@seams/wallet 0.7.3 → 0.8.0

package/dist/types/shared-ts/src/threshold/keyMaterialBrands.d.ts

@@ -1,25 +1,15 @@
-import type { EcdsaThresholdKeyId } from './ecdsaDerivationRoleLocalBootstrap';
 export type Brand<T, Name extends string> = T & {
     readonly __brand: Name;
 };
-export type EcdsaDerivationKeyVersion = Brand<string, 'EcdsaDerivationKeyVersion'>;
 export type SigningSessionSealKeyVersion = Brand<string, 'SigningSessionSealKeyVersion'>;
 export type EcdsaClientVerifyingShareB64u = Brand<string, 'EcdsaClientVerifyingShareB64u'>;
-export type Ed25519RelayerKeyId = Brand<string, 'Ed25519RelayerKeyId'>;
 export type EcdsaRelayerKeyId = Brand<string, 'EcdsaRelayerKeyId'>;
 export type EcdsaKeyHandle = Brand<string, 'EcdsaKeyHandle'>;
 export declare function parseNonEmptyBrand<T extends string>(value: unknown, label: string): Brand<string, T>;
-export declare function parseEcdsaDerivationKeyVersion(value: unknown): EcdsaDerivationKeyVersion;
 export declare function parseSigningSessionSealKeyVersion(value: unknown): SigningSessionSealKeyVersion;
 export declare function parseEcdsaClientVerifyingShareB64u(value: unknown): EcdsaClientVerifyingShareB64u;
-export declare function parseEd25519RelayerKeyId(value: unknown): Ed25519RelayerKeyId;
 export declare function parseEcdsaRelayerKeyId(value: unknown): EcdsaRelayerKeyId;
 export declare function parseEcdsaKeyHandle(value: unknown): EcdsaKeyHandle;
-export declare function formatEcdsaDerivationKeyVersionForWire(value: EcdsaDerivationKeyVersion): string;
 export declare function formatSigningSessionSealKeyVersionForWire(value: SigningSessionSealKeyVersion): string;
-export declare function formatEcdsaClientVerifyingShareB64uForWire(value: EcdsaClientVerifyingShareB64u): string;
-export declare function formatEd25519RelayerKeyIdForWire(value: Ed25519RelayerKeyId): string;
-export declare function formatEcdsaRelayerKeyIdForWire(value: EcdsaRelayerKeyId): string;
-export declare function formatEcdsaThresholdKeyIdForWire(value: EcdsaThresholdKeyId): string;
 export declare function formatEcdsaKeyHandleForWire(value: EcdsaKeyHandle): string;
 //# sourceMappingURL=keyMaterialBrands.d.ts.map

package/dist/types/shared-ts/src/threshold/participants.d.ts

@@ -8,7 +8,7 @@ export declare const THRESHOLD_ED25519_2P_PARTICIPANT_IDS: readonly [1, 2];
  */
 type ThresholdEd25519ShareDerivation = 'prf_first_v1' | 'derived_master_secret_v1' | 'kv_random_v1' | 'unknown';
 export interface ThresholdEd25519ParticipantV1 {
-    /** FROST identifier (1-indexed). */
+    /** Participant identifier (1-indexed). */
     id: number;
     role: ThresholdParticipantRole;
     /** Optional relayer endpoint for this participant (future multi-relayer support). */

