LINK_TARGET_FACTOR_ACTION' | 'PM_DEVICE_LINK_EMAIL_OTP_BASE_FACTOR_ACTION' | 'PM_CANCEL_DEVICE_LINKING' | 'PM_SYNC_ACCOUNT_FLOW';
+export type ParentToChildType = 'PM_SET_TRANSACTION_VIEW' | 'PM_TRANSACTION_BROADCAST_STARTED' | 'PING' | 'PM_PREPARE_WALLET_RUNTIME' | 'PM_SET_CONFIG' | 'PM_ACTIVATE_TRANSACTION_REVIEW' | 'PM_CANCEL' | 'PM_OPEN_AUTH_MENU' | 'PM_CANCEL_AUTH_MENU' | 'PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH' | 'PM_REDEEM_HOSTED_WALLET_SEAMS_SESSION' | 'PM_REGISTER_WALLET' | 'PM_ADD_WALLET_SIGNER' | 'PM_ADD_PASSKEY' | 'PM_ADD_EMAIL_OTP' | 'PM_REVOKE_AUTH_METHOD' | 'PM_UNLOCK' | 'PM_LOCK' | 'PM_LOCK_EXACT_WALLET_SESSION' | 'PM_GET_LAST_WALLET_MOVE_REQUEST' | 'PM_MOVE_WALLET' | 'PM_GET_WALLET_MOVE' | 'PM_GET_WALLET_PLACEMENT' | 'PM_GET_WALLET_SESSION' | 'PM_GET_EXACT_WALLET_SESSION_STATE' | 'PM_GET_NEAR_PROVISIONING_STATE' | 'PM_REQUEST_EMAIL_OTP_CHALLENGE' | 'PM_BEGIN_GOOGLE_EMAIL_OTP_WALLET_AUTH' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_RESEND' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_REROLL_WALLET_ID' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_SUBMIT' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_COMPLETE_REGISTRATION' | 'PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_CANCEL' | 'PM_GET_WALLET_RECOVERY_CODE_STATUS' | 'PM_ACKNOWLEDGE_WALLET_RECOVERY_CODE_BACKUP' | 'PM_ROTATE_WALLET_RECOVERY_CODES' | 'PM_REQUEST_WALLET_CUSTODY_EMAIL_OTP_CHALLENGE' | 'PM_SIGN_TX_WITH_ACTIONS' | 'PM_SIGN_AND_SEND_TX' | 'PM_SEND_TRANSACTION' | 'PM_SIGN_DELEGATE_ACTION' | 'PM_SIGN_NEP413' | 'PM_SIGN_TEMPO' | 'PM_REPORT_TEMPO_BROADCAST_ACCEPTED' | 'PM_REPORT_TEMPO_BROADCAST_REJECTED' | 'PM_REPORT_TEMPO_FINALIZED' | 'PM_REPORT_TEMPO_DROPPED_OR_REPLACED' | 'PM_RECONCILE_TEMPO_NONCE_LANE' | 'PM_RESOLVE_EXACT_KEY_EXPORT_LANE' | 'PM_EXPORT_KEYPAIR_UI' | 'PM_GET_RECENT_UNLOCKS' | 'PM_SET_CONFIRM_BEHAVIOR' | 'PM_SET_CONFIRMATION_CONFIG' | 'PM_GET_CONFIRMATION_CONFIG' | 'PM_HAS_PASSKEY' | 'PM_LIST_LINKED_DEVICES' | 'PM_REVOKE_LINKED_DEVICE' | 'PM_SCAN_AND_LINK_DEVICE' | 'PM_START_DEVICE2_LINKING_FLOW' | 'PM_DEVICE_LINK_TARGET_FACTOR_ACTION' | 'PM_DEVICE_LINK_EMAIL_OTP_BASE_FACTOR_ACTION' | 'PM_CANCEL_DEVICE_LINKING' | 'PM_SYNC_ACCOUNT_FLOW';
 interface RpcEnvelope<T extends string = string, P = unknown> {
     type: T;
     requestId?: string;
@@ -608,7 +608,7 @@ export type ParentToChildEnvelope = RpcEnvelope<'PM_ACTIVATE_TRANSACTION_REVIEW'
     view: 'toast' | 'closed';
 }> | RpcEnvelope<'PM_TRANSACTION_BROADCAST_STARTED', {
     signedTransaction: string;
-}> | RpcEnvelope<'PING'> | RpcEnvelope<'PM_SET_CONFIG', PMSetConfigPayload> | RpcEnvelope<'PM_CANCEL', PMCancelPayload> | RpcEnvelope<'PM_OPEN_AUTH_MENU', PMOpenAuthMenuPayload> | RpcEnvelope<'PM_CANCEL_AUTH_MENU', PMCancelAuthMenuPayload> | RpcEnvelope<'PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH', PMResolveAuthMenuExternalAuthPayload> | RpcEnvelope<'PM_REDEEM_HOSTED_WALLET_SEAMS_SESSION', PMRedeemHostedWalletSeamsSessionPayload> | RpcEnvelope<'PM_REGISTER_WALLET', PMRegisterWalletPayload> | RpcEnvelope<'PM_ADD_WALLET_SIGNER', PMAddWalletSignerPayload> | RpcEnvelope<'PM_ADD_PASSKEY', PMAddPasskeyPayload> | RpcEnvelope<'PM_ADD_EMAIL_OTP', PMAddEmailOtpPayload> | RpcEnvelope<'PM_REVOKE_AUTH_METHOD', PMRevokeAuthMethodPayload> | RpcEnvelope<'PM_UNLOCK', PMUnlockPayload> | RpcEnvelope<'PM_LOCK'> | RpcEnvelope<'PM_LOCK_EXACT_WALLET_SESSION', WalletIframeExactSessionIdentity> | RpcEnvelope<'PM_MOVE_WALLET', {
+}> | RpcEnvelope<'PING'> | RpcEnvelope<'PM_PREPARE_WALLET_RUNTIME'> | RpcEnvelope<'PM_SET_CONFIG', PMSetConfigPayload> | RpcEnvelope<'PM_CANCEL', PMCancelPayload> | RpcEnvelope<'PM_OPEN_AUTH_MENU', PMOpenAuthMenuPayload> | RpcEnvelope<'PM_CANCEL_AUTH_MENU', PMCancelAuthMenuPayload> | RpcEnvelope<'PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH', PMResolveAuthMenuExternalAuthPayload> | RpcEnvelope<'PM_REDEEM_HOSTED_WALLET_SEAMS_SESSION', PMRedeemHostedWalletSeamsSessionPayload> | RpcEnvelope<'PM_REGISTER_WALLET', PMRegisterWalletPayload> | RpcEnvelope<'PM_ADD_WALLET_SIGNER', PMAddWalletSignerPayload> | RpcEnvelope<'PM_ADD_PASSKEY', PMAddPasskeyPayload> | RpcEnvelope<'PM_ADD_EMAIL_OTP', PMAddEmailOtpPayload> | RpcEnvelope<'PM_REVOKE_AUTH_METHOD', PMRevokeAuthMethodPayload> | RpcEnvelope<'PM_UNLOCK', PMUnlockPayload> | RpcEnvelope<'PM_LOCK'> | RpcEnvelope<'PM_LOCK_EXACT_WALLET_SESSION', WalletIframeExactSessionIdentity> | RpcEnvelope<'PM_MOVE_WALLET', {
     readonly walletId: string;
     readonly moveId: string;
     readonly destinationRegion: string;

