@seams/wallet 0.8.0 → 0.9.0

package/dist/public/wallet-service/index.html

@@ -5,14 +5,14 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Web3Authn Wallet Service</title>
     <!-- Surface styles are external so strict CSP can keep style-src 'self' -->
-    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.8.0" />
+    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.9.0" />
     <!-- Minimal shims some ESM bundles expect (externalized to enable strict CSP) -->
-    <script src="/sdk/wallet-shims.js?v=0.8.0"></script>
+    <script src="/sdk/wallet-shims.js?v=0.9.0"></script>
     <!-- Hint the browser to fetch the host script earlier -->
-    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.8.0" crossorigin>
+    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.9.0" crossorigin>
   </head>
   <body>
     <!-- sdkBasePath points to the SDK root (e.g. '/sdk'). Load the host directly. -->
-    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.8.0"></script>
+    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.9.0"></script>
   </body>
 </html>

package/dist/types/shared-ts/src/device-linking/activeWalletSession.d.ts

@@ -1,6 +1,7 @@
-import type { ActiveWalletSessionV1, WalletSessionOperationCredentialV1 } from './contracts';
+import type { ActiveWalletSessionV1, WalletSessionOperationCredentialV1, WalletSessionHome } from './contracts';
 export declare function activeWalletSessionV1RecordsEqual(left: ActiveWalletSessionV1, right: ActiveWalletSessionV1): boolean;
 export declare function walletSessionPreservesCapabilities(previous: ActiveWalletSessionV1, next: ActiveWalletSessionV1): boolean;
+export declare function parseWalletSessionHome(raw: unknown): WalletSessionHome;
 export declare function parseWalletSessionOperationCredentialV1(raw: unknown): WalletSessionOperationCredentialV1;
 export declare function parseActiveWalletSessionV1(raw: unknown): ActiveWalletSessionV1;
 //# sourceMappingURL=activeWalletSession.d.ts.map

package/dist/types/shared-ts/src/device-linking/contracts.d.ts

@@ -670,9 +670,19 @@ export type ActiveWalletSessionV1 = {
     readonly issuedAtMs: number;
     readonly expiresAtMs: number;
 };
+/** Routing metadata selects an endpoint and grants no execution authority. */
+export type WalletSessionHome = {
+    readonly kind: 'direct';
+    readonly region?: never;
+} | {
+    readonly kind: 'regional';
+    readonly region: 'US' | 'WEUR' | 'APAC' | 'OC';
+};
 /** The bearer used to authenticate ordinary operations for an active session. */
 export type WalletSessionOperationCredentialV1 = {
     readonly kind: 'opaque_wallet_session_operation_credential_v1';
+    readonly ownershipGeneration: number;
+    readonly home: WalletSessionHome;
     readonly token: string;
     readonly walletSessionId: WalletSessionId;
 };

package/dist/types/shared-ts/src/threshold/ed25519OperationFingerprint.d.ts

@@ -81,7 +81,8 @@ type ThresholdEd25519Nep413FingerprintInput = ThresholdEd25519CanonicalScope & {
     message: string;
     recipient: string;
     nonce: string;
-    state?: string | null;
+    callbackUrl: string | null;
+    state?: never;
 };
 type ThresholdEd25519DelegateActionFingerprintInput = ThresholdEd25519CanonicalScope & {
     delegate: {

package/dist/types/shared-ts/src/utils/emailOtpDomain.d.ts

@@ -12,13 +12,15 @@ export declare const WALLET_EMAIL_OTP_REGISTRATION_OPERATION: "registration";
 /** Linked-device enrollment: prove control of the wallet's enrolled email
  * destination to complete one device link. */
 export declare const WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION: "device_link";
-export type WalletEmailOtpOperation = WalletEmailOtpLoginOperation | typeof WALLET_EMAIL_OTP_REGISTRATION_OPERATION | typeof WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION;
+export declare const WALLET_EMAIL_OTP_RELOCATION_OPERATION: "wallet_relocation";
+export type WalletEmailOtpOperation = WalletEmailOtpLoginOperation | typeof WALLET_EMAIL_OTP_REGISTRATION_OPERATION | typeof WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION | typeof WALLET_EMAIL_OTP_RELOCATION_OPERATION;
 export declare const WALLET_EMAIL_OTP_ACTIONS: {
     readonly login: "wallet_email_otp_login";
     readonly registration: "wallet_email_otp_registration";
     readonly recoveryBootstrap: "wallet_email_otp_recovery_bootstrap";
     readonly unseal: "wallet_email_otp_unseal";
     readonly deviceLink: "wallet_email_otp_device_link";
+    readonly relocation: "wallet_email_otp_relocation";
 };
 export type WalletEmailOtpAction = (typeof WALLET_EMAIL_OTP_ACTIONS)[keyof typeof WALLET_EMAIL_OTP_ACTIONS];
 export declare const WALLET_EMAIL_OTP_EXPORT_OPERATION: "export_key";

package/dist/types/shared-ts/src/utils/routerAbPublicKeyset.d.ts

@@ -22,14 +22,6 @@ type RouterAbSignerEnvelopeHpkeRotatingPublicKeySetV1 = {
     previous_retire_at_ms: number;
 };
 type RouterAbSignerEnvelopeHpkeRotationPublicKeySetV1 = RouterAbSignerEnvelopeHpkeCurrentPublicKeySetV1 | RouterAbSignerEnvelopeHpkeRotatingPublicKeySetV1;
-type RouterAbSignerPeerVerifyingKeyHexV1 = {
-    role: RouterAbSignerRoleV1;
-    verifying_key_hex: string;
-};
-type RouterAbSignerPeerVerifyingKeyHexSetV1 = {
-    deriver_a: RouterAbSignerPeerVerifyingKeyHexV1;
-    deriver_b: RouterAbSignerPeerVerifyingKeyHexV1;
-};
 type RouterAbPublicHpkeKeyDescriptorV1 = {
     key_epoch: string;
     public_key: string;
@@ -37,7 +29,6 @@ type RouterAbPublicHpkeKeyDescriptorV1 = {
 export type RouterAbPublicKeysetV2 = {
     keyset_version: typeof ROUTER_AB_PUBLIC_KEYSET_VERSION_V2;
     signer_envelope_hpke: RouterAbSignerEnvelopeHpkeRotationPublicKeySetV1;
-    signer_peer_verifying_keys: RouterAbSignerPeerVerifyingKeyHexSetV1;
     signing_worker_server_output_hpke: RouterAbPublicHpkeKeyDescriptorV1;
 };
 export declare function requireRouterAbX25519PublicKey(value: unknown, label: string): string;

