kokio-sdk 1.0.0 → 2.0.0

package/dist/types/logic/P256Verifier.d.ts

@@ -1,4 +1,4 @@
 import { Hex } from "viem";
 import { WebAuthnSignature } from "../types.js";
-import { SmartAccountClient } from "@aa-sdk/core";
-export declare const _verifySignature: (client: SmartAccountClient, message: Hex, requireMessageVerification: boolean, webAuthnSignature: WebAuthnSignature, x: bigint, y: bigint) => Promise<boolean>;
+import { KokioSmartAccountClient } from "../types.js";
+export declare const _verifySignature: (client: KokioSmartAccountClient, message: Hex, requireMessageVerification: boolean, webAuthnSignature: WebAuthnSignature, x: bigint, y: bigint) => Promise<boolean>;

package/dist/types/logic/account-kit/createSmartAccount.d.ts

@@ -1,6 +1,5 @@
-import { SmartContractAccount, SmartAccountClient } from "@aa-sdk/core";
-import { type SignableMessage, WalletClient, Hex, TypedDataDefinition, TypedData } from "viem";
-import { P256Key, WebAuthnSignature } from "../../types.js";
+import { type SignableMessage, WalletClient, Hex, Address, TypedDataDefinition, TypedData } from "viem";
+import { P256Key, WebAuthnSignature, KokioSmartAccount, KokioSmartAccountClient } from "../../types.js";
 /**
  * BeaconProxy creation bytecode, used to compute the CREATE2 counterfactual
  * DeviceWallet address off-chain (initCode = creationCode ++ abi.encode(beacon, initData)).
@@ -9,35 +8,60 @@ import { P256Key, WebAuthnSignature } from "../../types.js";
  * DeviceWalletFactory deploys, or the computed address will diverge from the
  * deployed one. Source of truth:
  *   OpenZeppelin Contracts v5.0.0 - proxy/beacon/BeaconProxy.sol
- *   compiled by Hardhat (smart-contract-suite `artifacts/@openzeppelin/contracts/
- *   proxy/beacon/BeaconProxy.sol/BeaconProxy.json`), solc 0.8.25+commit.b61c2a91,
- *   optimizer { enabled: true, runs: 200 }, viaIR: true.
- * NOTE: the Foundry `out/` artifact (different optimizer settings) produces a
- * DIFFERENT bytecode - do not swap it in without re-verifying the counterfactual.
- * `_assertCounterfactualMatchesOnChain` guards against drift at runtime.
+ *   smart-contract-suite `deployments/base-sepolia-84532-entrypoint-v8.json`,
+ *   section `create2`, solc 0.8.36, optimizer runs 10000000, viaIR: true,
+ *   evm target osaka. Hash: 0xc571dd76379a732e12f1973fa9f4cbbaeb1702bb0ace06e5beb7e2b56cd03c6b.
+ * NOTE: a different optimizer/compiler setting produces a DIFFERENT bytecode -
+ * do not swap it in without re-verifying the counterfactual.
+ * `_assertCounterfactualMatchesOnChain` guards against drift; `_getSmartWallet`
+ * runs it once per chain per process.
  */
 export declare const BEACON_PROXY_CREATION_CODE: Hex;
+/**
+ * Stamp is client-side authentication. Since the passkeys are on the user's mobile device
+ * react-native-passkey helps fetch passkey for the user (provided credentialId, rpId).
+ * This is exactly how the WebAuthn.sol contract needs it to be.
+ */
 export declare const _stamp: (credentialId: string, rpId: string, payload: Hex) => Promise<WebAuthnSignature>;
-export declare const _getAccountInitCode: (client: WalletClient, deviceUniqueIdentifier: string, deviceWalletOwnerKey: P256Key, salt: bigint) => Promise<Hex>;
+type Call = {
+    to: Hex;
+    data?: Hex | undefined;
+    value?: bigint | undefined;
+};
+export declare const _encodeCalls: (calls: readonly Call[]) => Promise<Hex>;
+export declare const _getFactoryArgs: (client: WalletClient, deviceUniqueIdentifier: string, deviceWalletOwnerKey: P256Key, salt: bigint) => Promise<{
+    factory: Address;
+    factoryData: Hex;
+}>;
 export declare const getInitCodeHash: (client: WalletClient, deviceUniqueIdentifier: string, deviceWalletOwnerKey: P256Key) => Promise<Hex>;
 export declare const getCounterFactualAddress: (client: WalletClient, deviceUniqueIdentifier: string, deviceWalletOwnerKey: P256Key, salt: bigint) => Promise<Hex>;
 /**
- * Optional drift guard. Recomputes the counterfactual address off-chain (using
- * the pinned {@link BEACON_PROXY_CREATION_CODE}) and compares it against the
+ * Drift guard. Recomputes the counterfactual address off-chain (using the
+ * pinned {@link BEACON_PROXY_CREATION_CODE}) and compares it against the
  * on-chain `DeviceWalletFactory.getCounterFactualAddress` view - which derives
  * the address from the BeaconProxy the factory ACTUALLY deploys. A mismatch
  * means the pinned proxy bytecode (or init encoding) has drifted from the
  * deployed contract, so this throws early instead of letting a UserOp deploy to,
  * or fund, the wrong address.
  *
- * Not wired into the default account-creation path (it costs one extra RPC);
- * call it explicitly in environments where you want the extra safety, e.g.
- * after a contract redeploy or on first use against a new chain.
+ * `_getSmartWallet` runs this once per chain per process; call it directly for
+ * an unconditional check, e.g. right after a contract redeploy.
  */
 export declare const _assertCounterfactualMatchesOnChain: (client: WalletClient, deviceUniqueIdentifier: string, deviceWalletOwnerKey: P256Key, salt: bigint) => Promise<Hex>;
 export declare const _encodeSignature: (webAuthnSignature: WebAuthnSignature, validUntil: number) => Promise<Hex>;
-export declare const _signMessage: (message: SignableMessage, credentialId: string, rpId: string) => Promise<Hex>;
-export declare const _signTypedData: <const typedData extends TypedData | Record<string, unknown>, primaryType extends keyof typedData | "EIP712Domain" = keyof typedData>(typedData: TypedDataDefinition<typedData, primaryType>, credentialId: string, rpId: string) => Promise<Hex>;
+export declare const _signMessage: (message: SignableMessage, credentialId: string, rpId: string, chainId: number, accountAddress: Address) => Promise<Hex>;
+export declare const _signTypedData: <const typedData extends TypedData | Record<string, unknown>, primaryType extends keyof typedData | "EIP712Domain" = keyof typedData>(typedData: TypedDataDefinition<typedData, primaryType>, credentialId: string, rpId: string, chainId: number, accountAddress: Address) => Promise<Hex>;
 export declare const _signUserOperationHash: (credentialId: string, rpId: string, userOpHash: Hex) => Promise<Hex>;
-export declare const _getSmartWallet: (client: WalletClient, credentialId: string, rpId: string, organiationId: string, deviceUniqueIdentifier: string, deviceWalletOwnerKey: P256Key, salt: bigint) => Promise<SmartContractAccount>;
-export declare const _getSmartWalletClient: (client: WalletClient, pimlicoAPIKey: string, gasPolicyId: string, account: SmartContractAccount) => Promise<SmartAccountClient>;
+export declare const _getSmartWallet: (client: WalletClient, credentialId: string, rpId: string, deviceUniqueIdentifier: string, deviceWalletOwnerKey: P256Key, salt: bigint) => Promise<KokioSmartAccount>;
+type RawGasEstimate = Record<string, Hex>;
+/**
+ * Raise the bundler's verification estimates to what a real signature costs.
+ * See `STUB_VERIFICATION_GAS_PAD` for the measurements behind the numbers.
+ *
+ * This sits in the transport because viem binds `prepareUserOperation` to the
+ * client as it was before `.extend` ran, so an `estimateUserOperationGas`
+ * override placed on the client is never the one it calls.
+ */
+export declare const _padGasEstimate: (estimate: RawGasEstimate) => RawGasEstimate;
+export declare const _getSmartWalletClient: (client: WalletClient, pimlicoAPIKey: string, gasPolicyId: string, account: KokioSmartAccount) => Promise<KokioSmartAccountClient>;
+export {};

