@seams/wallet 0.6.2 → 0.7.3

package/dist/types/wallet/src/SeamsWeb/operations/auth/login.d.ts

@@ -3,40 +3,24 @@ import type { GetRecentUnlocksResult, LoginAndCreateSessionResult, WalletSession
 import type { LoginWebContext, RecentUnlocksWebContext, WalletSessionWebContext } from '../../signingSurface/types';
 import { type AccountId } from '../../../core/types/accountIds';
 import type { EcdsaClientPresignCleanupTarget } from '../../../core/signingEngine/workerManager/ecdsaPresignLifecycle';
-import type { WalletAuthorityV1 } from '../../../../../shared-ts/src/authorization/walletAuthority';
+import type { ActiveWalletAuthorityV1 } from '../../../../../shared-ts/src/authorization/walletAuthority';
 import type { ActiveWalletSessionV1, WalletSessionOperationCredentialV1 } from '../../../../../shared-ts/src/device-linking';
 import { type WalletAuthMethodId } from '../../../../../shared-ts/src/utils/domainIds';
 import { type EmailOtpWalletAuthAuthority, type EmailOtpProvider } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
-import { IndexedDBManager } from '../../../core/indexedDB';
-import type { ClientUserData } from '../../../core/accountData/near/nearAccountData.types';
-import type { AccountSignerRecord, LocalWalletAuthMethodProjectionV2, LocalWalletAuthMethodRecordV2, WalletAuthorityExportRootRecordV1, WalletAuthoritySignerMaterialRecordV1, WalletSelectionRecordV1 } from '../../../core/indexedDB/passkeyClientDB.types';
-import { type OpenWalletAuthorityLinkedSignerMaterialResultV1 } from '../../../core/indexedDB/linkedAuthoritySignerMaterial';
-import { type RouterAbEcdsaPostRegistrationSessionActivationPolicyV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import { type ThresholdEcdsaChainTarget, type WalletId } from '../../../core/signingEngine/interfaces/ecdsaChainTarget';
-import { type WalletUnlockSelection } from '../../../core/signingEngine/session/passkey/unlockEcdsaWarmupPlanner';
-import type { ThresholdEcdsaKeyIdentityInventoryEntry } from '../../../core/signingEngine/session/passkey/ecdsaKeyFactsInventory';
+import type { ActiveEmailOtpWalletAuthMethodRecordV2, ActivePasskeyWalletAuthMethodRecordV2, ActiveWalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import type { LocalWalletAuthMethodProjectionV2, WalletAuthorityExportRootRecordV1, WalletAuthoritySignerMaterialRecordV1, WalletSelectionRecordV1 } from '../../../core/indexedDB/passkeyClientDB.types';
+import { type WalletId } from '../../../core/signingEngine/interfaces/ecdsaChainTarget';
 import { type WalletUnlockSubjectSet } from './walletUnlockSubject';
-export declare function resolveLoginWalletUnlockSelectionForSubjectSet(args: {
-    selection: LoginHooksOptions['unlockSelection'] | undefined;
-    subjectSet: WalletUnlockSubjectSet;
-}): WalletUnlockSelection;
 export declare function resolveExactLinkedEmailOtpAuthority(args: {
-    readonly authMethod: Extract<LocalWalletAuthMethodRecordV2, {
-        kind: 'email_otp';
-        status: 'active';
-    }>;
+    readonly authMethod: ActiveEmailOtpWalletAuthMethodRecordV2;
     readonly provider: EmailOtpProvider;
     readonly providerSubjectId: string;
 }): Promise<EmailOtpWalletAuthAuthority>;
 type LinkedDeviceAuthoritySelection = Readonly<{
     readonly walletId: WalletId;
     readonly selection: WalletSelectionRecordV1;
-    readonly authMethod: Extract<LocalWalletAuthMethodRecordV2, {
-        status: 'active';
-    }>;
-    readonly authority: Extract<WalletAuthorityV1, {
-        state: 'active';
-    }>;
+    readonly authMethod: ActiveWalletAuthMethodRecordV2;
+    readonly authority: ActiveWalletAuthorityV1;
     readonly signerMaterials: readonly WalletAuthoritySignerMaterialRecordV1[];
     readonly exportRoot: WalletAuthorityExportRootRecordV1 | null;
 }>;
@@ -44,24 +28,16 @@ export type LinkedDevicePasskeyAuthoritySelection = LinkedDeviceAuthoritySelecti
     readonly kind: 'linked_device_passkey_authority_selection_v1';
     readonly walletId: WalletId;
     readonly selection: WalletSelectionRecordV1;
-    readonly authMethod: Extract<LocalWalletAuthMethodRecordV2, {
-        kind: 'passkey';
-        status: 'active';
-    }>;
-    readonly authority: Extract<WalletAuthorityV1, {
-        state: 'active';
-    }>;
+    readonly authMethod: ActivePasskeyWalletAuthMethodRecordV2;
+    readonly authority: ActiveWalletAuthorityV1;
     readonly signerMaterials: readonly WalletAuthoritySignerMaterialRecordV1[];
     readonly exportRoot: WalletAuthorityExportRootRecordV1 | null;
 }>;
-export type LinkedDeviceEmailOtpAuthoritySelection = LinkedDeviceAuthoritySelection & Readonly<{
+type LinkedDeviceEmailOtpAuthoritySelection = LinkedDeviceAuthoritySelection & Readonly<{
     readonly kind: 'linked_device_email_otp_authority_selection_v1';
-    readonly authMethod: Extract<LocalWalletAuthMethodRecordV2, {
-        kind: 'email_otp';
-        status: 'active';
-    }>;
+    readonly authMethod: ActiveEmailOtpWalletAuthMethodRecordV2;
 }>;