package/dist/types/shared-ts/src/utils/addWalletAuthMethod.d.ts

@@ -11,17 +11,8 @@
  * an attempt to add a family the authority already has is resolved as
  * `already_configured` at admission — before any target verification or local
  * write — rather than travelling through the operation as a rejected case.
- *
- * Every identity a branch depends on is required and branded. The raw wire and
- * storage values are parsed once by {@link parseAddWalletAuthMethodSourceV1}
- * and {@link parseAddWalletAuthMethodIntentIdentityV1} at their boundary; core
- * code below them receives branded identities and one verified branch, and
- * never compares raw identity strings.
  */
-import type { DeviceId, WalletSessionId } from '../authorization/capabilityKinds';
-import type { DigestB64u } from './canonicalPrimitives';
-import { type WalletAuthMethodId, type WalletAuthorityId, type WalletId } from './domainIds';
-import type { ActiveWalletAuthMethodRecordV2, EmailOtpWalletAuthMethodDraftV1, PasskeyWalletAuthMethodDraftV1 } from './walletAuthMethodRecord';
+import type { ActiveWalletAuthMethodRecordV2 } from './walletAuthMethodRecord';
 import type { WalletAuthMethod } from './signerDomain';
 /**
  * The factor family a method belongs to.
@@ -40,120 +31,6 @@ export type WalletAuthMethodFamilyV1 = WalletAuthMethod;
  * target.
  */
 export type AddWalletAuthMethodBranchV1 = 'passkey_to_email_otp' | 'email_otp_to_passkey';
-/**
- * A validated authority generation. Branding it stops a revocation epoch from
- * being read as any other integer on the authority — a signer slot, a counter,
- * a timestamp — at the boundaries where all of them arrive as bare numbers.
- */
-type WalletAuthorityRevocationEpochV1 = number & {
-    readonly __walletAuthorityRevocationEpochBrand: 'WalletAuthorityRevocationEpochV1';
-};
-/**
- * One server-allocated addition ceremony. The server mints it, binds the
- * target method ID to it, and a client request can neither nominate nor
- * substitute one.
- */
-type AddWalletAuthMethodCeremonyIdV1 = string & {
-    readonly __addWalletAuthMethodCeremonyIdBrand: 'AddWalletAuthMethodCeremonyIdV1';
-};
-/**
- * Everything the active Wallet Session names about the source.
- *
- * The caller supplies none of it: the selected session names the exact source
- * method, and the server resolves the wallet, authority, device, digest, and
- * epoch from that method. Each field is required, so a branch cannot be built
- * from a partially resolved session.
- */
-export type AddWalletAuthMethodSourceV1 = {
-    readonly walletId: WalletId;
-    readonly walletAuthorityId: WalletAuthorityId;
-    readonly sourceWalletAuthMethodId: WalletAuthMethodId;
-    readonly sourceWalletSessionId: WalletSessionId;
-    readonly deviceId: DeviceId;
-    readonly authorityDigestB64u: DigestB64u;
-    readonly revocationEpoch: WalletAuthorityRevocationEpochV1;
-};
-/**
- * The intent identity every stage revalidates against.
- *
- * `targetWalletAuthMethodId` is allocated by the server during preparation and
- * bound into the Passkey creation options or the Email OTP grant, so a retry
- * that reuses this intent converges on the same target method instead of
- * creating a second one.
- */
-export type AddWalletAuthMethodIntentIdentityV1 = {
-    readonly addAuthMethodCeremonyId: AddWalletAuthMethodCeremonyIdV1;
-    readonly intentDigestB64u: DigestB64u;
-    readonly targetWalletAuthMethodId: WalletAuthMethodId;
-    readonly expiresAtMs: number;
-};
-/**
- * Fresh source authorization for this exact intent.
- *
- * Both variants carry the digest they were collected against, which is what
- * binds the proof to one wallet, authority, source method, source session,
- * target method ID, and authority state rather than to the operation kind.
- */
-export type VerifiedAddWalletAuthMethodSourceProofV1 = {
-    readonly kind: 'verified_passkey_source_proof_v1';
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly boundIntentDigestB64u: DigestB64u;
-    readonly verifiedAtMs: number;
-} | {
-    readonly kind: 'verified_email_otp_source_proof_v1';
-    readonly walletAuthMethodId: WalletAuthMethodId;
-    readonly boundIntentDigestB64u: DigestB64u;
-    readonly verifiedAtMs: number;
-};
-/**
- * The independently verified target factor plus its exact draft.
- *
- * A source proof can never appear here: the target is verified on its own
- * evidence — a created credential, or a consumed one-use Email OTP grant — and
- * the two are separate fields on the branch so neither can stand in for the
- * other.
- */
-export type VerifiedAddWalletAuthMethodTargetV1 = {
-    readonly kind: 'verified_passkey_target_v1';
-    readonly authMethod: PasskeyWalletAuthMethodDraftV1;
-    readonly verificationDigestB64u: DigestB64u;
-    readonly verifiedAtMs: number;
-} | {
-    readonly kind: 'verified_email_otp_target_v1';
-    readonly authMethod: EmailOtpWalletAuthMethodDraftV1;
-    readonly verificationDigestB64u: DigestB64u;
-    readonly verifiedAtMs: number;
-};
-type VerifiedPasskeySourceProofV1 = Extract<VerifiedAddWalletAuthMethodSourceProofV1, {
-    readonly kind: 'verified_passkey_source_proof_v1';
-}>;
-type VerifiedEmailOtpSourceProofV1 = Extract<VerifiedAddWalletAuthMethodSourceProofV1, {
-    readonly kind: 'verified_email_otp_source_proof_v1';
-}>;
-type VerifiedPasskeyTargetV1 = Extract<VerifiedAddWalletAuthMethodTargetV1, {
-    readonly kind: 'verified_passkey_target_v1';
-}>;
-type VerifiedEmailOtpTargetV1 = Extract<VerifiedAddWalletAuthMethodTargetV1, {
-    readonly kind: 'verified_email_otp_target_v1';
-}>;
-type AddWalletAuthMethodInputCommonV1 = {
-    readonly source: AddWalletAuthMethodSourceV1;
-    readonly intent: AddWalletAuthMethodIntentIdentityV1;
-};
-/**
- * What core code accepts after verification, and the only shape the activation
- * stage reads. The proof/target pairing is fixed per branch, so a verified
- * Passkey source cannot arrive alongside a verified Passkey target.
- */
-export type VerifiedAddWalletAuthMethodInputV1 = (AddWalletAuthMethodInputCommonV1 & {
-    readonly branch: 'passkey_to_email_otp';
-    readonly sourceProof: VerifiedPasskeySourceProofV1;
-    readonly target: VerifiedEmailOtpTargetV1;
-}) | (AddWalletAuthMethodInputCommonV1 & {
-    readonly branch: 'email_otp_to_passkey';
-    readonly sourceProof: VerifiedEmailOtpSourceProofV1;
-    readonly target: VerifiedPasskeyTargetV1;
-});
 /**
  * Admission: what the operation does before it verifies anything.
  *
@@ -164,17 +41,10 @@ export type VerifiedAddWalletAuthMethodInputV1 = (AddWalletAuthMethodInputCommon
  */
 type AddWalletAuthMethodAdmissionV1 = {
     readonly kind: 'proceed';
-    readonly branch: AddWalletAuthMethodBranchV1;
 } | {
     readonly kind: 'already_configured';
     readonly family: WalletAuthMethodFamilyV1;
-    readonly existingWalletAuthMethodId: WalletAuthMethodId;
 };
-export declare function unreachableAddWalletAuthMethodBranch(value: never): never;
-/** The family a branch fills in. */
-export declare function addWalletAuthMethodTargetFamily(branch: AddWalletAuthMethodBranchV1): WalletAuthMethodFamilyV1;
-/** The family the branch authorizes from. */
-export declare function addWalletAuthMethodSourceFamily(branch: AddWalletAuthMethodBranchV1): WalletAuthMethodFamilyV1;
 /**
  * Resolves the branch from the exact active inventory of one authority.
  *
@@ -188,7 +58,5 @@ export declare function admitAddWalletAuthMethod(input: {
     readonly targetFamily: WalletAuthMethodFamilyV1;
     readonly activeMethodsOnAuthority: readonly ActiveWalletAuthMethodRecordV2[];
 }): AddWalletAuthMethodAdmissionV1;
-export declare function parseWalletAuthorityRevocationEpochV1(value: unknown): WalletAuthorityRevocationEpochV1;
-export declare function parseAddWalletAuthMethodCeremonyIdV1(value: unknown): AddWalletAuthMethodCeremonyIdV1;
 export {};
 //# sourceMappingURL=addWalletAuthMethod.d.ts.map

