@seams/wallet 0.7.1 → 0.7.3

package/dist/types/wallet/src/core/signingEngine/flows/signEvmFamily/emailOtpSigningSession.d.ts

@@ -142,7 +142,7 @@ export declare function requestEmailOtpSigningSessionChallenge(deps: EmailOtpEcd
     walletSession: WalletSessionRef;
     chainTarget: ThresholdEcdsaChainTarget;
 }): Promise<EmailOtpTransactionSigningChallenge>;
-type RefreshEmailOtpSigningSessionArgs = {
+export type RefreshEmailOtpSigningSessionArgs = {
     walletSession: WalletSessionRef;
     chainTarget: ThresholdEcdsaChainTarget;
     challengeId: string;

package/dist/types/wallet/src/core/signingEngine/flows/signEvmFamily/freshAuthRetryPolicy.d.ts

@@ -3,6 +3,7 @@ import { type SignerAuthMethod } from '../../../../../../shared-ts/src/utils/sig
 import { type OperationAuthorizationQueueKey, type WalletSessionQuotaAdmissionDecision } from '../../session/operationState/authorizationAdmission';
 import type { SigningSessionCoordinator } from '../../session/SigningSessionCoordinator';
 import type { EvmFamilySenderSignatureAlgorithm } from './types';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export type EvmFamilyFreshAuthRetrySideEffectState = 'no_auth_side_effect_started' | 'auth_prompt_shown' | 'auth_confirmed' | 'threshold_reconnect_started';
 export type EvmFamilySigningAuthSideEffect = 'auth_prompt_shown' | 'email_otp_challenge' | 'passkey_reauth' | 'auth_confirmed' | 'threshold_reconnect';
 type EvmFamilyFreshAuthRetryTrigger = 'wallet_session_reauthorization_required' | 'wallet_signing_budget_exhausted';
@@ -64,15 +65,13 @@ type EvmFamilyFreshAuthRetryInputBase = {
     hasStepUpAuthPlan?: boolean;
     sideEffectState: EvmFamilyFreshAuthRetrySideEffectState;
 };
-type EvmFamilyFreshAuthRetryInput = EvmFamilyFreshAuthRetryInputBase & ({
+type EvmFamilyFreshAuthRetryInput = EvmFamilyFreshAuthRetryInputBase & ExclusiveUnion<{
     trigger: 'wallet_session_reauthorization_required';
-    activeSigningAuthMethod?: never;
-    admissionRetryState?: never;
 } | {
     trigger: 'wallet_signing_budget_exhausted';
     activeSigningAuthMethod: SignerAuthMethod;
     admissionRetryState: EvmFamilyAdmissionRetryState;
-});
+}>;
 export declare function nextEvmFamilyFreshAuthRetrySideEffectState(args: {
     current: EvmFamilyFreshAuthRetrySideEffectState;
     sideEffect: EvmFamilySigningAuthSideEffect;

package/dist/types/wallet/src/core/signingEngine/flows/signEvmFamily/nonceResolution.d.ts

@@ -3,6 +3,7 @@ import type { EvmSigningRequest } from '../../chains/evm/evmSigning.types';
 import type { TempoSigningRequest } from '../../chains/tempo/tempoSigning.types';
 import type { ThresholdEcdsaChainTarget } from '../../interfaces/ecdsaChainTarget';
 import type { EvmFamilyAccountMetadataDeps } from './accountAuth';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export type { EvmFamilyAccountMetadataDeps };
 export type EvmFamilyNonceNetworkDeps = {
     seamsWebConfigs: SeamsConfigsReadonly;
@@ -15,15 +16,13 @@ export declare function resolveNonceNetworkKeyForError(args: {
     configs: SeamsConfigsReadonly;
     request: EvmSigningRequest | TempoSigningRequest;
 }): string;
-export type EvmFamilyManagedNonceSenderIdentity = {
+export type EvmFamilyManagedNonceSenderIdentity = ExclusiveUnion<{
     kind: 'threshold_owner';
     thresholdOwnerAddress: `0x${string}`;
-    chainAccountAddress?: never;
 } | {
     kind: 'chain_account';
     chainAccountAddress: `0x${string}`;
-    thresholdOwnerAddress?: never;
-};
+}>;
 export declare function thresholdOwnerNonceSenderIdentity(thresholdOwnerAddress: `0x${string}`): EvmFamilyManagedNonceSenderIdentity;
 export declare function resolveWalletChainNonceSenderIdentity(args: {
     deps: EvmFamilyAccountMetadataDeps;

package/dist/types/wallet/src/core/signingEngine/flows/signEvmFamily/readySecp256k1Material.d.ts

