@seams/wallet-server 0.7.1 → 0.7.3

package/dist/esm/threshold/session/signingSessionSeal/idempotencyBackends.js

@@ -2,7 +2,7 @@ import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/nor
 import "../../../shared-ts/src/utils/validation.js";
 import { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetJson, redisSetJson } from "../../../core/ThresholdService/kv.js";
 import { createInMemorySigningSessionSealIdempotencyStore } from "./idempotency.js";
-import { parseCurrentSigningSessionSealIdempotencyRouteResult, parseCurrentSigningSessionSealIdempotencyStoredEntry } from "./idempotencyRecords.js";
+import { parseCurrentSigningSessionSealIdempotencyResultRecord, parseCurrentSigningSessionSealIdempotencyStoredEntry } from "./idempotencyRecords.js";
 //#region src/threshold/session/signingSessionSeal/idempotencyBackends.ts
 const DEFAULT_KEY_PREFIX = "threshold:signing-session-seal:idempotency:";
 function toPositiveInt(value) {
@@ -46,7 +46,7 @@ var UpstashSigningSessionSealIdempotencyStore = class {
 		if (!key) return;
 		const expiresAtMs = toPositiveInt(input.expiresAtMs);
 		if (expiresAtMs === void 0) return;
-		const normalizedResult = parseCurrentSigningSessionSealIdempotencyRouteResult(input.result);
+		const normalizedResult = parseCurrentSigningSessionSealIdempotencyResultRecord(input.result);
 		if (!normalizedResult) return;
 		const ttlMs = ttlMsUntilExpiry(expiresAtMs, this.nowMs());
 		if (ttlMs <= 0) return;
@@ -80,7 +80,7 @@ var RedisTcpSigningSessionSealIdempotencyStore = class {
 		if (!key) return;
 		const expiresAtMs = toPositiveInt(input.expiresAtMs);
 		if (expiresAtMs === void 0) return;
-		const normalizedResult = parseCurrentSigningSessionSealIdempotencyRouteResult(input.result);
+		const normalizedResult = parseCurrentSigningSessionSealIdempotencyResultRecord(input.result);
 		if (!normalizedResult) return;
 		const ttlMs = ttlMsUntilExpiry(expiresAtMs, this.nowMs());
 		if (ttlMs <= 0) return;

package/dist/esm/threshold/session/signingSessionSeal/idempotencyRecords.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import "../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 //#region src/threshold/session/signingSessionSeal/idempotencyRecords.ts
 function toPositiveInt(value) {
 	const parsed = Number(value);
@@ -26,11 +27,7 @@ function parseCurrentSigningSessionSealIdempotencyResultRecord(raw) {
 		const code = normalizeOptionalTrimmedString(obj.code);
 		const message = normalizeOptionalTrimmedString(obj.message);
 		if (!code || !message) return null;
-		return {
-			ok: false,
-			code,
-			message
-		};
+		return failure(code, message);
 	}
 	return null;
 }
@@ -45,10 +42,7 @@ function parseCurrentSigningSessionSealIdempotencyStoredEntry(raw) {
 		expiresAtMs
 	};
 }
-function parseCurrentSigningSessionSealIdempotencyRouteResult(raw) {
-	return parseCurrentSigningSessionSealIdempotencyResultRecord(raw);
-}
 //#endregion
-export { parseCurrentSigningSessionSealIdempotencyRouteResult, parseCurrentSigningSessionSealIdempotencyStoredEntry };
+export { parseCurrentSigningSessionSealIdempotencyResultRecord, parseCurrentSigningSessionSealIdempotencyStoredEntry };
 
