@seams/wallet 0.6.1 → 0.7.1

package/dist/types/shared-ts/src/threshold/keyMaterialBrands.d.ts

@@ -0,0 +1,25 @@
+import type { EcdsaThresholdKeyId } from './ecdsaDerivationRoleLocalBootstrap';
+export type Brand<T, Name extends string> = T & {
+    readonly __brand: Name;
+};
+export type EcdsaDerivationKeyVersion = Brand<string, 'EcdsaDerivationKeyVersion'>;
+export type SigningSessionSealKeyVersion = Brand<string, 'SigningSessionSealKeyVersion'>;
+export type EcdsaClientVerifyingShareB64u = Brand<string, 'EcdsaClientVerifyingShareB64u'>;
+export type Ed25519RelayerKeyId = Brand<string, 'Ed25519RelayerKeyId'>;
+export type EcdsaRelayerKeyId = Brand<string, 'EcdsaRelayerKeyId'>;
+export type EcdsaKeyHandle = Brand<string, 'EcdsaKeyHandle'>;
+export declare function parseNonEmptyBrand<T extends string>(value: unknown, label: string): Brand<string, T>;
+export declare function parseEcdsaDerivationKeyVersion(value: unknown): EcdsaDerivationKeyVersion;
+export declare function parseSigningSessionSealKeyVersion(value: unknown): SigningSessionSealKeyVersion;
+export declare function parseEcdsaClientVerifyingShareB64u(value: unknown): EcdsaClientVerifyingShareB64u;
+export declare function parseEd25519RelayerKeyId(value: unknown): Ed25519RelayerKeyId;
+export declare function parseEcdsaRelayerKeyId(value: unknown): EcdsaRelayerKeyId;
+export declare function parseEcdsaKeyHandle(value: unknown): EcdsaKeyHandle;
+export declare function formatEcdsaDerivationKeyVersionForWire(value: EcdsaDerivationKeyVersion): string;
+export declare function formatSigningSessionSealKeyVersionForWire(value: SigningSessionSealKeyVersion): string;
+export declare function formatEcdsaClientVerifyingShareB64uForWire(value: EcdsaClientVerifyingShareB64u): string;
+export declare function formatEd25519RelayerKeyIdForWire(value: Ed25519RelayerKeyId): string;
+export declare function formatEcdsaRelayerKeyIdForWire(value: EcdsaRelayerKeyId): string;
+export declare function formatEcdsaThresholdKeyIdForWire(value: EcdsaThresholdKeyId): string;
+export declare function formatEcdsaKeyHandleForWire(value: EcdsaKeyHandle): string;
+//# sourceMappingURL=keyMaterialBrands.d.ts.map

package/dist/types/shared-ts/src/threshold/participants.d.ts

@@ -1,4 +1,4 @@
-export type ThresholdParticipantRole = 'client' | 'relayer';
+type ThresholdParticipantRole = 'client' | 'relayer';
 export declare const THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID: 1;
 export declare const THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID: 2;
 export declare const THRESHOLD_ED25519_2P_PARTICIPANT_IDS: readonly [1, 2];
@@ -6,7 +6,7 @@ export declare const THRESHOLD_ED25519_2P_PARTICIPANT_IDS: readonly [1, 2];
  * Metadata describing how a participant share is derived/stored.
  * This is informational in v1 and may be used for validation/policy later.
  */
-export type ThresholdEd25519ShareDerivation = 'prf_first_v1' | 'derived_master_secret_v1' | 'kv_random_v1' | 'unknown';
+type ThresholdEd25519ShareDerivation = 'prf_first_v1' | 'derived_master_secret_v1' | 'kv_random_v1' | 'unknown';
 export interface ThresholdEd25519ParticipantV1 {
     /** FROST identifier (1-indexed). */
     id: number;
@@ -17,15 +17,8 @@ export interface ThresholdEd25519ParticipantV1 {
     relayerKeyId?: string;
     shareDerivation?: ThresholdEd25519ShareDerivation;
 }
-export declare const THRESHOLD_ED25519_PARTICIPANT_SET_V1: "threshold_ed25519_participants_v1";
-export interface ThresholdEd25519ParticipantSetV1 {
-    version: typeof THRESHOLD_ED25519_PARTICIPANT_SET_V1;
-    groupPublicKey: string;
-    participants: ThresholdEd25519ParticipantV1[];
-}
 export declare function normalizeThresholdEd25519ParticipantId(id: unknown): number | null;
 export declare function normalizeThresholdEd25519ParticipantIds(input: unknown): number[] | null;
-export declare function areThresholdEd25519ParticipantIds2p(participantIds: number[] | null | undefined, expected?: readonly number[]): boolean;
 export declare function parseThresholdEd25519ParticipantsV1(input: unknown): ThresholdEd25519ParticipantV1[] | null;
 export declare function buildThresholdEd25519Participants2pV1(input: {
     clientParticipantId?: number | null;
@@ -35,4 +28,5 @@ export declare function buildThresholdEd25519Participants2pV1(input: {
     clientShareDerivation?: ThresholdEd25519ShareDerivation | null;
     relayerShareDerivation?: ThresholdEd25519ShareDerivation | null;
 }): ThresholdEd25519ParticipantV1[];
+export {};
 //# sourceMappingURL=participants.d.ts.map

