@seams/wallet 0.7.1 → 0.8.0

package/dist/types/shared-ts/src/utils/routerAbNormalSigningIdentity.d.ts

@@ -1,4 +1,6 @@
 import { type MpcMaterialActivationRef } from './domainIds';
+import type { RouterAbEcdsaOperationStepUpPreparationV1Wire } from './routerAbEcdsaDerivation';
+import type { RouterAbMpcMaterialActivationRefV1 } from './generated/routerAbEd25519YaoCore';
 export type RouterAbNormalSigningAuthorizationWire = {
     readonly kind: 'reusable_wallet_session';
     readonly wallet_session_id: string;
@@ -7,15 +9,18 @@ export type RouterAbNormalSigningAuthorizationWire = {
     readonly evidence_set_digest?: never;
     readonly wallet_session_id?: never;
 };
-export type RouterAbMpcMaterialActivationRefWire = {
-    readonly kind: 'mpc_material_activation_ref';
-    readonly activation_id: string;
-    readonly capability: string;
-    readonly material_owner: string;
-    readonly key_binding: string;
-    readonly lifecycle_binding: string;
-    readonly signing_worker: string;
+export type RouterAbEcdsaDerivationPoolFillAuthorization = {
+    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
+        readonly kind: 'reusable_wallet_session';
+    }>;
+    readonly operation?: never;
+} | {
+    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
+        readonly kind: 'operation_step_up';
+    }>;
+    readonly operation: RouterAbEcdsaOperationStepUpPreparationV1Wire;
 };
+export type RouterAbMpcMaterialActivationRefWire = Readonly<RouterAbMpcMaterialActivationRefV1>;
 export type RouterAbEd25519OperationStepUpPreparationV1Wire = {
     readonly wallet_id: string;
     readonly operation_kind: 'near.sign_transaction' | 'near.sign_delegate_action' | 'near.sign_nep413_message';
@@ -29,6 +34,23 @@ export type RouterAbEd25519OperationStepUpPreparationV1Wire = {
     readonly participant_ids: readonly [number, number];
     readonly expires_at_ms: number;
 };
+export type RouterAbEd25519OperationStepUpMaterialRecoveryRequest = {
+    kind: 'not_requested';
+} | {
+    kind: 'email_otp_factor_release_v1';
+    workerEphemeralPublicKey65B64u: string;
+};
+export type RouterAbEd25519OperationStepUpMaterialRecoveryResponse = {
+    kind: 'not_requested';
+} | {
+    kind: 'email_otp_factor_release_v1';
+    challengeId: string;
+    enrollmentId: string;
+    enrollmentSealKeyVersion: string;
+    serverEphemeralPublicKey65B64u: string;
+    nonce12B64u: string;
+    ciphertextB64u: string;
+};
 export type RouterAbEd25519OwnerOperationAuthorizationDecisionV1Wire = {
     readonly kind: 'authorized';
     readonly operation: {

package/dist/types/shared-ts/src/utils/routerApiKeyAuth.d.ts

@@ -0,0 +1,2 @@
+export type RouterApiKeyAuthFailureCode = 'secret_key_missing' | 'secret_key_invalid' | 'secret_key_revoked' | 'secret_key_forbidden_scope' | 'secret_key_ip_blocked' | 'secret_key_environment_mismatch';
+//# sourceMappingURL=routerApiKeyAuth.d.ts.map

package/dist/types/shared-ts/src/utils/signingSessionSeal.d.ts

@@ -1,6 +1,7 @@
 import type { RouterAbEcdsaDerivationNormalSigningStateV1, RouterAbEcdsaDerivationPublicCapabilityV1 } from './routerAbEcdsaDerivation';
 import type { EmailOtpProvider, EmailOtpWalletAuthAuthority, WalletAuthAuthorityRef } from './walletAuthAuthority';
 import type { MpcMaterialActivationRef } from './domainIds';
+import type { ThresholdEcdsaChainTarget } from './thresholdEcdsaChainTarget';
 import { SIGNER_AUTH_METHODS, type SignerAuthMethod } from './signerDomain';
 export declare const SIGNING_SESSION_SEALED_RECORD_VERSION: 2;
 export declare const SIGNING_SESSION_SEAL_ALG: "shamir3pass-v2";
@@ -23,6 +24,14 @@ export type SigningSessionSealProtocol = {
     algorithm: typeof SIGNING_SESSION_SEAL_ALG;
     groupId: SigningSessionSealGroupId;
 };
+/** The signing-session seal capabilities a relayer publishes in its well-known document. */
+export type WellKnownSigningSessionSealCapabilities = {
+    mode: 'none';
+} | {
+    mode: 'sealed_refresh_v1';
+    protocol: SigningSessionSealProtocol;
+    currentKeyVersion: string;
+};
 export type SealedSigningSessionEcdsaRestoreSource = 'login' | 'registration' | 'manual-bootstrap' | 'email_otp';
 export type RouterAbEd25519NormalSigningState = {
     kind: typeof ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND;
@@ -30,18 +39,8 @@ export type RouterAbEd25519NormalSigningState = {
 };
 export declare function parseRouterAbEd25519NormalSigningState(value: unknown): RouterAbEd25519NormalSigningState | null;
 export declare function requireRouterAbEd25519NormalSigningState(value: unknown): RouterAbEd25519NormalSigningState;
-type SealedSigningSessionEcdsaChainTarget = {
-    kind: 'tempo';
-    chainId: number;
-    networkSlug: string;
-} | {
-    kind: 'evm';
-    namespace: 'eip155';
-    chainId: number;
-    networkSlug: string;
-};
 type SealedSigningSessionEcdsaRestoreMetadataBase = {
-    chainTarget: SealedSigningSessionEcdsaChainTarget;
+    chainTarget: ThresholdEcdsaChainTarget;
     signingRootId: string;
     signingRootVersion: string;
     keyHandle: string;

