@seams/wallet 0.6.2 → 0.7.3

package/dist/public/wallet-service/index.html

@@ -5,14 +5,14 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Web3Authn Wallet Service</title>
     <!-- Surface styles are external so strict CSP can keep style-src 'self' -->
-    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.6.2" />
+    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.7.3" />
     <!-- Minimal shims some ESM bundles expect (externalized to enable strict CSP) -->
-    <script src="/sdk/wallet-shims.js?v=0.6.2"></script>
+    <script src="/sdk/wallet-shims.js?v=0.7.3"></script>
     <!-- Hint the browser to fetch the host script earlier -->
-    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.6.2" crossorigin>
+    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.7.3" crossorigin>
   </head>
   <body>
     <!-- sdkBasePath points to the SDK root (e.g. '/sdk'). Load the host directly. -->
-    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.6.2"></script>
+    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.7.3"></script>
   </body>
 </html>

package/dist/types/shared-ts/src/authorization/capabilityKinds.d.ts

@@ -1,5 +1,5 @@
 import type { DomainId } from '../utils/domainIds';
-export type AuthorizationParseError = {
+type AuthorizationParseError = {
     readonly code: 'missing' | 'invalid';
     readonly message: string;
 };
@@ -15,12 +15,12 @@ export declare const CAPABILITY_KINDS: {
     readonly nearEd25519MpcSigning: "near_ed25519_mpc_signing";
     readonly evmEcdsaMpcSigning: "evm_ecdsa_mpc_signing";
 };
-export type CapabilityKind = (typeof CAPABILITY_KINDS)[keyof typeof CAPABILITY_KINDS];
+type CapabilityKind = (typeof CAPABILITY_KINDS)[keyof typeof CAPABILITY_KINDS];
 export declare const VAULT_OPERATION_KINDS: {
     readonly proxyUse: "vault.proxy_use";
     readonly reveal: "vault.reveal";
 };
-export type VaultOperationKind = (typeof VAULT_OPERATION_KINDS)[keyof typeof VAULT_OPERATION_KINDS];
+type VaultOperationKind = (typeof VAULT_OPERATION_KINDS)[keyof typeof VAULT_OPERATION_KINDS];
 export declare const NEAR_ED25519_MPC_OPERATION_KINDS: {
     readonly signTransaction: "near.sign_transaction";
     readonly signDelegateAction: "near.sign_delegate_action";
@@ -33,8 +33,7 @@ export declare const EVM_ECDSA_MPC_OPERATION_KINDS: {
     readonly exportKey: "evm.export_key";
 };
 export type EvmEcdsaMpcOperationKind = (typeof EVM_ECDSA_MPC_OPERATION_KINDS)[keyof typeof EVM_ECDSA_MPC_OPERATION_KINDS];
-export type CapabilityOperationKind = VaultOperationKind | NearEd25519MpcOperationKind | EvmEcdsaMpcOperationKind;
-export type CapabilityOperationKindByCapability = {
+type CapabilityOperationKindByCapability = {
     readonly vault_access: VaultOperationKind;
     readonly near_ed25519_mpc_signing: NearEd25519MpcOperationKind;
     readonly evm_ecdsa_mpc_signing: EvmEcdsaMpcOperationKind;
@@ -49,14 +48,13 @@ export declare const AUTH_FACTOR_KINDS: {
     readonly passkey: "passkey";
     readonly emailOtp: "email_otp";
 };
-export type AuthFactorKind = (typeof AUTH_FACTOR_KINDS)[keyof typeof AUTH_FACTOR_KINDS];
 export declare const AUTHORIZATION_EVIDENCE_KINDS: {
     readonly seamsSession: "seams_session";
     readonly passkeyAssertion: "passkey_assertion";
     readonly emailOtp: "email_otp";
 };
-export type SessionAuthorizationEvidenceKind = typeof AUTHORIZATION_EVIDENCE_KINDS.seamsSession;
-export type InteractiveAuthorizationEvidenceKind = typeof AUTHORIZATION_EVIDENCE_KINDS.passkeyAssertion | typeof AUTHORIZATION_EVIDENCE_KINDS.emailOtp;
+type SessionAuthorizationEvidenceKind = typeof AUTHORIZATION_EVIDENCE_KINDS.seamsSession;
+type InteractiveAuthorizationEvidenceKind = typeof AUTHORIZATION_EVIDENCE_KINDS.passkeyAssertion | typeof AUTHORIZATION_EVIDENCE_KINDS.emailOtp;
 export type AuthorizationEvidenceKind = SessionAuthorizationEvidenceKind | InteractiveAuthorizationEvidenceKind;
 export type AuthorizationEvidenceRequirement = {
     readonly mode: 'all' | 'any';
@@ -65,20 +63,13 @@ export type AuthorizationEvidenceRequirement = {
 export type TenantId = DomainId<'TenantId'>;
 export type PrincipalId = DomainId<'PrincipalId'>;
 export type EcdsaAuthorizationSessionId = DomainId<'EcdsaAuthorizationSessionId'>;
-export type SeamsSession = DomainId<'SeamsSession'>;
 export type HostedWalletSessionExchangeCodeId = DomainId<'HostedWalletSessionExchangeCodeId'>;
-export type SessionClientId = DomainId<'SessionClientId'>;
 export type DeviceId = DomainId<'DeviceId'>;
 export type AuthFactorId = DomainId<'AuthFactorId'>;
