@seams/wallet 0.7.1 → 0.8.0

package/dist/types/wallet/src/core/signingEngine/session/emailOtp/EmailOtpWalletSessionCoordinator.d.ts

@@ -1,20 +1,43 @@
-import { EmailOtpWalletSessionRuntime, type EmailOtpWalletSessionCoordinatorDeps } from './coordinatorRuntime';
+import type { WarmSessionStatusResult } from '../../uiConfirm/uiConfirm.types';
+import type { DiscoverPersistedSessionsForWalletInput, DiscoverPersistedSessionsForWalletResult, RestorePersistedSessionForSigningInput, RestorePersistedSessionForSigningResult } from '../sealedRecovery/sealedRecovery.types';
+import type { EmailOtpWalletSessionCoordinatorDeps } from './ports';
+import type { EmailOtpWarmMaterialTarget } from '../../workerManager/workerTypes';
+import type { EmailOtpTransactionSigningChallenge } from './publicTypes';
+import { type EmailOtpThresholdEcdsaLoginResult, type LoginEmailOtpEcdsaCapabilityArgs, type LoginEmailOtpEcdsaCapabilityForSigningArgs } from './ecdsaLogin';
+import { type EmailOtpEcdsaExportArtifact, type ExportEcdsaKeyWithDurableAuthorizationArgs, type ExportEd25519YaoSeedWithFreshEmailOtpLaneArgs, type RequestEmailOtpChallengeArgs, type RequestEmailOtpExportChallengeArgs } from './exportRecoveryRuntime';
+import { EmailOtpSealedSessionRegistry } from './sealedSessionRegistry';
+import type { WarmSessionMaterialOperationTarget } from './sealedRuntimePurpose';
 export type { EmailOtpThresholdEcdsaLoginResult, LoginEmailOtpEcdsaCapabilityArgs, } from './ecdsaLogin';
 export type { EmailOtpCoordinatorRuntimePorts, EmailOtpEcdsaSessionPorts, EmailOtpSealedSessionStorePorts, EmailOtpWalletSessionCoordinatorDeps, } from './ports';
 export declare class EmailOtpWalletSessionCoordinator {
-    private readonly runtime;
+    private sealedRefreshDiagnosticLogAtMsByKey;
+    private readonly sealedRefreshPolicy;
+    private readonly sealedRestoreOrchestrator;
+    private readonly runtimeConfig;
+    private readonly sealedSessionRegistry;
+    private readonly warmSessionRuntime;
+    private readonly exportRecoveryRuntime;
+    private readonly ecdsaLifecycleRuntime;
     constructor(deps: EmailOtpWalletSessionCoordinatorDeps);
-    persistEcdsaSessionForRefresh(args: Parameters<EmailOtpWalletSessionRuntime['persistEcdsaSessionForRefresh']>[0]): ReturnType<EmailOtpWalletSessionRuntime['persistEcdsaSessionForRefresh']>;
-    discoverPersistedSessionsForWallet(args: Parameters<EmailOtpWalletSessionRuntime['discoverPersistedSessionsForWallet']>[0]): ReturnType<EmailOtpWalletSessionRuntime['discoverPersistedSessionsForWallet']>;
-    restorePersistedSessionForSigning(args: Parameters<EmailOtpWalletSessionRuntime['restorePersistedSessionForSigning']>[0]): ReturnType<EmailOtpWalletSessionRuntime['restorePersistedSessionForSigning']>;
-    readWarmSessionStatusOnly(target: Parameters<EmailOtpWalletSessionRuntime['readWarmSessionStatusOnly']>[0]): ReturnType<EmailOtpWalletSessionRuntime['readWarmSessionStatusOnly']>;
-    consumeWarmSessionUses(args: Parameters<EmailOtpWalletSessionRuntime['consumeWarmSessionUses']>[0]): ReturnType<EmailOtpWalletSessionRuntime['consumeWarmSessionUses']>;
-    clearVolatileWarmSessionMaterial(target: Parameters<EmailOtpWalletSessionRuntime['clearVolatileWarmSessionMaterial']>[0]): ReturnType<EmailOtpWalletSessionRuntime['clearVolatileWarmSessionMaterial']>;
-    requestTransactionSigningChallenge(args: Parameters<EmailOtpWalletSessionRuntime['requestTransactionSigningChallenge']>[0]): ReturnType<EmailOtpWalletSessionRuntime['requestTransactionSigningChallenge']>;
-    requestExportChallenge(args: Parameters<EmailOtpWalletSessionRuntime['requestExportChallenge']>[0]): ReturnType<EmailOtpWalletSessionRuntime['requestExportChallenge']>;
-    exportEcdsaKeyWithDurableAuthorization(args: Parameters<EmailOtpWalletSessionRuntime['exportEcdsaKeyWithDurableAuthorization']>[0]): ReturnType<EmailOtpWalletSessionRuntime['exportEcdsaKeyWithDurableAuthorization']>;
-    exportEd25519YaoSeedWithFreshEmailOtpLane(args: Parameters<EmailOtpWalletSessionRuntime['exportEd25519YaoSeedWithFreshEmailOtpLane']>[0]): ReturnType<EmailOtpWalletSessionRuntime['exportEd25519YaoSeedWithFreshEmailOtpLane']>;
-    loginWithEcdsaCapabilityForSigning(args: Parameters<EmailOtpWalletSessionRuntime['loginWithEcdsaCapabilityForSigning']>[0]): ReturnType<EmailOtpWalletSessionRuntime['loginWithEcdsaCapabilityForSigning']>;
-    loginWithEcdsaCapabilityInternal(args: Parameters<EmailOtpWalletSessionRuntime['loginWithEcdsaCapabilityInternal']>[0]): ReturnType<EmailOtpWalletSessionRuntime['loginWithEcdsaCapabilityInternal']>;
+    persistEcdsaSessionForRefresh(args: Parameters<EmailOtpSealedSessionRegistry['persistEcdsaSessionForRefresh']>[0]): Promise<void>;
+    private clearEcdsaRestoreCaches;
+    private shouldLogSealedRefreshDiagnostic;
+    discoverPersistedSessionsForWallet(args: DiscoverPersistedSessionsForWalletInput): Promise<DiscoverPersistedSessionsForWalletResult>;
+    restorePersistedSessionForSigning(args: RestorePersistedSessionForSigningInput): Promise<RestorePersistedSessionForSigningResult>;
+    readWarmSessionStatusOnly(target: EmailOtpWarmMaterialTarget): Promise<WarmSessionStatusResult>;
+    consumeWarmSessionUses(args: WarmSessionMaterialOperationTarget & {
+        uses?: number;
+    }): Promise<WarmSessionStatusResult>;
+    clearVolatileWarmSessionMaterial(target: EmailOtpWarmMaterialTarget): Promise<void>;
+    requestTransactionSigningChallenge(args: RequestEmailOtpChallengeArgs): Promise<EmailOtpTransactionSigningChallenge>;
+    requestExportChallenge(args: RequestEmailOtpExportChallengeArgs): Promise<EmailOtpTransactionSigningChallenge>;
+    exportEcdsaKeyWithDurableAuthorization(args: ExportEcdsaKeyWithDurableAuthorizationArgs): Promise<EmailOtpEcdsaExportArtifact>;
+    exportEd25519YaoSeedWithFreshEmailOtpLane(args: ExportEd25519YaoSeedWithFreshEmailOtpLaneArgs): Promise<{
+        artifactKind: 'near-ed25519-seed-v1';
+        publicKey: string;
+        privateKey: string;
+    }>;
+    loginWithEcdsaCapabilityForSigning(args: LoginEmailOtpEcdsaCapabilityForSigningArgs): Promise<EmailOtpThresholdEcdsaLoginResult>;
+    loginWithEcdsaCapabilityInternal(args: LoginEmailOtpEcdsaCapabilityArgs): Promise<EmailOtpThresholdEcdsaLoginResult>;
 }
 //# sourceMappingURL=EmailOtpWalletSessionCoordinator.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/emailOtp/ecdsaLogin.d.ts