 //# sourceMappingURL=idempotencyRecords.js.map

package/dist/esm/threshold/session/signingSessionSeal/service.js

@@ -1,6 +1,7 @@
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
 import "../../../shared-ts/src/utils/encoders.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 //#region src/threshold/session/signingSessionSeal/service.ts
 const SIGNING_SESSION_SEAL_LOG_LABEL = "[threshold-signing-session-seal]";
 const SIGNING_SESSION_SEAL_IDEMPOTENCY_TTL_MS_DEFAULT = 9e4;
@@ -120,11 +121,7 @@ function shouldPersistIdempotentResult(result) {
 async function runSealOperation(input) {
 	const nowMs = input.options.nowMs || Date.now;
 	const startedAtMs = nowMs();
-	let result = {
-		ok: false,
-		code: "internal",
-		message: "Internal error"
-	};
+	let result = failure("internal", "Internal error");
 	try {
 		emitOperationRequestLog({
 			options: input.options,
@@ -136,27 +133,15 @@ async function runSealOperation(input) {
 		});
 		const session = input.auth.session;
 		if (signingSessionSealAuthorizationId(session) !== input.request.thresholdSessionId) {
-			result = {
-				ok: false,
-				code: "forbidden",
-				message: "Wallet Session does not match requested thresholdSessionId"
-			};
+			result = failure("forbidden", "Wallet Session does not match requested thresholdSessionId");
 			return result;
 		}
 		if (session.userId !== input.auth.userId) {
-			result = {
-				ok: false,
-				code: "forbidden",
-				message: "thresholdSessionId does not belong to authenticated user"
-			};
+			result = failure("forbidden", "thresholdSessionId does not belong to authenticated user");
 			return result;
 		}
 		if (isExpired(session, nowMs())) {
-			result = {
-				ok: false,
-				code: "expired",
-				message: "threshold session expired"
-			};
+			result = failure("expired", "threshold session expired");
 			return result;
 		}
 		if (input.options.guard) {
@@ -166,11 +151,7 @@ async function runSealOperation(input) {
 				auth: input.auth
 			});
 			if (!guard.ok) {
-				result = {
-					ok: false,
-					code: toCode(guard.code, "forbidden"),
-					message: toMessage(guard.message, "Request rejected")
-				};
+				result = failure(toCode(guard.code, "forbidden"), toMessage(guard.message, "Request rejected"));
 				return result;
 			}
 		}
@@ -183,11 +164,7 @@ async function runSealOperation(input) {
 			auth: { userId: input.auth.userId }
 		});
 		if (!sealed.ok) {
-			result = {
-				ok: false,
-				code: toCode(sealed.code, "internal"),
-				message: toMessage(sealed.message, "Signing-session seal operation failed")
-			};
+			result = failure(toCode(sealed.code, "internal"), toMessage(sealed.message, "Signing-session seal operation failed"));
 			return result;
 		}
 		result = {
@@ -198,11 +175,7 @@ async function runSealOperation(input) {
 		};
 		return result;
 	} catch (error) {
-		result = {
-			ok: false,
-			code: "internal",
-			message: toMessage(error instanceof Error ? error.message : error, "Internal error")
-		};
+		result = failure("internal", toMessage(error instanceof Error ? error.message : error, "Internal error"));
 		return result;
 	} finally {
 		const durationMs = Math.max(0, nowMs() - startedAtMs);