package/dist/types/shared-ts/src/utils/addWalletAuthMethod.typecheck.d.ts

@@ -2,23 +2,9 @@
  * Compile-time fixtures for the same-device auth-method addition contract.
  *
  * Every `@ts-expect-error` below is a state the contract forbids. If one ever
- * starts compiling, the branch union has been widened — a same-family
- * addition, a mixed target draft, an unverified value, or a cast has become
- * expressible — and this file fails the build rather than the behaviour
- * failing in a browser.
+ * starts compiling, the branch union has been widened — a same-family addition
+ * has become expressible — and this file fails the build rather than the
+ * behaviour failing in a browser.
  */
-import { type AddWalletAuthMethodIntentIdentityV1, type VerifiedAddWalletAuthMethodSourceProofV1, type VerifiedAddWalletAuthMethodTargetV1 } from './addWalletAuthMethod';
-export declare const intent: AddWalletAuthMethodIntentIdentityV1;
-export declare const passkeySourceProof: Extract<VerifiedAddWalletAuthMethodSourceProofV1, {
-    kind: 'verified_passkey_source_proof_v1';
-}>;
-export declare const emailOtpSourceProof: Extract<VerifiedAddWalletAuthMethodSourceProofV1, {
-    kind: 'verified_email_otp_source_proof_v1';
-}>;
-export declare const emailOtpTarget: Extract<VerifiedAddWalletAuthMethodTargetV1, {
-    kind: 'verified_email_otp_target_v1';
-}>;
-export declare const passkeyTarget: Extract<VerifiedAddWalletAuthMethodTargetV1, {
-    kind: 'verified_passkey_target_v1';
-}>;
+export {};
 //# sourceMappingURL=addWalletAuthMethod.typecheck.d.ts.map

package/dist/types/shared-ts/src/utils/domainIds.d.ts

@@ -22,7 +22,6 @@ export type VerifiedEmailAddress = DomainId<'VerifiedEmailAddress'>;
 export type EmailOtpProviderUserId = DomainId<'EmailOtpProviderUserId'>;
 export type ChallengeSubjectId = DomainId<'ChallengeSubjectId'>;
 export type EmailOtpChallengeId = DomainId<'EmailOtpChallengeId'>;
-export type EmailOtpRegistrationAttemptId = DomainId<'EmailOtpRegistrationAttemptId'>;
 export type OrgId = DomainId<'OrgId'>;
 export type WebAuthnRpId = DomainId<'WebAuthnRpId'>;
 export type WebAuthnCredentialIdB64u = DomainId<'WebAuthnCredentialIdB64u'>;
@@ -68,14 +67,9 @@ export type WalletKeyId = DomainId<'WalletKeyId'>;
 export type SigningLaneId = DomainId<'SigningLaneId'>;
 export type LaneShareEpoch = DomainId<'LaneShareEpoch'>;
 export type LinkedDeviceId = DomainId<'LinkedDeviceId'>;
-export type LaneOperationId = DomainId<'LaneOperationId'>;
-export type LaneEnrollmentId = DomainId<'LaneEnrollmentId'>;
-export type LaneOperationIdempotencyKey = DomainId<'LaneOperationIdempotencyKey'>;
 export type LinkedDeviceEnrollmentId = DomainId<'LinkedDeviceEnrollmentId'>;
 export type WalletRecoveryOperationId = DomainId<'WalletRecoveryOperationId'>;
-export type Ed25519YaoSuiteId = DomainId<'Ed25519YaoSuiteId'>;
 export type EcdsaRelayerKeyId = DomainId<'EcdsaRelayerKeyId'>;
-export type LaneHolderRecipientHandleV1 = DomainId<'LaneHolderRecipientHandleV1'>;
 export type LinkDeviceSessionId = DomainId<'LinkDeviceSessionId'>;
 export declare function hasControlCharacter(value: string): boolean;
 export declare function hasWhitespaceOrControlCharacters(value: string): boolean;
@@ -87,7 +81,6 @@ export declare function parseVerifiedEmailAddress(raw: unknown): DomainIdParseRe
 export declare function parseEmailOtpProviderUserId(raw: unknown): DomainIdParseResult<EmailOtpProviderUserId>;
 export declare function parseChallengeSubjectId(raw: unknown): DomainIdParseResult<ChallengeSubjectId>;
 export declare function parseEmailOtpChallengeId(raw: unknown): DomainIdParseResult<EmailOtpChallengeId>;
-export declare function parseEmailOtpRegistrationAttemptId(raw: unknown): DomainIdParseResult<EmailOtpRegistrationAttemptId>;
 export declare function parseOrgId(raw: unknown): DomainIdParseResult<OrgId>;
 export declare function parseWebAuthnRpId(raw: unknown): DomainIdParseResult<WebAuthnRpId>;
 export declare function parseWebAuthnCredentialIdB64u(raw: unknown): DomainIdParseResult<WebAuthnCredentialIdB64u>;
@@ -126,14 +119,9 @@ export declare function parseWalletKeyId(raw: unknown): DomainIdParseResult<Wall
 export declare function parseSigningLaneId(raw: unknown): DomainIdParseResult<SigningLaneId>;
 export declare function parseLaneShareEpoch(raw: unknown): DomainIdParseResult<LaneShareEpoch>;
 export declare function parseLinkedDeviceId(raw: unknown): DomainIdParseResult<LinkedDeviceId>;
-export declare function parseLaneOperationId(raw: unknown): DomainIdParseResult<LaneOperationId>;
-export declare function parseLaneEnrollmentId(raw: unknown): DomainIdParseResult<LaneEnrollmentId>;
-export declare function parseLaneOperationIdempotencyKey(raw: unknown): DomainIdParseResult<LaneOperationIdempotencyKey>;
 export declare function parseLinkedDeviceEnrollmentId(raw: unknown): DomainIdParseResult<LinkedDeviceEnrollmentId>;
 export declare function parseWalletRecoveryOperationId(raw: unknown): DomainIdParseResult<WalletRecoveryOperationId>;
-export declare function parseEd25519YaoSuiteId(raw: unknown): DomainIdParseResult<Ed25519YaoSuiteId>;
 export declare function parseEcdsaRelayerKeyId(raw: unknown): DomainIdParseResult<EcdsaRelayerKeyId>;
-export declare function parseLaneHolderRecipientHandleV1(raw: unknown): DomainIdParseResult<LaneHolderRecipientHandleV1>;
 export declare function parseLinkDeviceSessionId(raw: unknown): DomainIdParseResult<LinkDeviceSessionId>;
 export {};
 //# sourceMappingURL=domainIds.d.ts.map