-export type LinkedDeviceEmailOtpAuthorityResolution = {
+type LinkedDeviceEmailOtpAuthorityResolution = {
     readonly kind: 'none';
 } | {
     readonly kind: 'selected';
@@ -70,9 +46,6 @@ export type LinkedDeviceEmailOtpAuthorityResolution = {
     readonly kind: 'rejected';
     readonly message: string;
 };
-export type LinkedDevicePasskeyOpenedMaterial = Extract<OpenWalletAuthorityLinkedSignerMaterialResultV1, {
-    readonly kind: 'opened_wallet_authority_linked_signer_material_v1';
-}>;
 export declare function resolveLinkedDevicePasskeyAuthoritySelection(walletIdInput: string): Promise<LinkedDevicePasskeyAuthoritySelection | null>;
 export declare function resolveLinkedDeviceEmailOtpAuthoritySelection(args: {
     readonly walletIdInput: string;
@@ -80,7 +53,7 @@ export declare function resolveLinkedDeviceEmailOtpAuthoritySelection(args: {
     readonly provider: EmailOtpProvider;
     readonly providerSubjectId: string;
     /**
-     * R109C: resolve as this method rather than as the selected one.
+     * Resolve as this method rather than as the selected one.
      *
      * An added sibling is not selected yet - invariant 9 leaves the source
      * selected until a lock and unlock - so resolving through the selection would
@@ -89,24 +62,6 @@ export declare function resolveLinkedDeviceEmailOtpAuthoritySelection(args: {
      */
     readonly walletAuthMethodId?: string;
 }): Promise<LinkedDeviceEmailOtpAuthorityResolution>;
-export type LoginUnlockWarmupBranchPlan = {
-    kind: 'near_ed25519_only';
-    wantsEd25519Warmup: true;
-    wantsEcdsaWarmup: false;
-} | {
-    kind: 'evm_family_ecdsa_only';
-    wantsEd25519Warmup: false;
-    wantsEcdsaWarmup: boolean;
-} | {
-    kind: 'near_ed25519_and_evm_family_ecdsa';
-    wantsEd25519Warmup: true;
-    wantsEcdsaWarmup: boolean;
-};
-export declare function resolveLoginUnlockWarmupBranchPlan(args: {
-    subjectSet: WalletUnlockSubjectSet;
-    selection: WalletUnlockSelection;
-    hasConfiguredEcdsaTargets: boolean;
-}): LoginUnlockWarmupBranchPlan;
 /**
  * Core login function (passkey identity + Router API-issued sessions).
  *
@@ -119,18 +74,6 @@ export declare function resolveLoginUnlockWarmupBranchPlan(args: {
 export declare function unlock(context: LoginWebContext, nearAccountId: AccountId, options?: LoginHooksOptions): Promise<LoginAndCreateSessionResult>;
 export declare function unlockResolvedWalletSubjectSet(context: LoginWebContext, subjectSet: WalletUnlockSubjectSet, options?: LoginHooksOptions): Promise<LoginAndCreateSessionResult>;
 export declare function resolveLinkedDeviceUnlockSubjectSet(walletIdInput: string): Promise<WalletUnlockSubjectSet | null>;
-type LinkedEcdsaHolderActivationContext = {
-    readonly signingEngine: Pick<LoginWebContext['signingEngine'], 'getSignerWorkerContext'>;
-};
-export declare function activateLinkedEmailOtpEcdsaHolderAfterLink(args: {
-    readonly context: LinkedEcdsaHolderActivationContext;
-    readonly walletId: WalletId;
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly emailHashHex: string;
-    readonly providerUserId: string;
-    readonly walletSession: ActiveWalletSessionV1;
-    readonly factorSecret32: Uint8Array;
-}): Promise<void>;
 type LinkedDevicePostLinkFactor = {
     readonly kind: 'passkey';
     readonly walletId: WalletId;
@@ -163,25 +106,7 @@ export declare function unlockLinkedDeviceEmailOtpWallet(args: {
     readonly relayUrl: string;
 }): Promise<void>;
 export declare function unlockLinkedDevicePasskey(context: LoginWebContext, walletIdInput: string, options: LoginHooksOptions | undefined): Promise<LoginAndCreateSessionResult>;
-export declare function bindPasskeyEcdsaSessionPolicyToUnlockChallenge(policy: RouterAbEcdsaPostRegistrationSessionActivationPolicyV1, challengeId: string): RouterAbEcdsaPostRegistrationSessionActivationPolicyV1;
-type ThresholdLoginWarmSigner = 'ed25519' | 'ecdsa';
-type ThresholdLoginWarmupTask = {
-    signer: ThresholdLoginWarmSigner;
-    dependencies: ThresholdLoginWarmSigner[];
-    onFailure: ((error: unknown) => void) | null;
-    run: () => Promise<void>;
-};
-export declare function runThresholdLoginWarmupTasks(tasks: ThresholdLoginWarmupTask[]): Promise<void>;
 export declare function getWalletSession(context: WalletSessionWebContext, walletId?: WalletId | string): Promise<WalletSession>;
-type AuthenticatedEcdsaInventoryProfileRepairStore = Pick<typeof IndexedDBManager, 'activateAccountSigner'>;
-export declare function persistAuthenticatedEcdsaInventoryProfileRepairs(args: {
-    store: AuthenticatedEcdsaInventoryProfileRepairStore;
-    walletId: WalletId;
-    configuredTargets: readonly ThresholdEcdsaChainTarget[];
-    walletSigners: readonly AccountSignerRecord[];
-    records: readonly ThresholdEcdsaKeyIdentityInventoryEntry[];
-}): Promise<void>;
-export declare function selectNearOperationalPublicKeyForLogin(userData: Pick<ClientUserData, 'operationalPublicKey'> | null): string | null;
 /**
  * List recently used accounts from IndexedDB.
  *

