kokio-sdk 1.1.0 → 2.0.0

package/dist/types/logic/admin/reads/deviceWalletFactory.reads.d.ts

@@ -1,26 +1,57 @@
-import { Address, WalletClient } from "viem";
+import { Address, Hex, WalletClient } from "viem";
 import { P256Key } from "../../../types.js";
-/**
- * Read-only admin logic for `DeviceWalletFactory` - the contract's public
- * storage getters and `view` functions, surfaced for the backend.
- *
- * A viem `WalletClient` carries no public actions, so each read extends it with
- * `publicActions` (reusing the same transport, so it also works under an anvil
- * fork) before calling `readContract`. Reads need no EOA account, so there is no
- * `MissingEOAWalletError` guard.
- */
 /** The admin EOA (`eSIMWalletAdmin`) currently set on the factory. */
 export declare const _eSIMWalletAdmin: (client: WalletClient) => Promise<Address>;
-/** The vault EOA that receives eSIM payments. */
-export declare const _vault: (client: WalletClient) => Promise<Address>;
-/** The pending admin proposed via `requestAdminUpdate` (zero address if none). */
-export declare const _newRequestedAdmin: (client: WalletClient) => Promise<Address>;
 /** Whether a device wallet has been registered with the factory. */
 export declare const _deviceWalletInfoAdded: (client: WalletClient, deviceWallet: Address) => Promise<boolean>;
 /** The current device-wallet beacon implementation. */
 export declare const _getCurrentDeviceWalletImplementation: (client: WalletClient) => Promise<Address>;
+/**
+ * Check an identifier and owner key before deploying. Answers the zero address
+ * when both are free, or the wallet already holding one of them.
+ *
+ * `createAccount` runs inside EntryPoint validation, where the 4337 rules bar it
+ * from reading the registry, so it cannot see that an identifier or a key is
+ * taken: it deploys a second wallet at a fresh address and the
+ * `postCreateAccount` that would register it fails afterwards. Checking here
+ * first is what stops that.
+ *
+ * Reverts on an empty identifier or a key that is not a point on the P256 curve.
+ */
+export declare const _preCreateAccountValidation: (client: WalletClient, deviceUniqueIdentifier: string, deviceWalletOwnerKey: P256Key) => Promise<Address>;
+/**
+ * The beacon every device wallet reads its implementation from. One update moves
+ * all of them and no wallet can decline it.
+ */
+export declare const _beacon: (client: WalletClient) => Promise<`0x${string}`>;
+/** The registry the factory writes new wallets into. */
+export declare const _registry: (client: WalletClient) => Promise<`0x${string}`>;
+/** The EntryPoint baked into every device wallet this factory deploys. */
+export declare const _entryPoint: (client: WalletClient) => Promise<`0x${string}`>;
+/** The contract new device wallets verify WebAuthn assertions through. */
+export declare const _verifier: (client: WalletClient) => Promise<`0x${string}`>;
+/**
+ * Who holds `onlyOwner` on the factory. On the live deployment this is the
+ * `ProtocolAdmin` timelock, so an owner call sent from an EOA reverts and has to
+ * be scheduled instead.
+ */
+export declare const _owner: (client: WalletClient) => Promise<`0x${string}`>;
+/**
+ * The address a `transferOwnership` is waiting on. Worth reading before
+ * `protocolAdmin.acceptOwnershipBatch`, which reverts on any target that has not
+ * been offered to the timelock.
+ */
+export declare const _pendingOwner: (client: WalletClient) => Promise<`0x${string}`>;
 /**
  * The counterfactual (CREATE2) device-wallet address for an owner key. On-chain
  * arg order is `(ownerKey, uid, salt)` - note this differs from `createAccount`.
  */
 export declare const _getCounterFactualAddress: (client: WalletClient, deviceWalletOwnerKey: P256Key, deviceUniqueIdentifier: string, salt: bigint) => Promise<Address>;
+/**
+ * The ERC-1822 storage slot this proxy keeps its implementation in. An upgrade
+ * reverts unless the incoming implementation answers with the same value, which
+ * is what stops a non-UUPS address being installed.
+ */
+export declare const _proxiableUUID: (client: WalletClient) => Promise<Hex>;
+/** The OpenZeppelin upgrade interface this proxy speaks, currently `"5.0.0"`. */
+export declare const _upgradeInterfaceVersion: (client: WalletClient) => Promise<string>;

