@seams/wallet 0.6.1 → 0.7.1

package/dist/types/shared-ts/src/near/actions.d.ts

@@ -47,12 +47,12 @@ export interface DeployContractAction {
     type: ActionType.DeployContract;
     code: Uint8Array | string;
 }
-export interface DeployGlobalContractAction {
+interface DeployGlobalContractAction {
     type: ActionType.DeployGlobalContract;
     code: Uint8Array | string;
     deployMode: 'CodeHash' | 'AccountId';
 }
-export interface UseGlobalContractAction {
+interface UseGlobalContractAction {
     type: ActionType.UseGlobalContract;
     accountId?: string;
     codeHash?: string;
@@ -126,7 +126,7 @@ export type ActionArgsWasm = {
     account_id?: string;
     code_hash?: string;
 };
-export type RelayedSignedDelegateActionArgsWasm = {
+type RelayedSignedDelegateActionArgsWasm = {
     action_type: ActionType.SignedDelegate;
     delegate_action: RelayedDelegateAction;
     signature: Signature;
@@ -136,6 +136,6 @@ export declare function isActionArgsWasm(a?: any): a is ActionArgsWasm;
 export declare function toActionArgsWasm(action: ActionArgs): ActionArgsWasm;
 export declare function validateActionArgsWasm(actionArgsWasm: NearTransactionActionArgsWasm): void;
 export declare function fromActionArgsWasm(a: ActionArgsWasm): ActionArgs;
-export declare function fromTransactionInputWasm(tx: TransactionInputWasm): TransactionInput;
 export declare function fromTransactionInputsWasm(txs: TransactionInputWasm[]): TransactionInput[];
+export {};
 //# sourceMappingURL=actions.d.ts.map

package/dist/types/shared-ts/src/near/delegate.d.ts

@@ -1,5 +1,5 @@
 import type { ActionArgs } from './actions';
-export interface PublicKey {
+interface PublicKey {
     keyType: number;
     keyData: number[];
 }
@@ -19,7 +19,7 @@ export interface SignedDelegate {
     delegateAction: DelegateAction;
     signature: Signature;
 }
-export interface RelayedNearFunctionCall {
+interface RelayedNearFunctionCall {
     readonly methodName: string;
     readonly args: number[];
     readonly gas: number;
@@ -52,4 +52,5 @@ export interface DelegateActionInput {
     maxBlockHeight: bigint | string | number;
     publicKey: string | PublicKey;
 }
+export {};
 //# sourceMappingURL=delegate.d.ts.map

