@seams/wallet 0.6.2 → 0.7.3

package/dist/types/wallet/src/core/signingEngine/session/persistence/sealedSessionStore.d.ts

@@ -1,14 +1,8 @@
-import { type MpcMaterialActivationRef } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { Ed25519DurableMaterialLocator } from '../sealedRecovery/materialActivationKey';
-import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, SIGNING_SESSION_SEAL_STORAGE_SCOPE, SIGNING_SESSION_SECRET_KIND, type SealedSigningSessionEcdsaRestoreMetadata, type SealedSigningSessionEcdsaRestoreSource, type SealedSigningSessionRecord } from '../../../../../../shared-ts/src/utils/signingSessionSeal';
-import { normalizeRuntimePolicyScope } from '../../../../../../shared-ts/src/threshold/signingRootScope';
 import { type ThresholdEcdsaChainTarget } from '../../interfaces/ecdsaChainTarget';
-import { type RouterAbEd25519NormalSigningState } from '../../threshold/ed25519/routerAbNormalSigningState';
-import { type RouterAbEcdsaDerivationNormalSigningStateV1, type RouterAbEcdsaDerivationPublicCapabilityV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import { type DeleteDurableSealedSessionCommand } from './durableSealedSessionCommands';
-import { type EcdsaRoleLocalPersistedMaterialRef } from '../keyMaterialBrands';
-import { type EmailOtpWalletAuthAuthority, type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
-export type SigningSessionRestoreLease = {
+import { type CurrentEd25519SealedSessionRecord, type CurrentSealedSessionRecord, type EcdsaDurableLaneRecord } from './sealedSessionRecords';
+type SigningSessionRestoreLease = {
     v: 1;
     leaseKey: string;
     ownerId: string;
@@ -16,154 +10,9 @@ export type SigningSessionRestoreLease = {
     startedAtMs: number;
     expiresAtMs: number;
 };
-export type SigningSessionRestoreLeaseHandle = SigningSessionRestoreLease & {
+type SigningSessionRestoreLeaseHandle = SigningSessionRestoreLease & {
     thresholdSessionId: string;
 };
-export type SigningSessionSealedStoreRecord = SealedSigningSessionRecord & {
-    storeKey: string;
-    curve: 'ed25519' | 'ecdsa';
-};
-export type Ed25519SealedRecordThresholdSessionIds = {
-    ed25519: string;
-    ecdsa?: string;
-};
-export type EcdsaSealedRecordThresholdSessionIds = {
-    ed25519?: string;
-    ecdsa: string;
-};
-type CurrentEd25519RestoreMetadataBase = {
-    nearAccountId: string;
-    nearEd25519SigningKeyId: string;
-    rpId: string;
-    relayerKeyId: string;
-    participantIds: number[];
-    runtimePolicyScope?: unknown;
-    signerSlot: number;
-    routerAbNormalSigning: RouterAbEd25519NormalSigningState;
-};
-export type CurrentEd25519RestoreMetadata = (CurrentEd25519RestoreMetadataBase & {
-    credentialIdB64u: string;
-    materialActivation: MpcMaterialActivationRef;
-    providerSubjectId?: never;
-    emailHashHex?: never;
-}) | (CurrentEd25519RestoreMetadataBase & {
-    provider: 'google' | 'email';
-    providerSubjectId: string;
-    emailHashHex: string;
-    materialActivation: MpcMaterialActivationRef;
-    credentialIdB64u?: never;
-});
-export type CurrentEd25519SealedSessionRecord = Omit<Extract<SigningSessionSealedStoreRecord, {
-    curve: 'ed25519';
-}>, 'curve' | 'thresholdSessionIds' | 'walletId' | 'relayerUrl' | 'ed25519Restore' | 'ecdsaRestore'> & {
-    curve: 'ed25519';
-    thresholdSessionIds: Ed25519SealedRecordThresholdSessionIds;
-    walletId: string;
-    relayerUrl: string;
-    ed25519Restore: CurrentEd25519RestoreMetadata;
-    ecdsaRestore?: SealedSigningSessionEcdsaRestoreMetadata;
-};
-export type CurrentEcdsaSealedSessionRecord = Omit<Extract<SigningSessionSealedStoreRecord, {
-    curve: 'ecdsa';
-}>, 'curve' | 'thresholdSessionIds' | 'walletId' | 'relayerUrl' | 'signingRootId' | 'signingRootVersion' | 'ecdsaRestore' | 'ed25519Restore'> & {
-    curve: 'ecdsa';
-    thresholdSessionIds: EcdsaSealedRecordThresholdSessionIds;
-    walletId: string;
-    signingRootId?: never;
-    signingRootVersion?: never;
-    relayerUrl: string;
-    ecdsaRestore: SealedSigningSessionEcdsaRestoreMetadata;
-    ed25519Restore?: CurrentEd25519RestoreMetadata;
-};
-declare const ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND: "ecdsa_inactive_sealed_material_v1";
-type EcdsaInactiveSealedMaterialRecordBase = {
-    recordKind: typeof ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND;
-    storeKey: string;
