@seams/wallet 0.7.1 → 0.7.3

package/dist/types/shared-ts/src/utils/routerAbNormalSigningIdentity.d.ts

@@ -1,4 +1,6 @@
 import { type MpcMaterialActivationRef } from './domainIds';
+import type { RouterAbEcdsaOperationStepUpPreparationV1Wire } from './routerAbEcdsaDerivation';
+import type { RouterAbMpcMaterialActivationRefV1 } from './generated/routerAbEd25519YaoCore';
 export type RouterAbNormalSigningAuthorizationWire = {
     readonly kind: 'reusable_wallet_session';
     readonly wallet_session_id: string;
@@ -7,15 +9,18 @@ export type RouterAbNormalSigningAuthorizationWire = {
     readonly evidence_set_digest?: never;
     readonly wallet_session_id?: never;
 };
-export type RouterAbMpcMaterialActivationRefWire = {
-    readonly kind: 'mpc_material_activation_ref';
-    readonly activation_id: string;
-    readonly capability: string;
-    readonly material_owner: string;
-    readonly key_binding: string;
-    readonly lifecycle_binding: string;
-    readonly signing_worker: string;
+export type RouterAbEcdsaDerivationPoolFillAuthorization = {
+    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
+        readonly kind: 'reusable_wallet_session';
+    }>;
+    readonly operation?: never;
+} | {
+    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
+        readonly kind: 'operation_step_up';
+    }>;
+    readonly operation: RouterAbEcdsaOperationStepUpPreparationV1Wire;
 };
+export type RouterAbMpcMaterialActivationRefWire = Readonly<RouterAbMpcMaterialActivationRefV1>;
 export type RouterAbEd25519OperationStepUpPreparationV1Wire = {
     readonly wallet_id: string;
     readonly operation_kind: 'near.sign_transaction' | 'near.sign_delegate_action' | 'near.sign_nep413_message';
@@ -29,6 +34,23 @@ export type RouterAbEd25519OperationStepUpPreparationV1Wire = {
     readonly participant_ids: readonly [number, number];
     readonly expires_at_ms: number;
 };
+export type RouterAbEd25519OperationStepUpMaterialRecoveryRequest = {
+    kind: 'not_requested';
+} | {
+    kind: 'email_otp_factor_release_v1';
+    workerEphemeralPublicKey65B64u: string;
+};
+export type RouterAbEd25519OperationStepUpMaterialRecoveryResponse = {
+    kind: 'not_requested';
+} | {
+    kind: 'email_otp_factor_release_v1';
+    challengeId: string;
+    enrollmentId: string;
+    enrollmentSealKeyVersion: string;
+    serverEphemeralPublicKey65B64u: string;
+    nonce12B64u: string;
+    ciphertextB64u: string;
+};
 export type RouterAbEd25519OwnerOperationAuthorizationDecisionV1Wire = {
     readonly kind: 'authorized';
     readonly operation: {

package/dist/types/shared-ts/src/utils/routerApiKeyAuth.d.ts

@@ -0,0 +1,2 @@
+export type RouterApiKeyAuthFailureCode = 'secret_key_missing' | 'secret_key_invalid' | 'secret_key_revoked' | 'secret_key_forbidden_scope' | 'secret_key_ip_blocked' | 'secret_key_environment_mismatch';
+//# sourceMappingURL=routerApiKeyAuth.d.ts.map

