@seams/wallet 0.7.1 → 0.7.3

package/dist/types/wallet/src/core/signingEngine/session/emailOtp/walletUnlock.d.ts

@@ -6,20 +6,11 @@ import type { LoadedWalletCustodyEd25519MaterialV1 } from '../../walletCustody/e
 import type { RouterAbEd25519YaoActiveClientMetadataV1 } from '../../threshold/ed25519/yaoClient';
 import type { EmailOtpRoutePlan } from '../../stepUpConfirmation/otpPrompt/authLane';
 import type { ThresholdRuntimePolicyScope } from '../../threshold/sessionPolicy';
-import type { EmailOtpVerifiedAuthorityProjection } from './publicTypes';
+import type { EmailOtpBootstrapRecovery } from '../../stepUpConfirmation/otpPrompt/bootstrapRecovery';
 import type { RouterAbEcdsaCredentialFreeSessionActivationResponseV1, RouterAbEcdsaPostRegistrationSessionActivationPolicyV1, RouterAbEcdsaPostRegistrationSessionActivationResponseV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-type EmailOtpWalletUnlockRecovery = {
-    challengeId: string;
-    enrollmentSealKeyVersion: string;
-    unlockChallengeId: string;
-    unlockChallengeB64u: string;
-    clientUnlockPublicKeyB64u: string;
-    unlockSignatureB64u: string;
-    verifiedAuthorityProjection: EmailOtpVerifiedAuthorityProjection;
-};
 export type EmailOtpWalletUnlockResult = {
     kind: 'ecdsa';
-    recovery: EmailOtpWalletUnlockRecovery;
+    recovery: EmailOtpBootstrapRecovery;
     emailOtpSessionHandle: EmailOtpEcdsaSessionBootstrapHandlePayload;
 } & ({
     operation: 'wallet_unlock';
@@ -31,11 +22,11 @@ export type EmailOtpWalletUnlockResult = {
 });
 export type EmailOtpEd25519YaoUnlockResult = {
     kind: 'wallet_custody_cache_absent';
-    recovery: EmailOtpWalletUnlockRecovery;
+    recovery: EmailOtpBootstrapRecovery;
     ed25519YaoRecovery: EmailOtpEd25519YaoRecoveryBootstrapV1;
 } | {
     kind: 'ed25519_yao_capability';
-    recovery: EmailOtpWalletUnlockRecovery;
+    recovery: EmailOtpBootstrapRecovery;
     activeClientHandle: string;
     metadata: RouterAbEd25519YaoActiveClientMetadataV1;
     ed25519YaoCapability: EmailOtpEd25519YaoRecoveryBootstrapV1;
@@ -47,7 +38,7 @@ export type EmailOtpEd25519YaoUnlockResult = {
 };
 export type EmailOtpWalletUnlockCapabilityResults = {
     kind: 'wallet_unlock_capabilities';
-    recovery: EmailOtpWalletUnlockRecovery;
+    recovery: EmailOtpBootstrapRecovery;
     walletSessionAuthorization: ExactWalletSessionAuthorization;
     ed25519ExportRootCustody: Extract<EmailOtpWalletUnlockMaterialResult, {
         kind: 'wallet_unlock_capabilities';
@@ -55,7 +46,7 @@ export type EmailOtpWalletUnlockCapabilityResults = {
     ecdsa: {
         kind: 'ecdsa';
         operation: 'wallet_unlock';
-        recovery: EmailOtpWalletUnlockRecovery;
+        recovery: EmailOtpBootstrapRecovery;
         emailOtpSessionHandle: EmailOtpEcdsaSessionBootstrapHandlePayload;
         ecdsaSession: RouterAbEcdsaCredentialFreeSessionActivationResponseV1;
         ecdsaCustody: EmailOtpEcdsaCustodyRestoreV1;

package/dist/types/wallet/src/core/signingEngine/session/identity/evmFamilyEcdsaIdentity.d.ts