package/dist/types/shared-ts/src/utils/walletManagementProtocol.d.ts

@@ -1,3 +1,3 @@
 export declare const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
-export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "2";
+export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "3";
 //# sourceMappingURL=walletManagementProtocol.d.ts.map

package/dist/types/wallet/build-paths.d.ts

@@ -52,9 +52,7 @@ export declare const BUILD_PATHS: {
         readonly ED25519_YAO_CLIENT_WASM: "router_ab_ed25519_yao_client_bg.wasm";
         readonly ECDSA_CLIENT_JS: "router_ab_ecdsa_client.js";
         readonly ECDSA_CLIENT_WASM: "router_ab_ecdsa_client_bg.wasm";
-        readonly WASM_EVM_CRYPTO_WASM: "evm_crypto.wasm";
         readonly WASM_EVM_CRYPTO_BG_WASM: "evm_crypto_bg.wasm";
-        readonly WASM_TEMPO_SIGNER_WASM: "tempo_signer.wasm";
         readonly WASM_TEMPO_SIGNER_BG_WASM: "tempo_signer_bg.wasm";
         readonly EMAIL_OTP_RUNTIME_JS: "email_otp_runtime.js";
         readonly EMAIL_OTP_RUNTIME_WASM: "email_otp_runtime_bg.wasm";
@@ -78,9 +76,7 @@ export declare const BUILD_PATHS: {
         readonly ED25519_YAO_CLIENT_WASM: "/sdk/workers/router_ab_ed25519_yao_client_bg.wasm";
         readonly ECDSA_CLIENT_JS: "/sdk/workers/router_ab_ecdsa_client.js";
         readonly ECDSA_CLIENT_WASM: "/sdk/workers/router_ab_ecdsa_client_bg.wasm";
-        readonly WASM_EVM_CRYPTO_WASM: "/sdk/workers/evm_crypto.wasm";
         readonly WASM_EVM_CRYPTO_BG_WASM: "/sdk/workers/evm_crypto_bg.wasm";
-        readonly WASM_TEMPO_SIGNER_WASM: "/sdk/workers/tempo_signer.wasm";
         readonly WASM_TEMPO_SIGNER_BG_WASM: "/sdk/workers/tempo_signer_bg.wasm";
         readonly EMAIL_OTP_RUNTIME_JS: "/sdk/workers/email_otp_runtime.js";
         readonly EMAIL_OTP_RUNTIME_WASM: "/sdk/workers/email_otp_runtime_bg.wasm";