package/dist/types/wallet/src/SeamsWeb/operations/auth/scheduleLinkedDevicePresignaturePrefill.d.ts

@@ -0,0 +1,11 @@
+import type { WalletSessionOperationCredentialV1 } from '../../../../../shared-ts/src/device-linking';
+import { type LinkedEcdsaHolderRuntimeV1 } from '../../../core/signingEngine/session/material/linkedEcdsaHolderRuntime';
+import type { WorkerOperationContext } from '../../../core/signingEngine/workerManager/executeWorkerOperation';
+export declare function scheduleLinkedDevicePresignaturePrefill(args: {
+    runtime: LinkedEcdsaHolderRuntimeV1;
+    operationCredential: WalletSessionOperationCredentialV1;
+    expiresAtMs: number;
+    relayerUrl: string;
+    workerCtx: WorkerOperationContext;
+}): Promise<void>;
+//# sourceMappingURL=scheduleLinkedDevicePresignaturePrefill.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/auth/walletAuth.d.ts

@@ -1,3 +1,4 @@
+import type { WalletSessionStatusReadScope } from '../../../core/rpcClients/relayer/walletSessionAuthorizationStatus';
 import type { NearClient } from '../../../core/rpcClients/near/NearClient';
 import type { RouterAbEcdsaDerivationLoginPresignaturePrefillResult } from '../../../core/signingEngine/session/warmCapabilities/ecdsaLoginPrefill';
 import type { ThresholdEcdsaChainTarget } from '../../../core/signingEngine/interfaces/ecdsaChainTarget';
@@ -22,7 +23,7 @@ export type WalletAuthDomainDeps = {
     nearClient: NearClient;
     initWalletIframe: (walletId?: string) => Promise<WalletIframeExactSessionState>;
 };
-export type WalletLockDomainDeps = {
+type WalletLockDomainDeps = {
     getContext: () => LockOperationContext;
     walletIframe: {
         shouldUseWalletIframe(): boolean;
@@ -31,7 +32,7 @@ export type WalletLockDomainDeps = {
         }>;
     };
 };
-export type WalletLogoutDomainDeps = {
+type WalletLogoutDomainDeps = {
     getContext: () => LogoutOperationContext;
     walletIframe: {
         shouldUseWalletIframe(): boolean;
@@ -50,6 +51,6 @@ export declare function prefillRouterAbEcdsaDerivationPresignaturePoolDomain(dep
     walletSession: WalletSessionRef;
     chainTarget: ThresholdEcdsaChainTarget;
     waitForPoolReady?: boolean;
-}): Promise<RouterAbEcdsaDerivationLoginPresignaturePrefillResult>;
+}, statusReads: WalletSessionStatusReadScope): Promise<RouterAbEcdsaDerivationLoginPresignaturePrefillResult>;
 export {};
 //# sourceMappingURL=walletAuth.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/auth/walletUnlockEcdsaSubject.d.ts