package/dist/types/shared-ts/src/threshold/secp256k1.d.ts

@@ -1,39 +1,2 @@
-/**
- * secp256k1 group order `n`.
- *
- * This is the order of the prime-order subgroup generated by `G` (the base point),
- * as specified by SEC 2 (Recommended Elliptic Curve Domain Parameters).
- *
- * Important:
- * - This is **not** the field modulus `p` (used for x/y coordinate arithmetic).
- * - Scalars for secp256k1 signing/keygen are interpreted modulo `n`.
- *
- * Used by the threshold-secp256k1 ECDSA stack to reduce HKDF-derived bytes into a
- * non-zero scalar in `[1, n-1]`.
- */
-export declare const SECP256K1_ORDER: bigint;
-export type ThresholdSecp256k1Ecdsa2pTopologyV1 = {
-    readonly kind: 'threshold_secp256k1_ecdsa_2p_v1';
-};
-export type ThresholdSecp256k1Ecdsa2pTopologyParseResult = {
-    readonly ok: true;
-    readonly value: ThresholdSecp256k1Ecdsa2pTopologyV1;
-} | {
-    readonly ok: false;
-    readonly message: string;
-};
-export type ThresholdSecp256k1Ecdsa2pParticipantIdsParseResult = {
-    readonly ok: true;
-    readonly value: readonly [1, 2];
-} | {
-    readonly ok: false;
-    readonly message: string;
-};
-export declare const THRESHOLD_SECP256K1_ECDSA_2P_TOPOLOGY_V1: ThresholdSecp256k1Ecdsa2pTopologyV1;
-export declare const THRESHOLD_SECP256K1_ECDSA_2P_CLIENT_ID_V1: 1;
-export declare const THRESHOLD_SECP256K1_ECDSA_2P_RELAYER_ID_V1: 2;
-export declare const THRESHOLD_SECP256K1_ECDSA_2P_THRESHOLD_V1: 2;
 export declare const THRESHOLD_SECP256K1_ECDSA_2P_PARTICIPANT_IDS_V1: readonly [1, 2];
-export declare function parseThresholdSecp256k1Ecdsa2pTopologyV1(value: unknown): ThresholdSecp256k1Ecdsa2pTopologyParseResult;
-export declare function parseThresholdSecp256k1Ecdsa2pParticipantIdsV1(value: unknown): ThresholdSecp256k1Ecdsa2pParticipantIdsParseResult;
 //# sourceMappingURL=secp256k1.d.ts.map

package/dist/types/shared-ts/src/threshold/sessionPolicy.d.ts

@@ -1,5 +1,29 @@
+import type { WebAuthnRpId } from '../utils/domainIds';
 export declare const DEFAULT_WALLET_SESSION_TTL_MS: number;
 export declare const DEFAULT_WALLET_SESSION_REMAINING_USES = 3;
 export declare const MAX_WALLET_SESSION_TTL_MS: number;
 export declare const MAX_WALLET_SESSION_REMAINING_USES = 1000000;
+export type Ed25519AuthorityScope = {
+    kind: 'passkey_rp';
+    rpId: WebAuthnRpId;
+    proofKind?: never;
+    email?: never;
+    provider?: never;
+    providerUserId?: never;
+    challengeId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+} | {
+    kind: 'email_otp';
+    provider: 'google' | 'email';
+    providerUserId: string;
+    proofKind?: never;
+    rpId?: never;
+    email?: never;
+    challengeId?: never;
+    googleEmailOtpRegistrationAttemptId?: never;
+    googleEmailOtpRegistrationOfferId?: never;
+    googleEmailOtpRegistrationCandidateId?: never;
+};
 //# sourceMappingURL=sessionPolicy.d.ts.map

