@seams/wallet 0.6.2 → 0.7.3

package/dist/types/wallet/src/core/signingEngine/workerManager/workers/email-otp/crypto.d.ts

@@ -0,0 +1,57 @@
+import type { LinkedDeviceEmailOtpFactorReleaseEnvelopeV1 } from '../../../../../../../shared-ts/src/device-linking/contracts';
+import { type EmailOtpEscrowSecret32DecodeResult } from '../../../session/emailOtp/secretEscrow';
+import { RouterAbEd25519YaoClientV1 } from '../../../threshold/ed25519/yaoClient';
+import { getShamir3PassRuntime } from '../shamir3pass/runtime';
+export declare function generateRandomSecret32(): Uint8Array;
+export declare function getEmailOtpYaoClient(): Promise<RouterAbEd25519YaoClientV1>;
+export declare function ensureEvmCryptoWasm(): Promise<void>;
+export declare function ensureWalletCustodyCeremonyWasm(): Promise<void>;
+export declare function ensureNearSignerRecoveryWasm(): Promise<void>;
+export declare function deriveEmailOtpUnlockAuthSeedInWorker(args: {
+    clientSecret32: Uint8Array;
+    walletId: string;
+}): Promise<Uint8Array>;
+export declare function removeClientSealToSecret32(args: {
+    runtime: Awaited<ReturnType<typeof getShamir3PassRuntime>>;
+    keyHandle: string;
+    ciphertextB64u: string;
+}): Promise<EmailOtpEscrowSecret32DecodeResult>;
+export declare function addClientSealFromBytes(args: {
+    runtime: Awaited<ReturnType<typeof getShamir3PassRuntime>>;
+    keyHandle: string;
+    ciphertext: Uint8Array;
+}): Promise<string>;
+/** A fresh P-256 key pair; the Router seals the released factor to its public half. */
+export declare function generateEmailOtpFactorReleaseKeyPair(label: string): Promise<{
+    readonly subtle: SubtleCrypto;
+    readonly privateKey: CryptoKey;
+    readonly workerPublicKey: Uint8Array;
+}>;
+/**
+ * Opens a factor released to this worker: ECDH with the Router's ephemeral key, then
+ * AES-GCM bound to the wallet, enrollment and challenge. The caller owns and zeroizes
+ * the decoded server key, nonce and ciphertext.
+ */
+export declare function openEmailOtpFactorReleaseCiphertext(args: {
+    readonly subtle: SubtleCrypto;
+    readonly workerPrivateKey: CryptoKey;
+    readonly serverPublicKey: Uint8Array;
+    readonly nonce: Uint8Array;
+    readonly ciphertext: Uint8Array;
+    readonly walletId: string;
+    readonly enrollmentId: string;
+    readonly enrollmentSealKeyVersion: string;
+    readonly challengeId: string;
+}): Promise<Uint8Array>;
+export declare function decryptEmailOtpFactorReleaseEnvelope(args: {
+    walletId: string;
+    challengeId: string;
+    workerPrivateKey: CryptoKey;
+    materialRecovery: LinkedDeviceEmailOtpFactorReleaseEnvelopeV1;
+}): Promise<{
+    challengeId: string;
+    enrollmentId: string;
+    enrollmentSealKeyVersion: string;
+    factorSecret32: Uint8Array;
+}>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/types/wallet/src/core/signingEngine/workerManager/workers/email-otp/custodyRestore.d.ts