package/dist/types/shared-ts/src/utils/thresholdEcdsaChainTarget.d.ts

@@ -0,0 +1,25 @@
+export type EvmEip155ChainTarget = {
+    kind: 'evm';
+    namespace: 'eip155';
+    chainId: number;
+    networkSlug: string;
+};
+export type TempoChainTarget = {
+    kind: 'tempo';
+    chainId: number;
+    networkSlug: string;
+};
+export type ThresholdEcdsaChainTarget = EvmEip155ChainTarget | TempoChainTarget;
+/** A chain target as requests carry it: the network slug may still be unresolved. */
+export type ThresholdEcdsaChainTargetWire = {
+    kind: 'evm';
+    namespace: 'eip155';
+    chainId: number;
+    networkSlug?: string;
+} | {
+    kind: 'tempo';
+    chainId: number;
+    networkSlug?: string;
+};
+export declare function thresholdEcdsaChainTargetKey(target: ThresholdEcdsaChainTargetWire): string;
+//# sourceMappingURL=thresholdEcdsaChainTarget.d.ts.map

package/dist/types/shared-ts/src/utils/validation.d.ts

@@ -1,6 +1,4 @@
-export type { NearAccountValidationOptions } from './near';
-export { ensureEd25519Prefix, validateNearAccountId, isValidAccountId } from './near';
-export { normalizeOptionalString as toOptionalString, normalizeOptionalTrimmedString as toOptionalTrimmedString, normalizeTrimmedString as toTrimmedString, stripTrailingSlashes, ensureLeadingSlash, toBasePath, toOriginOrUndefined, toRorOriginOrNull, toSingleLine, normalizeInteger, normalizePositiveInteger, } from './normalize';
+export { normalizeOptionalString as toOptionalString, normalizeOptionalTrimmedString as toOptionalTrimmedString, normalizeTrimmedString as toTrimmedString, stripTrailingSlashes, ensureLeadingSlash, toBasePath, toOriginOrUndefined, toRorOriginOrNull, normalizeInteger, normalizePositiveInteger, } from './normalize';
 export declare function requireTrimmedString(value: unknown, label: string, message?: string): string;
 export declare function toOptionalTrimmedNonEmptyString(value: unknown): string | undefined;
 export declare function requireNonEmptyString(value: unknown, label: string): string;

package/dist/types/shared-ts/src/utils/variant.d.ts

@@ -8,4 +8,22 @@
 export type Variant<U, K extends keyof U, V extends U[K]> = Extract<U, {
     readonly [P in K]: V;
 }>;
+type KeysOfUnion<U> = U extends unknown ? keyof U : never;
+type Flatten<T> = {
+    [K in keyof T]: T[K];
+};
+/**
+ * Union `U` with each member's missing keys added as `?: never`, where the missing keys are
+ * those that other members declare. The members stay mutually exclusive, and code can read any
+ * member's key without narrowing first (it reads as `undefined` on the members that lack it).
+ * `K` holds every member's keys, taken before `U` distributes.
+ */
+export type ExclusiveUnion<U, K extends PropertyKey = KeysOfUnion<U>> = U extends unknown ? Flatten<U & {
+    [P in Exclude<K, keyof U>]?: never;
+}> : never;
+/** `ExclusiveUnion` for readonly members: the added keys are `readonly` too. */
+export type ReadonlyExclusiveUnion<U, K extends PropertyKey = KeysOfUnion<U>> = U extends unknown ? Flatten<U & {
+    readonly [P in Exclude<K, keyof U>]?: never;
+}> : never;
+export {};
 //# sourceMappingURL=variant.d.ts.map