-    curve: 'ecdsa';
-    walletId: string;
-    relayerUrl: string;
-    alg: typeof SIGNING_SESSION_SEAL_ALG;
-    storageScope: typeof SIGNING_SESSION_SEAL_STORAGE_SCOPE;
-    secretKind: typeof SIGNING_SESSION_SECRET_KIND;
-    sealedSecretB64u: string;
-    keyVersion: string;
-    groupId: typeof SIGNING_SESSION_SEAL_GROUP_ID;
-    updatedAtMs: number;
-    issuedAtMs?: never;
-    expiresAtMs?: never;
-    remainingUses?: never;
-    thresholdSessionIds?: never;
-    authorizationRetirementReason: 'expired' | 'exhausted';
-    ed25519Restore?: never;
-};
-type EcdsaInactiveMaterialPublicRestoreBase = {
-    chainTarget: ThresholdEcdsaChainTarget;
-    signingRootId: string;
-    signingRootVersion: string;
-    keyHandle: string;
-    ecdsaThresholdKeyId: string;
-    ethereumAddress: string;
-    relayerKeyId: string;
-    thresholdEcdsaPublicKeyB64u: string;
-    participantIds: number[];
-    runtimePolicyScope: ReturnType<typeof normalizeRuntimePolicyScope>;
-    routerAbEcdsaDerivationNormalSigning: RouterAbEcdsaDerivationNormalSigningStateV1;
-    publicCapability: RouterAbEcdsaDerivationPublicCapabilityV1;
-    clientVerifyingShareB64u?: never;
-};
-export type EcdsaInactiveMaterialPublicRestore = (EcdsaInactiveMaterialPublicRestoreBase & {
-    source: Exclude<SealedSigningSessionEcdsaRestoreSource, 'email_otp'>;
-    authority: WalletAuthAuthorityRef;
-    rpId: string;
-    credentialIdB64u: string;
-    roleLocalMaterialRef: EcdsaRoleLocalPersistedMaterialRef;
-    providerSubjectId?: never;
-    emailHashHex?: never;
-}) | (EcdsaInactiveMaterialPublicRestoreBase & {
-    source: 'email_otp';
-    provider: 'google' | 'email';
-    providerSubjectId: string;
-    emailHashHex: string;
-    authority: WalletAuthAuthorityRef;
-    emailOtpAuthority: EmailOtpWalletAuthAuthority;
-    roleLocalMaterialRef: EcdsaRoleLocalPersistedMaterialRef;
-    rpId?: never;
-    credentialIdB64u?: never;
-});
-export type EcdsaInactiveSealedMaterialRecord = EcdsaInactiveSealedMaterialRecordBase & ({
-    authMethod: 'passkey';
-    ecdsaRestore: Exclude<EcdsaInactiveMaterialPublicRestore, {
-        source: 'email_otp';
-    }>;
-} | {
-    authMethod: 'email_otp';
-    ecdsaRestore: Extract<EcdsaInactiveMaterialPublicRestore, {
-        source: 'email_otp';
-    }>;
-});
-export type EcdsaDurableLaneRecord = SigningSessionSealedStoreRecord | EcdsaInactiveSealedMaterialRecord;
-export type CurrentSealedSessionRecord = CurrentEd25519SealedSessionRecord | CurrentEcdsaSealedSessionRecord;
-export type RawSealedSessionRecord = Record<string, unknown>;
-export type SealedSessionRecordClassificationReason = 'invalid_payload' | 'invalid_header' | 'invalid_identity' | 'owned_by_lane_holder_store' | 'missing_signing_root_id' | 'missing_participant_ids' | 'missing_restore_metadata';
-export type CurrentSealedSessionRecordClassification = {
-    kind: 'current';
-    record: CurrentSealedSessionRecord;
-};
-export type EcdsaInactiveSealedMaterialRecordClassification = {
-    kind: 'ecdsa_inactive_material';
-    record: EcdsaInactiveSealedMaterialRecord;
-};
-type NonCurrentSealedSessionRecordClassificationKind = 'delete_required' | 'rebuild_required' | 'user_action_required' | 'unrelated_record' | 'malformed';
-type NonCurrentSealedSessionRecordClassification = {
-    [K in NonCurrentSealedSessionRecordClassificationKind]: {
-        kind: K;
-        storeKey: string | null;
-        walletId: string | null;
-        reason: SealedSessionRecordClassificationReason;
-        safeSummary: Record<string, unknown>;
-    };
-}[NonCurrentSealedSessionRecordClassificationKind];
-export type SealedSessionRecordClassification = CurrentSealedSessionRecordClassification | EcdsaInactiveSealedMaterialRecordClassification | NonCurrentSealedSessionRecordClassification;
 export type SigningSessionSealedRecordFilter = {
     authMethod: 'passkey' | 'email_otp';
     curve: 'ed25519';
@@ -172,40 +21,10 @@ export type SigningSessionSealedRecordFilter = {
     curve: 'ecdsa';
     chainTarget: ThresholdEcdsaChainTarget;
 };
-export type ListEcdsaSigningSessionSealedRecordsForWalletFilter = {
+type ListEcdsaSigningSessionSealedRecordsForWalletFilter = {
     authMethod?: 'passkey' | 'email_otp';
     curve: 'ecdsa';
 };
-type BuildCurrentSealedSessionRecordCommonInput = {
-    thresholdSessionId: string;
-    sealedSecretB64u: string;