package/dist/types/shared-ts/src/utils/signingSessionSeal.d.ts

@@ -1,6 +1,7 @@
 import type { RouterAbEcdsaDerivationNormalSigningStateV1, RouterAbEcdsaDerivationPublicCapabilityV1 } from './routerAbEcdsaDerivation';
 import type { EmailOtpProvider, EmailOtpWalletAuthAuthority, WalletAuthAuthorityRef } from './walletAuthAuthority';
 import type { MpcMaterialActivationRef } from './domainIds';
+import type { ThresholdEcdsaChainTarget } from './thresholdEcdsaChainTarget';
 import { SIGNER_AUTH_METHODS, type SignerAuthMethod } from './signerDomain';
 export declare const SIGNING_SESSION_SEALED_RECORD_VERSION: 2;
 export declare const SIGNING_SESSION_SEAL_ALG: "shamir3pass-v2";
@@ -23,6 +24,14 @@ export type SigningSessionSealProtocol = {
     algorithm: typeof SIGNING_SESSION_SEAL_ALG;
     groupId: SigningSessionSealGroupId;
 };
+/** The signing-session seal capabilities a relayer publishes in its well-known document. */
+export type WellKnownSigningSessionSealCapabilities = {
+    mode: 'none';
+} | {
+    mode: 'sealed_refresh_v1';
+    protocol: SigningSessionSealProtocol;
+    currentKeyVersion: string;
+};
 export type SealedSigningSessionEcdsaRestoreSource = 'login' | 'registration' | 'manual-bootstrap' | 'email_otp';
 export type RouterAbEd25519NormalSigningState = {
     kind: typeof ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND;
@@ -30,18 +39,8 @@ export type RouterAbEd25519NormalSigningState = {
 };
 export declare function parseRouterAbEd25519NormalSigningState(value: unknown): RouterAbEd25519NormalSigningState | null;
 export declare function requireRouterAbEd25519NormalSigningState(value: unknown): RouterAbEd25519NormalSigningState;
-type SealedSigningSessionEcdsaChainTarget = {
-    kind: 'tempo';
-    chainId: number;
-    networkSlug: string;
-} | {
-    kind: 'evm';
-    namespace: 'eip155';
-    chainId: number;
-    networkSlug: string;
-};
 type SealedSigningSessionEcdsaRestoreMetadataBase = {
-    chainTarget: SealedSigningSessionEcdsaChainTarget;
+    chainTarget: ThresholdEcdsaChainTarget;
     signingRootId: string;
     signingRootVersion: string;
     keyHandle: string;

package/dist/types/shared-ts/src/utils/thresholdEcdsaChainTarget.d.ts

@@ -0,0 +1,25 @@
+export type EvmEip155ChainTarget = {
+    kind: 'evm';
+    namespace: 'eip155';
+    chainId: number;
+    networkSlug: string;
+};
+export type TempoChainTarget = {
+    kind: 'tempo';
+    chainId: number;
+    networkSlug: string;
+};
+export type ThresholdEcdsaChainTarget = EvmEip155ChainTarget | TempoChainTarget;
+/** A chain target as requests carry it: the network slug may still be unresolved. */
+export type ThresholdEcdsaChainTargetWire = {
+    kind: 'evm';
+    namespace: 'eip155';
+    chainId: number;
+    networkSlug?: string;
+} | {
+    kind: 'tempo';
+    chainId: number;
+    networkSlug?: string;
+};
+export declare function thresholdEcdsaChainTargetKey(target: ThresholdEcdsaChainTargetWire): string;
+//# sourceMappingURL=thresholdEcdsaChainTarget.d.ts.map

package/dist/types/shared-ts/src/utils/variant.d.ts

@@ -8,4 +8,22 @@
 export type Variant<U, K extends keyof U, V extends U[K]> = Extract<U, {
     readonly [P in K]: V;
 }>;
+type KeysOfUnion<U> = U extends unknown ? keyof U : never;
+type Flatten<T> = {
+    [K in keyof T]: T[K];
+};
+/**
+ * Union `U` with each member's missing keys added as `?: never`, where the missing keys are
+ * those that other members declare. The members stay mutually exclusive, and code can read any
+ * member's key without narrowing first (it reads as `undefined` on the members that lack it).
+ * `K` holds every member's keys, taken before `U` distributes.
+ */
+export type ExclusiveUnion<U, K extends PropertyKey = KeysOfUnion<U>> = U extends unknown ? Flatten<U & {
+    [P in Exclude<K, keyof U>]?: never;
+}> : never;
+/** `ExclusiveUnion` for readonly members: the added keys are `readonly` too. */
+export type ReadonlyExclusiveUnion<U, K extends PropertyKey = KeysOfUnion<U>> = U extends unknown ? Flatten<U & {
+    readonly [P in Exclude<K, keyof U>]?: never;
+}> : never;
+export {};
 //# sourceMappingURL=variant.d.ts.map