package/dist/types/shared-ts/src/utils/walletAuthMethodRecord.d.ts

@@ -1,6 +1,6 @@
 import { type DigestB64u } from './canonicalPrimitives';
 import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId, type WebAuthnCredentialIdB64u, type WebAuthnRpId } from './domainIds';
-import type { Variant } from './variant';
+import type { Variant, ReadonlyExclusiveUnion } from './variant';
 export type WalletAuthMethodRevocationProof = {
     readonly kind: 'webauthn_assertion';
     rpId: WebAuthnRpId;
@@ -44,19 +44,16 @@ export type WalletAuthMethodRecord = {
     credentialPublicKeyB64u?: never;
     counter?: never;
 };
-type WalletAuthMethodLifecycleV1 = {
+type WalletAuthMethodLifecycleV1 = ReadonlyExclusiveUnion<{
     readonly status: 'pending_local_install';
-    readonly activatedAtMs?: never;
-    readonly revokedAtMs?: never;
 } | {
     readonly status: 'active';
     readonly activatedAtMs: number;
-    readonly revokedAtMs?: never;
 } | {
     readonly status: 'revoked';
     readonly activatedAtMs: number;
     readonly revokedAtMs: number;
-};
+}>;
 type WalletAuthMethodDraftCommonV1 = {
     readonly walletAuthMethodId: WalletAuthMethodId;
     readonly walletId: WalletId;

package/dist/types/shared-ts/src/utils/walletCapabilityBindings.d.ts

@@ -74,7 +74,6 @@ export declare function buildEmailOtpWalletAuthMethodBinding(args: {
     emailHashHex: string;
     registrationAuthorityId: string;
 }): WalletAuthMethodBinding;
-export declare function walletAuthMethodBindingId(binding: WalletAuthMethodBinding): WalletAuthMethodId;
 export declare function walletAuthMethodBindingFromRaw(raw: unknown): WalletCapabilityBindingParseResult<WalletAuthMethodBinding>;
 export declare function buildNoCurrentWalletAuthMethod(): Extract<CurrentWalletAuthMethod, {
     kind: 'none';

package/dist/types/shared-ts/src/utils/walletManagementProtocol.d.ts

@@ -0,0 +1,3 @@
+export declare const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
+export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "2";
+//# sourceMappingURL=walletManagementProtocol.d.ts.map

package/dist/types/shared-ts/src/utils/webauthnDeviceInfo.d.ts

@@ -10,8 +10,8 @@
  * Stored on the authenticator row and returned by the authenticators listing
  * so profile UIs can label signers ("Chrome on macOS", "iCloud Keychain").
  */
-type WebAuthnDeviceBrowser = 'chrome' | 'safari' | 'firefox' | 'edge' | 'other';
-type WebAuthnDeviceOs = 'macos' | 'ios' | 'windows' | 'android' | 'linux' | 'other';
+type WebAuthnDeviceBrowser = (typeof WEBAUTHN_DEVICE_BROWSERS)[number];
+type WebAuthnDeviceOs = (typeof WEBAUTHN_DEVICE_OSES)[number];
 export type WebAuthnAuthenticatorDeviceInfo = {
     /** Display-ready label, e.g. "Chrome on macOS". Never empty. */
     label: string;
@@ -26,6 +26,8 @@ export type WebAuthnAuthenticatorDeviceInfo = {
     /** Display name for the provider, e.g. "iCloud Keychain". */
     providerLabel?: string;
 };
+declare const WEBAUTHN_DEVICE_BROWSERS: readonly ["chrome", "safari", "firefox", "edge", "other"];
+declare const WEBAUTHN_DEVICE_OSES: readonly ["macos", "ios", "windows", "android", "linux", "other"];
 export declare function deriveWebAuthnAuthenticatorDeviceInfo(input: {
     userAgent?: string;
     aaguid?: string;

package/dist/types/shared-ts/src/utils/wireSchema.d.ts

@@ -50,8 +50,6 @@ export declare function wireUnion<K extends string, V extends WireParser<unknown
 }>(tag: K, variants: readonly V[]): WireParser<WireType<V>>;
 /** `null`, or a value `parse` accepts. */
 export declare function wireNullable<T>(parse: WireParser<T>): WireParser<T | null>;
-/** A non-empty array of `item`; `refine` checks rules that span the items. */
-export declare function wireNonEmptyArray<T>(item: WireParser<T>, refine?: (items: readonly [T, ...T[]], label: string) => void): WireParser<readonly [T, ...T[]]>;
 /** Adapts a parser that returns a result, putting the field's label before its error. */
 export declare function wireResult<T>(parse: (raw: unknown) => ParseResult<T>): WireParser<T>;
 /** Adapts a parser that throws, putting the field's label before its error. */

package/dist/types/shared-ts/src/wallet-recovery/backupAcknowledgement.d.ts

@@ -32,7 +32,6 @@ type WalletRecoveryBackupAcknowledgementParseResult = {
     readonly record: WalletRecoveryBackupAcknowledgementV1;
 } | {
     readonly ok: false;
-    readonly reason: string;
 };
 export declare function parseWalletRecoveryBackupAcknowledgementV1(raw: unknown, options: {
     readonly expectedWalletId: string;