@@ -0,0 +1,89 @@
+import { type PasskeyCustodyEnvelopeRecord } from '../../../../../../../shared-ts/src/passkey-custody';
+import { type EmailOtpVerifiedAuthorityProjection } from '../../../session/emailOtp/publicTypes';
+import { type WalletCustodyUnlockKeyManifest } from '../../../../rpcClients/relayer/walletRecoveryPrepare';
+import { type WalletCustodyActivationFactsV1 } from '../../../walletCustody/openCustodyCache';
+import type { EmailOtpEd25519YaoRecoveryBootstrapV1, EmailOtpEcdsaCustodyContinuityV1, EmailOtpEcdsaCustodyRestoreV1, EmailOtpAuthoritySelector, EmailOtpWalletUnlockMaterialRequest } from '../../workerTypes';
+import type { RouterAbEd25519YaoActiveClientMetadataV1 } from '../../../threshold/ed25519/yaoClient';
+import type { WalletRegistrationEd25519YaoBootstrapSession } from '../../../../../../../shared-ts/src/utils/registrationContracts';
+import { type RouterAbEcdsaCredentialFreeSessionActivationResponseV1 } from '../../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import type { ExactWalletSessionAuthorization } from '../../../session/persistence/walletSessionAuthorizationProjection';
+export type EmailOtpWalletCustodyUnlockProjection = {
+    readonly kind: 'wallet_custody_email_otp_unlock_v1';
+    readonly walletId: string;
+    readonly enrollmentId: string;
+    readonly enrollmentSealKeyVersion: string;
+    readonly envelopeVersion: string;
+    readonly envelopeRevision: number;
+    readonly storeVersion: string;
+    readonly activeKeySetIds: readonly string[];
+    readonly keyManifest: WalletCustodyUnlockKeyManifest;
+    readonly envelope: PasskeyCustodyEnvelopeRecord;
+};
+export declare function bytesToLowerHex(bytes: Uint8Array): string;
+export type EmailOtpUnlockSecretMaterialRequest = Extract<EmailOtpWalletUnlockMaterialRequest, {
+    kind: 'ecdsa';
+}> | {
+    kind: 'ed25519_yao_export';
+} | EmailOtpEd25519OperationRecoveryMaterialRequest | Extract<EmailOtpWalletUnlockMaterialRequest, {
+    kind: 'ed25519_yao_recovery' | 'wallet_unlock_capabilities';
+}>;
+export type EmailOtpEd25519OperationRecoveryMaterialRequest = Omit<Extract<EmailOtpWalletUnlockMaterialRequest, {
+    kind: 'ed25519_yao_recovery';
+}>, 'kind'> & {
+    readonly kind: 'ed25519_yao_operation_recovery';
+    readonly bootstrap: EmailOtpEd25519YaoRecoveryBootstrapV1;
+};
+export declare function parseEmailOtpWalletUnlockBootstrapSession(value: unknown, unlockCredential: unknown): WalletRegistrationEd25519YaoBootstrapSession;
+type EmailOtpWalletUnlockExactSession = {
+    readonly relayUrl: string;
+    readonly rawWalletSession: unknown;
+    readonly rawOperationCredential: unknown;
+    readonly walletId: string;
+    readonly providerSubjectId: string;
+    readonly verifiedAuthorityProjection: EmailOtpVerifiedAuthorityProjection;
+    readonly ed25519Session: WalletRegistrationEd25519YaoBootstrapSession;
+};
+export declare function resolveEmailOtpWalletUnlockExactSessionAuthorization(args: EmailOtpWalletUnlockExactSession): Promise<ExactWalletSessionAuthorization>;
+export declare function parseEmailOtpWalletUnlockExactSessionAuthorization(args: EmailOtpWalletUnlockExactSession & {
+    readonly activation: RouterAbEcdsaCredentialFreeSessionActivationResponseV1;
+}): Promise<ExactWalletSessionAuthorization>;
+export declare function parseEmailOtpWalletCustodyUnlockProjection(args: {
+    raw: unknown;
+    walletId: string;
+    enrollmentId: string;
+    enrollmentSealKeyVersion: string;
+}): EmailOtpWalletCustodyUnlockProjection;
+export declare function parseEmailOtpEcdsaCustodyContinuity(raw: unknown): EmailOtpEcdsaCustodyContinuityV1;
+export declare function restoreEmailOtpEcdsaMaterialFromCustody(args: {
+    projection: EmailOtpWalletCustodyUnlockProjection;
+    clientSecret32: Uint8Array;
+    material: EmailOtpUnlockSecretMaterialRequest;
+    continuity: EmailOtpEcdsaCustodyContinuityV1;
+}): Promise<EmailOtpEcdsaCustodyRestoreV1>;
+export declare function walletCustodyActivationFactsFromEmailOtpBootstrap(bootstrap: EmailOtpEd25519YaoRecoveryBootstrapV1): WalletCustodyActivationFactsV1;
+type EmailOtpEd25519WalletCustodyRestoreResult = {
+    kind: 'opened';
+    activeClientHandle: string;
+    metadata: RouterAbEd25519YaoActiveClientMetadataV1;
+} | {
+    kind: 'cache_absent';
+};
+export declare function restoreEmailOtpEd25519FromCustodyCache(args: {
+    relayUrl: string;
+    walletId: string;
+    projection: EmailOtpWalletCustodyUnlockProjection;
+    material: Extract<EmailOtpUnlockSecretMaterialRequest, {
+        kind: 'ed25519_yao_recovery';
+    }> | EmailOtpEd25519OperationRecoveryMaterialRequest | Extract<EmailOtpUnlockSecretMaterialRequest, {
+        kind: 'wallet_unlock_capabilities';
+    }>;
+    bootstrap: EmailOtpEd25519YaoRecoveryBootstrapV1;
+    clientSecret32: Uint8Array;
+}): Promise<EmailOtpEd25519WalletCustodyRestoreResult>;
+export declare function requireVerifiedEmailOtpAuthorityProjection(args: {
+    raw: unknown;
+    walletId: string;
+    authoritySelector: EmailOtpAuthoritySelector;
+}): EmailOtpVerifiedAuthorityProjection;
+export {};
+//# sourceMappingURL=custodyRestore.d.ts.map

package/dist/types/wallet/src/core/signingEngine/workerManager/workers/email-otp/dispatch.d.ts