package/dist/types/shared-ts/src/threshold/signingRootScope.d.ts

@@ -4,7 +4,7 @@ export type RuntimePolicyScope = {
     readonly envId: string;
     readonly signingRootVersion: string;
 };
-export type SigningRootScope = {
+type SigningRootScope = {
     readonly signingRootId: string;
     readonly signingRootVersion?: string;
 };
@@ -17,8 +17,5 @@ export declare function normalizeRuntimePolicyScopeFields(input: unknown): Omit<
     readonly signingRootVersion?: string;
 };
 export declare function signingRootScopeFromRuntimePolicyScope(scope: RuntimePolicyScope): SigningRootScope;
-export declare function normalizeSigningRootScope(input: {
-    readonly signingRootId: unknown;
-    readonly signingRootVersion?: unknown;
-}): SigningRootScope;
+export {};
 //# sourceMappingURL=signingRootScope.d.ts.map

package/dist/types/shared-ts/src/utils/addAuthMethodRegistration.d.ts

@@ -3,10 +3,9 @@
  *
  * This lives in the shared package because three parties read the same record:
  * the server that mints it, the browser that passes it to
- * `navigator.credentials.create`, and — since Refactor 103 Phase 8 — the
- * linked-device target preparation that carries it to Device 2. One
- * declaration, so a change to the ceremony cannot silently diverge from what a
- * linked device creates its passkey against.
+ * `navigator.credentials.create`, and the linked-device target preparation that
+ * carries it to Device 2. One declaration, so a change to the ceremony cannot
+ * silently diverge from what a linked device creates its passkey against.
  *
  * Everything here is fixed by the canonical add-auth-method ceremony: two
  * algorithms in a fixed order, a resident key, no attestation, and PRF