package/dist/types/shared-ts/src/utils/errors.d.ts

@@ -1,7 +1,3 @@
-/**
- * Centralized error handling utilities for the Passkey SDK
- */
-export { formatNearRpcError, getNearShortErrorMessage } from './near';
 /**
  * Best-effort error message extractor without relying on `any`.
  * Always returns a string (may be empty when nothing usable can be derived).

package/dist/types/shared-ts/src/utils/near.d.ts

@@ -52,26 +52,6 @@ export declare function parseImplicitNearAccountId(raw: unknown): NearAccountIdP
 export declare function parseNamedNearAccountId(raw: unknown): NearAccountIdParseResult<NamedNearAccountId>;
 export declare function parseNearAccountId(raw: unknown): NearAccountIdParseResult<NearAccountId>;
 export declare function deriveImplicitNearAccountIdFromEd25519PublicKey(publicKey: string): ImplicitNearAccountId;
-/**
- * Format a NEAR JSON-RPC error into a concise, human-friendly message while
- * preserving the original error payload on `details`.
- *
- * The function is defensive and only relies on structural checks. It does not
- * require concrete NEAR types to avoid tight coupling with providers.
- */
-export declare function formatNearRpcError(operationName: string, rpc: {
-    error?: {
-        code?: number;
-        name?: string;
-        message?: string;
-        data?: unknown;
-    };
-}): {
-    message: string;
-    code?: number;
-    name?: string;
-    details?: unknown;
-};
 /**
  * Extract a short NEAR error label for UI display, e.g.:
  *   "InvalidTxError: UnsuitableStakingKey"

package/dist/types/shared-ts/src/utils/normalize.d.ts

@@ -48,6 +48,4 @@ export declare function toOriginOrUndefined(input?: string): string | undefined;
  * - Normalizes hostname casing.
  */
 export declare function toRorOriginOrNull(value: unknown): string | null;
-/** Collapse a string into a single line by normalizing whitespace. */
-export declare function toSingleLine(value: unknown): string;
 //# sourceMappingURL=normalize.d.ts.map

package/dist/types/shared-ts/src/utils/registrationSetupOperation.d.ts

@@ -0,0 +1,3 @@
+export declare function parseRegistrationSetupOperationId(value: unknown): string | null;
+export declare function createRegistrationSetupOperationId(): string;
+//# sourceMappingURL=registrationSetupOperation.d.ts.map

package/dist/types/shared-ts/src/utils/validation.d.ts

@@ -1,6 +1,4 @@
-export type { NearAccountValidationOptions } from './near';
-export { ensureEd25519Prefix, validateNearAccountId, isValidAccountId } from './near';
-export { normalizeOptionalString as toOptionalString, normalizeOptionalTrimmedString as toOptionalTrimmedString, normalizeTrimmedString as toTrimmedString, stripTrailingSlashes, ensureLeadingSlash, toBasePath, toOriginOrUndefined, toRorOriginOrNull, toSingleLine, normalizeInteger, normalizePositiveInteger, } from './normalize';
+export { normalizeOptionalString as toOptionalString, normalizeOptionalTrimmedString as toOptionalTrimmedString, normalizeTrimmedString as toTrimmedString, stripTrailingSlashes, ensureLeadingSlash, toBasePath, toOriginOrUndefined, toRorOriginOrNull, normalizeInteger, normalizePositiveInteger, } from './normalize';
 export declare function requireTrimmedString(value: unknown, label: string, message?: string): string;
 export declare function toOptionalTrimmedNonEmptyString(value: unknown): string | undefined;
 export declare function requireNonEmptyString(value: unknown, label: string): string;

package/dist/types/shared-ts/src/utils/walletCapabilityBindings.d.ts

@@ -74,7 +74,6 @@ export declare function buildEmailOtpWalletAuthMethodBinding(args: {
     emailHashHex: string;
     registrationAuthorityId: string;
 }): WalletAuthMethodBinding;
-export declare function walletAuthMethodBindingId(binding: WalletAuthMethodBinding): WalletAuthMethodId;
 export declare function walletAuthMethodBindingFromRaw(raw: unknown): WalletCapabilityBindingParseResult<WalletAuthMethodBinding>;
 export declare function buildNoCurrentWalletAuthMethod(): Extract<CurrentWalletAuthMethod, {
     kind: 'none';

package/dist/types/shared-ts/src/utils/walletManagementProtocol.d.ts

@@ -0,0 +1,3 @@
+export declare const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
+export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "2";
+//# sourceMappingURL=walletManagementProtocol.d.ts.map

package/dist/types/shared-ts/src/utils/wireSchema.d.ts

@@ -50,8 +50,6 @@ export declare function wireUnion<K extends string, V extends WireParser<unknown
 }>(tag: K, variants: readonly V[]): WireParser<WireType<V>>;
 /** `null`, or a value `parse` accepts. */
 export declare function wireNullable<T>(parse: WireParser<T>): WireParser<T | null>;
-/** A non-empty array of `item`; `refine` checks rules that span the items. */
-export declare function wireNonEmptyArray<T>(item: WireParser<T>, refine?: (items: readonly [T, ...T[]], label: string) => void): WireParser<readonly [T, ...T[]]>;
 /** Adapts a parser that returns a result, putting the field's label before its error. */
 export declare function wireResult<T>(parse: (raw: unknown) => ParseResult<T>): WireParser<T>;
 /** Adapts a parser that throws, putting the field's label before its error. */