 export type CapabilityId = DomainId<'CapabilityId'>;
-export type CapabilityBindingId = DomainId<'CapabilityBindingId'>;
 export type CapabilityOperationId = DomainId<'CapabilityOperationId'>;
 export type WalletSessionAuthorizationId = DomainId<'WalletSessionAuthorizationId'>;
-export declare const AUTHORIZATION_GRANT_KINDS: {
-    readonly walletSession: "wallet_session_authorization";
-};
-export type AuthorizationGrantKind = (typeof AUTHORIZATION_GRANT_KINDS)[keyof typeof AUTHORIZATION_GRANT_KINDS];
-export type WalletSessionAuthorizationRef = {
+type WalletSessionAuthorizationRef = {
     readonly kind: 'wallet_session_authorization';
     readonly authorizationId: WalletSessionAuthorizationId;
 };
@@ -90,13 +81,9 @@ export type MpcWalletSigningQuotaId = DomainId<'MpcWalletSigningQuotaId'>;
 export type WalletSessionMintId = DomainId<'WalletSessionMintId'>;
 export type AuthorizationEvidenceId = DomainId<'AuthorizationEvidenceId'>;
 export type AuthorizationEvidenceSetId = DomainId<'AuthorizationEvidenceSetId'>;
-export type GrantChallengeId = DomainId<'GrantChallengeId'>;
-export type PolicyId = DomainId<'PolicyId'>;
 export type AuthorizationAuditEventId = DomainId<'AuthorizationAuditEventId'>;
 export type VaultId = DomainId<'VaultId'>;
 export type VaultItemId = DomainId<'VaultItemId'>;
-export type CapabilityOperationResultStorageRef = DomainId<'CapabilityOperationResultStorageRef'>;
-export declare function isCapabilityKind(value: unknown): value is CapabilityKind;
 export declare function isAuthorizationEvidenceKind(value: unknown): value is AuthorizationEvidenceKind;
 export declare function buildVaultOperationRef<TOperationKind extends VaultOperationKind>(operationKind: TOperationKind): Extract<CapabilityOperationRef, {
     readonly capabilityKind: 'vault_access';
@@ -121,13 +108,10 @@ export declare function buildAuthorizationEvidenceRequirement(input: {
 export declare function parseTenantId(value: unknown): AuthorizationParseResult<TenantId>;
 export declare function parsePrincipalId(value: unknown): AuthorizationParseResult<PrincipalId>;
 export declare function parseEcdsaAuthorizationSessionId(value: unknown): AuthorizationParseResult<EcdsaAuthorizationSessionId>;
-export declare function parseSeamsSession(value: unknown): AuthorizationParseResult<SeamsSession>;
 export declare function parseHostedWalletSessionExchangeCodeId(value: unknown): AuthorizationParseResult<HostedWalletSessionExchangeCodeId>;
-export declare function parseSessionClientId(value: unknown): AuthorizationParseResult<SessionClientId>;
 export declare function parseDeviceId(value: unknown): AuthorizationParseResult<DeviceId>;
 export declare function parseAuthFactorId(value: unknown): AuthorizationParseResult<AuthFactorId>;
 export declare function parseCapabilityId(value: unknown): AuthorizationParseResult<CapabilityId>;
-export declare function parseCapabilityBindingId(value: unknown): AuthorizationParseResult<CapabilityBindingId>;
 export declare function parseCapabilityOperationId(value: unknown): AuthorizationParseResult<CapabilityOperationId>;
 export declare function parseAuthorizationGrantRef(value: unknown): AuthorizationParseResult<AuthorizationGrantRef>;
 export declare function buildAuthorizationGrantRef(authorizationId: WalletSessionAuthorizationId): WalletSessionAuthorizationRef;
@@ -138,10 +122,8 @@ export declare function parseMpcWalletSigningQuotaId(value: unknown): Authorizat
 export declare function parseWalletSessionMintId(value: unknown): AuthorizationParseResult<WalletSessionMintId>;
 export declare function parseAuthorizationEvidenceId(value: unknown): AuthorizationParseResult<AuthorizationEvidenceId>;
 export declare function parseAuthorizationEvidenceSetId(value: unknown): AuthorizationParseResult<AuthorizationEvidenceSetId>;
-export declare function parseGrantChallengeId(value: unknown): AuthorizationParseResult<GrantChallengeId>;
-export declare function parsePolicyId(value: unknown): AuthorizationParseResult<PolicyId>;
 export declare function parseAuthorizationAuditEventId(value: unknown): AuthorizationParseResult<AuthorizationAuditEventId>;
 export declare function parseVaultId(value: unknown): AuthorizationParseResult<VaultId>;
 export declare function parseVaultItemId(value: unknown): AuthorizationParseResult<VaultItemId>;
-export declare function parseCapabilityOperationResultStorageRef(value: unknown): AuthorizationParseResult<CapabilityOperationResultStorageRef>;
+export {};
 //# sourceMappingURL=capabilityKinds.d.ts.map