package/dist/types/wallet/src/SeamsWeb/SeamsWeb.d.ts

@@ -1,175 +1,56 @@
+import type { WalletPlacementCapability } from './publicApi/placement';
 import { type NearClient } from '../core/rpcClients/near/NearClient';
-import type { ThemeMode, AppearanceConfigInput, SeamsConfigsReadonly, SeamsConfigsInput } from '../core/types/seams';
-import type { SdkLifecycleEventListener, SigningFlowEvent } from '../core/types/sdkSentEvents';
-import type { HostedAuthMenuExternalAuthRequest, HostedAuthMenuDemoEmailOtpDelivery, HostedAuthMenuExternalAuthResolutionInput, HostedAuthMenuOpenRequest, HostedAuthMenuOutcome, HostedAuthMenuSessionId, PreferencesChangedPayload } from './walletIframe/shared/messages';
+import type { SeamsConfigsInput, SeamsClientConfig, ThemeMode } from '../core/types/seams';
+import type { AuthMenuCapability, ConfigCapability, ConnectionCapability, EventsCapability } from './publicApi/types';
+import type { AuthCapability, DevicesCapability, EvmSignerCapability, KeyExportCapability, NearSignerCapability, PreferencesCapability, RecoveryCapability, RegistrationCapability, TempoSignerCapability } from './signingSurface/types';
 import { type WalletIframeExactSessionIdentityInput, type WalletIframeExactSessionLockResult, type WalletIframeExactSessionState } from './walletIframe/shared/exactSessionState';
-import type { AuthCapability, DevicesCapability, EvmSignerCapability, KeyExportCapability, NearSignerCapability, SeamsWebContext, PreferencesCapability, RegistrationCapability, RecoveryCapability, TempoSignerCapability } from './signingSurface/types';
-import type { UiConfirmSurfaceMeasurementBinding } from '../core/signingEngine/uiConfirm/uiConfirm.types';
-import { type ThresholdEcdsaChainTarget, type WalletSessionRef } from '../core/signingEngine/interfaces/ecdsaChainTarget';
-import { type EcdsaChainSelector } from './publicApi/chainTargets';
-import type { TempoChainTarget } from '../core/platform/types';
-import type { EvmSignedResult } from '../core/signingEngine/chains/evm/evmAdapter';
-import type { ConfirmationConfig } from '../core/types/signer-worker';
-import { type TempoFeeTokenPreferenceSigningRequest } from '../core/signingEngine/chains/tempo/feeToken';
-type SeamsWebPrewarmOptions = {
-    iframe?: boolean;
-    workers?: boolean;
-    walletId?: never;
-    nearAccountId?: never;
-} | {
-    iframe?: boolean;
-    workers?: boolean;
-    walletId: string;
-    nearAccountId: string;
-};
-export type SeamsWebInternalOptions = {
-    readonly kind: 'application';
-} | {
-    readonly kind: 'wallet_host';
-};
-type SeamsWebContextWithDeviceLinkingResumeV1 = SeamsWebContext & {
-    readonly resumePendingAcknowledgementsV1: () => void;
-};
 /**
  * Main SeamsWeb class that provides framework-agnostic passkey operations
  * with flexible event-based callbacks for custom UX implementation
  */
 export declare class SeamsWeb {
-    private readonly signingEngine;
+    private readonly disposePreferences;
+    private readonly preferenceState;
     private readonly nearClient;
-    readonly configs: SeamsConfigsReadonly;
+    readonly configs: SeamsClientConfig;
     private appearance;
-    theme: ThemeMode;
+    readonly config: ConfigCapability;
+    readonly events: EventsCapability;
+    readonly connection: ConnectionCapability;
+    readonly authMenu: AuthMenuCapability;
     private readonly walletIframe;
-    private readonly lifecycleEventSource;
     readonly recovery: RecoveryCapability;
     readonly devices: DevicesCapability;
     readonly keys: KeyExportCapability;
     readonly preferences: PreferencesCapability;
     readonly auth: AuthCapability;
+    readonly placement: WalletPlacementCapability;
     readonly registration: RegistrationCapability;
     readonly near: NearSignerCapability;
     readonly tempo: TempoSignerCapability;
     readonly evm: EvmSignerCapability;
-    private readonly walletIframeControls;
-    private readonly deviceLinkingDispose;
-    private readonly resumePendingAcknowledgementsV1;
-    private emailOtpUnlockPrewarmRecord;
-    constructor(configs: SeamsConfigsInput, nearClient?: NearClient, internalOptions?: SeamsWebInternalOptions);
-    /**
-     * Initialize the hidden wallet service iframe client (optional) and warm critical resources.
-     * Always warms local resources; initializes iframe when wallet mode is `iframe`.
-     * Idempotent and safe to call multiple times.
-     */
-    initWalletIframe(walletId?: string): Promise<WalletIframeExactSessionState>;
+    constructor(configs: SeamsConfigsInput, nearClient?: NearClient);
     getWalletIframeExactSessionState(): Promise<WalletIframeExactSessionState>;
-    /** @internal One wallet-host restore owns all configured-chain prefills. */
-    prefillRestoredWalletSession(state: WalletIframeExactSessionState): Promise<void>;
-    openHostedAuthMenu(request: HostedAuthMenuOpenRequest, anchorElement?: HTMLElement): Promise<HostedAuthMenuOutcome>;
-    cancelHostedAuthMenu(args: {
-        authMenuSessionId: HostedAuthMenuSessionId;
-    }): Promise<void>;
-    onHostedAuthMenuExternalAuthRequest(listener: (request: HostedAuthMenuExternalAuthRequest) => void): () => void;
-    onHostedAuthMenuDemoEmailOtpDelivery(listener: (delivery: HostedAuthMenuDemoEmailOtpDelivery) => void): () => void;
-    resolveHostedAuthMenuExternalAuth(resolution: HostedAuthMenuExternalAuthResolutionInput): Promise<void>;
     lockWalletIframeExactSession(identity: WalletIframeExactSessionIdentityInput): Promise<WalletIframeExactSessionLockResult>;
-    /** True when the wallet iframe client is connected and ready. */
-    isWalletIframeReady(): boolean;
-    /** Subscribe to wallet iframe ready state transitions. */
-    onWalletIframeReady(listener: () => void): () => void;
-    /** Subscribe to wallet-host login status updates. */
-    onWalletIframeLoginStatusChanged(listener: (status: {
-        isLoggedIn: boolean;
-        walletId: string | null;
-    }) => void): () => void;
-    /** Subscribe to typed lifecycle events emitted by the wallet boundary. */
-    onSdkLifecycleEvent(listener: SdkLifecycleEventListener): () => void;
-    /** Subscribe to wallet-host preference updates. */
-    onWalletIframePreferencesChanged(listener: (payload: PreferencesChangedPayload) => void): () => void;
-    getContext(): SeamsWebContextWithDeviceLinkingResumeV1;
-    private resumePendingAcknowledgementsAfterExactUnlockV1;
-    private resumePendingRegistrationOnStartup;
-    dispose(): void;
-    private getWalletAuthDeps;
-    setTheme(next: ThemeMode): void;
-    /**
-     * Resolve one configured ECDSA chain target by network slug, chain id, or
-     * family — the value every EVM-family signing and export call takes.
-     *
-     * Throws when the selector matches no configured chain, or more than one.
-     * Every configured chain is named in the error, so an ambiguous selector is
-     * a clear failure rather than a silent first-match pick.
-     *
-     * @example seams.chainTarget('tempo-testnet')
-     */
-    chainTarget(selector: EcdsaChainSelector): ThresholdEcdsaChainTarget;
-    /** Every ECDSA chain target this client is configured for. */
-    configuredChainTargets(): readonly ThresholdEcdsaChainTarget[];
+    private disposeClient;
+    get theme(): ThemeMode;
+    private updateTheme;
     /**
      * Update resolved appearance at runtime.
-     * This is the canonical internal propagation path for local signing UI,
-     * wallet-host documents, and app-origin wallet iframe mode. Appearance is
+     * Forward appearance to the wallet-host document. Appearance is
      * excluded from the runtime-reset fingerprint, so warm signing-session state
      * is preserved. Fire-and-forget; never throws.
      */
-    setAppearance(appearance: AppearanceConfigInput): void;
-    setWalletIframeSurfaceMeasurementBinding(binding: UiConfirmSurfaceMeasurementBinding): void;
-    /**
-     * Pre-warm resources on a best-effort basis without changing visible state.
-     * - When iframe=true, initializes the wallet iframe client.
-     * - When workers=true, warms local critical resources only outside app-origin iframe mode.
-     * - When both are false/omitted, does nothing.
-     */
-    prewarm(opts?: SeamsWebPrewarmOptions): Promise<void>;
-    private emitWalletIframeTransportTimingSummary;
-    private registerWalletDomain;
-    private getNearProvisioningStateDomain;
-    private resumePendingEcdsaRegistrationDomain;
-    private registerWalletSignerDomain;
-    private addPasskeyDomain;
-    private revokeAuthMethodDomain;
-    private addEmailOtpDomain;
-    private registerPasskeyDomain;
-    private emailOtpRegistrationFlowId;
-    private emailOtpUnlockFlowId;
-    private emitEmailOtpRegistrationEvent;
-    private emitEmailOtpUnlockEvent;
-    private emitEmailOtpRegistrationFailure;
-    private emitEmailOtpUnlockWorkerProgress;
-    private emitEmailOtpUnlockFailure;
-    private requestEmailOtpChallengeDomain;
-    private requestEmailOtpEnrollmentChallengeDomain;
-    private requestEmailOtpSigningSessionChallengeDomain;
-    private enrollEmailOtpDomain;
-    private getWalletRecoveryCodeStatusDomain;
-    private beginGoogleEmailOtpWalletAuthDomain;
-    private resolveGoogleEmailOtpProviderDomain;
-    private resolveLinkedEmailOtpWalletAuthDomain;
-    private loginWithLinkedEmailOtpWalletDomain;
-    private prewarmEmailOtpYaoDomain;
-    private getGoogleEmailOtpWalletSessionDomain;
-    private acknowledgeWalletRecoveryCodeBackupDomain;
-    private loadPendingWalletRecoveryCodeBackupRequest;
+    private updateAppearance;
+    private synchronizeAppearance;
+    private getAppearance;
+    private syncAccountDomain;
+    private getWalletIframe;
+    private onNearAccountChange;
+    private getCodeStatusDomain;
+    private confirmBackupDomain;
     private requestWalletCustodyEmailOtpChallengeDomain;
-    private rotateWalletRecoveryCodesDomain;
-    private loginWithEmailOtpEd25519YaoCapabilityDomain;
-    private emailOtpEmailHashHex;
-    private loginWithEmailOtpEcdsaCapabilityDomain;
-    private refreshEmailOtpSigningSessionDomain;
-    /**
-     * Prefetch latest block height/hash (and nonce if context missing) to reduce
-     * perceived latency when the user initiates a signing flow.
-     */
-    prefetchBlockheight(): Promise<void>;
-    /** Wallet-host entrypoint for the exact FeeManager preference operation. */
-    signTempoFeeTokenPreferenceInternal(args: {
-        walletSession: WalletSessionRef;
-        request: TempoFeeTokenPreferenceSigningRequest;
-        chainTarget: TempoChainTarget;
-        confirmationConfigOverride?: Partial<ConfirmationConfig>;
-        shouldAbort?: () => boolean;
-        onEvent?: (event: SigningFlowEvent) => void;
-    }): Promise<EvmSignedResult>;
+    private rotateCodesDomain;
     /**
      * Canonical entrypoint to show secure key export UI (wallet-origin only) without
      * returning private keys to the caller.
@@ -177,5 +58,4 @@ export declare class SeamsWeb {
     private resolveExactKeyExportLaneDomain;
     private exportKeypairWithUIDomain;
 }
-export {};
 //# sourceMappingURL=SeamsWeb.d.ts.map