package/dist/types/shared-ts/src/wallet-recovery/backupAcknowledgement.d.ts

@@ -32,7 +32,6 @@ type WalletRecoveryBackupAcknowledgementParseResult = {
     readonly record: WalletRecoveryBackupAcknowledgementV1;
 } | {
     readonly ok: false;
-    readonly reason: string;
 };
 export declare function parseWalletRecoveryBackupAcknowledgementV1(raw: unknown, options: {
     readonly expectedWalletId: string;

package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeReservation.d.ts

@@ -29,7 +29,7 @@ type RecoveryCodeTransitionResult = {
     code: RecoveryCodeTransitionRejection;
     message: string;
 };
-export type RecoveryCodeTransitionRejection = 'already_consumed' | 'revoked' | 'already_reserved' | 'not_reserved' | 'reservation_expired' | 'reservation_mismatch';
+type RecoveryCodeTransitionRejection = 'already_consumed' | 'revoked' | 'already_reserved' | 'not_reserved' | 'reservation_expired' | 'reservation_mismatch';
 export declare function parseRecoveryCodeReservationId(value: unknown): RecoveryCodeReservationId;
 /**
  * Places a hold on an active code.
@@ -44,15 +44,6 @@ export declare function reserveRecoveryCode(args: {
     nowMs: number;
     reservationTtlMs: number;
 }): RecoveryCodeTransitionResult;
-/**
- * Releases a hold after a failed pre-commit recovery, returning the code to the
- * active pool. Releasing a consumed code is refused: consumption is terminal
- * and a post-commit failure must not hand the code back.
- */
-export declare function releaseRecoveryCodeReservation(args: {
-    lifecycle: RecoveryCodeLifecycleState;
-    reservationId: RecoveryCodeReservationId;
-}): RecoveryCodeTransitionResult;
 /**
  * Consumes a reserved code once every required activation receipt has verified.
  *

package/dist/types/shared-ts/src/wallet-recovery/recoveryCodes.d.ts

@@ -1,11 +1,9 @@
 export { EMAIL_OTP_RECOVERY_KEY_ALPHABET as WALLET_RECOVERY_CODE_ALPHABET, EMAIL_OTP_RECOVERY_KEY_BYTE_LENGTH as WALLET_RECOVERY_CODE_BYTE_LENGTH, EMAIL_OTP_RECOVERY_KEY_CHAR_LENGTH as WALLET_RECOVERY_CODE_CHAR_LENGTH, EMAIL_OTP_RECOVERY_KEY_COUNT as WALLET_RECOVERY_CODE_COUNT, EMAIL_OTP_RECOVERY_KEY_GROUP_COUNT as WALLET_RECOVERY_CODE_GROUP_COUNT, EMAIL_OTP_RECOVERY_KEY_GROUP_LENGTH as WALLET_RECOVERY_CODE_GROUP_LENGTH, buildEmailOtpRecoveryCodeSet as buildWalletRecoveryCodeSet, decodeEmailOtpRecoveryKey as decodeWalletRecoveryCode, formatEmailOtpRecoveryKey as formatWalletRecoveryCode, normalizeEmailOtpRecoveryKey as normalizeWalletRecoveryCode, } from '../utils/emailOtpRecoveryKey';
 export type { EmailOtpRecoveryCode as WalletRecoveryCode, EmailOtpRecoveryCodeSet as WalletRecoveryCodeSet, } from '../utils/emailOtpRecoveryKey';
-export { deriveWalletRecoveryKeyId, deriveWalletRecoveryKeyIdFromBytes, isDerivedWalletRecoveryKeyId, parseDerivedWalletRecoveryKeyId, WALLET_RECOVERY_KEY_ID_PREFIX_V1, } from './recoveryKeyId';
+export { deriveWalletRecoveryKeyIdFromBytes, parseDerivedWalletRecoveryKeyId, WALLET_RECOVERY_KEY_ID_PREFIX_V1, } from './recoveryKeyId';
 export type { DerivedWalletRecoveryKeyId } from './recoveryKeyId';
 export { issueWalletRecoveryCodes, zeroizeIssuedWalletRecoveryCodes } from './recoveryCodeIssuance';
 export type { IssuedWalletRecoveryCodes } from './recoveryCodeIssuance';
-export { runWalletRecoveryWithCode } from './recoveryCodeAttempt';
-export type { WalletRecoveryActivationResult, WalletRecoveryAttemptOutcome, } from './recoveryCodeAttempt';
 export { buildWalletRecoveryBackupAcknowledgementV1, parseWalletRecoveryBackupAcknowledgementV1, walletRecoveryBackupIsOutstanding, } from './backupAcknowledgement';
 export type { WalletRecoveryBackupAcknowledgementV1 } from './backupAcknowledgement';
 //# sourceMappingURL=recoveryCodes.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/recoveryKeyId.d.ts