package/dist/types/shared-ts/src/utils/addWalletAuthMethod.d.ts

@@ -1,5 +1,5 @@
 /**
- * Refactor 109C — the internal contract for same-device auth-method addition.
+ * The internal contract for same-device auth-method addition.
  *
  * One product action ("Add authentication method") has exactly two branches:
  * a Passkey-only authority adds Email OTP, or an Email-OTP-only authority adds
@@ -21,7 +21,7 @@
 import type { DeviceId, WalletSessionId } from '../authorization/capabilityKinds';
 import type { DigestB64u } from './canonicalPrimitives';
 import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from './domainIds';
-import type { EmailOtpWalletAuthMethodDraftV1, PasskeyWalletAuthMethodDraftV1, WalletAuthMethodRecordV2 } from './registrationIntent';
+import type { ActiveWalletAuthMethodRecordV2, EmailOtpWalletAuthMethodDraftV1, PasskeyWalletAuthMethodDraftV1 } from './walletAuthMethodRecord';
 import type { WalletAuthMethod } from './signerDomain';
 /**
  * The factor family a method belongs to.
@@ -45,7 +45,7 @@ export type AddWalletAuthMethodBranchV1 = 'passkey_to_email_otp' | 'email_otp_to
  * being read as any other integer on the authority — a signer slot, a counter,
  * a timestamp — at the boundaries where all of them arrive as bare numbers.
  */
-export type WalletAuthorityRevocationEpochV1 = number & {
+type WalletAuthorityRevocationEpochV1 = number & {
     readonly __walletAuthorityRevocationEpochBrand: 'WalletAuthorityRevocationEpochV1';
 };
 /**
@@ -53,7 +53,7 @@ export type WalletAuthorityRevocationEpochV1 = number & {
  * target method ID to it, and a client request can neither nominate nor
  * substitute one.
  */
-export type AddWalletAuthMethodCeremonyIdV1 = string & {
+type AddWalletAuthMethodCeremonyIdV1 = string & {
     readonly __addWalletAuthMethodCeremonyIdBrand: 'AddWalletAuthMethodCeremonyIdV1';
 };
 /**
@@ -154,49 +154,6 @@ export type VerifiedAddWalletAuthMethodInputV1 = (AddWalletAuthMethodInputCommon
     readonly sourceProof: VerifiedEmailOtpSourceProofV1;
     readonly target: VerifiedPasskeyTargetV1;
 });
-export type AddWalletAuthMethodFailureReasonV1 = 'source_session_not_selected' | 'source_method_not_active' | 'source_authority_not_active' | 'source_authority_not_full_owner' | 'source_authority_changed' | 'local_installation_incomplete' | 'source_proof_rejected' | 'target_factor_rejected' | 'target_family_present' | 'intent_expired' | 'intent_digest_mismatch' | 'identity_mismatch' | 'custody_reseal_failed' | 'local_persistence_failed' | 'activation_conflict';
-/**
- * The one result union both SDK entry points return. UI control flow switches
- * on `kind`; `reason` and `message` are display and diagnostic data and never
- * select a code path.
- */
-export type AddWalletAuthMethodResultV1 = {
-    readonly kind: 'active';
-    readonly branch: AddWalletAuthMethodBranchV1;
-    readonly walletId: WalletId;
-    readonly walletAuthorityId: WalletAuthorityId;
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly family: WalletAuthMethodFamilyV1;
-    readonly sourceWalletAuthMethodId: WalletAuthMethodId;
-    readonly sourceWalletSessionId: WalletSessionId;
-} | {
-    readonly kind: 'already_configured';
-    readonly walletId: WalletId;
-    readonly walletAuthorityId: WalletAuthorityId;
-    readonly family: WalletAuthMethodFamilyV1;
-    readonly existingWalletAuthMethodId: WalletAuthMethodId;
-} | {
-    readonly kind: 'cancelled';
-    readonly branch: AddWalletAuthMethodBranchV1;
-} | {
-    readonly kind: 'expired';
-    readonly branch: AddWalletAuthMethodBranchV1;
-} | {
-    readonly kind: 'unauthorized';
-    readonly branch: AddWalletAuthMethodBranchV1;
-    readonly reason: AddWalletAuthMethodFailureReasonV1;
-    readonly message: string;
-} | {
-    readonly kind: 'target_verification_failed';
-    readonly branch: AddWalletAuthMethodBranchV1;
-    readonly reason: AddWalletAuthMethodFailureReasonV1;
-    readonly message: string;
-} | {
-    readonly kind: 'integrity_error';
-    readonly branch: AddWalletAuthMethodBranchV1;
-    readonly reason: AddWalletAuthMethodFailureReasonV1;
-    readonly message: string;
-};
 /**
  * Admission: what the operation does before it verifies anything.
  *
@@ -205,7 +162,7 @@ export type AddWalletAuthMethodResultV1 = {
  * holds. Resolving it here is what keeps the promise that a present family
  * never reaches target verification or a local write.
  */
-export type AddWalletAuthMethodAdmissionV1 = {
+type AddWalletAuthMethodAdmissionV1 = {
     readonly kind: 'proceed';
     readonly branch: AddWalletAuthMethodBranchV1;
 } | {
@@ -227,69 +184,11 @@ export declare function addWalletAuthMethodSourceFamily(branch: AddWalletAuthMet
  * which is why the operation needs no same-family rejection of its own.
  */
 export declare function admitAddWalletAuthMethod(input: {
-    readonly sourceMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly sourceMethod: ActiveWalletAuthMethodRecordV2;
     readonly targetFamily: WalletAuthMethodFamilyV1;
-    readonly activeMethodsOnAuthority: readonly Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>[];
+    readonly activeMethodsOnAuthority: readonly ActiveWalletAuthMethodRecordV2[];
 }): AddWalletAuthMethodAdmissionV1;
 export declare function parseWalletAuthorityRevocationEpochV1(value: unknown): WalletAuthorityRevocationEpochV1;
 export declare function parseAddWalletAuthMethodCeremonyIdV1(value: unknown): AddWalletAuthMethodCeremonyIdV1;
-/**
- * The one place raw source identity becomes branded. Every field is read from
- * the resolved session and authority, so a caller cannot widen the source by
- * supplying an extra one.
- */
-export declare function parseAddWalletAuthMethodSourceV1(raw: {
-    readonly walletId: unknown;
-    readonly walletAuthorityId: unknown;
-    readonly sourceWalletAuthMethodId: unknown;
-    readonly sourceWalletSessionId: unknown;
-    readonly deviceId: unknown;
-    readonly authorityDigestB64u: unknown;
-    readonly revocationEpoch: unknown;
-}): AddWalletAuthMethodSourceV1;
-export declare function parseAddWalletAuthMethodIntentIdentityV1(raw: {
-    readonly addAuthMethodCeremonyId: unknown;
-    readonly intentDigestB64u: unknown;
-    readonly targetWalletAuthMethodId: unknown;
-    readonly expiresAtMs: unknown;
-}): AddWalletAuthMethodIntentIdentityV1;
-/**
- * Branch-specific builders rather than one constructor with a `branch`
- * parameter: each accepts only the proof and target its branch can hold, so a
- * mismatched pair is a compile error at the call site instead of a runtime
- * check inside the operation.
- */
-export declare function buildPasskeyToEmailOtpAdditionV1(input: {
-    readonly source: AddWalletAuthMethodSourceV1;
-    readonly intent: AddWalletAuthMethodIntentIdentityV1;
-    readonly sourceProof: VerifiedPasskeySourceProofV1;
-    readonly target: VerifiedEmailOtpTargetV1;
-}): Extract<VerifiedAddWalletAuthMethodInputV1, {
-    readonly branch: 'passkey_to_email_otp';
-}>;
-export declare function buildEmailOtpToPasskeyAdditionV1(input: {
-    readonly source: AddWalletAuthMethodSourceV1;
-    readonly intent: AddWalletAuthMethodIntentIdentityV1;
-    readonly sourceProof: VerifiedEmailOtpSourceProofV1;
-    readonly target: VerifiedPasskeyTargetV1;
-}): Extract<VerifiedAddWalletAuthMethodInputV1, {
-    readonly branch: 'email_otp_to_passkey';
-}>;
-/**
- * The exact active record the activation stage inserts.
- *
- * It reuses the source authority and the server-allocated target method ID,
- * and it is built from the verified target draft alone — no field is carried
- * across from the source method, which is what keeps addition from copying
- * permissions, activations, or credential identity onto the new method.
- */
-export declare function buildAddedWalletAuthMethodRecordV2Input(input: {
-    readonly verified: VerifiedAddWalletAuthMethodInputV1;
-    readonly nowMs: number;
-}): WalletAuthMethodRecordV2;
 export {};
 //# sourceMappingURL=addWalletAuthMethod.d.ts.map