@@ -10,6 +10,7 @@ import { type ThresholdEcdsaChainTarget, type WalletId } from '../../interfaces/
 import { type ThresholdEcdsaSessionId } from '../operationState/types';
 import { type EcdsaRoleLocalPersistedMaterialRef, type EcdsaRoleLocalWorkerHandle } from '../keyMaterialBrands';
 import type { ThresholdRuntimePolicyScope } from '../../threshold/sessionPolicy';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export type { EcdsaThresholdKeyId, EmailOtpAuthSubjectId, RpId, SigningRootId, SigningRootVersion, WalletId, ThresholdEcdsaSessionId, EvmFamilySigningKeySlotId, };
 export type ParticipantId = number & {
     readonly __brand: 'ParticipantId';
@@ -114,17 +115,14 @@ export type ResolvedEvmFamilyEcdsaKey<TAuthBinding extends EvmFamilyEcdsaAuthBin
     subjectId?: never;
     rpId?: never;
 };
-type ThresholdEcdsaRoleLocalWorkerMaterial = {
+type ThresholdEcdsaRoleLocalWorkerMaterial = ExclusiveUnion<{
     kind: 'worker_loaded';
     materialRef: EcdsaRoleLocalPersistedMaterialRef;
-    stateBlob?: never;
-    ecdsaRoleLocalReadyRecord?: never;
 } | {
     kind: 'ready_state_blob';
     stateBlob: EcdsaRoleLocalReadyStateBlob;
     ecdsaRoleLocalReadyRecord: EcdsaRoleLocalReadyRecord;
-    materialRef?: never;
-};
+}>;
 export type ThresholdEcdsaRoleLocalWorkerShare = {
     kind: 'role_local_worker_share';
     handle: EcdsaRoleLocalWorkerHandle;

package/dist/types/wallet/src/core/signingEngine/session/identity/exactWalletSessionCredential.d.ts

@@ -24,6 +24,7 @@ import type { SignerAuthMethod } from '../../../../../../shared-ts/src/utils/sig
 import type { WalletId } from '../../interfaces/ecdsaChainTarget';
 import { type ExactSigningLaneIdentity } from './exactSigningLaneIdentity';
 import type { ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 /** The signer material one operation needs the exact session to authorize. */
 type RequiredExactWalletSessionSigningSubject = {
     readonly keyFamily: 'ed25519';
@@ -49,15 +50,13 @@ type ResolvedExactWalletSessionCredential = {
     readonly walletSessionId: WalletSessionId;
     readonly materialActivation: MpcMaterialActivationRef;
 };
-type ExactWalletSessionCredentialResolution = {
+type ExactWalletSessionCredentialResolution = ReadonlyExclusiveUnion<{
     readonly kind: 'resolved';
     readonly resolved: ResolvedExactWalletSessionCredential;
-    readonly reason?: never;
 } | {
     readonly kind: 'unavailable';
     readonly reason: ExactWalletSessionCredentialUnavailableReason;
-    readonly resolved?: never;
-};
+}>;
 type ResolveExactWalletSessionCredentialInput = {
     readonly walletId: WalletId;
     readonly authMethod: SignerAuthMethod;

package/dist/types/wallet/src/core/signingEngine/session/identity/exactWalletSessionReader.d.ts

@@ -3,7 +3,8 @@ import { type WalletSessionAuthorizationExactOperationCredentialReadResult } fro
 import type { WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { WalletId } from '../../interfaces/ecdsaChainTarget';
 import type { ExactWalletSessionReadPorts } from './exactWalletSessionCredential';
-export type ExactWalletSessionAuthenticationReadResult = {
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
+export type ExactWalletSessionAuthenticationReadResult = ReadonlyExclusiveUnion<{
     readonly kind: 'authenticated';
     readonly state: Extract<WalletAuthenticationState, {
         readonly kind: 'authenticated';
@@ -13,13 +14,9 @@ export type ExactWalletSessionAuthenticationReadResult = {
     readonly walletAuthMethodId: WalletAuthMethodId;
 } | {
     readonly kind: 'missing';
-    readonly state?: never;
-    readonly walletAuthMethodId?: never;
 } | {
     readonly kind: 'upgrade_required';
-    readonly state?: never;
-    readonly walletAuthMethodId?: never;
-};
+}>;
 export declare function readExactWalletSessionAuthentication(args: {
     readonly walletId: WalletId;
     readonly ports: ExactWalletSessionReadPorts;

package/dist/types/wallet/src/core/signingEngine/session/identity/laneIdentity.d.ts