@@ -1,9 +1,9 @@
 /**
  * The identity of one recovery code inside a wallet's custody set.
  *
- * **Wallet-scoped, and factor-neutral on purpose.** The Email OTP id it
- * replaces (`deriveEmailOtpRecoveryKeyId`) puts `enrollmentVersion` and
- * `enrollmentSealKeyVersion` in its tuple, so it cannot mint an id for a
+ * **Wallet-scoped, and factor-neutral on purpose.** The tuple holds the code,
+ * the wallet id and the set version, and no Email OTP enrollment field
+ * (`enrollmentVersion`, `enrollmentSealKeyVersion`), so it can mint an id for a
  * passkey wallet — which has no enrollment at all. A wallet custody recovery
  * set belongs to the wallet, not to whichever factor happened to establish it,
  * exactly as the seed and the continuity cache do.
@@ -25,29 +25,13 @@ export type DerivedWalletRecoveryKeyId = string & {
 };
 export declare const WALLET_RECOVERY_KEY_ID_PREFIX_V1: "wallet-rkid-v1-";
 export declare function parseDerivedWalletRecoveryKeyId(value: unknown, label?: string): DerivedWalletRecoveryKeyId;
-export declare function isDerivedWalletRecoveryKeyId(value: unknown): value is DerivedWalletRecoveryKeyId;
 /**
- * Derives one code's id within a wallet's recovery set.
+ * Derives one code's id within a wallet's recovery set, from the decoded code
+ * bytes the ceremony already holds.
  *
  * Bound to the wallet and the set version, so the same code typed against a
  * different wallet produces a different id and finds no wrap. Length-delimited
  * fields under a fixed context, so no two inputs encode alike.
- *
- * The decoded code bytes are zeroized before returning, including on failure —
- * the code is the factor that opens the seed, and it must not outlive this
- * call in a buffer the caller cannot see.
- */
-export declare function deriveWalletRecoveryKeyId(args: {
-    readonly recoveryCode: string;
-    readonly walletId: string;
-    readonly setVersion?: string;
-}): Promise<DerivedWalletRecoveryKeyId>;
-/**
- * The same derivation from decoded bytes.
- *
- * Separate entry point because the ceremony seals wraps from bytes it already
- * holds, while a user typing a code arrives as a string. Both must reach one
- * id, so both go through this.
  */
 export declare function deriveWalletRecoveryKeyIdFromBytes(args: {
     readonly codeBytes: Uint8Array;

package/dist/types/wallet/src/SeamsWeb/operations/auth/walletUnlockEcdsaSubject.d.ts

@@ -1,7 +1,7 @@
 import type { EcdsaWalletActivationSelectorListResult } from '../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestLookups';
 import type { EvmFamilyEcdsaWalletUnlockSubject } from '../../../core/signingEngine/session/identity/walletUnlockSubject';
 import { type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
-export type { EvmFamilyEcdsaWalletUnlockSubject, EvmFamilyEcdsaWalletUnlockSubjectSet, } from '../../../core/signingEngine/session/identity/walletUnlockSubject';
+export type { EvmFamilyEcdsaWalletUnlockSubject } from '../../../core/signingEngine/session/identity/walletUnlockSubject';
 export type WalletUnlockCapabilitySubjectResolutionFailure = 'capability_subject_lookup_failed' | 'invalid_capability_subject';
 export declare function resolveEvmFamilyEcdsaWalletUnlockSubjects(walletId: WalletId): Promise<{
     readonly kind: 'resolved';

package/dist/types/wallet/src/SeamsWeb/operations/auth/walletUnlockSubject.d.ts

@@ -15,12 +15,10 @@ type WalletUnlockSubjectSetResolution = {
     readonly subjectSet: WalletUnlockSubjectSet;
 } | {
     readonly kind: 'missing_requested_capability_subject';
-    readonly walletId: WalletId;
     readonly subjectSet?: never;
     readonly reason?: never;
 } | {
     readonly kind: 'capability_subject_resolution_failed';
-    readonly walletId: WalletId;
     readonly reason: WalletUnlockCapabilitySubjectResolutionFailure;
     readonly subjectSet?: never;
 };
@@ -37,7 +35,6 @@ export type WalletCapabilitySubjectResolution = ExclusiveUnion<{
     kind: 'no_session_for_wallet';
     walletId: WalletId;
     reason: 'missing_requested_capability_subject';
-    source: WalletIdentitySource;
 } | {
     kind: 'unresolvable';
     walletId: WalletId;

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/emailOtp/challenge.d.ts

@@ -7,12 +7,8 @@ export type FetchLike = typeof fetch;
 export type { EmailOtpEnrollmentResult, WalletEmailOtpChannel };
 export { EMAIL_OTP_CHANNEL };
 type JsonObject = Record<string, unknown>;
-export declare function parseEmailOtpEnrollmentResult(value: unknown): EmailOtpEnrollmentResult;
 export declare function readString(value: unknown, label: string): string;
 export declare function readOptionalString(value: unknown): string | undefined;
-export declare function zeroizeBytes(bytes?: Uint8Array | null): void;
-export declare function requireWorkerCtx(workerCtx?: WorkerOperationContext): WorkerOperationContext;
-export declare function cloneFixed32Bytes(value: Uint8Array, label: string): Uint8Array;
 export declare function buildWorkerEmailOtpRoutePlan(args: {
     routeFamily: Extract<EmailOtpRouteFamily, 'login' | 'registration'>;
     operation?: WalletEmailOtpLoginOperation;

package/dist/types/wallet/src/SeamsWeb/operations/devices/deviceLinkingResume.d.ts

@@ -55,7 +55,6 @@ export type DeviceLinkingDurableAcknowledgementReplayResultV1 = {
     readonly kind: 'none';
 } | {
     readonly kind: 'replayed';
-    readonly count: number;
 };
 /**
  * Bootstrap recovery for a page reload or a lost recipient worker handle.

package/dist/types/wallet/src/SeamsWeb/operations/devices/linkDeviceFlow.d.ts

@@ -3,6 +3,7 @@ import type { Device2LinkingFlowPortsV1 } from './deviceLinkingPorts';
 import { LinkDeviceEventPhase } from '../../../core/types/sdkSentEvents';
 import { type GetLinkedDeviceAuthenticationContext } from './linkDeviceFlowSupport';
 export declare class LinkDeviceFlow {
+    private pendingActivationCompletion;
     private readonly options;
     private readonly ports;
     private readonly getAuthenticationContext;
@@ -57,6 +58,7 @@ export declare class LinkDeviceFlow {
     private assertTargetPreparationMatchesSession;
     private activateAuthorityForStateV1;
     private finishActiveAuthorityV1;
+    private completeAcknowledgedActivationV1;
     private requireAuthenticatedTransport;
     private requireSessionTargetFactorV1;
     private requireSessionV1;

package/dist/types/wallet/src/SeamsWeb/operations/registration/pendingRegistrationRecovery.d.ts

