@seams/wallet 0.6.1 → 0.7.1

package/dist/types/wallet/src/core/signingEngine/walletCustody/registrationCeremony.d.ts

@@ -11,7 +11,7 @@ import { type WalletCustodyCeremonyStepRunner } from './ceremonyDriver';
  * that are not shown are codes nobody can ever produce, and a payload committed
  * without its codes leaves a wallet whose owner holds nothing.
  */
-export type EstablishNearEd25519CustodyInput = {
+type EstablishNearEd25519CustodyInput = {
     readonly runStep: WalletCustodyCeremonyStepRunner;
     readonly walletId: string;
     /** The passkey or Email OTP factor, as the envelope will name it. */
@@ -30,7 +30,7 @@ export type EstablishNearEd25519CustodyInput = {
     /** Present when this key set already has a registration to reproduce. */
     readonly continuityRegisteredPublicKeyB64u?: string;
 };
-export type EstablishedNearEd25519Custody = {
+type EstablishedNearEd25519Custody = {
     /** Show these once. They are the only copy. */
     readonly recoveryCodes: readonly string[];
     /** Ready for the wire: carries no client signing material. */
@@ -63,7 +63,7 @@ export type EstablishedNearEd25519Custody = {
     };
 };
 export declare function establishNearEd25519CustodyV1(input: EstablishNearEd25519CustodyInput): Promise<EstablishedNearEd25519Custody>;
-export type EstablishEvmFamilyCustodyInput = {
+type EstablishEvmFamilyCustodyInput = {
     readonly runStep: WalletCustodyCeremonyStepRunner;
     readonly walletId: string;
     readonly factorJson: string;
@@ -79,7 +79,7 @@ export type EstablishEvmFamilyCustodyInput = {
         readonly preActivationCommitPayload: WalletCustodyCeremonyCommitPayload;
     }) => Promise<string>;
 };
-export type EstablishedEvmFamilyCustody = {
+type EstablishedEvmFamilyCustody = {
     readonly recoveryCodes: readonly string[];
     /** The exact payload admitted during activation, before local completion. */
     readonly commitPayload: WalletCustodyCeremonyCommitPayload;
@@ -96,7 +96,7 @@ export type EstablishedEvmFamilyCustody = {
 };
 export declare function joinCustodyJsonFromEstablishedCommitPayload(payload: WalletCustodyCeremonyCommitPayload): string;
 export declare function establishEvmFamilyCustodyV1(input: EstablishEvmFamilyCustodyInput): Promise<EstablishedEvmFamilyCustody>;
-export type RejoinEvmFamilyCustodyInput = {
+type RejoinEvmFamilyCustodyInput = {
     readonly runStep: WalletCustodyCeremonyStepRunner;
     readonly walletId: string;
     readonly custodyJson: string;
@@ -106,12 +106,12 @@ export type RejoinEvmFamilyCustodyInput = {
     readonly registeredClientRootPublicKey33B64u: string;
     readonly relayerPublicIdentityJson: string;
 };
-export type JoinEvmFamilyCustodyInput = Omit<EstablishEvmFamilyCustodyInput, 'factorJson' | 'confirmRecoveryCodesBackedUp'> & {
+type JoinEvmFamilyCustodyInput = Omit<EstablishEvmFamilyCustodyInput, 'factorJson' | 'confirmRecoveryCodesBackedUp'> & {
     readonly custodyJson: string;
 };
-export type JoinedEvmFamilyCustody = Omit<EstablishedEvmFamilyCustody, 'recoveryCodes'>;
+type JoinedEvmFamilyCustody = Omit<EstablishedEvmFamilyCustody, 'recoveryCodes'>;
 export declare function joinEvmFamilyCustodyV1(input: JoinEvmFamilyCustodyInput): Promise<JoinedEvmFamilyCustody>;
-export type RejoinedEvmFamilyCustody = {
+type RejoinedEvmFamilyCustody = {
     readonly readyStateBlobB64u: string;
     readonly publicFacts: WalletCustodyEvmFamilyPublicFacts;
 };
@@ -128,7 +128,7 @@ type WalletRecoveryCustodyInput = {
     readonly recordedKeyManifestDigestB64u: string;
     readonly factorReplacement: RecoveryFactorReplacement;
 };
-export type RecoverEvmFamilyCustodyInput = WalletRecoveryCustodyInput & {
+type RecoverEvmFamilyCustodyInput = WalletRecoveryCustodyInput & {
     readonly runStep: WalletCustodyCeremonyStepRunner;
     readonly walletId: string;
     readonly evmFamilySigningKeySlotId: string;
@@ -136,21 +136,11 @@ export type RecoverEvmFamilyCustodyInput = WalletRecoveryCustodyInput & {