package/dist/types/shared-ts/src/utils/walletAuthMethodRecord.d.ts

@@ -1,6 +1,6 @@
 import { type DigestB64u } from './canonicalPrimitives';
 import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from './domainIds';
-import type { Variant } from './variant';
+import type { Variant, ReadonlyExclusiveUnion } from './variant';
 export type WalletAuthMethodRevocationProof = {
     readonly kind: 'webauthn_assertion';
     rpId: WebAuthnRpId;
@@ -44,19 +44,16 @@ export type WalletAuthMethodRecord = {
     credentialPublicKeyB64u?: never;
     counter?: never;
 };
-type WalletAuthMethodLifecycleV1 = {
+type WalletAuthMethodLifecycleV1 = ReadonlyExclusiveUnion<{
     readonly status: 'pending_local_install';
-    readonly activatedAtMs?: never;
-    readonly revokedAtMs?: never;
 } | {
     readonly status: 'active';
     readonly activatedAtMs: number;
-    readonly revokedAtMs?: never;
 } | {
     readonly status: 'revoked';
     readonly activatedAtMs: number;
     readonly revokedAtMs: number;
-};
+}>;
 type WalletAuthMethodDraftCommonV1 = {
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly walletId: WalletId;

package/dist/types/shared-ts/src/utils/webauthnDeviceInfo.d.ts

@@ -10,8 +10,8 @@
  * Stored on the authenticator row and returned by the authenticators listing
  * so profile UIs can label signers ("Chrome on macOS", "iCloud Keychain").
  */
-type WebAuthnDeviceBrowser = 'chrome' | 'safari' | 'firefox' | 'edge' | 'other';
-type WebAuthnDeviceOs = 'macos' | 'ios' | 'windows' | 'android' | 'linux' | 'other';
+type WebAuthnDeviceBrowser = (typeof WEBAUTHN_DEVICE_BROWSERS)[number];
+type WebAuthnDeviceOs = (typeof WEBAUTHN_DEVICE_OSES)[number];
 export type WebAuthnAuthenticatorDeviceInfo = {
     /** Display-ready label, e.g. "Chrome on macOS". Never empty. */
     label: string;
@@ -26,6 +26,8 @@ export type WebAuthnAuthenticatorDeviceInfo = {
     /** Display name for the provider, e.g. "iCloud Keychain". */
     providerLabel?: string;
 };
+declare const WEBAUTHN_DEVICE_BROWSERS: readonly ["chrome", "safari", "firefox", "edge", "other"];
+declare const WEBAUTHN_DEVICE_OSES: readonly ["macos", "ios", "windows", "android", "linux", "other"];
 export declare function deriveWebAuthnAuthenticatorDeviceInfo(input: {
     userAgent?: string;
     aaguid?: string;

package/dist/types/shared-ts/src/wallet-recovery/recoveryEnvelopes.d.ts

@@ -1,4 +1,5 @@
 import type { RecoveryCodeReservationId } from './recoveryCodeReservation';
+import type { ExclusiveUnion } from '../utils/variant';
 /**
  * Lifecycle of one recovery code.
  *
@@ -6,37 +7,23 @@ import type { RecoveryCodeReservationId } from './recoveryCodeReservation';
  * commits only after the replacement credential activates. See
  * `recoveryCodeReservation.ts` for the transitions between these states.
  */
-export type RecoveryCodeLifecycleState = {
+export type RecoveryCodeLifecycleState = ExclusiveUnion<{
     state: 'active';
     issuedAtMs: number;
-    reservationId?: never;
-    reservedAtMs?: never;
-    reservationExpiresAtMs?: never;
-    consumedAtMs?: never;
-    revokedAtMs?: never;
 } | {
     state: 'reserved';
     issuedAtMs: number;
     reservationId: RecoveryCodeReservationId;
     reservedAtMs: number;
     reservationExpiresAtMs: number;
-    consumedAtMs?: never;
-    revokedAtMs?: never;
 } | {
     state: 'consumed';
     issuedAtMs: number;
     reservationId: RecoveryCodeReservationId;
     consumedAtMs: number;
-    reservedAtMs?: never;
-    reservationExpiresAtMs?: never;
-    revokedAtMs?: never;
 } | {
     state: 'revoked';
     issuedAtMs: number;
     revokedAtMs: number;
-    reservationId?: never;
-    reservedAtMs?: never;
-    reservationExpiresAtMs?: never;
-    consumedAtMs?: never;
-};
+}>;
 //# sourceMappingURL=recoveryEnvelopes.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryPreparation.d.ts