package/dist/types/shared-ts/src/utils/addWalletAuthMethod.typecheck.d.ts

@@ -1,11 +1,24 @@
 /**
- * Compile-time fixtures for the Refactor 109C addition contract.
+ * Compile-time fixtures for the same-device auth-method addition contract.
  *
- * Every `@ts-expect-error` below is a state R109C forbids. If one of them ever
+ * Every `@ts-expect-error` below is a state the contract forbids. If one ever
  * starts compiling, the branch union has been widened — a same-family
  * addition, a mixed target draft, an unverified value, or a cast has become
  * expressible — and this file fails the build rather than the behaviour
  * failing in a browser.
  */
-export {};
+import { type AddWalletAuthMethodIntentIdentityV1, type VerifiedAddWalletAuthMethodSourceProofV1, type VerifiedAddWalletAuthMethodTargetV1 } from './addWalletAuthMethod';
+export declare const intent: AddWalletAuthMethodIntentIdentityV1;
+export declare const passkeySourceProof: Extract<VerifiedAddWalletAuthMethodSourceProofV1, {
+    kind: 'verified_passkey_source_proof_v1';
+}>;
+export declare const emailOtpSourceProof: Extract<VerifiedAddWalletAuthMethodSourceProofV1, {
+    kind: 'verified_email_otp_source_proof_v1';
+}>;
+export declare const emailOtpTarget: Extract<VerifiedAddWalletAuthMethodTargetV1, {
+    kind: 'verified_email_otp_target_v1';
+}>;
+export declare const passkeyTarget: Extract<VerifiedAddWalletAuthMethodTargetV1, {
+    kind: 'verified_passkey_target_v1';
+}>;
 //# sourceMappingURL=addWalletAuthMethod.typecheck.d.ts.map

package/dist/types/shared-ts/src/utils/canonicalPrimitives.d.ts

@@ -8,5 +8,7 @@ export declare function parseCorrelationId(value: unknown): CorrelationId;
 export declare function parseDigestB64u(value: unknown): DigestB64u;
 export declare function parseIsoTimestamp(value: unknown): IsoTimestamp;
 export declare function isoTimestampFromUnixMs(value: unknown): IsoTimestamp;
+export declare function sha256DigestB64u(bytes: Uint8Array): Promise<DigestB64u>;
+export declare function sha256Utf8DigestB64u(text: string): Promise<DigestB64u>;
 export {};
 //# sourceMappingURL=canonicalPrimitives.d.ts.map

package/dist/types/shared-ts/src/utils/digestEncoding.d.ts

@@ -0,0 +1,9 @@
+import { type DigestB64u } from './canonicalPrimitives';
+export declare function concat(parts: readonly Uint8Array[]): Uint8Array;
+export declare function u32(value: number, label: string): Uint8Array;
+export declare function u64(value: number, label: string): Uint8Array;
+export declare function lp32(value: Uint8Array, label: string): Uint8Array;
+export declare function text(value: string, label: string): Uint8Array;
+export declare function rawDigest(value: DigestB64u, label: string): Uint8Array;
+export declare function rawPublicKey(value: string, label: string): Uint8Array;
+//# sourceMappingURL=digestEncoding.d.ts.map