@@ -14,6 +14,7 @@ import type { ExactEvmFamilyWalletSessionAuthorization } from '../material/ecdsa
 import type { ActiveWalletAuthorityEcdsaRuntimeV1 } from '../material/activeWalletAuthorityEcdsaRuntime';
 import type { ExactNearEd25519WalletSessionAuthorization } from '../material/nearEd25519YaoSigningPreparation';
 import type { NearEd25519SigningKeyId } from '../../../../../../shared-ts/src/utils/registrationIds';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export type { SigningCurve };
 export type { EcdsaThresholdKeyId };
 export type SigningRootId = string & {
@@ -89,27 +90,23 @@ type BuildEmailOtpAuthContextForWalletAuthMethodArgs = {
     emailHashHex: unknown;
     provider: EmailOtpProvider;
     providerUserId: unknown;
-} & ({
+} & ExclusiveUnion<{
     retention: 'session';
     reason: 'login' | 'sign';
-    consumedAtMs?: never;
 } | {
     retention: 'single_use';
-    reason?: never;
     consumedAtMs?: number;
-});
+}>;
 type BuildEmailOtpAuthContextFromExactAuthorityArgs = {
     policy: EmailOtpAuthPolicy;
     authority: EmailOtpWalletAuthAuthority;
-} & ({
+} & ExclusiveUnion<{
     retention: 'session';
     reason: 'login' | 'sign';
-    consumedAtMs?: never;
 } | {
     retention: 'single_use';
-    reason?: never;
     consumedAtMs?: number;
-});
+}>;
 export declare function buildEmailOtpAuthContext(args: BuildEmailOtpSessionAuthContextArgs): ThresholdEcdsaEmailOtpSessionAuthContext;
 export declare function buildEmailOtpAuthContext(args: BuildEmailOtpPendingSingleUseAuthContextArgs): ThresholdEcdsaEmailOtpPendingSingleUseAuthContext;
 export declare function buildEmailOtpAuthContext(args: BuildEmailOtpConsumedSingleUseAuthContextArgs): ThresholdEcdsaEmailOtpConsumedSingleUseAuthContext;

package/dist/types/wallet/src/core/signingEngine/session/identity/signingLaneAuthBinding.d.ts

@@ -3,17 +3,15 @@ import { SIGNER_AUTH_METHODS, type SignerAuthMethod } from '../../../../../../sh
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { LinkedDeviceEnrollmentId, LinkedDeviceId } from '../../../../../../shared-ts/src/signing-lanes/ids';
 import type { WalletAuthMethodId, WalletAuthorityBindingDigest } from '../../../../../../shared-ts/src/utils/domainIds';
-export type SigningLaneAuthBinding = {
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
+export type SigningLaneAuthBinding = ExclusiveUnion<{
     kind: typeof SIGNER_AUTH_METHODS.passkey;
     rpId: RpId;
     credentialIdB64u: string;
-    providerSubjectId?: never;
 } | {
     kind: typeof SIGNER_AUTH_METHODS.emailOtp;
     providerSubjectId: string;
-    rpId?: never;
-    credentialIdB64u?: never;
-};
+}>;
 /**
  * Identity that distinguishes one linked Email OTP owner from the wallet-wide
  * factor and from another enrollment using that factor. It is separate from

package/dist/types/wallet/src/core/signingEngine/session/material/activeEcdsaCapabilityRuntime.d.ts

@@ -3,30 +3,25 @@ import { type ThresholdEcdsaChainTarget, type WalletId } from '../../interfaces/
 import { type ExactEcdsaCapabilityRuntime, type ExactEcdsaSealedRuntime, type ExactEcdsaSealedRuntimeResolution } from './ecdsaSealedRuntime';
 import type { ActiveEcdsaCapabilityManifest } from './ecdsaCapabilityManifest';
 import type { ExactWalletSessionReadPorts } from '../identity/exactWalletSessionCredential';
-export type ActiveEcdsaCapabilityRuntimeResolution = {
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
+export type ActiveEcdsaCapabilityRuntimeResolution = ReadonlyExclusiveUnion<{
     readonly kind: 'resolved';
     readonly manifest: ActiveEcdsaCapabilityManifest;
     readonly runtime: ExactEcdsaSealedRuntime;
-    readonly reason?: never;
 } | {
     readonly kind: 'blocked';
     readonly reason: Extract<ExactEcdsaSealedRuntimeResolution, {
         kind: 'blocked';
     }>['reason'] | 'missing_capability';
-    readonly manifest?: never;
-    readonly runtime?: never;
-};
-type ExactEcdsaCapabilityRuntimeResolution = {
+}>;
+type ExactEcdsaCapabilityRuntimeResolution = ReadonlyExclusiveUnion<{
     readonly kind: 'resolved';
     readonly manifest: ActiveEcdsaCapabilityManifest;
     readonly runtime: ExactEcdsaCapabilityRuntime;
-    readonly reason?: never;
 } | {
     readonly kind: 'blocked';
     readonly reason: 'chain_mismatch' | 'corrupt';
-    readonly manifest?: never;
-    readonly runtime?: never;
-};
+}>;
 export type ActiveEcdsaCapabilityRuntimeReadPorts = Pick<ExactWalletSessionReadPorts, 'resolveSelectedWalletAuthority'> & {
     readonly listActiveEcdsaCapabilityManifestsForWallet: (walletId: WalletId) => Promise<readonly ActiveEcdsaCapabilityManifest[]>;
     readonly listExactSealedSessionsForWallet: typeof listExactSealedSessionsForWallet;

package/dist/types/wallet/src/core/signingEngine/session/material/activeWalletAuthorityEcdsaRuntime.d.ts