@@ -0,0 +1,15 @@
+import type { RuntimePolicyScope } from '../threshold/signingRootScope';
+import type { RouterAbEd25519YaoApplicationBindingFactsV1, RouterAbEd25519YaoBytes32V1, RouterAbEd25519YaoLifecycleScopeV1 } from '../utils/routerAbEd25519Yao';
+export type WalletRecoveryPreparationNearRecoveryBasisV1 = {
+    readonly capabilityKind: 'registration' | 'recovery';
+    readonly activeCapabilityBinding: RouterAbEd25519YaoBytes32V1;
+    readonly scope: RouterAbEd25519YaoLifecycleScopeV1;
+    readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
+    readonly participantIds: readonly [number, number];
+    readonly registeredPublicKey: RouterAbEd25519YaoBytes32V1;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+    readonly activationTranscript: RouterAbEd25519YaoBytes32V1;
+    readonly activationStateEpoch: number;
+    readonly signingWorkerVerifyingShare: RouterAbEd25519YaoBytes32V1;
+};
+//# sourceMappingURL=walletRecoveryPreparation.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryTarget.d.ts

@@ -1,12 +1,11 @@
 import { type WebAuthnRpId } from '../utils/domainIds';
-export type WalletRecoveryTargetV1 = {
+import type { ReadonlyExclusiveUnion } from '../utils/variant';
+export type WalletRecoveryTargetV1 = ReadonlyExclusiveUnion<{
     readonly kind: 'passkey';
     readonly rpId: WebAuthnRpId;
-    readonly googleProvider?: never;
 } | {
     readonly kind: 'google_email_otp';
     readonly googleProvider: 'google';
-    readonly rpId?: never;
-};
+}>;
 export declare function parseWalletRecoveryTargetV1(raw: unknown): WalletRecoveryTargetV1;
 //# sourceMappingURL=walletRecoveryTarget.d.ts.map

package/dist/types/wallet/build-paths.d.ts

@@ -13,13 +13,12 @@ export declare const BUILD_PATHS: {
         readonly WASM_SIGNER: "../../wasm/near_signer";
         readonly ED25519_YAO_CLIENT: "../../crates/router-ab-ed25519-yao-client";
         readonly WASM_ECDSA_CLIENT: "../../wasm/router_ab_ecdsa_client";
-        readonly WASM_ECDSA_SIGNING_WORKER: "../../wasm/router_ab_ecdsa_signing_worker";
         readonly WASM_EVM_CRYPTO: "../../wasm/evm_crypto";
         readonly WASM_TEMPO_SIGNER: "../../wasm/tempo_signer";
         readonly WASM_SHAMIR3PASS_RUNTIME: "../../wasm/shamir3pass_runtime";
         readonly WASM_EMAIL_OTP_RUNTIME: "../../wasm/email_otp_runtime";
         readonly WASM_WALLET_CUSTODY_CEREMONY: "../../wasm/wallet_custody_ceremony";
-        readonly CRITICAL_DIRS: readonly ["src/core", "src/react", "src/static", "src/utils", "../wallet-server/src", "../shared-ts/src", "../../crates/router-ab-ed25519-yao-client", "../../wasm/near_signer", "../../wasm/router_ab_ecdsa_client", "../../wasm/router_ab_ecdsa_signing_worker", "../../wasm/evm_crypto", "../../wasm/tempo_signer", "../../wasm/shamir3pass_runtime", "../../wasm/email_otp_runtime", "../../wasm/wallet_custody_ceremony"];
+        readonly CRITICAL_DIRS: readonly ["src/core", "src/react", "src/static", "src/utils", "../wallet-server/src", "../shared-ts/src", "../../crates/router-ab-ed25519-yao-client", "../../wasm/near_signer", "../../wasm/router_ab_ecdsa_client", "../../wasm/evm_crypto", "../../wasm/tempo_signer", "../../wasm/shamir3pass_runtime", "../../wasm/email_otp_runtime", "../../wasm/wallet_custody_ceremony"];
     };
     readonly RUNTIME: {
         readonly SDK_BASE: "/sdk";

package/dist/types/wallet/src/SeamsWeb/SeamsWeb.d.ts

@@ -63,6 +63,8 @@ export declare class SeamsWeb {
      */
     initWalletIframe(walletId?: string): Promise<WalletIframeExactSessionState>;
     getWalletIframeExactSessionState(): Promise<WalletIframeExactSessionState>;
+    /** @internal One wallet-host restore owns all configured-chain prefills. */
+    prefillRestoredWalletSession(state: WalletIframeExactSessionState): Promise<void>;
     openHostedAuthMenu(request: HostedAuthMenuOpenRequest, anchorElement?: HTMLElement): Promise<HostedAuthMenuOutcome>;
     cancelHostedAuthMenu(args: {
         authMenuSessionId: HostedAuthMenuSessionId;

package/dist/types/wallet/src/SeamsWeb/operations/auth/scheduleLinkedDevicePresignaturePrefill.d.ts