package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeReservation.d.ts

@@ -29,7 +29,7 @@ type RecoveryCodeTransitionResult = {
     code: RecoveryCodeTransitionRejection;
     message: string;
 };
-export type RecoveryCodeTransitionRejection = 'already_consumed' | 'revoked' | 'already_reserved' | 'not_reserved' | 'reservation_expired' | 'reservation_mismatch';
+type RecoveryCodeTransitionRejection = 'already_consumed' | 'revoked' | 'already_reserved' | 'not_reserved' | 'reservation_expired' | 'reservation_mismatch';
 export declare function parseRecoveryCodeReservationId(value: unknown): RecoveryCodeReservationId;
 /**
  * Places a hold on an active code.
@@ -44,15 +44,6 @@ export declare function reserveRecoveryCode(args: {
     nowMs: number;
     reservationTtlMs: number;
 }): RecoveryCodeTransitionResult;
-/**
- * Releases a hold after a failed pre-commit recovery, returning the code to the
- * active pool. Releasing a consumed code is refused: consumption is terminal
- * and a post-commit failure must not hand the code back.
- */
-export declare function releaseRecoveryCodeReservation(args: {
-    lifecycle: RecoveryCodeLifecycleState;
-    reservationId: RecoveryCodeReservationId;
-}): RecoveryCodeTransitionResult;
 /**
  * Consumes a reserved code once every required activation receipt has verified.
  *

package/dist/types/shared-ts/src/wallet-recovery/recoveryCodes.d.ts

@@ -1,11 +1,9 @@
 export { EMAIL_OTP_RECOVERY_KEY_ALPHABET as WALLET_RECOVERY_CODE_ALPHABET, EMAIL_OTP_RECOVERY_KEY_BYTE_LENGTH as WALLET_RECOVERY_CODE_BYTE_LENGTH, EMAIL_OTP_RECOVERY_KEY_CHAR_LENGTH as WALLET_RECOVERY_CODE_CHAR_LENGTH, EMAIL_OTP_RECOVERY_KEY_COUNT as WALLET_RECOVERY_CODE_COUNT, EMAIL_OTP_RECOVERY_KEY_GROUP_COUNT as WALLET_RECOVERY_CODE_GROUP_COUNT, EMAIL_OTP_RECOVERY_KEY_GROUP_LENGTH as WALLET_RECOVERY_CODE_GROUP_LENGTH, buildEmailOtpRecoveryCodeSet as buildWalletRecoveryCodeSet, decodeEmailOtpRecoveryKey as decodeWalletRecoveryCode, formatEmailOtpRecoveryKey as formatWalletRecoveryCode, normalizeEmailOtpRecoveryKey as normalizeWalletRecoveryCode, } from '../utils/emailOtpRecoveryKey';
 export type { EmailOtpRecoveryCode as WalletRecoveryCode, EmailOtpRecoveryCodeSet as WalletRecoveryCodeSet, } from '../utils/emailOtpRecoveryKey';
-export { deriveWalletRecoveryKeyId, deriveWalletRecoveryKeyIdFromBytes, isDerivedWalletRecoveryKeyId, parseDerivedWalletRecoveryKeyId, WALLET_RECOVERY_KEY_ID_PREFIX_V1, } from './recoveryKeyId';
+export { deriveWalletRecoveryKeyIdFromBytes, parseDerivedWalletRecoveryKeyId, WALLET_RECOVERY_KEY_ID_PREFIX_V1, } from './recoveryKeyId';
 export type { DerivedWalletRecoveryKeyId } from './recoveryKeyId';
 export { issueWalletRecoveryCodes, zeroizeIssuedWalletRecoveryCodes } from './recoveryCodeIssuance';
 export type { IssuedWalletRecoveryCodes } from './recoveryCodeIssuance';
-export { runWalletRecoveryWithCode } from './recoveryCodeAttempt';
-export type { WalletRecoveryActivationResult, WalletRecoveryAttemptOutcome, } from './recoveryCodeAttempt';
 export { buildWalletRecoveryBackupAcknowledgementV1, parseWalletRecoveryBackupAcknowledgementV1, walletRecoveryBackupIsOutstanding, } from './backupAcknowledgement';
 export type { WalletRecoveryBackupAcknowledgementV1 } from './backupAcknowledgement';
 //# sourceMappingURL=recoveryCodes.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/recoveryEnvelopes.d.ts