package/dist/types/wallet/src/core/indexedDB/index.d.ts

@@ -1,7 +1,8 @@
 export { UnifiedIndexedDBManager } from './unifiedIndexedDBManager';
 export { createIndexedDBNonceLaneCoordinationStore } from './nonceLaneCoordinationStore';
 export { seamsWalletDB } from './singletons';
-export { SEAMS_WALLET_DB_NAME, SEAMS_WALLET_DB_VERSION, SEAMS_WALLET_INDEXES, SEAMS_WALLET_SCHEMA_MANIFEST, SEAMS_WALLET_STORES, assertCanonicalIndexedDBName, createSeamsTestWalletDbName, } from './schemaNames';
+export { SEAMS_WALLET_DB_NAME } from './walletDbName';
+export { SEAMS_WALLET_DB_VERSION, SEAMS_WALLET_INDEXES, SEAMS_WALLET_SCHEMA_MANIFEST, SEAMS_WALLET_STORES, assertCanonicalIndexedDBName, createSeamsTestWalletDbName, } from './schemaNames';
 export { upgradeSeamsWalletDBSchema } from './seamsWalletDB/schema';
 export type { SeamsWalletDBConfig } from './seamsWalletDB/schema';
 export { SeamsWalletDBManager } from './seamsWalletDB/manager';

package/dist/types/wallet/src/core/indexedDB/schemaNames.d.ts

@@ -1,4 +1,3 @@
-export declare const SEAMS_WALLET_DB_NAME: "seams_wallet";
 export declare const SEAMS_WALLET_DB_VERSION: 24;
 export declare const SEAMS_WALLET_STORES: {
     readonly appState: "app_state";