     readonly registeredClientRootPublicKey33B64u: string;
     readonly resolveRelayerPublicIdentity: EstablishEvmFamilyCustodyInput['runRelayerRound'];
 };
-export type RecoveredEvmFamilyCustody = RejoinedEvmFamilyCustody & {
+type RecoveredEvmFamilyCustody = RejoinedEvmFamilyCustody & {
     readonly recoveryReplacementEnvelope: NonNullable<WalletCustodyCeremonyCommitPayload['recoveryReplacementEnvelope']> | null;
 };
 export declare function recoverEvmFamilyCustodyV1(input: RecoverEvmFamilyCustodyInput): Promise<RecoveredEvmFamilyCustody>;
 export declare function rejoinEvmFamilyCustodyV1(input: RejoinEvmFamilyCustodyInput): Promise<RejoinedEvmFamilyCustody>;
-export declare function computeWalletCustodyEvmFamilyKeyManifestDigestB64u(input: {
-    readonly walletId: string;
-    readonly evmFamilySigningKeySlotId: string;
-    readonly clientRootPublicKey33B64u: string;
-}): Promise<string>;
-export declare function computeWalletCustodyNearEd25519KeyManifestDigestB64u(input: {
-    readonly walletId: string;
-    readonly nearEd25519SigningKeyId: string;
-    readonly registeredPublicKeyB64u: string;
-}): Promise<string>;
 /**
  * Strips everything the server must never receive.
  *
@@ -181,7 +171,7 @@ export declare function walletCustodyCommitPayloadForWire(payload: WalletCustody
  * *establish* a key set — registering a second, different key for a wallet
  * that already has one, which no later check would undo.
  */
-export type RejoinNearEd25519CustodyInput = Omit<EstablishNearEd25519CustodyInput, 'factorJson' | 'registrationCeremonyId'> & {
+type RejoinNearEd25519CustodyInput = Omit<EstablishNearEd25519CustodyInput, 'factorJson' | 'registrationCeremonyId'> & {
     /** `JoinCustodyWireV1`: the stored envelope binding and its sealed seed. */
     readonly custodyJson: string;
     readonly recoveryLifecycleId: string;
@@ -195,11 +185,11 @@ type JoinedNearEd25519CustodyBase = {
     readonly activationReference: EstablishedNearEd25519Custody['activationReference'];
     readonly localMaterial: EstablishedNearEd25519Custody['localMaterial'];
 };
-export type RejoinedNearEd25519Custody = JoinedNearEd25519CustodyBase & {
+type RejoinedNearEd25519Custody = JoinedNearEd25519CustodyBase & {
     readonly activationResultJson: string;
     readonly activationReceipt: RouterAbEd25519YaoRecoveryActivationReceiptV1;
 };
-export type JoinNearEd25519CustodyInput = Omit<EstablishNearEd25519CustodyInput, 'walletId' | 'factorJson' | 'continuityRegisteredPublicKeyB64u'> & {
+type JoinNearEd25519CustodyInput = Omit<EstablishNearEd25519CustodyInput, 'walletId' | 'factorJson' | 'continuityRegisteredPublicKeyB64u'> & {
     readonly preparation: {
         readonly kind: 'fresh';
     } | {
@@ -210,8 +200,8 @@ export type JoinNearEd25519CustodyInput = Omit<EstablishNearEd25519CustodyInput,
     /** `JoinCustodyWireV1`: the envelope established by another key set. */
     readonly custodyJson: string;
 };
-export type JoinedNearEd25519Custody = JoinedNearEd25519CustodyBase;
-export type RecoverNearEd25519CustodyInput = WalletRecoveryCustodyInput & {
+type JoinedNearEd25519Custody = JoinedNearEd25519CustodyBase;
+type RecoverNearEd25519CustodyInput = WalletRecoveryCustodyInput & {
     readonly runStep: WalletCustodyCeremonyStepRunner;
     readonly walletId: string;
     readonly nearEd25519SigningKeyId: string;
@@ -223,7 +213,7 @@ export type RecoverNearEd25519CustodyInput = WalletRecoveryCustodyInput & {
     readonly runRouterRound: (yaoExecuteRequestJson: string) => Promise<string>;
     readonly activateRouterRecovery: (protocolResultJson: string) => Promise<RouterAbEd25519YaoRecoveryActivationReceiptV1>;
 };
-export type RecoveredNearEd25519Custody = {
+type RecoveredNearEd25519Custody = {
     readonly localMaterial: RejoinedNearEd25519Custody['localMaterial'];
     readonly activationResultJson: string;
     readonly activationReceipt: RouterAbEd25519YaoRecoveryActivationReceiptV1;