@@ -1,4 +1,5 @@
 import type { RecoveryCodeReservationId } from './recoveryCodeReservation';
+import type { ExclusiveUnion } from '../utils/variant';
 /**
  * Lifecycle of one recovery code.
  *
@@ -6,37 +7,23 @@ import type { RecoveryCodeReservationId } from './recoveryCodeReservation';
  * commits only after the replacement credential activates. See
  * `recoveryCodeReservation.ts` for the transitions between these states.
  */
-export type RecoveryCodeLifecycleState = {
+export type RecoveryCodeLifecycleState = ExclusiveUnion<{
     state: 'active';
     issuedAtMs: number;
-    reservationId?: never;
-    reservedAtMs?: never;
-    reservationExpiresAtMs?: never;
-    consumedAtMs?: never;
-    revokedAtMs?: never;
 } | {
     state: 'reserved';
     issuedAtMs: number;
     reservationId: RecoveryCodeReservationId;
     reservedAtMs: number;
     reservationExpiresAtMs: number;
-    consumedAtMs?: never;
-    revokedAtMs?: never;
 } | {
     state: 'consumed';
     issuedAtMs: number;
     reservationId: RecoveryCodeReservationId;
     consumedAtMs: number;
-    reservedAtMs?: never;
-    reservationExpiresAtMs?: never;
-    revokedAtMs?: never;
 } | {
     state: 'revoked';
     issuedAtMs: number;
     revokedAtMs: number;
-    reservationId?: never;
-    reservedAtMs?: never;
-    reservationExpiresAtMs?: never;
-    consumedAtMs?: never;
-};
+}>;
 //# sourceMappingURL=recoveryEnvelopes.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/recoveryKeyId.d.ts

@@ -1,9 +1,9 @@
 /**
  * The identity of one recovery code inside a wallet's custody set.
  *
- * **Wallet-scoped, and factor-neutral on purpose.** The Email OTP id it
- * replaces (`deriveEmailOtpRecoveryKeyId`) puts `enrollmentVersion` and
- * `enrollmentSealKeyVersion` in its tuple, so it cannot mint an id for a
+ * **Wallet-scoped, and factor-neutral on purpose.** The tuple holds the code,
+ * the wallet id and the set version, and no Email OTP enrollment field
+ * (`enrollmentVersion`, `enrollmentSealKeyVersion`), so it can mint an id for a
  * passkey wallet — which has no enrollment at all. A wallet custody recovery
  * set belongs to the wallet, not to whichever factor happened to establish it,
  * exactly as the seed and the continuity cache do.
@@ -25,29 +25,13 @@ export type DerivedWalletRecoveryKeyId = string & {
 };
 export declare const WALLET_RECOVERY_KEY_ID_PREFIX_V1: "wallet-rkid-v1-";
 export declare function parseDerivedWalletRecoveryKeyId(value: unknown, label?: string): DerivedWalletRecoveryKeyId;
-export declare function isDerivedWalletRecoveryKeyId(value: unknown): value is DerivedWalletRecoveryKeyId;
 /**
- * Derives one code's id within a wallet's recovery set.
+ * Derives one code's id within a wallet's recovery set, from the decoded code
+ * bytes the ceremony already holds.
  *
  * Bound to the wallet and the set version, so the same code typed against a
  * different wallet produces a different id and finds no wrap. Length-delimited
  * fields under a fixed context, so no two inputs encode alike.
- *
- * The decoded code bytes are zeroized before returning, including on failure —
- * the code is the factor that opens the seed, and it must not outlive this
- * call in a buffer the caller cannot see.
- */
-export declare function deriveWalletRecoveryKeyId(args: {
-    readonly recoveryCode: string;
-    readonly walletId: string;
-    readonly setVersion?: string;
-}): Promise<DerivedWalletRecoveryKeyId>;
-/**
- * The same derivation from decoded bytes.
- *
- * Separate entry point because the ceremony seals wraps from bytes it already
- * holds, while a user typing a code arrives as a string. Both must reach one
- * id, so both go through this.
  */
 export declare function deriveWalletRecoveryKeyIdFromBytes(args: {
     readonly codeBytes: Uint8Array;

package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryPreparation.d.ts

@@ -0,0 +1,15 @@
+import type { RuntimePolicyScope } from '../threshold/signingRootScope';
+import type { RouterAbEd25519YaoApplicationBindingFactsV1, RouterAbEd25519YaoBytes32V1, RouterAbEd25519YaoLifecycleScopeV1 } from '../utils/routerAbEd25519Yao';
+export type WalletRecoveryPreparationNearRecoveryBasisV1 = {
+    readonly capabilityKind: 'registration' | 'recovery';
+    readonly activeCapabilityBinding: RouterAbEd25519YaoBytes32V1;
+    readonly scope: RouterAbEd25519YaoLifecycleScopeV1;
+    readonly applicationBinding: RouterAbEd25519YaoApplicationBindingFactsV1;
+    readonly participantIds: readonly [number, number];
+    readonly registeredPublicKey: RouterAbEd25519YaoBytes32V1;
+    readonly runtimePolicyScope: RuntimePolicyScope;
+    readonly activationTranscript: RouterAbEd25519YaoBytes32V1;
+    readonly activationStateEpoch: number;
+    readonly signingWorkerVerifyingShare: RouterAbEd25519YaoBytes32V1;
+};
+//# sourceMappingURL=walletRecoveryPreparation.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/walletRecoveryTarget.d.ts