package/dist/types/shared-ts/src/utils/domainIds.d.ts

@@ -1,7 +1,7 @@
 export type DomainId<TBrand extends string> = string & {
     readonly __domainIdBrand: TBrand;
 };
-export type DomainIdParseError = {
+type DomainIdParseError = {
     code: 'missing' | 'invalid';
     message: string;
 };
@@ -117,7 +117,6 @@ export declare function parseMpcRegisteredPublicKeyBindingRef(raw: unknown): Dom
 export declare function buildMpcMaterialActivationRef(fields: MpcMaterialActivationRefFields): MpcMaterialActivationRef;
 export declare function mpcMaterialActivationRefsEqual(left: MpcMaterialActivationRef, right: MpcMaterialActivationRef): boolean;
 export declare function parseMpcMaterialActivationRef(raw: unknown): DomainIdParseResult<MpcMaterialActivationRef>;
-export declare function formatWebAuthnRpIdForWire(value: WebAuthnRpId): string;
 export declare function parseThresholdEd25519SessionId(raw: unknown): DomainIdParseResult<ThresholdEd25519SessionId>;
 export declare function parseThresholdEcdsaSessionId(raw: unknown): DomainIdParseResult<ThresholdEcdsaSessionId>;
 export declare function parseEcdsaActiveStateId(raw: unknown): DomainIdParseResult<EcdsaActiveStateId>;

package/dist/types/shared-ts/src/utils/ecdsaKeyFactsInventory.d.ts

@@ -8,7 +8,7 @@ type EcdsaInventoryChainTarget = {
     chainId: number;
     networkSlug?: string;
 };
-export type WalletEcdsaKeyFactsInventoryChallengeInput = {
+type WalletEcdsaKeyFactsInventoryChallengeInput = {
     walletId: string;
     rpId: string;
     keyTargets: readonly {
@@ -18,7 +18,6 @@ export type WalletEcdsaKeyFactsInventoryChallengeInput = {
     runtimePolicyScope?: unknown;
     serverNonceB64u: string;
 };
-export declare function canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input: WalletEcdsaKeyFactsInventoryChallengeInput): string;
 export declare function computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u(input: WalletEcdsaKeyFactsInventoryChallengeInput): Promise<string>;
 export {};
 //# sourceMappingURL=ecdsaKeyFactsInventory.d.ts.map

package/dist/types/shared-ts/src/utils/emailOtpDomain.d.ts

@@ -1,14 +1,14 @@
 export declare const EMAIL_OTP_CHANNEL: "email_otp";
 export declare const EMAIL_OTP_INITIAL_ENROLLMENT_VERSION: "1";
 export declare function emailOtpDeviceEnrollmentId(walletId: string, providerSubject: string): string;
-export declare const WALLET_UNLOCK_BACKENDS: readonly ["passkey", "email_otp"];
+declare const WALLET_UNLOCK_BACKENDS: readonly ["passkey", "email_otp"];
 export type WalletUnlockBackend = (typeof WALLET_UNLOCK_BACKENDS)[number];
 export type WalletEmailOtpChannel = typeof EMAIL_OTP_CHANNEL;
-export declare const WALLET_EMAIL_OTP_LOGIN_OPERATIONS: readonly ["wallet_unlock", "transaction_sign", "export_key"];
+declare const WALLET_EMAIL_OTP_LOGIN_OPERATIONS: readonly ["wallet_unlock", "transaction_sign", "export_key"];
 export type WalletEmailOtpLoginOperation = (typeof WALLET_EMAIL_OTP_LOGIN_OPERATIONS)[number];
 export declare const WALLET_EMAIL_OTP_REGISTRATION_OPERATION: "registration";
-/** Linked-device enrollment (Refactor 103 Phase 6): prove control of the
- * wallet's enrolled email destination to complete one device link. */
+/** Linked-device enrollment: prove control of the wallet's enrolled email
+ * destination to complete one device link. */
 export declare const WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION: "device_link";
 export type WalletEmailOtpOperation = WalletEmailOtpLoginOperation | typeof WALLET_EMAIL_OTP_REGISTRATION_OPERATION | typeof WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION;
 export declare const WALLET_EMAIL_OTP_ACTIONS: {
@@ -24,7 +24,7 @@ export declare const WALLET_EMAIL_OTP_UNLOCK_OPERATION: "wallet_unlock";
 export declare const WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION: "transaction_sign";
 export type WalletEmailOtpExportOperation = typeof WALLET_EMAIL_OTP_EXPORT_OPERATION;
 export type WalletEmailOtpTransactionSignOperation = typeof WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION;
-export type WalletEmailOtpUnlockOperation = typeof WALLET_EMAIL_OTP_UNLOCK_OPERATION;
 export declare function isWalletUnlockBackend(value: string): value is WalletUnlockBackend;
 export declare function isWalletEmailOtpLoginOperation(value: string): value is WalletEmailOtpLoginOperation;
+export {};
 //# sourceMappingURL=emailOtpDomain.d.ts.map

