@seams/wallet 0.6.1 → 0.7.1

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/emailOtp/registrationOffer.d.ts

@@ -1,4 +1,3 @@
-import type { GoogleEmailOtpRegistrationFinalizeInput, GoogleEmailOtpRegistrationOffer } from '../../../publicApi/types';
+import type { GoogleEmailOtpRegistrationOffer } from '../../../publicApi/types';
 export declare function parseGoogleEmailOtpRegistrationOffer(value: unknown): GoogleEmailOtpRegistrationOffer;
-export declare function parseGoogleEmailOtpRegistrationFinalizeInput(value: unknown): GoogleEmailOtpRegistrationFinalizeInput;
 //# sourceMappingURL=registrationOffer.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/passkey/exactPasskeyAuthority.d.ts

@@ -0,0 +1,20 @@
+import type { WalletId } from '../../../../core/signingEngine/interfaces/ecdsaChainTarget';
+import { type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { ActivePasskeyWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+/**
+ * The wallet's one active passkey method for this credential. The local
+ * auth-method store is the one source that names a wallet's methods: a method
+ * id derived from the credential is not the id the wallet registered it under.
+ */
+export declare function exactPasskeyWalletAuthMethodForCredential(args: {
+    readonly walletId: WalletId;
+    readonly rpId: string;
+    readonly credentialIdB64u: string;
+}): Promise<ActivePasskeyWalletAuthMethodRecordV2>;
+/** The authority reference of the wallet's active passkey method for this credential. */
+export declare function exactPasskeyWalletAuthAuthorityRefForCredential(args: {
+    readonly walletId: WalletId;
+    readonly rpId: string;
+    readonly credentialIdB64u: string;
+}): Promise<WalletAuthAuthorityRef>;
+//# sourceMappingURL=exactPasskeyAuthority.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/passkey/localPasskeyProjection.d.ts

@@ -1,23 +1,18 @@
 import { type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
-import { type WalletAuthMethodRecordV2, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
-import type { ActiveRecoveredWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
-import { type LocalWalletAuthMethodRecord } from '../../../../core/indexedDB';
+import { type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
 /** The finalize fields this projection is built from, whichever route returned them. */
-export type FinalizedPasskeyAuthMethodV1 = {
+type FinalizedPasskeyAuthMethodV1 = {
     readonly walletId: WalletId;
     readonly rpId: string;
     readonly credentialIdB64u: string;
     readonly credentialPublicKeyB64u: string;
     readonly counter: number;
 };
-export declare function localPasskeyAuthMethodFromFinalizeV1(args: FinalizedPasskeyAuthMethodV1): LocalWalletAuthMethodRecord & {
-    kind: 'passkey';
-};
 /** Writes the projection for a factor the server has already accepted. */
 export declare function persistFinalizedPasskeyAuthMethodV1(args: FinalizedPasskeyAuthMethodV1): Promise<void>;
 /**
- * Refactor 109C: the full local install for a passkey added to a wallet that
- * registered with another family.
+ * The full local install for a passkey added to a wallet that registered with
+ * another family.
  *
  * Three records, and unlock needs all of them. It reads the profile, then the
  * profile's authenticators, then keeps only those whose credential belongs to
@@ -43,38 +38,5 @@ export declare function persistAddedCrossFamilyPasskeyV1(args: {
         readonly rawId: string;
     };
 }): Promise<void>;
-export type SyncedPasskeyAuthMethodV2 = {
-    readonly walletId: WalletId;
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly walletAuthorityId: WalletAuthorityId;
-    readonly rpId: string;
-    readonly credentialIdB64u: string;
-    readonly credentialPublicKeyB64u: string;
-    readonly counter: number;
-};
-export declare function localPasskeyAuthMethodFromSyncV2(args: SyncedPasskeyAuthMethodV2): Extract<WalletAuthMethodRecordV2, {
-    kind: 'passkey';
-    status: 'active';
-}>;
-export declare function persistSyncedPasskeyAuthMethodV2(args: SyncedPasskeyAuthMethodV2): Promise<void>;
-type RecoveredPasskeyLocalProjection = {
-    readonly authority: ActiveRecoveredWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'passkey';
-        readonly status: 'active';
-    }>;
-    readonly credential: {
-        readonly id: string;
-        readonly rawId: string;
-    };
-} & ({
-    readonly kind: 'near';
-    readonly signerSlot?: never;
-} | {
-    readonly kind: 'wallet_only';
-    readonly signerSlot: number;
-});
-/** Rebuilds the local identity required by exact-wallet login after recovery. */
-export declare function persistRecoveredPasskeyAuthMethodProjectionV1(input: RecoveredPasskeyLocalProjection): Promise<void>;
 export {};
 //# sourceMappingURL=localPasskeyProjection.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/passkey/registrationAuthority.d.ts