@@ -1,24 +1,8 @@
-import type { EcdsaWalletActivationSelectorListResult } from '../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore';
-import type { EvmFamilyEcdsaWalletUnlockSubject, EvmFamilyEcdsaWalletUnlockSubjectSet } from '../../../core/signingEngine/session/identity/walletUnlockSubject';
+import type { EcdsaWalletActivationSelectorListResult } from '../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestLookups';
+import type { EvmFamilyEcdsaWalletUnlockSubject } from '../../../core/signingEngine/session/identity/walletUnlockSubject';
 import { type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
 export type { EvmFamilyEcdsaWalletUnlockSubject, EvmFamilyEcdsaWalletUnlockSubjectSet, } from '../../../core/signingEngine/session/identity/walletUnlockSubject';
 export type WalletUnlockCapabilitySubjectResolutionFailure = 'capability_subject_lookup_failed' | 'invalid_capability_subject';
-export type EvmFamilyEcdsaWalletUnlockSubjectSetResolution = {
-    readonly kind: 'resolved';
-    readonly subjectSet: EvmFamilyEcdsaWalletUnlockSubjectSet;
-    readonly reason?: never;
-} | {
-    readonly kind: 'missing_requested_capability_subject';
-    readonly walletId: WalletId;
-    readonly subjectSet?: never;
-    readonly reason?: never;
-} | {
-    readonly kind: 'capability_subject_resolution_failed';
-    readonly walletId: WalletId;
-    readonly reason: WalletUnlockCapabilitySubjectResolutionFailure;
-    readonly subjectSet?: never;
-};
-export declare function resolveEvmFamilyEcdsaWalletUnlockSubjectSet(rawWalletId: unknown): Promise<EvmFamilyEcdsaWalletUnlockSubjectSetResolution>;
 export declare function resolveEvmFamilyEcdsaWalletUnlockSubjects(walletId: WalletId): Promise<{
     readonly kind: 'resolved';
     readonly subjects: readonly EvmFamilyEcdsaWalletUnlockSubject[];

package/dist/types/wallet/src/SeamsWeb/operations/auth/walletUnlockSubject.d.ts

@@ -1,6 +1,7 @@
 import { type WalletId } from '../../../core/signingEngine/interfaces/ecdsaChainTarget';
 import { type WalletUnlockCapabilitySubjectResolutionFailure } from './walletUnlockEcdsaSubject';
-import type { WalletUnlockSubject, WalletUnlockSubjectSet } from '../../../core/signingEngine/session/identity/walletUnlockSubject';
+import type { WalletUnlockSubjectSet } from '../../../core/signingEngine/session/identity/walletUnlockSubject';
+import type { ExclusiveUnion } from '../../../../../shared-ts/src/utils/variant';
 export type { NearEd25519WalletUnlockSubject, WalletUnlockSubject, WalletUnlockSubjectSet, } from '../../../core/signingEngine/session/identity/walletUnlockSubject';
 export type WalletUnlockCapabilityFamilyScope = {
     readonly kind: 'near_ed25519_only';
@@ -9,7 +10,7 @@ export type WalletUnlockCapabilityFamilyScope = {
 } | {
     readonly kind: 'all_registered_mpc';
 };
-export type WalletUnlockSubjectSetResolution = {
+type WalletUnlockSubjectSetResolution = {
     readonly kind: 'resolved';
     readonly subjectSet: WalletUnlockSubjectSet;
 } | {
@@ -23,50 +24,32 @@ export type WalletUnlockSubjectSetResolution = {
     readonly reason: WalletUnlockCapabilitySubjectResolutionFailure;
     readonly subjectSet?: never;
 };
-export type WalletIdentitySource = 'profile_projection' | 'host_last_used_profile' | 'local_wallet_authority';
-export type WalletIdentityResolveFailure = 'missing_wallet_profile' | 'ambiguous_wallet_profile' | 'missing_requested_capability_subject' | WalletUnlockCapabilitySubjectResolutionFailure | 'invalid_wallet_profile';
-export type WalletCapabilitySubjectResolution = {
+type WalletIdentitySource = 'profile_projection' | 'host_last_used_profile' | 'local_wallet_authority';
+type WalletIdentityResolveFailure = 'missing_wallet_profile' | 'ambiguous_wallet_profile' | 'missing_requested_capability_subject' | WalletUnlockCapabilitySubjectResolutionFailure | 'invalid_wallet_profile';
+export type WalletCapabilitySubjectResolution = ExclusiveUnion<{
     kind: 'no_session_request';
-    walletId?: never;
-    profileId?: never;
-    subjectSet?: never;
-    source?: never;
-    reason?: never;
 } | {
     kind: 'resolved';
     walletId: WalletId;
-    profileId?: never;
     subjectSet: WalletUnlockSubjectSet;
     source: WalletIdentitySource;
-    reason?: never;
 } | {
     kind: 'no_session_for_wallet';
     walletId: WalletId;
-    profileId?: never;
     reason: 'missing_requested_capability_subject';
     source: WalletIdentitySource;
-    subjectSet?: never;
 } | {
     kind: 'unresolvable';
     walletId: WalletId;
-    profileId?: never;
     reason: WalletIdentityResolveFailure;
-    subjectSet?: never;
-    source?: never;
 } | {
     kind: 'unresolvable_profile';
     profileId: string;
-    walletId?: never;
     reason: WalletIdentityResolveFailure;
-    subjectSet?: never;
-    source?: never;
-};
+}>;
 export declare function resolveWalletUnlockSubjectSet(args: {
     readonly walletId: string;
     readonly requestedCapabilityFamilies: WalletUnlockCapabilityFamilyScope;
 }): Promise<WalletUnlockSubjectSetResolution>;
-export declare function resolveNearEd25519WalletUnlockSubject(walletId: string): Promise<Extract<WalletUnlockSubject, {
-    kind: 'near_ed25519_wallet';
-}> | null>;
 export declare function resolveWalletCapabilitySubjectResolution(walletId?: WalletId | string): Promise<WalletCapabilitySubjectResolution>;
 //# sourceMappingURL=walletUnlockSubject.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/addAuthMethodSourceClaim.d.ts