package/dist/types/logic/admin/deviceWallet.eoa.d.ts

@@ -1,12 +1,18 @@
 import { Address, WalletClient } from "viem";
 /**
- * Admin-EOA logic targeting a specific `DeviceWallet` instance (its address is
- * passed in - there is no single factory address). Both functions are admin
- * gated on chain (`deployESIMWallet` is `onlyESIMWalletAdmin`,
- * `setESIMUniqueIdentifierForAnESIMWallet` is `onlyESIMWalletAdminOrRegistry`),
- * so they cannot be driven from a device-wallet userOp and live on the EOA surface.
+ * Deploy a new eSIM wallet under a device wallet. `onlyESIMWalletAdmin`.
+ *
+ * The bind that follows never carries ETH access: the contract reverts on a
+ * `true` rather than downgrading it quietly, so the SDK passes `false` and there
+ * is nothing to choose. The owner grants access afterwards with
+ * `toggleAccessToETH`, which the admin EOA cannot reach.
  */
-/** Deploy a new eSIM wallet under a device wallet. `onlyESIMWalletAdmin`. */
-export declare const _deployESIMWallet: (client: WalletClient, deviceWalletAddress: Address, hasAccessToETH: boolean, salt: bigint) => Promise<`0x${string}`>;
-/** Bind an eSIM's unique identifier to its wallet. `onlyESIMWalletAdminOrRegistry`. */
-export declare const _setESIMUniqueIdentifierForAnESIMWallet: (client: WalletClient, deviceWalletAddress: Address, eSIMWalletAddress: Address, eSIMUniqueIdentifier: string) => Promise<`0x${string}`>;
+export declare const _deployESIMWallet: (client: WalletClient, deviceWalletAddress: Address, salt: bigint) => Promise<`0x${string}`>;
+/**
+ * Top up a device wallet's gas deposit at the EntryPoint, paid by the admin EOA.
+ *
+ * Open to anyone: paying another account's gas costs the payer and nobody else.
+ * `withdrawDepositTo` is `onlySelf`, so only the wallet's owner can take it back
+ * out, and topping one up is not a way to reach its funds.
+ */
+export declare const _addDeposit: (client: WalletClient, deviceWalletAddress: Address, amount: bigint) => Promise<`0x${string}`>;