package/dist/types/shared-ts/src/authorization/delegatedAuthority.d.ts

@@ -1,7 +1,6 @@
 import type { AuthorizationParseResult } from './capabilityKinds';
-export type DelegatedWalletPermissionV1 = 'sign' | 'export_keys' | 'link_devices' | 'revoke_devices';
-export declare const FULL_OWNER_PERMISSIONS: readonly ["export_keys", "link_devices", "revoke_devices", "sign"];
-export declare const SIGNING_ONLY_PERMISSIONS: readonly ["sign"];
+export type DelegatedWalletPermissionV1 = (typeof DELEGATED_WALLET_PERMISSION_VALUES)[number];
+declare const DELEGATED_WALLET_PERMISSION_VALUES: readonly ["export_keys", "link_devices", "revoke_devices", "sign"];
 type CanonicalPermissionTuple = readonly [
     DelegatedWalletPermissionV1,
     ...DelegatedWalletPermissionV1[]
@@ -19,14 +18,12 @@ export type DelegatedWalletAuthorityV1 = {
     readonly kind: 'delegated_wallet_authority_v1';
     readonly permissions: CanonicalDelegatedWalletPermissionSetV1;
 };
-export declare function isDelegatedWalletPermissionV1(value: unknown): value is DelegatedWalletPermissionV1;
 export declare function parseDelegatedWalletPermissionSetV1(raw: unknown): AuthorizationParseResult<CanonicalDelegatedWalletPermissionSetV1>;
 export declare function buildDelegatedWalletAuthorityV1(input: {
     readonly permissions: CanonicalDelegatedWalletPermissionSetV1;
 }): DelegatedWalletAuthorityV1;
 export declare function parseDelegatedWalletAuthorityV1(raw: unknown): AuthorizationParseResult<DelegatedWalletAuthorityV1>;
 export declare function buildFullOwnerPermissionsV1(): CanonicalDelegatedWalletPermissionSetV1;
-export declare function buildSigningOnlyPermissionsV1(): CanonicalDelegatedWalletPermissionSetV1;
 export declare function buildFullOwnerDelegatedWalletAuthorityV1(): DelegatedWalletAuthorityV1;
 export declare function buildSigningOnlyDelegatedWalletAuthorityV1(): DelegatedWalletAuthorityV1;
 export declare function hasDelegatedWalletPermissionV1(authority: DelegatedWalletAuthorityV1, permission: DelegatedWalletPermissionV1): boolean;
@@ -36,9 +33,5 @@ export declare function validateDelegatedWalletAuthorityAttenuationV1(input: {
     readonly parent: DelegatedWalletAuthorityV1;
     readonly child: DelegatedWalletAuthorityV1;
 }): AuthorizationParseResult<true>;
-export declare function assertDelegatedWalletAuthorityAttenuationV1(input: {
-    readonly parent: DelegatedWalletAuthorityV1;
-    readonly child: DelegatedWalletAuthorityV1;
-}): void;
 export {};
 //# sourceMappingURL=delegatedAuthority.d.ts.map

package/dist/types/shared-ts/src/authorization/operationFingerprint.d.ts

@@ -1,5 +1,5 @@
 import type { DigestB64u } from '../utils/canonicalPrimitives';
-import { type AuthorizationParseResult, type CapabilityId, type CapabilityOperationId, type CapabilityOperationRef, type PrincipalId, type TenantId } from './capabilityKinds';
+import type { CapabilityId, CapabilityOperationId, CapabilityOperationRef, PrincipalId, TenantId } from './capabilityKinds';
 declare const capabilityOperationFingerprintDigestBrand: unique symbol;
 export type CapabilityOperationFingerprintDigest = DigestB64u & {
     readonly [capabilityOperationFingerprintDigestBrand]: true;
@@ -29,8 +29,6 @@ declare class CapabilityOperationEnvelopeProof<TOperation extends CapabilityOper
 }
 export type CapabilityOperationEnvelope<TOperation extends CapabilityOperationRef = CapabilityOperationRef> = CapabilityOperationEnvelopeProof<TOperation>;
 export declare function buildCapabilityOperationEnvelope<TOperation extends CapabilityOperationRef>(fields: CapabilityOperationEnvelopeFields<TOperation>): CapabilityOperationEnvelope<TOperation>;
-export declare function parseCapabilityOperationEnvelope(raw: unknown): AuthorizationParseResult<CapabilityOperationEnvelope>;
-export declare function parseOperationDigestSet(raw: unknown): AuthorizationParseResult<OperationDigestSet>;
 export declare function canonicalCapabilityOperationFingerprintPreimageV1(envelope: CapabilityOperationEnvelope): string;
 export declare function computeCapabilityOperationFingerprintDigest(envelope: CapabilityOperationEnvelope): Promise<CapabilityOperationFingerprintDigest>;
 export declare function parseCapabilityOperationFingerprintDigest(value: unknown): CapabilityOperationFingerprintDigest;