@@ -47,7 +47,6 @@ export type EmailOtpThresholdEcdsaLoginResult = {
 };
 export type EmailOtpThresholdEcdsaExportPreparation = {
     bootstrap: ThresholdEcdsaExplicitKeyExportActivationResult;
-    timings: EmailOtpThresholdEcdsaLoginTimings;
 };
 export type EmailOtpEcdsaProviderIdentity = {
     kind: 'explicit_provider_user';
@@ -132,7 +131,6 @@ type EmailOtpEcdsaLoginPorts = EmailOtpEcdsaLoginAuthorityPorts & {
     provisionEmailOtpEcdsaExplicitExportSession: (request: ThresholdEcdsaEmailOtpExportActivationRequest) => Promise<EmailOtpEcdsaExplicitExportBootstrapResult>;
     requireRelayUrl: () => string;
     requireSigningSessionSealGroupId: () => string;
-    resolveCurrentEcdsaCapabilityRuntime: ActiveEcdsaCapabilityRuntimeResolver;
     publicationPorts: EmailOtpEcdsaPublicationPorts;
 };
 export type LoginEmailOtpEcdsaCapabilityForSigningArgs = {
@@ -148,7 +146,6 @@ export type LoginEmailOtpEcdsaCapabilityForSigningArgs = {
     authLane?: never;
 };
 export declare function loginWithEmailOtpEcdsaCapabilityForSigning(args: LoginEmailOtpEcdsaCapabilityForSigningArgs, ports: {
-    requireRelayUrl: () => string;
     resolveCurrentEcdsaCapabilityRuntime: ActiveEcdsaCapabilityRuntimeResolver;
     loginWithEcdsaCapabilityInternal: (args: LoginEmailOtpEcdsaCapabilityArgs) => Promise<EmailOtpThresholdEcdsaLoginResult>;
 }): Promise<EmailOtpThresholdEcdsaLoginResult>;