package/dist/types/wallet/src/core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.d.ts

@@ -1,6 +1,6 @@
 /**
- * Refactor 103 zero-prompt handoff — the main thread's view of the unlocked
- * Ed25519 Yao Client export-root capability.
+ * The main thread's view of the unlocked Ed25519 Yao Client export-root
+ * capability.
  *
  * The wallet custody ceremony worker owns the opened custody-seed handle; this
  * module owns the one public reference to it and the discipline around it:
@@ -15,12 +15,12 @@
  * expired capability is an unlock requirement, never permission to prompt from
  * the linking flow.
  */
-import type { UnlockedWalletEd25519ExportRootCapabilityDestroyScopeV1, UnlockedWalletEd25519ExportRootCapabilityV1 } from '../workerManager/workerTypes';
+import type { UnlockedEd25519ExportRootLinkingCapabilityV1, UnlockedWalletEd25519ExportRootCapabilityDestroyScopeV1, UnlockedWalletEd25519ExportRootCapabilityV1 } from '../workerManager/workerTypes';
 import { type WalletCustodyCeremonyTransportPort } from './ceremonyStepRunner';
 import type { PasskeyCustodyEnvelopeRecord } from '../../../../../shared-ts/src/passkey-custody';
 import type { WorkerOperationContext } from '../workerManager/executeWorkerOperation';
 /**
- * Refactor 109C: where a pre-109C envelope's upgrade goes after an unlock.
+ * Where an unbound envelope's upgrade goes after an unlock.
  *
  * The reseal happens inside the worker, at the one instant both the factor
  * secret and the selected method are in hand. Only the host knows the relayer
@@ -28,7 +28,7 @@ import type { WorkerOperationContext } from '../workerManager/executeWorkerOpera
  * this behind and every establishment path reaches persistence — including the
  * two that call the worker directly and have no relayer of their own.
  */
-export type UnlockedCustodyEnvelopeUpgradeSinkV1 = (input: {
+type UnlockedCustodyEnvelopeUpgradeSinkV1 = (input: {
     readonly walletId: string;
     readonly walletAuthMethodId: string;
     readonly walletSessionId: string;
@@ -37,10 +37,11 @@ export type UnlockedCustodyEnvelopeUpgradeSinkV1 = (input: {
 export declare function setUnlockedCustodyEnvelopeUpgradeSinkV1(sink: UnlockedCustodyEnvelopeUpgradeSinkV1 | null): void;
 export declare function walletCustodyCeremonyTransportFromWorkerContextV1(workerContext: WorkerOperationContext): WalletCustodyCeremonyTransportPort;
 /**
- * Opens a wallet-custody-seed envelope inside the worker with the factor secret
- * already present in the calling operation, and records the returned reference
- * as the current capability. Client-root envelopes belong to the exact sealed
- * export-root path and do not establish this seed-backed capability.
+ * Opens this device's own custody envelope inside the worker with the factor
+ * secret already present in the calling operation, and records the returned
+ * reference as the current capability. A wallet custody seed yields the
+ * seed-backed capability; a linked device's Client-root envelope yields the
+ * linked-device capability, which only linking accepts.
  * The caller still owns `existingFactorSecret` and zeroes it; the worker zeroes
  * its own copy.
  *
@@ -54,12 +55,20 @@ export declare function establishUnlockedWalletEd25519ExportRootCapabilityV1(tra
     readonly walletAuthMethodId: string;
     readonly walletSessionId: string;
     readonly expiresAtMs: number;
-}): Promise<UnlockedWalletEd25519ExportRootCapabilityV1 | undefined>;
+}): Promise<UnlockedEd25519ExportRootLinkingCapabilityV1 | undefined>;
 /**
- * The current capability for this exact wallet, or undefined when the wallet
- * has none — never a prompt, and never a stale or expired reference.
+ * The current seed-backed capability for this exact wallet, or undefined when
+ * the wallet has none — never a prompt, and never a stale or expired
+ * reference. A linked device's Client-root capability is never returned here:
+ * seed reseals and auth-method additions cannot use it.
  */
 export declare function readUnlockedWalletEd25519ExportRootCapabilityV1(walletId: string): UnlockedWalletEd25519ExportRootCapabilityV1 | undefined;
+/**
+ * The current capability a device approving a link seals the export root
+ * from, of either kind, for this exact wallet — never a prompt, and never a
+ * stale or expired reference.
+ */
+export declare function readUnlockedEd25519ExportRootLinkingCapabilityV1(walletId: string): UnlockedEd25519ExportRootLinkingCapabilityV1 | undefined;
 /**
  * Drops the local reference without a worker round-trip. This is the
  * worker-reset path: a terminated worker has already lost its handle memory,
@@ -75,4 +84,5 @@ export declare function dropUnlockedWalletEd25519ExportRootCapabilityReferenceV1
  * wants.
  */
 export declare function destroyUnlockedWalletEd25519ExportRootCapabilitiesV1(transport: WalletCustodyCeremonyTransportPort, scope: UnlockedWalletEd25519ExportRootCapabilityDestroyScopeV1): Promise<void>;
+export {};
 //# sourceMappingURL=unlockedEd25519ExportRootCapability.d.ts.map

package/dist/types/wallet/src/core/signingEngine/walletCustody/walletRecoveryEd25519.d.ts