package/dist/types/logic/admin/reads/eSIMWallet.reads.d.ts

@@ -1,15 +1,34 @@
 import { Address, WalletClient } from "viem";
-/**
- * Read-only admin logic targeting a specific `ESIMWallet` instance (its address
- * is passed in). Surfaces the instance's public storage getters + `owner` view
- * for the backend. Each read extends the `WalletClient` with `publicActions`; no
- * EOA account is required.
- */
+import { DataBundleDetails } from "../../../types.js";
 /** The `ESIMWalletFactory` that deployed this eSIM wallet. */
 export declare const _eSIMWalletFactory: (client: WalletClient, eSIMWalletAddress: Address) => Promise<Address>;
 /** The eSIM's unique identifier string (empty until set by the admin). */
 export declare const _eSIMUniqueIdentifier: (client: WalletClient, eSIMWalletAddress: Address) => Promise<string>;
+/**
+ * This wallet's own price ceiling in wei. Zero means it follows the registry's
+ * `defaultDataBundlePriceCap` instead, which is the state a fresh wallet and a
+ * newly handed-over wallet both start in. Worth reading before naming a price on
+ * `buyDataBundle`, since a price over the ceiling reverts.
+ */
+export declare const _dataBundlePriceCap: (client: WalletClient, eSIMWalletAddress: Address) => Promise<bigint>;
 /** The pending owner proposed via `requestTransferOwnership` (zero if none). */
 export declare const _newRequestedOwner: (client: WalletClient, eSIMWalletAddress: Address) => Promise<Address>;
 /** The current owner (device wallet) of this eSIM wallet. */
 export declare const _owner: (client: WalletClient, eSIMWalletAddress: Address) => Promise<Address>;
+/**
+ * The device wallet this eSIM wallet belongs to. Tracks `owner` today, but it is
+ * a separate storage slot with its own typed getter, so read whichever one the
+ * calling code actually means.
+ */
+export declare const _deviceWallet: (client: WalletClient, eSIMWalletAddress: Address) => Promise<Address>;
+/**
+ * One data bundle purchase, by position. The array holds every purchase this
+ * wallet has made, and for a wallet that started life on the fiat path it also
+ * holds the pre-deployment purchases the lazy registry copies in.
+ *
+ * The contract publishes no length getter, so there is no way to ask how many
+ * entries exist. Read upwards from zero until a call reverts, or track the count
+ * from the `DataBundleBought` and `TransactionHistoryPopulated` events, whose
+ * `_totalEntries` is the length after the batch landed.
+ */
+export declare const _transactionHistory: (client: WalletClient, eSIMWalletAddress: Address, index: bigint) => Promise<DataBundleDetails>;

package/dist/types/logic/admin/reads/eSIMWalletFactory.reads.d.ts

@@ -1,10 +1,25 @@
-import { Address, WalletClient } from "viem";
-/**
- * Read-only admin logic for `ESIMWalletFactory` - its public storage getter and
- * `view` function, surfaced for the backend. Each read extends the `WalletClient`
- * with `publicActions` (no EOA account required).
- */
+import { Address, Hex, WalletClient } from "viem";
 /** Whether an eSIM wallet was deployed by this factory. */
 export declare const _isESIMWalletDeployed: (client: WalletClient, eSIMWallet: Address) => Promise<boolean>;
 /** The current eSIM-wallet beacon implementation. */
 export declare const _getCurrentESIMWalletImplementation: (client: WalletClient) => Promise<Address>;
+/**
+ * The ERC-1822 storage slot this proxy keeps its implementation in. An upgrade
+ * reverts unless the incoming implementation answers with the same value, which
+ * is what stops a non-UUPS address being installed.
+ */
+export declare const _proxiableUUID: (client: WalletClient) => Promise<Hex>;
+/** The OpenZeppelin upgrade interface this proxy speaks, currently `"5.0.0"`. */
+export declare const _upgradeInterfaceVersion: (client: WalletClient) => Promise<string>;
+/**
+ * Who holds `onlyOwner` here. On the live deployment this is the
+ * `ProtocolAdmin` timelock, so an owner call sent from an EOA reverts and has to
+ * be scheduled instead.
+ */
+export declare const _owner: (client: WalletClient) => Promise<Address>;
+/**
+ * The address a `transferOwnership` is waiting on. Worth reading before
+ * `protocolAdmin.acceptOwnershipBatch`, which reverts on any target that has not
+ * been offered to the timelock.
+ */
+export declare const _pendingOwner: (client: WalletClient) => Promise<Address>;