package/dist/types/shared-ts/src/utils/emailOtpRecoveryKey.d.ts

@@ -25,7 +25,5 @@ export declare function formatEmailOtpRecoveryKey(normalizedKey: string): EmailO
 export declare function buildEmailOtpRecoveryCodeSet(keys: readonly string[]): EmailOtpRecoveryCodeSet;
 export declare function normalizeEmailOtpRecoveryKey(input: string): string;
 export declare function decodeEmailOtpRecoveryKey(input: string): Uint8Array;
-export declare function generateEmailOtpRecoveryKey(): string;
-export declare function generateEmailOtpRecoveryKeySet(): EmailOtpRecoveryCodeSet;
 export {};
 //# sourceMappingURL=emailOtpRecoveryKey.d.ts.map

package/dist/types/shared-ts/src/utils/errors.d.ts

@@ -7,7 +7,6 @@ export { formatNearRpcError, getNearShortErrorMessage } from './near';
  * Always returns a string (may be empty when nothing usable can be derived).
  */
 export declare function errorMessage(err: unknown): string;
-export declare function redactSensitiveErrorText(input: string): string;
 export declare function safeErrorMessage(err: unknown): string;
 export declare function errorLogSummary(err: unknown): {
     name: string;
@@ -27,12 +26,6 @@ export declare function toError(e: unknown): Error;
 export declare function isTouchIdCancellationError(error: unknown): boolean;
 export declare function isWebAuthnRpIdOriginConfigurationError(error: unknown): boolean;
 export declare function isUserCancellationError(error: unknown): boolean;
-/**
- * Get a user-friendly error message for TouchID/FaceID cancellation
- * @param context - The context where the cancellation occurred (e.g., 'registration', 'login')
- * @returns A user-friendly error message
- */
-export declare function getTouchIdCancellationMessage(context: 'registration' | 'login'): string;
 /**
  * Transform an error message to be more user-friendly
  * @param error - The original error object or message

package/dist/types/shared-ts/src/utils/exactRecord.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Rejects every field outside this record's exact shape.
+ *
+ * `knownOnOtherBranches` names fields that are legitimate public bindings
+ * somewhere else in the same union. Those are reported as the branch mismatch
+ * they are; only genuinely unknown fields are classified as leaks, so a public
+ * key like `clientRootPublicKey33B64u` on the wrong branch is never mistaken
+ * for plaintext custody material.
+ */
+export declare function rejectUnknownFields(record: Record<string, unknown>, allowed: readonly string[], label: string, knownOnOtherBranches?: readonly string[]): void;
+export declare function exactRecord(raw: unknown, fields: readonly string[], label: string): Record<string, unknown>;
+//# sourceMappingURL=exactRecord.d.ts.map

package/dist/types/shared-ts/src/utils/index.d.ts

@@ -11,13 +11,15 @@ export * from './theme';
 export * from './keccak';
 export * from './jsonRpc';
 export * from './nearRpcResults';
-export * from './recoveryDomain';
-export * from './paillier';
 export * from './signingSessionSeal';
 export * from './emailOtpRecoveryKey';
 export * from './addAuthMethodRegistration';
 export * from './addWalletAuthMethod';
 export * from './registrationIntent';
+export * from './walletAuthMethodRecord';
+export * from './registrationIds';
+export * from './registrationSignerPlan';
+export { normalizeAddAuthMethodInput, normalizeEmailOtpRegistrationProof, normalizeRegistrationAuthMethodInput, type AddAuthMethodInput, type EmailOtpRegistrationAuthMethodInput, type EmailOtpRegistrationProof, type PasskeyRegistrationAuthMethodInput, type RegisterWalletInput, type RegistrationAuthMethodInput, type RegistrationAuthority, type WalletAddAuthMethodEmailOtpTargetV1, type WalletEmailOtpEnrollmentMaterialV1, } from './registrationAuthMethodInput';
 export * from './domainIds';
 export * from './webauthnDeviceInfo';
 export * from './walletCapabilityBindings';
@@ -27,6 +29,7 @@ export * from './secureRandomId';
 export * from './routerAbPublicKeyset';
 export * from './routerAbEcdsaDerivation';
 export * from './routerAbEd25519Yao';
+export { deriveRouterAbEd25519YaoApplicationBindingDigestV1, deriveRouterAbEd25519YaoExportAuthorizationDigestV1, deriveRouterAbEd25519YaoExportConfirmationDigestV1, deriveRouterAbEd25519YaoRuntimePolicyBindingV1, deriveRouterAbEd25519YaoStableContextBindingV1, } from './routerAbEd25519YaoDigests';
 export * from './routerAbTraceContext';
 export * from './authenticatorOptions';
 export * from './canonicalPrimitives';