package/dist/types/wallet/src/core/indexedDB/seamsWalletDB/manager.d.ts

@@ -1,6 +1,7 @@
 import { type IDBPDatabase } from 'idb';
 import { type SeamsWalletDBConfig } from './schema';
-import { SEAMS_WALLET_DB_NAME, type SeamsWalletStoreName } from '../schemaNames';
+import { type SeamsWalletStoreName } from '../schemaNames';
+import { SEAMS_WALLET_DB_NAME } from '../walletDbName';
 type SeamsWalletTransactionMode = 'readonly' | 'readwrite';
 export type SeamsWalletTransactionContext = {
     db: IDBPDatabase;

package/dist/types/wallet/src/core/indexedDB/walletDbName.d.ts

@@ -0,0 +1,2 @@
+export declare const SEAMS_WALLET_DB_NAME: "seams_wallet";
+//# sourceMappingURL=walletDbName.d.ts.map

package/dist/types/wallet/src/core/signingEngine/flows/recovery/keyExportFlow.d.ts

@@ -37,9 +37,6 @@ export type SigningEngineResolveExactKeyExportLaneInput = ExclusiveUnion<{
     walletSession: WalletSessionRef;
 }>;
 export type SigningEngineResolveExactKeyExportLaneResult = {
-    kind: 'relink_required';
-    reason: 'missing_canonical_owner_binding';
-} | {
     kind: 'ecdsa';
     laneIdentity: ExactEcdsaSigningLaneIdentity;
 } | {

package/dist/types/wallet/src/core/signingEngine/routerAb/ecdsaDerivation/presignaturePool.d.ts

@@ -141,31 +141,12 @@ export declare function waitForRouterAbEcdsaDerivationClientPresignaturePoolRead
 }): Promise<boolean>;
 export declare function clearAllRouterAbEcdsaDerivationClientPresignatures(): void;
 export declare function clearRouterAbEcdsaDerivationClientPresignaturesForWallet(walletIdInput: string): void;
-export declare function getRouterAbEcdsaDerivationClientPresignaturePoolDepth(args: {
-    ownershipGeneration: number;
-    relayerUrl: string;
-    scope: RouterAbEcdsaDerivationNormalSigningScopeV1;
-    materialActivation: RouterAbMpcMaterialActivationRefWire;
-}): number;
 type PresignatureRefillScheduleInput = RouterAbEcdsaDerivationClientPresignatureRefillInput & {
     poolPolicy?: RouterAbEcdsaDerivationPresignaturePoolPolicyInput | RouterAbEcdsaDerivationPresignaturePoolPolicy;
     targetDepth?: number;
     triggerIfDepthAtOrBelow?: number;
 };
 export declare function scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill(args: PresignatureRefillScheduleInput): RouterAbEcdsaDerivationClientPresignatureRefillScheduleResult;
-type EcdsaPoolSigningInput = {
-    relayerUrl: string;
-    scope: RouterAbEcdsaDerivationNormalSigningScopeV1;
-    operationId: string;
-    operationDigests: RouterAbEcdsaDerivationOperationDigestsV1Wire;
-    materialActivation: RouterAbMpcMaterialActivationRefWire;
-    credential: RouterAbEcdsaPresignCredential;
-    signingDigest32: Uint8Array;
-    clientSigningMaterial: RouterAbEcdsaDerivationClientSigningMaterialSource;
-    expiresAtMs?: number;
-    workerCtx: WorkerOperationContext;
-} & RouterAbEcdsaDerivationSigningAuthorization;
-export declare function signRouterAbEcdsaDerivationDigestWithPoolHit(args: EcdsaPoolSigningInput): Promise<RouterAbEcdsaDerivationCoordinatorResult>;
 export declare function signRouterAbEcdsaDerivationDigestWithPool(args: {
     relayerUrl: string;
     scope: RouterAbEcdsaDerivationNormalSigningScopeV1;

package/dist/types/wallet/src/core/signingEngine/session/identity/ownerLaneScope.d.ts