package/dist/types/shared-ts/src/authorization/walletAuthority.d.ts

@@ -3,7 +3,7 @@ import { type CanonicalDelegatedWalletPermissionSetV1 } from './delegatedAuthori
 import { type AuthorizationParseResult, type DeviceId } from './capabilityKinds';
 import { type ExactAdministeredEd25519SignerV1, type ExactAdministeredEcdsaSignerV1, type ExactAdministeredSignerManifestV1 } from '../device-linking/delegatedActivationPlan';
 import { type LinkDeviceSessionId, type LinkedDeviceEnrollmentId, type MpcMaterialActivationRef, type WalletAuthorityId, type WalletId, type WalletRecoveryOperationId } from '../utils/domainIds';
-export type WalletAuthorityPrincipalV1 = {
+type WalletAuthorityPrincipalV1 = {
     readonly kind: 'owner_device';
     readonly deviceId: DeviceId;
 };
@@ -55,7 +55,7 @@ export type WalletSignerActivationSetV1 = {
     readonly ed25519: WalletEd25519SignerActivationV1;
     readonly ecdsa: WalletEcdsaSignerActivationV1;
 };
-export type WalletSignerActivationMaterialsV1 = {
+type WalletSignerActivationMaterialsV1 = {
     readonly keyFamilies: readonly ['ed25519'];
     readonly ed25519: MpcMaterialActivationRef;
     readonly ecdsa?: never;
@@ -68,11 +68,11 @@ export type WalletSignerActivationMaterialsV1 = {
     readonly ed25519: MpcMaterialActivationRef;
     readonly ecdsa: MpcMaterialActivationRef;
 };
-export type WalletSignerActivationSetBuilderInputV1 = {
+type WalletSignerActivationSetBuilderInputV1 = {
     readonly manifest: ExactAdministeredSignerManifestV1;
     readonly materialActivations: WalletSignerActivationMaterialsV1;
 };
-export type WalletAuthorityCommonV1 = {
+type WalletAuthorityCommonV1 = {
     readonly kind: 'wallet_authority_v1';
     readonly authorityId: WalletAuthorityId;
     readonly walletId: WalletId;
@@ -136,11 +136,8 @@ export type ActiveCombinedWalletAuthorityV1 = Omit<ActiveWalletAuthorityV1, 'sig
 };
 export declare function isCombinedWalletSignerActivationSetV1(value: WalletSignerActivationSetV1): value is CombinedWalletSignerActivationSetV1;
 export declare function isActiveEcdsaWalletAuthorityV1(value: ActiveWalletAuthorityV1): value is ActiveEcdsaWalletAuthorityV1;
+export declare function isActiveEd25519WalletAuthorityV1(value: ActiveWalletAuthorityV1): value is ActiveEd25519WalletAuthorityV1;
 export declare function isActiveRecoveredWalletAuthorityV1(value: ActiveWalletAuthorityV1): value is ActiveRecoveredWalletAuthorityV1;
-export declare function buildWalletEd25519SignerActivationV1(input: {
-    readonly signer: ExactAdministeredEd25519SignerV1;
-    readonly materialActivation: MpcMaterialActivationRef;
-}): WalletEd25519SignerActivationV1;
 export declare function buildWalletEcdsaSignerActivationV1(input: {
     readonly signer: ExactAdministeredEcdsaSignerV1;
     readonly materialActivation: MpcMaterialActivationRef;
@@ -149,8 +146,6 @@ export declare function buildWalletSignerActivationSetV1(input: WalletSignerActi
 export declare function parseWalletSignerActivationSetV1(raw: unknown): AuthorizationParseResult<WalletSignerActivationSetV1>;
 export declare function encodeWalletSignerActivationSetV1(value: WalletSignerActivationSetV1): Uint8Array;
 export declare function computeWalletSignerActivationSetDigestB64u(value: WalletSignerActivationSetV1): Promise<DigestB64u>;
-export declare function parseWalletSignerActivationSetDigestB64u(raw: unknown): DigestB64u;
-export declare function buildWalletAuthorityV1(input: WalletAuthorityV1): WalletAuthorityV1;
 export declare function buildPendingWalletAuthorityV1(input: PendingWalletAuthorityV1): PendingWalletAuthorityV1;
 export declare function buildActiveWalletAuthorityV1(input: ActiveWalletAuthorityV1): ActiveWalletAuthorityV1;
 export declare function replaceActiveWalletAuthorityEd25519MaterialActivationV1(input: {
@@ -161,15 +156,33 @@ export declare function replaceActiveWalletAuthorityEd25519MaterialActivationV1(
 export declare function buildActiveCombinedWalletAuthorityV1(input: ActiveCombinedWalletAuthorityV1): ActiveCombinedWalletAuthorityV1;
 export declare function buildRevokedWalletAuthorityV1(input: RevokedWalletAuthorityV1): RevokedWalletAuthorityV1;
 export declare function parseWalletAuthorityV1(raw: unknown): AuthorizationParseResult<WalletAuthorityV1>;
-export declare function encodeWalletAuthorityV1(value: WalletAuthorityV1): Uint8Array;
 export declare function computeWalletAuthorityDigestB64u(value: WalletAuthorityV1): Promise<DigestB64u>;
-export declare function parseWalletAuthorityDigestB64u(raw: unknown): DigestB64u;
 export declare function walletAuthorityDigestsMatchV1(value: WalletAuthorityV1): Promise<boolean>;
+/**
+ * True when both authorities' stored digests verify and agree. The authority digest does not
+ * cover the timestamps, so those must agree too.
+ */
+export declare function sameVerifiedActiveWalletAuthorityV1(left: ActiveWalletAuthorityV1, right: ActiveWalletAuthorityV1): Promise<boolean>;
 export declare function extendEcdsaWalletAuthorityWithEd25519(input: {
     readonly authority: ActiveEcdsaWalletAuthorityV1;
     readonly ed25519: WalletEd25519SignerActivationV1;
     readonly now: number;
 }): Promise<ActiveCombinedWalletAuthorityV1>;
+/**
+ * An authority holding only a NEAR signer gains the ECDSA signer its owner
+ * added. The NEAR activation, identity and lifecycle stay as they were.
+ */
+export declare function extendEd25519WalletAuthorityWithEcdsa(input: {
+    readonly authority: ActiveEd25519WalletAuthorityV1;
+    readonly ecdsa: WalletEcdsaSignerActivationV1;
+    readonly now: number;
+}): Promise<ActiveCombinedWalletAuthorityV1>;
+/**
+ * Whether `next` is `previous` with an added ECDSA signer and nothing else
+ * changed. Both projections have already passed digest validation.
+ */
+export declare function isEcdsaExtensionOfEd25519WalletAuthority(previous: ActiveWalletAuthorityV1, next: ActiveWalletAuthorityV1): boolean;
 /** Both projections have already passed digest validation at their boundaries. */
 export declare function isEd25519ExtensionOfEcdsaWalletAuthority(previous: ActiveWalletAuthorityV1, next: ActiveWalletAuthorityV1): boolean;
+export {};
 //# sourceMappingURL=walletAuthority.d.ts.map

