@seams/wallet 0.9.4 → 0.10.1

package/dist/public/sdk/wallet-iframe-host-ecdsa.js

@@ -1 +1 @@
-import"./primitives-CqrjmIAH.js";import"./sessionPolicy-CBTZQe1n.js";import"./signingSessionSeal-DX41aXUL.js";import{t as e}from"./host-h55onlkx.js";import"./activeWalletSession-WdZkhtBB.js";import"./capabilityKinds-N8xo_IEh.js";import"./errors-DIWY1KR9.js";e({supportedRuntimeRouteKinds:new Set([`auth`,`ecdsa`,`email_otp`,`export`,`recovery`,`preferences`])});
+import"./primitives-CqrjmIAH.js";import"./sessionPolicy-CBTZQe1n.js";import"./signingSessionSeal-DX41aXUL.js";import{t as e}from"./host-CCwkhJHK.js";import"./activeWalletSession-WdZkhtBB.js";import"./capabilityKinds-N8xo_IEh.js";import"./errors-DIWY1KR9.js";e({supportedRuntimeRouteKinds:new Set([`auth`,`ecdsa`,`email_otp`,`export`,`recovery`,`preferences`])});

package/dist/public/sdk/wallet-iframe-host-full.js

@@ -1 +1 @@
-import"./primitives-CqrjmIAH.js";import"./sessionPolicy-CBTZQe1n.js";import"./signingSessionSeal-DX41aXUL.js";import{t as e}from"./host-h55onlkx.js";import"./activeWalletSession-WdZkhtBB.js";import"./capabilityKinds-N8xo_IEh.js";import"./errors-DIWY1KR9.js";e();
+import"./primitives-CqrjmIAH.js";import"./sessionPolicy-CBTZQe1n.js";import"./signingSessionSeal-DX41aXUL.js";import{t as e}from"./host-CCwkhJHK.js";import"./activeWalletSession-WdZkhtBB.js";import"./capabilityKinds-N8xo_IEh.js";import"./errors-DIWY1KR9.js";e();

package/dist/public/sdk/wallet-iframe-host-near.js

@@ -1 +1 @@
-import"./primitives-CqrjmIAH.js";import"./sessionPolicy-CBTZQe1n.js";import"./signingSessionSeal-DX41aXUL.js";import{t as e}from"./host-h55onlkx.js";import"./activeWalletSession-WdZkhtBB.js";import"./capabilityKinds-N8xo_IEh.js";import"./errors-DIWY1KR9.js";e({supportedRuntimeRouteKinds:new Set([`auth`,`near`,`export`,`device_link`,`recovery`,`preferences`])});
+import"./primitives-CqrjmIAH.js";import"./sessionPolicy-CBTZQe1n.js";import"./signingSessionSeal-DX41aXUL.js";import{t as e}from"./host-CCwkhJHK.js";import"./activeWalletSession-WdZkhtBB.js";import"./capabilityKinds-N8xo_IEh.js";import"./errors-DIWY1KR9.js";e({supportedRuntimeRouteKinds:new Set([`auth`,`near`,`export`,`device_link`,`recovery`,`preferences`])});

package/dist/public/sdk/wallet-iframe-host-runtime.js

@@ -1 +1 @@
-import"./primitives-CqrjmIAH.js";import"./sessionPolicy-CBTZQe1n.js";import"./signingSessionSeal-DX41aXUL.js";import{t as e}from"./host-h55onlkx.js";import"./activeWalletSession-WdZkhtBB.js";import"./capabilityKinds-N8xo_IEh.js";import"./errors-DIWY1KR9.js";export{e as initWalletIFrame};
+import"./primitives-CqrjmIAH.js";import"./sessionPolicy-CBTZQe1n.js";import"./signingSessionSeal-DX41aXUL.js";import{t as e}from"./host-CCwkhJHK.js";import"./activeWalletSession-WdZkhtBB.js";import"./capabilityKinds-N8xo_IEh.js";import"./errors-DIWY1KR9.js";export{e as initWalletIFrame};