package/dist/types/logic/admin/deviceWalletFactory.eoa.d.ts

@@ -1,33 +1,44 @@
-import { Address, WalletClient } from "viem";
-import { P256Key } from "../../types.js";
-/**
- * Admin-EOA logic for `DeviceWalletFactory`.
- *
- * Every function here is `onlyAdmin` / `onlyAdminOrRegistry` / `onlyOwner` on
- * chain, i.e. the caller must be the `eSIMWalletAdmin` (or `upgradeManager`)
- * EOA - never a device-wallet userOp. They therefore live on the EOA surface
- * (`KokioAdmin`) and use `writeContract`, mirroring `_createAccountWithEOA`
- * (which is reused as-is from `../deviceWalletFactory.js`).
- */
+import { Address, Hex, WalletClient } from "viem";
+import { OwnerCall, P256Key } from "../../types.js";
 /**
  * Batch-deploy device wallets for lazy/fiat users. `onlyAdminOrRegistry`,
  * `payable`: `value` is the total ETH pot from which each `depositAmounts[i]`
  * is drawn; any surplus is refunded to the caller on chain.
  */
 export declare const _deployDeviceWalletForUsers: (client: WalletClient, deviceUniqueIdentifiers: Array<string>, deviceWalletOwnersKey: Array<P256Key>, salts: Array<bigint>, depositAmounts: Array<bigint>, value: bigint) => Promise<`0x${string}`>;
-/** Register a freshly created device wallet with the factory. `onlyAdminOrRegistry`. */
-export declare const _postCreateAccount: (client: WalletClient, deviceWallet: Address, deviceUniqueIdentifier: string, deviceWalletOwnerKey: P256Key) => Promise<`0x${string}`>;
-/** One-time wiring of the registry into the factory. `onlyAdmin`. */
-export declare const _addRegistryAddress: (client: WalletClient, registryContractAddress: Address) => Promise<`0x${string}`>;
-/** Update the vault that receives eSIM payments. `onlyAdmin`. */
-export declare const _updateVaultAddress: (client: WalletClient, newVaultAddress: Address) => Promise<`0x${string}`>;
-/** Step 1 of the 2-step admin handover: propose a new admin. `onlyAdmin`. */
-export declare const _requestAdminUpdate: (client: WalletClient, newAdmin: Address) => Promise<`0x${string}`>;
 /**
- * Step 2 of the 2-step admin handover: the proposed admin accepts. The chain
- * requires `msg.sender` to equal the pending admin, so the `client` here must
- * be the newly proposed admin EOA.
+ * Register a freshly created device wallet with the factory. `onlyAdminOrRegistry`.
+ * The salt has to be the one the deploying `createAccount` used, since the
+ * factory rederives the counterfactual address from it to check the wallet.
  */
-export declare const _acceptAdminUpdate: (client: WalletClient) => Promise<`0x${string}`>;
+export declare const _postCreateAccount: (client: WalletClient, deviceWallet: Address, deviceUniqueIdentifier: string, deviceWalletOwnerKey: P256Key, salt: bigint) => Promise<`0x${string}`>;
+/** One-time wiring of the registry into the factory. `onlyAdmin`. */
+export declare const _addRegistryAddress: (client: WalletClient, registryContractAddress: Address) => Promise<`0x${string}`>;
 /** Point the device-wallet beacon at a new implementation. `onlyOwner` (upgradeManager). */
 export declare const _updateDeviceWalletImplementation: (client: WalletClient, newDeviceImpl: Address) => Promise<`0x${string}`>;
+/**
+ * Offer ownership to a new address. Pass the result to `schedule`.
+ *
+ * Ownable2Step, so the offer changes nothing until the named address calls
+ * `acceptOwnership`. Note this hands over the beacon too, since the factory owns
+ * it, so the new owner can move every deployed device wallet at once.
+ */
+export declare const _transferOwnershipCall: (client: WalletClient, newOwner: Address) => Promise<OwnerCall>;
+/**
+ * Point the factory's own proxy at a new implementation. Builds
+ * `upgradeToAndCall`. Pass the result to `schedule`.
+ *
+ * This does not touch deployed device wallets. They read their implementation
+ * from the beacon, which moves through `updateDeviceWalletImplementation`
+ * instead. Changing what the factory deploys next is a beacon update, not this.
+ */
+export declare const _upgradeCall: (client: WalletClient, newImplementation: Address, data?: Hex) => Promise<OwnerCall>;
+/**
+ * Take ownership after a `transferOwnership` named this client. `msg.sender`
+ * must equal `pendingOwner`, so the `client` is the incoming owner.
+ *
+ * Where the incoming owner is the timelock, use
+ * `protocolAdmin.acceptOwnershipBatch` instead, which accepts for every contract
+ * at once.
+ */
+export declare const _acceptOwnership: (client: WalletClient) => Promise<`0x${string}`>;