package/dist/types/shared-ts/src/authorization/walletSessionIssuance.d.ts

@@ -23,6 +23,14 @@ export type WalletSessionAlreadyCommittedResponseV1 = {
     readonly next: 'unlock_exact_method';
     readonly committed: WalletSessionCommittedIdentityV1;
 };
+/** An issuer rejection that carries no committed identity to retry against. */
+export type WalletSessionRejectionV1 = {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+    readonly next?: never;
+    readonly committed?: never;
+};
 export declare function parseWalletSessionAlreadyCommittedResponseV1(value: unknown): WalletSessionAlreadyCommittedResponseV1 | null;
 export declare function parseWalletUnlockAlreadyCommittedResponseV1(value: unknown): WalletSessionAlreadyCommittedResponseV1 | null;
 //# sourceMappingURL=walletSessionIssuance.d.ts.map

package/dist/types/shared-ts/src/authorization/walletSignerActivationEquality.d.ts

@@ -0,0 +1,4 @@
+import type { WalletEcdsaSignerActivationV1, WalletEd25519SignerActivationV1 } from './walletAuthority';
+export declare function sameWalletEd25519SignerActivationV1(left: WalletEd25519SignerActivationV1, right: WalletEd25519SignerActivationV1): boolean;
+export declare function sameWalletEcdsaSignerActivationV1(left: WalletEcdsaSignerActivationV1, right: WalletEcdsaSignerActivationV1): boolean;
+//# sourceMappingURL=walletSignerActivationEquality.d.ts.map

package/dist/types/shared-ts/src/device-linking/activeWalletSession.d.ts

@@ -1,5 +1,6 @@
-import type { ActiveWalletSessionV1, WalletCapabilitySubjectV1 } from './contracts';
+import type { ActiveWalletSessionV1, WalletSessionOperationCredentialV1 } from './contracts';
 export declare function activeWalletSessionV1RecordsEqual(left: ActiveWalletSessionV1, right: ActiveWalletSessionV1): boolean;
-export declare function walletCapabilitySubjectsEqual(left: WalletCapabilitySubjectV1, right: WalletCapabilitySubjectV1): boolean;
 export declare function walletSessionPreservesCapabilities(previous: ActiveWalletSessionV1, next: ActiveWalletSessionV1): boolean;
+export declare function parseWalletSessionOperationCredentialV1(raw: unknown): WalletSessionOperationCredentialV1;
+export declare function parseActiveWalletSessionV1(raw: unknown): ActiveWalletSessionV1;
 //# sourceMappingURL=activeWalletSession.d.ts.map

package/dist/types/shared-ts/src/device-linking/authorityActivation.d.ts

@@ -0,0 +1,5 @@
+import { type ActivateInstalledAuthorityResultV1, type LocalAuthorityActivationFinalAckV1, type LocalAuthorityInstallationReceiptV1 } from './contracts';
+export declare function parseLocalAuthorityInstallationReceiptV1(raw: unknown): LocalAuthorityInstallationReceiptV1;
+export declare function parseLocalAuthorityActivationFinalAckV1(raw: unknown): LocalAuthorityActivationFinalAckV1;
+export declare function parseActivateInstalledAuthorityResultV1(raw: unknown): ActivateInstalledAuthorityResultV1;
+//# sourceMappingURL=authorityActivation.d.ts.map