package/dist/types/wallet/src/core/signingEngine/session/emailOtp/ecdsaPublication.d.ts

@@ -12,6 +12,7 @@ import type { WorkerOperationContext } from '../../workerManager/executeWorkerOp
 import { type EvmFamilyEcdsaWalletKey } from '../identity/evmFamilyEcdsaIdentity';
 import { type PersistedEcdsaRoleLocalMaterial } from '../material/ecdsaRoleLocalMaterialResolver';
 import type { ActiveEcdsaCapabilityManifest } from '../material/ecdsaCapabilityManifest';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 type EmailOtpEcdsaPublicationTimingBucket = 'signingSessionSealApplyMs' | 'warmCapabilityPersistenceMs';
 export type EmailOtpEcdsaPublicationTimings = Record<EmailOtpEcdsaPublicationTimingBucket, number>;
 export type EmailOtpEcdsaPublicationPorts = {
@@ -47,19 +48,16 @@ export type ResolvedEmailOtpExistingEcdsaKey = {
     persistedRoleLocalMaterial: PersistedEcdsaRoleLocalMaterial;
     runtimePolicyScope: ThresholdRuntimePolicyScope;
 };
-export type EmailOtpEcdsaScopeSelector = {
+export type EmailOtpEcdsaScopeSelector = ExclusiveUnion<{
     kind: 'exact';
     runtimePolicyScope: ThresholdRuntimePolicyScope;
     authorityRef: WalletAuthAuthorityRef;
 } | {
     kind: 'exact_authority';
     authorityRef: WalletAuthAuthorityRef;
-    runtimePolicyScope?: never;
 } | {
     kind: 'durable_manifest';
-    runtimePolicyScope?: never;
-    authorityRef?: never;
-};
+}>;
 export declare function projectEmailOtpExistingEcdsaKeyToChainTarget(args: {
     existingKey: ResolvedEmailOtpExistingEcdsaKey;
     chainTarget: ThresholdEcdsaChainTarget;

package/dist/types/wallet/src/core/signingEngine/session/emailOtp/ecdsaRecovery.d.ts

@@ -1,4 +1,3 @@
-import type { SeamsConfigsReadonly } from '../../../types/seams';
 import { type ThresholdEcdsaEmailOtpAuthContext, type ThresholdEcdsaEmailOtpSessionAuthContext } from '../identity/laneIdentity';
 import type { ThresholdEcdsaSessionBootstrapResult } from '../../threshold/ecdsa/activation';
 import { type ThresholdEcdsaChainTarget, type WalletId } from '../../interfaces/ecdsaChainTarget';
@@ -12,7 +11,6 @@ import { type ResolvedEmailOtpExistingEcdsaKey } from './ecdsaPublication';
 import type { ActiveEcdsaCapabilityRuntimeResolver } from '../material/activeEcdsaCapabilityRuntime';
 import { type ExactEvmFamilyWalletSessionAuthorization } from '../material/ecdsaSigningCapability';
 export type EmailOtpThresholdEcdsaRehydrateResult = {
-    bootstrap: ThresholdEcdsaSessionBootstrapResult;
     authorization: ExactEvmFamilyWalletSessionAuthorization;
     remainingUses: number;
     expiresAtMs: number;
@@ -21,7 +19,6 @@ export type EmailOtpEcdsaSealedRecoveryRecordInput = {
     sealedRecord: EmailOtpEcdsaSealedRecoveryRecord;
 };
 type EmailOtpEcdsaSealedRecoveryPorts = {
-    configs: SeamsConfigsReadonly;
     withThresholdEcdsaSigningQueue: <T>(args: {
         queueKey: string;
         walletId: WalletId;
@@ -56,8 +53,6 @@ export type EmailOtpEcdsaRestoreSource = {
     relayerUrl: string;
     chainTarget: ThresholdEcdsaChainTarget;
     keyHandle: string;
-    relayerKeyId: string;
-    participantIds: readonly number[];
     signingSessionSealKeyVersion: string;
     signingSessionSealGroupId: string;
     runtimePolicyScope?: EmailOtpEcdsaSealedRecoveryRecord['runtimePolicyScope'];