@@ -3,7 +3,7 @@ import type { WebAuthnRegistrationCredential } from '../../../../core/types/weba
 import type { ConfirmationConfig } from '../../../../core/types/signer-worker';
 import type { WebAuthnRegistrationConfirmationSurface } from '../../../signingSurface/types';
 import type { WalletId } from '../../../../core/signingEngine/interfaces/ecdsaChainTarget';
-export type PasskeyRegistrationAuthorityMaterial = {
+type PasskeyRegistrationAuthorityMaterial = {
     kind: 'passkey';
     credential: WebAuthnRegistrationCredential;
     webauthnRegistration: WebAuthnRegistrationCredential;
@@ -43,4 +43,5 @@ export declare function collectPasskeyRegistrationAuthority(args: {
     options: RegistrationHooksOptions;
     confirmationConfigOverride: Partial<ConfirmationConfig>;
 }): Promise<PasskeyRegistrationAuthorityMaterial>;
+export {};
 //# sourceMappingURL=registrationAuthority.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/revokeAuthMethod.d.ts

@@ -1,8 +1,6 @@
-import { type WalletId, type WalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/registrationIntent';
+import { type WalletId } from '../../../../../shared-ts/src/utils/registrationIntent';
 import { type WalletAuthMethodId } from '../../../../../shared-ts/src/utils/domainIds';
-import type { WebAuthnAllowCredential } from '../../../core/signingEngine/webauthnAuth/credentials/collectAuthenticationCredentialForChallengeB64u';
 import type { RegistrationWebContext } from '../../signingSurface/types';
-import type { ProfileAuthenticatorRecord } from '../../../core/indexedDB';
 export type RevokeAuthMethodResult = {
     readonly ok: true;
     readonly walletId: WalletId;
@@ -12,12 +10,6 @@ export type RevokeAuthMethodResult = {
         readonly status: 'revoked';
     };
 };
-export declare function passkeySourceCredentialsForActiveMethods(args: {
-    readonly walletId: WalletId;
-    readonly authenticators: readonly ProfileAuthenticatorRecord[];
-    readonly authMethods: readonly WalletAuthMethodRecordV2[];
-    readonly excludeCredentialIdB64u: string | null;
-}): WebAuthnAllowCredential[];
 export declare function revokeWalletAuthMethodOperation(args: {
     readonly context: RegistrationWebContext;
     readonly walletId: WalletId | string;

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/sourcePasskeyProof.d.ts

@@ -1,9 +1,4 @@
 import type { WebAuthnAllowCredential } from '../../../core/signingEngine/webauthnAuth/credentials/collectAuthenticationCredentialForChallengeB64u';
-import type { WalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/registrationIntent';
-type ActivePasskeyWalletAuthMethod = Extract<WalletAuthMethodRecordV2, {
-    readonly kind: 'passkey';
-    readonly status: 'active';
-}>;
-export declare function addAuthMethodSourcePasskeyAllowCredentials(sourceAuthMethod: ActivePasskeyWalletAuthMethod): [WebAuthnAllowCredential];
-export {};
+import type { ActivePasskeyWalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+export declare function addAuthMethodSourcePasskeyAllowCredentials(sourceAuthMethod: ActivePasskeyWalletAuthMethodRecordV2): [WebAuthnAllowCredential];
 //# sourceMappingURL=sourcePasskeyProof.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/devices/deviceLinkingAuthorityInstallation.d.ts

@@ -99,19 +99,6 @@ export type DeviceLinkingAuthorityActivationFlowInputV1 = {
     readonly nowMs: () => number;
 };
 export declare function createDeviceLinkingAuthorityInstallationPortV1(options: DeviceLinkingAuthorityInstallationAssemblyOptionsV1): DeviceLinkingAuthorityInstallationPortV1;
-export declare function createDeviceLinkingDeliveryResumePortV1(input: {
-    readonly indexedDB: UnifiedIndexedDBManager;
-}): DeviceLinkingDeliveryResumePortV1;
-export declare function installLocalAuthorityV1(input: {
-    readonly indexedDB: UnifiedIndexedDBManager;
-    readonly sealing: DeviceLinkingCommittedPackageSealingPortV1;
-    readonly nowMs: () => number;
-    readonly committed: CommittedAuthorityPackagesV1;
-    readonly targetFactor: VerifiedTargetFactorV1;
-    readonly keyMaterial: DeviceLinkingKeyMaterialHandleV1;
-    readonly resealedExportRoot: DeviceLinkingResealedEd25519ExportRootV1 | null;
-    readonly expectedLockGeneration: number;
-}): Promise<LocalAuthorityInstallationReceiptV1>;
 export declare function finalizeLocalAuthorityActivationV1(input: {
     readonly indexedDB: UnifiedIndexedDBManager;
     readonly active: Extract<ActivateInstalledAuthorityResultV1, {

package/dist/types/wallet/src/SeamsWeb/operations/devices/deviceLinkingComposition.d.ts