package/dist/types/shared-ts/src/device-linking/committedSignerPackages.d.ts

@@ -3,10 +3,11 @@ import type { CanonicalDelegatedWalletPermissionSetV1 } from '../authorization/d
 import type { PendingWalletAuthorityV1 } from '../authorization/walletAuthority';
 import { type LinkDeviceSessionId, type LinkedDeviceEnrollmentId, type MpcMaterialActivationRef, type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from '../utils/domainIds';
 import { type DigestB64u } from '../utils/canonicalPrimitives';
-import { type WalletAuthMethodRecordV2 } from '../utils/registrationIntent';
+import { type PendingWalletAuthMethodRecordV2 } from '../utils/walletAuthMethodRecord';
 import { type LinkedDeviceEd25519ExportRootPackageV1 } from './ed25519ExportRoot';
 import { type LinkedDeviceEcdsaEncryptedSourceContributionV1, type LinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from './sourceContribution';
 import { type RouterAbEd25519YaoApplicationBindingFactsV1, type RouterAbEd25519YaoActivationPublicReceiptV1, type RouterAbEd25519YaoActivationClientPackageV1, type RouterAbEd25519YaoCeremonyBindingV1 } from '../utils/routerAbEd25519Yao';
+import type { ReadonlyExclusiveUnion } from '../utils/variant';
 export type CommittedEd25519SignerPackageV1 = {
     readonly kind: 'committed_ed25519_signer_package_v1';
     readonly materialActivation: MpcMaterialActivationRef;
@@ -23,29 +24,24 @@ export type CommittedEcdsaSignerPackageV1 = {
     readonly encryptedTargetClientShare: LinkedDeviceEcdsaEncryptedSourceContributionV1;
     readonly activationReceipt: LinkedDeviceEcdsaSourcePreservingActivationReceiptV1;
 };
-export type CommittedSignerPackageSetV1 = {
+export type CommittedSignerPackageSetV1 = ReadonlyExclusiveUnion<{
     readonly kind: 'committed_signer_package_set_v1';
     readonly keyFamilies: readonly ['ed25519'];
     readonly ed25519: CommittedEd25519SignerPackageV1;
-    readonly ecdsa?: never;
 } | {
     readonly kind: 'committed_signer_package_set_v1';
     readonly keyFamilies: readonly ['ecdsa_secp256k1'];
-    readonly ed25519?: never;
     readonly ecdsa: CommittedEcdsaSignerPackageV1;
 } | {
     readonly kind: 'committed_signer_package_set_v1';
     readonly keyFamilies: readonly ['ed25519', 'ecdsa_secp256k1'];
     readonly ed25519: CommittedEd25519SignerPackageV1;
     readonly ecdsa: CommittedEcdsaSignerPackageV1;
-};
-export type PendingWalletAuthMethodRecordV1 = Extract<WalletAuthMethodRecordV2, {
-    readonly status: 'pending_local_install';
 }>;
 export type CommittedAuthorityPackagesV1 = {
     readonly kind: 'committed_authority_packages_v1';
     readonly authority: PendingWalletAuthorityV1;
-    readonly authMethod: PendingWalletAuthMethodRecordV1;
+    readonly authMethod: PendingWalletAuthMethodRecordV2;
     readonly signerPackages: CommittedSignerPackageSetV1;
     readonly ed25519ExportRootPackage: LinkedDeviceEd25519ExportRootPackageV1 | null;
     readonly packageSetDigestB64u: DigestB64u;