@@ -0,0 +1,4 @@
+export declare function postToMainThread(message: unknown, transfer?: Transferable[]): void;
+/** Answers one request posted to the Email OTP worker. */
+export declare function handleEmailOtpWorkerMessage(event: MessageEvent): Promise<void>;
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/types/wallet/src/core/signingEngine/workerManager/workers/email-otp/ed25519YaoExport.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Ed25519 Yao seed export: authorizes the export for its exact lane and opens the custody the
+ * Router asks for.
+ */
+import type { WalletAuthMethodId } from '../../../../../../../shared-ts/src/utils/domainIds';
+import type { EmailOtpEd25519YaoActiveCapabilityDescriptorV1, EmailOtpEd25519YaoExportMaterialV1 } from '../../workerTypes';
+import { type RouterAbEd25519YaoExportArtifactV1, type RouterAbEd25519YaoExportEmailOtpFactorReleaseV1, type RouterAbEd25519YaoExportCustodyEnvelopeV1 } from '../../../threshold/ed25519/yaoClient';
+import type { ThresholdRuntimePolicyScope } from '../../../threshold/sessionPolicy';
+import { type EmailOtpEd25519YaoWorkerActivationHandle } from './sessionState';
+export declare function exportEmailOtpEd25519YaoSeed(args: {
+    relayUrl: string;
+    walletId: string;
+    providerSubjectId: string;
+    walletAuthMethodId: string;
+    challengeId: string;
+    otpCode: string;
+    nearAccountId: string;
+    nearEd25519SigningKeyId: string;
+    signerSlot: number;
+    runtimePolicyScope: ThresholdRuntimePolicyScope;
+    capability: EmailOtpEd25519YaoActiveCapabilityDescriptorV1;
+    resolveCustodyEnvelope: (release: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1) => Promise<RouterAbEd25519YaoExportCustodyEnvelopeV1>;
+}): Promise<RouterAbEd25519YaoExportArtifactV1>;
+export type EmailOtpEd25519ExportCustodyResolutionState = {
+    readonly relayUrl: string;
+    readonly walletId: string;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly orgId: string;
+    readonly providerSubjectId: string;
+    readonly material: EmailOtpEd25519YaoExportMaterialV1;
+    activeClientHandle: string | null;
+    warmFactorBound: boolean;
+    rehydrated: EmailOtpEd25519YaoWorkerActivationHandle | null;
+};
+export declare function emailOtpEd25519YaoExportCapabilityV1(material: EmailOtpEd25519YaoExportMaterialV1): EmailOtpEd25519YaoActiveCapabilityDescriptorV1;
+export declare function resolveEmailOtpEd25519ExportCustodyEnvelope(state: EmailOtpEd25519ExportCustodyResolutionState, release: RouterAbEd25519YaoExportEmailOtpFactorReleaseV1): Promise<{
+    readonly factorSecret: Uint8Array;
+    readonly bindingJson: string;
+    readonly nonce: Uint8Array;
+    readonly ciphertext: Uint8Array;
+    readonly aadHash: Uint8Array;
+    readonly ciphertextDigest: Uint8Array;
+    readonly kind: 'wallet_custody_seed_v1' | 'ed25519_yao_client_root_v1';
+}>;
+//# sourceMappingURL=ed25519YaoExport.d.ts.map

package/dist/types/wallet/src/core/signingEngine/workerManager/workers/email-otp/enrollment.d.ts