package/dist/types/wallet/src/core/signingEngine/session/emailOtp/ed25519ExportContext.d.ts

@@ -11,7 +11,8 @@ import type { ExactWalletSessionStatus } from '../../../rpcClients/relayer/walle
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type MpcMaterialActivationRef } from '../../../../../../shared-ts/src/utils/domainIds';
 import { type EmailOtpWalletAuthAuthority } from '../../../../../../shared-ts/src/utils/walletAuthAuthority';
-import type { PasskeyCustodyEnvelopeRecord, PasskeyCustodySecretBinding } from '../../../../../../shared-ts/src/passkey-custody';
+import type { PasskeyCustodyEnvelopeRecord } from '../../../../../../shared-ts/src/passkey-custody';
+import type { Ed25519YaoClientRootEnvelopeRecordV1 } from '../passkey/passkeyCustodySessionCache';
 import type { ActiveEmailOtpWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 type EmailOtpEd25519LaneAuth = Extract<SigningLaneAuthBinding, {
     kind: 'email_otp';
@@ -45,15 +46,9 @@ export type EmailOtpEd25519ExportAuthorizationReadResultV1 = {
     readonly kind: 'missing' | 'upgrade_required' | 'corrupt' | 'persistence_unavailable' | 'exhausted' | 'expired' | 'superseded' | 'authority_unavailable' | 'method_unavailable' | 'capability_unavailable';
     readonly authorization?: never;
 };
-type Ed25519YaoClientRootEnvelopeRecordV1 = PasskeyCustodyEnvelopeRecord & {
-    readonly binding: Extract<PasskeyCustodySecretBinding, {
-        readonly kind: 'ed25519_yao_client_root_v1';
-    }>;
-};
 export type ResolvedWalletCustodyEd25519ExportV1 = {
     readonly kind: 'wallet_custody_ed25519_export_context_v1';
     readonly lane: ExactEd25519ExportMaterialIdentity<EmailOtpEd25519LaneAuth>;
-    readonly selectedLaneMaterialActivation: MpcMaterialActivationRef;
     readonly authorization: ExactWalletSessionAuthorizationForEd25519ExportV1;
     readonly material: {
         readonly kind: 'active_capability';

package/dist/types/wallet/src/core/signingEngine/session/emailOtp/secretEscrow.d.ts

@@ -9,7 +9,6 @@ type EmailOtpCorruptLocalCustodyFailure = {
     readonly code: 'corrupt_local_custody';
     readonly reason: 'invalid_escrow_plaintext_length';
     readonly expectedLength: typeof EMAIL_OTP_ESCROW_SECRET_LENGTH;
-    readonly actualLength: number;
     readonly message: string;
 };
 export type EmailOtpEscrowSecret32DecodeResult = EmailOtpEscrowSecret32 | EmailOtpCorruptLocalCustodyFailure;

package/dist/types/wallet/src/core/signingEngine/session/emailOtp/walletUnlock.d.ts