package/dist/types/wallet/src/SeamsWeb/assembly/browserSigningSurfaceAssembly.d.ts

@@ -21,9 +21,8 @@ import { type ThresholdEd25519CommitQueueByKey } from '../../core/signingEngine/
 import type { SignerWorkerManager } from '../../core/signingEngine/workerManager/SignerWorkerManager';
 import type { PasskeyMpcExportPort, PasskeyMpcSessionPort, UiConfirmRuntimeBridgePort } from '../../core/signingEngine/uiConfirm/uiConfirm.types';
 import type { WarmSigningPorts } from '../../core/signingEngine/assembly/ports/warmSigning';
-import type { WorkerResourceWarmupPolicy } from '../../core/signingEngine/assembly/warmup';
+import type { UiConfirmPrewarmPredicate } from '../../core/signingEngine/assembly/warmup';
 import type { SeamsConfigsReadonly, ThemeMode } from '../../core/types/seams';
-import * as registrationPublic from '../../core/signingEngine/flows/registration/public';
 import type { Ed25519YaoPublicCapabilityReferenceStorePort } from '../../core/signingEngine/threshold/ed25519/yaoPublicCapabilityReferences';
 import type { ThresholdEcdsaChainTarget } from '../../core/signingEngine/interfaces/ecdsaChainTarget';
 import { type SignerAuthMethod } from '../../../../shared-ts/src/utils/signerDomain';
@@ -53,18 +52,21 @@ export declare function resolveBrowserNearEd25519PasskeyAuthorityForMaterial(arg
     readonly runtime: ExactEd25519SealedSessionRuntime;
     readonly authorizationRead: BrowserNearEd25519PasskeyMaterialAuthorizationRead;
 }): Promise<WalletAuthAuthorityRef>;
+/** Local observations plan signing. Prepare must reconcile fresh server authority
+ * before the client creates a signature share. Never use this reader for export. */
+export declare function readBrowserNearEd25519SigningCandidate(relayerUrl: string, statusReads: WalletSessionStatusReadScope, walletId: ReturnType<typeof toWalletId>): Promise<NearEd25519WalletSessionAuthorizationReadResult>;
 /**
  * Reads the selected authority, exact V6 session row, and authenticated
  * relayer status as one Ed25519 authorization value. The local row never
  * authorizes an operation without the status read.
  */
 export declare function readBrowserExactNearEd25519WalletSessionAuthorization(relayerUrlInput: string, statusReads: WalletSessionStatusReadScope, walletIdInput: ReturnType<typeof toWalletId>): Promise<NearEd25519WalletSessionAuthorizationReadResult>;
-export declare function resolveBrowserActiveNearEd25519WalletSessionAuthorization(walletId: ReturnType<typeof toWalletId>, relayerUrl: string): Promise<ExactNearEd25519WalletSessionAuthorization | null>;
+export declare function resolveBrowserActiveNearEd25519WalletSessionAuthorization(walletId: ReturnType<typeof toWalletId>, relayerUrl: string, statusReads: WalletSessionStatusReadScope): Promise<ExactNearEd25519WalletSessionAuthorization | null>;
 export declare function listBrowserEcdsaPreprocessingCapabilitiesForWallet(args: BrowserEcdsaCapabilityReaderContext, input: {
     walletId: string;
     chainTargets: readonly ThresholdEcdsaChainTarget[];
 }, statusReads: WalletSessionStatusReadScope): Promise<readonly AuthorizedEcdsaPreprocessingCapability[]>;
-export declare function createBrowserActiveEcdsaWalletSessionAuthorizationResolver(args: BrowserEcdsaCapabilityReaderContext): (input: BrowserEcdsaWalletSessionAuthorizationInput) => Promise<ExactEvmFamilyWalletSessionAuthorization | null>;
+export declare function createBrowserActiveEcdsaWalletSessionAuthorizationResolver(args: BrowserEcdsaCapabilityReaderContext): (input: BrowserEcdsaWalletSessionAuthorizationInput, statusReads: WalletSessionStatusReadScope) => Promise<ExactEvmFamilyWalletSessionAuthorization | null>;
 export declare function resolveAmbiguousEcdsaActivationForSelectedAuthMethod(input: {
     readonly walletId: ReturnType<typeof toWalletId>;
     readonly materialActivation: Parameters<typeof ecdsaCapabilityManifestStore.lookupByMaterialActivation>[0]['materialActivation'];
@@ -105,12 +107,11 @@ type BrowserSigningSurfaceEnginePortsArgs = {
     thresholdEcdsaSigningQueueByKey: ThresholdEcdsaSigningQueueByKey;
     thresholdEd25519CommitQueueByKey: ThresholdEd25519CommitQueueByKey;
     getWorkerBaseOrigin: () => string;
-    workerWarmupPolicy: WorkerResourceWarmupPolicy;
+    shouldPrewarmUiConfirmUi: UiConfirmPrewarmPredicate;
     getTheme: () => ThemeMode;
     ensureSealedRefreshStartupParity: () => Promise<void>;
     resolveOwnerLaneScope: (walletId: string) => Promise<OwnerLaneScope>;
     getEnginePorts: () => SigningEnginePorts;
-    getRegistrationPublicDeps: () => registrationPublic.RegistrationPublicDeps;
     prepareNearEd25519YaoMaterialBoundary: Parameters<typeof createSigningEnginePorts>[0]['prepareNearEd25519YaoMaterialBoundary'];
 };
 export declare function createBrowserSigningSurfaceEnginePorts(args: BrowserSigningSurfaceEnginePortsArgs): SigningEnginePorts;