@@ -6,24 +6,21 @@ import type { ExactEcdsaCapabilityRuntime, ExactEcdsaMaterialRuntime, ExactEcdsa
 import { type ReadySecp256k1SigningMaterial } from './signers/secp256k1';
 import type { AuthorizedEvmFamilyEcdsaSigningCapability, CanonicalEvmFamilyEcdsaSigningCapability, ExactEvmFamilyWalletSessionAuthorization } from '../../session/material/ecdsaSigningCapability';
 import type { ActiveWalletAuthorityEcdsaRuntimeV1 } from '../../session/material/activeWalletAuthorityEcdsaRuntime';
-export type ReadySecp256k1SigningMaterialResolution = {
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
+export type ReadySecp256k1SigningMaterialResolution = ReadonlyExclusiveUnion<{
     readonly kind: 'ready';
     readonly material: ReadySecp256k1SigningMaterial;
-    readonly reason?: never;
 } | {
     readonly kind: 'unavailable';
     readonly reason: 'material_activation_mismatch' | 'chain_mismatch' | 'runtime_correlation_mismatch' | 'runtime_policy_scope_missing' | 'authorization_expired' | 'authorization_exhausted' | 'device_link_required' | 'material_corrupt';
-    readonly material?: never;
-};
-export type HydratedSecp256k1SigningMaterialResolution = {
+}>;
+export type HydratedSecp256k1SigningMaterialResolution = ReadonlyExclusiveUnion<{
     readonly kind: 'ready';
     readonly material: HydratedEcdsaSignerMaterial;
-    readonly reason?: never;
 } | {
     readonly kind: 'unavailable';
     readonly reason: 'material_activation_mismatch' | 'chain_mismatch' | 'runtime_correlation_mismatch' | 'runtime_policy_scope_missing' | 'device_link_required' | 'material_corrupt';
-    readonly material?: never;
-};
+}>;
 /** Ready ECDSA signing material, assembled from each fact's canonical owner:
  * the manifest names the material and its public facts, the exact durable
  * runtime supplies normal-signing state, policy scope, and transport, and the

package/dist/types/wallet/src/core/signingEngine/flows/signEvmFamily/signers/ecdsaDerivationClientSigningMaterialSource.d.ts

@@ -12,4 +12,5 @@ export declare function loadRouterAbEcdsaDerivationSigningMaterialSource(args: {
     signerSession: HydratedEcdsaSignerMaterial;
     workerCtx: WorkerOperationContext;
 }): Promise<LoadedRouterAbEcdsaDerivationSigningMaterialSource>;
+export declare function createLinkedHolderClientSigningMaterialSource(holderHandleId: string): RouterAbEcdsaDerivationClientSigningMaterialSource;
 //# sourceMappingURL=ecdsaDerivationClientSigningMaterialSource.d.ts.map

package/dist/types/wallet/src/core/signingEngine/flows/signEvmFamily/signingFlowRuntime.d.ts

@@ -1,14 +1,14 @@
 import type { SigningSessionPlan, SigningOperationContext } from '../../session/operationState/types';
 import type { SigningOperationTransitionObserver } from '../shared/signingStateMachine';
 import type { EvmFamilySigningDeps } from '../../interfaces/operationDeps';
-import type { EvmFamilyLifecycleEventCallback, EvmFamilySenderSignatureAlgorithm } from './types';
+import type { EvmFamilyLifecycleEventCallback } from './types';
+import type { PreparedEvmFamilyEcdsaSigningSession } from './preparedSigning';
 import type { EcdsaSigningMaterialPlan } from './signingFlow';
 import type { EvmFamilyThresholdEcdsaStepUpRuntime } from './requireEvmFamilyStepUpAuth';
 import type { EvmFamilySigningAuthSideEffect } from './freshAuthRetryPolicy';
 import type { ThresholdEcdsaChainTarget, WalletId, WalletSessionRef } from '../../interfaces/ecdsaChainTarget';
 import type { EvmSigningRequest } from '../../chains/evm/evmSigning.types';
 import type { TempoSigningRequest } from '../../chains/tempo/tempoSigning.types';
-import type { ExactEcdsaSigningLaneIdentity } from '../../session/identity/exactSigningLaneIdentity';
 import type { OperationDigestSet } from '../../../../../../shared-ts/src/authorization/operationFingerprint';
 import { type ActiveWalletAuthorityEcdsaSigningAuthPlan, type ActiveWalletAuthorityEcdsaRuntimeV1 } from '../../session/material/activeWalletAuthorityEcdsaRuntime';
 import type { TransactionSigningIntent } from '../../session/operationState/transactionState';
@@ -23,7 +23,6 @@ export declare function createEvmFamilySigningFlowRuntime(args: {
     walletSession: WalletSessionRef;
     request: TempoSigningRequest | EvmSigningRequest;
     chainTarget: ThresholdEcdsaChainTarget;
-    senderSignatureAlgorithm: EvmFamilySenderSignatureAlgorithm;
     signingSessionPlan?: SigningSessionPlan;
     emailOtpSigningForFlow?: EvmFamilyThresholdEcdsaStepUpRuntime['emailOtpSigning'];
     confirmationConfigOverride?: unknown;
@@ -32,9 +31,15 @@ export declare function createEvmFamilySigningFlowRuntime(args: {
     onAuthSideEffectStarted?: (sideEffect: EvmFamilySigningAuthSideEffect) => void;
     signingOperation?: SigningOperationContext;
     onSigningOperationTransition?: SigningOperationTransitionObserver;
-    getEcdsaSigningLaneIdentity: () => ExactEcdsaSigningLaneIdentity;
+} & ({
+    senderSignatureAlgorithm: 'secp256k1';
+    preparedSession: PreparedEvmFamilyEcdsaSigningSession;
     activeWalletAuthority?: ActiveWalletAuthorityEvmFamilyFlowRuntime;
-}): Promise<{
+} | {
+    senderSignatureAlgorithm: 'webauthnP256';
+    preparedSession?: never;
+    activeWalletAuthority?: never;
+})): Promise<{
     flowArgs: {
         confirmationConfigOverride: unknown;
         thresholdEcdsaStepUpRuntime?: EvmFamilyThresholdEcdsaStepUpRuntime | undefined;

package/dist/types/wallet/src/core/signingEngine/flows/signNear/shared/ed25519YaoCapabilityResolution.d.ts