package/dist/types/logic/admin/reads/lazyWalletRegistry.reads.d.ts

@@ -1,20 +1,53 @@
-import { WalletClient } from "viem";
+import { Address, Hex, WalletClient } from "viem";
 import { DataBundleDetails } from "../../../types.js";
-/**
- * Read-only admin logic for `LazyWalletRegistry` - its public storage getters,
- * surfaced for the backend's fiat/lazy provisioning flows. Each read extends the
- * `WalletClient` with `publicActions`; no EOA account is required.
- *
- * Note: `deviceIdentifierToESIMDetails` and
- * `eSIMIdentifiersAssociatedWithDeviceIdentifier` back dynamic arrays on chain,
- * so their auto-generated getters take an element `index` and return one entry -
- * callers iterate indices to read the whole list (there is no full-array getter).
- */
 /** The upgrade-manager (owner) EOA of the lazy registry. */
 export declare const _upgradeManager: (client: WalletClient) => Promise<`0x${string}`>;
 /** The device identifier an eSIM identifier is currently associated with. */
 export declare const _eSIMIdentifierToDeviceIdentifier: (client: WalletClient, eSIMIdentifier: string) => Promise<string>;
 /** One data-bundle history entry for a (device, eSIM) pair, by array index. */
 export declare const _deviceIdentifierToESIMDetails: (client: WalletClient, deviceIdentifier: string, eSIMIdentifier: string, index: bigint) => Promise<DataBundleDetails>;
+/** Most eSIM wallets one `deployLazyWalletAndSetESIMIdentifier` call will deploy. */
+export declare const _maxESIMWalletsPerCall: (client: WalletClient) => Promise<bigint>;
+/** Most history entries one `setHistoryForLazyWallet` call will copy. */
+export declare const _maxHistoryEntriesPerCall: (client: WalletClient) => Promise<bigint>;
+/**
+ * How many of a device's eSIM wallets are already deployed. Non-zero exactly when
+ * the lazy route ran the device's first batch, so it doubles as the marker for
+ * the route itself.
+ */
+export declare const _eSIMWalletsDeployed: (client: WalletClient, deviceIdentifier: string) => Promise<bigint>;
+/** Salt the device's first deployment batch started from. Every later batch derives from it. */
+export declare const _lazyDeploymentSalt: (client: WalletClient, deviceIdentifier: string) => Promise<bigint>;
+/**
+ * The eSIM wallet this registry deployed for an identifier. Zero for anything it
+ * did not deploy, which is what authorises the history copy.
+ */
+export declare const _lazyDeployedESIMWallet: (client: WalletClient, eSIMIdentifier: string) => Promise<`0x${string}`>;
+/** How many of an eSIM's stored purchase entries have already reached its wallet. */
+export declare const _historyEntriesCopied: (client: WalletClient, eSIMIdentifier: string) => Promise<bigint>;
+/** Whether a device identifier has purchases recorded against it here. */
+export declare const _isDeviceIdentifierReserved: (client: WalletClient, deviceIdentifier: string) => Promise<boolean>;
+/** Whether an eSIM identifier is bound to a device here. */
+export declare const _isESIMIdentifierReserved: (client: WalletClient, eSIMIdentifier: string) => Promise<boolean>;
 /** One eSIM identifier associated with a device identifier, by array index. */
 export declare const _eSIMIdentifiersAssociatedWithDeviceIdentifier: (client: WalletClient, deviceIdentifier: string, index: bigint) => Promise<string>;
+/**
+ * The ERC-1822 storage slot this proxy keeps its implementation in. An upgrade
+ * reverts unless the incoming implementation answers with the same value, which
+ * is what stops a non-UUPS address being installed.
+ */
+export declare const _proxiableUUID: (client: WalletClient) => Promise<Hex>;
+/** The OpenZeppelin upgrade interface this proxy speaks, currently `"5.0.0"`. */
+export declare const _upgradeInterfaceVersion: (client: WalletClient) => Promise<string>;
+/**
+ * Who holds `onlyOwner` here. On the live deployment this is the
+ * `ProtocolAdmin` timelock, so an owner call sent from an EOA reverts and has to
+ * be scheduled instead.
+ */
+export declare const _owner: (client: WalletClient) => Promise<Address>;
+/**
+ * The address a `transferOwnership` is waiting on. Worth reading before
+ * `protocolAdmin.acceptOwnershipBatch`, which reverts on any target that has not
+ * been offered to the timelock.
+ */
+export declare const _pendingOwner: (client: WalletClient) => Promise<Address>;