package/dist/types/wallet/src/SeamsWeb/assembly/browserSigningSurfacePorts.d.ts

@@ -3,12 +3,10 @@ import type { SigningEngineStorePorts } from '../../core/signingEngine/assembly/
 import type { ManagerAssemblyStores } from '../../core/signingEngine/assembly/createManagers';
 import type { BrowserSealedSigningSessionStorePorts } from './createBrowserSigningStores';
 import type { UserPreferencesManager } from '../../core/signingEngine/session/userPreferences';
-import type { SeamsConfigsReadonly } from '../../core/types/seams';
 import type { CreateBrowserSigningRuntimeArgs } from './createBrowserSigningRuntime';
-import type { WorkerResourceWarmupPolicy } from '../../core/signingEngine/assembly/warmup';
+import type { UiConfirmPrewarmPredicate } from '../../core/signingEngine/assembly/warmup';
 import type { Ed25519YaoPublicCapabilityReferenceStorePort } from '../../core/signingEngine/threshold/ed25519/yaoPublicCapabilityReferences';
 type InitializeSigningRuntimePort = (args: {
-    config: SeamsConfigsReadonly;
     userPreferencesManager: Pick<UserPreferencesManager, 'initFromIndexedDB'>;
     getWorkerBaseOrigin: () => string;
     setWorkerBaseOrigin: (origin: string) => void;
@@ -20,7 +18,7 @@ export type BrowserSigningSurfaceConstructorDeps = {
     ed25519YaoPublicCapabilityReferences: Ed25519YaoPublicCapabilityReferenceStorePort;
     createRuntime: (args: CreateBrowserSigningRuntimeArgs) => SigningRuntime;
     initializeRuntime: InitializeSigningRuntimePort;
-    workerWarmupPolicy: WorkerResourceWarmupPolicy;
+    shouldPrewarmUiConfirmUi: UiConfirmPrewarmPredicate;
 };
 export {};
 //# sourceMappingURL=browserSigningSurfacePorts.d.ts.map

package/dist/types/wallet/src/SeamsWeb/assembly/createWalletIframeRouter.d.ts

@@ -1,7 +1,7 @@
-import type { AppearanceConfig, SeamsConfigsReadonly } from '../../core/types/seams';
+import type { AppearanceConfig, SeamsClientConfig } from '../../core/types/seams';
 import type { WalletIframeRouter } from '../walletIframe/client/router';
 export declare function createWalletIframeRouter(args: {
-    configs: SeamsConfigsReadonly;
+    configs: SeamsClientConfig;
     walletOrigin: string;
     getAppearance: () => AppearanceConfig;
 }): Promise<WalletIframeRouter>;

package/dist/types/wallet/src/SeamsWeb/assembly/initializeBrowserSigningRuntime.d.ts