package/dist/public/wallet-assets.manifest.json

@@ -1,14 +1,14 @@
 {
   "schemaVersion": 1,
   "packageName": "@seams/wallet",
-  "packageVersion": "0.9.4",
+  "packageVersion": "0.10.1",
   "assetRoot": "dist/public",
   "sdkBasePath": "/sdk",
   "walletServicePath": "/wallet-service",
   "headersManifest": "headers.manifest.json",
   "versionSkewContract": {
     "kind": "wallet_iframe_protocol_handshake",
-    "packageVersion": "0.9.4",
+    "packageVersion": "0.10.1",
     "protocolVersion": "15.0.0",
     "readyPayloadField": "protocolVersion",
     "failureMode": "typed_error",
@@ -970,8 +970,8 @@
       ]
     },
     {
-      "route": "/sdk/host-h55onlkx.js",
-      "sourceFile": "sdk/host-h55onlkx.js",
+      "route": "/sdk/host-CCwkhJHK.js",
+      "sourceFile": "sdk/host-CCwkhJHK.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1210,8 +1210,8 @@
       ]
     },
     {
-      "route": "/sdk/nearEd25519YaoMaterialActivation-CvDs4RtV.js",
-      "sourceFile": "sdk/nearEd25519YaoMaterialActivation-CvDs4RtV.js",
+      "route": "/sdk/nearEd25519YaoMaterialActivation-DMGPKrn8.js",
+      "sourceFile": "sdk/nearEd25519YaoMaterialActivation-DMGPKrn8.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1618,8 +1618,8 @@
       ]
     },
     {
-      "route": "/sdk/registration-Cfg9rWhA.js",
-      "sourceFile": "sdk/registration-Cfg9rWhA.js",
+      "route": "/sdk/registration-Cx_f58rb.js",
+      "sourceFile": "sdk/registration-Cx_f58rb.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1834,8 +1834,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-auth-Ch4qvKL2.js",
-      "sourceFile": "sdk/runtime-auth-Ch4qvKL2.js",
+      "route": "/sdk/runtime-auth-Cjvf3UFB.js",
+      "sourceFile": "sdk/runtime-auth-Cjvf3UFB.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1858,8 +1858,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-device-link-DtNpEjq5.js",
-      "sourceFile": "sdk/runtime-device-link-DtNpEjq5.js",
+      "route": "/sdk/runtime-device-link-BCKuKNp1.js",
+      "sourceFile": "sdk/runtime-device-link-BCKuKNp1.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1882,8 +1882,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-ecdsa-tempo-Bntp_Zgx.js",
-      "sourceFile": "sdk/runtime-ecdsa-tempo-Bntp_Zgx.js",
+      "route": "/sdk/runtime-ecdsa-tempo-Bpmv6fe0.js",
+      "sourceFile": "sdk/runtime-ecdsa-tempo-Bpmv6fe0.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1906,8 +1906,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-email-otp-DEFt-Y-_.js",
-      "sourceFile": "sdk/runtime-email-otp-DEFt-Y-_.js",
+      "route": "/sdk/runtime-email-otp-Bp16EG2j.js",
+      "sourceFile": "sdk/runtime-email-otp-Bp16EG2j.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1930,8 +1930,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-export-DE_umiS1.js",
-      "sourceFile": "sdk/runtime-export-DE_umiS1.js",
+      "route": "/sdk/runtime-export-fONYqIZg.js",
+      "sourceFile": "sdk/runtime-export-fONYqIZg.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1954,8 +1954,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-near-uXqcLEz8.js",
-      "sourceFile": "sdk/runtime-near-uXqcLEz8.js",
+      "route": "/sdk/runtime-near-s4rtAbA2.js",
+      "sourceFile": "sdk/runtime-near-s4rtAbA2.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1978,8 +1978,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-preferences-C49p0VLC.js",
-      "sourceFile": "sdk/runtime-preferences-C49p0VLC.js",
+      "route": "/sdk/runtime-preferences-1v5EHalc.js",
+      "sourceFile": "sdk/runtime-preferences-1v5EHalc.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2026,8 +2026,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-recovery-D7wklehP.js",
-      "sourceFile": "sdk/runtime-recovery-D7wklehP.js",
+      "route": "/sdk/runtime-recovery-mppuqUaS.js",
+      "sourceFile": "sdk/runtime-recovery-mppuqUaS.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2146,8 +2146,8 @@
       ]
     },
     {
-      "route": "/sdk/shared-D6RYxvYR.js",
-      "sourceFile": "sdk/shared-D6RYxvYR.js",
+      "route": "/sdk/shared-Big0VQEK.js",
+      "sourceFile": "sdk/shared-Big0VQEK.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2386,8 +2386,8 @@
       ]
     },
     {
-      "route": "/sdk/signNear-DR50cpes.js",
-      "sourceFile": "sdk/signNear-DR50cpes.js",
+      "route": "/sdk/signNear-D0tlQXb9.js",
+      "sourceFile": "sdk/signNear-D0tlQXb9.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",