-    authMethod: 'passkey' | 'email_otp';
-    keyVersion: string;
-    groupId: typeof SIGNING_SESSION_SEAL_GROUP_ID;
-    issuedAtMs: number;
-    expiresAtMs: number;
-    remainingUses: number;
-    updatedAtMs: number;
-};
-export type BuildCurrentEd25519SealedSessionRecordInput = BuildCurrentSealedSessionRecordCommonInput & {
-    curve: 'ed25519';
-    thresholdSessionIds: Ed25519SealedRecordThresholdSessionIds;
-    walletId: string;
-    signingRootId?: string;
-    signingRootVersion?: string;
-    relayerUrl: string;
-    ecdsaRestore?: SealedSigningSessionEcdsaRestoreMetadata;
-    ed25519Restore: CurrentEd25519RestoreMetadata;
-};
-export type BuildCurrentEcdsaSealedSessionRecordInput = BuildCurrentSealedSessionRecordCommonInput & {
-    curve: 'ecdsa';
-    thresholdSessionIds: EcdsaSealedRecordThresholdSessionIds;
-    walletId: string;
-    relayerUrl: string;
-    ecdsaRestore: SealedSigningSessionEcdsaRestoreMetadata;
-    ed25519Restore?: CurrentEd25519RestoreMetadata;
-};
-export type BuildCurrentSealedSessionRecordInput = BuildCurrentEd25519SealedSessionRecordInput | BuildCurrentEcdsaSealedSessionRecordInput;
 export type UpdateExactSealedSessionPolicyInput = {
     thresholdSessionId: string;
     filter: SigningSessionSealedRecordFilter;
@@ -213,16 +32,6 @@ export type UpdateExactSealedSessionPolicyInput = {
     remainingUses?: number;
     updatedAtMs: number;
 };
-export type ResolvedIdentityDeleteReason = 'durable_record_deleted' | 'invalid_persisted_record' | 'same_lane_replaced' | 'same_scope_replaced';
-type DeleteExactSealedSessionOptions = {
-    deleteResolvedIdentity: true;
-    resolvedIdentityDeleteReason: ResolvedIdentityDeleteReason;
-} | {
-    deleteResolvedIdentity: false;
-    resolvedIdentityDeleteReason?: never;
-};
-export declare function classifyRawSealedSessionRecord(raw: unknown): SealedSessionRecordClassification;
-export declare function buildCurrentSealedSessionRecord(args: BuildCurrentSealedSessionRecordInput): CurrentSealedSessionRecord | null;
 export declare function readExactSealedSession(thresholdSessionIdRaw: string, filter: SigningSessionSealedRecordFilter): Promise<CurrentSealedSessionRecord | null>;
 export declare function readExactEd25519SealedSession(locator: Ed25519DurableMaterialLocator): Promise<CurrentEd25519SealedSessionRecord | null>;
 export declare function listExactSealedSessionsForWallet(args: {
@@ -234,7 +43,6 @@ export declare function listEcdsaSealedSessionsForWallet(args: {
     filter: ListEcdsaSigningSessionSealedRecordsForWalletFilter;
 }): Promise<EcdsaDurableLaneRecord[]>;
 export declare function writeExactSealedSession(record: CurrentSealedSessionRecord): Promise<void>;
-export declare function buildEcdsaInactiveMaterialPublicRestore(restore: SealedSigningSessionEcdsaRestoreMetadata, relayerUrlRaw: string): EcdsaInactiveMaterialPublicRestore | null;
 export declare function updateExactSealedSessionPolicy(args: UpdateExactSealedSessionPolicyInput): Promise<void>;
 export declare function updateExactEd25519SealedSessionPolicy(args: {
     locator: Ed25519DurableMaterialLocator;
@@ -242,8 +50,6 @@ export declare function updateExactEd25519SealedSessionPolicy(args: {
     remainingUses: number;
     updatedAtMs: number;
 }): Promise<void>;
-export declare function deleteExactSealedSession(thresholdSessionIdRaw: string, filter: SigningSessionSealedRecordFilter, options: DeleteExactSealedSessionOptions): Promise<void>;
-export declare function deleteExactEd25519SealedSession(locator: Ed25519DurableMaterialLocator, options: DeleteExactSealedSessionOptions): Promise<void>;
 export declare function deleteDurableSealedSessionRecord(command: DeleteDurableSealedSessionCommand): Promise<void>;
 export declare function acquireSigningSessionRestoreLease(args: {
     thresholdSessionId: string;
@@ -252,6 +58,5 @@ export declare function acquireSigningSessionRestoreLease(args: {
     ttlMs?: number;
 } & SigningSessionSealedRecordFilter): Promise<SigningSessionRestoreLeaseHandle | null>;
 export declare function releaseSigningSessionRestoreLease(lease: SigningSessionRestoreLeaseHandle | null | undefined): Promise<void>;
-export declare function clearAllSealedSessions(): Promise<void>;
 export {};
 //# sourceMappingURL=sealedSessionStore.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/postconditions/runtimePostconditions.d.ts