@@ -3,31 +3,12 @@ import type { AuthenticatorPort } from '../../../core/platform';
 import type { HttpTransport } from '../../../core/platform/http';
 import { type DeviceLinkingWorkerEndpointV1 } from './deviceLinkingWorkerChannels';
 import { type LinkSessionOwnerApprovalUpdatesPortV1, type LinkSessionOwnerAuthenticatedRequestPortV1 } from './deviceLinkingOwnerTransport';
-import { type DeviceLinkingDeliveryResumePortV1 } from './deviceLinkingAuthorityInstallation';
-import type { DeviceLinkingFlowPortsV1, DeviceLinkingOwnerAuthorizationPortV1, DeviceLinkingSourceContributionPortV1, DeviceLinkingWalletSessionAcknowledgementReplayPortV1 } from './deviceLinkingPorts';
-import type { WalletSessionOperationCredentialV1 } from '../../../../../shared-ts/src/device-linking';
-import type { WalletAuthMethodId, WalletAuthorityId, WalletId } from '../../../../../shared-ts/src/utils/domainIds';
+import type { DeviceLinkingFlowPortsV1, DeviceLinkingOwnerAuthorizationPortV1, DeviceLinkingSourceContributionPortV1 } from './deviceLinkingPorts';
 export type DeviceLinkingFlowPortsAssemblyV1 = DeviceLinkingFlowPortsV1 & {
     readonly resumePendingAcknowledgementsV1: () => Promise<void>;
     readonly dispose: () => void;
 };
-type DeviceLinkingAcknowledgementExactSessionReadV1 = {
-    readonly kind: 'found';
-    readonly operationCredential: WalletSessionOperationCredentialV1;
-} | {
-    readonly kind: 'missing';
-};
-export type DeviceLinkingAcknowledgementExactSessionReaderV1 = (input: {
-    readonly walletId: WalletId;
-    readonly authorityId: WalletAuthorityId;
-    readonly authMethodId: WalletAuthMethodId;
-}) => Promise<DeviceLinkingAcknowledgementExactSessionReadV1>;
-export declare function resumePendingDeviceLinkingAcknowledgementsV1(input: {
-    readonly installation: DeviceLinkingDeliveryResumePortV1;
-    readonly transport: DeviceLinkingWalletSessionAcknowledgementReplayPortV1;
-    readonly readExactSession: DeviceLinkingAcknowledgementExactSessionReaderV1;
-}): Promise<void>;
-export type DeviceLinkingFlowPortsAssemblyOptionsV1 = {
+type DeviceLinkingFlowPortsAssemblyOptionsV1 = {
     readonly authenticator: AuthenticatorPort;
     readonly http: HttpTransport;
     readonly relayerUrl: string;

package/dist/types/wallet/src/SeamsWeb/operations/devices/deviceLinkingEd25519ExportRoot.d.ts

@@ -7,7 +7,7 @@ import type { DigestB64u } from '../../../../../shared-ts/src/utils/canonicalPri
 import type { Ed25519PublicKeyB64u } from '../../../../../shared-ts/src/passkey-custody/primitives';
 import type { WalletId } from '../../../../../shared-ts/src/utils/domainIds';
 import type { WalletCustodyCeremonyTransportPort } from '../../../core/signingEngine/walletCustody/ceremonyStepRunner';
-import type { UnlockedWalletEd25519ExportRootCapabilityV1 } from '../../../core/signingEngine/workerManager/workerTypes';
+import type { UnlockedEd25519ExportRootLinkingCapabilityV1 } from '../../../core/signingEngine/workerManager/workerTypes';
 export type DeviceLinkingEd25519ExportRootIdentityV1 = {
     readonly linkSessionId: LinkDeviceSessionId;
     readonly walletId: WalletId;
@@ -37,7 +37,7 @@ export type DeviceLinkingEd25519ExportRootPortV1 = {
     }) => Promise<DeviceLinkingEd25519ExportRootRecipientHandleV1>;
     readonly sealForLinkedDeviceV1: (input: {
         readonly recipient: LinkedDeviceEd25519ExportRootRecipientV1;
-        readonly capability: UnlockedWalletEd25519ExportRootCapabilityV1;
+        readonly capability: UnlockedEd25519ExportRootLinkingCapabilityV1;
         readonly sealedAtMs: number;
     }) => Promise<LinkedDeviceEd25519ExportRootPackageV1>;
     readonly acceptTransferV1: (input: {

package/dist/types/wallet/src/SeamsWeb/operations/devices/deviceLinkingHttpTransport.d.ts