@@ -1,7 +1,5 @@
 import type { UserPreferencesManager } from '../../core/signingEngine/session/userPreferences';
-import type { SeamsConfigsReadonly } from '../../core/types/seams';
 type InitializeBrowserSigningRuntimeArgs = {
-    config: SeamsConfigsReadonly;
     userPreferencesManager: Pick<UserPreferencesManager, 'initFromIndexedDB'>;
     getWorkerBaseOrigin: () => string;
     setWorkerBaseOrigin: (origin: string) => void;

package/dist/types/wallet/src/SeamsWeb/index.d.ts

@@ -5,7 +5,7 @@ export { BrowserCapabilityUnavailableError } from './publicApi/capabilitySelecti
 export type { BrowserCapabilitySelectionResult, BrowserCapabilityUnavailableReason, BrowserCapabilityUnavailableSelection, } from './publicApi/capabilitySelection';
 export type { DemoEmailOtpCodeResponse } from '../core/signingEngine/session/emailOtp/publicTypes';
 export type { TempoFeeTokenValidation } from '../core/signingEngine/chains/tempo/feeToken';
-export type { AuthCapability, AddPasskeyAuthorization, AddPasskeyResult, BootstrapThresholdEcdsaSessionArgs, DevicesCapability, EmailOtpChallengeResult, EmailOtpEcdsaCapabilityArgs, EmailOtpEcdsaCapabilityResult, EmailOtpEnrollmentResult, ExportKeypairWithUIInput, GoogleEmailOtpRegistrationEnrollmentResult, GoogleEmailOtpRegistrationCandidate, GoogleEmailOtpRegistrationCandidateId, GoogleEmailOtpRegistrationFinalizeInput, GoogleEmailOtpRegistrationOffer, GoogleEmailOtpRegistrationOfferId, GoogleEmailOtpWalletAuthDelivery, GoogleEmailOtpWalletAuthEcdsaTargets, GoogleEmailOtpWalletAuthFailure, GoogleEmailOtpWalletAuthFailureCode, GoogleEmailOtpWalletAuthFlow, GoogleEmailOtpWalletAuthLoginTarget, GoogleEmailOtpWalletAuthLoginFlow, GoogleEmailOtpWalletAuthPromptCopy, GoogleEmailOtpWalletAuthRegistrationCompleted, GoogleEmailOtpWalletAuthRegistrationFlow, GoogleEmailOtpWalletAuthRequestedMode, GoogleEmailOtpWalletAuthResolvedMode, GoogleEmailOtpWalletAuthResult, GoogleEmailOtpWalletAuthStartInput, GoogleEmailOtpWalletAuthSubmitSuccess, GetTempoFeeTokenPreferenceArgs, RegistrationFinalizeIdempotencyKey, ExecuteEvmFamilyTransactionArgs, ExecuteEvmFamilyTransactionResult, EvmSignerCapability, FinalizedEvmTxPayloadVerification, KeyExportCapability, NearSignerCapability, PasskeyRegistrationOptions, PreferencesCapability, RegistrationCapability, RecoveryCapability, WalletRecoveryRotationAuthorization, WalletRecoveryRotationOutcome, ReconcileTempoNonceLaneArgs, ReportTempoBroadcastAcceptedArgs, ReportTempoBroadcastRejectedArgs, ReportTempoDroppedOrReplacedArgs, ReportTempoFinalizedArgs, SignEvmTransactionArgs, SetTempoFeeTokenPreferenceArgs, SignTempoArgs, TempoNonceLifecycleEvent, TempoNonceLifecycleOptions, TempoNonceLaneStatus, TempoSignerCapability, ValidateTempoFeeTokenArgs, } from './publicApi/types';
+export type { AuthCapability, AuthMenuCapability, EventsCapability, ConfigCapability, ConnectionCapability, ClientConnectionState, AddPasskeyAuthorization, AddPasskeyResult, DevicesCapability, EmailOtpChallengeResult, EmailOtpEcdsaCapabilityArgs, EmailOtpEcdsaCapabilityResult, ExportKeyInput, KeyExportOutcome, GoogleEmailOtpRegistrationEnrollmentResult, GoogleEmailOtpRegistrationCandidate, GoogleEmailOtpRegistrationCandidateId, GoogleEmailOtpRegistrationFinalizeInput, GoogleEmailOtpRegistrationOffer, GoogleEmailOtpRegistrationOfferId, GoogleEmailOtpWalletAuthDelivery, GoogleEmailOtpWalletAuthEcdsaTargets, GoogleEmailOtpWalletAuthFailure, GoogleEmailOtpWalletAuthFailureCode, GoogleEmailOtpWalletAuthFlow, GoogleEmailOtpWalletAuthLoginTarget, GoogleEmailOtpWalletAuthLoginFlow, RequestEmailCodeInput, GoogleEmailOtpWalletAuthPromptCopy, GoogleEmailOtpWalletAuthRegistrationCompleted, GoogleEmailOtpWalletAuthRegistrationFlow, GoogleEmailOtpWalletAuthRequestedMode, GoogleEmailOtpWalletAuthResolvedMode, GoogleEmailOtpWalletAuthResult, GoogleEmailOtpWalletAuthStartInput, GoogleEmailOtpWalletAuthSubmitSuccess, GetTempoFeeTokenPreferenceArgs, RegistrationFinalizeIdempotencyKey, ExecuteEvmFamilyTransactionArgs, ExecuteEvmFamilyTransactionResult, EvmSignerCapability, FinalizedEvmTxPayloadVerification, KeyExportCapability, NearSignerCapability, PreferencesCapability, RegistrationCapability, RecoveryCapability, WalletRecoveryRotationAuthorization, WalletRecoveryRotationOutcome, ReconcileTempoNonceLaneArgs, ReportTempoBroadcastAcceptedArgs, ReportTempoBroadcastRejectedArgs, ReportTempoDroppedOrReplacedArgs, ReportTempoFinalizedArgs, SignEvmTransactionArgs, SetTempoFeeTokenPreferenceArgs, SignTempoArgs, TempoNonceLifecycleEvent, TempoNonceLifecycleOptions, TempoNonceLaneStatus, TempoSignerCapability, ValidateTempoFeeTokenArgs, } from './publicApi/types';
 export type { SeamsConfigsReadonly, SeamsConfigsInput, AddedEvmFamilyEcdsaSignerCapability, AddedNearEd25519SignerCapability, RegisteredEvmFamilyEcdsaCapability, RegisteredNearEd25519Capability, RegistrationResult, NearProvisioningState, LoginAndCreateSessionResult, LoginResult, WalletSession, SigningSessionStatus, ActionResult, } from '../core/types/seams';
 export type { ActionHooksOptions, AfterCall, EventCallback, LoginHooksOptions, RegistrationHooksOptions, SignNEP413HooksOptions, SyncAccountHooksOptions, NearProvisioningStateChangedEvent, } from '../core/types/sdkSentEvents';
 export type { SignNEP413MessageParams, SignNEP413MessageResult, } from '../core/types/sdkPublicResults';