@@ -20,7 +20,7 @@ export type WalletSessionEd25519RecoveryBasisV1 = {
         readonly signingWorkerId: string;
     };
 };
-export type WalletRecoveryEd25519Admission = {
+type WalletRecoveryEd25519Admission = {
     readonly request: RouterAbEd25519YaoRecoveryAdmissionRequestV1;
     readonly receipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'recovery'>;
 };

package/dist/types/wallet/src/core/signingEngine/walletCustody/walletRecoveryRotation.d.ts

@@ -1,7 +1,7 @@
 import { type WalletRecoverySetRotationWorkerResultV1 } from '../../../../../shared-ts/src/wallet-recovery/walletRecoveryRotation';
 import type { PasskeyCustodyEnvelopeRecord } from '../../../../../shared-ts/src/passkey-custody';
 import { type WalletCustodyFactorProof, type WalletRecoverySetRotateResult } from '../../rpcClients/relayer/walletRecoveryRotate';
-export type WalletRecoveryRotationWorker = {
+type WalletRecoveryRotationWorker = {
     rotateRecoverySet(args: {
         readonly custodyJson: string;
         readonly factorSecret: ArrayBuffer;
@@ -12,7 +12,7 @@ export type WalletRecoveryFactorProofFactory = (input: {
     readonly operation: 'recovery_rotate';
     readonly payload: Record<string, unknown>;
 }) => Promise<WalletCustodyFactorProof>;
-export type EmailOtpWalletRecoveryRotationWorker = {
+type EmailOtpWalletRecoveryRotationWorker = {
     rotateRecoverySet(args: {
         readonly recoveryCodesJson: string;
     }): Promise<WalletRecoverySetRotationWorkerResultV1>;
@@ -48,4 +48,5 @@ export declare function rotateWalletRecoverySetWithEmailOtpV1(input: {
     readonly worker: EmailOtpWalletRecoveryRotationWorker;
     readonly fetchImpl?: typeof fetch;
 }): Promise<WalletRecoveryRotationOutcome>;
+export {};
 //# sourceMappingURL=walletRecoveryRotation.d.ts.map

package/dist/types/wallet/src/core/signingEngine/webauthnAuth/credentials/collectAuthenticationCredentialForChallengeB64u.d.ts

@@ -3,7 +3,7 @@ import { type AccountId } from '../../../types/accountIds';
 import type { AccountSignerStatus, ProfileAuthenticatorRecord } from '../../../indexedDB';
 import type { WebAuthnAuthenticationCredential } from '../../../types/webauthn';
 import type { WalletId } from '../../interfaces/ecdsaChainTarget';
-import type { WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { WalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 export type WebAuthnAllowCredential = {
     id: string;
     type: string;
@@ -52,7 +52,6 @@ export type WebAuthnPromptPort = {
         includeSecondPrfOutput?: boolean;
     }) => Promise<WebAuthnAuthenticationCredential>;
 };
-export declare function authenticatorsToAllowCredentials<TAuth extends WebAuthnAuthenticatorRecord>(authenticators: TAuth[]): WebAuthnAllowCredential[];
 export declare function collectAuthenticationCredentialForExactNearChallengeB64u(args: {
     touchIdPrompt: Pick<WebAuthnPromptPort, 'getAuthenticationCredentialsSerializedForChallengeB64u'>;
     nearAccountId: AccountId | string;

package/dist/types/wallet/src/core/signingEngine/webauthnAuth/credentials/credentialExtensions.d.ts

@@ -1,11 +1,8 @@
-export type CredentialWithExtensionOutputs = {
+type CredentialWithExtensionOutputs = {
     response?: unknown;
     clientExtensionResults?: unknown;
 };
-export declare function getPrfResultsFromCredential(credential: unknown): {
-    first?: string;
-    second?: string;
-};
 export declare function getPrfFirstB64uFromCredential(credential: unknown): string | null;
 export declare function redactCredentialExtensionOutputs<C extends CredentialWithExtensionOutputs>(credential: C): C;
+export {};
 //# sourceMappingURL=credentialExtensions.d.ts.map

package/dist/types/wallet/src/core/signingEngine/webauthnAuth/credentials/helpers.d.ts

@@ -1,14 +1,5 @@
 import { type WebAuthnAuthenticationCredential, type WebAuthnRegistrationCredential } from '../../../types/webauthn';
 export declare function redactedPasskeyRegistrationCredential(credential: WebAuthnRegistrationCredential): WebAuthnRegistrationCredential;
-/**
- * Serialize PublicKeyCredential for both authentication and registration for WASM worker
- * - Uses base64url encoding for WASM compatibility
- *
- * @returns SerializableCredential - The serialized credential
- * - Does not return PRF outputs
- */
-export declare function serializeRegistrationCredential(credential: PublicKeyCredential): WebAuthnRegistrationCredential;
-export declare function serializeAuthenticationCredential(credential: PublicKeyCredential): WebAuthnAuthenticationCredential;
 /**
  * Serialize PublicKeyCredential for both authentication and registration for WASM worker
  * @returns SerializableCredential - The serialized credential

package/dist/types/wallet/src/core/signingEngine/webauthnAuth/fallbacks/safari-fallbacks.d.ts