@@ -25,20 +25,6 @@ export type OwnerLaneScopeStores = {
 export declare class OwnerLaneScopeIntegrityError extends Error {
     constructor(message: string);
 }
-/**
- * The active authority names a credential this device holds no active
- * canonical wallet auth method for: a pre-Phase-8 enrollment (or a device
- * whose canonical state was removed). It cannot act as a human owner until it
- * links again. Distinct from OwnerLaneScopeIntegrityError so request
- * boundaries and the UI can surface "link this device again" instead of a
- * generic integrity failure.
- */
-declare class OwnerRelinkRequiredError extends Error {
-    readonly code: "relink_required";
-    readonly reason: "missing_canonical_owner_binding";
-    constructor(walletAuthMethodId: string);
-}
-export declare function isOwnerRelinkRequiredError(error: unknown): error is OwnerRelinkRequiredError;
 export declare function resolveExactWalletAuthAuthority(args: {
     readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly stores: OwnerLaneScopeStores;
@@ -69,17 +55,4 @@ export declare function resolveExactOwnerLaneScope(args: {
     readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly stores: OwnerLaneScopeStores;
 }): Promise<OwnerLaneScope>;
-/**
- * Owner derivation chain: active Wallet Session authority -> one active
- * wallet auth method -> exact credential -> exact local authenticator and
- * signer slot (Passkey only). Every value comes from the previous link, and
- * the resolved method must reproduce the authority digest the active session
- * carries. Missing or duplicate records are integrity failures — timestamps,
- * labels, and slot searches never select another owner.
- */
-export declare function resolveOwnerLaneScope(args: {
-    readonly authorityRef: WalletAuthAuthorityRef;
-    readonly stores: OwnerLaneScopeStores;
-}): Promise<OwnerLaneScope>;
-export {};
 //# sourceMappingURL=ownerLaneScope.d.ts.map

package/dist/types/wallet/src/plugins/plugin-utils.d.ts

@@ -1,33 +1,3 @@
 import { type WalletHostVariant } from '../core/browser/walletIframe/hostVariant';
-export declare function addPreconnectLink(res: any, origin?: string): void;
 export declare function buildWalletServiceHtml(sdkBasePath?: string, assetVersion?: string, walletHostVariant?: WalletHostVariant): string;
-export declare function resolveCoepMode(explicit?: 'strict' | 'off'): 'strict' | 'off';
-export declare function applyCoepCorpIfNeeded(res: any, coepMode?: 'strict' | 'off'): void;
-export declare function echoCorsFromRequest(res: any, req: any, opts?: {
-    honorExistingAcaOrigin?: boolean;
-    allowCredentialsWhenExplicit?: boolean;
-    methods?: string;
-    headers?: string;
-    handlePreflight?: boolean;
-}): boolean;
-/**
- * Log and validate Related Origin Requests (ROR) configuration.
- * - Prints the well-known endpoint and the configured origins list.
- * - Warns if any origins are not absolute (e.g., missing protocol/hostname).
- */
-export declare function logRorConfig(origins: string[], endpoint?: string): void;
-type RorOriginsInput = {
-    configuredOrigins: readonly string[];
-    docsOrigin: string;
-    walletOrigin: string;
-};
-export declare function parseConfiguredRorOrigins(value: string): string[];
-export declare function resolveRorOrigins(input: RorOriginsInput): string[];
-/**
- * Infer and set a proper Content-Type header for a given file path.
- * Shared by both app and wallet-iframe dev servers.
- */
-export declare function setContentType(res: any, filePath: string): void;
-export { toBasePath } from '../../../shared-ts/src/utils/validation';
-export declare function resolveSdkDistRoot(explicit?: string): string;
 //# sourceMappingURL=plugin-utils.d.ts.map

package/dist/types/wallet/src/react/components/AccountMenuButton/AccountMenuDialog.d.ts

@@ -1,12 +1,5 @@
 import React from 'react';
-type AccountMenuDialogPresentation = 'modal' | 'page' | 'embedded';
-export declare function useAccountMenuDialogKeyboard(input: {
-    readonly isOpen: boolean;
-    readonly presentation: AccountMenuDialogPresentation;
-    readonly onClose: () => void;
-    readonly dialogRef: React.RefObject<HTMLDivElement | null>;
-    readonly focusableSelector: string;
-}): void;
+type AccountMenuDialogPresentation = 'page' | 'embedded';
 export declare const AccountMenuDialogFrame: React.FC<{
     readonly presentation: AccountMenuDialogPresentation;
     readonly onClose: () => void;
@@ -14,7 +7,6 @@ export declare const AccountMenuDialogFrame: React.FC<{
     readonly contentClassName: string;
     readonly titleId: string;
     readonly title: string;
-    readonly closeLabel: string;
     readonly children: React.ReactNode;
 }>;
 export {};

package/dist/types/wallet/src/react/components/AccountMenuButton/AuthenticationMethodsModal.d.ts