package/dist/public/wallet-service/index.html

@@ -5,14 +5,14 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Web3Authn Wallet Service</title>
     <!-- Surface styles are external so strict CSP can keep style-src 'self' -->
-    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.9.4" />
+    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.10.1" />
     <!-- Minimal shims some ESM bundles expect (externalized to enable strict CSP) -->
-    <script src="/sdk/wallet-shims.js?v=0.9.4"></script>
+    <script src="/sdk/wallet-shims.js?v=0.10.1"></script>
     <!-- Hint the browser to fetch the host script earlier -->
-    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.9.4" crossorigin>
+    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.10.1" crossorigin>
   </head>
   <body>
     <!-- sdkBasePath points to the SDK root (e.g. '/sdk'). Load the host directly. -->
-    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.9.4"></script>
+    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.10.1"></script>
   </body>
 </html>

package/dist/types/shared-ts/src/utils/walletManagementProtocol.d.ts

@@ -1,3 +1,3 @@
 export declare const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
-export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "3";
+export declare const WALLET_MANAGEMENT_PROTOCOL_VERSION = "4";
 //# sourceMappingURL=walletManagementProtocol.d.ts.map

package/dist/types/wallet/src/SeamsWeb/signingSurface/BrowserSigningSurface.d.ts

@@ -14,7 +14,7 @@ import { establishEvmFamilyCustodyV1, joinEvmFamilyCustodyV1 } from '../../core/
 import { type WalletSessionEd25519RecoveryBasisV1 } from '../../core/signingEngine/walletCustody/walletRecoveryEd25519';
 import { recoverWalletCustodyManifestV1 } from '../../core/signingEngine/walletCustody/walletRecoveryManifest';
 import { type LoadedWalletCustodyEd25519MaterialV1, type WalletCustodyEd25519MaterialBindingV1, type WalletCustodySealedEd25519MaterialV1 } from '../../core/signingEngine/walletCustody/ed25519SeedMaterial';
-import type { EstablishedWalletCustodyEvmFamilyKeySetV1, EstablishedWalletCustodyNearEd25519KeySetV1, JoinedWalletCustodyNearEd25519KeySetV1, JoinedWalletCustodyEvmFamilyKeySetV1, RejoinedWalletCustodyEvmFamilyKeySetV1 } from './ports';
+import type { EstablishWalletCustodyNearEd25519KeySetArgs, EstablishedWalletCustodyEvmFamilyKeySetV1, EstablishedWalletCustodyNearEd25519KeySetV1, JoinedWalletCustodyNearEd25519KeySetV1, JoinedWalletCustodyEvmFamilyKeySetV1, RejoinedWalletCustodyEvmFamilyKeySetV1 } from './ports';
 import { type RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import type { RouterAbTraceContextV1 } from '../../../../shared-ts/src/utils/routerAbTraceContext';
 import type { SignerWorkerKind, SignerWorkerOperationRequest, SignerWorkerOperationResult, SignerWorkerOperationType, EmailOtpYaoPrewarmRequest, EmailOtpYaoPrewarmOutcome } from '../../core/signingEngine/workerManager/workerTypes';
@@ -133,21 +133,7 @@ export declare class BrowserSigningSurface {
      * PRF-derived path used, so the execute request goes to the same endpoint
      * with the same trace context — only the root behind it changed.
      */
-    establishWalletCustodyNearEd25519KeySet(args: {
-        readonly home: WalletSessionHome;
-        walletId: string;
-        factorJson: string;
-        factorSecret: ArrayBuffer;
-        nearEd25519SigningKeyId: string;
-        registrationCeremonyId: string;
-        admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
-        admissionReceipt: unknown;
-        participantIds: readonly [number, number];
-        routerOrigin: string;
-        /** The signed setup: the Router authorizes the execute round against it. */
-        authorization: string;
-        traceContext?: RouterAbTraceContextV1;
-    }): Promise<EstablishedWalletCustodyNearEd25519KeySetV1>;
+    establishWalletCustodyNearEd25519KeySet(args: EstablishWalletCustodyNearEd25519KeySetArgs): Promise<EstablishedWalletCustodyNearEd25519KeySetV1>;