@@ -10,6 +10,7 @@ import type { SigningLaneAuthBinding } from '../identity/signingLaneAuthBinding'
 import { type LinkedEcdsaHolderRuntimeV1 } from './linkedEcdsaHolderRuntime';
 import type { ExactWalletSessionReadPorts } from '../identity/exactWalletSessionCredential';
 import type { ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 type ActiveWalletAuthorityEcdsaAuth = {
     readonly auth: Extract<SigningLaneAuthBinding, {
         readonly kind: 'passkey';
@@ -84,19 +85,15 @@ export type ActiveWalletAuthorityEcdsaLaneProjectionV1 = ActiveWalletAuthorityEc
     readonly authorizationState: 'authorization_required';
 };
 type ActiveWalletAuthorityEcdsaRuntimeBlockReason = 'missing_selected_authority' | 'invalid_selected_authority' | 'wallet_locked' | 'auth_method_inactive' | 'authority_inactive' | 'authority_identity_mismatch' | 'missing_wallet_session' | 'upgrade_required' | 'wallet_session_inactive' | 'wallet_session_expired' | 'wallet_session_identity_mismatch' | 'wallet_session_capability_mismatch' | 'missing_ecdsa_signer' | 'missing_holder_runtime' | 'holder_runtime_identity_mismatch' | 'normal_signing_identity_mismatch' | 'invalid_public_facts' | 'persistence_unavailable';
-type ActiveWalletAuthorityEcdsaRuntimeResolution = {
+type ActiveWalletAuthorityEcdsaRuntimeResolution = ReadonlyExclusiveUnion<{
     readonly kind: 'resolved';
     readonly runtime: ActiveWalletAuthorityEcdsaRuntimeV1;
     readonly lane: ActiveWalletAuthorityEcdsaLaneProjectionV1 | null;
-    readonly reason?: never;
-    readonly message?: never;
 } | {
     readonly kind: 'blocked';
     readonly reason: ActiveWalletAuthorityEcdsaRuntimeBlockReason;
     readonly message?: string;
-    readonly runtime?: never;
-    readonly lane?: never;
-};
+}>;
 type ResolveActiveWalletAuthorityEcdsaRuntimeV1Input = {
     readonly walletId: WalletId | string;
     readonly chainTarget?: ThresholdEcdsaChainTarget;

package/dist/types/wallet/src/core/signingEngine/session/material/capabilityPreparationResult.d.ts

@@ -1,37 +1,18 @@
-export type CapabilityPreparationResult<Ready, Resume, Requirement, Replacement, Failure> = {
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
+export type CapabilityPreparationResult<Ready, Resume, Requirement, Replacement, Failure> = ExclusiveUnion<{
     kind: 'ready';
     value: Ready;
-    resume?: never;
-    requirement?: never;
-    replacement?: never;
-    failure?: never;
 } | {
     kind: 'pending';
     resume: Resume;
-    value?: never;
-    requirement?: never;
-    replacement?: never;
-    failure?: never;
 } | {
     kind: 'authorization_required';
     requirement: Requirement;
-    value?: never;
-    resume?: never;
-    replacement?: never;
-    failure?: never;
 } | {
     kind: 'superseded';
     replacement: Replacement;
-    value?: never;
-    resume?: never;
-    requirement?: never;
-    failure?: never;
 } | {
     kind: 'failed';
     failure: Failure;
-    value?: never;
-    resume?: never;
-    requirement?: never;
-    replacement?: never;
-};
+}>;
 //# sourceMappingURL=capabilityPreparationResult.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/material/ecdsaCapabilityHydration.d.ts