@@ -4,15 +4,15 @@ import type { AvailableSigningLanes } from '../availability/availableSigningLane
 import { type OwnerLaneScope } from '../identity/signingLaneAuthBinding';
 import type { SigningSessionSealAuthMethod } from '../../../../../../shared-ts/src/utils/signingSessionSeal';
 import type { MpcWalletSigningQuotaId, WalletSessionAuthorizationId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
-export type RuntimePostconditionSource = 'registration_finalize' | 'wallet_unlock';
-export type RuntimePostconditionTarget = {
+type RuntimePostconditionSource = 'registration_finalize' | 'wallet_unlock';
+type RuntimePostconditionTarget = {
     curve: 'ed25519';
     chainTarget?: never;
 } | {
     curve: 'ecdsa';
     chainTarget: ThresholdEcdsaChainTarget;
 };
-export type RuntimeLaneMaterial = {
+type RuntimeLaneMaterial = {
     kind: 'durable_sealed_record';
     sourceChainTarget?: never;
 } | {
@@ -25,7 +25,7 @@ export type RuntimeLaneMaterial = {
     kind: 'canonical_capability';
     sourceChainTarget?: never;
 };
-export type RestorableRuntimeLaneMaterial = Extract<RuntimeLaneMaterial, {
+type RestorableRuntimeLaneMaterial = Extract<RuntimeLaneMaterial, {
     kind: 'durable_sealed_record' | 'public_capability_reference';
 }>;
 type UsableRuntimeLaneIdentity = {
@@ -46,7 +46,6 @@ type UsableRuntimeLaneIdentity = {
     authorizationId: WalletSessionAuthorizationId;
     materialActivationId: string;
 };
-export type RuntimePostconditionLaneState = 'ready' | 'restorable';
 type ActiveUsableRuntimeLane = UsableRuntimeLaneIdentity & {
     readonly state: 'ready';
     readonly remainingSignatureUses: number;
@@ -63,24 +62,15 @@ type RestorableUsableRuntimeLane = Extract<UsableRuntimeLaneIdentity, {
     readonly expiresAtMs: number;
     readonly material: RestorableRuntimeLaneMaterial;
 };
-export type UsableRuntimeLane = ActiveUsableRuntimeLane | RestorableUsableRuntimeLane;
+type UsableRuntimeLane = ActiveUsableRuntimeLane | RestorableUsableRuntimeLane;
 export type WalletRuntimeInventory = {
     walletId: string;
     authMethod: SigningSessionSealAuthMethod;
     ed25519?: UsableRuntimeLane;
     ecdsaByTarget: ReadonlyMap<string, UsableRuntimeLane>;
 };
-export type WalletRuntimePostconditionFailureCode = 'wallet_missing' | 'auth_method_missing' | 'ed25519_lane_missing' | 'ecdsa_lane_missing' | 'lane_inventory_mismatch' | 'auth_method_route_mismatch' | 'lane_material_missing';
-export type WalletRuntimePostconditionResult = {
-    ok: true;
-    inventory: WalletRuntimeInventory;
-} | {
-    ok: false;
-    code: WalletRuntimePostconditionFailureCode;
-    details: Record<string, unknown>;
-};
 /**
- * R103C: the postcondition read is owner-scoped at the source. The reader
+ * The postcondition read is owner-scoped at the source. The reader
  * already filtered to the exact owner authority and signer slot, so the
  * canonical aggregate lane IS the owner's one operational lane per curve.
  * There is nothing to search, rank, or repair here — a lane is usable,
@@ -90,25 +80,6 @@ type ReadOwnerScopedSigningLanes = (args: {
     walletId: string | WalletId;
     ownerScope: OwnerLaneScope;
 }) => Promise<AvailableSigningLanes>;
-export declare class WalletRuntimePostconditionError extends Error {
-    readonly code: WalletRuntimePostconditionFailureCode;
-    readonly details: Record<string, unknown>;
-    constructor(result: Extract<WalletRuntimePostconditionResult, {
-        ok: false;
-    }>);
-}
-export declare function readWalletRuntimePostconditions(args: {
-    source: RuntimePostconditionSource;
-    walletId: string | WalletId;
-    ownerScope: OwnerLaneScope;
-    requiredTargets: readonly RuntimePostconditionTarget[];
-    readOwnerScopedSigningLanes: ReadOwnerScopedSigningLanes;
-    nowMs?: number;
-}): Promise<WalletRuntimePostconditionResult>;
-export declare function compareWalletRuntimeInventories(args: {
-    registration: WalletRuntimeInventory;
-    unlock: WalletRuntimeInventory;
-}): WalletRuntimePostconditionResult;
 export declare function assertWalletRuntimePostconditions(args: {
     source: RuntimePostconditionSource;
     walletId: string | WalletId;