package/dist/types/logic/admin/eSIMWallet.eoa.d.ts

@@ -1,10 +1,5 @@
 import { Address, WalletClient } from "viem";
 import { DataBundleDetails } from "../../types.js";
-/**
- * Admin-EOA logic targeting a specific `ESIMWallet` instance (address passed in).
- * `buyDataBundle` is `onlyDeviceWalletOrESIMWalletAdmin`, so the admin EOA can
- * call it directly.
- */
 /**
  * Buy a data bundle for an eSIM wallet. `onlyDeviceWalletOrESIMWalletAdmin`,
  * `payable`. `value` is optional: the contract pulls any shortfall from the

package/dist/types/logic/admin/eSIMWalletFactory.eoa.d.ts

@@ -1,13 +1,31 @@
-import { Address, WalletClient } from "viem";
-/**
- * Admin-EOA logic for `ESIMWalletFactory`. Both functions are owner-gated
- * (`addRegistryAddress` requires `msg.sender == owner()`, `updateESIMWalletImplementation`
- * is `onlyOwner`), so the `client` must carry the `upgradeManager` EOA.
- *
- * Note: `ESIMWalletFactory.deployESIMWallet` is intentionally NOT exposed - it is
- * `onlyRegistryOrDeviceWalletFactoryOrDeviceWallet`, so a bare EOA always reverts.
- */
+import { Address, Hex, WalletClient } from "viem";
+import type { OwnerCall } from "../../types.js";
 /** One-time wiring of the registry into the eSIM factory. Owner only. */
 export declare const _addRegistryAddress: (client: WalletClient, registryContractAddress: Address) => Promise<`0x${string}`>;
 /** Point the eSIM-wallet beacon at a new implementation. `onlyOwner`. */
 export declare const _updateESIMWalletImplementation: (client: WalletClient, eSIMWalletImpl: Address) => Promise<`0x${string}`>;
+/**
+ * Offer ownership to a new address. Pass the result to `schedule`.
+ *
+ * Ownable2Step, so the offer changes nothing until the named address calls
+ * `acceptOwnership`. Note this hands over the beacon too, since the factory owns
+ * it, so the new owner can move every deployed eSIM wallet at once.
+ */
+export declare const _transferOwnershipCall: (client: WalletClient, newOwner: Address) => Promise<OwnerCall>;
+/**
+ * Point the factory's own proxy at a new implementation. Builds
+ * `upgradeToAndCall`. Pass the result to `schedule`.
+ *
+ * This does not touch deployed eSIM wallets. They read their implementation from
+ * the beacon, which moves through `updateESIMWalletImplementation` instead.
+ */
+export declare const _upgradeCall: (client: WalletClient, newImplementation: Address, data?: Hex) => Promise<OwnerCall>;
+/**
+ * Take ownership after a `transferOwnership` named this client. `msg.sender`
+ * must equal `pendingOwner`, so the `client` is the incoming owner.
+ *
+ * Where the incoming owner is the timelock, use
+ * `protocolAdmin.acceptOwnershipBatch` instead, which accepts for every contract
+ * at once.
+ */
+export declare const _acceptOwnership: (client: WalletClient) => Promise<`0x${string}`>;