package/dist/types/shared-ts/src/near/nearClient.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Minimal NEAR RPC client that replaces @near-js/providers, with only the methods
+ * the wallet and the server use. Each package extends NearJsonRpcClient with its
+ * own NearRpcError.
+ */
+import type { TxExecutionStatus, AccessKeyView, AccessKeyInfoView, AccessKeyList, FunctionCallPermissionView, AccountView, BlockReference, RpcQueryRequest, FinalityReference } from '@near-js/types';
+import { type JsonRpcErrorDetails } from '../utils/jsonRpc';
+import { type DecodedNearFinalExecutionOutcome, type DecodedNearBlockReference, type NearRpcResultDecoder } from '../utils/nearRpcResults';
+interface ViewAccountParams {
+    account: string;
+    block_id?: string;
+}
+type FullAccessKey = Omit<AccessKeyInfoView, 'access_key'> & {
+    access_key: Omit<AccessKeyView, 'permission'> & {
+        permission: 'FullAccess';
+    };
+};
+type FunctionCallAccessKey = Omit<AccessKeyInfoView, 'access_key'> & {
+    access_key: Omit<AccessKeyView, 'permission'> & {
+        permission: FunctionCallPermissionView;
+    };
+};
+type SignedTransactionFields<Tx, Sig, Lease> = {
+    transaction: Tx;
+    signature: Sig;
+    borsh_bytes: number[];
+    nonceLease?: Lease;
+    serverDispatch?: {
+        transactionHash: string;
+        rpcResult: unknown;
+    };
+};
+/** The wallet narrows the transaction, signature and nonce lease types. */
+export declare class SignedTransaction<Tx = unknown, Sig = unknown, Lease = unknown> {
+    transaction: Tx;
+    signature: Sig;
+    borsh_bytes: number[];
+    nonceLease?: Lease;
+    serverDispatch?: {
+        transactionHash: string;
+        rpcResult: unknown;
+    };
+    constructor(data: SignedTransactionFields<Tx, Sig, Lease>);
+    static fromPlain(input: SignedTransactionFields<unknown, unknown, unknown>): SignedTransaction;
+    encode(): ArrayBuffer;
+    base64Encode(): string;
+}
+/**
+ * Serialize a signed transaction-like object to base64.
+ * Accepts either our SignedTransaction instance or a plain object
+ * with borsh bytes (borsh_bytes | borshBytes) from cross-origin RPC.
+ *
+ * Implementation notes / pitfalls:
+ * - We always bind `this` correctly when calling .base64Encode() / .encode()
+ *   so methods defined on SignedTransaction can safely call this.encode().
+ * - The underlying base64Encode() helper is implemented to avoid spreading large
+ *   Uint8Arrays into String.fromCharCode(...), which can overflow the JS call
+ *   stack for big WASM binaries or large transactions.
+ * - As a fallback, we accept raw borsh bytes in multiple shapes to keep the
+ *   serializer resilient to different runtimes (plain objects, typed arrays, etc.).
+ */
+type EncodableSignedTx = SignedTransaction | {
+    borsh_bytes?: unknown;
+    borshBytes?: unknown;
+    encode?: () => ArrayBuffer;
+    base64Encode?: () => string;
+};
+export declare function encodeSignedTransactionBase64(signed: EncodableSignedTx): string;
+/**
+ * MinimalNearClient provides a simplified interface for NEAR protocol interactions
+ */
+export interface NearClient<SignedTx = SignedTransaction> {
+    viewAccessKey(accountId: string, publicKey: string, finalityQuery?: FinalityReference): Promise<AccessKeyView>;
+    viewAccessKeyList(accountId: string, finalityQuery?: FinalityReference): Promise<AccessKeyList>;
+    viewAccount(accountId: string): Promise<AccountView>;
+    viewCode(accountId: string, finalityQuery?: FinalityReference): Promise<Uint8Array>;
+    viewBlock(params: BlockReference): Promise<DecodedNearBlockReference>;
+    sendTransaction(signedTransaction: SignedTx, waitUntil?: TxExecutionStatus): Promise<DecodedNearFinalExecutionOutcome>;
+    txStatus(txHash: string, senderAccountId: string): Promise<DecodedNearFinalExecutionOutcome>;
+    query<T>(params: RpcQueryRequest, decodeResult: NearRpcResultDecoder<T>): Promise<T>;
+    callFunction<A, T>(accountId: string, method: string, args: A, decodeResult: NearRpcResultDecoder<T>, blockQuery?: BlockReference): Promise<T>;
+    view<A, T>(params: {
+        account: string;
+        method: string;
+        args: A;
+        decodeResult: NearRpcResultDecoder<T>;
+    }): Promise<T>;
+    getAccessKeys(params: ViewAccountParams): Promise<{
+        fullAccessKeys: FullAccessKey[];
+        functionCallAccessKeys: FunctionCallAccessKey[];
+    }>;
+}
+export declare abstract class NearJsonRpcClient<SignedTx extends SignedTransaction = SignedTransaction> implements NearClient<SignedTx> {
+    private readonly rpcUrls;
+    constructor(rpcUrl: string | string[]);
+    private static normalizeRpcUrls;
+    /** The error for a JSON-RPC error response. */
+    protected abstract errorFromRpc(operationName: string, error: JsonRpcErrorDetails): Error;
+    /** The error for a result that carries an `error`, as some providers return. */
+    protected abstract errorFromWrappedResult(message: string): Error;
+    /** The error for a sent transaction whose outcome status is a Failure. */
+    protected abstract errorFromOutcome(operationName: string, outcome: DecodedNearFinalExecutionOutcome, failure: unknown): Error;
+    /** The error for a non-2xx HTTP response. */
+    protected errorFromHttpStatus(response: Response): Error;
+    /**
+     * What a call rejects with when its request, response or decoding fails; the
+     * server reports every such failure as a NearRpcError.
+     */
+    protected errorFromFailedCall(_operationName: string, error: unknown): unknown;
+    /** Sends a transaction once; the wallet retries transient failures. */
+    protected sendWithRetry<T>(send: () => Promise<T>): Promise<T>;
+    /** Build a JSON-RPC 2.0 POST body (stringified). */
+    private buildRequestBody;
+    /** Perform a single POST to one endpoint and decode its JSON-RPC envelope. */
+    private postOnce;
+    /** Try each configured RPC endpoint in order and return the first decoded envelope. */
+    private requestWithFallback;
+    /** Unwrap an envelope while keeping the method result unknown. */
+    private unwrapRpcResult;
+    /**
+     * Execute RPC call with proper error handling and result extraction
+     */
+    private makeRpcCall;
+    query<T>(params: RpcQueryRequest, decodeResult: NearRpcResultDecoder<T>): Promise<T>;
+    viewAccessKey(accountId: string, publicKey: string, finalityQuery?: FinalityReference): Promise<AccessKeyView>;
+    viewAccessKeyList(accountId: string, finalityQuery?: FinalityReference): Promise<AccessKeyList>;
+    viewAccount(accountId: string): Promise<AccountView>;
+    viewCode(accountId: string, finalityQuery?: FinalityReference): Promise<Uint8Array>;
+    viewBlock(params: BlockReference): Promise<DecodedNearBlockReference>;
+    sendTransaction(signedTransaction: SignedTx, waitUntil?: TxExecutionStatus): Promise<DecodedNearFinalExecutionOutcome>;
+    txStatus(txHash: string, senderAccountId: string): Promise<DecodedNearFinalExecutionOutcome>;
+    callFunction<A, T>(accountId: string, method: string, args: A, decodeResult: NearRpcResultDecoder<T>, blockQuery?: BlockReference): Promise<T>;
+    view<A, T>(params: {
+        account: string;
+        method: string;
+        args: A;
+        decodeResult: NearRpcResultDecoder<T>;
+    }): Promise<T>;
+    getAccessKeys({ account, block_id }: ViewAccountParams): Promise<{
+        fullAccessKeys: FullAccessKey[];
+        functionCallAccessKeys: FunctionCallAccessKey[];
+    }>;
+}
+export {};
+//# sourceMappingURL=nearClient.d.ts.map