@@ -0,0 +1,11 @@
+import type { WalletSessionOperationCredentialV1 } from '../../../../../shared-ts/src/device-linking';
+import { type LinkedEcdsaHolderRuntimeV1 } from '../../../core/signingEngine/session/material/linkedEcdsaHolderRuntime';
+import type { WorkerOperationContext } from '../../../core/signingEngine/workerManager/executeWorkerOperation';
+export declare function scheduleLinkedDevicePresignaturePrefill(args: {
+    runtime: LinkedEcdsaHolderRuntimeV1;
+    operationCredential: WalletSessionOperationCredentialV1;
+    expiresAtMs: number;
+    relayerUrl: string;
+    workerCtx: WorkerOperationContext;
+}): Promise<void>;
+//# sourceMappingURL=scheduleLinkedDevicePresignaturePrefill.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/auth/walletAuth.d.ts

@@ -1,3 +1,4 @@
+import type { WalletSessionStatusReadScope } from '../../../core/rpcClients/relayer/walletSessionAuthorizationStatus';
 import type { NearClient } from '../../../core/rpcClients/near/NearClient';
 import type { RouterAbEcdsaDerivationLoginPresignaturePrefillResult } from '../../../core/signingEngine/session/warmCapabilities/ecdsaLoginPrefill';
 import type { ThresholdEcdsaChainTarget } from '../../../core/signingEngine/interfaces/ecdsaChainTarget';
@@ -50,6 +51,6 @@ export declare function prefillRouterAbEcdsaDerivationPresignaturePoolDomain(dep
     walletSession: WalletSessionRef;
     chainTarget: ThresholdEcdsaChainTarget;
     waitForPoolReady?: boolean;
-}): Promise<RouterAbEcdsaDerivationLoginPresignaturePrefillResult>;
+}, statusReads: WalletSessionStatusReadScope): Promise<RouterAbEcdsaDerivationLoginPresignaturePrefillResult>;
 export {};
 //# sourceMappingURL=walletAuth.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/auth/walletUnlockSubject.d.ts

@@ -1,6 +1,7 @@
 import { type WalletId } from '../../../core/signingEngine/interfaces/ecdsaChainTarget';
 import { type WalletUnlockCapabilitySubjectResolutionFailure } from './walletUnlockEcdsaSubject';
 import type { WalletUnlockSubjectSet } from '../../../core/signingEngine/session/identity/walletUnlockSubject';
+import type { ExclusiveUnion } from '../../../../../shared-ts/src/utils/variant';
 export type { NearEd25519WalletUnlockSubject, WalletUnlockSubject, WalletUnlockSubjectSet, } from '../../../core/signingEngine/session/identity/walletUnlockSubject';
 export type WalletUnlockCapabilityFamilyScope = {
     readonly kind: 'near_ed25519_only';
@@ -25,42 +26,27 @@ type WalletUnlockSubjectSetResolution = {
 };
 type WalletIdentitySource = 'profile_projection' | 'host_last_used_profile' | 'local_wallet_authority';
 type WalletIdentityResolveFailure = 'missing_wallet_profile' | 'ambiguous_wallet_profile' | 'missing_requested_capability_subject' | WalletUnlockCapabilitySubjectResolutionFailure | 'invalid_wallet_profile';
-export type WalletCapabilitySubjectResolution = {
+export type WalletCapabilitySubjectResolution = ExclusiveUnion<{
     kind: 'no_session_request';
-    walletId?: never;
-    profileId?: never;
-    subjectSet?: never;
-    source?: never;
-    reason?: never;
 } | {
     kind: 'resolved';
     walletId: WalletId;
-    profileId?: never;
     subjectSet: WalletUnlockSubjectSet;
     source: WalletIdentitySource;
-    reason?: never;
 } | {
     kind: 'no_session_for_wallet';
     walletId: WalletId;
-    profileId?: never;
     reason: 'missing_requested_capability_subject';
     source: WalletIdentitySource;
-    subjectSet?: never;
 } | {
     kind: 'unresolvable';
     walletId: WalletId;
-    profileId?: never;
     reason: WalletIdentityResolveFailure;
-    subjectSet?: never;
-    source?: never;
 } | {
     kind: 'unresolvable_profile';
     profileId: string;
-    walletId?: never;
     reason: WalletIdentityResolveFailure;
-    subjectSet?: never;
-    source?: never;
-};
+}>;
 export declare function resolveWalletUnlockSubjectSet(args: {
     readonly walletId: string;
     readonly requestedCapabilityFamilies: WalletUnlockCapabilityFamilyScope;