     recoverWalletCustodyManifest(args: Omit<Parameters<typeof recoverWalletCustodyManifestV1>[0], 'runStep' | 'workerCtx'>): Promise<Awaited<ReturnType<typeof recoverWalletCustodyManifestV1>>>;
     createWalletRecoveryReplacementCredential(args: {
         readonly walletId: WalletId;

package/dist/types/wallet/src/SeamsWeb/signingSurface/ports.d.ts

@@ -44,6 +44,7 @@ import type { EcdsaBootstrapRequest } from '../../core/signingEngine/session/pas
 import type { ConnectEd25519SessionArgs } from '../../core/signingEngine/session/passkey/public';
 import type { HydrateWarmSigningSessionInput } from '../../core/signingEngine/session/passkey/warmSessionHydration';
 import type { LoginWithEmailOtpWalletCustodyEd25519Args } from '../../core/signingEngine/walletCustody/ed25519Login';
+import type { EstablishNearEd25519CustodyFactor } from '../../core/signingEngine/walletCustody/registrationCeremony';
 import type { EmailOtpEd25519YaoRecoveryBootstrapV1 } from '../../core/signingEngine/workerManager/workerTypes';
 import type { RouterAbEd25519YaoActiveClientMetadataV1 } from '../../core/signingEngine/threshold/ed25519/yaoClient';
 import type { RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../shared-ts/src/utils/routerAbEd25519Yao';
@@ -226,21 +227,7 @@ export interface WalletCustodyCeremonySurface {
         recoveryChallengeId: string;
         relayUrl: string;
     }): Promise<RecoveredWalletCustodyManifestV1>;
-    establishWalletCustodyNearEd25519KeySet(args: {
-        readonly home: WalletSessionHome;
-        walletId: string;
-        factorJson: string;
-        factorSecret: ArrayBuffer;
-        nearEd25519SigningKeyId: string;
-        registrationCeremonyId: string;
-        admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
-        admissionReceipt: unknown;
-        participantIds: readonly [number, number];
-        routerOrigin: string;
-        /** The signed setup: the Router authorizes the execute round against it. */
-        authorization: string;
-        traceContext?: RouterAbTraceContextV1;
-    }): Promise<EstablishedWalletCustodyNearEd25519KeySetV1>;
+    establishWalletCustodyNearEd25519KeySet(args: EstablishWalletCustodyNearEd25519KeySetArgs): Promise<EstablishedWalletCustodyNearEd25519KeySetV1>;
     joinWalletCustodyNearEd25519KeySet(args: {
         readonly routing: WalletSessionHome | {
             readonly kind: 'discovery';
@@ -609,4 +596,26 @@ export type WalletRecoverySigningSurface = AccountSyncSigningSurface & Ed25519Ya
 export type WalletRecoveryWebContext = SeamsWebBaseContext<WalletRecoverySigningSurface>;
 export type DeviceLinkingSigningSurface = LocalLoginStateSurface & LoginUnlockSigningSurface & NearSigningSurface & EmailOtpRegistrationEnrollmentSurface & Pick<SigningSessionSurface, 'hydrateSigningSession'> & RpIdSurface & WebAuthnRegistrationConfirmationSurface & Pick<UserProfileStoreSurface & RegistrationAccountSurface, 'storeUserData' | 'storeAuthenticator'> & Pick<EcdsaRegistrationSurface, 'storeWalletEcdsaSignerRecords'>;
 export type DeviceLinkingWebContext = SeamsWebBaseContext<DeviceLinkingSigningSurface>;
+export type EstablishWalletCustodyNearEd25519KeySetArgs = {
+    readonly home: WalletSessionHome;
+    walletId: string;
+    /** The factor that seals the custody: at hand, or asked for after the Router round. */
+    factor: EstablishNearEd25519CustodyFactor;
+    /**
+     * Sends the execute request together with the registration proof. It
+     * returns the activation result, or `null` when the Gateway admitted the
+     * registration and did not complete the execution: the run then sends the
+     * same request to the execute route.
+     */
+    executeWithProof?: (yaoExecuteRequestJson: string) => Promise<string | null>;
+    nearEd25519SigningKeyId: string;
+    registrationCeremonyId: string;
+    admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+    admissionReceipt: unknown;
+    participantIds: readonly [number, number];
+    routerOrigin: string;
+    /** The signed setup: the Router authorizes the execute round against it. */
+    authorization: string;
+    traceContext?: RouterAbTraceContextV1;
+};
 //# sourceMappingURL=ports.d.ts.map