package/dist/types/logic/admin/reads/protocolAdmin.reads.d.ts

@@ -0,0 +1,53 @@
+import { Address, Hex, WalletClient } from "viem";
+/** Operation lifecycle, matching the on-chain `OperationState` enum. */
+export declare enum OperationState {
+    Unset = 0,
+    Waiting = 1,
+    Ready = 2,
+    Done = 3
+}
+/**
+ * Shortest delay a new operation will be given. Read this rather than following
+ * `MinDelayChange`, which carries the value `updateDelay` stored and not the
+ * floor that overrides it.
+ */
+export declare const _getMinDelay: (client: WalletClient) => Promise<bigint>;
+/**
+ * The floor `getMinDelay` clamps to. Immutable, so `updateDelay` can never bring
+ * the timelock below it.
+ */
+export declare const _minDelayFloor: (client: WalletClient) => Promise<bigint>;
+/** Where an operation is in its lifecycle. */
+export declare const _getOperationState: (client: WalletClient, id: Hex) => Promise<OperationState>;
+/**
+ * When an operation becomes executable, as a unix timestamp. Reads `0` for an
+ * unknown operation and the literal `1` for one already done, so compare against
+ * the state rather than treating this as a time in both cases.
+ */
+export declare const _getTimestamp: (client: WalletClient, id: Hex) => Promise<bigint>;
+/** Whether the timelock has ever seen this operation. */
+export declare const _isOperation: (client: WalletClient, id: Hex) => Promise<boolean>;
+/** Scheduled and not yet executed, whether or not the delay has elapsed. */
+export declare const _isOperationPending: (client: WalletClient, id: Hex) => Promise<boolean>;
+/** The delay has elapsed and the operation can be executed now. */
+export declare const _isOperationReady: (client: WalletClient, id: Hex) => Promise<boolean>;
+/** The operation has already run. */
+export declare const _isOperationDone: (client: WalletClient, id: Hex) => Promise<boolean>;
+/** Whether an account holds a role. Role ids come from the constants below. */
+export declare const _hasRole: (client: WalletClient, role: Hex, account: Address) => Promise<boolean>;
+/**
+ * The role that can grant and revoke the given one. Always `DEFAULT_ADMIN_ROLE`,
+ * which only the timelock itself holds, so every role change is a scheduled
+ * operation.
+ */
+export declare const _getRoleAdmin: (client: WalletClient, role: Hex) => Promise<Hex>;
+/** Held only by the timelock itself, which is what makes role changes wait. */
+export declare const _defaultAdminRole: (client: WalletClient) => Promise<`0x${string}`>;
+/** Can schedule operations, and can cancel them. */
+export declare const _proposerRole: (client: WalletClient) => Promise<`0x${string}`>;
+/** Can cancel a scheduled operation and nothing else. */
+export declare const _cancellerRole: (client: WalletClient) => Promise<`0x${string}`>;
+/** Granted to the zero address, so execution is open to anyone. */
+export declare const _executorRole: (client: WalletClient) => Promise<`0x${string}`>;
+/** The three instant powers. Cannot be held alongside proposer or canceller. */
+export declare const _guardianRole: (client: WalletClient) => Promise<`0x${string}`>;