package/dist/types/wallet/src/core/signingEngine/session/public.d.ts

@@ -27,7 +27,7 @@ export type SessionPublicDeps = {
 };
 export declare function discoverPersistedSessionsForWallet(deps: SessionPublicDeps, args: DiscoverPersistedSessionsForWalletInput): Promise<DiscoverPersistedSessionsForWalletResult>;
 export declare function readPersistedAvailableSigningLanes(deps: SessionPublicDeps, args: Omit<ReadAvailableSigningLanesInput, 'ecdsaChainTargets'>): Promise<AvailableSigningLanes>;
-/** R103C human operational read: one exact owner, configured ECDSA targets. */
+/** Human operational read: one exact owner, configured ECDSA targets. */
 export declare function readOwnerScopedSigningLanes(deps: SessionPublicDeps, args: {
     readonly walletId: WalletId | string;
     readonly ownerScope: OwnerLaneScope;

package/dist/types/wallet/src/core/signingEngine/session/routerAbSigningWalletSession.d.ts

@@ -22,15 +22,15 @@ export type RouterAbEd25519SigningWalletSession = {
     signingRootVersion: string;
     routerAbNormalSigning: RouterAbEd25519NormalSigningState;
 };
-export type RouterAbSigningWalletSessionParseFailureReason = 'missing_record' | 'cookie_session' | 'missing_session_identity' | 'missing_wallet_session_token' | 'missing_quota_id' | 'missing_threshold_session_id' | 'missing_signing_root' | 'signing_root_mismatch' | 'missing_client_verifying_share' | 'material_identity_mismatch' | 'wallet_binding_mismatch' | 'missing_runtime_policy_scope' | 'missing_router_ab_state' | 'invalid_router_ab_state' | 'invalid_budget' | 'expired' | 'exhausted';
-export type RouterAbSigningWalletSessionResult<T> = {
+type RouterAbSigningWalletSessionParseFailureReason = 'missing_record' | 'cookie_session' | 'missing_session_identity' | 'missing_wallet_session_token' | 'missing_quota_id' | 'missing_threshold_session_id' | 'missing_signing_root' | 'signing_root_mismatch' | 'missing_client_verifying_share' | 'material_identity_mismatch' | 'wallet_binding_mismatch' | 'missing_runtime_policy_scope' | 'missing_router_ab_state' | 'invalid_router_ab_state' | 'invalid_budget' | 'expired' | 'exhausted';
+type RouterAbSigningWalletSessionResult<T> = {
     ok: true;
     value: T;
 } | {
     ok: false;
     reason: RouterAbSigningWalletSessionParseFailureReason;
 };
-export type BuildRouterAbEd25519SigningWalletSessionInput = {
+type BuildRouterAbEd25519SigningWalletSessionInput = {
     walletId: string;
     nearAccountId: string;
     nearEd25519SigningKeyId: string;
@@ -48,4 +48,5 @@ export type BuildRouterAbEd25519SigningWalletSessionInput = {
     nowMs: number;
 };
 export declare function buildRouterAbEd25519SigningWalletSession(input: BuildRouterAbEd25519SigningWalletSessionInput): RouterAbSigningWalletSessionResult<RouterAbEd25519SigningWalletSession>;
+export {};
 //# sourceMappingURL=routerAbSigningWalletSession.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/sealedRecovery/recoveryRecord.d.ts

@@ -2,7 +2,7 @@ import type { ThresholdEcdsaChainTarget } from '../../interfaces/ecdsaChainTarge
 import { type ThresholdRuntimePolicyScope } from '../../threshold/sessionPolicy';
 import { type RouterAbEcdsaDerivationNormalSigningStateV1, type RouterAbEcdsaDerivationPublicCapabilityV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import { type EmailOtpWalletAuthAuthority, type PasskeyWalletAuthAuthority, type WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
-import type { RawSealedSessionRecord } from '../persistence/sealedSessionStore';
+import type { RawSealedSessionRecord } from '../persistence/sealedSessionRecords';
 import type { ThresholdEcdsaSessionStoreSource } from '../identity/laneIdentity';
 import { type EcdsaRoleLocalPersistedMaterialRef } from '../keyMaterialBrands';
 type RawThresholdSessionIds = {
@@ -117,7 +117,7 @@ export type EmailOtpEcdsaSealedRecoveryRecord = EcdsaSealedRecoveryRecordBase &
     rpId?: never;
 };
 export type SealedRecoveryRecord = PasskeyEcdsaSealedRecoveryRecord | EmailOtpEcdsaSealedRecoveryRecord;
-export type NormalizeSealedRecoveryRecordResult = {
+type NormalizeSealedRecoveryRecordResult = {
     kind: 'accepted';
     record: SealedRecoveryRecord;
 } | {

package/dist/types/wallet/src/core/signingEngine/session/sealedRecovery/sealedRecovery.types.d.ts

@@ -3,6 +3,7 @@ import type { ExactEcdsaSigningLaneIdentity } from '../identity/exactSigningLane
 import type { EcdsaThresholdKeyId } from '../keyMaterialBrands';
 import type { MpcMaterialActivationRef } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { RawSigningSessionSealedStoreRecord, RejectedSealedRecoveryRecord, SealedRecoveryRecord } from './recoveryRecord';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 type RestoreSealedSessionListInput = {
     walletId: string;
     authMethod: 'email_otp' | 'passkey';
@@ -26,13 +27,11 @@ export type RestorePersistedSessionForSigningInput = RestorePersistedSessionForS
         ecdsaThresholdKeyId: EcdsaThresholdKeyId;
     };
 };
-export type RestorePersistedSessionForSigningResult = {
+export type RestorePersistedSessionForSigningResult = ExclusiveUnion<{
     kind: 'completed';
     attempted: number;
     restored: number;
     deferred: number;
-    duplicateCount?: never;
-    duplicateRecordSummaries?: never;
 } | {
     kind: 'duplicate_records';
     attempted: 0;
@@ -40,7 +39,7 @@ export type RestorePersistedSessionForSigningResult = {
     deferred: 0;
     duplicateCount: number;
     duplicateRecordSummaries: readonly Record<string, unknown>[];
-};
+}>;
 export type RestorePersistedSessionPurpose = {
     walletId: string;
     authMethod: 'email_otp' | 'passkey';