@@ -1,5 +1,5 @@
 /**
- * Refactor 109C: the source claim a same-device addition puts in its intent.
+ * The source claim a same-device addition puts in its intent.
  *
  * The intent digest is what the fresh source proof signs, so every identity the
  * proof is meant to bind has to be inside it. The server resolves the true
@@ -13,17 +13,16 @@
  * revalidates against.
  */
 import type { AddAuthMethodIntentSourceV1 } from '../../../../../shared-ts/src/utils/registrationIntent';
+import type { ActiveWalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { WalletId } from '../../../../../shared-ts/src/utils/domainIds';
-import type { WalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/registrationIntent';
-export type AddAuthMethodSourceClaimResultV1 = {
+type AddAuthMethodSourceClaimResultV1 = {
     readonly kind: 'resolved';
     readonly source: AddAuthMethodIntentSourceV1;
-    readonly sourceAuthMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly status: 'active';
-    }>;
+    readonly sourceAuthMethod: ActiveWalletAuthMethodRecordV2;
 } | {
     readonly kind: 'unavailable';
     readonly reason: string;
 };
 export declare function resolveAddAuthMethodSourceClaimV1(walletId: WalletId): Promise<AddAuthMethodSourceClaimResultV1>;
+export {};
 //# sourceMappingURL=addAuthMethodSourceClaim.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/emailOtp/addEmailOtp.d.ts

@@ -1,5 +1,5 @@
 /**
- * Refactor 109C's `passkey_to_email_otp` branch: a wallet that unlocks with a
+ * The `passkey_to_email_otp` addition branch: a wallet that unlocks with a
  * passkey gains an Email OTP method on the same authority.
  *
  * One new `WalletAuthMethodRecordV2` and one custody envelope. No authority,

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/emailOtp/challenge.d.ts

@@ -7,19 +7,6 @@ export type FetchLike = typeof fetch;
 export type { EmailOtpEnrollmentResult, WalletEmailOtpChannel };
 export { EMAIL_OTP_CHANNEL };
 type JsonObject = Record<string, unknown>;
-export declare class EmailOtpRouteError extends Error {
-    readonly code?: string;
-    readonly status: number;
-    readonly retryAfterMs?: number;
-    readonly resetAtMs?: number;
-    constructor(input: {
-        message: string;
-        status: number;
-        code?: unknown;
-        retryAfterMs?: unknown;
-        resetAtMs?: unknown;
-    });
-}
 export declare function parseEmailOtpEnrollmentResult(value: unknown): EmailOtpEnrollmentResult;
 export declare function readString(value: unknown, label: string): string;
 export declare function readOptionalString(value: unknown): string | undefined;

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/emailOtp/googleEmailOtpWalletAuthFlow.d.ts

@@ -76,6 +76,5 @@ export type GoogleEmailOtpWalletAuthDeps = {
     getWalletSession(walletId: string): Promise<WalletSession>;
 };
 export declare function beginGoogleEmailOtpWalletAuth(deps: GoogleEmailOtpWalletAuthDeps, input: GoogleEmailOtpWalletAuthStartInput): Promise<GoogleEmailOtpWalletAuthResult<GoogleEmailOtpWalletAuthFlow>>;
-export declare function googleEmailOtpTargetKeys(targets: readonly ThresholdEcdsaChainTarget[]): readonly string[];
 export {};
 //# sourceMappingURL=googleEmailOtpWalletAuthFlow.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/emailOtp/localEmailOtpProjection.d.ts