package/dist/types/logic/admin/lazyWalletRegistry.eoa.d.ts

@@ -1,18 +1,110 @@
-import { WalletClient } from "viem";
-import { DataBundleDetails, P256Key } from "../../types.js";
+import { Address, Hex, WalletClient } from "viem";
+import type { DataBundleDetails, LazyDeployment, LazyHistoryCopy, OwnerCall, P256Key } from "../../types.js";
 /**
- * Admin-EOA logic for `LazyWalletRegistry`. All three functions are
- * `onlyESIMWalletAdmin` on chain, so they can only succeed from the admin EOA -
- * a device-wallet userOp (whose sender is the smart account) always reverts.
- * This is why they belong on the EOA surface rather than the mobile userOp one.
+ * The contract's own caps, mirrored here because they are `constant` on chain and
+ * reading them would cost a round trip on every call. The fork tier checks these
+ * against the live deployment, so an upgrade that moved one would fail there
+ * rather than turning every call into a reverted transaction.
  */
+export declare const MAX_ESIM_WALLETS_PER_CALL = 20n;
+export declare const MAX_HISTORY_ENTRIES_PER_CALL = 50n;
+/**
+ * Default batch sizes, both below the caps above.
+ *
+ * A continuation call costs about 28,000 gas before it deploys anything, against
+ * roughly 556,000 per eSIM wallet, so a smaller batch buys headroom for almost
+ * nothing: running a 45 eSIM device at 10 rather than 20 costs about 0.4% more
+ * gas in total. That headroom matters because a full batch of 20 measures between
+ * 9.3M and 11.8M gas depending on identifier length and storage warmth, which is
+ * uncomfortably close to a per-transaction gas ceiling.
+ */
+export declare const DEFAULT_ESIM_WALLETS_PER_CALL = 10n;
+export declare const DEFAULT_HISTORY_ENTRIES_PER_CALL = 25n;
 /** Record fiat/lazy purchase history for a batch of devices. `onlyESIMWalletAdmin`. */
 export declare const _batchPopulateHistory: (client: WalletClient, deviceUniqueIdentifiers: Array<string>, eSIMUniqueIdentifiers: Array<Array<string>>, dataBundleDetails: Array<Array<DataBundleDetails>>) => Promise<`0x${string}`>;
 /**
- * Materialise a lazily-provisioned device wallet and its eSIMs on chain.
- * `onlyESIMWalletAdmin`, `payable`: the contract requires `depositAmount == msg.value`,
- * so `value` is set to `depositAmount` here.
+ * Materialise a lazily-provisioned device wallet and the first batch of its eSIMs
+ * on chain. `onlyESIMWalletAdmin`, `payable`: the contract requires
+ * `depositAmount == msg.value`, so `value` is set to `depositAmount` here.
+ *
+ * One transaction. `maxWallets` caps how many eSIM wallets it deploys, and the
+ * contract refuses anything above `MAX_ESIM_WALLETS_PER_CALL` rather than
+ * clamping it. Prefer `_deployLazyWalletAllBatches`, which finishes the device.
+ */
+export declare const _deployLazyWalletAndSetESIMIdentifier: (client: WalletClient, deviceOwnerPublicKey: P256Key, deviceUniqueIdentifier: string, salt: bigint, depositAmount: bigint, maxWallets: bigint) => Promise<`0x${string}`>;
+/**
+ * Deploy the next batch of eSIM wallets for a device the lazy route already
+ * started. `onlyESIMWalletAdmin`.
+ *
+ * One transaction. The contract reads its position from a cursor, so a dropped
+ * transaction is retried by repeating the identical call. It reverts
+ * `AllESIMWalletsDeployed` once nothing is left, which is the terminal condition
+ * rather than a failure.
  */
-export declare const _deployLazyWalletAndSetESIMIdentifier: (client: WalletClient, deviceOwnerPublicKey: P256Key, deviceUniqueIdentifier: string, salt: bigint, depositAmount: bigint) => Promise<`0x${string}`>;
+export declare const _deployMoreESIMWalletsForLazyDevice: (client: WalletClient, deviceUniqueIdentifier: string, maxWallets: bigint) => Promise<`0x${string}`>;
+/**
+ * Copy the next batch of an eSIM's stored purchase history onto its deployed
+ * wallet. `onlyESIMWalletAdmin`.
+ *
+ * One transaction, with its own cursor per eSIM. Reverts `HistoryAlreadyCopied`
+ * once nothing is left. Prefer `_setHistoryForLazyWalletAllBatches`.
+ */
+export declare const _setHistoryForLazyWallet: (client: WalletClient, eSIMIdentifier: string, maxEntries: bigint) => Promise<`0x${string}`>;
 /** Re-point an eSIM identifier from an old device to a new one. `onlyESIMWalletAdmin`. */
 export declare const _switchESIMIdentifierToNewDeviceIdentifier: (client: WalletClient, eSIMIdentifier: string, oldDeviceIdentifier: string, newDeviceIdentifier: string) => Promise<`0x${string}`>;
+/**
+ * Deploy a lazy device and every one of its eSIM wallets, over as many
+ * transactions as that takes. `onlyESIMWalletAdmin`.
+ *
+ * Resumable. A device that is part-deployed, because a batch was dropped or an
+ * earlier call threw, is continued from its cursor instead of being restarted,
+ * so retrying is just calling this again with the same arguments. Pass a deposit
+ * of 0 on a retry: only the first batch is payable and it already took one.
+ *
+ * All of a device's purchase history has to be recorded before this runs. The
+ * first batch creates the device wallet, and `batchPopulateHistory` refuses any
+ * device that has one.
+ *
+ * @param maxWallets eSIM wallets per transaction, 1 to `MAX_ESIM_WALLETS_PER_CALL`.
+ */
+export declare const _deployLazyWalletAllBatches: (client: WalletClient, deviceOwnerPublicKey: P256Key, deviceUniqueIdentifier: string, salt: bigint, depositAmount: bigint, maxWallets?: bigint) => Promise<LazyDeployment>;
+/**
+ * Copy an eSIM's whole stored purchase history onto its wallet, over as many
+ * transactions as that takes. `onlyESIMWalletAdmin`.
+ *
+ * Resumable for the same reason as the deployment: the cursor lives on chain, so
+ * a partly copied eSIM is continued rather than restarted.
+ *
+ * The history cursor is per eSIM and the deploy cursor is per device, so this can
+ * run against an eSIM whose wallet has landed while its siblings are still
+ * undeployed.
+ *
+ * @param maxEntries entries per transaction, 1 to `MAX_HISTORY_ENTRIES_PER_CALL`.
+ */
+export declare const _setHistoryForLazyWalletAllBatches: (client: WalletClient, eSIMIdentifier: string, maxEntries?: bigint) => Promise<LazyHistoryCopy>;
+/**
+ * Offer ownership to a new address. Pass the result to `schedule`.
+ *
+ * Ownable2Step, so the offer changes nothing until the named address calls
+ * `acceptOwnership`. Until then the current owner keeps every power.
+ */
+export declare const _transferOwnershipCall: (client: WalletClient, newOwner: Address) => Promise<OwnerCall>;
+/**
+ * Point the proxy at a new implementation. Builds `upgradeToAndCall`. Pass the
+ * result to `schedule`.
+ *
+ * This contract holds every fiat user's unclaimed purchase history, so a layout
+ * change here strands data that has no other copy. Diff the storage layout
+ * before scheduling. `data` runs on the proxy straight after the swap and is
+ * where a `reinitializer` goes.
+ */
+export declare const _upgradeCall: (client: WalletClient, newImplementation: Address, data?: Hex) => Promise<OwnerCall>;
+/**
+ * Take ownership after a `transferOwnership` named this client. `msg.sender`
+ * must equal `pendingOwner`, so the `client` is the incoming owner.
+ *
+ * Where the incoming owner is the timelock, use
+ * `protocolAdmin.acceptOwnershipBatch` instead, which accepts for every contract
+ * at once.
+ */
+export declare const _acceptOwnership: (client: WalletClient) => Promise<`0x${string}`>;