@@ -5,8 +5,7 @@ export declare const WebAuthnBridgeMessage: {
     readonly CreateResult: "WALLET_WEBAUTHN_CREATE_RESULT";
     readonly GetResult: "WALLET_WEBAUTHN_GET_RESULT";
 };
-export type BridgeKind = typeof WebAuthnBridgeMessage.Create | typeof WebAuthnBridgeMessage.Get;
-export type BridgeResultKind = typeof WebAuthnBridgeMessage.CreateResult | typeof WebAuthnBridgeMessage.GetResult;
+type BridgeKind = typeof WebAuthnBridgeMessage.Create | typeof WebAuthnBridgeMessage.Get;
 type BridgeOk = {
     ok: true;
     credential: unknown;
@@ -18,7 +17,7 @@ type BridgeErr = {
 };
 type BridgeResponse = BridgeOk | BridgeErr;
 type AnyPublicKeyOptions = PublicKeyCredentialCreationOptions | PublicKeyCredentialRequestOptions;
-export type ParentDomainWebAuthnClient = {
+type ParentDomainWebAuthnClient = {
     request<K extends BridgeKind>(kind: K, publicKey: AnyPublicKeyOptions, timeoutMs?: number): Promise<BridgeResponse>;
 };
 interface OrchestratorDepsBase {
@@ -28,16 +27,12 @@ interface OrchestratorDepsBase {
     bridgeClient?: ParentDomainWebAuthnClient;
     abortSignal?: AbortSignal;
 }
-export type RegistrationOrchestratorDeps = OrchestratorDepsBase & {
+type RegistrationOrchestratorDeps = OrchestratorDepsBase & {
     registrationOriginPolicy: 'wallet_origin_only';
 };
-export type AuthenticationOrchestratorDeps = OrchestratorDepsBase & {
+type AuthenticationOrchestratorDeps = OrchestratorDepsBase & {
     registrationOriginPolicy?: never;
 };
-export declare class WalletOriginWebAuthnUnavailableError extends Error {
-    readonly code = "wallet_origin_webauthn_unavailable";
-    constructor(message: string);
-}
 /** Execute WebAuthn once on the wallet origin. */
 export declare function executeWebAuthnWithParentFallbacksSafari(kind: 'create', publicKey: PublicKeyCredentialCreationOptions, deps: RegistrationOrchestratorDeps): Promise<PublicKeyCredential | unknown>;
 export declare function executeWebAuthnWithParentFallbacksSafari(kind: 'get', publicKey: PublicKeyCredentialRequestOptions, deps: AuthenticationOrchestratorDeps): Promise<PublicKeyCredential | unknown>;

package/dist/types/wallet/src/core/signingEngine/workerManager/deviceLinkingPorts.d.ts