@@ -0,0 +1,47 @@
+import { type WalletEmailOtpChannel } from '../../../../../../../shared-ts/src/utils/emailOtpDomain';
+import type { EmailOtpWalletRegistrationEcdsaPrepareHandleRequest, EmailOtpWalletRegistrationEcdsaPrepareHandleResult, EmailOtpWorkerProgressCode } from '../../workerTypes';
+import { type EmailOtpRoutePlan } from '../../../stepUpConfirmation/otpPrompt/authLane';
+export declare function emailOtpWalletRegistrationEcdsaHandleResult(request: EmailOtpWalletRegistrationEcdsaPrepareHandleRequest): EmailOtpWalletRegistrationEcdsaPrepareHandleResult;
+export declare function completeEmailOtpEnrollmentFromSecret32(args: {
+    relayUrl: string;
+    walletId: string;
+    userId: string;
+    challengeId?: string;
+    otpCode?: string;
+    groupId: string;
+    routePlan: EmailOtpRoutePlan;
+    clientSecret32?: Uint8Array;
+    returnClientSecret32?: boolean;
+    skipServerFinalize?: boolean;
+    googleEmailOtpRegistrationAttemptId?: string;
+    onProgress?: (code: EmailOtpWorkerProgressCode) => void;
+}): Promise<{
+    challengeId: string;
+    otpChannel: WalletEmailOtpChannel;
+    enrollmentId: string;
+    enrollmentSealKeyVersion: string;
+    serverSealedFactorCiphertextB64u: string;
+    clientUnlockPublicKeyB64u: string;
+    unlockKeyVersion: string;
+    emailOtpEnrollment: {
+        enrollmentSealKeyVersion: string;
+        serverSealedFactorCiphertextB64u: string;
+        clientUnlockPublicKeyB64u: string;
+        unlockKeyVersion: string;
+    };
+    clientSecret32?: Uint8Array;
+}>;
+/** A caller-chosen enrollment factor secret, when the request carries one. */
+export declare function enrollmentClientSecret32(value: ArrayBuffer | undefined): {
+    clientSecret32?: Uint8Array;
+};
+/** The enrollment facts both enrollment requests return to the main thread. */
+export declare function emailOtpEnrollmentFacts(result: Awaited<ReturnType<typeof completeEmailOtpEnrollmentFromSecret32>>): {
+    otpChannel: "email_otp";
+    enrollmentId: string;
+    enrollmentSealKeyVersion: string;
+    serverSealedFactorCiphertextB64u: string;
+    clientUnlockPublicKeyB64u: string;
+    unlockKeyVersion: string;
+};
+//# sourceMappingURL=enrollment.d.ts.map

package/dist/types/wallet/src/core/signingEngine/workerManager/workers/email-otp/fetch.d.ts

@@ -1,9 +1,10 @@
 import type { WalletSessionOperationCredentialV1 } from '../../../../../../../shared-ts/src/device-linking';
-export type EmailOtpWorkerJson = Record<string, unknown>;
+type EmailOtpWorkerJson = Record<string, unknown>;
 export declare function postEmailOtpJson(args: {
     relayUrl: string;
     route: string;
     body: EmailOtpWorkerJson;
     sessionAuth?: WalletSessionOperationCredentialV1;
 }): Promise<EmailOtpWorkerJson>;
+export {};
 //# sourceMappingURL=fetch.d.ts.map

package/dist/types/wallet/src/core/signingEngine/workerManager/workers/email-otp/materialParsing.d.ts

@@ -0,0 +1,45 @@
+import type { WalletCustodyCacheEnvelopeV1 } from '../../../walletCustody/openCustodyCache';
+import type { WalletCustodyEd25519MaterialBindingV1 } from '../../../walletCustody/ed25519SeedMaterial';
+import type { EmailOtpEd25519YaoActiveCapabilityDescriptorV1, EmailOtpEd25519YaoExportMaterialV1, EmailOtpEd25519YaoRecoveryAugmentationV1, EmailOtpEd25519YaoRecoveryBootstrapV1, EmailOtpWalletCustodyEd25519MaterialRequest, EmailOtpWalletUnlockMaterialRequest } from '../../workerTypes';
+import type { RouterAbEd25519YaoClientSigningInputV1 } from '../../../threshold/ed25519/yaoClient';
+import type { WalletRegistrationEd25519YaoSignerRuntimeBootstrap } from '../../../../../../../shared-ts/src/utils/registrationContracts';
+export declare function parseWalletCustodyEd25519MaterialRequest(value: unknown): EmailOtpWalletCustodyEd25519MaterialRequest;
+export declare function parseWalletCustodyCacheEnvelope(value: unknown): WalletCustodyCacheEnvelopeV1;
+export declare function parseEmailOtpEd25519YaoRecoveryAugmentation(value: unknown): EmailOtpEd25519YaoRecoveryAugmentationV1;
+export declare const EMAIL_OTP_ED25519_RECOVERY_LANE_FIELDS: readonly ["providerSubject", "nearAccountId", "expectedOperationalPublicKey", "expectedThresholdSessionId", "walletCustodyEd25519Material"];
+/** The Ed25519 lane an Email OTP unlock restores, named the same way by every request. */
+export declare function parseEmailOtpEd25519RecoveryLane(record: Record<string, unknown>, label: string): {
+    providerSubject: string;
+    nearAccountId: string;
+    expectedOperationalPublicKey: string;
+    expectedThresholdSessionId: string;
+    walletCustodyEd25519Material: EmailOtpWalletCustodyEd25519MaterialRequest;
+};
+export declare function parseEmailOtpWalletUnlockMaterialRequest(value: unknown): EmailOtpWalletUnlockMaterialRequest;
+type EmailOtpEd25519YaoBootstrapSessionCredentialSource = 
+/** The unlock response, whose issued branch carries its own credential. */
+{
+    readonly kind: 'wallet_unlock_response';
+    readonly unlockCredential: unknown;
+}
+/** A worker message, which carries only credential-free runtime facts. */
+ | {
+    readonly kind: 'resolved_worker_payload';
+}
+/** An operation-scoped grant may recover material from an exhausted exact session. */
+ | {
+    readonly kind: 'operation_step_up_payload';
+};
+export declare function parseEmailOtpEd25519YaoBootstrapSession(value: unknown, source: EmailOtpEd25519YaoBootstrapSessionCredentialSource): WalletRegistrationEd25519YaoSignerRuntimeBootstrap;
+/** Whether cached custody material belongs to the exact Ed25519 lane of `capability`. */
+export declare function emailOtpCustodyMaterialMatchesLane(binding: WalletCustodyEd25519MaterialBindingV1, capability: EmailOtpEd25519YaoActiveCapabilityDescriptorV1): boolean;
+export declare function parseEmailOtpEd25519YaoExportMaterial(value: unknown): EmailOtpEd25519YaoExportMaterialV1;
+export declare function readEmailOtpEd25519YaoRecoveryBootstrapRecord(value: unknown): Record<string, unknown>;
+/**
+ * The unlock response carries the capability's material activation in its wire form;
+ * worker payloads carry the parsed reference.
+ */
+export declare function parseEmailOtpEd25519YaoRecoveryBootstrap(value: unknown, source: EmailOtpEd25519YaoBootstrapSessionCredentialSource): EmailOtpEd25519YaoRecoveryBootstrapV1;
+export declare function parseEmailOtpEd25519YaoSigningInput(value: unknown): RouterAbEd25519YaoClientSigningInputV1;
+export {};
+//# sourceMappingURL=materialParsing.d.ts.map