package/dist/types/wallet/src/SeamsWeb/operations/auth/login.d.ts

@@ -1,8 +1,8 @@
+import { WalletSessionStatusReadScope } from '../../../core/rpcClients/relayer/walletSessionAuthorizationStatus';
 import type { LoginHooksOptions } from '../../../core/types/sdkSentEvents';
 import type { GetRecentUnlocksResult, LoginAndCreateSessionResult, WalletSession, WalletAuthenticationState } from '../../../core/types/seams';
 import type { LoginWebContext, RecentUnlocksWebContext, WalletSessionWebContext } from '../../signingSurface/types';
 import { type AccountId } from '../../../core/types/accountIds';
-import type { EcdsaClientPresignCleanupTarget } from '../../../core/signingEngine/workerManager/ecdsaPresignLifecycle';
 import type { ActiveWalletAuthorityV1 } from '../../../../../shared-ts/src/authorization/walletAuthority';
 import type { ActiveWalletSessionV1, WalletSessionOperationCredentialV1 } from '../../../../../shared-ts/src/device-linking';
 import { type WalletAuthMethodId } from '../../../../../shared-ts/src/utils/domainIds';
@@ -106,7 +106,7 @@ export declare function unlockLinkedDeviceEmailOtpWallet(args: {
     readonly relayUrl: string;
 }): Promise<void>;
 export declare function unlockLinkedDevicePasskey(context: LoginWebContext, walletIdInput: string, options: LoginHooksOptions | undefined): Promise<LoginAndCreateSessionResult>;
-export declare function getWalletSession(context: WalletSessionWebContext, walletId?: WalletId | string): Promise<WalletSession>;
+export declare function getWalletSession(context: WalletSessionWebContext, walletId: WalletId | string | undefined, statusReads: WalletSessionStatusReadScope): Promise<WalletSession>;
 /**
  * List recently used accounts from IndexedDB.
  *
@@ -138,12 +138,6 @@ export type LockOperationContext = {
         clearVolatileWarmSigningMaterial(walletId?: WalletId): Promise<void>;
     };
 };
-export type LogoutOperationContext = {
-    signingEngine: LockOperationContext['signingEngine'] & {
-        deleteDurableEcdsaPresignatures(target: EcdsaClientPresignCleanupTarget): Promise<number>;
-    };
-};
 export declare function lock(context: LockOperationContext): Promise<void>;
-export declare function logout(context: LogoutOperationContext): Promise<void>;
 export {};
 //# sourceMappingURL=login.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/auth/unlockCompletion.d.ts

@@ -0,0 +1,26 @@
+import type { AfterCall, CreateUnlockFlowEventInput, LoginHooksOptions } from '../../../core/types/sdkSentEvents';
+import type { LoginAndCreateSessionResult, LoginResult, WalletAuthMethod } from '../../../core/types/seams';
+import type { LoginWebContext } from '../../signingSurface/types';
+type EmitUnlockEventInput = Omit<CreateUnlockFlowEventInput, 'accountId' | 'flowId'>;
+export declare function emitUnlockEvent(onEvent: LoginHooksOptions['onEvent'] | undefined, unlockSubjectId: string, event: EmitUnlockEventInput): void;
+export declare function finalizeLoginSuccess(args: {
+    context: LoginWebContext;
+    authMethod: WalletAuthMethod;
+    unlockSubjectId: string;
+    loginResult: LoginResult;
+    onEvent?: LoginHooksOptions['onEvent'];
+    afterCall?: AfterCall<LoginAndCreateSessionResult>;
+}): Promise<LoginAndCreateSessionResult>;
+export declare function finalizeLoginError(args: {
+    unlockSubjectId: string;
+    message: string;
+    error?: unknown;
+    onEvent?: LoginHooksOptions['onEvent'];
+    onError?: (error: Error) => void;
+    afterCall?: AfterCall<LoginAndCreateSessionResult>;
+    callOnError?: boolean;
+    callAfterCall?: boolean;
+    cancelled?: boolean;
+}): Promise<LoginAndCreateSessionResult>;
+export {};
+//# sourceMappingURL=unlockCompletion.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/auth/unlockPendingRegistration.d.ts

@@ -0,0 +1,14 @@
+import type { WalletAuthWebContext } from '../../signingSurface/types';
+import type { LoginHooksOptions } from '../../../core/types/sdkSentEvents';
+import type { LoginAndCreateSessionResult } from '../../../core/types/seams';
+import { type PendingEcdsaRegistrationCommit, type PendingRegistrationRecoverySigningSurface } from '../registration/pendingRegistrationRecovery';
+type PendingRegistrationAuthContext = WalletAuthWebContext & {
+    signingEngine: PendingRegistrationRecoverySigningSurface;
+};
+export declare function unlockPendingRegistration(args: {
+    context: PendingRegistrationAuthContext;
+    pending: PendingEcdsaRegistrationCommit;
+    options: LoginHooksOptions | undefined;
+}): Promise<LoginAndCreateSessionResult>;
+export {};
+//# sourceMappingURL=unlockPendingRegistration.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/auth/unlockSessionPolicy.d.ts

@@ -0,0 +1,16 @@
+import type { LoginHooksOptions } from '../../../core/types/sdkSentEvents';
+import type { SeamsConfigsReadonly } from '../../../core/types/seams';
+export type UnlockSessionPolicy = {
+    readonly kind: 'disabled';
+    readonly ttlMs: 0;
+    readonly unlockRemainingUses: null;
+} | {
+    readonly kind: 'enabled';
+    readonly ttlMs: number;
+    readonly unlockRemainingUses: number;
+};
+export declare function resolveUnlockSessionPolicy(args: {
+    readonly defaults: SeamsConfigsReadonly['signing']['sessionDefaults'];
+    readonly override: LoginHooksOptions['signingSession'];
+}): UnlockSessionPolicy;
+//# sourceMappingURL=unlockSessionPolicy.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/emailOtp/challenge.d.ts