@@ -1,12 +1,11 @@
 import { type WebAuthnRpId } from '../utils/domainIds';
-export type WalletRecoveryTargetV1 = {
+import type { ReadonlyExclusiveUnion } from '../utils/variant';
+export type WalletRecoveryTargetV1 = ReadonlyExclusiveUnion<{
     readonly kind: 'passkey';
     readonly rpId: WebAuthnRpId;
-    readonly googleProvider?: never;
 } | {
     readonly kind: 'google_email_otp';
     readonly googleProvider: 'google';
-    readonly rpId?: never;
-};
+}>;
 export declare function parseWalletRecoveryTargetV1(raw: unknown): WalletRecoveryTargetV1;
 //# sourceMappingURL=walletRecoveryTarget.d.ts.map

package/dist/types/wallet/build-paths.d.ts

@@ -13,13 +13,12 @@ export declare const BUILD_PATHS: {
         readonly WASM_SIGNER: "../../wasm/near_signer";
         readonly ED25519_YAO_CLIENT: "../../crates/router-ab-ed25519-yao-client";
         readonly WASM_ECDSA_CLIENT: "../../wasm/router_ab_ecdsa_client";
-        readonly WASM_ECDSA_SIGNING_WORKER: "../../wasm/router_ab_ecdsa_signing_worker";
         readonly WASM_EVM_CRYPTO: "../../wasm/evm_crypto";
         readonly WASM_TEMPO_SIGNER: "../../wasm/tempo_signer";
         readonly WASM_SHAMIR3PASS_RUNTIME: "../../wasm/shamir3pass_runtime";
         readonly WASM_EMAIL_OTP_RUNTIME: "../../wasm/email_otp_runtime";
         readonly WASM_WALLET_CUSTODY_CEREMONY: "../../wasm/wallet_custody_ceremony";
-        readonly CRITICAL_DIRS: readonly ["src/core", "src/react", "src/static", "src/utils", "../wallet-server/src", "../shared-ts/src", "../../crates/router-ab-ed25519-yao-client", "../../wasm/near_signer", "../../wasm/router_ab_ecdsa_client", "../../wasm/router_ab_ecdsa_signing_worker", "../../wasm/evm_crypto", "../../wasm/tempo_signer", "../../wasm/shamir3pass_runtime", "../../wasm/email_otp_runtime", "../../wasm/wallet_custody_ceremony"];
+        readonly CRITICAL_DIRS: readonly ["src/core", "src/react", "src/static", "src/utils", "../wallet-server/src", "../shared-ts/src", "../../crates/router-ab-ed25519-yao-client", "../../wasm/near_signer", "../../wasm/router_ab_ecdsa_client", "../../wasm/evm_crypto", "../../wasm/tempo_signer", "../../wasm/shamir3pass_runtime", "../../wasm/email_otp_runtime", "../../wasm/wallet_custody_ceremony"];
     };
     readonly RUNTIME: {
         readonly SDK_BASE: "/sdk";

package/dist/types/wallet/src/SeamsWeb/SeamsWeb.d.ts

@@ -63,6 +63,8 @@ export declare class SeamsWeb {
      */
     initWalletIframe(walletId?: string): Promise<WalletIframeExactSessionState>;
     getWalletIframeExactSessionState(): Promise<WalletIframeExactSessionState>;
+    /** @internal One wallet-host restore owns all configured-chain prefills. */
+    prefillRestoredWalletSession(state: WalletIframeExactSessionState): Promise<void>;
     openHostedAuthMenu(request: HostedAuthMenuOpenRequest, anchorElement?: HTMLElement): Promise<HostedAuthMenuOutcome>;
     cancelHostedAuthMenu(args: {
         authMenuSessionId: HostedAuthMenuSessionId;

package/dist/types/wallet/src/SeamsWeb/operations/auth/scheduleLinkedDevicePresignaturePrefill.d.ts

@@ -0,0 +1,11 @@
+import type { WalletSessionOperationCredentialV1 } from '../../../../../shared-ts/src/device-linking';
+import { type LinkedEcdsaHolderRuntimeV1 } from '../../../core/signingEngine/session/material/linkedEcdsaHolderRuntime';
+import type { WorkerOperationContext } from '../../../core/signingEngine/workerManager/executeWorkerOperation';
+export declare function scheduleLinkedDevicePresignaturePrefill(args: {
+    runtime: LinkedEcdsaHolderRuntimeV1;
+    operationCredential: WalletSessionOperationCredentialV1;
+    expiresAtMs: number;
+    relayerUrl: string;
+    workerCtx: WorkerOperationContext;
+}): Promise<void>;
+//# sourceMappingURL=scheduleLinkedDevicePresignaturePrefill.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/auth/walletAuth.d.ts