package/dist/esm/threshold/session/signingSessionSeal/transport/express.js

@@ -1,3 +1,4 @@
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from "./shared.js";
 //#region src/threshold/session/signingSessionSeal/transport/express.ts
 function errMessage(error) {
@@ -10,94 +11,23 @@ function registerSigningSessionSealRoutes(router, ctx) {
 	const basePath = resolveSigningSessionSealBasePath(options.basePath);
 	const applyPath = buildSigningSessionSealApplyPath(basePath);
 	const removePath = buildSigningSessionSealRemovePath(basePath);
-	router.post(applyPath, async (req, res) => {
+	const handleSealRoute = (route, operation) => async (req, res) => {
 		const startedAtMs = Date.now();
 		try {
 			ctx.logger.info("[threshold-signing-session-seal] request", {
-				route: applyPath,
-				operation: "apply-server-seal"
+				route,
+				operation
 			});
-			const parsed = parseSigningSessionSealApplyBody(req.body || {});
+			const parsed = operation === "apply-server-seal" ? parseSigningSessionSealApplyBody(req.body || {}) : parseSigningSessionSealRemoveBody(req.body || {});
 			if (!parsed.ok) {
 				ctx.logger.warn("[threshold-signing-session-seal] invalid_body", {
-					route: applyPath,
-					operation: "apply-server-seal",
+					route,
+					operation,
 					code: parsed.code,
 					message: parsed.message,
 					durationMs: Math.max(0, Date.now() - startedAtMs)
 				});
-				res.status(400).json({
-					ok: false,
-					code: parsed.code,
-					message: parsed.message
-				});
-				return;
-			}
-			const authorized = await authorizeSigningSessionSealRequest({
-				options,
-				headers: req.headers || {},
-				thresholdSessionId: parsed.value.thresholdSessionId
-			});
-			if (!authorized.ok) {
-				ctx.logger.warn("[threshold-signing-session-seal] unauthorized", {
-					route: applyPath,
-					operation: "apply-server-seal",
-					code: authorized.code || "unauthorized",
-					message: authorized.message || "Unauthorized",
-					durationMs: Math.max(0, Date.now() - startedAtMs)
-				});
-				res.status(signingSessionSealAuthorizeStatusCode(authorized)).json({
-					ok: false,
-					code: authorized.code || "unauthorized",
-					message: authorized.message || "Unauthorized"
-				});
-				return;
-			}
-			const result = await options.service.applyServerSeal(parsed.value, authorized.auth);
-			const status = signingSessionSealStatusCode(result);
-			res.status(status).json(result);
-			ctx.logger.info("[threshold-signing-session-seal] response", {
-				route: applyPath,
-				status,
-				ok: result.ok,
-				durationMs: Math.max(0, Date.now() - startedAtMs),
-				userId: authorized.auth.userId
-			});
-		} catch (error) {
-			const message = errMessage(error);
-			ctx.logger.error("[threshold-signing-session-seal] error", {
-				route: applyPath,
-				message,
-				durationMs: Math.max(0, Date.now() - startedAtMs)
-			});
-			res.status(500).json({
-				ok: false,
-				code: "internal",
-				message
-			});
-		}
-	});
-	router.post(removePath, async (req, res) => {
-		const startedAtMs = Date.now();
-		try {
-			ctx.logger.info("[threshold-signing-session-seal] request", {
-				route: removePath,
-				operation: "remove-server-seal"
-			});
-			const parsed = parseSigningSessionSealRemoveBody(req.body || {});
-			if (!parsed.ok) {
-				ctx.logger.warn("[threshold-signing-session-seal] invalid_body", {
-					route: removePath,
-					operation: "remove-server-seal",
-					code: parsed.code,
-					message: parsed.message,
-					durationMs: Math.max(0, Date.now() - startedAtMs)
-				});
-				res.status(400).json({
-					ok: false,
-					code: parsed.code,
-					message: parsed.message
-				});
+				res.status(400).json(failure(parsed.code, parsed.message));
 				return;
 			}
 			const authorized = await authorizeSigningSessionSealRequest({
@@ -107,24 +37,20 @@ function registerSigningSessionSealRoutes(router, ctx) {
 			});
 			if (!authorized.ok) {
 				ctx.logger.warn("[threshold-signing-session-seal] unauthorized", {
-					route: removePath,
-					operation: "remove-server-seal",
+					route,
+					operation,
 					code: authorized.code || "unauthorized",
 					message: authorized.message || "Unauthorized",
 					durationMs: Math.max(0, Date.now() - startedAtMs)
 				});
-				res.status(signingSessionSealAuthorizeStatusCode(authorized)).json({
-					ok: false,
-					code: authorized.code || "unauthorized",
-					message: authorized.message || "Unauthorized"
-				});
+				res.status(signingSessionSealAuthorizeStatusCode(authorized)).json(failure(authorized.code || "unauthorized", authorized.message || "Unauthorized"));
 				return;
 			}
-			const result = await options.service.removeServerSeal(parsed.value, authorized.auth);
+			const result = operation === "apply-server-seal" ? await options.service.applyServerSeal(parsed.value, authorized.auth) : await options.service.removeServerSeal(parsed.value, authorized.auth);
 			const status = signingSessionSealStatusCode(result);
 			res.status(status).json(result);
 			ctx.logger.info("[threshold-signing-session-seal] response", {
-				route: removePath,
+				route,
 				status,
 				ok: result.ok,
 				durationMs: Math.max(0, Date.now() - startedAtMs),
@@ -133,17 +59,15 @@ function registerSigningSessionSealRoutes(router, ctx) {
 		} catch (error) {
 			const message = errMessage(error);
 			ctx.logger.error("[threshold-signing-session-seal] error", {
-				route: removePath,
+				route,
 				message,
 				durationMs: Math.max(0, Date.now() - startedAtMs)
 			});
-			res.status(500).json({
-				ok: false,
-				code: "internal",
-				message
-			});
+			res.status(500).json(failure("internal", message));
 		}
-	});
+	};
+	router.post(applyPath, handleSealRoute(applyPath, "apply-server-seal"));
+	router.post(removePath, handleSealRoute(removePath, "remove-server-seal"));
 }
 //#endregion
 export { registerSigningSessionSealRoutes };