@@ -15,7 +15,7 @@
 import { type WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import { type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
-export type FinalizedEmailOtpAuthMethodV1 = {
+type FinalizedEmailOtpAuthMethodV1 = {
     readonly walletId: WalletId;
     readonly walletAuthMethodId: WalletAuthMethodId | string;
     readonly walletAuthorityId: WalletAuthorityId | string;
@@ -24,4 +24,5 @@ export type FinalizedEmailOtpAuthMethodV1 = {
 };
 /** Writes the projection for a factor the server has already accepted. */
 export declare function persistFinalizedEmailOtpAuthMethodV1(args: FinalizedEmailOtpAuthMethodV1): Promise<void>;
+export {};
 //# sourceMappingURL=localEmailOtpProjection.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/emailOtp/registrationAuthority.d.ts

@@ -1,6 +1,6 @@
-import type { EmailOtpRegistrationAuthMethodInput, EmailOtpRegistrationProof } from '../../../../../../shared-ts/src/utils/registrationIntent';
+import type { EmailOtpRegistrationAuthMethodInput, EmailOtpRegistrationProof } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 type FetchLike = typeof fetch;
-export type EmailOtpRegistrationAuthorityMaterial = {
+type EmailOtpRegistrationAuthorityMaterial = {
     kind: 'email_otp';
     proof: EmailOtpRegistrationProof;
     registrationAuthorityId: string;

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/emailOtp/registrationOffer.d.ts

@@ -1,4 +1,3 @@
-import type { GoogleEmailOtpRegistrationFinalizeInput, GoogleEmailOtpRegistrationOffer } from '../../../publicApi/types';
+import type { GoogleEmailOtpRegistrationOffer } from '../../../publicApi/types';
 export declare function parseGoogleEmailOtpRegistrationOffer(value: unknown): GoogleEmailOtpRegistrationOffer;
-export declare function parseGoogleEmailOtpRegistrationFinalizeInput(value: unknown): GoogleEmailOtpRegistrationFinalizeInput;
 //# sourceMappingURL=registrationOffer.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/emailOtp/walletActivation.d.ts

@@ -5,6 +5,7 @@ import type { NearEd25519SignerBinding } from '../../../../../../shared-ts/src/u
 import type { WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { EmailOtpVerifiedAuthorityProjection } from '../../../../core/signingEngine/session/emailOtp/publicTypes';
 import { type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export declare function persistVerifiedEmailOtpAuthorityAfterUnlock(args: {
     readonly walletId: string;
     readonly walletAuthMethodId: string;
@@ -17,17 +18,15 @@ export declare function walletAuthAuthorityRefForVerifiedEmailOtpUnlock(args: {
     readonly emailHashHex: string;
     readonly projection: EmailOtpVerifiedAuthorityProjection;
 }): Promise<WalletAuthAuthorityRef>;
-export type EmailOtpWalletPostUnlockActivation = {
+export type EmailOtpWalletPostUnlockActivation = ExclusiveUnion<{
     kind: 'near_ed25519_wallet';
     signer: NearEd25519SignerBinding;
     walletAuthMethodId: WalletAuthMethodId;
-    walletId?: never;
 } | {
     kind: 'evm_family_ecdsa_wallet';
     walletId: WalletId;
     walletAuthMethodId: WalletAuthMethodId;
-    signer?: never;
-};
+}>;
 export type EmailOtpWalletPostUnlockActivationDeps = {
     signingEngine: {
         setWalletAuthenticated(args: {

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/passkey/exactPasskeyAuthority.d.ts

@@ -0,0 +1,20 @@
+import type { WalletId } from '../../../../core/signingEngine/interfaces/ecdsaChainTarget';
+import { type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { ActivePasskeyWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+/**
+ * The wallet's one active passkey method for this credential. The local
+ * auth-method store is the one source that names a wallet's methods: a method
+ * id derived from the credential is not the id the wallet registered it under.
+ */
+export declare function exactPasskeyWalletAuthMethodForCredential(args: {
+    readonly walletId: WalletId;
+    readonly rpId: string;
+    readonly credentialIdB64u: string;
+}): Promise<ActivePasskeyWalletAuthMethodRecordV2>;
+/** The authority reference of the wallet's active passkey method for this credential. */
+export declare function exactPasskeyWalletAuthAuthorityRefForCredential(args: {
+    readonly walletId: WalletId;
+    readonly rpId: string;
+    readonly credentialIdB64u: string;
+}): Promise<WalletAuthAuthorityRef>;
+//# sourceMappingURL=exactPasskeyAuthority.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/passkey/localPasskeyProjection.d.ts