@@ -4,6 +4,7 @@ import type { NearEd25519YaoSigningPreparation } from '../../../session/material
 import type { MpcMaterialActivationRef, ThresholdEd25519SessionId } from '../../../../../../../shared-ts/src/utils/domainIds';
 import type { WebAuthnAuthenticationCredential } from '../../../../types/webauthn';
 import type { SignerAuthMethod } from '../../../../../../../shared-ts/src/utils/signerDomain';
+import type { ExclusiveUnion } from '../../../../../../../shared-ts/src/utils/variant';
 type NearEd25519AuthorizationResult = {
     thresholdSessionId: ThresholdEd25519SessionId;
     material: NearEd25519YaoOperationMaterial;
@@ -48,26 +49,19 @@ export declare function prepareNearOperationStepUpMaterial(args: {
     preparation: NearEd25519YaoSigningPreparation;
     executor: NearEd25519YaoMaterialExecutor;
 }): Promise<NearOperationStepUpMaterial>;
-type ResolveNearOperationStepUpMaterialArgs = {
+type ResolveNearOperationStepUpMaterialArgs = ExclusiveUnion<{
     kind: 'passkey';
     material: Extract<NearOperationStepUpMaterial, {
         kind: 'passkey_live' | 'passkey_sealed';
     }>;
     expectedActivation: MpcMaterialActivationRef;
     credential: WebAuthnAuthenticationCredential;
-    normalSigningRequest?: never;
-    displayDigest?: never;
-    proof?: never;
 } | {
     kind: 'email_otp_live';
     material: Extract<NearOperationStepUpMaterial, {
         kind: 'email_otp_live';
     }>;
     expectedActivation: MpcMaterialActivationRef;
-    normalSigningRequest?: never;
-    displayDigest?: never;
-    proof?: never;
-    credential?: never;
 } | {
     kind: 'email_otp_sealed';
     material: Extract<NearOperationStepUpMaterial, {
@@ -81,8 +75,7 @@ type ResolveNearOperationStepUpMaterialArgs = {
     proof: Parameters<Extract<NearEmailOtpEd25519OperationStepUpCapabilityPreparation, {
         kind: 'sealed';
     }>['authorizeAndRehydrate']>[0]['proof'];
-    credential?: never;
-};
+}>;
 export declare function resolveNearOperationStepUpMaterial(args: ResolveNearOperationStepUpMaterialArgs): Promise<ResolvedNearOperationStepUpMaterial>;
 export declare function resolveConfirmedNearEd25519YaoCapability(args: {
     authorization: Extract<NearEd25519StepUpAuthorization, {

package/dist/types/wallet/src/core/signingEngine/flows/signNear/shared/operationStepUpPreparation.d.ts

@@ -3,6 +3,7 @@ import type { RouterAbNormalSigningPrepareRequestV2BuildResult } from '../../../
 import type { CapabilityOperationEnvelope } from '../../../../../../../shared-ts/src/authorization/operationFingerprint';
 import type { NearOperationStepUpPreparationPort, NearOperationStepUpPreparationRef } from '../../../interfaces/operationStepUpPreparation';
 import { type MpcMaterialActivationRef } from '../../../../../../../shared-ts/src/utils/domainIds';
+import type { ExclusiveUnion } from '../../../../../../../shared-ts/src/utils/variant';
 type PreparedNearOperationStepUpBase = {
     prepare: RouterAbNormalSigningPrepareRequestV2BuildResult;
     signingDigestB64u: string;
@@ -15,7 +16,7 @@ export type PreparedNearOperationStepUp = (PreparedNearOperationStepUpBase & {
     kind: 'near_signature_only';
     unsignedTransactionBorshB64u?: never;
 });
-type NearOperationStepUpBuilderInput = {
+type NearOperationStepUpBuilderInput = ExclusiveUnion<{
     kind: 'near_transaction';
     transactionContext: TransactionContext;
     operationId: string;
@@ -24,10 +25,7 @@ type NearOperationStepUpBuilderInput = {
 } | {
     kind: 'near_signature_only';
     displayDigest: string;
-    transactionContext?: never;
-    operationId?: never;
-    operationFingerprint?: never;
-};
+}>;
 type PreparedNearOperationStepUpBuilder = (input: NearOperationStepUpBuilderInput) => Promise<{
     operation: PreparedNearOperationStepUp;
     envelope: CapabilityOperationEnvelope;