package/dist/types/shared-ts/src/passkey-custody/ceremonyCommitPayload.d.ts

@@ -1,25 +1,3 @@
-/**
- * What a wallet custody ceremony hands back when it seals.
- *
- * This is the wasm `WalletCustodyCommitPayloadV1` as it crosses the worker
- * boundary and then the wire: ciphertext and public facts only. It lives in
- * shared so the SDK worker channel and the Gateway commit path describe the
- * same shape once — two spellings of it would diverge silently, and the first
- * symptom would be a stored envelope that never opens.
- *
- * Nothing here is a capability. The seed, the owner roots, the manifest KEK,
- * and the manifest proof all stayed inside the ceremony module.
- */
-/**
- * The owner key sets a ceremony can provision, spelled as the Rust
- * `WalletKeySetKindV1` serializes them.
- *
- * Used where the SDK *chooses* a key set — the worker channel and the ceremony
- * driver. `WalletCustodyCeremonyCommitPayload.keySet` stays a `string`: it
- * arrives over the wire, and narrowing a parsed value to this union without
- * checking it would only move the assumption somewhere harder to see.
- */
-export type WalletCustodyKeySetKind = 'near_ed25519_v1' | 'evm_family_ecdsa_v1';
 export type WalletCustodyCeremonyRecoveryWrapPayload = {
     readonly recoveryKeyId: string;
     readonly nonceB64u: string;

package/dist/types/shared-ts/src/passkey-custody/credentialActivity.d.ts

@@ -33,8 +33,7 @@ export type WalletCredentialActivityRecordV1 = {
     /** How many times, for a user deciding whether a credential is stale. */
     readonly useCount: number;
 };
-export declare const MAX_WALLET_CREDENTIAL_LABEL_LENGTH = 64;
-export type WalletCredentialActivityParseResult = {
+type WalletCredentialActivityParseResult = {
     readonly ok: true;
     readonly record: WalletCredentialActivityRecordV1;
 } | {
@@ -44,6 +43,5 @@ export type WalletCredentialActivityParseResult = {
 export declare function parseWalletCredentialActivityRecordV1(raw: unknown, options: {
     readonly expectedWalletId: string;
 }): WalletCredentialActivityParseResult;
-/** Records one use of a credential, for the list the user reads. */
-export declare function recordWalletCredentialUseV1(record: WalletCredentialActivityRecordV1, usedAtMs: number): WalletCredentialActivityRecordV1;
+export {};
 //# sourceMappingURL=credentialActivity.d.ts.map