@@ -6,20 +6,11 @@ import type { LoadedWalletCustodyEd25519MaterialV1 } from '../../walletCustody/e
 import type { RouterAbEd25519YaoActiveClientMetadataV1 } from '../../threshold/ed25519/yaoClient';
 import type { EmailOtpRoutePlan } from '../../stepUpConfirmation/otpPrompt/authLane';
 import type { ThresholdRuntimePolicyScope } from '../../threshold/sessionPolicy';
-import type { EmailOtpVerifiedAuthorityProjection } from './publicTypes';
+import type { EmailOtpBootstrapRecovery } from '../../stepUpConfirmation/otpPrompt/bootstrapRecovery';
 import type { RouterAbEcdsaCredentialFreeSessionActivationResponseV1, RouterAbEcdsaPostRegistrationSessionActivationPolicyV1, RouterAbEcdsaPostRegistrationSessionActivationResponseV1 } from '../../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
-type EmailOtpWalletUnlockRecovery = {
-    challengeId: string;
-    enrollmentSealKeyVersion: string;
-    unlockChallengeId: string;
-    unlockChallengeB64u: string;
-    clientUnlockPublicKeyB64u: string;
-    unlockSignatureB64u: string;
-    verifiedAuthorityProjection: EmailOtpVerifiedAuthorityProjection;
-};
 export type EmailOtpWalletUnlockResult = {
     kind: 'ecdsa';
-    recovery: EmailOtpWalletUnlockRecovery;
+    recovery: EmailOtpBootstrapRecovery;
     emailOtpSessionHandle: EmailOtpEcdsaSessionBootstrapHandlePayload;
 } & ({
     operation: 'wallet_unlock';
@@ -31,11 +22,11 @@ export type EmailOtpWalletUnlockResult = {
 });
 export type EmailOtpEd25519YaoUnlockResult = {
     kind: 'wallet_custody_cache_absent';
-    recovery: EmailOtpWalletUnlockRecovery;
+    recovery: EmailOtpBootstrapRecovery;
     ed25519YaoRecovery: EmailOtpEd25519YaoRecoveryBootstrapV1;
 } | {
     kind: 'ed25519_yao_capability';
-    recovery: EmailOtpWalletUnlockRecovery;
+    recovery: EmailOtpBootstrapRecovery;
     activeClientHandle: string;
     metadata: RouterAbEd25519YaoActiveClientMetadataV1;
     ed25519YaoCapability: EmailOtpEd25519YaoRecoveryBootstrapV1;
@@ -47,7 +38,7 @@ export type EmailOtpEd25519YaoUnlockResult = {
 };
 export type EmailOtpWalletUnlockCapabilityResults = {
     kind: 'wallet_unlock_capabilities';
-    recovery: EmailOtpWalletUnlockRecovery;
+    recovery: EmailOtpBootstrapRecovery;
     walletSessionAuthorization: ExactWalletSessionAuthorization;
     ed25519ExportRootCustody: Extract<EmailOtpWalletUnlockMaterialResult, {
         kind: 'wallet_unlock_capabilities';
@@ -55,7 +46,7 @@ export type EmailOtpWalletUnlockCapabilityResults = {
     ecdsa: {
         kind: 'ecdsa';
         operation: 'wallet_unlock';
-        recovery: EmailOtpWalletUnlockRecovery;
+        recovery: EmailOtpBootstrapRecovery;
         emailOtpSessionHandle: EmailOtpEcdsaSessionBootstrapHandlePayload;
         ecdsaSession: RouterAbEcdsaCredentialFreeSessionActivationResponseV1;
         ecdsaCustody: EmailOtpEcdsaCustodyRestoreV1;

package/dist/types/wallet/src/core/signingEngine/session/identity/clientSessionPersistenceState.d.ts

@@ -3,8 +3,6 @@ import type { WalletId } from '../../interfaces/ecdsaChainTarget';
 import { type ExactEcdsaSigningLaneIdentity, type ExactEd25519SigningLaneIdentity, type ExactSigningLaneIdentity } from './exactSigningLaneIdentity';
 import type { MpcWalletSigningQuotaId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
 import type { ExactEvmFamilyWalletSessionAuthorization } from '../material/ecdsaSigningCapability';
-type WalletSessionAuthorizationUnavailableReason = 'network' | 'server_unavailable' | 'persistence_unavailable';
-type WalletSessionAuthorizationInvalidReason = 'malformed' | 'signature_invalid' | 'scope_mismatch' | 'authority_mismatch';
 type CommonWalletSessionAuthorizationIdentity = {
     readonly walletId: WalletId;
     readonly authMethod: SignerAuthMethod;
@@ -30,10 +28,8 @@ type WalletSessionAuthorizationObservationKind = {
     readonly kind: 'missing';
 } | {
     readonly kind: 'unavailable';
-    readonly reason: WalletSessionAuthorizationUnavailableReason;
 } | {
     readonly kind: 'invalid';
-    readonly reason: WalletSessionAuthorizationInvalidReason;
 };
 export type WalletSessionAuthorizationObservation = WalletSessionAuthorizationObservationKind & {
     readonly source: WalletSessionAuthorizationIdentitySource;
@@ -53,11 +49,9 @@ type MissingWalletSessionAuthorizationState = WalletSessionAuthorizationIdentity
 };
 type UnavailableWalletSessionAuthorizationState = WalletSessionAuthorizationIdentity & {
     readonly kind: 'unavailable';
-    readonly reason: WalletSessionAuthorizationUnavailableReason;
 };
 type InvalidWalletSessionAuthorizationState = WalletSessionAuthorizationIdentity & {
     readonly kind: 'invalid';
-    readonly reason: WalletSessionAuthorizationInvalidReason;
 };
 export type WalletSessionAuthorizationState = ActiveWalletSessionAuthorizationState | ExpiredWalletSessionAuthorizationState | MissingWalletSessionAuthorizationState | UnavailableWalletSessionAuthorizationState | InvalidWalletSessionAuthorizationState;
 export declare function requireAuthoritativeExpiredWalletSessionAuthorizationBoundary(args: {