package/dist/types/shared-ts/src/device-linking/contracts.d.ts

@@ -6,15 +6,17 @@ import type { WebAuthnAuthenticatorDeviceInfo } from '../utils/webauthnDeviceInf
 import type { DigestB64u } from '../utils/canonicalPrimitives';
 import type { WalletAddAuthMethodRegistrationOptions } from '../utils/addAuthMethodRegistration';
 import type { Ed25519PublicKeyB64u } from '../passkey-custody/primitives';
-import type { ActiveWalletAuthorityV1, WalletAuthorityV1, WalletSignerActivationSetV1 } from '../authorization/walletAuthority';
+import type { ActiveWalletAuthorityV1, WalletSignerActivationSetV1 } from '../authorization/walletAuthority';
 import type { CanonicalDelegatedWalletPermissionSetV1 } from '../authorization/delegatedAuthority';
 import type { ExactAdministeredSignerManifestV1 } from './delegatedActivationPlan';
-import type { EmailOtpWalletAuthMethodDraftV1, PasskeyWalletAuthMethodDraftV1, WalletAuthMethodRecordV2, WalletEmailOtpEnrollmentMaterialV1 } from '../utils/registrationIntent';
+import type { ActiveWalletAuthMethodRecordV2, EmailOtpWalletAuthMethodDraftV1, PasskeyWalletAuthMethodDraftV1 } from '../utils/walletAuthMethodRecord';
+import type { WalletEmailOtpEnrollmentMaterialV1 } from '../utils/registrationAuthMethodInput';
 import type { VerifiedEmailAddress } from '../utils/domainIds';
 import type { LinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, LinkedDeviceOrdinaryMaterialSourceContributionTupleV1 } from './sourceContribution';
 import type { LinkedDeviceWalletSessionCredentialDeliveryBindingV1, LinkedDeviceWalletSessionCredentialDeliveryV1 } from './walletSessionCredentialDelivery';
+import type { ReadonlyExclusiveUnion } from '../utils/variant';
 export type { LinkedDeviceEcdsaSourceContributionBindingV1, LinkedDeviceEcdsaSourceContributionPackageV1, LinkedDeviceEcdsaSourceContributionPreparationV1, LinkedDeviceEcdsaSourceDerivationV1, LinkedDeviceEcdsaSourcePreservingActivationReceiptV1, LinkedDeviceEcdsaSourceContributionV1, LinkedDeviceEcdsaSourceSignerIdentityV1, LinkedDeviceEcdsaTargetRecipientPreparationV1, LinkedDeviceEd25519SourceContributionPreparationV1, LinkedDeviceEd25519SourceContributionV1, LinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, LinkedDeviceOrdinaryMaterialSourceContributionTupleV1, LinkedDeviceOrdinaryMaterialSourceContributionV1, } from './sourceContribution';
-export type { CommittedAuthorityPackagesV1, CommittedEd25519SignerPackageV1, CommittedEcdsaSignerPackageV1, PendingWalletAuthMethodRecordV1, CommittedSignerPackageSetDigestInputV1, CommittedSignerPackageSetV1, } from './committedSignerPackages';
+export type { CommittedAuthorityPackagesV1, CommittedEd25519SignerPackageV1, CommittedEcdsaSignerPackageV1, CommittedSignerPackageSetDigestInputV1, CommittedSignerPackageSetV1, } from './committedSignerPackages';
 /** Public key bytes carried by the link session, encoded as canonical base64url. */
 export type LinkDevicePublicKeyB64u = string & {
     readonly __linkDevicePublicKeyB64uBrand: 'LinkDevicePublicKeyB64u';
@@ -468,7 +470,7 @@ export type OwnerDeviceSummaryV1 = {
     /**
      * The authority this method belongs to.
      *
-     * R109C puts both factor families on one founding authority and lists one
+     * A founding authority can hold both factor families, and the list gives one
      * entry per active method, so a reader needs this to group the entries it was
      * given — to decide which family is still missing on THIS authority, and to
      * know which sibling would remain if one were removed. Grouping by wallet
@@ -530,97 +532,40 @@ export type LinkPrecommitFailureV1 = {
     readonly reason: string;
 };
 /** The only durable states retained by the linear link-session boundary. */
-export type LinkSessionStateV1 = {
+export type LinkSessionStateV1 = ReadonlyExclusiveUnion<{
     readonly state: 'displaying_qr';
-    readonly deviceId?: never;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly activatedAtMs?: never;
-    readonly error?: never;
-    readonly cancelledAtMs?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'claimed';
     readonly deviceId: DeviceId;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly activatedAtMs?: never;
-    readonly error?: never;
-    readonly cancelledAtMs?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'awaiting_target_factor';
     readonly deviceId: DeviceId;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly activatedAtMs?: never;
-    readonly error?: never;
-    readonly cancelledAtMs?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'awaiting_source_contribution';
     readonly deviceId: DeviceId;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly activatedAtMs?: never;
-    readonly error?: never;
-    readonly cancelledAtMs?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'provisioning';
     readonly deviceId: DeviceId;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly activatedAtMs?: never;
-    readonly error?: never;
-    readonly cancelledAtMs?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'authority_pending_local_install';
     readonly deviceId: DeviceId;
     readonly authorityId: WalletAuthorityId;
     readonly packageSetDigestB64u: DigestB64u;
-    readonly activatedAtMs?: never;
-    readonly error?: never;
-    readonly cancelledAtMs?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'active';
     readonly deviceId: DeviceId;
     readonly authorityId: WalletAuthorityId;
     readonly activatedAtMs: number;
-    readonly packageSetDigestB64u?: never;
-    readonly error?: never;
-    readonly cancelledAtMs?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'failed_before_commit';
     readonly error: LinkPrecommitFailureV1;
-    readonly deviceId?: never;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly activatedAtMs?: never;
-    readonly cancelledAtMs?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'cancelled';
     readonly cancelledAtMs: number;
-    readonly deviceId?: never;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly activatedAtMs?: never;
-    readonly error?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'expired';
     readonly expiredAtMs: number;
-    readonly deviceId?: never;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly activatedAtMs?: never;
-    readonly error?: never;
-    readonly cancelledAtMs?: never;
-};
+}>;
 export type VerifiedSourceAuthorityV1 = {
     readonly authority: ActiveWalletAuthorityV1;
     readonly authMethodId: WalletAuthMethodId;
@@ -701,7 +646,7 @@ export type LinkedDeviceTargetCredentialRegistrationResultV1 = {
     readonly keyManifestDigestB64u: DigestB64u;
 };
 /** The ordinary session issued by activation and persisted by the browser. */
-export type WalletCapabilitySubjectV1 = {
+export type WalletCapabilitySubjectV1 = ReadonlyExclusiveUnion<{
     readonly kind: 'sign';
     readonly keyFamily: 'ed25519' | 'ecdsa_secp256k1';
     readonly materialActivation: MpcMaterialActivationRef;
@@ -711,9 +656,7 @@ export type WalletCapabilitySubjectV1 = {
     readonly materialActivation: MpcMaterialActivationRef;
 } | {
     readonly kind: 'link_devices' | 'revoke_devices';
-    readonly keyFamily?: never;
-    readonly materialActivation?: never;
-};
+}>;
 export type ActiveWalletSessionV1 = {
     readonly kind: 'active_wallet_session_v1';
     readonly walletId: WalletId;
@@ -745,7 +688,7 @@ export type LocalAuthorityInstallationReceiptV1 = {
     readonly targetFactorVerificationDigestB64u: DigestB64u;
     readonly installedAtMs: number;
 };
-export type RelinkRequiredReasonV1 = {
+type RelinkRequiredReasonV1 = {
     readonly kind: 'incomplete_migrated_enrollment';
 } | {
     readonly kind: 'missing_canonical_local_material';
@@ -772,12 +715,8 @@ export type ActivationRetryReasonV1 = {
 };
 export type ActivateInstalledAuthorityResultV1 = {
     readonly kind: 'active';
-    readonly authority: Extract<WalletAuthorityV1, {
-        readonly state: 'active';
-    }>;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly authority: ActiveWalletAuthorityV1;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly walletSession: ActiveWalletSessionV1;
     readonly deliveryBinding: LinkedDeviceWalletSessionCredentialDeliveryBindingV1;
     readonly sealedDelivery: LinkedDeviceWalletSessionCredentialDeliveryV1;

package/dist/types/shared-ts/src/device-linking/contracts.typecheck.d.ts

@@ -1,2 +1,3 @@
-export {};
+import type { LinkedDeviceOwnerAuthorizationSourceV1 } from './contracts';
+export declare const invalidStepUpOwnerAuthorization: LinkedDeviceOwnerAuthorizationSourceV1;
 //# sourceMappingURL=contracts.typecheck.d.ts.map