@@ -1,23 +1,18 @@
 import { type WalletAuthMethodId, type WalletAuthorityId } from '../../../../../../shared-ts/src/utils/domainIds';
-import { type WalletAuthMethodRecordV2, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
-import type { ActiveRecoveredWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
-import { type LocalWalletAuthMethodRecord } from '../../../../core/indexedDB';
+import { type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
 /** The finalize fields this projection is built from, whichever route returned them. */
-export type FinalizedPasskeyAuthMethodV1 = {
+type FinalizedPasskeyAuthMethodV1 = {
     readonly walletId: WalletId;
     readonly rpId: string;
     readonly credentialIdB64u: string;
     readonly credentialPublicKeyB64u: string;
     readonly counter: number;
 };
-export declare function localPasskeyAuthMethodFromFinalizeV1(args: FinalizedPasskeyAuthMethodV1): LocalWalletAuthMethodRecord & {
-    kind: 'passkey';
-};
 /** Writes the projection for a factor the server has already accepted. */
 export declare function persistFinalizedPasskeyAuthMethodV1(args: FinalizedPasskeyAuthMethodV1): Promise<void>;
 /**
- * Refactor 109C: the full local install for a passkey added to a wallet that
- * registered with another family.
+ * The full local install for a passkey added to a wallet that registered with
+ * another family.
  *
  * Three records, and unlock needs all of them. It reads the profile, then the
  * profile's authenticators, then keeps only those whose credential belongs to
@@ -43,38 +38,5 @@ export declare function persistAddedCrossFamilyPasskeyV1(args: {
         readonly rawId: string;
     };
 }): Promise<void>;
-export type SyncedPasskeyAuthMethodV2 = {
-    readonly walletId: WalletId;
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly walletAuthorityId: WalletAuthorityId;
-    readonly rpId: string;
-    readonly credentialIdB64u: string;
-    readonly credentialPublicKeyB64u: string;
-    readonly counter: number;
-};
-export declare function localPasskeyAuthMethodFromSyncV2(args: SyncedPasskeyAuthMethodV2): Extract<WalletAuthMethodRecordV2, {
-    kind: 'passkey';
-    status: 'active';
-}>;
-export declare function persistSyncedPasskeyAuthMethodV2(args: SyncedPasskeyAuthMethodV2): Promise<void>;
-type RecoveredPasskeyLocalProjection = {
-    readonly authority: ActiveRecoveredWalletAuthorityV1;
-    readonly authMethod: Extract<WalletAuthMethodRecordV2, {
-        readonly kind: 'passkey';
-        readonly status: 'active';
-    }>;
-    readonly credential: {
-        readonly id: string;
-        readonly rawId: string;
-    };
-} & ({
-    readonly kind: 'near';
-    readonly signerSlot?: never;
-} | {
-    readonly kind: 'wallet_only';
-    readonly signerSlot: number;
-});
-/** Rebuilds the local identity required by exact-wallet login after recovery. */
-export declare function persistRecoveredPasskeyAuthMethodProjectionV1(input: RecoveredPasskeyLocalProjection): Promise<void>;
 export {};
 //# sourceMappingURL=localPasskeyProjection.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/passkey/registrationAuthority.d.ts

@@ -3,7 +3,7 @@ import type { WebAuthnRegistrationCredential } from '../../../../core/types/weba
 import type { ConfirmationConfig } from '../../../../core/types/signer-worker';
 import type { WebAuthnRegistrationConfirmationSurface } from '../../../signingSurface/types';
 import type { WalletId } from '../../../../core/signingEngine/interfaces/ecdsaChainTarget';
-export type PasskeyRegistrationAuthorityMaterial = {
+type PasskeyRegistrationAuthorityMaterial = {
     kind: 'passkey';
     credential: WebAuthnRegistrationCredential;
     webauthnRegistration: WebAuthnRegistrationCredential;
@@ -43,4 +43,5 @@ export declare function collectPasskeyRegistrationAuthority(args: {
     options: RegistrationHooksOptions;
     confirmationConfigOverride: Partial<ConfirmationConfig>;
 }): Promise<PasskeyRegistrationAuthorityMaterial>;
+export {};
 //# sourceMappingURL=registrationAuthority.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/revokeAuthMethod.d.ts

@@ -1,8 +1,6 @@
-import { type WalletId, type WalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/registrationIntent';
+import { type WalletId } from '../../../../../shared-ts/src/utils/registrationIntent';
 import { type WalletAuthMethodId } from '../../../../../shared-ts/src/utils/domainIds';
-import type { WebAuthnAllowCredential } from '../../../core/signingEngine/webauthnAuth/credentials/collectAuthenticationCredentialForChallengeB64u';
 import type { RegistrationWebContext } from '../../signingSurface/types';
-import type { ProfileAuthenticatorRecord } from '../../../core/indexedDB';
 export type RevokeAuthMethodResult = {
     readonly ok: true;
     readonly walletId: WalletId;
@@ -12,12 +10,6 @@ export type RevokeAuthMethodResult = {
         readonly status: 'revoked';
     };
 };
-export declare function passkeySourceCredentialsForActiveMethods(args: {
-    readonly walletId: WalletId;
-    readonly authenticators: readonly ProfileAuthenticatorRecord[];
-    readonly authMethods: readonly WalletAuthMethodRecordV2[];
-    readonly excludeCredentialIdB64u: string | null;
-}): WebAuthnAllowCredential[];
 export declare function revokeWalletAuthMethodOperation(args: {
     readonly context: RegistrationWebContext;
     readonly walletId: WalletId | string;