package/dist/types/wallet/src/core/signingEngine/flows/signNear/signNep413.d.ts

@@ -1,25 +1,21 @@
 import type { NearNep413Payload } from '../../interfaces/near';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 /**
  * Sign a NEP-413 message using the active threshold-controlled NEAR key.
  *
  * @param payload - NEP-413 signing parameters including message, recipient, nonce, and state
  * @returns Promise resolving to signing result with account ID, public key, and signature
  */
-type InternalSignNep413MessageResult = {
+type InternalSignNep413MessageResult = ExclusiveUnion<{
     success: true;
     accountId: string;
     publicKey: string;
     signature: string;
     state?: string;
-    error?: never;
 } | {
     success: false;
     error: string;
-    accountId?: never;
-    publicKey?: never;
-    signature?: never;
-    state?: never;
-};
+}>;
 export declare function signNep413Message({ ctx, commandSubject, nearAccount, signingSessionCoordinator, payload, forceFreshAuth, passkeyEd25519OperationStepUp, emailOtpEd25519StepUp, yaoSigningPreparation, yaoMaterialExecutor, selection, onEvent, }: NearNep413Payload): Promise<InternalSignNep413MessageResult>;
 export {};
 //# sourceMappingURL=signNep413.d.ts.map

package/dist/types/wallet/src/core/signingEngine/interfaces/near.d.ts

@@ -31,6 +31,7 @@ import type { RouterAbNormalSigningPrepareRequestV2Wire } from '../../rpcClients
 import type { Ed25519OperationStepUpProof } from '../threshold/ed25519/walletSession';
 import type { DigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { SigningOperationStateRef } from '../flows/shared/signingStateMachine';
+import type { ExclusiveUnion } from '../../../../../shared-ts/src/utils/variant';
 type NearResolvedEd25519WalletSessionAuth = {
     kind: 'wallet_session_opaque';
     walletSessionToken: string;
@@ -194,15 +195,13 @@ export type NearTransactionWithActionsPayload = (NearTransactionWithActionsPaylo
     transactionOperation?: never;
     ed25519SigningBoundary?: never;
 });
-export type NearAdHocEd25519Selection = {
+export type NearAdHocEd25519Selection = ExclusiveUnion<{
     kind: 'authorized';
     selectedLane: SelectedEd25519Lane;
-    candidate?: never;
 } | {
     kind: 'authorization_required';
-    selectedLane?: never;
     candidate: AuthorizationRequiredEd25519LaneCandidate;
-};
+}>;
 export type NearDelegateActionPayload = {
     ctx: NearSigningRuntimeDeps;
     commandSubject: NearCommandSubject;

package/dist/types/wallet/src/core/signingEngine/interfaces/operationDeps.d.ts

@@ -26,6 +26,7 @@ import type { ExactEcdsaWalletSessionAuthorizationResolver, AuthorizedEvmFamilyE
 import type { OwnerLaneScope } from '../session/identity/signingLaneAuthBinding';
 import type { DigestB64u } from '../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { ExactWalletSessionReadPorts } from '../session/identity/exactWalletSessionCredential';
+import type { ReadonlyExclusiveUnion } from '../../../../../shared-ts/src/utils/variant';
 export type EvmFamilyChain = 'tempo' | 'evm';
 export type DurableEmailOtpEcdsaSigningSessionAuthorityResolver = {
     resolveDurableEmailOtpEcdsaSigningSessionAuthority: (args: {
@@ -43,15 +44,12 @@ export type NearEd25519MaterialIdentity = {
 type NearEd25519MaterialBoundaryInput = {
     readonly walletId: WalletId;
     readonly nearAccountId: AccountId;
-} & ({
+} & ReadonlyExclusiveUnion<{
     readonly laneIdentity: ExactEd25519SigningLaneIdentity;
     readonly auth: SigningLaneAuthBinding;
-    readonly materialIdentity?: never;
 } | {
-    readonly laneIdentity?: never;
-    readonly auth?: never;
     readonly materialIdentity: NearEd25519MaterialIdentity;
-});
+}>;
 export type NearSigningApiDeps = {
     nearRpcUrl: string;
     touchConfirm: UiConfirmSigningPort;

package/dist/types/wallet/src/core/signingEngine/interfaces/operationStepUpPreparation.d.ts

@@ -1,4 +1,5 @@
 import type { TransactionContext } from '../../types/rpc';
+import type { ExclusiveUnion } from '../../../../../shared-ts/src/utils/variant';
 declare const nearOperationStepUpHandleBrand: unique symbol;
 type NearOperationStepUpHandle = string & {
     readonly [nearOperationStepUpHandleBrand]: true;
@@ -9,7 +10,7 @@ export type NearOperationStepUpPreparationRef = {
     challengeB64u: string;
 };
 export type NearOperationStepUpPreparationPort = {
-    prepare(input: {
+    prepare(input: ExclusiveUnion<{
         kind: 'near_transaction';
         requestId: string;
         transactionContext: TransactionContext;
@@ -20,10 +21,7 @@ export type NearOperationStepUpPreparationPort = {
         kind: 'near_signature_only';
         requestId: string;
         displayDigest: string;
-        transactionContext?: never;
-        operationId?: never;
-        operationFingerprint?: never;
-    }): Promise<NearOperationStepUpPreparationRef>;
+    }>): Promise<NearOperationStepUpPreparationRef>;
     cancel(input: {
         requestId: string;
         handle?: NearOperationStepUpHandle;

package/dist/types/wallet/src/core/signingEngine/nonce/nearTransactionReadiness.d.ts