@@ -1,16 +1,15 @@
 import { type MpcCapabilityRuntimeRef, type MpcMaterialActivationRef } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { EcdsaCapabilityManifestLookup, EcdsaCapabilityMaterialRefLookup } from '../../../indexedDB/seamsWalletDB/ecdsaCapabilityManifestLookups';
 import { type MpcCapabilityHydrationPlan, type RestorableMpcMaterialRef } from './mpcCapabilityHydration';
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export declare function buildRestorableMpcMaterialRefForHydration(durableMaterialRef: string): RestorableMpcMaterialRef;
-export type EcdsaCapabilityRuntimeObservation = {
+export type EcdsaCapabilityRuntimeObservation = ReadonlyExclusiveUnion<{
     readonly kind: 'live';
     readonly runtime: MpcCapabilityRuntimeRef;
     readonly materialActivation: MpcMaterialActivationRef;
 } | {
     readonly kind: 'absent';
-    readonly runtime?: never;
-    readonly materialActivation?: never;
-};
+}>;
 type EcdsaCapabilityHydrationLookup = EcdsaCapabilityManifestLookup | EcdsaCapabilityMaterialRefLookup;
 export type EcdsaCapabilityHydrationInput = {
     readonly lookup: EcdsaCapabilityHydrationLookup;

package/dist/types/wallet/src/core/signingEngine/session/material/ecdsaSealedRuntime.d.ts

@@ -8,6 +8,7 @@ import type { MpcCapabilityHydrationBlockedReason } from './mpcCapabilityHydrati
 import { type ActiveEcdsaCapabilityManifest } from './ecdsaCapabilityManifest';
 import type { EmailOtpWalletAuthAuthority } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { SigningSessionSealAuthMethod } from '../../../../../../shared-ts/src/utils/signingSessionSeal';
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export type ExactEcdsaSealedRuntimeAuthBinding = {
     readonly kind: 'passkey';
     readonly rpId: string;
@@ -71,15 +72,13 @@ export type ExactEcdsaDirectCapabilityRuntime = ExactEcdsaMaterialRuntime & {
     readonly sealedRecord?: never;
 };
 export type ExactEcdsaWalletSessionRuntime = ExactEcdsaDirectCapabilityRuntime | ExactEcdsaSealedRuntime;
-export type ExactEcdsaSealedRuntimeResolution = {
+export type ExactEcdsaSealedRuntimeResolution = ReadonlyExclusiveUnion<{
     readonly kind: 'resolved';
     readonly runtime: ExactEcdsaSealedRuntime;
-    readonly reason?: never;
 } | {
     readonly kind: 'blocked';
     readonly reason: Extract<MpcCapabilityHydrationBlockedReason, 'missing_material' | 'binding_mismatch' | 'exact_record_conflict' | 'corrupt'>;
-    readonly runtime?: never;
-};
+}>;
 export declare function resolveExactEcdsaSealedRuntime(input: {
     readonly manifest: ActiveEcdsaCapabilityManifest;
     readonly walletId: WalletId;

package/dist/types/wallet/src/core/signingEngine/session/material/ecdsaSigningCapability.d.ts

@@ -78,6 +78,11 @@ export type BuildExactEvmFamilyWalletSessionAuthorizationInput = {
     readonly runtime: ExactEcdsaWalletSessionRuntime;
     readonly nowMs: number;
 };
+export declare function exactAuthorizationMatchesCapability(args: {
+    readonly capability: CanonicalEvmFamilyEcdsaSigningCapability;
+    readonly authorization: ExactEvmFamilyWalletSessionAuthorization | AuthorizedEcdsaPreprocessingCapability['authorization'];
+    readonly nowMs: number;
+}): boolean;
 export declare function buildExactEcdsaDirectCapabilityRuntime(args: {
     readonly runtime: ExactEcdsaCapabilityRuntime;
     readonly authority: WalletAuthAuthority;

package/dist/types/wallet/src/core/signingEngine/session/material/nearEd25519YaoSigningPreparation.d.ts

@@ -6,6 +6,7 @@ import type { SigningLaneAuthBinding } from '../identity/signingLaneAuthBinding'
 import type { MpcCapabilityHydrationPlan } from './mpcCapabilityHydration';
 import type { WalletAuthAuthority } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
 import type { ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export type ActiveNearEd25519WalletSessionStatus = Extract<ExactWalletSessionStatus, {
     readonly status: 'active';
 }>;
@@ -31,33 +32,27 @@ export type NearEd25519WalletSessionAuthorizationReadResult = {
     readonly authorization?: never;
 };
 export type NearEd25519WalletSessionFullLoginReason = 'missing' | 'corrupt' | 'upgrade_required' | 'superseded' | 'authority_unavailable' | 'method_unavailable' | 'capability_unavailable' | 'unavailable';
-export type NearEd25519WalletSessionAuthorizationDisposition = {
+export type NearEd25519WalletSessionAuthorizationDisposition = ReadonlyExclusiveUnion<{
     readonly kind: 'authorized';
     readonly authorization: ExactNearEd25519WalletSessionAuthorization;
-    readonly reason?: never;
 } | {
     readonly kind: 'operation_step_up';
     readonly reason: 'expired' | 'exhausted';
-    readonly authorization?: never;
 } | {
     readonly kind: 'full_login_required';
     readonly reason: NearEd25519WalletSessionFullLoginReason;
-    readonly authorization?: never;
 } | {
     readonly kind: 'temporarily_unavailable';
     readonly reason: 'persistence_unavailable';
-    readonly authorization?: never;
-};
+}>;
 export declare function classifyNearEd25519WalletSessionAuthorization(result: NearEd25519WalletSessionAuthorizationReadResult): NearEd25519WalletSessionAuthorizationDisposition;
-type NearEd25519OperationAuthorizationState = {
+type NearEd25519OperationAuthorizationState = ReadonlyExclusiveUnion<{
     readonly kind: 'authorized';
     readonly authorization: ExactNearEd25519WalletSessionAuthorization;
-    readonly requirement?: never;
 } | {
     readonly kind: 'authorization_required';
     readonly requirement: SigningLaneAuthBinding;
-    readonly authorization?: never;
-};
+}>;
 export type NearEd25519YaoSigningPreparation = {
     readonly kind: 'near_ed25519_yao_signing_preparation';
     readonly hydration: MpcCapabilityHydrationPlan;