@@ -1,6 +1,6 @@
 import { type CommittedAuthorityPackagesV1 } from '../../../../../shared-ts/src/device-linking/committedSignerPackages';
 import type { OrdinarySignerMaterialRecipientRequestV1, OrdinarySignerMaterialRecipientRequirementV1, OrdinarySignerMaterialReservationPreparationV1, VerifiedTargetFactorV1 } from '../../../../../shared-ts/src/device-linking/contracts';
-import { type WalletAuthMethodId, type WalletAuthorityId, type WalletKeyId } from '../../../../../shared-ts/src/utils/domainIds';
+import { type WalletKeyId } from '../../../../../shared-ts/src/utils/domainIds';
 import { type DigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
 import { type PasskeyCustodyEnvelopeRecord } from '../../../../../shared-ts/src/passkey-custody';
 import type { WalletAuthorityExportRootRecordV1, WalletAuthoritySignerMaterialRecordV1 } from '../../indexedDB';
@@ -36,7 +36,7 @@ export type DeviceLinkingOrdinarySignerMaterialRecipientPreparationV1 = {
 };
 export type DeviceLinkingOrdinarySignerMaterialRecipientInputTupleV1 = DeviceLinkingOrdinarySignerMaterialRecipientPreparationV1['recipientInputs'];
 export type DeviceLinkingOrdinaryTargetFactorBindingV1 = WalletAuthorityLinkedMaterialTargetFactorV1;
-export type DeviceLinkingOrdinarySignerMaterialPreparationResultV1 = {
+type DeviceLinkingOrdinarySignerMaterialPreparationResultV1 = {
     readonly kind: 'device_linking_ordinary_signer_material_preparation_v1';
     readonly targetFactor: DeviceLinkingOrdinaryTargetFactorBindingV1;
     readonly preparations: readonly [
@@ -83,7 +83,7 @@ export type DeviceLinkingOrdinaryMaterialWorkerPrivateRequestV1 = {
     readonly recipientInputs: DeviceLinkingOrdinarySignerMaterialRecipientInputTupleV1;
     readonly factorSecret: ArrayBuffer;
 };
-export type DeviceLinkingOrdinaryMaterialWorkerRequestSenderV1 = (request: DeviceLinkingOrdinaryMaterialWorkerRequestV1 | DeviceLinkingOrdinaryMaterialWorkerPrivateRequestV1, transfer?: Transferable[]) => Promise<unknown>;
+type DeviceLinkingOrdinaryMaterialWorkerRequestSenderV1 = (request: DeviceLinkingOrdinaryMaterialWorkerRequestV1 | DeviceLinkingOrdinaryMaterialWorkerPrivateRequestV1, transfer?: Transferable[]) => Promise<unknown>;
 export type DeviceLinkingOrdinaryMaterialWorkerPortV1 = {
     createOrdinarySignerMaterialRecipientRequestsV1(input: {
         readonly keyMaterial: WorkerKeyMaterialHandleV1;
@@ -127,7 +127,6 @@ export type DeviceLinkingOrdinaryMaterialSealerV1 = {
         readonly factorSecret: Uint8Array;
     }): Promise<SealedLocalAuthorityMaterialSetV1>;
 };
-export declare function targetFactorBindingV1(targetFactor: VerifiedTargetFactorV1): DeviceLinkingOrdinaryTargetFactorBindingV1;
 export declare function createDeviceLinkingOrdinaryMaterialWorkerPortV1(send: DeviceLinkingOrdinaryMaterialWorkerRequestSenderV1): DeviceLinkingOrdinaryMaterialWorkerPortV1;
 export declare function parseOrdinaryMaterialWorkerRequestV1(value: unknown): DeviceLinkingOrdinaryMaterialWorkerRequestV1;
 export declare function parseOrdinaryMaterialWorkerPrivateRequestV1(value: unknown): DeviceLinkingOrdinaryMaterialWorkerPrivateRequestV1;
@@ -135,13 +134,5 @@ export declare function assertOrdinaryExportRootResealingMatchesCommittedV1(inpu
     readonly committed: CommittedAuthorityPackagesV1;
     readonly resealedExportRoot: OrdinaryMaterialResealedExportRootV1 | null;
 }): WalletAuthorityExportRootRecordV1 | null;
-export declare function assertOrdinaryExportRootResealingMatchesIdentityV1(input: {
-    readonly authorityId: WalletAuthorityId;
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly walletKeyId: WalletKeyId | null;
-    readonly resealedExportRoot: OrdinaryMaterialResealedExportRootV1 | null;
-}): WalletAuthorityExportRootRecordV1 | null;
-export declare function parseOrdinaryResealedExportRootRecordV1(value: unknown): OrdinaryMaterialResealedExportRootV1 | null;
-export declare function parseOrdinarySignerMaterialRecipientPreparationV1(value: unknown): DeviceLinkingOrdinarySignerMaterialRecipientPreparationV1;
 export {};
 //# sourceMappingURL=deviceLinkingPorts.d.ts.map

package/dist/types/wallet/src/core/signingEngine/workerManager/deviceLinkingSourceContribution.d.ts