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/emailOtp/walletActivation.d.ts

@@ -5,6 +5,7 @@ import type { NearEd25519SignerBinding } from '../../../../../../shared-ts/src/u
 import type { WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { EmailOtpVerifiedAuthorityProjection } from '../../../../core/signingEngine/session/emailOtp/publicTypes';
 import { type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export declare function persistVerifiedEmailOtpAuthorityAfterUnlock(args: {
     readonly walletId: string;
     readonly walletAuthMethodId: string;
@@ -17,17 +18,15 @@ export declare function walletAuthAuthorityRefForVerifiedEmailOtpUnlock(args: {
     readonly emailHashHex: string;
     readonly projection: EmailOtpVerifiedAuthorityProjection;
 }): Promise<WalletAuthAuthorityRef>;
-export type EmailOtpWalletPostUnlockActivation = {
+export type EmailOtpWalletPostUnlockActivation = ExclusiveUnion<{
     kind: 'near_ed25519_wallet';
     signer: NearEd25519SignerBinding;
     walletAuthMethodId: WalletAuthMethodId;
-    walletId?: never;
 } | {
     kind: 'evm_family_ecdsa_wallet';
     walletId: WalletId;
     walletAuthMethodId: WalletAuthMethodId;
-    signer?: never;
-};
+}>;
 export type EmailOtpWalletPostUnlockActivationDeps = {
     signingEngine: {
         setWalletAuthenticated(args: {

package/dist/types/wallet/src/SeamsWeb/operations/devices/deviceLinkingAuthorityInstallation.d.ts

@@ -1,20 +1,12 @@
 import type { ActivateInstalledAuthorityResultV1, CommittedAuthorityPackagesV1, LinkSessionStateV1, LinkedAuthorityActivationResultV1, LocalAuthorityActivationFinalAckV1, LocalAuthorityInstallationReceiptV1, WalletSessionOperationCredentialV1, VerifiedTargetFactorV1 } from '../../../../../shared-ts/src/device-linking';
-import { parseDigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { LinkDeviceSessionId } from '../../../../../shared-ts/src/signing-lanes/ids';
-import type { WalletAuthorityExportRootRecordV1, WalletAuthoritySignerMaterialRecordV1 } from '../../../core/indexedDB';
 import type { UnifiedIndexedDBManager } from '../../../core/indexedDB';
+import type { SealedLocalAuthorityMaterialSetV1 } from '../../../core/signingEngine/workerManager/deviceLinkingPorts';
 import type { DeviceLinkingAuthorityActivationTransportPortV1, DeviceLinkingKeyMaterialHandleV1, DeviceLinkingKeyMaterialPortV1 } from './deviceLinkingPorts';
 import type { DeviceLinkingResealedEd25519ExportRootV1 } from './deviceLinkingEd25519ExportRoot';
 import { type DeviceLinkingCommittedResumeV1 } from './deviceLinkingResume';
 export { replayPendingDeviceLinkingAcknowledgementsV1, type DeviceLinkingDurableAcknowledgementReplayResultV1, } from './deviceLinkingResume';
-export type DeviceLinkingSealedAuthorityRecordsV1 = {
-    readonly signerMaterials: readonly [
-        WalletAuthoritySignerMaterialRecordV1,
-        ...WalletAuthoritySignerMaterialRecordV1[]
-    ];
-    readonly exportRoot: WalletAuthorityExportRootRecordV1 | null;
-    readonly installedRecordSetDigestB64u: ReturnType<typeof parseDigestB64u>;
-};
+export type DeviceLinkingSealedAuthorityRecordsV1 = SealedLocalAuthorityMaterialSetV1;
 /**
  * The worker owns package decryption and factor sealing. The browser receives
  * only already-sealed persistence records at this boundary.