package/dist/esm/threshold/session/signingSessionSeal/transport/fetch.js

@@ -1,4 +1,6 @@
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from "./shared.js";
+import { headersToRecord, readJson } from "../../../../router/framework/http.js";
 //#region src/threshold/session/signingSessionSeal/transport/fetch.ts
 function json(body, status = 200) {
 	return new Response(JSON.stringify(body), {
@@ -6,20 +8,6 @@ function json(body, status = 200) {
 		headers: { "Content-Type": "application/json; charset=utf-8" }
 	});
 }
-async function readJsonSafe(request) {
-	try {
-		return await request.json();
-	} catch {
-		return null;
-	}
-}
-function headersToRecord(headers) {
-	const out = {};
-	headers.forEach((value, key) => {
-		out[key] = value;
-	});
-	return out;
-}
 function errMessage(error) {
 	return error instanceof Error ? error.message : String(error || "Internal error");
 }
@@ -39,7 +27,7 @@ async function handleSigningSessionSealRoutes(ctx) {
 			route: isApply ? applyPath : removePath,
 			operation
 		});
-		const body = await readJsonSafe(ctx.request);
+		const body = await readJson(ctx.request);
 		const parsed = isApply ? parseSigningSessionSealApplyBody(body) : parseSigningSessionSealRemoveBody(body);
 		if (!parsed.ok) {
 			ctx.logger.warn("[threshold-signing-session-seal] invalid_body", {
@@ -49,11 +37,7 @@ async function handleSigningSessionSealRoutes(ctx) {
 				message: parsed.message,
 				durationMs: Math.max(0, Date.now() - startedAtMs)
 			});
-			return json({
-				ok: false,
-				code: parsed.code,
-				message: parsed.message
-			}, 400);
+			return json(failure(parsed.code, parsed.message), 400);
 		}
 		const authorized = await authorizeSigningSessionSealRequest({
 			options,
@@ -69,11 +53,7 @@ async function handleSigningSessionSealRoutes(ctx) {
 				message: authorized.message || "Unauthorized",
 				durationMs: Math.max(0, Date.now() - startedAtMs)
 			});
-			return json({
-				ok: false,
-				code: authorized.code || "unauthorized",
-				message: authorized.message || "Unauthorized"
-			}, signingSessionSealAuthorizeStatusCode(authorized));
+			return json(failure(authorized.code || "unauthorized", authorized.message || "Unauthorized"), signingSessionSealAuthorizeStatusCode(authorized));
 		}
 		const result = isApply ? await options.service.applyServerSeal(parsed.value, authorized.auth) : await options.service.removeServerSeal(parsed.value, authorized.auth);
 		const status = signingSessionSealStatusCode(result);
@@ -93,11 +73,7 @@ async function handleSigningSessionSealRoutes(ctx) {
 			message,
 			durationMs: Math.max(0, Date.now() - startedAtMs)
 		});
-		return json({
-			ok: false,
-			code: "internal",
-			message
-		}, 500);
+		return json(failure("internal", message), 500);
 	}
 }
 //#endregion