package/dist/types/wallet/src/core/rpcClients/relayer/walletRegistration.d.ts

@@ -11,7 +11,7 @@ import type { RegistrationEstablishedSessionResultV2 } from '../../../../../shar
 import { type RootShareEpoch, type ThresholdEd25519SessionId, type WalletAuthMethodId } from '../../../../../shared-ts/src/utils/domainIds';
 import { type WebAuthnAuthenticatorDeviceInfo } from '../../../../../shared-ts/src/utils/webauthnDeviceInfo';
 import type { EcdsaKeyFactsInventoryWalletSessionCredential } from '../../types/sdkSentEvents';
-import { type RouterAbEd25519YaoActivationAdmissionReceiptV1, type RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import { type RouterAbEd25519YaoActivationAdmissionReceiptV1, type RouterAbEd25519YaoActivationExecuteRequestV1, type RouterAbEd25519YaoActivationResultV1, type RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import type { CreateRegistrationIntentRequest, WalletEd25519YaoSignerPublicResult, WalletRegistrationEd25519YaoActivationReference, WalletRegistrationEd25519YaoStart, WalletRegistrationFinalizeAuthMethod } from '../../../../../shared-ts/src/utils/registrationContracts';
 import { type WalletAuthAuthority } from '../../../../../shared-ts/src/utils/walletAuthAuthority';
 import { type RouterAbEd25519NormalSigningState } from '../../../../../shared-ts/src/utils/signingSessionSeal';
@@ -132,12 +132,31 @@ type WalletRegistrationSetupSuccessBase = {
     intent: RegistrationIntentV1;
     signedSetup: string;
 };
+/**
+ * What setup says about the Yao admission of an Ed25519-only plan.
+ *
+ * `described` holds the admission that respond will issue. Nothing is
+ * admitted yet: the client only prepares its protocol inputs from it while
+ * the user answers the passkey prompt, and sends them with the proof.
+ * `after_proof` means that respond is the first to state the admission.
+ */
+export type WalletRegistrationSetupEd25519Admission = {
+    readonly status: 'described';
+    readonly admissionRequest: WalletRegistrationEd25519YaoStart['admissionRequest'];
+    readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+} | {
+    readonly status: 'after_proof';
+    readonly admissionRequest?: never;
+    readonly admissionReceipt?: never;
+};
 export type WalletRegistrationSetupSuccessV2 = (WalletRegistrationSetupSuccessBase & {
     kind: 'evm_family_ecdsa' | 'near_ed25519_and_evm_family_ecdsa';
     ecdsa: WalletRegistrationSetupEcdsaPreparePayload;
+    ed25519?: never;
 }) | (WalletRegistrationSetupSuccessBase & {
     kind: 'near_ed25519';
     ecdsa?: never;
+    ed25519: WalletRegistrationSetupEd25519Admission;
 });
 export type WalletRegistrationSetupResponseV2 = WalletRegistrationSetupSuccessV2 | {
     ok: false;
@@ -578,11 +597,24 @@ export type WalletRegistrationRespondResponseV2 = {
     registrationCeremonyId: string;
     kind: 'near_ed25519';
     ecdsa?: never;
-    ed25519: {
-        readonly status: 'admitted';
-        readonly admissionRequest: WalletRegistrationEd25519YaoStart['admissionRequest'];
-        readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