@@ -3,6 +3,7 @@ import type { TransactionContext } from '../../types/rpc';
 import type { WalletId } from '../interfaces/ecdsaChainTarget';
 import type { NonceLeaseRef } from '../interfaces/nonceLease';
 import type { PreparedNonceOperationContext } from './nonceTypes';
+import type { ExclusiveUnion } from '../../../../../shared-ts/src/utils/variant';
 type NearFundingSubject = Readonly<{
     walletId: WalletId;
     nearAccountId: AccountId;
@@ -13,16 +14,13 @@ export type NearFundingRequest = Readonly<{
     operation: PreparedNonceOperationContext;
     signatureUses: number;
 }>;
-export type NearTransactionReadiness = {
+export type NearTransactionReadiness = ExclusiveUnion<{
     kind: 'context_ready';
     transactionContext: TransactionContext;
     nonceLeases: NonceLeaseRef[];
-    request?: never;
 } | {
     kind: 'funding_required';
     request: NearFundingRequest;
-    transactionContext?: never;
-    nonceLeases?: never;
-};
+}>;
 export {};
 //# sourceMappingURL=nearTransactionReadiness.d.ts.map

package/dist/types/wallet/src/core/signingEngine/nonce/nonceTypes.d.ts

@@ -177,7 +177,7 @@ export type NonceCoordinatorAlert = {
 export type NonceCoordinatorSameOriginLockPort = {
     withLock<T>(key: string, task: () => Promise<T>): Promise<T>;
 };
-type NonceLaneCoordinationRecordBaseWithoutLifecycle = {
+export type NonceLaneCoordinationRecordBaseWithoutLifecycle = {
     v: 1;
     laneKey: string;
     leaseId: string;
@@ -200,7 +200,7 @@ export type NonceDurableLeaseLifecycle<TTransactionHash extends string = string>
     state: typeof NonceDurableLeaseState.BroadcastAccepted;
     txHash: TTransactionHash;
 };
-type NonceLaneCoordinationRecordBase<TTransactionHash extends string> = NonceLaneCoordinationRecordBaseWithoutLifecycle & NonceDurableLeaseLifecycle<TTransactionHash>;
+export type NonceLaneCoordinationRecordBase<TTransactionHash extends string> = NonceLaneCoordinationRecordBaseWithoutLifecycle & NonceDurableLeaseLifecycle<TTransactionHash>;
 export type NonceLaneCoordinationRecord = (NonceLaneCoordinationRecordBase<`0x${string}`> & {
     family: 'evm';
     chainTarget: ThresholdEcdsaChainTarget;

package/dist/types/wallet/src/core/signingEngine/routerAb/ecdsaDerivation/clientCeremony.d.ts

@@ -7,6 +7,7 @@ import type { CapabilityInstanceRef, MpcMaterialActivationRef } from '../../../.
 import type { WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { EcdsaServerActivationCommand } from '../../session/material/ecdsaCapabilityManifest';
 import type { WalletCustodyEvmFamilyPublicFacts } from '../../../../../../shared-ts/src/passkey-custody';
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export type CreateRouterAbEcdsaRegistrationCeremonyRequestV1 = {
     readonly kind: 'create_router_ab_ecdsa_registration_ceremony_v1';
     readonly ceremonyId: string;
@@ -43,21 +44,18 @@ export type PersistInitialCanonicalEcdsaActivationRequestV1 = PersistInitialCano
     readonly clientActivation: RouterAbEcdsaVerifiedClientActivationFactsV1;
 };
 type PersistInitialCanonicalEcdsaActivationFailureCode = 'invalid_ceremony_state' | 'ceremony_plan_mismatch' | 'invalid_activation_plan' | 'exact_record_conflict' | 'corrupt' | 'persistence_unavailable';
-export type PersistInitialCanonicalEcdsaActivationResultV1 = {
+export type PersistInitialCanonicalEcdsaActivationResultV1 = ReadonlyExclusiveUnion<{
     readonly ok: true;
     readonly kind: 'initial_canonical_ecdsa_activation_persisted_v1';
     readonly ceremonyId: string;
     readonly journalId: InitialEcdsaCapabilityActivationPlanInput['journalId'];
-    readonly code?: never;
-    readonly message?: never;
 } | {
     readonly ok: false;
     readonly kind: 'initial_canonical_ecdsa_activation_persistence_failed_v1';
     readonly ceremonyId: string;
     readonly code: PersistInitialCanonicalEcdsaActivationFailureCode;
     readonly message: string;
-    readonly journalId?: never;
-};
+}>;
 type FinalizeRouterAbEcdsaRegistrationActivationRequestBaseV1 = {
     readonly kind: 'finalize_router_ab_ecdsa_registration_activation_v1';
     readonly journalId: CorrelationId;
@@ -83,35 +81,20 @@ export type ReconcileCanonicalEcdsaActivationRequestV1 = {
     readonly capability: CapabilityInstanceRef;
     readonly authority: WalletAuthAuthorityRef;
 };
-export type ReconcileCanonicalEcdsaActivationResultV1 = {
+export type ReconcileCanonicalEcdsaActivationResultV1 = ReadonlyExclusiveUnion<{
     readonly kind: 'canonical_ecdsa_activation_reconciliation_pending_v1';
     readonly journalId: CorrelationId;
     readonly reason: 'parent_confirmation_and_server_query_required' | 'wallet_custody_rejoin_required';
     readonly activationCommand: EcdsaServerActivationCommand | null;
-    readonly activation?: never;
-    readonly code?: never;
 } | {
     readonly kind: 'canonical_ecdsa_activation_reconciliation_finalized_v1';
     readonly activation: FinalizeRouterAbEcdsaRegistrationActivationResultV1;
-    readonly journalId?: never;
-    readonly reason?: never;
-    readonly activationCommand?: never;
-    readonly code?: never;
 } | {
     readonly kind: 'canonical_ecdsa_activation_reconciliation_absent_v1';
-    readonly journalId?: never;
-    readonly reason?: never;
-    readonly activationCommand?: never;
-    readonly activation?: never;
-    readonly code?: never;
 } | {
     readonly kind: 'canonical_ecdsa_activation_reconciliation_failed_v1';
     readonly code: 'corrupt' | 'persistence_unavailable';
-    readonly journalId?: never;
-    readonly reason?: never;
-    readonly activationCommand?: never;
-    readonly activation?: never;
-};
+}>;
 export type ReconcileCanonicalEcdsaActivationWorkerResultV1 = ReconcileCanonicalEcdsaActivationResultV1 | {
     readonly kind: 'canonical_ecdsa_activation_committed_finalization_required_v1';
     readonly journalId: CorrelationId;