package/dist/types/wallet/src/SeamsWeb/operations/tempo/executeEvmFamilyTransaction.d.ts

@@ -25,7 +25,7 @@ export type EvmFamilyTransactionSignArgs = {
  */
 export declare function withResolvedChainId(request: ExecuteEvmFamilyTransactionArgs['request'], chainTarget: ThresholdEcdsaChainTarget): EvmSigningRequest | TempoSigningRequest;
 type TempoLifecycleDeps = {
-    onBroadcastStarted?: (signedResult: TempoSignedResult | EvmSignedResult) => void;
+    onBroadcastStarted(args: Pick<ReportTempoBroadcastAcceptedArgs, 'walletSession' | 'signedResult'>): void;
     signEvmFamily(args: EvmFamilyTransactionSignArgs): Promise<TempoSignedResult | EvmSignedResult>;
     reportBroadcastAccepted(args: ReportTempoBroadcastAcceptedArgs): Promise<void>;
     reportBroadcastRejected(args: ReportTempoBroadcastRejectedArgs): Promise<void>;

package/dist/types/wallet/src/SeamsWeb/publicApi/types.d.ts

@@ -28,6 +28,7 @@ import type { PendingEcdsaRegistrationResumeRequest, ResumePendingEcdsaRegistrat
 import type { EvmAddress, EvmBytes, EvmSigningRequest } from '../../core/signingEngine/chains/evm/evmSigning.types';
 import type { TempoSigningRequest } from '../../core/signingEngine/chains/tempo/tempoSigning.types';
 import type { TempoFeeTokenValidation } from '../../core/signingEngine/chains/tempo/feeToken';
+import type { EvmFamilyNonceLaneStatus } from '../../core/signingEngine/flows/signEvmFamily/types';
 import type { SigningEngineResolveExactKeyExportLaneInput, SigningEngineResolveExactKeyExportLaneResult, SigningEngineExportKeypairWithUIInput } from '../../core/signingEngine/flows/recovery/public';
 import type { ThresholdEcdsaSessionBootstrapResult } from '../../core/signingEngine/threshold/ecdsa/activation';
 import type { EmailOtpBootstrapRecovery } from '../../core/signingEngine/stepUpConfirmation/otpPrompt/bootstrapRecovery';
@@ -37,6 +38,7 @@ import type { WalletEmailOtpChannel, WalletEmailOtpLoginOperation } from '../../
 import type { WalletId } from '../../../../shared-ts/src/utils/registrationIntent';
 import type { AddSignerSelection, RegistrationNearAccountProvisioning, RegistrationSignerSetSelection } from '../../../../shared-ts/src/utils/registrationSignerPlan';
 import type { RegistrationAuthMethodInput, RegisterWalletInput } from '../../../../shared-ts/src/utils/registrationAuthMethodInput';
+import type { ExclusiveUnion } from '../../../../shared-ts/src/utils/variant';
 export type { WalletIframeRequestId, WalletIframeSurfaceId, } from '../../core/types/walletIframeIdentity';
 export type { WalletSessionInput } from './currentWallet';
 export type { AwaitNearReadyResult } from './awaitNearReady';
@@ -181,12 +183,7 @@ export type ReportTempoDroppedOrReplacedArgs = ReportTempoNonceLifecycleBaseArgs
     txHash?: `0x${string}`;
 };
 export type ReconcileTempoNonceLaneArgs = ReportTempoNonceLifecycleBaseArgs;
-export type TempoNonceLaneStatus = {
-    chainNextNonce: string;
-    unresolvedInFlightNonces: string[];
-    blocked: boolean;
-    blockedNonce?: string;
-};
+export type TempoNonceLaneStatus = EvmFamilyNonceLaneStatus;
 export type FinalizedEvmEip1559PayloadExpectation = {
     kind: 'evm_eip1559';
     to: EvmAddress | null;
@@ -486,15 +483,11 @@ export type GoogleEmailOtpWalletAuthLoginTarget = {
     readonly kind: 'wallet';
     readonly walletId: WalletId | string;
 };
-export type GoogleEmailOtpWalletAuthStartInput = GoogleEmailOtpWalletAuthStartBaseInput & ({
+export type GoogleEmailOtpWalletAuthStartInput = GoogleEmailOtpWalletAuthStartBaseInput & ExclusiveUnion<{
     mode: 'login';
     loginTarget: GoogleEmailOtpWalletAuthLoginTarget;
-    replaceExistingWallet?: never;
-    signerSelection?: never;
-    recoveryCodeBackup?: never;
 } | {
     mode: 'register';
-    loginTarget?: never;
     /** Start a fresh wallet even when this Google account already holds one. */
     replaceExistingWallet?: boolean;
     /** The exact signer set to provision when configuration defaults are insufficient. */
@@ -503,7 +496,7 @@ export type GoogleEmailOtpWalletAuthStartInput = GoogleEmailOtpWalletAuthStartBa
     recoveryCodeBackup?: Extract<RegistrationHooksOptions['recoveryCodeBackup'], {
         readonly kind: 'defer_to_account_menu' | 'show_builtin_dialog';
     }>;
-});
+}>;
 export interface AuthCapability {
     unlock(walletId: string, options?: LoginHooksOptions): Promise<LoginAndCreateSessionResult>;
     lock(): Promise<void>;
@@ -841,13 +834,12 @@ export type KeyExportOutcome = {
     kind: 'relink_required';
     reason: 'missing_canonical_owner_binding';
 };
-export type ExportKeypairInput = {
+export type ExportKeypairInput = ExclusiveUnion<{
     kind: 'ed25519';
     /** A `WalletSessionRef` or bare wallet id. Omitted, resolves to the authenticated wallet. */
     walletSession?: WalletSessionInput;
     /** Omitted, resolves to the authenticated wallet's NEAR account. */
     nearAccount?: NearAccountRef | string;
-    chainTarget?: never;
     options?: KeyExportUiOptions;
 } | {
     kind: 'ecdsa';
@@ -855,9 +847,8 @@ export type ExportKeypairInput = {
     walletSession?: WalletSessionInput;
     /** A configured EVM-family network slug, or an exact target. */
     chainTarget: EcdsaChainSelector;
-    nearAccount?: never;
     options?: KeyExportUiOptions;
-};
+}>;
 export interface KeyExportCapability {
     /**
      * Resolve the exact export lane, then open the wallet-origin export viewer.