@@ -1,21 +1,9 @@
-import type { LinkDevicePublicKeyB64u } from '../../../../../shared-ts/src/device-linking';
 import type { HttpTransport } from '../../../core/platform/http';
-import type { DeviceLinkingAuthenticatedTransportPortV1, DeviceLinkingAuthorityActivationTransportPortV1, DeviceLinkingKeyMaterialHandleV1, DeviceLinkingKeyMaterialPortV1, DeviceLinkingWalletSessionAcknowledgementReplayPortV1, LinkSessionOwnerTransportPortV1, LinkSessionTransportPortV1 } from './deviceLinkingPorts';
+import type { DeviceLinkingKeyMaterialPortV1, DeviceLinkingWalletSessionAcknowledgementReplayPortV1, LinkSessionOwnerTransportPortV1, LinkSessionTransportPortV1 } from './deviceLinkingPorts';
 export declare const LINKED_DEVICE_SESSION_HTTP_BASE_PATH_V1 = "/wallet/device-linking/v1/sessions";
 /** Keep long-lived session polling responsive without creating a tight request loop. */
 export declare function nextLinkedDevicePollingDelayMsV1(baseDelayMs: number, attempt: number): number;
-export type DeviceLinkingAuthenticatedSessionTransportOptionsV1 = {
-    readonly http: HttpTransport;
-    readonly relayerUrl: string;
-    readonly publishableKey: string;
-    readonly projectEnvironmentId: string;
-    readonly keyMaterial: DeviceLinkingKeyMaterialPortV1;
-    readonly keyMaterialHandle: DeviceLinkingKeyMaterialHandleV1;
-    readonly devicePublicKeyB64u: LinkDevicePublicKeyB64u;
-    readonly nowMs: () => number;
-    readonly pollIntervalMs: number;
-};
-export type DeviceLinkingSessionTransportAssemblyOptionsV1 = {
+type DeviceLinkingSessionTransportAssemblyOptionsV1 = {
     readonly owner: LinkSessionOwnerTransportPortV1;
     readonly http: HttpTransport;
     readonly relayerUrl: string;
@@ -25,14 +13,13 @@ export type DeviceLinkingSessionTransportAssemblyOptionsV1 = {
     readonly nowMs: () => number;
     readonly pollIntervalMs: number;
 };
-export type DeviceLinkingWalletSessionAcknowledgementTransportOptionsV1 = {
+type DeviceLinkingWalletSessionAcknowledgementTransportOptionsV1 = {
     readonly http: HttpTransport;
     readonly relayerUrl: string;
     readonly projectEnvironmentId: string;
 };
-export declare function createDeviceLinkingAuthenticatedSessionTransportV1(options: DeviceLinkingAuthenticatedSessionTransportOptionsV1): DeviceLinkingAuthenticatedTransportPortV1;
 export declare function createDeviceLinkingWalletSessionAcknowledgementReplayPortV1(options: DeviceLinkingWalletSessionAcknowledgementTransportOptionsV1): DeviceLinkingWalletSessionAcknowledgementReplayPortV1;
-export declare function createDeviceLinkingAuthorityActivationTransportV1(options: DeviceLinkingAuthenticatedSessionTransportOptionsV1): DeviceLinkingAuthorityActivationTransportPortV1;
 /** Compose one direct transport port; owner auth remains an injected boundary. */
 export declare function createDeviceLinkingSessionTransportPortV1(options: DeviceLinkingSessionTransportAssemblyOptionsV1): LinkSessionTransportPortV1;
+export {};
 //# sourceMappingURL=deviceLinkingHttpTransport.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/devices/deviceLinkingOwnerTransport.d.ts

@@ -28,9 +28,10 @@ export type LinkSessionOwnerApprovalUpdatesPortV1 = {
         readonly onResult: (result: LinkedDeviceApprovalResultV1) => void;
     }): Promise<LinkSessionSubscriptionV1>;
 };
-export type DeviceLinkingOwnerTransportOptionsV1 = {
+type DeviceLinkingOwnerTransportOptionsV1 = {
     readonly request: LinkSessionOwnerAuthenticatedRequestPortV1;
     readonly approvalUpdates: LinkSessionOwnerApprovalUpdatesPortV1;
 };
 export declare function createDeviceLinkingOwnerTransportV1(options: DeviceLinkingOwnerTransportOptionsV1): LinkSessionOwnerTransportPortV1;
+export {};
 //# sourceMappingURL=deviceLinkingOwnerTransport.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/devices/deviceLinkingPorts.d.ts