package/dist/types/wallet/src/core/signingEngine/session/userPreferences.d.ts

@@ -15,7 +15,7 @@ export type UserPreferencesStorePort = ProfileLastSelectionPort & {
         preferences: Partial<UserPreferences>;
     }) => Promise<unknown>;
 };
-export type UserPreferencesManagerDeps = {
+type UserPreferencesManagerDeps = {
     store: UserPreferencesStorePort;
 };
 export declare class UserPreferencesManager {
@@ -54,4 +54,5 @@ export declare class UserPreferencesManager {
     loadUserSettings(): Promise<void>;
     saveUserSettings(): Promise<void>;
 }
+export {};
 //# sourceMappingURL=userPreferences.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/warmCapabilities/capabilityReader.d.ts

@@ -1,5 +1,4 @@
 import type { WarmSessionStatusResult } from '../../uiConfirm/uiConfirm.types';
-import { type WarmSessionCapabilityReaderSeal } from './capabilityReaderCore';
 import { type WarmSessionStatusReaderDeps } from './statusReader';
 import { type WarmSessionReadPorts, type WarmSessionReadPortsInput } from './readModel';
 import type { WarmSessionCapabilityReader } from './types';
@@ -8,10 +7,10 @@ import type { WalletId } from '../../interfaces/ecdsaChainTarget';
 import type { ExactNearEd25519WalletSessionAuthorization } from '../material/nearEd25519YaoSigningPreparation';
 import type { EmailOtpWarmMaterialTarget } from '../../workerManager/workerTypes';
 import type { ActiveEcdsaCapabilityRuntimeForChainResolver, ActiveEcdsaCapabilityRuntimeResolver } from '../material/activeEcdsaCapabilityRuntime';
-export type WarmSessionCapabilityReaderSealInput = {
+type WarmSessionCapabilityReaderSealInput = {
     groupId: string;
 } | null;
-export type WarmSessionCapabilityReaderTouchConfirmInput = Exclude<WarmSessionReadPortsInput, undefined>;
+type WarmSessionCapabilityReaderTouchConfirmInput = Exclude<WarmSessionReadPortsInput, undefined>;
 export type WarmCapabilityReaderPortsConfigured = {
     runtimeStatus: 'configured';
     touchConfirm: WarmSessionReadPorts | null;
@@ -22,7 +21,6 @@ export type WarmCapabilityReaderPortsNoRuntimeStatus = {
     touchConfirm: null;
     getEmailOtpWarmSessionStatus: (target: EmailOtpWarmMaterialTarget) => Promise<WarmSessionStatusResult>;
 };
-export type WarmCapabilityReaderPorts = WarmCapabilityReaderPortsConfigured | WarmCapabilityReaderPortsNoRuntimeStatus;
 export type WarmSessionCapabilityReaderFactoryDeps = Omit<WarmSessionStatusReaderDeps, 'getEmailOtpWarmSessionStatus' | 'touchConfirm'> & {
     resolveActiveEcdsaCapabilityRuntime: ActiveEcdsaCapabilityRuntimeResolver;
     resolveActiveEcdsaCapabilityRuntimeForChain: ActiveEcdsaCapabilityRuntimeForChainResolver;
@@ -32,7 +30,6 @@ export type WarmSessionCapabilityReaderFactoryDeps = Omit<WarmSessionStatusReade
     resolveActiveEcdsaWalletSessionAuthorization?: ExactEcdsaWalletSessionAuthorizationResolver;
     resolveActiveEd25519WalletSessionAuthorization?: (walletId: WalletId) => Promise<ExactNearEd25519WalletSessionAuthorization | null>;
 };
-export declare function normalizeWarmCapabilityReaderPorts(deps: Pick<WarmSessionCapabilityReaderFactoryDeps, 'touchConfirm' | 'getEmailOtpWarmSessionStatus'>): WarmCapabilityReaderPorts;
-export declare function normalizeWarmSessionCapabilityReaderSeal(sealInput: WarmSessionCapabilityReaderSealInput): WarmSessionCapabilityReaderSeal;
 export declare function createWarmSessionCapabilityReader(deps: WarmSessionCapabilityReaderFactoryDeps): WarmSessionCapabilityReader;
+export {};
 //# sourceMappingURL=capabilityReader.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/warmCapabilities/capabilityReaderCore.d.ts