package/dist/types/wallet/src/core/signingEngine/workerManager/workers/email-otp/operationRequestParsing.d.ts

@@ -0,0 +1,7 @@
+import type { Ed25519OperationStepUpProof } from '../../../threshold/ed25519/walletSession';
+import type { RouterAbNormalSigningPrepareRequestV2Wire } from '../../../../rpcClients/relayer/routerAbNormalSigning';
+export declare function parseEmailOtpOperationNormalSigningRequest(value: unknown): RouterAbNormalSigningPrepareRequestV2Wire;
+export declare function parseEmailOtpOperationStepUpProof(value: unknown): Extract<Ed25519OperationStepUpProof, {
+    kind: 'email_otp';
+}>;
+//# sourceMappingURL=operationRequestParsing.d.ts.map

package/dist/types/wallet/src/core/signingEngine/workerManager/workers/email-otp/otpVerification.d.ts

@@ -0,0 +1,53 @@
+import type { WalletEmailOtpOperation } from '../../../../../../../shared-ts/src/utils/emailOtpDomain';
+import type { WalletSessionOperationCredentialV1 } from '../../../../../../../shared-ts/src/device-linking';
+import type { EmailOtpAuthoritySelector, EmailOtpWorkerOperationMap } from '../../workerTypes';
+import { type EmailOtpRoutePlan } from '../../../stepUpConfirmation/otpPrompt/authLane';
+export declare function parseEmailOtpChallengeSignerSelection(value: unknown): EmailOtpWorkerOperationMap['requestEmailOtpChallenge']['result']['signerSelection'];
+export declare function emailOtpRouteSessionAuth(routePlan: EmailOtpRoutePlan): WalletSessionOperationCredentialV1 | undefined;
+/** Posts an Email OTP challenge request and rejects a challenge issued for another action. */
+export declare function postEmailOtpChallenge(args: {
+    readonly relayUrl: string;
+    readonly routePlan: EmailOtpRoutePlan;
+    readonly body: Record<string, unknown>;
+    readonly expectedAction: string;
+    readonly label: string;
+}): Promise<Record<string, unknown>>;
+/** A challenge the caller answers directly, with its delivery details. */
+export declare function requestEmailOtpChallenge(args: Parameters<typeof postEmailOtpChallenge>[0]): Promise<{
+    response: Record<string, unknown>;
+    challenge: Record<string, unknown>;
+    delivery: import("../../../session/emailOtp/publicTypes").EmailOtpChallengeDelivery;
+    expiresAtMs: number;
+}>;
+export declare function releaseEmailOtpFactorSecret(args: {
+    relayUrl: string;
+    walletId: string;
+} & ({
+    kind: 'verified_grant';
+    challengeId: string;
+    loginGrant: string;
+    sessionAuth: WalletSessionOperationCredentialV1 | undefined;
+    otpCode?: never;
+    operation?: never;
+} | {
+    kind: 'email_otp';
+    authoritySelector: EmailOtpAuthoritySelector;
+    challengeId: string;
+    otpCode: string;
+    operation: WalletEmailOtpOperation;
+    sessionAuth: WalletSessionOperationCredentialV1 | undefined;
+    loginGrant?: never;
+} | {
+    kind: 'wallet_session';
+    sessionAuth: WalletSessionOperationCredentialV1;
+    challengeId?: never;
+    loginGrant?: never;
+    otpCode?: never;
+    operation?: never;
+})): Promise<{
+    challengeId: string;
+    enrollmentId: string;
+    enrollmentSealKeyVersion: string;
+    factorSecret32: Uint8Array;
+}>;
+//# sourceMappingURL=otpVerification.d.ts.map