package/dist/types/logic/admin/reads/registry.reads.d.ts

@@ -1,16 +1,62 @@
 import { Address, Hex, WalletClient } from "viem";
 /**
- * Read-only admin logic for `Registry` (which inherits `RegistryHelper`, so its
- * ABI carries the helper mappings too). Surfaces the public storage getters for
- * the backend. Each read extends the `WalletClient` with `publicActions`; no EOA
- * account is required.
+ * The admin EOA (`eSIMWalletAdmin`) recorded in the registry. Reads zero while a
+ * nomination is pending or the admin is suspended, which means the role is
+ * dormant rather than unset.
  */
-/** The admin EOA (`eSIMWalletAdmin`) recorded in the registry. */
 export declare const _eSIMWalletAdmin: (client: WalletClient) => Promise<Address>;
+/**
+ * The admin address on the books, which keeps naming a suspended admin so the
+ * suspension can be lifted without supplying it again. Ask `_eSIMWalletAdmin`
+ * who may actually act.
+ */
+export declare const _adminOfRecord: (client: WalletClient) => Promise<Address>;
+/**
+ * Whether the admin's powers are suspended protocol-wide. True and a pending
+ * nomination are separate reasons for `_eSIMWalletAdmin` to read zero, so read
+ * this alongside `_newRequestedAdmin` to tell them apart.
+ */
+export declare const _adminDisabled: (client: WalletClient) => Promise<boolean>;
+/**
+ * Whether the protocol is paused. While true, every ETH-moving path on the
+ * device wallets and eSIM wallets reverts `ProtocolPaused`.
+ */
+export declare const _paused: (client: WalletClient) => Promise<boolean>;
+/**
+ * The fallback price ceiling in wei, applied to any eSIM wallet holding no cap of
+ * its own. Never zero.
+ */
+export declare const _defaultDataBundlePriceCap: (client: WalletClient) => Promise<bigint>;
 /** The vault EOA recorded in the registry. */
 export declare const _vault: (client: WalletClient) => Promise<Address>;
+/** The pending admin nominated via `requestAdminUpdate` (zero address if none). */
+export declare const _newRequestedAdmin: (client: WalletClient) => Promise<Address>;
+/**
+ * Who holds `onlyOwner` on the registry. On the live deployment this is the
+ * `ProtocolAdmin` timelock, so an owner call sent from an EOA reverts and has to
+ * be scheduled instead.
+ */
+export declare const _owner: (client: WalletClient) => Promise<Address>;
 /** The upgrade-manager (owner) EOA recorded in the registry. */
 export declare const _upgradeManager: (client: WalletClient) => Promise<Address>;
+/**
+ * The address a `transferOwnership` is waiting on. Worth reading before
+ * `protocolAdmin.acceptOwnershipBatch`, which reverts on any target that has not
+ * been offered to the timelock.
+ */
+export declare const _pendingOwner: (client: WalletClient) => Promise<Address>;
+/** The `DeviceWalletFactory` address wired into the registry. */
+export declare const _deviceWalletFactory: (client: WalletClient) => Promise<Address>;
+/** The `ESIMWalletFactory` address wired into the registry. */
+export declare const _eSIMWalletFactory: (client: WalletClient) => Promise<Address>;
+/** The EntryPoint the registry recognises. One per chain. */
+export declare const _entryPoint: (client: WalletClient) => Promise<Address>;
+/**
+ * The same pause check the wallets themselves run, which throws rather than
+ * returning false. Use `_paused` to branch on it; use this when you want the
+ * failure to carry the protocol's own revert reason.
+ */
+export declare const _requireNotPaused: (client: WalletClient) => Promise<void>;
 /** The `LazyWalletRegistry` address wired into the registry. */
 export declare const _lazyWalletRegistry: (client: WalletClient) => Promise<Address>;
 /** The device wallet registered for a device unique identifier (zero if none). */
@@ -25,10 +71,60 @@ export declare const _registeredP256Keys: (client: WalletClient, hashOfOwnerP256