package/dist/types/shared-ts/src/utils/jsonRpc.d.ts

@@ -1,4 +1,4 @@
-export type JsonRpcId = string | number | null;
+type JsonRpcId = string | number | null;
 export type JsonRpcErrorDetails = {
     code?: number | string;
     name?: string;
@@ -17,7 +17,7 @@ export type JsonRpcEnvelope = {
     error: JsonRpcErrorDetails;
     result?: never;
 };
-export type JsonRpcEnvelopeDecodeResult = {
+type JsonRpcEnvelopeDecodeResult = {
     ok: true;
     value: JsonRpcEnvelope;
     error?: never;
@@ -27,4 +27,5 @@ export type JsonRpcEnvelopeDecodeResult = {
     value?: never;
 };
 export declare function decodeJsonRpcEnvelope(value: unknown): JsonRpcEnvelopeDecodeResult;
+export {};
 //# sourceMappingURL=jsonRpc.d.ts.map

package/dist/types/shared-ts/src/utils/near.d.ts

@@ -38,7 +38,7 @@ export declare function validateNearAccountId(nearAccountId: string, options?: N
  * - chars: lowercase letters, digits, `_`, `.`, `-`
  */
 export declare function isValidAccountId(accountId: unknown): accountId is string;
-export type NearAccountIdParseResult<T> = {
+type NearAccountIdParseResult<T> = {
     ok: true;
     value: T;
 } | {
@@ -78,4 +78,5 @@ export declare function formatNearRpcError(operationName: string, rpc: {
  * Falls back to undefined when structure is not recognized.
  */
 export declare function getNearShortErrorMessage(error: unknown): string | undefined;
+export {};
 //# sourceMappingURL=near.d.ts.map

package/dist/types/shared-ts/src/utils/nearRpcResults.d.ts

@@ -1,19 +1,19 @@
 import { ExecutionStatusBasic, FinalExecutionStatusBasic, type ExecutionError, type TxExecutionStatus } from '@near-js/types';
 export type NearRpcResultDecoder<T> = (value: unknown) => T;
-export type DecodedNearFunctionCallPermission = {
+type DecodedNearFunctionCallPermission = {
     FunctionCall: {
         allowance: string;
         receiver_id: string;
         method_names: string[];
     };
 };
-export type DecodedNearAccessKeyView = {
+type DecodedNearAccessKeyView = {
     block_height: number;
     block_hash: string;
     nonce: bigint;
     permission: 'FullAccess' | DecodedNearFunctionCallPermission;
 };
-export type DecodedNearAccessKeyList = {
+type DecodedNearAccessKeyList = {
     block_height: number;
     block_hash: string;
     keys: Array<{
@@ -21,7 +21,7 @@ export type DecodedNearAccessKeyList = {
         access_key: DecodedNearAccessKeyView;
     }>;
 };
-export type DecodedNearAccountView = {
+type DecodedNearAccountView = {
     block_height: number;
     block_hash: string;
     amount: bigint;
@@ -36,7 +36,7 @@ export type DecodedNearBlockReference = {
         height: number;
     };
 };
-export type DecodedNearContractCallResult = {
+type DecodedNearContractCallResult = {
     block_height: number;
     block_hash: string;
     logs: string[];
@@ -46,14 +46,14 @@ type DecodedNearExecutionError = ExecutionError & {
     InvalidTxError?: unknown;
     ActionError?: unknown;
 };
-export type DecodedNearFinalExecutionStatus = {
+type DecodedNearFinalExecutionStatus = {
     SuccessValue: string;
     Failure?: never;
 } | {
     Failure: DecodedNearExecutionError;
     SuccessValue?: never;
 } | FinalExecutionStatusBasic;
-export type DecodedNearExecutionStatus = {
+type DecodedNearExecutionStatus = {
     SuccessValue: string;
     SuccessReceiptId?: never;
     Failure?: never;

package/dist/types/shared-ts/src/utils/normalize.d.ts

@@ -11,10 +11,6 @@ export declare function normalizeOptionalTrimmedString(value: unknown): string;
 export declare function normalizeTrimmedString(value: unknown): string;
 /** String coercion + trimming + lowercase. */
 export declare function normalizeLowercaseString(value: unknown): string;
-/** String coercion + trimming + uppercase. */
-export declare function normalizeUppercaseString(value: unknown): string;
-/** Normalize session kind into the canonical `'jwt' | 'cookie'` token. */
-export declare function normalizeJwtCookieSessionKind(value: unknown): 'jwt' | 'cookie';
 /** String coercion + trimming; empty => undefined. */
 export declare function normalizeOptionalNonEmptyString(value: unknown): string | undefined;
 /** Convert unknown to finite number; non-finite => null. */