package/dist/types/shared-ts/src/passkey-custody/custodyEnvelope.d.ts

@@ -3,13 +3,11 @@ import type { DigestB64u } from '../utils/canonicalPrimitives';
 import type { PasskeyCustodySecretBinding } from './custodySecretBinding';
 import type { EnvelopeCiphertextB64u, EnvelopeNonceB64u, EnvelopeRevision } from './primitives';
 export declare const WALLET_CUSTODY_ENVELOPE_VERSION_V2: "wallet_custody_envelope_v2";
-/** Refactor 109C: an envelope whose owning auth method is part of its AAD. */
-export declare const WALLET_CUSTODY_ENVELOPE_VERSION_V3: "wallet_custody_envelope_v3";
-export declare const PASSKEY_PRF_KEK_VERSION_V1: "passkey_prf_kek_hkdf_sha256_v1";
-export declare const EMAIL_OTP_FACTOR_KEK_VERSION_V1: "email_otp_factor_kek_hkdf_sha256_v1";
-export type WalletCustodyEnvelopeVersion = typeof WALLET_CUSTODY_ENVELOPE_VERSION_V2;
-export type PasskeyPrfKekVersion = typeof PASSKEY_PRF_KEK_VERSION_V1;
-export type EmailOtpFactorKekVersion = typeof EMAIL_OTP_FACTOR_KEK_VERSION_V1;
+declare const PASSKEY_PRF_KEK_VERSION_V1: "passkey_prf_kek_hkdf_sha256_v1";
+declare const EMAIL_OTP_FACTOR_KEK_VERSION_V1: "email_otp_factor_kek_hkdf_sha256_v1";
+type WalletCustodyEnvelopeVersion = typeof WALLET_CUSTODY_ENVELOPE_VERSION_V2;
+type PasskeyPrfKekVersion = typeof PASSKEY_PRF_KEK_VERSION_V1;
+type EmailOtpFactorKekVersion = typeof EMAIL_OTP_FACTOR_KEK_VERSION_V1;
 /**
  * Which enrolled factor sealed this envelope.
  *
@@ -51,7 +49,6 @@ export type WalletCustodyEnvelopeFactor = {
     rpId?: never;
     credentialIdB64u?: never;
 };
-export type WalletCustodyFactorKind = WalletCustodyEnvelopeFactor['kind'];
 export type PasskeyCustodyEnvelopeLifecycle = {
     state: 'active';
     activatedAtMs: number;
@@ -73,7 +70,7 @@ export type PasskeyCustodyEnvelopeLifecycle = {
  *
  * This record carries no authorization identity: no `AuthorizationGrantRef`,
  * `WalletSessionId`, `MpcWalletSigningQuotaId`, `AuthorizedOperationId`, or
- * bearer session. Those are resolved per operation at the Refactor 90 boundary.
+ * bearer session. Those are resolved per operation, not stored here.
  * It also carries no `MpcMaterialActivationRef` — activation identity is bound
  * when opened material enters the canonical activation boundary, so an explicit
  * reactivation can mint a fresh activation id without rewriting this envelope.
@@ -96,7 +93,6 @@ export type PasskeyCustodyEnvelopeRecord = {
     createdAtMs: number;
     updatedAtMs: number;
 };
-export declare function parseWalletCustodyEnvelopeOwnership(raw: unknown, label: string): WalletCustodyEnvelopeOwnership;
 /**
  * The exact JSON `signer_core::PasskeyCustodyEnvelopeBindingV1` deserialises.
  *
@@ -133,10 +129,6 @@ export declare function buildEmailOtpEnvelopeFactor(args: {
 export declare function buildActiveEnvelopeLifecycle(args: {
     activatedAtMs: number;
 }): PasskeyCustodyEnvelopeLifecycle;
-export declare function buildRetiredEnvelopeLifecycle(args: {
-    activatedAtMs: number;
-    retiredAtMs: number;
-}): PasskeyCustodyEnvelopeLifecycle;
 export declare function buildRevokedEnvelopeLifecycle(args: {
     activatedAtMs: number;
     revokedAtMs: number;
@@ -156,7 +148,6 @@ export declare function buildPasskeyCustodyEnvelopeRecord(args: {
     createdAtMs: number;
     updatedAtMs: number;
 }): PasskeyCustodyEnvelopeRecord;
-export declare function parsePasskeyCustodyEnvelopeLifecycle(raw: unknown, label?: string): PasskeyCustodyEnvelopeLifecycle;
 export declare function parseWalletCustodyEnvelopeFactor(raw: unknown, label?: string): WalletCustodyEnvelopeFactor;
 /**
  * Parses one raw server row, wire payload, or IndexedDB cache entry into the
@@ -164,10 +155,9 @@ export declare function parseWalletCustodyEnvelopeFactor(raw: unknown, label?: s
  * `PasskeyCustodyEnvelopeRecord`, never a raw shape.
  */
 export declare function parsePasskeyCustodyEnvelopeRecord(raw: unknown, label?: string): PasskeyCustodyEnvelopeRecord;
-export declare function isActivePasskeyCustodyEnvelope(envelope: PasskeyCustodyEnvelopeRecord): boolean;
 /** Two ownerships name the same owner. */
 export declare function sameWalletCustodyEnvelopeOwnership(left: WalletCustodyEnvelopeOwnership, right: WalletCustodyEnvelopeOwnership): boolean;
-export type WalletCustodyEnvelopeOwnershipReplacementAdmissionV1 = {
+type WalletCustodyEnvelopeOwnershipReplacementAdmissionV1 = {
     readonly kind: 'admitted';
 } | {
     readonly kind: 'refused';
@@ -181,11 +171,12 @@ export type WalletCustodyEnvelopeOwnershipReplacementAdmissionV1 = {
  * what was sealed before ownership was authenticated. And a stored owner may
  * only be replaced by itself: an envelope already bound to one method is never
  * rebound to a sibling, which is the whole point of putting the owner in the
- * AAD. That leaves exactly one transition that moves anything — the pre-109C
+ * AAD. That leaves exactly one transition that moves anything — the ownership
  * upgrade, `unbound` to the method that just proved it can open the envelope.
  */
 export declare function admitWalletCustodyEnvelopeOwnershipReplacementV1(input: {
     readonly stored: WalletCustodyEnvelopeOwnership;
     readonly replacement: WalletCustodyEnvelopeOwnership;
 }): WalletCustodyEnvelopeOwnershipReplacementAdmissionV1;
+export {};
 //# sourceMappingURL=custodyEnvelope.d.ts.map