 /** Whether a device wallet is registered/valid. */
 export declare const _isDeviceWalletValid: (client: WalletClient, deviceWallet: Address) => Promise<boolean>;
 /**
- * The device wallet that owns an eSIM wallet (zero address if the eSIM is not
- * valid). On-chain this getter is named `isESIMWalletValid` but returns the
- * associated device-wallet address, not a boolean.
+ * The device wallet an eSIM wallet is registered against, zero if the protocol
+ * never deployed it. Despite the name this returns an address, not a boolean.
+ *
+ * This is a registration record, not a current holder. Once it goes non-zero it
+ * stays non-zero for the rest of the wallet's life, and mid-transfer it still
+ * names the device wallet that last held it. To ask who holds it now, read
+ * `DeviceWallet.isValidESIMWallet` on the device wallet.
  */
 export declare const _isESIMWalletValid: (client: WalletClient, eSIMWallet: Address) => Promise<Address>;
-/** Whether an eSIM wallet is currently on standby. */
+/**
+ * Whether a transfer is outstanding on an eSIM wallet. `bindESIMWallet` clears
+ * it once the new device wallet takes the eSIM wallet on.
+ *
+ * Independent of `isESIMWalletValid`, and neither implies the other. A `true`
+ * here is not a claim the wallet left the protocol, and it is normal for the
+ * association to still name the device wallet that raised the flag. Do not use
+ * this to decide whether an eSIM wallet belongs to the protocol.
+ */
 export declare const _isESIMWalletOnStandby: (client: WalletClient, eSIMWallet: Address) => Promise<boolean>;
+/**
+ * Whether a device identifier already has a wallet on chain. Not the same
+ * question as `lazyWalletRegistry.isDeviceIdentifierReserved`, which reads true
+ * as soon as history is recorded and well before anything is deployed.
+ */
+export declare const _isDeviceIdentifierAlreadyUsed: (client: WalletClient, deviceUniqueIdentifier: string) => Promise<boolean>;
+/** Whether an eSIM identifier is already held by a wallet. */
+export declare const _isESIMIdentifierClaimed: (client: WalletClient, eSIMUniqueIdentifier: string) => Promise<boolean>;
+/**
+ * The one eSIM wallet holding an eSIM identifier, zero if nobody holds it. Set
+ * once and never cleared, an ownership transfer included, because the eSIM
+ * belongs to the wallet rather than to whichever device is holding it.
+ */
+export declare const _eSIMWalletForIdentifier: (client: WalletClient, eSIMUniqueIdentifier: string) => Promise<Address>;
+/**
+ * The same answer as `_eSIMWalletForIdentifier`, keyed by the keccak256 of the
+ * identifier. Use it when the hash is what you already have; otherwise take the
+ * string version and skip the hashing.
+ */
+export declare const _claimedESIMIdentifiers: (client: WalletClient, hashOfESIMIdentifier: Hex) => Promise<Address>;
+/**
+ * The check `DeviceWalletFactory` runs before taking a device identifier.
+ * Resolves if the identifier is free, reverts `DeviceIdentifierReservedForLazyWallet`
+ * if a fiat user's eSIMs are already waiting on it.
+ *
+ * Worth calling ahead of a deployment: taking a reserved identifier strands the
+ * lazy user, since the history copy, the wallet deployment and the device switch
+ * all then refuse it.
+ */
+export declare const _requireDeviceIdentifierNotReserved: (client: WalletClient, deviceUniqueIdentifier: string) => Promise<void>;
+/**
+ * The ERC-1822 storage slot this proxy keeps its implementation in. An upgrade
+ * reverts unless the incoming implementation answers with the same value, which
+ * is what stops a non-UUPS address being installed.
+ */
+export declare const _proxiableUUID: (client: WalletClient) => Promise<Hex>;
+/** The OpenZeppelin upgrade interface this proxy speaks, currently `"5.0.0"`. */
+export declare const _upgradeInterfaceVersion: (client: WalletClient) => Promise<string>;