package/dist/types/wallet/src/core/signingEngine/workerManager/workers/email-otp/passkeyCustodyLink.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Linking a new passkey to Email OTP custody: holds the opened seed between prepare and
+ * complete, then reseals it to the passkey.
+ */
+import { type WalletAuthMethodId } from '../../../../../../../shared-ts/src/utils/domainIds';
+import { type PasskeyCustodyEnvelopeRecord } from '../../../../../../../shared-ts/src/passkey-custody';
+import type { EmailOtpWorkerOperationMap } from '../../workerTypes';
+import { type EmailOtpWalletCustodySeedUnlock } from './unlock';
+export declare function prepareEmailOtpPasskeyCustodyLink(args: EmailOtpWalletCustodySeedUnlock): Promise<EmailOtpWorkerOperationMap['prepareEmailOtpPasskeyCustodyLink']['result']>;
+export declare function completeEmailOtpPasskeyCustodyLink(args: {
+    readonly pendingHandleId: string;
+    readonly existingEnvelope: PasskeyCustodyEnvelopeRecord;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+    readonly registration: EmailOtpWorkerOperationMap['completeEmailOtpPasskeyCustodyLink']['payload']['registration'];
+    readonly registrationCredential: EmailOtpWorkerOperationMap['completeEmailOtpPasskeyCustodyLink']['payload']['registrationCredential'];
+}): EmailOtpWorkerOperationMap['completeEmailOtpPasskeyCustodyLink']['result'];
+export declare function discardEmailOtpPasskeyCustodyLink(pendingHandleIdRaw: unknown): boolean;
+//# sourceMappingURL=passkeyCustodyLink.d.ts.map

package/dist/types/wallet/src/core/signingEngine/workerManager/workers/email-otp/payloadParsing.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Readers shared by every Email OTP worker request: strings, route plans, chain targets, ECDSA
+ * handle bindings and warm-material targets.
+ */
+import { type WalletAuthMethodId, type ThresholdEd25519SessionId } from '../../../../../../../shared-ts/src/utils/domainIds';
+import { type WalletEmailOtpChannel } from '../../../../../../../shared-ts/src/utils/emailOtpDomain';
+import { SIGNING_SESSION_SEAL_GROUP_ID } from '../../../../../../../shared-ts/src/utils/signingSessionSeal';
+import { type WalletSessionOperationCredentialV1 } from '../../../../../../../shared-ts/src/device-linking';
+import type { EmailOtpEcdsaSessionBootstrapHandleBinding, EmailOtpWalletRegistrationEcdsaPrepareHandleRequest, EmailOtpAuthoritySelector, EmailOtpWarmMaterialTarget } from '../../workerTypes';
+import { type SigningSessionSealKeyVersion } from '../../../session/keyMaterialBrands';
+import { type ThresholdEcdsaChainTarget } from '../../../interfaces/ecdsaChainTarget';
+import { type ThresholdRuntimePolicyScope } from '../../../threshold/sessionPolicy';
+import { type EmailOtpRoutePlan } from '../../../stepUpConfirmation/otpPrompt/authLane';
+export declare function assertNeverEmailOtpWorker(value: never): never;
+export declare function resolveEmailOtpAuthSubjectId(args: {
+    walletId: string;
+    userId?: unknown;
+    routePlan: EmailOtpRoutePlan;
+}): string;
+export declare function readString(value: unknown, label: string): string;
+export declare function readSigningSessionSealGroupId(value: unknown): typeof SIGNING_SESSION_SEAL_GROUP_ID;
+export declare function readThresholdEd25519SessionId(value: unknown, label: string): ThresholdEd25519SessionId;
+export declare function readNumber(value: unknown, label: string): number;
+export declare function readEmailOtpAuthoritySelector(value: unknown): EmailOtpAuthoritySelector;
+export declare function emailOtpAuthoritySelectorBody(selector: EmailOtpAuthoritySelector): {
+    readonly walletAuthMethodId?: string;
+};
+export declare function readRoutePlan(value: unknown, label: string): EmailOtpRoutePlan;
+export declare const SIGNING_SESSION_SEAL_TRANSPORT_FIELDS: readonly ["relayerUrl", "authorizationThresholdSessionId", "operationCredential", "signingSessionSealKeyVersion", "groupId"];
+export declare function requireFixed32ArrayBuffer(value: unknown, label: string): Uint8Array;
+export declare function requireWorkerWalletAuthMethodId(value: unknown): WalletAuthMethodId;
+export declare function rejectUnknownEmailOtpYaoFields(obj: Record<string, unknown>, allowed: readonly string[], label: string): void;
+export declare function parseEmailOtpWarmMaterialTarget(value: unknown): EmailOtpWarmMaterialTarget;
+export declare function parseOptionalEmailOtpChannel(value: unknown, label: string): WalletEmailOtpChannel | undefined;
+export declare function optionalWorkerPositiveInteger(value: unknown): number | undefined;
+export declare function parseWorkerRuntimePolicyScope(value: unknown, label: string): ThresholdRuntimePolicyScope;
+export declare function parseWorkerChainTarget(value: unknown): ThresholdEcdsaChainTarget;
+export declare function parseOptionalWorkerEcdsaSessionBootstrapHandleBinding(value: unknown): EmailOtpEcdsaSessionBootstrapHandleBinding | undefined;
+export declare function parseWorkerWalletRegistrationEcdsaPrepareHandleRequest(value: unknown): EmailOtpWalletRegistrationEcdsaPrepareHandleRequest;
+export declare function parseWorkerSealTransport(value: unknown): {
+    relayerUrl: string;
+    authorizationThresholdSessionId: string;
+    operationCredential: WalletSessionOperationCredentialV1;
+    signingSessionSealKeyVersion?: SigningSessionSealKeyVersion;
+    groupId?: string;
+};
+export declare function readRegistrationRoutePlan(value: unknown, label: string): EmailOtpRoutePlan;
+//# sourceMappingURL=payloadParsing.d.ts.map