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/restoredSessionPresignaturePrefill.d.ts

@@ -1,10 +1,11 @@
+import { WalletSessionStatusReadScope } from '../../../core/rpcClients/relayer/walletSessionAuthorizationStatus';
 import type { WalletIframeExactSessionState } from '../shared/exactSessionState';
 import { type ThresholdEcdsaChainTarget, type WalletSessionRef } from '../../../core/signingEngine/interfaces/ecdsaChainTarget';
 import type { RouterAbEcdsaDerivationLoginPresignaturePrefillResult } from '../../../core/signingEngine/session/warmCapabilities/ecdsaLoginPrefill';
 export type RestoredSessionPresignaturePrefill = (args: {
     walletSession: WalletSessionRef;
     chainTarget: ThresholdEcdsaChainTarget;
-}) => Promise<RouterAbEcdsaDerivationLoginPresignaturePrefillResult>;
+}, statusReads: WalletSessionStatusReadScope) => Promise<RouterAbEcdsaDerivationLoginPresignaturePrefillResult>;
 export declare function scheduleRestoredSessionPresignaturePrefills(args: {
     state: WalletIframeExactSessionState;
     chainTargets: readonly ThresholdEcdsaChainTarget[];

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/ui/auth-menu/AuthMenuSurface.d.ts

@@ -91,8 +91,7 @@ export declare class AuthMenuSurface extends Component<AuthMenuSurfaceProps, {
     private renderLinkDeviceEmailOtp;
     private renderLinkDeviceEmailOtpActions;
     private renderLinkDeviceFailure;
-    private renderLinkDeviceExpired;
-    private renderLinkDeviceCancelled;
+    private renderLinkDeviceFailurePanel;
     private renderLinkedDeviceActivation;
     private renderLinkDevicePasskeyConfirmation;
     private renderGoogleOtp;