package/dist/types/logic/admin/registry.eoa.d.ts

@@ -1,7 +1,104 @@
-import { Address, WalletClient } from "viem";
-/**
- * Admin-EOA logic for `Registry`. `addOrUpdateLazyWalletRegistryAddress` is
- * `onlyOwner`, so the `client` must carry the `upgradeManager` EOA.
- */
+import { Address, Hex, WalletClient } from "viem";
+import type { OwnerCall } from "../../types.js";
 /** Wire (or rewire) the LazyWalletRegistry into the Registry. `onlyOwner`. */
 export declare const _addOrUpdateLazyWalletRegistryAddress: (client: WalletClient, lazyWalletRegistry: Address) => Promise<`0x${string}`>;
+/** Update the vault that receives eSIM payments. `onlyOwner`. */
+export declare const _updateVaultAddress: (client: WalletClient, newVaultAddress: Address) => Promise<`0x${string}`>;
+/**
+ * Step 1 of the 2-step admin handover: nominate the next admin. `onlyOwner`, so
+ * the `client` is the owner EOA, not the outgoing admin.
+ *
+ * The nomination takes the role off the incumbent straight away: `eSIMWalletAdmin`
+ * reads zero until the nominee accepts, and every admin gated call across the
+ * protocol reverts in that window. Send the two steps close together. Naming the
+ * incumbent instead withdraws a pending nomination and hands the role back.
+ */
+export declare const _requestAdminUpdate: (client: WalletClient, newAdmin: Address) => Promise<`0x${string}`>;
+/**
+ * Suspend the admin's powers protocol-wide. `onlyOwner`.
+ *
+ * The address stays on the books as `adminOfRecord`, so lifting the suspension
+ * does not need it supplied again. Reverts if the admin is already suspended,
+ * rather than passing quietly and leaving the caller believing it acted.
+ */
+export declare const _disableAdmin: (client: WalletClient) => Promise<`0x${string}`>;
+/**
+ * Give the suspended admin its powers back. `onlyOwner`.
+ *
+ * Does nothing about an outstanding nomination, which keeps the incumbent
+ * powerless on its own. Withdraw that with `_requestAdminUpdate` naming the
+ * incumbent. Reverts if the admin was never suspended.
+ */
+export declare const _enableAdmin: (client: WalletClient) => Promise<`0x${string}`>;
+/**
+ * Stop the ETH-moving paths on every device wallet and eSIM wallet.
+ * `onlyESIMWalletAdmin`, so this is the one emergency lever the backend key can
+ * pull on its own.
+ *
+ * It cannot release it again: `_unpause` is `onlyOwner`. That split is what stops
+ * a compromised backend key holding user funds. Owners can still spend their own
+ * ETH through their device wallet's `execute`, which a pause never reaches.
+ */
+export declare const _pause: (client: WalletClient) => Promise<`0x${string}`>;
+/**
+ * Release the pause. `onlyOwner`, not the admin, see `_pause`.
+ *
+ * On the live deployment the owner is the timelock, so this reverts from an EOA.
+ * Schedule `protocolAdmin.unpauseCall` instead, or have a guardian call
+ * `unpauseInstantly` if the wait is not acceptable.
+ */
+export declare const _unpause: (client: WalletClient) => Promise<`0x${string}`>;
+/**
+ * Set the price ceiling every eSIM wallet falls back to when it holds none of its
+ * own. `onlyOwner`, deliberately not the admin: the admin names the price on
+ * `buyDataBundle`, so it must not also be able to raise its own limit.
+ *
+ * Zero reverts `ZeroDataBundlePriceCap`, since a zero would read as "no ceiling"
+ * for every wallet without one of its own.
+ */
+export declare const _setDefaultDataBundlePriceCap: (client: WalletClient, cap: bigint) => Promise<`0x${string}`>;
+/**
+ * Bind an eSIM's unique identifier to its wallet. `onlyESIMWalletAdmin`.
+ *
+ * The identifier is claimed protocol-wide, so a string already bound to another
+ * wallet reverts rather than moving.
+ */
+export declare const _assignESIMIdentifier: (client: WalletClient, eSIMWalletAddress: Address, eSIMUniqueIdentifier: string) => Promise<`0x${string}`>;
+/**
+ * Step 2 of the 2-step admin handover: the nominee accepts. The chain requires
+ * `msg.sender` to equal the pending admin, so the `client` here must be the
+ * newly nominated admin EOA.
+ */
+export declare const _acceptAdminUpdate: (client: WalletClient) => Promise<`0x${string}`>;
+/**
+ * Take ownership after a `transferOwnership` named this client. The chain
+ * requires `msg.sender` to equal `pendingOwner`, so the `client` is the incoming
+ * owner, not the outgoing one.
+ *
+ * Permissionless in the sense that it needs no role, so where the incoming owner
+ * is the timelock this is not the call to use: `protocolAdmin.acceptOwnershipBatch`
+ * accepts for every contract at once and needs no delay.
+ */
+export declare const _acceptOwnership: (client: WalletClient) => Promise<`0x${string}`>;
+/**
+ * Offer ownership to a new address. Pass the result to `schedule`.
+ *
+ * Ownable2Step, so the offer alone changes nothing: the named address has to
+ * call `acceptOwnership` before it holds anything. Until then the current owner
+ * keeps every power. Naming an address that cannot call back leaves the
+ * ownership where it is rather than stranding it.
+ */
+export declare const _transferOwnershipCall: (client: WalletClient, newOwner: Address) => Promise<OwnerCall>;
+/**
+ * Point the proxy at a new implementation. Builds `upgradeToAndCall`. Pass the
+ * result to `schedule`.
+ *
+ * `data` runs on the proxy straight after the swap, in the same transaction, and
+ * is where a `reinitializer` goes. Leave it empty when the new implementation
+ * needs no setup.
+ *
+ * There is no undo. The implementation is checked for a matching `proxiableUUID`
+ * and nothing else, so an address that answers correctly but cannot upgrade
+ * again ends the proxy's life. Diff the storage layout before scheduling.
+ */
+export declare const _upgradeCall: (client: WalletClient, newImplementation: Address, data?: Hex) => Promise<OwnerCall>;