package/dist/types/logic/admin/protocolAdmin.eoa.d.ts

@@ -0,0 +1,163 @@
+import { Address, Hex, WalletClient } from "viem";
+import type { OperationOptions, OwnerCall, ScheduledBatchOperation, ScheduledOperation } from "../../types.js";
+/**
+ * The id the timelock will file this call under. Computed on chain so the SDK
+ * and the contract cannot disagree about it.
+ */
+export declare const _operationId: (client: WalletClient, call: OwnerCall, opts?: OperationOptions) => Promise<Hex>;
+/** The id for a batch. Hashes differently from the same calls scheduled one by one. */
+export declare const _operationIdBatch: (client: WalletClient, calls: readonly OwnerCall[], opts?: OperationOptions) => Promise<Hex>;
+/**
+ * The id for a payload built outside this SDK. `_scheduleRaw` hands back only a
+ * transaction hash, so this is the only way to get the id that `cancel`,
+ * `getTimestamp` and the `isOperation*` reads need.
+ */
+export declare const _operationIdRaw: (client: WalletClient, target: Address, value: bigint, payload: Hex, predecessor: Hex, salt: Hex) => Promise<Hex>;
+/** The id for a raw batch. Same reason as `_operationIdRaw`. */
+export declare const _operationIdBatchRaw: (client: WalletClient, targets: readonly Address[], callValues: readonly bigint[], payloads: readonly Hex[], predecessor: Hex, salt: Hex) => Promise<Hex>;
+/**
+ * Announce an owner call. `PROPOSER_ROLE`.
+ *
+ * `delay` defaults to `getMinDelay()`. Keep the returned object: `execute` rebuilds
+ * the id from it, and without it the arguments have to be recovered from the
+ * `CallScheduled` event.
+ */
+export declare const _schedule: (client: WalletClient, call: OwnerCall, opts?: OperationOptions, delay?: bigint) => Promise<ScheduledOperation>;
+/**
+ * Announce several owner calls as one operation. `PROPOSER_ROLE`.
+ *
+ * Use this where the calls only make sense together, such as evicting a guardian,
+ * which needs both its guardian and its executor role revoked before it can act
+ * again.
+ */
+export declare const _scheduleBatch: (client: WalletClient, calls: readonly OwnerCall[], opts?: OperationOptions, delay?: bigint) => Promise<ScheduledBatchOperation>;
+/**
+ * Schedule a payload built elsewhere. `PROPOSER_ROLE`. For calldata that did not
+ * come from an ABI in this SDK.
+ *
+ * Returns what `_schedule` returns, so the id needed to cancel or inspect the
+ * operation comes back with it.
+ */
+export declare const _scheduleRaw: (client: WalletClient, target: Address, value: bigint, payload: Hex, predecessor: Hex, salt: Hex, delay: bigint) => Promise<ScheduledOperation>;
+/**
+ * Run a scheduled operation once its delay has elapsed. Permissionless, so any
+ * funded EOA works.
+ *
+ * Pass back the object `schedule` returned. The timelock recomputes the id from
+ * these fields, so an altered value looks up an operation that was never
+ * scheduled and reverts.
+ */
+export declare const _execute: (client: WalletClient, operation: ScheduledOperation) => Promise<`0x${string}`>;
+/** Run a scheduled batch. Permissionless, same rules as `_execute`. */
+export declare const _executeBatch: (client: WalletClient, operation: ScheduledBatchOperation) => Promise<`0x${string}`>;
+/** Execute a payload scheduled through `_scheduleRaw`. Permissionless. */
+export declare const _executeRaw: (client: WalletClient, target: Address, value: bigint, payload: Hex, predecessor: Hex, salt: Hex) => Promise<`0x${string}`>;
+/**
+ * Drop a scheduled operation before it runs. `CANCELLER_ROLE`, which every
+ * proposer also holds.
+ */
+export declare const _cancel: (client: WalletClient, id: Hex) => Promise<`0x${string}`>;
+/**
+ * Release a pause on a protocol contract straight away. `GUARDIAN_ROLE`.
+ *
+ * The selector is fixed in the contract, so this cannot be pointed at anything
+ * else on the target.
+ */
+export declare const _unpauseInstantly: (client: WalletClient, target: Address) => Promise<`0x${string}`>;
+/**
+ * Strip the cancel power from accounts straight away. `GUARDIAN_ROLE`.
+ *
+ * All or nothing: an account that does not hold the role reverts the whole batch
+ * rather than being skipped, so a guardian acting on a list is never left
+ * believing a veto is gone while it is still there.
+ */