@@ -4,7 +4,6 @@ import type { PendingWalletRegistrationCommitV1 } from '../../../core/indexedDB'
 import type { PublishPendingWalletRegistrationCommitInputV1, StoreWalletRegistrationPublicationInputV1, StoreWalletRegistrationFinalizeBatchResult } from '../../../core/indexedDB/seamsWalletDB/repositories';
 import { completeWalletRegistrationNearProvisioning, type WalletRegistrationNearProvisioningResponseV2 } from '../../../core/rpcClients/relayer/walletRegistration';
 import { type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
-import type { RegistrationEstablishedSessionResultV2 } from '../../../../../shared-ts/src/utils/registrationEstablishedSession';
 import type { PendingEcdsaRegistrationCommit, PendingEcdsaRegistrationKeyFamilies, PendingEcdsaRegistrationRecoveryPorts, PendingRegistrationExactMethod, PendingRegistrationRecoverySigningSurface } from './pendingEcdsaRegistrationRecoveryValidation';
 import { type ResumePendingEcdsaRegistrationResult } from './pendingEcdsaRegistrationRecovery';
 type PendingNearProvisioningCommit = Extract<PendingWalletRegistrationCommitV1, {
@@ -24,25 +23,16 @@ type PendingRegistrationRecoveryPorts = {
 type PendingRegistrationRecoveryResult = {
     readonly kind: 'published';
     readonly registrationCeremonyId: string;
-    readonly walletId: WalletId;
-    readonly sessionResult: RegistrationEstablishedSessionResultV2['kind'];
 } | {
     readonly kind: 'unlock_required';
     readonly registrationCeremonyId: string;
-    readonly walletId: WalletId;
     readonly keyFamilies: PendingEcdsaRegistrationKeyFamilies;
-    readonly activationJournalId: PendingEcdsaRegistrationCommit['localMaterial']['ecdsa']['activationJournalId'];
-    readonly activationRequestDigestB64u: PendingEcdsaRegistrationCommit['localMaterial']['ecdsa']['activationRequestDigestB64u'];
-    readonly clientActivation: PendingEcdsaRegistrationCommit['localMaterial']['ecdsa']['clientActivation'];
-    readonly walletAuthMethodId: PendingEcdsaRegistrationCommit['walletAuthMethodId'];
     readonly next: 'unlock_exact_method';
     readonly reason: 'ecdsa_local_finalization';
 } | {
     readonly kind: 'unlock_required';
     readonly reason: 'near_provisioning';
     readonly registrationCeremonyId: string;
-    readonly walletId: WalletId;
-    readonly walletAuthMethodId: PendingWalletRegistrationCommitV1['walletAuthMethodId'];
     readonly next: 'unlock_exact_method';
 } | {
     readonly kind: 'failed';

package/dist/types/wallet/src/SeamsWeb/operations/session/thresholdEcdsaProvisioning.d.ts

@@ -1,9 +1,8 @@
 import type { SeamsChainConfig } from '../../../core/types/seams';
 import { type ThresholdEcdsaChainTarget } from '../../../core/signingEngine/interfaces/ecdsaChainTarget';
-import type { EcdsaSignerProvisioningDefaults, EcdsaSignerProvisioningPolicy } from '../../../core/types/ecdsaSignerProvisioningDefaults';
+import type { EcdsaSignerProvisioningDefaults } from '../../../core/types/ecdsaSignerProvisioningDefaults';
 type ThresholdEcdsaProvisionTarget = {
     chainTarget: ThresholdEcdsaChainTarget;
-    options: EcdsaSignerProvisioningPolicy;
 };
 type EcdsaSessionPublicationTarget = {
     chainTarget: ThresholdEcdsaChainTarget;

package/dist/types/wallet/src/SeamsWeb/signingSurface/ports.d.ts

@@ -625,10 +625,8 @@ export type RegistrationWebContext = SeamsWebBaseContext<RegistrationSigningSurf
 export type NearSigningWebContext = SeamsWebBaseContext<NearSigningSurface & UserAccountLookupSurface & RpIdSurface>;
 export type WalletSessionWebContext = SeamsWebBaseContext<WalletSessionReadSurface>;
 export type LoginWebContext = SeamsWebBaseContext<LoginUnlockSigningSurface>;
-export type LockWebContext = SeamsWebBaseContext<LockSigningSurface>;
 export type RecentUnlocksWebContext = SeamsWebBaseContext<RecentUnlocksSigningSurface>;
 export type WalletAuthWebContext = SeamsWebBaseContext<LoginUnlockSigningSurface & LockSigningSurface & RecentUnlocksSigningSurface & RegistrationAccountSurface & EcdsaLoginSessionSurface>;
-export type LocalLoginStateWebContext = SeamsWebBaseContext<LocalLoginStateSurface>;
 export type AccountSyncWebContext = SeamsWebBaseContext<AccountSyncSigningSurface>;
 export type WalletRecoverySigningSurface = AccountSyncSigningSurface & Ed25519YaoCapabilityActivationSurface & EmailOtpRegistrationEnrollmentSurface & WebAuthnRegistrationConfirmationSurface & Pick<RegistrationAccountSurface, 'storeWalletEd25519RecoveryRegistrationData' | 'storeWalletEmailOtpEd25519RegistrationData' | 'upsertEd25519YaoPublicCapabilityReference'> & Pick<EcdsaRegistrationSurface, 'storeWalletEcdsaRecoverySignerRecords' | 'storeWalletEmailOtpEcdsaRegistrationData'> & Pick<EmailOtpRegistrationEnrollmentSurface, 'prepareEmailOtpRegistrationEnrollmentMaterialInternal'>;
 export type WalletRecoveryWebContext = SeamsWebBaseContext<WalletRecoverySigningSurface>;