-    };
+    ed25519: WalletRegistrationRespondEd25519Admission;
+};
+/**
+ * `executed` answers a respond that carried the execute request: the Gateway
+ * admitted, ran the execution and returns what the execute route returns.
+ * `admitted` answers every other respond and one whose execution did not
+ * complete: the client then runs the execution through the execute route.
+ */
+export type WalletRegistrationRespondEd25519Admission = {
+    readonly status: 'admitted';
+    readonly admissionRequest: WalletRegistrationEd25519YaoStart['admissionRequest'];
+    readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+    readonly activationResult?: never;
+} | {
+    readonly status: 'executed';
+    readonly admissionRequest: WalletRegistrationEd25519YaoStart['admissionRequest'];
+    readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+    readonly activationResult: RouterAbEd25519YaoActivationResultV1<'registration'>;
 };
 export type WalletRegistrationNearAdmissionResponseV2 = {
     ok: true;
@@ -606,9 +638,15 @@ type WalletRegistrationRespondEcdsaRequest = {
 type RespondWalletRegistrationArgs = (RespondWalletRegistrationArgsBase & {
     signerPlanKind: 'near_ed25519';
     ecdsa?: never;
+    /**
+     * The execute request that the client prepared from the admission that
+     * setup described. The Gateway admits, then runs it in this request.
+     */
+    ed25519Execution?: RouterAbEd25519YaoActivationExecuteRequestV1<'registration'>;
 }) | (RespondWalletRegistrationArgsBase & {
     signerPlanKind: Exclude<WalletRegistrationSignerPlanKind, 'near_ed25519'>;
     ecdsa: WalletRegistrationRespondEcdsaRequest;
+    ed25519Execution?: never;
 });
 export declare function respondWalletRegistration(args: RespondWalletRegistrationArgs): Promise<WalletRegistrationRespondResponseV2>;
 export declare function authorizeWalletRegistrationNearAdmission(args: RespondWalletRegistrationArgsBase): Promise<WalletRegistrationNearAdmissionResponseV2>;

package/dist/types/wallet/src/core/signingEngine/walletCustody/ceremonyDriver.d.ts

@@ -44,6 +44,20 @@ type WalletCustodyCeremonyCustodyInput = {
     readonly factorJson: string;
     readonly factorSecret: ArrayBuffer;
     readonly recoveryCodesJson: string;
+} | {
+    /**
+     * Establishes custody for a NEAR key set whose factor exists only after
+     * the protocol round: a passkey that the user creates while this run
+     * prepares its inputs. The seed is sealed at the end of the run, so the
+     * run begins without the factor and asks for it once, after the round.
+     */
+    readonly origin: 'establish_factor_after_round';
+    readonly walletId: string;
+    readonly recoveryCodesJson: string;
+    readonly factor: () => Promise<{
+        readonly factorJson: string;
+        readonly factorSecret: ArrayBuffer;
+    }>;
 } | {
     readonly origin: 'join';
     /** `JoinCustodyWireV1`: the envelope binding and its sealed seed. */

package/dist/types/wallet/src/core/signingEngine/walletCustody/registrationCeremony.d.ts