@@ -1,21 +1,19 @@
 import type { ActiveEcdsaCapabilityRuntimeForChainResolver, ActiveEcdsaCapabilityRuntimeResolver } from '../material/activeEcdsaCapabilityRuntime';
-import type { EcdsaSealTransportAuthMaterial } from '../persistence/sealedSessionTransportAuth';
-import type { ExactEcdsaSigningLaneIdentity } from '../identity/exactSigningLaneIdentity';
-import type { ExactEcdsaWalletSessionAuthorizationResolver, ExactEvmFamilyWalletSessionAuthorization } from '../material/ecdsaSigningCapability';
+import type { ExactEcdsaWalletSessionAuthorizationResolver } from '../material/ecdsaSigningCapability';
 import { type WalletId } from '../../interfaces/ecdsaChainTarget';
-import type { WarmSessionEcdsaCapabilityState, WarmSessionEnvelope } from './types';
+import type { WarmSessionCapabilityReader } from './types';
 import type { WarmSigningStatusReader } from './statusReader';
 import type { ExactNearEd25519WalletSessionAuthorization } from '../material/nearEd25519YaoSigningPreparation';
-export type WarmSessionCapabilityReaderSealConfigured = {
+type WarmSessionCapabilityReaderSealConfigured = {
     seal: 'configured';
     groupId: string;
 };
-export type WarmSessionCapabilityReaderSealUnavailable = {
+type WarmSessionCapabilityReaderSealUnavailable = {
     seal: 'unconfigured';
     groupId?: never;
 };
 export type WarmSessionCapabilityReaderSeal = WarmSessionCapabilityReaderSealConfigured | WarmSessionCapabilityReaderSealUnavailable;
-export type WarmSessionCapabilityReaderCoreDeps = {
+type WarmSessionCapabilityReaderCoreDeps = {
     resolveActiveEcdsaCapabilityRuntime: ActiveEcdsaCapabilityRuntimeResolver;
     resolveActiveEcdsaCapabilityRuntimeForChain: ActiveEcdsaCapabilityRuntimeForChainResolver;
     statusReader: Pick<WarmSigningStatusReader, 'readEd25519WarmSessionClaim'>;
@@ -23,16 +21,6 @@ export type WarmSessionCapabilityReaderCoreDeps = {
     resolveActiveEcdsaWalletSessionAuthorization?: ExactEcdsaWalletSessionAuthorizationResolver;
     resolveActiveEd25519WalletSessionAuthorization?: (walletId: WalletId) => Promise<ExactNearEd25519WalletSessionAuthorization | null>;
 };
-export type WarmSessionCapabilityReaderCore = {
-    getWarmSession: (walletId: WalletId) => Promise<WarmSessionEnvelope>;
-    getEcdsaCapabilityForLane: (args: {
-        lane: ExactEcdsaSigningLaneIdentity;
-        authorization: ExactEvmFamilyWalletSessionAuthorization;
-    }) => Promise<WarmSessionEcdsaCapabilityState | null>;
-    resolveEcdsaSealTransportForLane: (args: {
-        lane: ExactEcdsaSigningLaneIdentity;
-        authorization: ExactEvmFamilyWalletSessionAuthorization;
-    }) => Promise<EcdsaSealTransportAuthMaterial | null>;
-};
-export declare function createWarmSessionCapabilityReaderCore(deps: WarmSessionCapabilityReaderCoreDeps): WarmSessionCapabilityReaderCore;
+export declare function createWarmSessionCapabilityReaderCore(deps: WarmSessionCapabilityReaderCoreDeps): WarmSessionCapabilityReader;
+export {};
 //# sourceMappingURL=capabilityReaderCore.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/warmCapabilities/clearVolatileWarmSigningMaterial.d.ts

@@ -1,8 +1,9 @@
 import type { WalletId } from '../../interfaces/ecdsaChainTarget';
 import type { ClearVolatileWarmSessionMaterialCommand, VolatileWarmSessionMaterialClearAll, VolatileWarmSessionMaterialClearer } from '../../uiConfirm/uiConfirm.types';
-export type ClearVolatileWarmSigningMaterialDeps = {
+type ClearVolatileWarmSigningMaterialDeps = {
     touchConfirm: VolatileWarmSessionMaterialClearer | VolatileWarmSessionMaterialClearAll;
     clearVolatileThresholdSessionMaterial: (command: ClearVolatileWarmSessionMaterialCommand) => Promise<void>;
 };
 export declare function clearVolatileWarmSigningMaterial(deps: ClearVolatileWarmSigningMaterialDeps, walletId?: WalletId): Promise<void>;
+export {};
 //# sourceMappingURL=clearVolatileWarmSigningMaterial.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/warmCapabilities/ecdsaLoginPrefill.d.ts

@@ -30,7 +30,7 @@ export type RouterAbEcdsaDerivationLoginPresignaturePrefillResult = {
     walletSessionId: WalletSessionId;
     error: string;
 };
-export type RouterAbEcdsaDerivationLoginPresignaturePrefillDeps = {
+type RouterAbEcdsaDerivationLoginPresignaturePrefillDeps = {
     getSignerWorkerContext: () => SignerWorkerManagerContext;
     resolveClientSigningMaterialSource: (args: {
         manifest: ActiveEcdsaCapabilityManifest;
@@ -42,4 +42,5 @@ export type EcdsaSessionPresignaturePrefillInput = {
     waitForPoolReady?: boolean;
 };
 export declare function scheduleRouterAbEcdsaDerivationLoginPresignaturePrefill(deps: RouterAbEcdsaDerivationLoginPresignaturePrefillDeps, args: EcdsaSessionPresignaturePrefillInput): Promise<RouterAbEcdsaDerivationLoginPresignaturePrefillResult>;
+export {};
 //# sourceMappingURL=ecdsaLoginPrefill.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/warmCapabilities/ecdsaProvisionPlan.d.ts