@@ -1,3 +1,4 @@
+import type { WalletSessionStatusReadScope } from '../../../core/rpcClients/relayer/walletSessionAuthorizationStatus';
 import type { NearClient } from '../../../core/rpcClients/near/NearClient';
 import type { RouterAbEcdsaDerivationLoginPresignaturePrefillResult } from '../../../core/signingEngine/session/warmCapabilities/ecdsaLoginPrefill';
 import type { ThresholdEcdsaChainTarget } from '../../../core/signingEngine/interfaces/ecdsaChainTarget';
@@ -50,6 +51,6 @@ export declare function prefillRouterAbEcdsaDerivationPresignaturePoolDomain(dep
     walletSession: WalletSessionRef;
     chainTarget: ThresholdEcdsaChainTarget;
     waitForPoolReady?: boolean;
-}): Promise<RouterAbEcdsaDerivationLoginPresignaturePrefillResult>;
+}, statusReads: WalletSessionStatusReadScope): Promise<RouterAbEcdsaDerivationLoginPresignaturePrefillResult>;
 export {};
 //# sourceMappingURL=walletAuth.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/auth/walletUnlockEcdsaSubject.d.ts

@@ -1,7 +1,7 @@
 import type { EcdsaWalletActivationSelectorListResult } from '../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestLookups';
 import type { EvmFamilyEcdsaWalletUnlockSubject } from '../../../core/signingEngine/session/identity/walletUnlockSubject';
 import { type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
-export type { EvmFamilyEcdsaWalletUnlockSubject, EvmFamilyEcdsaWalletUnlockSubjectSet, } from '../../../core/signingEngine/session/identity/walletUnlockSubject';
+export type { EvmFamilyEcdsaWalletUnlockSubject } from '../../../core/signingEngine/session/identity/walletUnlockSubject';
 export type WalletUnlockCapabilitySubjectResolutionFailure = 'capability_subject_lookup_failed' | 'invalid_capability_subject';
 export declare function resolveEvmFamilyEcdsaWalletUnlockSubjects(walletId: WalletId): Promise<{
     readonly kind: 'resolved';

package/dist/types/wallet/src/SeamsWeb/operations/auth/walletUnlockSubject.d.ts

@@ -1,6 +1,7 @@
 import { type WalletId } from '../../../core/signingEngine/interfaces/ecdsaChainTarget';
 import { type WalletUnlockCapabilitySubjectResolutionFailure } from './walletUnlockEcdsaSubject';
 import type { WalletUnlockSubjectSet } from '../../../core/signingEngine/session/identity/walletUnlockSubject';
+import type { ExclusiveUnion } from '../../../../../shared-ts/src/utils/variant';
 export type { NearEd25519WalletUnlockSubject, WalletUnlockSubject, WalletUnlockSubjectSet, } from '../../../core/signingEngine/session/identity/walletUnlockSubject';
 export type WalletUnlockCapabilityFamilyScope = {
     readonly kind: 'near_ed25519_only';
@@ -14,53 +15,35 @@ type WalletUnlockSubjectSetResolution = {
     readonly subjectSet: WalletUnlockSubjectSet;
 } | {
     readonly kind: 'missing_requested_capability_subject';
-    readonly walletId: WalletId;
     readonly subjectSet?: never;
     readonly reason?: never;
 } | {
     readonly kind: 'capability_subject_resolution_failed';
-    readonly walletId: WalletId;
     readonly reason: WalletUnlockCapabilitySubjectResolutionFailure;
     readonly subjectSet?: never;
 };
 type WalletIdentitySource = 'profile_projection' | 'host_last_used_profile' | 'local_wallet_authority';
 type WalletIdentityResolveFailure = 'missing_wallet_profile' | 'ambiguous_wallet_profile' | 'missing_requested_capability_subject' | WalletUnlockCapabilitySubjectResolutionFailure | 'invalid_wallet_profile';
-export type WalletCapabilitySubjectResolution = {
+export type WalletCapabilitySubjectResolution = ExclusiveUnion<{
     kind: 'no_session_request';
-    walletId?: never;
-    profileId?: never;
-    subjectSet?: never;
-    source?: never;
-    reason?: never;
 } | {
     kind: 'resolved';
     walletId: WalletId;
-    profileId?: never;
     subjectSet: WalletUnlockSubjectSet;
     source: WalletIdentitySource;
-    reason?: never;
 } | {
     kind: 'no_session_for_wallet';
     walletId: WalletId;
-    profileId?: never;
     reason: 'missing_requested_capability_subject';
-    source: WalletIdentitySource;
-    subjectSet?: never;
 } | {
     kind: 'unresolvable';
     walletId: WalletId;
-    profileId?: never;
     reason: WalletIdentityResolveFailure;
-    subjectSet?: never;
-    source?: never;
 } | {
     kind: 'unresolvable_profile';
     profileId: string;
-    walletId?: never;
     reason: WalletIdentityResolveFailure;
-    subjectSet?: never;
-    source?: never;
-};
+}>;
 export declare function resolveWalletUnlockSubjectSet(args: {
     readonly walletId: string;
     readonly requestedCapabilityFamilies: WalletUnlockCapabilityFamilyScope;