package/dist/types/shared-ts/src/passkey-custody/custodySecretBinding.d.ts

@@ -1,7 +1,7 @@
 import type { LaneShareEpoch, LinkedDeviceEnrollmentId, LinkedDeviceId, LinkDeviceSessionId, SigningLaneId, WalletKeyId } from '../signing-lanes/ids';
 import type { EvmFamilySigningKeySlotId } from '../signing-lanes/evmFamilySigningKeySlotId';
 import type { ThresholdEcdsaSessionId } from '../utils/domainIds';
-import type { NearEd25519SigningKeyId } from '../utils/registrationIntent';
+import type { NearEd25519SigningKeyId } from '../utils/registrationIds';
 import type { DigestB64u } from '../utils/canonicalPrimitives';
 import type { Ed25519PublicKeyB64u, Secp256k1CompressedPublicKeyB64u } from './primitives';
 /**
@@ -9,13 +9,13 @@ import type { Ed25519PublicKeyB64u, Secp256k1CompressedPublicKeyB64u } from './p
  *
  * Owner custody is one wallet-scoped seed: every owner signing root derives
  * from it in parallel, so there is nothing per-curve to seal separately. Lane
- * holder shares stay per-lane because Refactor 102 provisions them
- * individually — they are not seed-derived.
+ * holder shares stay per-lane because they are provisioned individually, not
+ * derived from the seed.
  */
 export type PasskeyCustodySecretKind = 'wallet_custody_seed_v1' | 'ed25519_yao_client_root_v1' | 'ed25519_lane_holder_share_v1' | 'ecdsa_lane_holder_share_v1';
 /** The only derivation scheme owner custody supports. */
-export declare const WALLET_SEED_DERIVATION_SCHEME_V1: "wallet_seed_parallel_hkdf_sha256_v1";
-export type WalletSeedDerivationScheme = typeof WALLET_SEED_DERIVATION_SCHEME_V1;
+declare const WALLET_SEED_DERIVATION_SCHEME_V1: "wallet_seed_parallel_hkdf_sha256_v1";
+type WalletSeedDerivationScheme = typeof WALLET_SEED_DERIVATION_SCHEME_V1;
 export type PasskeyCustodySecretBinding = {
     /**
      * One random seed per wallet. Every owner signing root derives from it in
@@ -93,17 +93,16 @@ export type PasskeyCustodySecretBinding = {
     participantBindingDigestB64u?: never;
     clientRootPublicKey33B64u?: never;
 };
-export type Ed25519YaoClientRootTargetFactorV1 = {
+type Ed25519YaoClientRootTargetFactorV1 = {
     readonly kind: 'passkey_prf';
 } | {
     readonly kind: 'email_otp';
 };
-export type PasskeyCustodySecretBindingOfKind<TKind extends PasskeyCustodySecretKind> = Extract<PasskeyCustodySecretBinding, {
+type PasskeyCustodySecretBindingOfKind<TKind extends PasskeyCustodySecretKind> = Extract<PasskeyCustodySecretBinding, {
     kind: TKind;
 }>;
 /** True when this binding covers owner custody rather than one lane's share. */
 export declare function isWalletCustodySeedBinding(binding: PasskeyCustodySecretBinding): binding is PasskeyCustodySecretBindingOfKind<'wallet_custody_seed_v1'>;
-export declare function buildWalletCustodySeedBinding(): PasskeyCustodySecretBindingOfKind<'wallet_custody_seed_v1'>;
 export declare function buildEd25519YaoClientRootBinding(args: {
     linkSessionId: LinkDeviceSessionId;
     walletKeyId: WalletKeyId;
@@ -114,22 +113,6 @@ export declare function buildEd25519YaoClientRootBinding(args: {
     deviceId: LinkedDeviceId;
     revocationEpoch: number;
 }): PasskeyCustodySecretBindingOfKind<'ed25519_yao_client_root_v1'>;
-export declare function buildEd25519LaneHolderShareBinding(args: {
-    walletKeyId: WalletKeyId;
-    laneId: SigningLaneId;
-    laneShareEpoch: LaneShareEpoch;
-    nearEd25519SigningKeyId: NearEd25519SigningKeyId;
-    registeredPublicKeyB64u: Ed25519PublicKeyB64u;
-    participantBindingDigestB64u: DigestB64u;
-}): PasskeyCustodySecretBindingOfKind<'ed25519_lane_holder_share_v1'>;
-export declare function buildEcdsaLaneHolderShareBinding(args: {
-    walletKeyId: WalletKeyId;
-    laneId: SigningLaneId;
-    laneShareEpoch: LaneShareEpoch;
-    evmFamilySigningKeySlotId: EvmFamilySigningKeySlotId;
-    thresholdSessionId: ThresholdEcdsaSessionId;
-    thresholdPublicKey33B64u: Secp256k1CompressedPublicKeyB64u;
-}): PasskeyCustodySecretBindingOfKind<'ecdsa_lane_holder_share_v1'>;
 /**
  * Parses one raw persistence or wire shape into an exact custody-secret branch.
  * Cross-branch fields, unknown fields, and plaintext-secret fields are rejected
@@ -137,4 +120,5 @@ export declare function buildEcdsaLaneHolderShareBinding(args: {
  * branch it does not satisfy.
  */
 export declare function parsePasskeyCustodySecretBinding(raw: unknown, label?: string): PasskeyCustodySecretBinding;
+export {};
 //# sourceMappingURL=custodySecretBinding.d.ts.map

package/dist/types/shared-ts/src/passkey-custody/index.d.ts

@@ -3,7 +3,5 @@ export * from './custodySecretBinding';
 export * from './custodyEnvelope';
 export * from './ceremonyCommitPayload';
 export * from './credentialActivity';
-export * from './kekContext';
 export * from './envelopeIndex';
-export * from './credentialObservations';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/shared-ts/src/passkey-custody/primitives.d.ts