package/dist/types/wallet/src/SeamsWeb/signingSurface/types.d.ts

@@ -3,7 +3,7 @@ import type { UserPreferencesManager } from '../../core/signingEngine/session/us
 import type { UiConfirmSurfaceMeasurementBinding } from '../../core/signingEngine/uiConfirm/uiConfirm.types';
 import type { AppearanceConfig, SeamsConfigsReadonly } from '../../core/types/seams';
 import type { WorkerOperationContext } from '../../core/signingEngine/workerManager/executeWorkerOperation';
-export type { AccountSyncSigningSurface, AccountSyncWebContext, WalletAuthWebContext, DeviceLinkingSigningSurface, DeviceLinkingWebContext, EcdsaLoginSessionSurface, EcdsaRegistrationSurface, Ed25519YaoCapabilityActivationSurface, EcdsaSessionBootstrapSurface, EcdsaSessionControlSurface, Ed25519SessionConnectionSurface, EmailOtpRegistrationEnrollmentSurface, EmailOtpSigningSessionSurface, WalletRecoverySigningSurface, WalletRecoveryWebContext, EvmFamilySigningSurface, LocalLoginStateSurface, LocalLoginStateWebContext, LockSigningSurface, LockWebContext, LoginUnlockSigningSurface, LoginWarmSigningSurface, LoginWebContext, NearSigningSurface, NearSigningWebContext, NonceCoordinatorSurface, PasskeyLoginAssertionSurface, RecentUnlocksSigningSurface, RecentUnlocksWebContext, RegistrationAccountSurface, RegistrationResourceWarmupSurface, RegistrationSigningSurface, RegistrationWebContext, RpIdSurface, RuntimeStartupSurface, SeamsWebBaseContext, SigningEngineLifecycleEventSurface, SignerWorkerContextSurface, SigningSessionSurface, TempoNonceLifecycleSurface, TempoSigningSurface, UnlockedEd25519ExportRootCapabilitySurface, UserAccountLookupSurface, UserProfileStoreSurface, WalletIframeWarmupSurface, WalletAuthenticationSurface, WalletSessionReadSurface, WalletSessionWebContext, WarmSessionStatusSurface, WebAuthnRegistrationConfirmationSurface, } from './ports';
+export type { AccountSyncSigningSurface, AccountSyncWebContext, WalletAuthWebContext, DeviceLinkingSigningSurface, DeviceLinkingWebContext, EcdsaLoginSessionSurface, EcdsaRegistrationSurface, Ed25519YaoCapabilityActivationSurface, EcdsaSessionBootstrapSurface, EcdsaSessionControlSurface, Ed25519SessionConnectionSurface, EmailOtpRegistrationEnrollmentSurface, EmailOtpSigningSessionSurface, WalletRecoverySigningSurface, WalletRecoveryWebContext, EvmFamilySigningSurface, LocalLoginStateSurface, LockSigningSurface, LoginUnlockSigningSurface, LoginWarmSigningSurface, LoginWebContext, NearSigningSurface, NearSigningWebContext, NonceCoordinatorSurface, PasskeyLoginAssertionSurface, RecentUnlocksSigningSurface, RecentUnlocksWebContext, RegistrationAccountSurface, RegistrationResourceWarmupSurface, RegistrationSigningSurface, RegistrationWebContext, RpIdSurface, RuntimeStartupSurface, SeamsWebBaseContext, SigningEngineLifecycleEventSurface, SignerWorkerContextSurface, SigningSessionSurface, TempoNonceLifecycleSurface, TempoSigningSurface, UnlockedEd25519ExportRootCapabilitySurface, UserAccountLookupSurface, UserProfileStoreSurface, WalletIframeWarmupSurface, WalletAuthenticationSurface, WalletSessionReadSurface, WalletSessionWebContext, WarmSessionStatusSurface, WebAuthnRegistrationConfirmationSurface, } from './ports';
 export type * from '../publicApi/types';
 export interface SeamsWebSigningSurface extends RpIdSurface, NonceCoordinatorSurface, WalletIframeWarmupSurface, WalletIframeSurfaceMeasurementSurface, WalletAuthenticationSurface, WalletLockGenerationSurface, RuntimeStartupSurface, SigningEngineLifecycleEventSurface, WorkerOperationContext, SigningSessionSurface, Ed25519SessionConnectionSurface, EcdsaSessionBootstrapSurface, EmailOtpSigningSessionSurface, EmailOtpRegistrationEnrollmentSurface, EcdsaLoginSessionSurface, EcdsaSessionControlSurface, SignerWorkerContextSurface, WarmSessionStatusSurface, NearSigningSurface, EvmFamilySigningSurface, TempoNonceLifecycleSurface, UserProfileStoreSurface, RegistrationResourceWarmupSurface, RegistrationAccountSurface, EcdsaRegistrationSurface, Ed25519YaoCapabilityActivationSurface, UnlockedEd25519ExportRootCapabilitySurface, WalletCustodyCeremonySurface, Ed25519MaterialOwnerQueueSurface, Pick<AccountSyncSigningSurface, 'storeNearThresholdKeyMaterial'>, WebAuthnRegistrationConfirmationSurface, EmailOtpEnrollmentConfirmationSurface, PasskeyLoginAssertionSurface, KeyExportSigningSurface {
     readonly seamsWebConfigs: SeamsConfigsReadonly;

package/dist/types/wallet/src/SeamsWeb/walletIframe/client/surface/domain.d.ts

@@ -156,14 +156,6 @@ export type WalletIframeSurfaceEvent = (RequestOwnedEvent & {
     kind: 'auth_menu_request_started';
     presentation: WalletIframeAuthMenuPresentation;
     authMenuSessionId: HostedAuthMenuSessionId;
-}) | (RequestOwnedEvent & {
-    kind: 'auth_menu_request_completed';
-    presentation?: never;
-    authMenuSessionId: HostedAuthMenuSessionId;
-}) | (RequestOwnedEvent & {
-    kind: 'auth_menu_request_closed';
-    presentation?: never;
-    authMenuSessionId: HostedAuthMenuSessionId;
 }) | (RequestOwnedEvent & {
     kind: 'auth_menu_request_cancelled';
     presentation?: never;