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/sourcePasskeyProof.d.ts

@@ -1,9 +1,4 @@
 import type { WebAuthnAllowCredential } from '../../../core/signingEngine/webauthnAuth/credentials/collectAuthenticationCredentialForChallengeB64u';
-import type { WalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/registrationIntent';
-type ActivePasskeyWalletAuthMethod = Extract<WalletAuthMethodRecordV2, {
-    readonly kind: 'passkey';
-    readonly status: 'active';
-}>;
-export declare function addAuthMethodSourcePasskeyAllowCredentials(sourceAuthMethod: ActivePasskeyWalletAuthMethod): [WebAuthnAllowCredential];
-export {};
+import type { ActivePasskeyWalletAuthMethodRecordV2 } from '../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+export declare function addAuthMethodSourcePasskeyAllowCredentials(sourceAuthMethod: ActivePasskeyWalletAuthMethodRecordV2): [WebAuthnAllowCredential];
 //# sourceMappingURL=sourcePasskeyProof.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/devices/deviceLinkingAuthorityInstallation.d.ts

@@ -1,20 +1,12 @@
 import type { ActivateInstalledAuthorityResultV1, CommittedAuthorityPackagesV1, LinkSessionStateV1, LinkedAuthorityActivationResultV1, LocalAuthorityActivationFinalAckV1, LocalAuthorityInstallationReceiptV1, WalletSessionOperationCredentialV1, VerifiedTargetFactorV1 } from '../../../../../shared-ts/src/device-linking';
-import { parseDigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { LinkDeviceSessionId } from '../../../../../shared-ts/src/signing-lanes/ids';
-import type { WalletAuthorityExportRootRecordV1, WalletAuthoritySignerMaterialRecordV1 } from '../../../core/indexedDB';
 import type { UnifiedIndexedDBManager } from '../../../core/indexedDB';
+import type { SealedLocalAuthorityMaterialSetV1 } from '../../../core/signingEngine/workerManager/deviceLinkingPorts';
 import type { DeviceLinkingAuthorityActivationTransportPortV1, DeviceLinkingKeyMaterialHandleV1, DeviceLinkingKeyMaterialPortV1 } from './deviceLinkingPorts';
 import type { DeviceLinkingResealedEd25519ExportRootV1 } from './deviceLinkingEd25519ExportRoot';
 import { type DeviceLinkingCommittedResumeV1 } from './deviceLinkingResume';
 export { replayPendingDeviceLinkingAcknowledgementsV1, type DeviceLinkingDurableAcknowledgementReplayResultV1, } from './deviceLinkingResume';
-export type DeviceLinkingSealedAuthorityRecordsV1 = {
-    readonly signerMaterials: readonly [
-        WalletAuthoritySignerMaterialRecordV1,
-        ...WalletAuthoritySignerMaterialRecordV1[]
-    ];
-    readonly exportRoot: WalletAuthorityExportRootRecordV1 | null;
-    readonly installedRecordSetDigestB64u: ReturnType<typeof parseDigestB64u>;
-};
+export type DeviceLinkingSealedAuthorityRecordsV1 = SealedLocalAuthorityMaterialSetV1;
 /**
  * The worker owns package decryption and factor sealing. The browser receives
  * only already-sealed persistence records at this boundary.
@@ -99,19 +91,6 @@ export type DeviceLinkingAuthorityActivationFlowInputV1 = {
     readonly nowMs: () => number;
 };
 export declare function createDeviceLinkingAuthorityInstallationPortV1(options: DeviceLinkingAuthorityInstallationAssemblyOptionsV1): DeviceLinkingAuthorityInstallationPortV1;
-export declare function createDeviceLinkingDeliveryResumePortV1(input: {
-    readonly indexedDB: UnifiedIndexedDBManager;
-}): DeviceLinkingDeliveryResumePortV1;
-export declare function installLocalAuthorityV1(input: {
-    readonly indexedDB: UnifiedIndexedDBManager;
-    readonly sealing: DeviceLinkingCommittedPackageSealingPortV1;
-    readonly nowMs: () => number;
-    readonly committed: CommittedAuthorityPackagesV1;
-    readonly targetFactor: VerifiedTargetFactorV1;
-    readonly keyMaterial: DeviceLinkingKeyMaterialHandleV1;
-    readonly resealedExportRoot: DeviceLinkingResealedEd25519ExportRootV1 | null;
-    readonly expectedLockGeneration: number;
-}): Promise<LocalAuthorityInstallationReceiptV1>;
 export declare function finalizeLocalAuthorityActivationV1(input: {
     readonly indexedDB: UnifiedIndexedDBManager;
     readonly active: Extract<ActivateInstalledAuthorityResultV1, {