@@ -9,9 +9,6 @@ export type Secp256k1CompressedPublicKeyB64u = string & PasskeyCustodyBrand<'Sec
 export type KeyCreationSignerSlot = number & PasskeyCustodyBrand<'KeyCreationSignerSlot'>;
 export type EnvelopeRevision = number & PasskeyCustodyBrand<'EnvelopeRevision'>;
 export declare function parseDigestField(value: unknown, label: string): DigestB64u;
-export declare const PASSKEY_CUSTODY_WRAP_ALG_V1: "chacha20poly1305-hkdf-sha256-v1";
-export declare const PASSKEY_CUSTODY_WRAP_NONCE_LENGTH: 12;
-export declare const PASSKEY_CUSTODY_WRAP_TAG_LENGTH: 16;
 export declare function parseEnvelopeNonceB64u(value: unknown, label?: string): EnvelopeNonceB64u;
 export declare function parseEnvelopeCiphertextB64u(value: unknown, label?: string): EnvelopeCiphertextB64u;
 export declare function parseEd25519PublicKeyB64u(value: unknown, label?: string): Ed25519PublicKeyB64u;
@@ -19,16 +16,5 @@ export declare function parseSecp256k1CompressedPublicKeyB64u(value: unknown, la
 export declare function parseKeyCreationSignerSlot(value: unknown, label?: string): KeyCreationSignerSlot;
 export declare function parseEnvelopeRevision(value: unknown, label?: string): EnvelopeRevision;
 export declare function parseUnixMs(value: unknown, label: string): number;
-export declare function requireRecord(value: unknown, label: string): Record<string, unknown>;
-/**
- * Rejects every field outside this record's exact shape.
- *
- * `knownOnOtherBranches` names fields that are legitimate public bindings
- * somewhere else in the same union. Those are reported as the branch mismatch
- * they are; only genuinely unknown fields are classified as leaks, so a public
- * key like `clientRootPublicKey33B64u` on the wrong branch is never mistaken
- * for plaintext custody material.
- */
-export declare function rejectUnknownFields(record: Record<string, unknown>, allowed: readonly string[], label: string, knownOnOtherBranches?: readonly string[]): void;
 export {};
 //# sourceMappingURL=primitives.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.d.ts

@@ -3,22 +3,7 @@ export type EvmFamilySigningKeySlotId = string & {
     readonly __evmFamilySigningKeySlotIdBrand: 'EvmFamilySigningKeySlotId';
 };
 export declare function parseEvmFamilySigningKeySlotId(raw: unknown): DomainIdParseResult<EvmFamilySigningKeySlotId>;
-export declare function parseEvmFamilySigningKeySlotIdOrNull(raw: unknown): EvmFamilySigningKeySlotId | null;
 export declare function requireEvmFamilySigningKeySlotId(value: unknown, label?: string): EvmFamilySigningKeySlotId;
-export declare function assertMatchingEvmFamilySigningKeySlotId(args: {
-    expected: unknown;
-    actual: unknown;
-    expectedLabel?: string;
-    actualLabel?: string;
-    message?: string;
-}): EvmFamilySigningKeySlotId;
-export declare function assertEvmFamilySigningKeySlotIdMatchesPlan(args: {
-    evmFamilySigningKeySlotId: unknown;
-    walletId: unknown;
-    signingRootId: unknown;
-    signingRootVersion: unknown;
-    message?: string;
-}): EvmFamilySigningKeySlotId;
 export declare function deriveEvmFamilySigningKeySlotId(input: {
     walletId: unknown;
     signingRootId: unknown;