+export declare const _revokeCancellersInstantly: (client: WalletClient, accounts: readonly Address[]) => Promise<`0x${string}`>;
+/**
+ * Suspend a protocol contract's admin key straight away. `GUARDIAN_ROLE`.
+ *
+ * Takes the power away and hands none out. Reinstating the key or naming a
+ * replacement is an owner action and waits out the delay.
+ *
+ * `target` defaults to the registry, the one contract that keeps the admin
+ * address. Everything else reads it from there, so suspending it there closes
+ * every gate in the protocol.
+ */
+export declare const _disableAdminInstantly: (client: WalletClient, target?: Address) => Promise<`0x${string}`>;
+/**
+ * Finish taking ownership of contracts that have already offered it.
+ * Permissionless, and reverts `OwnershipNotOffered` for any target whose
+ * `pendingOwner` is not the timelock.
+ */
+export declare const _acceptOwnershipBatch: (client: WalletClient, targets: readonly Address[]) => Promise<`0x${string}`>;
+/**
+ * Give up one of your own roles. The chain requires `account` to be the caller,
+ * so this is the one role change that does not wait.
+ */
+export declare const _renounceRole: (client: WalletClient, role: Hex, account: Address) => Promise<`0x${string}`>;
+/** Grant a role. Pass the result to `schedule`. */
+export declare const _grantRoleCall: (client: WalletClient, role: Hex, account: Address) => Promise<OwnerCall>;
+/**
+ * Revoke a role. Pass the result to `schedule`.
+ *
+ * Evicting a guardian takes two of these in one `scheduleBatch`, its guardian
+ * role and its executor role, because the grant paired them but the revoke
+ * cannot tell that pairing from an independent grant.
+ */
+export declare const _revokeRoleCall: (client: WalletClient, role: Hex, account: Address) => Promise<OwnerCall>;
+/**
+ * Change the delay. Pass the result to `schedule`. `minDelayFloor` still clamps
+ * whatever this writes, so it cannot take the timelock below the floor.
+ */
+export declare const _updateDelayCall: (client: WalletClient, newDelay: bigint) => Promise<OwnerCall>;
+/**
+ * Suspend a protocol contract's admin and nominate its replacement in one step.
+ * Pass the result to `schedule`.
+ *
+ * The nominee still has to accept, and the role stays dormant until it does.
+ */
+export declare const _disableAndNominateCall: (client: WalletClient, target: Address, newAdmin: Address) => Promise<OwnerCall>;
+/**
+ * Release the protocol pause on the owner's route. Pass the result to `schedule`.
+ *
+ * There is no matching `pauseCall`. Tripping the pause is `onlyESIMWalletAdmin`,
+ * so the timelock cannot do it at all; the admin key calls `registry.pause`
+ * directly.
+ *
+ * A guardian can skip the delay with `_unpauseInstantly`. Use this form when no
+ * guardian key is to hand, or when the release is planned rather than urgent.
+ *
+ * `target` defaults to the registry.
+ */
+export declare const _unpauseCall: (client: WalletClient, target?: Address) => Promise<OwnerCall>;
+/**
+ * Set the fallback data bundle price ceiling. Pass the result to `schedule`.
+ *
+ * Zero reverts on execution, not on scheduling, so a zero here costs the whole
+ * delay before it fails.
+ *
+ * `target` defaults to the registry.
+ */
+export declare const _setDefaultDataBundlePriceCapCall: (client: WalletClient, cap: bigint, target?: Address) => Promise<OwnerCall>;
+/**
+ * Suspend a contract's admin key on the owner's route. Pass the result to
+ * `schedule`.
+ *
+ * Prefer `_disableAdminInstantly` during an incident: it does the same thing
+ * with no wait. This form is for a planned suspension, and for an owner holding
+ * no guardian key.
+ *
+ * `target` defaults to the registry, the one contract that keeps the admin
+ * address.
+ */
+export declare const _disableAdminCall: (client: WalletClient, target?: Address) => Promise<OwnerCall>;
+/**
+ * Give a suspended admin its powers back. Pass the result to `schedule`.
+ *
+ * The only route there is, and it waits out the delay however the key is held.
+ * Leaves an outstanding nomination alone, so an incumbent stripped by one is
+ * still powerless afterwards; withdraw that by naming the incumbent in
+ * `requestAdminUpdate`.
+ *
+ * `target` defaults to the registry.
+ */
+export declare const _enableAdminCall: (client: WalletClient, target?: Address) => Promise<OwnerCall>;