package/dist/esm/threshold/session/signingSessionSeal/transport/shared.js

@@ -2,6 +2,7 @@ import { parseThresholdSessionId } from "../../../../shared-ts/src/utils/domainI
 import { ensureLeadingSlash } from "../../../../shared-ts/src/utils/normalize.js";
 import { asRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { WALLET_SESSION_SEAL_BASE_PATH } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 //#region src/threshold/session/signingSessionSeal/transport/shared.ts
 const DEFAULT_BASE_PATH = WALLET_SESSION_SEAL_BASE_PATH;
 function readRequiredString(obj, key) {
@@ -24,24 +25,12 @@ function buildSigningSessionSealRemovePath(basePath) {
 }
 function parseSigningSessionSealApplyBody(body) {
 	const obj = asRecord(body);
-	if (!obj) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Request body must be a JSON object"
-	};
+	if (!obj) return failure("invalid_body", "Request body must be a JSON object");
 	const thresholdSessionId = readRequiredString(obj, "thresholdSessionId");
 	const ciphertext = readRequiredString(obj, "ciphertext");
-	if (!thresholdSessionId || !ciphertext) return {
-		ok: false,
-		code: "invalid_body",
-		message: "thresholdSessionId and ciphertext are required"
-	};
+	if (!thresholdSessionId || !ciphertext) return failure("invalid_body", "thresholdSessionId and ciphertext are required");
 	const parsedThresholdSessionId = parseThresholdSessionId(thresholdSessionId);
-	if (!parsedThresholdSessionId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "thresholdSessionId is invalid"
-	};
+	if (!parsedThresholdSessionId.ok) return failure("invalid_body", "thresholdSessionId is invalid");
 	return {
 		ok: true,
 		value: {
@@ -64,11 +53,7 @@ async function authorizeSigningSessionSealRequest(args) {
 			thresholdSessionId: args.thresholdSessionId
 		});
 	} catch (error) {
-		return {
-			ok: false,
-			code: "internal",
-			message: error instanceof Error ? error.message : String(error || "Authorization failed")
-		};
+		return failure("internal", error instanceof Error ? error.message : String(error || "Authorization failed"));
 	}
 	return {
 		ok: false,

package/dist/types/shared-ts/src/authorization/delegatedAuthority.d.ts

@@ -1,5 +1,6 @@
 import type { AuthorizationParseResult } from './capabilityKinds';
-export type DelegatedWalletPermissionV1 = 'sign' | 'export_keys' | 'link_devices' | 'revoke_devices';
+export type DelegatedWalletPermissionV1 = (typeof DELEGATED_WALLET_PERMISSION_VALUES)[number];
+declare const DELEGATED_WALLET_PERMISSION_VALUES: readonly ["export_keys", "link_devices", "revoke_devices", "sign"];
 type CanonicalPermissionTuple = readonly [
     DelegatedWalletPermissionV1,
     ...DelegatedWalletPermissionV1[]

package/dist/types/shared-ts/src/authorization/walletSessionIssuance.d.ts

@@ -16,14 +16,21 @@ export type WalletSessionCommittedIdentityV1 = {
     readonly quotaId: MpcWalletSigningQuotaId;
 };
 /** The credential-free retry signal shared by issuer response boundaries. */
-type WalletSessionAlreadyCommittedResponseV1 = {
+export type WalletSessionAlreadyCommittedResponseV1 = {
     readonly ok: false;
     readonly code: 'already_committed';
     readonly message: string;
     readonly next: 'unlock_exact_method';
     readonly committed: WalletSessionCommittedIdentityV1;
 };
+/** An issuer rejection that carries no committed identity to retry against. */
+export type WalletSessionRejectionV1 = {
+    readonly ok: false;
+    readonly code: string;
+    readonly message: string;
+    readonly next?: never;
+    readonly committed?: never;
+};
 export declare function parseWalletSessionAlreadyCommittedResponseV1(value: unknown): WalletSessionAlreadyCommittedResponseV1 | null;
 export declare function parseWalletUnlockAlreadyCommittedResponseV1(value: unknown): WalletSessionAlreadyCommittedResponseV1 | null;
-export {};
 //# sourceMappingURL=walletSessionIssuance.d.ts.map

package/dist/types/shared-ts/src/authorization/walletSignerActivationEquality.d.ts

@@ -0,0 +1,4 @@
+import type { WalletEcdsaSignerActivationV1, WalletEd25519SignerActivationV1 } from './walletAuthority';
+export declare function sameWalletEd25519SignerActivationV1(left: WalletEd25519SignerActivationV1, right: WalletEd25519SignerActivationV1): boolean;
+export declare function sameWalletEcdsaSignerActivationV1(left: WalletEcdsaSignerActivationV1, right: WalletEcdsaSignerActivationV1): boolean;
+//# sourceMappingURL=walletSignerActivationEquality.d.ts.map