@@ -3,32 +3,35 @@ import type { LinkedDeviceOwnerAuthorizationSourceV1 } from '../../../../../shar
 import type { MpcMaterialActivationRef, WalletKeyId } from '../../../../../shared-ts/src/utils/domainIds';
 import { type DigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { ActiveEcdsaCapabilityManifest } from '../session/material/ecdsaCapabilityManifest';
+import type { LinkedEcdsaHolderRuntimeV1 } from '../session/material/linkedEcdsaHolderRuntime';
 import type { WorkerOperationContext } from './executeWorkerOperation';
-import type { UnlockedWalletEd25519ExportRootCapabilityV1 } from './workerTypes';
-export type DeviceLinkingSourceRequestAuthenticationV1 = {
+import type { UnlockedEd25519ExportRootLinkingCapabilityV1 } from './workerTypes';
+type DeviceLinkingSourceRequestAuthenticationV1 = {
     readonly kind: 'link_session_authenticated_request_v1';
     readonly source: LinkedDeviceOwnerAuthorizationSourceV1;
     readonly proofDigestB64u: DigestB64u;
 };
-export type DeviceLinkingEd25519SourceContributionRuntimePortV1 = {
+type DeviceLinkingEd25519SourceContributionRuntimePortV1 = {
     produceSourceContributionV1(input: {
         readonly preparation: LinkedDeviceEd25519SourceContributionPreparationV1;
-        readonly capability: UnlockedWalletEd25519ExportRootCapabilityV1;
+        readonly capability: UnlockedEd25519ExportRootLinkingCapabilityV1;
         readonly authentication: DeviceLinkingSourceRequestAuthenticationV1;
     }): Promise<LinkedDeviceEd25519SourceContributionV1>;
 };
-export type DeviceLinkingEcdsaSourceContributionRuntimePortV1 = {
+type DeviceLinkingEcdsaSourceContributionRuntimePortV1 = {
     produceSourceContributionV1(input: {
         readonly preparation: LinkedDeviceEcdsaSourceContributionPreparationV1;
     }): Promise<LinkedDeviceEcdsaSourceContributionV1>;
 };
-export type DeviceLinkingSourceContributionRuntimePortV1 = {
+type DeviceLinkingSourceContributionRuntimePortV1 = {
     readonly ed25519: DeviceLinkingEd25519SourceContributionRuntimePortV1;
     readonly ecdsa: DeviceLinkingEcdsaSourceContributionRuntimePortV1;
 };
-export type DeviceLinkingEcdsaSourceContributionMetadataV1 = {
+type DeviceLinkingEcdsaSourceContributionMetadataV1 = {
     readonly walletKeyId: WalletKeyId;
     readonly sourceDerivation: LinkedDeviceEcdsaSourceDerivationV1;
+    /** Set when the source is this linked device's own holder share. */
+    readonly linkedHolderHandleId?: string;
 };
 export type DeviceLinkingEcdsaSourceContributionMetadataReaderV1 = (input: {
     readonly preparation: LinkedDeviceEcdsaSourceContributionPreparationV1;
@@ -37,14 +40,18 @@ export type DeviceLinkingEcdsaSourceContributionMetadataContextV1 = {
     readonly readActiveEcdsaCapabilityManifestV1: (input: {
         readonly materialActivation: MpcMaterialActivationRef;
     }) => Promise<ActiveEcdsaCapabilityManifest>;
+    /** This device's linked ECDSA holder for the activation, if a link installed it. */
+    readonly readLinkedEcdsaHolderV1: (input: {
+        readonly materialActivation: MpcMaterialActivationRef;
+    }) => LinkedEcdsaHolderRuntimeV1 | null;
 };
 export declare function createDeviceLinkingEcdsaSourceContributionMetadataReaderV1(context: DeviceLinkingEcdsaSourceContributionMetadataContextV1): DeviceLinkingEcdsaSourceContributionMetadataReaderV1;
-export type DeviceLinkingSourceContributionPortFactoryInputV1 = {
+type DeviceLinkingSourceContributionPortFactoryInputV1 = {
     readonly workerContext: WorkerOperationContext;
     readonly ed25519: DeviceLinkingEd25519SourceContributionRuntimePortV1;
     readonly readEcdsaMetadataV1: DeviceLinkingEcdsaSourceContributionMetadataReaderV1;
 };
-export type DeviceLinkingEd25519SourceContributionPortFactoryInputV1 = {
+type DeviceLinkingEd25519SourceContributionPortFactoryInputV1 = {
     readonly workerContext: WorkerOperationContext;
     readonly executeSourcePreservingV1: (input: {
         readonly linkSessionId: LinkedDeviceEd25519SourceContributionPreparationV1['linkSessionId'];
@@ -56,4 +63,5 @@ export type DeviceLinkingEd25519SourceContributionPortFactoryInputV1 = {
 };
 export declare function createDeviceLinkingEd25519SourceContributionPortV1(input: DeviceLinkingEd25519SourceContributionPortFactoryInputV1): DeviceLinkingEd25519SourceContributionRuntimePortV1;
 export declare function createDeviceLinkingSourceContributionPortV1(input: DeviceLinkingSourceContributionPortFactoryInputV1): DeviceLinkingSourceContributionRuntimePortV1;
+export {};
 //# sourceMappingURL=deviceLinkingSourceContribution.d.ts.map

package/dist/types/wallet/src/core/signingEngine/workerManager/ecdsaClientWorkerChannels.d.ts