package/dist/types/shared-ts/src/signing-lanes/execution.d.ts

@@ -1,38 +1,14 @@
 import type { AuthorizedOperationId, CapabilityId } from '../authorization/capabilityKinds';
 import type { CapabilityOperationFingerprintDigest } from '../authorization/operationFingerprint';
-import type { DomainId, MpcMaterialActivationRef } from '../utils/domainIds';
+import type { MpcMaterialActivationRef } from '../utils/domainIds';
 import type { LinkedDeviceEnrollmentId } from './ids';
-import type { LinkedDeviceId, LaneShareEpoch, SigningLaneId, WalletKeyId } from './ids';
-import type { ActiveSigningLaneReference, DelegatedSpendAuthorizationId } from './records';
-import { type RouterAbMpcMaterialActivationRefWire } from '../utils/routerAbNormalSigningIdentity';
-export type LinkedDeviceExecutionEnvelopeV1 = {
-    readonly kind: 'linked_device_execution_v1';
-    readonly enrollmentId: LinkedDeviceEnrollmentId;
-    readonly deviceId: LinkedDeviceId;
-    readonly walletKeyId: WalletKeyId;
-    readonly laneId: SigningLaneId;
-    readonly laneShareEpoch: LaneShareEpoch;
-    readonly materialActivation: RouterAbMpcMaterialActivationRefWire;
-};
-export declare function buildLinkedDeviceExecutionEnvelopeV1(input: {
-    readonly enrollmentId: LinkedDeviceEnrollmentId;
-    readonly deviceId: LinkedDeviceId;
-    readonly walletKeyId: WalletKeyId;
-    readonly laneId: SigningLaneId;
-    readonly laneShareEpoch: LaneShareEpoch;
-    readonly materialActivation: MpcMaterialActivationRef;
-}): LinkedDeviceExecutionEnvelopeV1;
-export type DelegatedBudgetClaimId = DomainId<'DelegatedBudgetClaimId'>;
+import type { ActiveSigningLaneReference } from './records';
 export type ClaimedWalletExecutionAuthorization = {
     readonly kind: 'claimed_wallet_execution_authorization_v1';
     readonly authorizedOperationId: AuthorizedOperationId;
     readonly operationFingerprintDigest: CapabilityOperationFingerprintDigest;
     readonly capabilityId: CapabilityId;
 };
-export type ReservedDelegatedBudgetClaim = {
-    readonly kind: 'reserved_delegated_budget_claim_v1';
-    readonly budgetClaimId: DelegatedBudgetClaimId;
-};
 type PreparedWalletExecutionBase = {
     readonly authorization: ClaimedWalletExecutionAuthorization;
     readonly materialActivation: MpcMaterialActivationRef;
@@ -57,35 +33,10 @@ export type PreparedLinkedDeviceWalletExecution = PreparedWalletExecutionBase &
     readonly delegatedAuthorizationId?: never;
     readonly budgetClaim?: never;
 };
-export type PreparedDelegatedWalletExecution = PreparedWalletExecutionBase & {
-    readonly kind: 'prepared_delegated_wallet_execution';
-    readonly laneKind: 'delegated_execution';
-    readonly lane: ActiveSigningLaneReference & {
-        readonly laneKind: 'delegated_execution';
-    };
-    readonly delegatedAuthorizationId: DelegatedSpendAuthorizationId;
-    readonly budgetClaim: ReservedDelegatedBudgetClaim;
-    readonly linkedDeviceEnrollmentId?: never;
-};
-export type PreparedWalletExecution = PreparedOwnerWalletExecution | PreparedLinkedDeviceWalletExecution | PreparedDelegatedWalletExecution;
 export declare function buildPreparedOwnerWalletExecution(input: {
     readonly authorization: ClaimedWalletExecutionAuthorization;
     readonly materialActivation: MpcMaterialActivationRef;
     readonly lane: PreparedOwnerWalletExecution['lane'];
 }): PreparedOwnerWalletExecution;
-export declare function buildPreparedLinkedDeviceWalletExecution(input: {
-    readonly authorization: ClaimedWalletExecutionAuthorization;
-    readonly materialActivation: MpcMaterialActivationRef;
-    readonly lane: PreparedLinkedDeviceWalletExecution['lane'];
-    readonly linkedDeviceEnrollmentId: LinkedDeviceEnrollmentId;
-}): PreparedLinkedDeviceWalletExecution;
-export declare function buildPreparedDelegatedWalletExecution(input: {
-    readonly authorization: ClaimedWalletExecutionAuthorization;
-    readonly materialActivation: MpcMaterialActivationRef;
-    readonly lane: PreparedDelegatedWalletExecution['lane'];
-    readonly delegatedAuthorizationId: DelegatedSpendAuthorizationId;
-    readonly budgetClaim: ReservedDelegatedBudgetClaim;
-}): PreparedDelegatedWalletExecution;
-export declare function assertNeverPreparedWalletExecution(value: never): never;
 export {};
 //# sourceMappingURL=execution.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/index.d.ts

@@ -1,8 +1,8 @@
 export * from './ids';
-export * from './validation';
 export * from './records';
 export * from './rotation';
 export * from './rotationParsers';
+export * from './rotationProtocolParsers';
 export * from './rotationDigests';
 export * from './rotationLifecycle';
 export * from './evmFamilySigningKeySlotId';
@@ -10,5 +10,4 @@ export * from './participants';
 export * from './participantDigest';
 export * from './execution';
 export * from './ownerContinuity';
-export * from './linkedEcdsaScope';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/ownerContinuity.d.ts

@@ -5,7 +5,7 @@ import { type LaneParticipantBindingDigestB64u } from './participants';
 export type WalletSignerId = string & {
     readonly __ownerLaneWalletSignerIdBrand: 'WalletSignerId';
 };
-/** Owner lanes bind to signer facts that predate independently provisioned R102 lanes. */
+/** Owner lanes bind to signer facts that predate independently provisioned lanes. */
 export type OwnerLaneParticipantContinuityV1 = {
     readonly kind: 'owner_lane_participant_continuity_v1';
     readonly signerId: WalletSignerId;
@@ -14,7 +14,6 @@ export type OwnerLaneParticipantContinuityV1 = {
     readonly custodyKeyManifestDigestB64u: DigestB64u;
     readonly sourceIdentityDigestB64u: DigestB64u;
 };
-export declare const OWNER_LANE_PARTICIPANT_BINDING_DOMAIN_V1: "seams/rotatable-signing-lanes/owner-lane-participant-continuity/v1";
 /** Parse the owner signer identity without widening it into a generic string. */
 export declare function parseWalletSignerId(raw: unknown, label?: string): WalletSignerId;
 export declare function buildOwnerLaneParticipantContinuityV1(args: {