@@ -1,5 +1,5 @@
 import type { DeviceLinkingEd25519ExportRootPortV1 } from './deviceLinkingEd25519ExportRoot';
-import type { UnlockedWalletEd25519ExportRootCapabilityV1 } from '../../../core/signingEngine/workerManager/workerTypes';
+import type { UnlockedEd25519ExportRootLinkingCapabilityV1 } from '../../../core/signingEngine/workerManager/workerTypes';
 import type { LinkedDeviceApprovalV1, LinkedDeviceApprovalResultV1, LinkedDeviceOwnerAuthorizationSourceV1, LinkedDeviceSessionClaimRequestV1, LinkedDeviceSessionClaimV1, LinkSessionProjectionV1, LinkSessionStateV1, LinkSessionTransportEventV1, LinkedDeviceSessionTransportRequestV1, LinkedDeviceTargetCredentialRegistrationV1, LinkedDeviceTargetCredentialRegistrationResultV1, LinkedDeviceTargetPreparationV1, LinkedDeviceTargetPreparationRequestV1, LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, LinkedDeviceEd25519SourceContributionPreparationV1, LinkedDeviceEd25519SourceContributionV1, LinkedDeviceEcdsaSourceContributionPreparationV1, LinkedDeviceEcdsaSourceContributionV1, LinkedDevicePasskeyCreationOptionsV1, LinkedDeviceWebAuthnRegistrationV1, LinkDevicePublicKeyB64u, QrLinkedDeviceSessionPayloadV5, LinkedDeviceEmailOtpChallengeStartRequestV1, LinkedDeviceEmailOtpChallengeResendRequestV1, LinkedDeviceEmailOtpChallengeVerifyRequestV1, LinkedDeviceEmailOtpChallengeResultV1, LinkedDeviceEmailOtpVerificationResultV1, LinkedDeviceEmailOtpBaseFactorRequestV1, LinkedDeviceEmailOtpBaseFactorResolutionResultV1, LinkedDeviceEmailOtpFactorReleaseEnvelopeV1, LinkedDeviceEmailOtpVerificationGrantV1, ActivateInstalledAuthorityResultV1, CommittedAuthorityPackagesV1, LocalAuthorityActivationFinalAckV1, LocalAuthorityInstallationReceiptV1, LinkedDeviceWalletSessionCredentialDeliveryBindingV1, LinkedDeviceWalletSessionCredentialDeliveryV1, WalletSessionOperationCredentialV1 } from '../../../../../shared-ts/src/device-linking';
 import type { LinkedDeviceEd25519ExportRootPackageV1, LinkedDeviceEd25519ExportRootRecipientV1, LinkedDeviceEd25519ExportRootSubmissionV1 } from '../../../../../shared-ts/src/device-linking/ed25519ExportRoot';
 import type { DigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
@@ -9,7 +9,6 @@ import type { LinkedDeviceId, LinkedDeviceEnrollmentId, LinkDeviceSessionId } fr
 import type { WalletAuthMethodId, WalletId } from '../../../../../shared-ts/src/utils/domainIds';
 import type { WalletAuthorityId } from '../../../../../shared-ts/src/utils/domainIds';
 import type { DeviceLinkingOrdinaryMaterialWorkerPortV1 } from './deviceLinkingOrdinaryMaterialWorker';
-import type { PasskeyCustodyEnvelopeRecord, WalletCustodyEnvelopeFactor } from '../../../../../shared-ts/src/passkey-custody';
 import type { DeviceLinkingAuthorityInstallationPortV1 } from './deviceLinkingAuthorityInstallation';
 export type { DeviceLinkingAuthorityActivationFlowInputV1, DeviceLinkingAuthorityInstallationAssemblyOptionsV1, DeviceLinkingAuthorityInstallationPortV1, DeviceLinkingCommittedPackageSealingPortV1, DeviceLinkingSealedAuthorityRecordsV1, } from './deviceLinkingAuthorityInstallation';
 /** Authenticated owner request proof produced by the one owner auth source. */
@@ -23,7 +22,7 @@ export type LinkSessionSubscriptionV1 = {
 };
 export type LinkSessionSnapshotV1 = LinkSessionProjectionV1;
 export type { LinkedDeviceApprovalResultV1 };
-/** Strict R103E authority-package delivery and activation acknowledgement. */
+/** Strict authority-package delivery and activation acknowledgement. */
 export type DeviceLinkingAuthorityActivationTransportPortV1 = {
     receiveCommittedAuthorityPackagesV1(input: {
         readonly linkSessionId: LinkDeviceSessionId;
@@ -185,7 +184,7 @@ export type DeviceLinkingKeyMaterialBundleV1 = {
     /** Public P-256 recipient retained by the target worker for delivery. */
     readonly deliveryRecipientPublicKey65B64u: string;
 };
-export type DeviceLinkingEmailOtpFactorReleaseInputV1 = {
+type DeviceLinkingEmailOtpFactorReleaseInputV1 = {
     /** The fresh server envelope is opened only by this worker slot. */
     readonly keyMaterial: DeviceLinkingKeyMaterialHandleV1;
     readonly walletId: WalletId;
@@ -248,22 +247,17 @@ export type DeviceLinkingKeyMaterialPortV1 = {
         readonly signatureB64u: string;
     }>;
 };
-export type DeviceLinkingLiveKeyMaterialPortV1 = DeviceLinkingKeyMaterialPortV1 & DeviceLinkingEmailOtpFactorReleasePortV1 & DeviceLinkingOrdinaryMaterialWorkerPortV1;
-export type EmailOtpExportRootEnvelopeRecordV1 = Omit<PasskeyCustodyEnvelopeRecord, 'factor'> & {
-    readonly factor: Extract<WalletCustodyEnvelopeFactor, {
-        readonly kind: 'email_otp';
-    }>;
-};
-export type LinkedDeviceOwnerAuthorizationResultBaseV1 = {
+type DeviceLinkingLiveKeyMaterialPortV1 = DeviceLinkingKeyMaterialPortV1 & DeviceLinkingEmailOtpFactorReleasePortV1 & DeviceLinkingOrdinaryMaterialWorkerPortV1;
+type LinkedDeviceOwnerAuthorizationResultBaseV1 = {
     readonly authentication: LinkSessionAuthenticationV1;
     readonly walletId: WalletId;
     readonly ownerAuthorization: LinkedDeviceOwnerAuthorizationSourceV1;
     readonly sourceSignerManifest: ExactAdministeredSignerManifestV1;
     readonly expiresAtMs: number;
 };
-export type LinkedDeviceOwnerAuthorizationResultV1 = (LinkedDeviceOwnerAuthorizationResultBaseV1 & {
+type LinkedDeviceOwnerAuthorizationResultV1 = (LinkedDeviceOwnerAuthorizationResultBaseV1 & {
     readonly exportRootRequirement: 'required';
-    readonly ed25519ExportRootCapability: UnlockedWalletEd25519ExportRootCapabilityV1;
+    readonly ed25519ExportRootCapability: UnlockedEd25519ExportRootLinkingCapabilityV1;
 }) | (LinkedDeviceOwnerAuthorizationResultBaseV1 & {
     readonly exportRootRequirement: 'not_required';
     readonly ed25519ExportRootCapability?: never;
@@ -275,14 +269,14 @@ export type DeviceLinkingOwnerAuthorizationPortV1 = {
     }): Promise<LinkedDeviceOwnerAuthorizationResultV1>;
 };
 /** Family-specific source-preserving producers. Private source material stays behind each port. */
-export type DeviceLinkingEd25519SourceContributionPortV1 = {
+type DeviceLinkingEd25519SourceContributionPortV1 = {
     produceSourceContributionV1(input: {
         readonly preparation: LinkedDeviceEd25519SourceContributionPreparationV1;
-        readonly capability: UnlockedWalletEd25519ExportRootCapabilityV1;
+        readonly capability: UnlockedEd25519ExportRootLinkingCapabilityV1;
         readonly authentication: LinkSessionAuthenticationV1;
     }): Promise<LinkedDeviceEd25519SourceContributionV1>;
 };
-export type DeviceLinkingEcdsaSourceContributionPortV1 = {
+type DeviceLinkingEcdsaSourceContributionPortV1 = {
     produceSourceContributionV1(input: {
         readonly preparation: LinkedDeviceEcdsaSourceContributionPreparationV1;
     }): Promise<LinkedDeviceEcdsaSourceContributionV1>;