package/dist/types/shared-ts/src/device-linking/deviceManagement.d.ts

@@ -0,0 +1,7 @@
+import { type LinkedDeviceListRequestV1, type LinkedDeviceListResultV1, type LinkedDeviceRevokeRequestV1, type LinkedDeviceRevokeResultV1, type LinkedDeviceSummaryV1 } from './contracts';
+export declare function parseLinkedDeviceSummaryV1(raw: unknown): LinkedDeviceSummaryV1;
+export declare function parseLinkedDeviceListRequestV1(raw: unknown): LinkedDeviceListRequestV1;
+export declare function parseLinkedDeviceListResultV1(raw: unknown): LinkedDeviceListResultV1;
+export declare function parseLinkedDeviceRevokeRequestV1(raw: unknown): LinkedDeviceRevokeRequestV1;
+export declare function parseLinkedDeviceRevokeResultV1(raw: unknown): LinkedDeviceRevokeResultV1;
+//# sourceMappingURL=deviceManagement.d.ts.map

package/dist/types/shared-ts/src/device-linking/digests.d.ts

@@ -6,15 +6,10 @@ export { computeCommittedSignerPackageDigestB64u, computeCommittedSignerPackageS
  * opaque token directly keeps the browser binding identical to that row.
  */
 export declare function computeWalletSessionOperationCredentialDigestB64u(credential: WalletSessionOperationCredentialV1): Promise<DigestB64u>;
-export declare function encodeWalletSessionInstallationReceiptV1(receipt: LocalAuthorityInstallationReceiptV1): string;
 export declare function computeWalletSessionInstallationReceiptDigestB64u(receipt: LocalAuthorityInstallationReceiptV1): Promise<DigestB64u>;
-export declare function encodeLinkedDevicePasskeyTargetConfigurationV1(value: LinkedDevicePasskeyTargetConfigurationFieldsV1): Uint8Array;
 export declare function computeLinkedDevicePasskeyTargetConfigurationDigestV1(value: LinkedDevicePasskeyTargetConfigurationFieldsV1): Promise<DigestB64u>;
-export declare function encodeLinkedDeviceSessionClaimV1(value: LinkedDeviceSessionClaimV1): Uint8Array;
 export declare function computeLinkedDeviceSessionClaimDigestV1(value: LinkedDeviceSessionClaimV1): Promise<DigestB64u>;
-export declare function encodeLinkedDeviceApprovalV1(value: LinkedDeviceApprovalV1): Uint8Array;
 export declare function computeLinkedDeviceApprovalDigestV1(value: LinkedDeviceApprovalV1): Promise<DigestB64u>;
-export declare function encodeLinkedDeviceTargetPreparationV1(value: LinkedDeviceTargetPreparationV1): Uint8Array;
 export declare function computeLinkedDeviceTargetPreparationDigestV1(value: LinkedDeviceTargetPreparationV1): Promise<DigestB64u>;
 export declare function assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1(input: {
     readonly preparation: LinkedDeviceTargetPreparationV1;

package/dist/types/shared-ts/src/device-linking/ed25519ExportRoot.d.ts

@@ -11,11 +11,11 @@ import type { LinkedDeviceTargetFactorV1 } from './contracts';
 /** Frozen by signer-core's Ed25519 Yao Client-root transfer module. */
 export declare const LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1: "x25519-hkdf-sha256-chacha20poly1305-v1";
 /** One-use X25519 public key generated and retained by Device 2's worker. */
-export type LinkedDeviceEd25519ExportRootRecipientPublicKeyB64u = string & {
+type LinkedDeviceEd25519ExportRootRecipientPublicKeyB64u = string & {
     readonly __linkedDeviceEd25519ExportRootRecipientPublicKeyB64uBrand: 'LinkedDeviceEd25519ExportRootRecipientPublicKeyB64u';
 };
 /** Exact public facts authenticated by signer-core as transfer AAD. */
-export type LinkedDeviceEd25519ExportRootTransferBindingV1 = {
+type LinkedDeviceEd25519ExportRootTransferBindingV1 = {
     readonly linkSessionId: LinkDeviceSessionId;
     readonly walletId: WalletId;
     readonly walletKeyId: WalletKeyId;
@@ -90,4 +90,5 @@ export declare function parseLinkedDeviceEd25519ExportRootPackageV1(raw: unknown
 export declare function parseLinkedDeviceEd25519ExportRootSubmissionV1(raw: unknown): LinkedDeviceEd25519ExportRootSubmissionV1;
 /** Ensures relay persistence cannot join two different root bindings. */
 export declare function linkedDeviceEd25519ExportRootMatchesRecipientV1(transferPackage: LinkedDeviceEd25519ExportRootPackageV1, recipient: LinkedDeviceEd25519ExportRootRecipientV1): boolean;
+export {};
 //# sourceMappingURL=ed25519ExportRoot.d.ts.map

package/dist/types/shared-ts/src/device-linking/index.d.ts

@@ -3,6 +3,8 @@ export * from './activeWalletSession';
 export * from './ed25519ExportRoot';
 export * from './delegatedActivationPlan';
 export * from './parsers';
+export * from './deviceManagement';
+export * from './authorityActivation';
 export * from './digests';
 export * from './requestProof';
 export * from './committedSignerPackages';