@@ -13,7 +13,7 @@ export type EcdsaSigningKeyContext = {
     ecdsaThresholdKeyId: string;
     participantIds: readonly number[];
 };
-export type PasskeyPrfFirstB64u = string & {
+type PasskeyPrfFirstB64u = string & {
     readonly __brand: 'PasskeyPrfFirstB64u';
 };
 export type PasskeyEcdsaProvisionSecretSource = {
@@ -22,12 +22,12 @@ export type PasskeyEcdsaProvisionSecretSource = {
     webauthnAuthentication: WebAuthnAuthenticationCredential;
     emailOtpAuthContext?: never;
 };
-export type PasskeyEcdsaActivationMaterial = {
+type PasskeyEcdsaActivationMaterial = {
     kind: 'session_record';
     relayerUrl?: never;
     walletKey?: never;
 };
-export type EmailOtpEcdsaProvisionSecretSource = {
+type EmailOtpEcdsaProvisionSecretSource = {
     kind: 'email_otp_worker_session_v1';
     workerHandle: Extract<EmailOtpWorkerIssuedSessionHandle, {
         action: 'threshold_ecdsa_bootstrap';
@@ -36,7 +36,7 @@ export type EmailOtpEcdsaProvisionSecretSource = {
     webauthnAuthentication?: never;
     passkeyPrfFirstB64u?: never;
 };
-export type PasskeyEcdsaSessionProvision = {
+type PasskeyEcdsaSessionProvision = {
     kind: 'passkey_ecdsa_session_provision';
     key: EvmFamilyEcdsaKeyIdentity;
     chainTarget: ThresholdEcdsaChainTarget;
@@ -53,7 +53,7 @@ export type PasskeyEcdsaSessionProvision = {
     passkeyPrfFirstB64u?: never;
     webauthnAuthentication?: never;
 };
-export type EmailOtpEcdsaSessionProvision = {
+type EmailOtpEcdsaSessionProvision = {
     kind: 'email_otp_ecdsa_session_provision';
     key: EvmFamilyEcdsaKeyIdentity;
     chainTarget: ThresholdEcdsaChainTarget;
@@ -104,44 +104,10 @@ type BuildEmailOtpEcdsaSessionProvisionPlanArgs = {
     webauthnAuthentication?: never;
     reconnectMaterial?: never;
 };
-export type BuildEcdsaSessionProvisionPlanArgs = BuildPasskeyEcdsaSessionProvisionPlanArgs | BuildEmailOtpEcdsaSessionProvisionPlanArgs;
-export declare function buildPasskeyEcdsaProvisionSecretSource(args: {
-    passkeyPrfFirstB64u: string;
-    webauthnAuthentication: WebAuthnAuthenticationCredential;
-}): PasskeyEcdsaProvisionSecretSource;
-export declare function buildEmailOtpEcdsaProvisionSecretSource(args: {
-    workerHandle: Extract<EmailOtpWorkerIssuedSessionHandle, {
-        action: 'threshold_ecdsa_bootstrap';
-    }>;
-    emailOtpAuthContext: ThresholdEcdsaEmailOtpAuthContext;
-}): EmailOtpEcdsaProvisionSecretSource;
+type BuildEcdsaSessionProvisionPlanArgs = BuildPasskeyEcdsaSessionProvisionPlanArgs | BuildEmailOtpEcdsaSessionProvisionPlanArgs;
 export declare function buildEcdsaSessionIdentity(args: {
     thresholdSessionId: unknown;
 }): EcdsaSessionIdentity;
-export declare function buildPasskeyEcdsaSessionProvision(args: {
-    key: EvmFamilyEcdsaKeyIdentity;
-    chainTarget: ThresholdEcdsaChainTarget;
-    newSessionIdentity: EcdsaSessionIdentity;
-    signingKeyContext: EcdsaSigningKeyContext;
-    sessionKind: 'opaque';
-    sessionBudgetUses: number;
-    requestId: string;
-    provisionSecretSource: PasskeyEcdsaProvisionSecretSource;
-    activationMaterial: PasskeyEcdsaActivationMaterial;
-    operationCredential: WalletSessionOperationCredentialV1;
-    runtimePolicyScope?: ThresholdRuntimePolicyScope;
-}): PasskeyEcdsaSessionProvision;
-export declare function buildEmailOtpEcdsaSessionProvision(args: {
-    key: EvmFamilyEcdsaKeyIdentity;
-    chainTarget: ThresholdEcdsaChainTarget;
-    newSessionIdentity: EcdsaSessionIdentity;
-    signingKeyContext: EcdsaSigningKeyContext;
-    sessionKind: 'opaque';
-    sessionBudgetUses: number;
-    provisionSecretSource: EmailOtpEcdsaProvisionSecretSource;
-    walletSessionRouteAuth: WalletSessionOperationCredentialV1;
-    runtimePolicyScope?: ThresholdRuntimePolicyScope;
-}): EmailOtpEcdsaSessionProvision;
 export declare function buildEcdsaSessionProvisionPlan(args: BuildEcdsaSessionProvisionPlanArgs): EcdsaSessionProvisionPlan;
 export {};
 //# sourceMappingURL=ecdsaProvisionPlan.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/warmCapabilities/ecdsaProvisionPlan.typecheck.d.ts

@@ -1,2 +1,6 @@
+export declare const signingKeyContext: {
+    ecdsaThresholdKeyId: string;
+    participantIds: number[];
+};
 export {};
 //# sourceMappingURL=ecdsaProvisionPlan.typecheck.d.ts.map