package/dist/types/shared-ts/src/device-linking/committedSignerPackages.d.ts

@@ -7,6 +7,7 @@ import { type PendingWalletAuthMethodRecordV2 } from '../utils/walletAuthMethodR
 import { type LinkedDeviceEd25519ExportRootPackageV1 } from './ed25519ExportRoot';
 import { type LinkedDeviceEcdsaEncryptedSourceContributionV1, type LinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from './sourceContribution';
 import { type RouterAbEd25519YaoApplicationBindingFactsV1, type RouterAbEd25519YaoActivationPublicReceiptV1, type RouterAbEd25519YaoActivationClientPackageV1, type RouterAbEd25519YaoCeremonyBindingV1 } from '../utils/routerAbEd25519Yao';
+import type { ReadonlyExclusiveUnion } from '../utils/variant';
 export type CommittedEd25519SignerPackageV1 = {
     readonly kind: 'committed_ed25519_signer_package_v1';
     readonly materialActivation: MpcMaterialActivationRef;
@@ -23,22 +24,20 @@ export type CommittedEcdsaSignerPackageV1 = {
     readonly encryptedTargetClientShare: LinkedDeviceEcdsaEncryptedSourceContributionV1;
     readonly activationReceipt: LinkedDeviceEcdsaSourcePreservingActivationReceiptV1;
 };
-export type CommittedSignerPackageSetV1 = {
+export type CommittedSignerPackageSetV1 = ReadonlyExclusiveUnion<{
     readonly kind: 'committed_signer_package_set_v1';
     readonly keyFamilies: readonly ['ed25519'];
     readonly ed25519: CommittedEd25519SignerPackageV1;
-    readonly ecdsa?: never;
 } | {
     readonly kind: 'committed_signer_package_set_v1';
     readonly keyFamilies: readonly ['ecdsa_secp256k1'];
-    readonly ed25519?: never;
     readonly ecdsa: CommittedEcdsaSignerPackageV1;
 } | {
     readonly kind: 'committed_signer_package_set_v1';
     readonly keyFamilies: readonly ['ed25519', 'ecdsa_secp256k1'];
     readonly ed25519: CommittedEd25519SignerPackageV1;
     readonly ecdsa: CommittedEcdsaSignerPackageV1;
-};
+}>;
 export type CommittedAuthorityPackagesV1 = {
     readonly kind: 'committed_authority_packages_v1';
     readonly authority: PendingWalletAuthorityV1;