package/dist/types/logic/constants.d.ts

@@ -2,6 +2,8 @@ import { WalletClient, Address } from 'viem';
 import { mainnet, sepolia, optimism, optimismSepolia, arbitrum, arbitrumSepolia, base, baseSepolia } from "viem/chains";
 export declare const ZERO: bigint;
 export declare const SIGNATURE_VALIDITY_SECONDS = 180;
+export declare const STUB_VERIFICATION_GAS_PAD: bigint;
+export declare const STUB_PRE_VERIFICATION_GAS_PAD: bigint;
 export declare enum CHAIN_ID {
     MAINNET = 1,
     SEPOLIA = 11155111,

package/dist/types/logic/deviceWallet.d.ts

@@ -1,8 +1,80 @@
-import { Address, WalletClient } from "viem";
-import { SmartAccountClient } from "@aa-sdk/core";
+import { Address, Hex, WalletClient } from "viem";
+import { Call, KokioSmartAccountClient } from "../types.js";
 import { P256Key } from "../types.js";
-export declare const _toggleAccessToETH: (client: SmartAccountClient, address: Address, eSIMWalletAddress: Address, hasAccessToETH: boolean) => Promise<import("@aa-sdk/core").SendUserOperationResult<keyof import("@aa-sdk/core").EntryPointRegistryBase<unknown>>>;
-export declare const _addESIMWallet: (client: SmartAccountClient, address: Address, eSIMWalletAddress: Address, hasAccessToETH: boolean) => Promise<import("@aa-sdk/core").SendUserOperationResult<keyof import("@aa-sdk/core").EntryPointRegistryBase<unknown>>>;
-export declare const _removeESIMWallet: (client: SmartAccountClient, address: Address, eSIMWalletAddress: Address, hasAccessToETH: boolean) => Promise<import("@aa-sdk/core").SendUserOperationResult<keyof import("@aa-sdk/core").EntryPointRegistryBase<unknown>>>;
-export declare const _getVaultAddress: (client: SmartAccountClient, address: Address) => Promise<Address>;
+/**
+ * Send one or more calls from this device wallet as a single user operation.
+ * The only escape hatch on this surface for anything not named below: sending
+ * ETH to any address, calling another contract, moving tokens, interacting
+ * with a DeFi protocol. A lone call encodes to `execute`, several batch
+ * atomically through `executeBatch`.
+ */
+export declare const _sendUserOperation: (client: KokioSmartAccountClient, calls: Call[]) => Promise<`0x${string}`>;
+export declare const _toggleAccessToETH: (client: KokioSmartAccountClient, address: Address, eSIMWalletAddress: Address, hasAccessToETH: boolean) => Promise<`0x${string}`>;
+/**
+ * Bind an eSIM wallet this device wallet already owns.
+ *
+ * A bind never carries ETH access: the contract reverts on a `true` rather than
+ * downgrading it quietly, so the SDK passes `false` and there is nothing to
+ * choose. `toggleAccessToETH` is the only way to grant it, which is what stops a
+ * bind from undoing the owner's revocation.
+ */
+export declare const _addESIMWallet: (client: KokioSmartAccountClient, address: Address, eSIMWalletAddress: Address) => Promise<`0x${string}`>;
+/**
+ * Release an eSIM wallet and put it on standby for a transfer.
+ *
+ * `callBackETH` sweeps whatever ETH the eSIM wallet still holds back here. It
+ * runs after the release, so a wallet whose handler misbehaves has already lost
+ * its ETH access and its registry association. A failed sweep is swallowed by
+ * the contract, so a `true` is not a promise that anything arrived.
+ */
+export declare const _removeESIMWallet: (client: KokioSmartAccountClient, address: Address, eSIMWalletAddress: Address, callBackETH: boolean) => Promise<`0x${string}`>;
+/**
+ * Rotate the P256 key that owns this wallet. The registry is told in the same
+ * call, so its record of the owner cannot drift from the wallet's.
+ *
+ * A key that cannot produce a verifiable signature bricks the wallet: this is
+ * reachable only through a signed userOp, so there is no rotating back and no
+ * reaching the balance afterwards. The contract rejects a key it can tell is
+ * unusable, but check the new key can sign before calling.
+ */
+export declare const _transferOwnership: (client: KokioSmartAccountClient, address: Address, newOwner: P256Key) => Promise<`0x${string}`>;
+/**
+ * Top up the gas deposit the EntryPoint holds for this wallet, from the wallet's
+ * own balance. Anyone may pay into any account's deposit, so an EOA can do this
+ * with a plain transfer too and not spend a userOp on it.
+ */
+export declare const _addDeposit: (client: KokioSmartAccountClient, address: Address, amount: bigint) => Promise<`0x${string}`>;
+/** Pull part of the EntryPoint gas deposit back out to any address. */
+export declare const _withdrawDepositTo: (client: KokioSmartAccountClient, address: Address, withdrawAddress: Address, amount: bigint) => Promise<`0x${string}`>;
+export declare const _getVaultAddress: (client: KokioSmartAccountClient, address: Address) => Promise<Address>;
+/** Gas this wallet has on deposit at the EntryPoint. */
+export declare const _getDeposit: (client: KokioSmartAccountClient, address: Address) => Promise<bigint>;
+/** The device identifier this wallet was deployed for. Set once, at deploy. */
+export declare const _deviceUniqueIdentifier: (client: KokioSmartAccountClient, address: Address) => Promise<string>;
+/** Whether this wallet currently holds the given eSIM wallet. */
+export declare const _isValidESIMWallet: (client: KokioSmartAccountClient, address: Address, eSIMWalletAddress: Address) => Promise<boolean>;
+/**
+ * Whether an eSIM wallet may pull ETH from this one. Binding a wallet never
+ * grants it, so this stays false until `toggleAccessToETH` says otherwise.
+ */
+export declare const _canPullETH: (client: KokioSmartAccountClient, address: Address, eSIMWalletAddress: Address) => Promise<boolean>;
+/**
+ * Check a signature over an arbitrary message, per ERC-1271. Returns
+ * `0x1626ba7e` when the signature is valid and unexpired, `0xffffffff` otherwise.
+ *
+ * The signature is a version byte, then six bytes of `validUntil`, then the
+ * ABI-encoded WebAuthn assertion. What was signed is not `messageHash` itself but
+ * an EIP-191 digest over version, validUntil, chain id, this wallet's address and
+ * `messageHash`, so a signature cannot be replayed on another chain or against
+ * the same owner key's wallet at a different salt.
+ */
+export declare const _isValidSignature: (client: KokioSmartAccountClient, address: Address, messageHash: Hex, signature: Hex) => Promise<Hex>;
+/** The registry this wallet reports its ownership changes to. */
+export declare const _registry: (client: KokioSmartAccountClient, address: Address) => Promise<Address>;
+/** The factory that deploys this wallet's eSIM wallets. */
+export declare const _eSIMWalletFactory: (client: KokioSmartAccountClient, address: Address) => Promise<Address>;
+/** The ERC-4337 EntryPoint this wallet answers to. Immutable. */
+export declare const _entryPoint: (client: KokioSmartAccountClient, address: Address) => Promise<Address>;
+/** The P256 verifier used when the RIP-7212 precompile is unavailable. */
+export declare const _verifier: (client: KokioSmartAccountClient, address: Address) => Promise<Address>;
 export declare const _getOwner: (client: WalletClient, address: Address) => Promise<P256Key>;