package/dist/types/wallet/src/core/signingEngine/workerManager/workers/email-otp/recovery.d.ts

@@ -0,0 +1,9 @@
+import type { EmailOtpWorkerOperationMap } from '../../workerTypes';
+import { type EmailOtpWalletCustodySeedUnlock } from './unlock';
+export declare function releaseWalletRecoveryEmailOtpFactor(args: EmailOtpWorkerOperationMap['releaseWalletRecoveryEmailOtpFactor']['payload']): Promise<EmailOtpWorkerOperationMap['releaseWalletRecoveryEmailOtpFactor']['result']>;
+export declare function rehydrateEmailOtpEd25519YaoOperationMaterial(args: EmailOtpWorkerOperationMap['rehydrateEmailOtpEd25519YaoOperationMaterial']['payload']): Promise<EmailOtpWorkerOperationMap['rehydrateEmailOtpEd25519YaoOperationMaterial']['result']>;
+export declare function rehydrateActiveEmailOtpEd25519YaoSessionMaterial(args: EmailOtpWorkerOperationMap['rehydrateActiveEmailOtpEd25519YaoSessionMaterial']['payload']): Promise<EmailOtpWorkerOperationMap['rehydrateActiveEmailOtpEd25519YaoSessionMaterial']['result']>;
+export declare function rotateEmailOtpWalletRecoverySet(args: EmailOtpWalletCustodySeedUnlock & {
+    readonly recoveryCodesJson: string;
+}): Promise<EmailOtpWorkerOperationMap['rotateEmailOtpWalletRecoverySet']['result']>;
+//# sourceMappingURL=recovery.d.ts.map

package/dist/types/wallet/src/core/signingEngine/workerManager/workers/email-otp/requestEnvelope.d.ts

@@ -0,0 +1,11 @@
+import type { EmailOtpWorkerOperationRequestEnvelope } from '../../workerTypes';
+type EmailOtpWorkerRequest = EmailOtpWorkerOperationRequestEnvelope;
+/**
+ * The request id alone, recovered from a message this worker refused to parse,
+ * so a rejected request can be answered instead of leaving its caller to time
+ * out with nothing to report.
+ */
+export declare function workerRequestIdFromRawMessage(raw: unknown): string | null;
+export declare function parseEmailOtpWorkerRequest(raw: unknown): EmailOtpWorkerRequest | null;
+export {};
+//# sourceMappingURL=requestEnvelope.d.ts.map

package/dist/types/wallet/src/core/signingEngine/workerManager/workers/email-otp/sessionState.d.ts