package/dist/types/wallet/src/core/signingEngine/routerAb/ecdsaDerivation/poolFillRoutes.d.ts

@@ -1,17 +1,7 @@
-import { type RouterAbEcdsaDerivationNormalSigningScopeV1, type RouterAbEcdsaOperationStepUpPreparationV1Wire } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-import type { RouterAbNormalSigningAuthorizationWire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import { type RouterAbEcdsaDerivationNormalSigningScopeV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import type { RouterAbEcdsaDerivationPoolFillAuthorization } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
 import type { RouterAbOwnerNormalSigningCredential } from '../../../rpcClients/relayer/routerAbNormalSigning';
-export type RouterAbEcdsaDerivationPoolFillAuthorization = {
-    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
-        readonly kind: 'reusable_wallet_session';
-    }>;
-    readonly operation?: never;
-} | {
-    readonly authorization: Extract<RouterAbNormalSigningAuthorizationWire, {
-        readonly kind: 'operation_step_up';
-    }>;
-    readonly operation: RouterAbEcdsaOperationStepUpPreparationV1Wire;
-};
+export type { RouterAbEcdsaDerivationPoolFillAuthorization };
 type RouterAbEcdsaDerivationPoolFillProgress = {
     ok: boolean;
     code?: string;
@@ -61,5 +51,4 @@ type RouterAbEcdsaDerivationPoolFillStepArgs = {
     requestTimeoutMs?: number;
 } & RouterAbEcdsaDerivationPoolFillAuthorization;
 export declare function routerAbEcdsaDerivationPresignaturePoolFillStep(args: RouterAbEcdsaDerivationPoolFillStepArgs): Promise<RouterAbEcdsaDerivationPoolFillProgress>;
-export {};
 //# sourceMappingURL=poolFillRoutes.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/availability/persistedAvailableSigningLanes.d.ts

@@ -36,6 +36,6 @@ export declare function readPersistedAvailableSigningLanesForSigning(deps: Persi
 export declare function readPersistedAvailableSigningLanesForTargets(deps: PersistedAvailableSigningLanesDeps, args: Omit<ReadAvailableSigningLanesInput, 'ecdsaChainTargets'> & {
     ecdsaChainTargets: readonly ThresholdEcdsaChainTarget[];
     requiredEcdsaCapability: EcdsaLaneCapability;
-}, statusReads: WalletSessionStatusReadScope): Promise<AvailableSigningLanes>;
+}, statusReads: WalletSessionStatusReadScope, curves: 'all' | 'ecdsa'): Promise<AvailableSigningLanes>;
 export {};
 //# sourceMappingURL=persistedAvailableSigningLanes.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/emailOtp/EmailOtpWalletSessionCoordinator.d.ts