package/dist/types/wallet/src/SeamsWeb/operations/devices/deviceLinkingResume.d.ts

@@ -6,11 +6,11 @@ import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '
 import { type DeviceId } from '../../../../../shared-ts/src/authorization/capabilityKinds';
 import type { DeviceLinkingWalletSessionAcknowledgementReplayPortV1 } from './deviceLinkingPorts';
 import type { DeviceLinkingDeliveryResumePortV1 } from './deviceLinkingAuthorityInstallation';
-export declare const LINKED_DEVICE_COMMITTED_RESUME_KIND_V1: "linked_device_committed_resume_v1";
-export declare const LINKED_DEVICE_PENDING_ACK_KIND_V1: "linked_device_pending_ack_v1";
+declare const LINKED_DEVICE_COMMITTED_RESUME_KIND_V1: "linked_device_committed_resume_v1";
+declare const LINKED_DEVICE_PENDING_ACK_KIND_V1: "linked_device_pending_ack_v1";
 export declare const LINKED_DEVICE_COMMITTED_RESUME_APP_STATE_PREFIX_V1 = "device-linking/committed-resume/v1/";
 export declare const LINKED_DEVICE_PENDING_ACK_APP_STATE_PREFIX_V1 = "device-linking/pending-ack/v1/";
-export type DeviceLinkingPendingAcknowledgementV1 = {
+type DeviceLinkingPendingAcknowledgementV1 = {
     readonly kind: typeof LINKED_DEVICE_PENDING_ACK_KIND_V1;
     readonly acknowledgement: LocalAuthorityActivationFinalAckV1;
 };
@@ -70,4 +70,5 @@ export declare function replayPendingDeviceLinkingAcknowledgementsV1(input: {
     readonly authMethodId: WalletAuthMethodId;
     readonly operationCredential: WalletSessionOperationCredentialV1;
 }): Promise<DeviceLinkingDurableAcknowledgementReplayResultV1>;
+export {};
 //# sourceMappingURL=deviceLinkingResume.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/devices/deviceLinkingWorkerChannels.d.ts

@@ -1,5 +1,3 @@
-import { type DigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
-import { type LinkDeviceSessionId } from '../../../../../shared-ts/src/signing-lanes/ids';
 import { type DeviceLinkingOrdinaryMaterialWorkerPortV1 } from './deviceLinkingOrdinaryMaterialWorker';
 import type { DeviceLinkingEmailOtpFactorReleasePortV1, DeviceLinkingKeyMaterialPortV1 } from './deviceLinkingPorts';
 export type DeviceLinkingWorkerEndpointV1 = {
@@ -10,7 +8,7 @@ export type DeviceLinkingWorkerEndpointV1 = {
     removeEventListener(type: 'error', listener: (event: ErrorEvent) => void): void;
     terminate(): void;
 };
-export type DeviceLinkingWorkerKeyMaterialPortV1 = DeviceLinkingKeyMaterialPortV1 & {
+type DeviceLinkingWorkerKeyMaterialPortV1 = DeviceLinkingKeyMaterialPortV1 & {
     close(): void;
 } & DeviceLinkingEmailOtpFactorReleasePortV1 & DeviceLinkingOrdinaryMaterialWorkerPortV1;
 /**
@@ -22,15 +20,5 @@ export declare function createDeviceLinkingKeyMaterialPortV1(args?: {
     readonly endpoint?: DeviceLinkingWorkerEndpointV1;
     readonly timeoutMs?: number;
 }): DeviceLinkingWorkerKeyMaterialPortV1;
-/** Builds the exact bytes used by the worker before Ed25519 signing. */
-export declare function encodeDeviceLinkingRequestForWorkerV1(input: {
-    readonly linkSessionId: LinkDeviceSessionId;
-    readonly devicePublicKeyDigestB64u: DigestB64u;
-    readonly bodyDigestB64u: DigestB64u;
-    readonly method: 'GET' | 'POST';
-    readonly canonicalPath: string;
-    readonly challengeB64u: string;
-    readonly issuedAtMs: number;
-    readonly expiresAtMs: number;
-}): Uint8Array;
+export {};
 //# sourceMappingURL=deviceLinkingWorkerChannels.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/devices/linkDevice.d.ts