@@ -0,0 +1,74 @@
+/**
+ * State the worker holds between requests: warm ECDSA and Ed25519 Yao factors, active Yao
+ * clients, and the signing-session seal that persists warm factors outside the worker.
+ */
+import { type MpcMaterialActivationRef } from '../../../../../../../shared-ts/src/utils/domainIds';
+import { type WalletSessionOperationCredentialV1 } from '../../../../../../../shared-ts/src/device-linking';
+import type { EmailOtpEcdsaSessionBootstrapHandleBinding, EmailOtpEcdsaSessionBootstrapHandlePayload, EmailOtpEd25519YaoRecoveryBootstrapV1, EmailOtpWarmMaterialTarget, EmailOtpWorkerOperationMap } from '../../workerTypes';
+import type { RouterAbEd25519YaoActiveClientMetadataV1, RouterAbEd25519YaoActiveClientV1, RouterAbEd25519YaoClientSigningShareV1 } from '../../../threshold/ed25519/yaoClient';
+import type { RouterAbEcdsaPostRegistrationSessionActivationResponseV1 } from '../../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+type EmailOtpWarmSessionStatusResult = EmailOtpWorkerOperationMap['getEmailOtpWarmSessionStatus']['result'];
+type EmailOtpWarmSessionSealResult = EmailOtpWorkerOperationMap['sealEmailOtpWarmSessionMaterial']['result'];
+type EmailOtpEcdsaWarmSessionRehydrateResult = EmailOtpWorkerOperationMap['rehydrateEmailOtpEcdsaWarmSessionMaterial']['result'];
+type ExactEmailOtpEcdsaWarmSessionRestore = EmailOtpWorkerOperationMap['rehydrateEmailOtpEcdsaWarmSessionMaterial']['payload']['restore'];
+type SigningSessionSealTransport = {
+    relayerUrl: string;
+    authorizationThresholdSessionId: string;
+    operationCredential: WalletSessionOperationCredentialV1;
+    keyVersion?: string;
+    groupId?: string;
+};
+type EmailOtpEd25519YaoActiveClientEntry = {
+    kind: 'active_client';
+    activeClient: RouterAbEd25519YaoActiveClientV1;
+};
+export type EmailOtpEd25519YaoWorkerActivationHandle = {
+    activeClientHandle: string;
+    metadata: RouterAbEd25519YaoActiveClientMetadataV1;
+};
+export declare const emailOtpEd25519YaoActiveClients: Map<string, EmailOtpEd25519YaoActiveClientEntry>;
+export declare function removeEmailOtpEd25519YaoActiveClient(activeClientHandle: string): boolean;
+export declare function storeEmailOtpEd25519YaoActiveClient(activeClient: RouterAbEd25519YaoActiveClientV1): EmailOtpEd25519YaoWorkerActivationHandle;
+export declare function cloneEmailOtpEd25519YaoSigningShare(share: RouterAbEd25519YaoClientSigningShareV1): RouterAbEd25519YaoClientSigningShareV1;
+export declare function parseSigningSessionSealTransport(value: unknown): SigningSessionSealTransport | null;
+export declare function invalidSigningSessionSealTransport(): {
+    ok: false;
+    code: string;
+    message: string;
+};
+export declare function deleteEmailOtpEd25519YaoWarmFactor(materialActivation: MpcMaterialActivationRef): void;
+export declare function deleteEmailOtpWarmMaterial(target: EmailOtpWarmMaterialTarget): void;
+export declare function bindEmailOtpEd25519YaoCapabilityWarmFactor(args: {
+    bootstrap: EmailOtpEd25519YaoRecoveryBootstrapV1;
+    factorSecret32: Uint8Array;
+    materialActivation: MpcMaterialActivationRef;
+}): void;
+export declare function issueEmailOtpEcdsaSessionHandle(args: {
+    walletId: string;
+    binding: EmailOtpEcdsaSessionBootstrapHandleBinding;
+}): EmailOtpEcdsaSessionBootstrapHandlePayload;
+export declare function bindEmailOtpEcdsaWarmSessionFactor(args: {
+    session: Pick<RouterAbEcdsaPostRegistrationSessionActivationResponseV1['session'], 'threshold_session_id' | 'remaining_uses' | 'expires_at_ms'>;
+    factorSecret32: Uint8Array;
+}): void;
+export declare function readEmailOtpWarmSessionStatus(target: EmailOtpWarmMaterialTarget): EmailOtpWarmSessionStatusResult;
+export declare function consumeEmailOtpWarmSessionUses(args: {
+    target: EmailOtpWarmMaterialTarget;
+    uses?: number;
+}): EmailOtpWarmSessionStatusResult;
+export declare function sealEmailOtpWarmSessionMaterial(args: {
+    target: EmailOtpWarmMaterialTarget;
+    transport: SigningSessionSealTransport;
+}): Promise<EmailOtpWarmSessionSealResult>;
+export declare function rehydrateEmailOtpEcdsaWarmSessionMaterial(args: {
+    target: Extract<EmailOtpWarmMaterialTarget, {
+        kind: 'ecdsa';
+    }>;
+    sealedSecretB64u: string;
+    remainingUses: number;
+    expiresAtMs: number;
+    transport: SigningSessionSealTransport;
+    restore: ExactEmailOtpEcdsaWarmSessionRestore;
+}): Promise<EmailOtpEcdsaWarmSessionRehydrateResult>;
+export {};
+//# sourceMappingURL=sessionState.d.ts.map