@@ -1,20 +1,43 @@
-import { EmailOtpWalletSessionRuntime, type EmailOtpWalletSessionCoordinatorDeps } from './coordinatorRuntime';
+import type { WarmSessionStatusResult } from '../../uiConfirm/uiConfirm.types';
+import type { DiscoverPersistedSessionsForWalletInput, DiscoverPersistedSessionsForWalletResult, RestorePersistedSessionForSigningInput, RestorePersistedSessionForSigningResult } from '../sealedRecovery/sealedRecovery.types';
+import type { EmailOtpWalletSessionCoordinatorDeps } from './ports';
+import type { EmailOtpWarmMaterialTarget } from '../../workerManager/workerTypes';
+import type { EmailOtpTransactionSigningChallenge } from './publicTypes';
+import { type EmailOtpThresholdEcdsaLoginResult, type LoginEmailOtpEcdsaCapabilityArgs, type LoginEmailOtpEcdsaCapabilityForSigningArgs } from './ecdsaLogin';
+import { type EmailOtpEcdsaExportArtifact, type ExportEcdsaKeyWithDurableAuthorizationArgs, type ExportEd25519YaoSeedWithFreshEmailOtpLaneArgs, type RequestEmailOtpChallengeArgs, type RequestEmailOtpExportChallengeArgs } from './exportRecoveryRuntime';
+import { EmailOtpSealedSessionRegistry } from './sealedSessionRegistry';
+import type { WarmSessionMaterialOperationTarget } from './sealedRuntimePurpose';
 export type { EmailOtpThresholdEcdsaLoginResult, LoginEmailOtpEcdsaCapabilityArgs, } from './ecdsaLogin';
 export type { EmailOtpCoordinatorRuntimePorts, EmailOtpEcdsaSessionPorts, EmailOtpSealedSessionStorePorts, EmailOtpWalletSessionCoordinatorDeps, } from './ports';
 export declare class EmailOtpWalletSessionCoordinator {
-    private readonly runtime;
+    private sealedRefreshDiagnosticLogAtMsByKey;
+    private readonly sealedRefreshPolicy;
+    private readonly sealedRestoreOrchestrator;
+    private readonly runtimeConfig;
+    private readonly sealedSessionRegistry;
+    private readonly warmSessionRuntime;
+    private readonly exportRecoveryRuntime;
+    private readonly ecdsaLifecycleRuntime;
     constructor(deps: EmailOtpWalletSessionCoordinatorDeps);
-    persistEcdsaSessionForRefresh(args: Parameters<EmailOtpWalletSessionRuntime['persistEcdsaSessionForRefresh']>[0]): ReturnType<EmailOtpWalletSessionRuntime['persistEcdsaSessionForRefresh']>;
-    discoverPersistedSessionsForWallet(args: Parameters<EmailOtpWalletSessionRuntime['discoverPersistedSessionsForWallet']>[0]): ReturnType<EmailOtpWalletSessionRuntime['discoverPersistedSessionsForWallet']>;
-    restorePersistedSessionForSigning(args: Parameters<EmailOtpWalletSessionRuntime['restorePersistedSessionForSigning']>[0]): ReturnType<EmailOtpWalletSessionRuntime['restorePersistedSessionForSigning']>;
-    readWarmSessionStatusOnly(target: Parameters<EmailOtpWalletSessionRuntime['readWarmSessionStatusOnly']>[0]): ReturnType<EmailOtpWalletSessionRuntime['readWarmSessionStatusOnly']>;
-    consumeWarmSessionUses(args: Parameters<EmailOtpWalletSessionRuntime['consumeWarmSessionUses']>[0]): ReturnType<EmailOtpWalletSessionRuntime['consumeWarmSessionUses']>;
-    clearVolatileWarmSessionMaterial(target: Parameters<EmailOtpWalletSessionRuntime['clearVolatileWarmSessionMaterial']>[0]): ReturnType<EmailOtpWalletSessionRuntime['clearVolatileWarmSessionMaterial']>;
-    requestTransactionSigningChallenge(args: Parameters<EmailOtpWalletSessionRuntime['requestTransactionSigningChallenge']>[0]): ReturnType<EmailOtpWalletSessionRuntime['requestTransactionSigningChallenge']>;
-    requestExportChallenge(args: Parameters<EmailOtpWalletSessionRuntime['requestExportChallenge']>[0]): ReturnType<EmailOtpWalletSessionRuntime['requestExportChallenge']>;
-    exportEcdsaKeyWithDurableAuthorization(args: Parameters<EmailOtpWalletSessionRuntime['exportEcdsaKeyWithDurableAuthorization']>[0]): ReturnType<EmailOtpWalletSessionRuntime['exportEcdsaKeyWithDurableAuthorization']>;
-    exportEd25519YaoSeedWithFreshEmailOtpLane(args: Parameters<EmailOtpWalletSessionRuntime['exportEd25519YaoSeedWithFreshEmailOtpLane']>[0]): ReturnType<EmailOtpWalletSessionRuntime['exportEd25519YaoSeedWithFreshEmailOtpLane']>;
-    loginWithEcdsaCapabilityForSigning(args: Parameters<EmailOtpWalletSessionRuntime['loginWithEcdsaCapabilityForSigning']>[0]): ReturnType<EmailOtpWalletSessionRuntime['loginWithEcdsaCapabilityForSigning']>;
-    loginWithEcdsaCapabilityInternal(args: Parameters<EmailOtpWalletSessionRuntime['loginWithEcdsaCapabilityInternal']>[0]): ReturnType<EmailOtpWalletSessionRuntime['loginWithEcdsaCapabilityInternal']>;
+    persistEcdsaSessionForRefresh(args: Parameters<EmailOtpSealedSessionRegistry['persistEcdsaSessionForRefresh']>[0]): Promise<void>;
+    private clearEcdsaRestoreCaches;
+    private shouldLogSealedRefreshDiagnostic;
+    discoverPersistedSessionsForWallet(args: DiscoverPersistedSessionsForWalletInput): Promise<DiscoverPersistedSessionsForWalletResult>;
+    restorePersistedSessionForSigning(args: RestorePersistedSessionForSigningInput): Promise<RestorePersistedSessionForSigningResult>;
+    readWarmSessionStatusOnly(target: EmailOtpWarmMaterialTarget): Promise<WarmSessionStatusResult>;
+    consumeWarmSessionUses(args: WarmSessionMaterialOperationTarget & {
+        uses?: number;
+    }): Promise<WarmSessionStatusResult>;
+    clearVolatileWarmSessionMaterial(target: EmailOtpWarmMaterialTarget): Promise<void>;
+    requestTransactionSigningChallenge(args: RequestEmailOtpChallengeArgs): Promise<EmailOtpTransactionSigningChallenge>;
+    requestExportChallenge(args: RequestEmailOtpExportChallengeArgs): Promise<EmailOtpTransactionSigningChallenge>;
+    exportEcdsaKeyWithDurableAuthorization(args: ExportEcdsaKeyWithDurableAuthorizationArgs): Promise<EmailOtpEcdsaExportArtifact>;
+    exportEd25519YaoSeedWithFreshEmailOtpLane(args: ExportEd25519YaoSeedWithFreshEmailOtpLaneArgs): Promise<{
+        artifactKind: 'near-ed25519-seed-v1';
+        publicKey: string;
+        privateKey: string;
+    }>;
+    loginWithEcdsaCapabilityForSigning(args: LoginEmailOtpEcdsaCapabilityForSigningArgs): Promise<EmailOtpThresholdEcdsaLoginResult>;
+    loginWithEcdsaCapabilityInternal(args: LoginEmailOtpEcdsaCapabilityArgs): Promise<EmailOtpThresholdEcdsaLoginResult>;
 }
 //# sourceMappingURL=EmailOtpWalletSessionCoordinator.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/emailOtp/ecdsaPublication.d.ts