package/dist/types/wallet/src/core/signingEngine/session/operationState/authorizationAdmission.d.ts

@@ -1,30 +1,25 @@
 import type { RouterAbOwnerOperationAuthorizationDecisionV1Wire as RouterAbEcdsaOwnerOperationAuthorizationDecisionV1Wire } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { RouterAbEd25519OwnerOperationAuthorizationDecisionV1Wire } from '../../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export type RouterAbOwnerOperationAuthorizationDecisionV1Wire = RouterAbEcdsaOwnerOperationAuthorizationDecisionV1Wire | RouterAbEd25519OwnerOperationAuthorizationDecisionV1Wire;
 type WalletSessionQuotaAdmissionFailureSource = 'local_projection' | 'server_prepare' | 'trusted_status';
 type WalletSessionQuotaAdmissionRetryReason = 'exhausted' | 'stale_projection';
-type WalletSessionQuotaAdmissionFailure = {
+type WalletSessionQuotaAdmissionFailure = ExclusiveUnion<{
     kind: 'exhausted';
     source: WalletSessionQuotaAdmissionFailureSource;
     detail: string;
-    retryAfterMs?: never;
-    localProjectionVersion?: never;
-    serverProjectionVersion?: never;
 } | {
     kind: 'in_flight';
     source: WalletSessionQuotaAdmissionFailureSource;
     detail: string;
     retryAfterMs: number;
-    localProjectionVersion?: never;
-    serverProjectionVersion?: never;
 } | {
     kind: 'stale_projection';
     source: WalletSessionQuotaAdmissionFailureSource;
     detail: string;
     localProjectionVersion: string;
     serverProjectionVersion: string;
-    retryAfterMs?: never;
-};
+}>;
 export type WalletSessionQuotaAdmissionDecision = {
     kind: 'request_fresh_step_up';
     reason: WalletSessionQuotaAdmissionRetryReason;

package/dist/types/wallet/src/core/signingEngine/session/operationState/types.d.ts

@@ -11,6 +11,7 @@ import { type MpcWalletSigningQuotaId, type WalletSessionId } from '../../../../
 import type { MpcMaterialActivationRef } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { ExactEvmFamilyWalletSessionAuthorization } from '../material/ecdsaSigningCapability';
 import type { NearEd25519SignerBinding } from '../../../../../../shared-ts/src/utils/walletCapabilityBindings';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export type { EmailOtpChallengeId, ThresholdEcdsaSessionId, ThresholdEd25519SessionId, ThresholdSessionId, } from '../../../../../../shared-ts/src/utils/domainIds';
 export type Brand<TValue, TBrand extends string> = TValue & {
     readonly __brand: TBrand;
@@ -157,19 +158,16 @@ type EmailOtpChallengePlan = {
     chainFamily: SigningChainFamily;
     lane: SelectedSigningSessionPlanningLane;
 };
-type PasskeyReconnectPlan = {
+type PasskeyReconnectPlan = ExclusiveUnion<{
     lane: SelectedEd25519SigningSessionPlanningLane;
     curve: 'ed25519';
     thresholdSessionId: ThresholdEd25519SessionId;
-    materialActivation?: never;
-    authorization?: never;
 } | {
     lane: SelectedEcdsaSigningSessionPlanningLane;
     curve: 'ecdsa';
     materialActivation: MpcMaterialActivationRef;
     authorization: ExactEvmFamilyWalletSessionAuthorization;
-    thresholdSessionId?: never;
-};
+}>;
 export type SigningSessionNotReadyReason = 'missing_session' | 'expired' | 'exhausted' | 'status_unknown' | 'auth_unavailable' | 'status_unavailable' | 'policy_blocked';
 export declare const SigningSessionPlanKind: {
     readonly WarmSession: "warm_session";

package/dist/types/wallet/src/core/signingEngine/session/passkey/ecdsaBootstrap.d.ts