@@ -1,97 +1,9 @@
 import type { DeviceLinkingWebContext } from '../../signingSurface/types';
-import type { DeviceLinkingSession, LinkDeviceResult, ScanAndLinkDeviceOptionsDevice1, StartDevice2LinkingFlowArgs, StartDevice2LinkingFlowResults } from '../../../core/types/linkDevice';
+import type { LinkDeviceResult, ScanAndLinkDeviceOptionsDevice1, StartDevice2LinkingFlowArgs, StartDevice2LinkingFlowResults } from '../../../core/types/linkDevice';
 import type { QrLinkedDeviceSessionPayloadV5 } from '../../../../../shared-ts/src/device-linking';
 import type { WalletIframeCoordinator } from '../../walletIframe/coordinator';
-import type { Device2LinkingFlowPortsV1, DeviceLinkingFlowPortsV1 } from './deviceLinkingPorts';
-import { LinkDeviceEventPhase } from '../../../core/types/sdkSentEvents';
-type GetLinkedDeviceAuthenticationContext = () => DeviceLinkingWebContext;
-export type LinkedDeviceDeliveryRecoveryReasonV1 = 'recipient_private_handle_lost' | 'sealed_delivery_expired';
-/**
- * These failures happen after the server has committed the linked authority.
- * The original delivery is intentionally abandoned; exact-method unlock uses
- * the durable local installation to obtain a successor Wallet Session.
- */
-export declare function classifyLinkedDeviceDeliveryFailureV1(error: unknown): LinkedDeviceDeliveryRecoveryReasonV1 | null;
-export declare class LinkDeviceFlow {
-    private readonly options;
-    private readonly ports;
-    private readonly getAuthenticationContext;
-    private readonly flowId;
-    private session;
-    private keyMaterialHandle;
-    private deliveryRecipientPublicKey65B64u;
-    private resealedExportRoot;
-    private targetCredentialRegistrationResult;
-    private committedAuthorityPackages;
-    private deliveryRecoveryReason;
-    private ordinarySignerMaterialRecipientPreparation;
-    private authenticatedTransport;
-    private subscription;
-    private error?;
-    private cancelled;
-    private runEpoch;
-    private generationInProgress;
-    private discardInProgress;
-    private targetCredentialActivationState;
-    private emailOtpTargetActivationState;
-    private readonly handledStates;
-    private sessionEventQueue;
-    constructor(options: StartDevice2LinkingFlowArgs, ports: Device2LinkingFlowPortsV1, getAuthenticationContext?: GetLinkedDeviceAuthenticationContext | null);
-    generateQR(): Promise<StartDevice2LinkingFlowResults>;
-    getState(): {
-        readonly phase: LinkDeviceEventPhase;
-        readonly session: DeviceLinkingSession | null;
-        readonly error?: Error;
-        readonly cancelled: boolean;
-    };
-    cancel(): Promise<void>;
-    reset(): Promise<void>;
-    private resolveLinkIdentityV1;
-    private handleSessionEvent;
-    private prepareTargetCredentialActivation;
-    private prepareTargetEmailOtpActivation;
-    private notifyEmailOtpActivationV1;
-    private sendTargetEmailOtpCodeV1;
-    private startTargetEmailOtpChallengeV1;
-    private resendTargetEmailOtpCodeV1;
-    private runTargetEmailOtpResendV1;
-    private submitTargetEmailOtpCodeV1;
-    private completeTargetEmailOtpActivationV1;
-    private activateTargetCredential;
-    private runTargetCredentialActivation;
-    private waitForTargetCredentialActivation;
-    private claimTargetCredentialFactorSecret;
-    private clearTargetCredentialActivationState;
-    private createTargetCredential;
-    private assertTargetPreparationMatchesSession;
-    private activateAuthorityForStateV1;
-    private finishActiveAuthorityV1;
-    private requireAuthenticatedTransport;
-    private requireSessionTargetFactorV1;
-    private requireSessionV1;
-    private requireKeyMaterialHandleV1;
-    private requireDeliveryRecipientPublicKey65B64u;
-    private requireOrdinarySignerMaterialRecipientPreparationV1;
-    private startRun;
-    private isCurrentRun;
-    private assertCurrentRun;
-    private handleSessionTransportEvent;
-    private handleSessionTransportFailure;
-    private handleCommittedDeliveryFailureV1;
-    private requireExactMethodUnlockForCommittedDeliveryV1;
-    private retryCommittedDeliveryV1;
-    private replayPendingActivationAcknowledgementV1;
-    private cancelFailedPrecommitSession;
-    private cleanupLocalResources;
-    private closeSessionSubscriptionV1;
-    private cleanupCompletedLocalResources;
-    private clearEmailOtpTargetActivationState;
-    private hasCommittedDeliveryState;
-    private discardKeyMaterial;
-    private emitFailure;
-    private emit;
-}
-export type DeviceLinkingDomainDeps = {
+import type { DeviceLinkingFlowPortsV1 } from './deviceLinkingPorts';
+type DeviceLinkingDomainDeps = {
     readonly kind: 'iframe';
     readonly getContext: () => DeviceLinkingWebContext;
     readonly walletIframe: Pick<WalletIframeCoordinator, 'shouldUseWalletIframe' | 'requireRouter'>;