@@ -12,6 +12,7 @@ import type { WorkerOperationContext } from '../../workerManager/executeWorkerOp
 import { type EvmFamilyEcdsaWalletKey } from '../identity/evmFamilyEcdsaIdentity';
 import { type PersistedEcdsaRoleLocalMaterial } from '../material/ecdsaRoleLocalMaterialResolver';
 import type { ActiveEcdsaCapabilityManifest } from '../material/ecdsaCapabilityManifest';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 type EmailOtpEcdsaPublicationTimingBucket = 'signingSessionSealApplyMs' | 'warmCapabilityPersistenceMs';
 export type EmailOtpEcdsaPublicationTimings = Record<EmailOtpEcdsaPublicationTimingBucket, number>;
 export type EmailOtpEcdsaPublicationPorts = {
@@ -47,19 +48,16 @@ export type ResolvedEmailOtpExistingEcdsaKey = {
     persistedRoleLocalMaterial: PersistedEcdsaRoleLocalMaterial;
     runtimePolicyScope: ThresholdRuntimePolicyScope;
 };
-export type EmailOtpEcdsaScopeSelector = {
+export type EmailOtpEcdsaScopeSelector = ExclusiveUnion<{
     kind: 'exact';
     runtimePolicyScope: ThresholdRuntimePolicyScope;
     authorityRef: WalletAuthAuthorityRef;
 } | {
     kind: 'exact_authority';
     authorityRef: WalletAuthAuthorityRef;
-    runtimePolicyScope?: never;
 } | {
     kind: 'durable_manifest';
-    runtimePolicyScope?: never;
-    authorityRef?: never;
-};
+}>;
 export declare function projectEmailOtpExistingEcdsaKeyToChainTarget(args: {
     existingKey: ResolvedEmailOtpExistingEcdsaKey;
     chainTarget: ThresholdEcdsaChainTarget;

package/dist/types/wallet/src/core/signingEngine/session/emailOtp/ed25519ExportContext.d.ts

@@ -11,7 +11,8 @@ import type { ExactWalletSessionStatus } from '../../../rpcClients/relayer/walle
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type MpcMaterialActivationRef } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type EmailOtpWalletAuthAuthority } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
-import type { PasskeyCustodyEnvelopeRecord, PasskeyCustodySecretBinding } from '../../../../../../shared-ts/src/passkey-custody';
+import type { PasskeyCustodyEnvelopeRecord } from '../../../../../../shared-ts/src/passkey-custody';
+import type { Ed25519YaoClientRootEnvelopeRecordV1 } from '../passkey/passkeyCustodySessionCache';
 import type { ActiveEmailOtpWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 type EmailOtpEd25519LaneAuth = Extract<SigningLaneAuthBinding, {
     kind: 'email_otp';
@@ -45,11 +46,6 @@ export type EmailOtpEd25519ExportAuthorizationReadResultV1 = {
     readonly kind: 'missing' | 'upgrade_required' | 'corrupt' | 'persistence_unavailable' | 'exhausted' | 'expired' | 'superseded' | 'authority_unavailable' | 'method_unavailable' | 'capability_unavailable';
     readonly authorization?: never;
 };
-type Ed25519YaoClientRootEnvelopeRecordV1 = PasskeyCustodyEnvelopeRecord & {
-    readonly binding: Extract<PasskeyCustodySecretBinding, {
-        readonly kind: 'ed25519_yao_client_root_v1';
-    }>;
-};
 export type ResolvedWalletCustodyEd25519ExportV1 = {
     readonly kind: 'wallet_custody_ed25519_export_context_v1';
     readonly lane: ExactEd25519ExportMaterialIdentity<EmailOtpEd25519LaneAuth>;