@@ -18,15 +18,15 @@ export declare const EcdsaClientWorkerControlKind: {
     readonly AttachLinkedHolderToPresign: "attach_linked_holder_to_ecdsa_presign_v1";
     readonly AttachPresignToOnline: "attach_ecdsa_presign_to_online_v1";
 };
-export type AttachEcdsaDerivationToPresignPort = {
+type AttachEcdsaDerivationToPresignPort = {
     readonly kind: typeof EcdsaClientWorkerControlKind.AttachDerivationToPresign;
     readonly port: MessagePort;
 };
-export type AttachLinkedHolderToPresignPort = {
+type AttachLinkedHolderToPresignPort = {
     readonly kind: typeof EcdsaClientWorkerControlKind.AttachLinkedHolderToPresign;
     readonly port: MessagePort;
 };
-export type AttachPresignToOnlinePort = {
+type AttachPresignToOnlinePort = {
     readonly kind: typeof EcdsaClientWorkerControlKind.AttachPresignToOnline;
     readonly port: MessagePort;
 };
@@ -203,6 +203,8 @@ export type PrepareEcdsaAdditiveLaneHolderResultV1 = EcdsaAdditiveLaneHolderPrep
 export type PrepareLinkedDeviceEcdsaSourceContributionRequestV1 = {
     readonly kind: 'prepare_linked_device_ecdsa_source_contribution_v1';
     readonly preparation: LinkedDeviceEcdsaSourceContributionPreparationV1;
+    /** Set when the source is this linked device's own holder share. */
+    readonly linkedHolderHandleId?: string;
 };
 export type PrepareLinkedDeviceEcdsaSourceContributionResultV1 = {
     readonly kind: 'linked_device_ecdsa_source_contribution_package_v1';
@@ -241,13 +243,13 @@ type RouterAbEcdsaOperationStepUpExplicitExportRequestWasmInputV1 = Omit<RouterA
         readonly authorization_id: DigestB64u;
     };
 };
-export type RouterAbEcdsaExplicitExportRequestWasmInputV1 = RouterAbEcdsaReusableExplicitExportRequestWasmInputV1 | RouterAbEcdsaOperationStepUpExplicitExportRequestWasmInputV1;
+type RouterAbEcdsaExplicitExportRequestWasmInputV1 = RouterAbEcdsaReusableExplicitExportRequestWasmInputV1 | RouterAbEcdsaOperationStepUpExplicitExportRequestWasmInputV1;
 export declare function projectRouterAbEcdsaExplicitExportRequestForWasmV1(request: RouterAbEcdsaExplicitExportRequestFactsV1): RouterAbEcdsaExplicitExportRequestWasmInputV1;
 export declare function attachRouterAbEcdsaExplicitExportOperationV1(input: {
     readonly facts: RouterAbEcdsaExplicitExportRequestFactsV1;
     readonly protocolRequest: RouterAbEcdsaDerivationExplicitExportProtocolRequestV1;
 }): RouterAbEcdsaDerivationExplicitExportRequestV1;
-export type RouterAbEcdsaActivationRefreshRequestFactsV1 = Omit<RouterAbEcdsaDerivationActivationRefreshRequestV1, 'deriver_a_refresh_envelope' | 'deriver_b_refresh_envelope'> & {
+type RouterAbEcdsaActivationRefreshRequestFactsV1 = Omit<RouterAbEcdsaDerivationActivationRefreshRequestV1, 'deriver_a_refresh_envelope' | 'deriver_b_refresh_envelope'> & {
     readonly deriver_recipient_keys: RouterAbEcdsaRegistrationRecipientKeysV1;
 };
 export type CreateRouterAbEcdsaPostRegistrationCeremonyRequestV1 = {
@@ -338,8 +340,6 @@ export type FinalizeEcdsaHolderOrdinaryExportResultV1 = {
     readonly privateKeyHex: string;
     readonly ethereumAddress: string;
 };
-export declare function parseRouterAbEcdsaExplicitExportRequestFactsV1(value: unknown): RouterAbEcdsaExplicitExportRequestFactsV1;
-export declare function parseRouterAbEcdsaActivationRefreshRequestFactsV1(value: unknown): RouterAbEcdsaActivationRefreshRequestFactsV1;
 export declare function parseCreateRouterAbEcdsaPostRegistrationCeremonyRequestV1(value: unknown): CreateRouterAbEcdsaPostRegistrationCeremonyRequestV1;
 export declare function parseCreateEcdsaHolderOrdinaryExportRequestV1(value: unknown): CreateEcdsaHolderOrdinaryExportRequestV1;
 export declare function parseFinalizeEcdsaHolderOrdinaryExportRequestV1(value: unknown): FinalizeEcdsaHolderOrdinaryExportRequestV1;

package/dist/types/wallet/src/core/signingEngine/workerManager/workerTransport.d.ts

@@ -17,11 +17,11 @@ export declare class WorkerTransport implements SignerWorkerTransportProtocol {
     clearEcdsaClientWorkerState(target: EcdsaClientPresignCleanupTarget): Promise<void>;
     private requireWorkerReadiness;
     /**
-     * Refactor 94C. Initializes the ECDSA derivation and registration WASM
-     * inside the derivation worker during the authentication prompt, so the
-     * first ceremony call after auth does not pay module init (measured 654 ms
-     * cold vs 88 ms warm on `ecdsaRegistrationClientCreateMs`). Fire-and-forget
-     * safe: failure leaves the lazy init path exactly as it was.
+     * Initializes the ECDSA derivation and registration WASM inside the
+     * derivation worker during the authentication prompt, so the first ceremony
+     * call after auth does not pay module init (measured 654 ms cold vs 88 ms
+     * warm on `ecdsaRegistrationClientCreateMs`). Fire-and-forget safe: failure
+     * leaves the lazy init path exactly as it was.
      */
     prewarmEcdsaRegistrationCrypto(): Promise<{
         kind: 'succeeded' | 'failed';