@@ -16,6 +16,7 @@ import type { PersistedEcdsaRoleLocalMaterial } from '../material/ecdsaRoleLocal
 import { type EcdsaPreauthorizedSessionActivation } from '../../threshold/ecdsa/postRegistrationSessionActivation';
 import { type ExactWalletSessionAuthorityIdentity } from '../persistence/walletSessionAuthorizationProjection';
 import type { WalletAuthAuthorityRef } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 type ExistingEcdsaBootstrapKeyIntent = {
     kind: 'existing_ecdsa_key';
     ecdsaThresholdKeyId: string;
@@ -122,13 +123,11 @@ type EmailOtpEcdsaBootstrapRequestBase = EcdsaBootstrapExactRequestBase & {
     passkeyPrfFirstB64u?: never;
     webauthnAuthentication?: never;
 };
-export type EmailOtpEcdsaBootstrapRequest = EmailOtpEcdsaBootstrapRequestBase & ({
+export type EmailOtpEcdsaBootstrapRequest = EmailOtpEcdsaBootstrapRequestBase & ExclusiveUnion<{
     routeAuth?: WalletSessionOperationCredentialV1;
-    sessionActivation?: never;
 } | {
     sessionActivation: EcdsaPreauthorizedSessionActivation;
-    routeAuth?: never;
-});
+}>;
 export type EmailOtpEcdsaExplicitExportBootstrapRequest = EcdsaExplicitExportBootstrapRequestBase & {
     kind: 'email_otp_ecdsa_export_bootstrap';
     purpose: 'explicit_key_export';

package/dist/types/wallet/src/core/signingEngine/session/passkey/ecdsaSessionProvision.d.ts

@@ -11,6 +11,7 @@ import type { ThresholdRuntimePolicyScope } from '../../threshold/sessionPolicy'
 import type { RouterAbEcdsaDerivationPublicCapabilityV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
 import type { WalletSessionOperationCredentialV1 } from '../../../../../../shared-ts/src/device-linking';
 import type { EcdsaPreauthorizedSessionActivation } from '../../threshold/ecdsa/postRegistrationSessionActivation';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export type ProvisionThresholdEcdsaSessionDeps = {
     queueByWallet: Map<string, Promise<void>>;
     activationDeps: WalletSessionActivationDeps;
@@ -85,13 +86,11 @@ type ThresholdEcdsaEmailOtpActivationRequestBase = ThresholdEcdsaActivationReque
     passkeyPrfFirstB64u?: never;
     webauthnAuthentication?: never;
 };
-export type ThresholdEcdsaEmailOtpActivationRequest = ThresholdEcdsaEmailOtpActivationRequestBase & ({
+export type ThresholdEcdsaEmailOtpActivationRequest = ThresholdEcdsaEmailOtpActivationRequestBase & ExclusiveUnion<{
     walletSessionRouteAuth: WalletSessionOperationCredentialV1;
-    preauthorizedSessionActivation?: never;
 } | {
     preauthorizedSessionActivation: EcdsaPreauthorizedSessionActivation;
-    walletSessionRouteAuth?: never;
-});
+}>;
 export type ThresholdEcdsaEmailOtpExportActivationRequest = ThresholdEcdsaExplicitExportActivationRequestBase & {
     readonly kind: 'email_otp_ecdsa_export_activation';
 };

package/dist/types/wallet/src/core/signingEngine/session/passkey/unlockEcdsaWarmupPlanner.d.ts