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/emailOtp/challenge.d.ts

@@ -7,12 +7,8 @@ export type FetchLike = typeof fetch;
 export type { EmailOtpEnrollmentResult, WalletEmailOtpChannel };
 export { EMAIL_OTP_CHANNEL };
 type JsonObject = Record<string, unknown>;
-export declare function parseEmailOtpEnrollmentResult(value: unknown): EmailOtpEnrollmentResult;
 export declare function readString(value: unknown, label: string): string;
 export declare function readOptionalString(value: unknown): string | undefined;
-export declare function zeroizeBytes(bytes?: Uint8Array | null): void;
-export declare function requireWorkerCtx(workerCtx?: WorkerOperationContext): WorkerOperationContext;
-export declare function cloneFixed32Bytes(value: Uint8Array, label: string): Uint8Array;
 export declare function buildWorkerEmailOtpRoutePlan(args: {
     routeFamily: Extract<EmailOtpRouteFamily, 'login' | 'registration'>;
     operation?: WalletEmailOtpLoginOperation;

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/emailOtp/walletActivation.d.ts

@@ -5,6 +5,7 @@ import type { NearEd25519SignerBinding } from '../../../../../../shared-ts/src/u
 import type { WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { EmailOtpVerifiedAuthorityProjection } from '../../../../core/signingEngine/session/emailOtp/publicTypes';
 import { type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export declare function persistVerifiedEmailOtpAuthorityAfterUnlock(args: {
     readonly walletId: string;
     readonly walletAuthMethodId: string;
@@ -17,17 +18,15 @@ export declare function walletAuthAuthorityRefForVerifiedEmailOtpUnlock(args: {
     readonly emailHashHex: string;
     readonly projection: EmailOtpVerifiedAuthorityProjection;
 }): Promise<WalletAuthAuthorityRef>;
-export type EmailOtpWalletPostUnlockActivation = {
+export type EmailOtpWalletPostUnlockActivation = ExclusiveUnion<{
     kind: 'near_ed25519_wallet';
     signer: NearEd25519SignerBinding;
     walletAuthMethodId: WalletAuthMethodId;
-    walletId?: never;
 } | {
     kind: 'evm_family_ecdsa_wallet';
     walletId: WalletId;
     walletAuthMethodId: WalletAuthMethodId;
-    signer?: never;
-};
+}>;
 export type EmailOtpWalletPostUnlockActivationDeps = {
     signingEngine: {
         setWalletAuthenticated(args: {

package/dist/types/wallet/src/SeamsWeb/operations/devices/deviceLinkingAuthorityInstallation.d.ts

@@ -1,20 +1,12 @@
 import type { ActivateInstalledAuthorityResultV1, CommittedAuthorityPackagesV1, LinkSessionStateV1, LinkedAuthorityActivationResultV1, LocalAuthorityActivationFinalAckV1, LocalAuthorityInstallationReceiptV1, WalletSessionOperationCredentialV1, VerifiedTargetFactorV1 } from '../../../../../shared-ts/src/device-linking';
-import { parseDigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { LinkDeviceSessionId } from '../../../../../shared-ts/src/signing-lanes/ids';
-import type { WalletAuthorityExportRootRecordV1, WalletAuthoritySignerMaterialRecordV1 } from '../../../core/indexedDB';
 import type { UnifiedIndexedDBManager } from '../../../core/indexedDB';
+import type { SealedLocalAuthorityMaterialSetV1 } from '../../../core/signingEngine/workerManager/deviceLinkingPorts';
 import type { DeviceLinkingAuthorityActivationTransportPortV1, DeviceLinkingKeyMaterialHandleV1, DeviceLinkingKeyMaterialPortV1 } from './deviceLinkingPorts';
 import type { DeviceLinkingResealedEd25519ExportRootV1 } from './deviceLinkingEd25519ExportRoot';
 import { type DeviceLinkingCommittedResumeV1 } from './deviceLinkingResume';
 export { replayPendingDeviceLinkingAcknowledgementsV1, type DeviceLinkingDurableAcknowledgementReplayResultV1, } from './deviceLinkingResume';
-export type DeviceLinkingSealedAuthorityRecordsV1 = {
-    readonly signerMaterials: readonly [
-        WalletAuthoritySignerMaterialRecordV1,
-        ...WalletAuthoritySignerMaterialRecordV1[]
-    ];
-    readonly exportRoot: WalletAuthorityExportRootRecordV1 | null;
-    readonly installedRecordSetDigestB64u: ReturnType<typeof parseDigestB64u>;
-};
+export type DeviceLinkingSealedAuthorityRecordsV1 = SealedLocalAuthorityMaterialSetV1;
 /**
  * The worker owns package decryption and factor sealing. The browser receives
  * only already-sealed persistence records at this boundary.

package/dist/types/wallet/src/SeamsWeb/operations/devices/deviceLinkingResume.d.ts

@@ -55,7 +55,6 @@ export type DeviceLinkingDurableAcknowledgementReplayResultV1 = {
     readonly kind: 'none';
 } | {
     readonly kind: 'replayed';
-    readonly count: number;
 };
 /**
  * Bootstrap recovery for a page reload or a lost recipient worker handle.