@@ -11,13 +11,31 @@ import { type WalletCustodyCeremonyStepRunner } from './ceremonyDriver';
  * that are not shown are codes nobody can ever produce, and a payload committed
  * without its codes leaves a wallet whose owner holds nothing.
  */
-type EstablishNearEd25519CustodyInput = {
-    readonly runStep: WalletCustodyCeremonyStepRunner;
-    readonly walletId: string;
+/**
+ * The factor that seals the new custody. A passkey that the user creates
+ * while the run prepares its inputs exists only after the Router round, so
+ * the run can take it then instead of at its start.
+ */
+export type EstablishNearEd25519CustodyFactor = {
     /** The passkey or Email OTP factor, as the envelope will name it. */
     readonly factorJson: string;
     /** `PRF.first` or the Email OTP factor key. Owned by the caller. */
     readonly factorSecret: ArrayBuffer;
+    readonly factorAfterRouterRound?: never;
+} | {
+    readonly factorJson?: never;
+    readonly factorSecret?: never;
+    /** Asked once, after the Router round returned. The caller owns the secret. */
+    readonly factorAfterRouterRound: () => Promise<{
+        readonly factorJson: string;
+        readonly factorSecret: ArrayBuffer;
+    }>;
+};
+type EstablishNearEd25519CustodyInput = EstablishNearEd25519CustodyFactor & NearEd25519CustodyRunInput;
+/** What every NEAR custody run takes, whichever factor reaches its seed. */
+type NearEd25519CustodyRunInput = {
+    readonly runStep: WalletCustodyCeremonyStepRunner;
+    readonly walletId: string;
     readonly nearEd25519SigningKeyId: string;
     /** The Yao lifecycle this run registers under, and route 4's own scope. */
     readonly registrationCeremonyId: string;
@@ -171,7 +189,9 @@ export declare function walletCustodyCommitPayloadForWire(payload: WalletCustody
  * *establish* a key set — registering a second, different key for a wallet
  * that already has one, which no later check would undo.
  */
-type RejoinNearEd25519CustodyInput = Omit<EstablishNearEd25519CustodyInput, 'factorJson' | 'registrationCeremonyId'> & {
+type RejoinNearEd25519CustodyInput = Omit<NearEd25519CustodyRunInput, 'registrationCeremonyId'> & {
+    /** Opens the stored envelope. Owned by the caller. */
+    readonly factorSecret: ArrayBuffer;
     /** `JoinCustodyWireV1`: the stored envelope binding and its sealed seed. */
     readonly custodyJson: string;
     readonly recoveryLifecycleId: string;
@@ -189,7 +209,9 @@ type RejoinedNearEd25519Custody = JoinedNearEd25519CustodyBase & {
     readonly activationResultJson: string;
     readonly activationReceipt: RouterAbEd25519YaoRecoveryActivationReceiptV1;
 };
-type JoinNearEd25519CustodyInput = Omit<EstablishNearEd25519CustodyInput, 'walletId' | 'factorJson' | 'continuityRegisteredPublicKeyB64u'> & {
+type JoinNearEd25519CustodyInput = Omit<NearEd25519CustodyRunInput, 'walletId' | 'continuityRegisteredPublicKeyB64u'> & {
+    /** Opens the envelope that another key set established. Owned by the caller. */
+    readonly factorSecret: ArrayBuffer;
     readonly preparation: {
         readonly kind: 'fresh';
     } | {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet",
-  "version": "0.9.4",
+  "version": "0.10.1",
   "type": "module",
   "description": "Seams web and runtime TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",