@@ -1,10 +1,10 @@
 import { EMAIL_OTP_CHANNEL, type WalletEmailOtpChannel, type WalletEmailOtpLoginOperation } from '../../../../../../shared-ts/src/utils/emailOtpDomain';
 import type { WorkerOperationContext } from '../../../../core/signingEngine/workerManager/executeWorkerOperation';
-import { type EmailOtpChallengeDelivery, type EmailOtpEnrollmentResult, type EmailOtpUnlockSignerSelection, type GoogleEmailOtpProviderResolution } from '../../../../core/signingEngine/session/emailOtp/publicTypes';
+import { type EmailOtpChallengeDelivery, type EmailOtpUnlockSignerSelection, type GoogleEmailOtpProviderResolution } from '../../../../core/signingEngine/session/emailOtp/publicTypes';
 import { type EmailOtpRouteFamily } from '../../../../core/signingEngine/stepUpConfirmation/otpPrompt/authLane';
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 export type FetchLike = typeof fetch;
-export type { EmailOtpEnrollmentResult, WalletEmailOtpChannel };
+export type { WalletEmailOtpChannel };
 export { EMAIL_OTP_CHANNEL };
 type JsonObject = Record<string, unknown>;
 export declare function readString(value: unknown, label: string): string;

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/emailOtp/googleEmailOtpWalletAuthFlow.d.ts

@@ -2,7 +2,7 @@ import type { RegistrationResult, SeamsConfigsReadonly, WalletSession } from '..
 import type { WalletSignerActivationSetV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import type { UnlockFlowEvent } from '../../../../core/types/sdkSentEvents';
 import { walletSessionRefFromSession, type ThresholdEcdsaChainTarget } from '../../../../core/signingEngine/interfaces/ecdsaChainTarget';
-import type { EmailOtpEcdsaCapabilityArgs, EmailOtpEcdsaCapabilityResult, EmailOtpOperationChallengeResult, GoogleEmailOtpWalletAuthFlow, GoogleEmailOtpWalletAuthRequestedMode, GoogleEmailOtpWalletAuthResult, GoogleEmailOtpWalletAuthStartInput, RegistrationCapability } from '../../../publicApi/types';
+import type { RequestEmailCodeInput, GoogleEmailOtpWalletAuthLoginFlow, EmailOtpEcdsaCapabilityArgs, EmailOtpEcdsaCapabilityResult, EmailOtpOperationChallengeResult, GoogleEmailOtpWalletAuthFlow, GoogleEmailOtpWalletAuthRequestedMode, GoogleEmailOtpWalletAuthResult, GoogleEmailOtpWalletAuthStartInput, RegistrationCapability } from '../../../publicApi/types';
 import type { GoogleEmailOtpProviderResolution } from '../../../../core/signingEngine/session/emailOtp/publicTypes';
 import type { EmailOtpAuthoritySelector } from '../../../../core/signingEngine/workerManager/workerTypes';
 type GoogleEmailOtpWalletRegistrationArgs = Parameters<RegistrationCapability['registerWallet']>[0];
@@ -75,6 +75,7 @@ export type GoogleEmailOtpWalletAuthDeps = {
     }): Promise<void>;
     getWalletSession(walletId: string): Promise<WalletSession>;
 };
-export declare function beginGoogleEmailOtpWalletAuth(deps: GoogleEmailOtpWalletAuthDeps, input: GoogleEmailOtpWalletAuthStartInput): Promise<GoogleEmailOtpWalletAuthResult<GoogleEmailOtpWalletAuthFlow>>;
+export declare function startGoogleSignIn(deps: GoogleEmailOtpWalletAuthDeps, input: GoogleEmailOtpWalletAuthStartInput): Promise<GoogleEmailOtpWalletAuthResult<GoogleEmailOtpWalletAuthFlow>>;
+export declare function requestEmailCode(deps: GoogleEmailOtpWalletAuthDeps, input: RequestEmailCodeInput): Promise<GoogleEmailOtpWalletAuthResult<GoogleEmailOtpWalletAuthLoginFlow>>;
 export {};
 //# sourceMappingURL=googleEmailOtpWalletAuthFlow.d.ts.map

package/dist/types/wallet/src/SeamsWeb/operations/authMethods/revokeAuthMethod.d.ts

@@ -1,6 +1,13 @@
 import { type WalletId } from '../../../../../shared-ts/src/utils/registrationIntent';
 import { type WalletAuthMethodId } from '../../../../../shared-ts/src/utils/domainIds';
+import type { WalletAuthMethodRevocationProof } from '../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import type { RegistrationWebContext } from '../../signingSurface/types';
+type RemovalSource = {
+    readonly kind: 'surviving_method';
+} | {
+    readonly kind: 'selected_method';
+    readonly walletAuthMethodId: WalletAuthMethodId;
+};
 export type RevokeAuthMethodResult = {
     readonly ok: true;
     readonly walletId: WalletId;
@@ -10,9 +17,18 @@ export type RevokeAuthMethodResult = {
         readonly status: 'revoked';
     };
 };
+export declare function authorizeWalletAuthMethodRemoval(context: Pick<RegistrationWebContext, 'configs' | 'signingEngine'>, source: RemovalSource, args: {
+    readonly walletId: WalletId;
+    readonly walletAuthMethodId: WalletAuthMethodId;
+}): Promise<{
+    readonly relayerUrl: string;
+    readonly requestedAtMs: number;
+    readonly sourceProof: WalletAuthMethodRevocationProof;
+}>;
 export declare function revokeWalletAuthMethodOperation(args: {
-    readonly context: RegistrationWebContext;
+    readonly context: Pick<RegistrationWebContext, 'configs' | 'signingEngine'>;
     readonly walletId: WalletId | string;
     readonly walletAuthMethodId: string;
 }): Promise<RevokeAuthMethodResult>;
+export {};
 //# sourceMappingURL=revokeAuthMethod.d.ts.map