@@ -5,19 +5,18 @@ import { type EvmFamilyEcdsaKeyIdentity, type EvmFamilyEcdsaWalletKey } from '..
 import { type EcdsaPublicCapabilityState } from './ecdsaKeyFactsInventory';
 import type { ThresholdRuntimePolicyScope } from '../../threshold/sessionPolicy';
 import { type RouterAbEcdsaDerivationPublicCapabilityV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-export type WalletUnlockSelection = {
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
+export type WalletUnlockSelection = ExclusiveUnion<{
     mode: 'ed25519_only';
     ed25519: true;
-    ecdsa?: never;
 } | {
     mode: 'ecdsa_only';
     ecdsa: true;
-    ed25519?: never;
 } | {
     mode: 'ed25519_and_ecdsa';
     ed25519: true;
     ecdsa: true;
-};
+}>;
 type EcdsaUnlockBlockedReason = 'missing_key_handle' | 'invalid_key_handle' | 'duplicate_key_handles' | 'missing_chain_target' | 'missing_key_facts' | 'invalid_signer_record';
 export type ActiveEcdsaSignerRecord = {
     kind: 'active_ecdsa_signer_record';
@@ -70,31 +69,22 @@ export type CanonicalThresholdEcdsaWarmSessionContext = {
     ecdsaKeys: ConfiguredTargetThresholdEcdsaWarmKey[];
     runtimePolicyScope?: ThresholdRuntimePolicyScope;
 };
-export type ConfiguredTargetKeyCompletion = {
+export type ConfiguredTargetKeyCompletion = ExclusiveUnion<{
     kind: 'complete_configured_target_keys';
     context: CanonicalThresholdEcdsaWarmSessionContext;
-    missingTargets?: never;
 } | {
     kind: 'missing_configured_target_keys';
     missingTargets: string[];
-    context?: never;
-};
+}>;
 type EcdsaUnlockRuntimeConfig = {
     allowAuthenticatedKeyFactsInventory: boolean;
     explicitKeyFactsInventoryMode: boolean;
 };
-export type EcdsaWarmupPlannerResult = {
+export type EcdsaWarmupPlannerResult = ExclusiveUnion<{
     kind: 'no_configured_ecdsa_targets';
-    readyTargets?: never;
-    keyTargets?: never;
-    keyFactsInventoryRequiredRecords?: never;
-    blockedRecords?: never;
 } | {
     kind: 'ready';
     readyTargets: EcdsaWarmupReadyTarget[];
-    keyTargets?: never;
-    keyFactsInventoryRequiredRecords?: never;
-    blockedRecords?: never;
 } | {
     kind: 'awaiting_authenticated_key_facts_inventory';
     keyTargets: {
@@ -102,21 +92,13 @@ export type EcdsaWarmupPlannerResult = {
         chainTarget: ThresholdEcdsaChainTarget;
     }[];
     keyFactsInventoryRequiredRecords: KeyFactsInventoryRequiredEcdsaSignerRecord[];
-    readyTargets?: never;
-    blockedRecords?: never;
 } | {
     kind: 'key_facts_inventory_required';
     keyFactsInventoryRequiredRecords: KeyFactsInventoryRequiredEcdsaSignerRecord[];
-    readyTargets?: never;
-    keyTargets?: never;
-    blockedRecords?: never;
 } | {
     kind: 'blocked';
     blockedRecords: BlockedEcdsaSignerRecord[];
-    readyTargets?: never;
-    keyTargets?: never;
-    keyFactsInventoryRequiredRecords?: never;
-};
+}>;
 export declare function parseActiveEcdsaSignerRecordForUnlock(args: {
     walletId: WalletId;
     configuredTargets: readonly ThresholdEcdsaChainTarget[];

package/dist/types/wallet/src/core/signingEngine/session/sealedRecovery/sealedRecovery.types.d.ts

@@ -3,6 +3,7 @@ import type { ExactEcdsaSigningLaneIdentity } from '../identity/exactSigningLane
 import type { EcdsaThresholdKeyId } from '../keyMaterialBrands';
 import type { MpcMaterialActivationRef } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { RawSigningSessionSealedStoreRecord, RejectedSealedRecoveryRecord, SealedRecoveryRecord } from './recoveryRecord';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 type RestoreSealedSessionListInput = {
     walletId: string;
     authMethod: 'email_otp' | 'passkey';
@@ -26,13 +27,11 @@ export type RestorePersistedSessionForSigningInput = RestorePersistedSessionForS
         ecdsaThresholdKeyId: EcdsaThresholdKeyId;
     };
 };
-export type RestorePersistedSessionForSigningResult = {
+export type RestorePersistedSessionForSigningResult = ExclusiveUnion<{
     kind: 'completed';
     attempted: number;
     restored: number;
     deferred: number;
-    duplicateCount?: never;
-    duplicateRecordSummaries?: never;
 } | {
     kind: 'duplicate_records';
     attempted: 0;
@@ -40,7 +39,7 @@ export type RestorePersistedSessionForSigningResult = {
     deferred: 0;
     duplicateCount: number;
     duplicateRecordSummaries: readonly Record<string, unknown>[];
-};
+}>;
 export type RestorePersistedSessionPurpose = {
     walletId: string;
     authMethod: 'email_otp' | 'passkey';