package/dist/types/wallet/src/SeamsWeb/operations/devices/linkDeviceFlow.d.ts

@@ -0,0 +1,88 @@
+import type { DeviceLinkingSession, StartDevice2LinkingFlowArgs, StartDevice2LinkingFlowResults } from '../../../core/types/linkDevice';
+import type { Device2LinkingFlowPortsV1 } from './deviceLinkingPorts';
+import { LinkDeviceEventPhase } from '../../../core/types/sdkSentEvents';
+import { type GetLinkedDeviceAuthenticationContext } from './linkDeviceFlowSupport';
+export declare class LinkDeviceFlow {
+    private readonly options;
+    private readonly ports;
+    private readonly getAuthenticationContext;
+    private readonly flowId;
+    private session;
+    private keyMaterialHandle;
+    private deliveryRecipientPublicKey65B64u;
+    private resealedExportRoot;
+    private targetCredentialRegistrationResult;
+    private committedAuthorityPackages;
+    private deliveryRecoveryReason;
+    private ordinarySignerMaterialRecipientPreparation;
+    private authenticatedTransport;
+    private subscription;
+    private error?;
+    private cancelled;
+    private runEpoch;
+    private generationInProgress;
+    private discardInProgress;
+    private targetCredentialActivationState;
+    private emailOtpTargetActivationState;
+    private readonly handledStates;
+    private sessionEventQueue;
+    constructor(options: StartDevice2LinkingFlowArgs, ports: Device2LinkingFlowPortsV1, getAuthenticationContext?: GetLinkedDeviceAuthenticationContext | null);
+    generateQR(): Promise<StartDevice2LinkingFlowResults>;
+    getState(): {
+        readonly phase: LinkDeviceEventPhase;
+        readonly session: DeviceLinkingSession | null;
+        readonly error?: Error;
+        readonly cancelled: boolean;
+    };
+    cancel(): Promise<void>;
+    private resolveLinkIdentityV1;
+    private cancelClaimedSessionV1;
+    private handleSessionEvent;
+    private prepareTargetCredentialActivation;
+    private prepareTargetEmailOtpActivation;
+    private notifyEmailOtpActivationV1;
+    private sendTargetEmailOtpCodeV1;
+    private startTargetEmailOtpChallengeV1;
+    private awaitTargetEmailOtpCodeV1;
+    private resendTargetEmailOtpCodeV1;
+    private runTargetEmailOtpResendV1;
+    private submitTargetEmailOtpCodeV1;
+    private completeTargetEmailOtpActivationV1;
+    private activateTargetCredential;
+    private runTargetCredentialActivation;
+    private waitForTargetCredentialActivation;
+    private clearTargetCredentialActivationState;
+    private createTargetCredential;
+    private acceptTargetExportRootV1;
+    private assertTargetPreparationMatchesSession;
+    private activateAuthorityForStateV1;
+    private finishActiveAuthorityV1;
+    private requireAuthenticatedTransport;
+    private requireSessionTargetFactorV1;
+    private requireSessionV1;
+    private requireKeyMaterialHandleV1;
+    private requireDeliveryRecipientPublicKey65B64u;
+    private requireOrdinarySignerMaterialRecipientPreparationV1;
+    private startRun;
+    private isCurrentRun;
+    private assertCurrentRun;
+    private handleSessionTransportEvent;
+    private handleSessionTransportFailure;
+    private handleCommittedDeliveryFailureV1;
+    private requireExactMethodUnlockForCommittedDeliveryV1;
+    private retryCommittedDeliveryV1;
+    private replayCommittedAuthorityV1;
+    private replayPendingActivationAcknowledgementV1;
+    private sendActivationAcknowledgementV1;
+    private cancelFailedPrecommitSession;
+    private cleanupLocalResources;
+    private clearRunActivationStateV1;
+    private closeSessionSubscriptionV1;
+    private cleanupCompletedLocalResources;
+    private clearEmailOtpTargetActivationState;
+    private hasCommittedDeliveryState;
+    private discardKeyMaterial;
+    private emitFailure;
+    private emit;
+}
+//# sourceMappingURL=linkDeviceFlow.d.ts.map