package/dist/types/shared-ts/src/device-linking/contracts.d.ts

@@ -14,6 +14,7 @@ import type { WalletEmailOtpEnrollmentMaterialV1 } from '../utils/registrationAu
 import type { VerifiedEmailAddress } from '../utils/domainIds';
 import type { LinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, LinkedDeviceOrdinaryMaterialSourceContributionTupleV1 } from './sourceContribution';
 import type { LinkedDeviceWalletSessionCredentialDeliveryBindingV1, LinkedDeviceWalletSessionCredentialDeliveryV1 } from './walletSessionCredentialDelivery';
+import type { ReadonlyExclusiveUnion } from '../utils/variant';
 export type { LinkedDeviceEcdsaSourceContributionBindingV1, LinkedDeviceEcdsaSourceContributionPackageV1, LinkedDeviceEcdsaSourceContributionPreparationV1, LinkedDeviceEcdsaSourceDerivationV1, LinkedDeviceEcdsaSourcePreservingActivationReceiptV1, LinkedDeviceEcdsaSourceContributionV1, LinkedDeviceEcdsaSourceSignerIdentityV1, LinkedDeviceEcdsaTargetRecipientPreparationV1, LinkedDeviceEd25519SourceContributionPreparationV1, LinkedDeviceEd25519SourceContributionV1, LinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, LinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, LinkedDeviceOrdinaryMaterialSourceContributionTupleV1, LinkedDeviceOrdinaryMaterialSourceContributionV1, } from './sourceContribution';
 export type { CommittedAuthorityPackagesV1, CommittedEd25519SignerPackageV1, CommittedEcdsaSignerPackageV1, CommittedSignerPackageSetDigestInputV1, CommittedSignerPackageSetV1, } from './committedSignerPackages';
 /** Public key bytes carried by the link session, encoded as canonical base64url. */
@@ -531,97 +532,40 @@ export type LinkPrecommitFailureV1 = {
     readonly reason: string;
 };
 /** The only durable states retained by the linear link-session boundary. */
-export type LinkSessionStateV1 = {
+export type LinkSessionStateV1 = ReadonlyExclusiveUnion<{
     readonly state: 'displaying_qr';
-    readonly deviceId?: never;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly activatedAtMs?: never;
-    readonly error?: never;
-    readonly cancelledAtMs?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'claimed';
     readonly deviceId: DeviceId;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly activatedAtMs?: never;
-    readonly error?: never;
-    readonly cancelledAtMs?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'awaiting_target_factor';
     readonly deviceId: DeviceId;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly activatedAtMs?: never;
-    readonly error?: never;
-    readonly cancelledAtMs?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'awaiting_source_contribution';
     readonly deviceId: DeviceId;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly activatedAtMs?: never;
-    readonly error?: never;
-    readonly cancelledAtMs?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'provisioning';
     readonly deviceId: DeviceId;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly activatedAtMs?: never;
-    readonly error?: never;
-    readonly cancelledAtMs?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'authority_pending_local_install';
     readonly deviceId: DeviceId;
     readonly authorityId: WalletAuthorityId;
     readonly packageSetDigestB64u: DigestB64u;
-    readonly activatedAtMs?: never;
-    readonly error?: never;
-    readonly cancelledAtMs?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'active';
     readonly deviceId: DeviceId;
     readonly authorityId: WalletAuthorityId;
     readonly activatedAtMs: number;
-    readonly packageSetDigestB64u?: never;
-    readonly error?: never;
-    readonly cancelledAtMs?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'failed_before_commit';
     readonly error: LinkPrecommitFailureV1;
-    readonly deviceId?: never;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly activatedAtMs?: never;
-    readonly cancelledAtMs?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'cancelled';
     readonly cancelledAtMs: number;
-    readonly deviceId?: never;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly activatedAtMs?: never;
-    readonly error?: never;
-    readonly expiredAtMs?: never;
 } | {
     readonly state: 'expired';
     readonly expiredAtMs: number;
-    readonly deviceId?: never;
-    readonly authorityId?: never;
-    readonly packageSetDigestB64u?: never;
-    readonly activatedAtMs?: never;
-    readonly error?: never;
-    readonly cancelledAtMs?: never;
-};
+}>;
 export type VerifiedSourceAuthorityV1 = {
     readonly authority: ActiveWalletAuthorityV1;
     readonly authMethodId: WalletAuthMethodId;
@@ -702,7 +646,7 @@ export type LinkedDeviceTargetCredentialRegistrationResultV1 = {
     readonly keyManifestDigestB64u: DigestB64u;
 };
 /** The ordinary session issued by activation and persisted by the browser. */
-export type WalletCapabilitySubjectV1 = {
+export type WalletCapabilitySubjectV1 = ReadonlyExclusiveUnion<{
     readonly kind: 'sign';
     readonly keyFamily: 'ed25519' | 'ecdsa_secp256k1';
     readonly materialActivation: MpcMaterialActivationRef;
@@ -712,9 +656,7 @@ export type WalletCapabilitySubjectV1 = {
     readonly materialActivation: MpcMaterialActivationRef;
 } | {
     readonly kind: 'link_devices' | 'revoke_devices';
-    readonly keyFamily?: never;
-    readonly materialActivation?: never;
-};
+}>;
 export type ActiveWalletSessionV1 = {
     readonly kind: 'active_wallet_session_v1';
     readonly walletId: WalletId;

package/dist/types/shared-ts/src/device-linking/sourceContribution.d.ts

@@ -179,5 +179,7 @@ export declare function parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV
 export declare function parseLinkedDeviceEcdsaSourceContributionPackageV1(raw: unknown): LinkedDeviceEcdsaSourceContributionPackageV1;
 export declare function parseLinkedDeviceEcdsaSourceContributionBindingV1(raw: unknown): LinkedDeviceEcdsaSourceContributionBindingV1;
 export declare function parseLinkedDeviceEcdsaEncryptedSourceContributionV1(raw: unknown, label: string): LinkedDeviceEcdsaEncryptedSourceContributionV1;
+export declare function sameEcdsaSourceSigner(left: LinkedDeviceEcdsaSourceSignerIdentityV1, right: LinkedDeviceEcdsaSourceSignerIdentityV1): boolean;
+export declare function sameEcdsaTarget(left: LinkedDeviceEcdsaTargetRecipientPreparationV1, right: LinkedDeviceEcdsaTargetRecipientPreparationV1): boolean;
 export {};
 //# sourceMappingURL=sourceContribution.d.ts.map