package/dist/types/logic/admin/reads/deviceWallet.reads.d.ts

@@ -1,11 +1,5 @@
-import { Address, WalletClient } from "viem";
-/**
- * Read-only admin logic targeting a specific `DeviceWallet` instance (its address
- * is passed in). Surfaces the instance's public storage getters + `getVaultAddress`
- * view for the backend. Each read extends the `WalletClient` with `publicActions`;
- * no EOA account is required, and the target is the instance address (not a
- * factory address, so no chain-constants lookup is needed).
- */
+import { Address, Hex, WalletClient } from "viem";
+import { P256Key } from "../../../types.js";
 /** The device's unique identifier string. */
 export declare const _deviceUniqueIdentifier: (client: WalletClient, deviceWalletAddress: Address) => Promise<string>;
 /** Whether an eSIM wallet is a valid child of this device wallet. */
@@ -14,3 +8,29 @@ export declare const _isValidESIMWallet: (client: WalletClient, deviceWalletAddr
 export declare const _canPullETH: (client: WalletClient, deviceWalletAddress: Address, eSIMWallet: Address) => Promise<boolean>;
 /** The vault address this device wallet pays eSIM purchases to. */
 export declare const _getVaultAddress: (client: WalletClient, deviceWalletAddress: Address) => Promise<Address>;
+/**
+ * The P256 key that owns this wallet, as its X and Y co-ordinates. Two reads,
+ * because the contract stores the pair as an array and Solidity gives an indexed
+ * getter rather than one returning both.
+ */
+export declare const _getOwner: (client: WalletClient, deviceWalletAddress: Address) => Promise<P256Key>;
+/** Gas this wallet has on deposit at the EntryPoint. */
+export declare const _getDeposit: (client: WalletClient, deviceWalletAddress: Address) => Promise<bigint>;
+/**
+ * Check a signature over an arbitrary message, per ERC-1271. Returns `0x1626ba7e`
+ * when the signature is valid and unexpired, `0xffffffff` otherwise.
+ *
+ * The signature is a version byte, then six bytes of `validUntil`, then the
+ * ABI-encoded WebAuthn assertion. What was signed is an EIP-191 digest over
+ * version, validUntil, chain id, the wallet address and `messageHash`, not
+ * `messageHash` on its own.
+ */
+export declare const _isValidSignature: (client: WalletClient, deviceWalletAddress: Address, messageHash: Hex, signature: Hex) => Promise<Hex>;
+/** The registry this wallet reports its ownership changes to. */
+export declare const _registry: (client: WalletClient, deviceWalletAddress: Address) => Promise<Address>;
+/** The factory that deploys this wallet's eSIM wallets. */
+export declare const _eSIMWalletFactory: (client: WalletClient, deviceWalletAddress: Address) => Promise<Address>;
+/** The ERC-4337 EntryPoint this wallet answers to. Immutable. */
+export declare const _entryPoint: (client: WalletClient, deviceWalletAddress: Address) => Promise<Address>;
+/** The P256 verifier used when the RIP-7212 precompile is unavailable. */
+export declare const _verifier: (client: WalletClient, deviceWalletAddress: Address) => Promise<Address>;