package/dist/types/shared-ts/src/signing-lanes/participantDigest.d.ts

@@ -1,48 +1,26 @@
 import { type DigestB64u } from '../utils/canonicalPrimitives';
 import { type HpkePublicKeyB64u, type LaneHolderCustodyIdentityV1, type LaneHolderParticipantId, type LaneHolderParticipantRecordV1, type LaneParticipantBindingDigestB64u, type SigningWorkerParticipantId, type SigningWorkerParticipantRecordV1, type SigningWorkerRecipientIdentityV1, type SigningWorkerRecipientKeyDigestB64u } from './participants';
-/** Domain tags are part of the wire contract and must never be shortened. */
-export declare const LANE_HOLDER_PARTICIPANT_BINDING_DOMAIN_V1: "seams/rotatable-signing-lanes/lane-holder-participant/v1";
-export declare const SIGNING_WORKER_PARTICIPANT_BINDING_DOMAIN_V1: "seams/rotatable-signing-lanes/signing-worker-participant/v1";
-/** The lane digest binds the fixed holder-then-SigningWorker participant set. */
-export declare const LANE_PARTICIPANT_SET_BINDING_DOMAIN_V1: "seams/rotatable-signing-lanes/lane-participant-set/v1";
-export type LaneHolderParticipantBindingInputV1 = {
+type LaneHolderParticipantBindingInputV1 = {
     readonly participantId: LaneHolderParticipantId;
     readonly custody: LaneHolderCustodyIdentityV1;
     readonly hpkePublicKeyB64u: HpkePublicKeyB64u;
     readonly hpkePublicKeyDigestB64u: SigningWorkerRecipientKeyDigestB64u;
 };
-export type SigningWorkerParticipantBindingInputV1 = {
+type SigningWorkerParticipantBindingInputV1 = {
     readonly participantId: SigningWorkerParticipantId;
     readonly recipient: SigningWorkerRecipientIdentityV1;
 };
-/** LP32(UTF8(value)) from the Refactor 102 canonical encoding. */
+/** LP32(UTF8(value)) from the canonical lane encoding. */
 export declare function encodeLaneCanonicalTextV1(value: string): Uint8Array;
-/** LP32(BASE64URL_DECODE_CANONICAL_32(value)) from the Refactor 102 encoding. */
+/** LP32(BASE64URL_DECODE_CANONICAL_32(value)) from the canonical lane encoding. */
 export declare function encodeLaneCanonicalDigestV1(value: DigestB64u): Uint8Array;
 /** U64(value), encoded as unsigned big-endian bytes. */
 export declare function encodeLaneCanonicalU64V1(value: number): Uint8Array;
-/** Nonempty array count encoding used by enrollment and receipt records. */
-export declare function encodeLaneCanonicalNonEmptyCountV1(count: number): Uint8Array;
-export declare function laneHolderParticipantCanonicalBytesV1(input: LaneHolderParticipantRecordV1): Uint8Array;
-export declare function signingWorkerParticipantCanonicalBytesV1(input: SigningWorkerParticipantRecordV1): Uint8Array;
-/**
- * Canonical bytes for the lane's complete participant set. The order is part
- * of the protocol: holder first, SigningWorker second. Individual participant
- * binding digests are included after their canonical identity bytes so a
- * verified record cannot be substituted while retaining the same identities.
- */
-export declare function laneParticipantSetCanonicalBytesV1(input: {
-    readonly holderParticipant: LaneHolderParticipantRecordV1;
-    readonly signingWorkerParticipant: SigningWorkerParticipantRecordV1;
-}): Uint8Array;
 export declare function computeLaneHolderParticipantBindingDigestV1(input: LaneHolderParticipantBindingInputV1): Promise<LaneParticipantBindingDigestB64u>;
-export declare function computeSigningWorkerParticipantBindingDigestV1(input: SigningWorkerParticipantBindingInputV1): Promise<LaneParticipantBindingDigestB64u>;
 export declare function computeLaneParticipantSetBindingDigestV1(input: {
     readonly holderParticipant: LaneHolderParticipantRecordV1;
     readonly signingWorkerParticipant: SigningWorkerParticipantRecordV1;
 }): Promise<LaneParticipantBindingDigestB64u>;
-export declare function buildLaneHolderParticipantRecordWithDigestV1(input: LaneHolderParticipantBindingInputV1): Promise<LaneHolderParticipantRecordV1>;
 export declare function buildSigningWorkerParticipantRecordWithDigestV1(input: SigningWorkerParticipantBindingInputV1): Promise<SigningWorkerParticipantRecordV1>;
-export declare function assertLaneHolderParticipantBindingDigestV1(record: LaneHolderParticipantRecordV1): Promise<LaneHolderParticipantRecordV1>;
-export declare function assertSigningWorkerParticipantBindingDigestV1(record: SigningWorkerParticipantRecordV1): Promise<SigningWorkerParticipantRecordV1>;
+export {};
 //# sourceMappingURL=participantDigest.d.ts.map