@@ -4,7 +4,7 @@ interface AuthenticationMethodsModalProps {
     readonly walletId: string | null;
     readonly isOpen: boolean;
     readonly onClose: () => void;
-    readonly presentation?: 'modal' | 'page' | 'embedded';
+    readonly presentation: 'page' | 'embedded';
 }
 export declare const AuthenticationMethodsModal: React.FC<AuthenticationMethodsModalProps>;
 export default AuthenticationMethodsModal;

package/dist/types/wallet/src/react/components/AccountMenuButton/LinkedDevicesModal.d.ts

@@ -4,7 +4,7 @@ interface LinkedDevicesModalProps {
     walletId: string | null;
     isOpen: boolean;
     onClose: () => void;
-    presentation?: 'modal' | 'page' | 'embedded';
+    presentation: 'page' | 'embedded';
 }
 export declare const LinkedDevicesModal: React.FC<LinkedDevicesModalProps>;
 export default LinkedDevicesModal;

package/dist/workers/ecdsa-derivation-client.worker.js

@@ -4310,8 +4310,10 @@ replaceTraps((oldTraps) => ({
   }
 }));
 
-// src/core/indexedDB/schemaNames.ts
+// src/core/indexedDB/walletDbName.ts
 var SEAMS_WALLET_DB_NAME = "seams_wallet";
+
+// src/core/indexedDB/schemaNames.ts
 var SEAMS_WALLET_DB_VERSION = 24;
 var SEAMS_WALLET_STORES = {
   appState: "app_state",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet",
-  "version": "0.13.1",
+  "version": "0.15.0",
   "type": "module",
   "description": "Seams web and runtime TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",

package/dist/esm/plugins/headers.js

@@ -1,55 +0,0 @@
-import { toOriginOrUndefined } from "./shared-ts/src/utils/normalize.js";
-//#region src/plugins/headers.ts
-function buildPermissionsPolicy(walletOrigin) {
-	const o = toOriginOrUndefined(walletOrigin);
-	const part = (name) => `${name}=(self${o ? ` "${o}"` : ""})`;
-	return [
-		part("publickey-credentials-get"),
-		part("publickey-credentials-create"),
-		part("clipboard-read"),
-		part("clipboard-write")
-	].join(", ");
-}
-/**
-* Build a wallet-friendly Content Security Policy string.
-*
-* mode:
-*  - 'strict' (default): no inline styles, injects "style-src-attr 'none'", and forbids JS 'unsafe-eval'.
-*  - 'compatible': allows inline styles/scripts via 'unsafe-inline' for friendlier dev/local setups.
-*
-* allowUnsafeEval:
-*  - false by default. Set to true only for development servers that require eval (e.g., Next.js Fast Refresh).
-*  - Wallet pages always include 'wasm-unsafe-eval' because browser-side signer initialization uses
-*    WebAssembly compilation.
-*  - Seams SDK does not require JS 'unsafe-eval' in production.
-*
-* Typical usage: apply strict CSP only to the wallet HTML route
-* (/wallet-service); do not attach CSP to host app routes.
-*/
-function buildWalletCsp(opts = {}) {
-	const mode = opts.mode || "strict";
-	const frame = (opts.frameSrc || []).filter(Boolean);
-	const scriptAllow = (opts.scriptSrcAllowlist || []).map((s) => toOriginOrUndefined(s) || s).filter(Boolean);
-	const scriptWasmUnsafeEval = " 'wasm-unsafe-eval'";
-	const scriptUnsafeInline = mode === "compatible" ? " 'unsafe-inline'" : "";
-	const styleUnsafeInline = mode === "compatible" ? " 'unsafe-inline'" : "";
-	const base = [
-		"default-src 'self'",
-		`script-src 'self'${scriptWasmUnsafeEval}${scriptUnsafeInline}${opts.allowUnsafeEval ? " 'unsafe-eval'" : ""}${scriptAllow.length ? " " + scriptAllow.join(" ") : ""}`,
-		`style-src 'self'${styleUnsafeInline}`,
-		"img-src 'self' data:",
-		"font-src 'self'",
-		"connect-src 'self' https:",
-		"worker-src 'self' blob:",
-		`frame-src 'self'${frame.length ? " " + frame.join(" ") : ""}`,
-		"object-src 'none'",
-		"base-uri 'none'",
-		"form-action 'none'"
-	];
-	if (mode === "strict") base.splice(2, 0, "style-src-attr 'none'");
-	return base.join("; ");
-}
-//#endregion
-export { buildPermissionsPolicy, buildWalletCsp };
-
-//# sourceMappingURL=headers.js.map