package/dist/types/wallet/src/core/signingEngine/session/identity/emailOtpEcdsaDerivationIdentity.d.ts

@@ -1,9 +1,6 @@
 import type { EcdsaThresholdKeyId, SigningRootId, SigningRootVersion, ThresholdEcdsaSessionId, ThresholdOwnerAddress } from './evmFamilyEcdsaIdentity';
 import type { EmailOtpAuthSubjectId } from '../../../platform/types';
 export type { EcdsaThresholdKeyId, EmailOtpAuthSubjectId, SigningRootId, SigningRootVersion, ThresholdEcdsaSessionId, ThresholdOwnerAddress, };
-export type WalletSessionUserId = string & {
-    readonly __brand: 'WalletSessionUserId';
-};
 export declare function toEmailOtpAuthSubjectId(value: unknown): EmailOtpAuthSubjectId;
 export declare function toEcdsaDerivationThresholdKeyId(value: unknown): EcdsaThresholdKeyId;
 export declare function toEcdsaDerivationSigningRootId(value: unknown): SigningRootId;

package/dist/types/wallet/src/core/signingEngine/session/identity/evmFamilyEcdsaIdentity.d.ts

@@ -10,6 +10,7 @@ import { type ThresholdEcdsaChainTarget, type WalletId } from '../../interfaces/
 import { type ThresholdEcdsaSessionId } from '../operationState/types';
 import { type EcdsaRoleLocalPersistedMaterialRef, type EcdsaRoleLocalWorkerHandle } from '../keyMaterialBrands';
 import type { ThresholdRuntimePolicyScope } from '../../threshold/sessionPolicy';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export type { EcdsaThresholdKeyId, EmailOtpAuthSubjectId, RpId, SigningRootId, SigningRootVersion, WalletId, ThresholdEcdsaSessionId, EvmFamilySigningKeySlotId, };
 export type ParticipantId = number & {
     readonly __brand: 'ParticipantId';
@@ -114,17 +115,14 @@ export type ResolvedEvmFamilyEcdsaKey<TAuthBinding extends EvmFamilyEcdsaAuthBin
     subjectId?: never;
     rpId?: never;
 };
-type ThresholdEcdsaRoleLocalWorkerMaterial = {
+type ThresholdEcdsaRoleLocalWorkerMaterial = ExclusiveUnion<{
     kind: 'worker_loaded';
     materialRef: EcdsaRoleLocalPersistedMaterialRef;
-    stateBlob?: never;
-    ecdsaRoleLocalReadyRecord?: never;
 } | {
     kind: 'ready_state_blob';
     stateBlob: EcdsaRoleLocalReadyStateBlob;
     ecdsaRoleLocalReadyRecord: EcdsaRoleLocalReadyRecord;
-    materialRef?: never;
-};
+}>;
 export type ThresholdEcdsaRoleLocalWorkerShare = {
     kind: 'role_local_worker_share';
     handle: EcdsaRoleLocalWorkerHandle;
@@ -153,7 +151,6 @@ export type HydratedEcdsaSignerMaterial = {
     readonly walletId: WalletId;
     readonly materialActivation: MpcMaterialActivationRef;
     readonly publicFacts: VerifiedEcdsaPublicFacts;
-    readonly chainTarget: ThresholdEcdsaChainTarget;
     readonly transport: HydratedEcdsaSignerTransport;
     readonly clientShare: ThresholdEcdsaSignerClientShare;
     readonly routerAbEcdsaDerivationNormalSigning: HydratedRouterAbEcdsaDerivationNormalSigning;
@@ -223,7 +220,6 @@ type BuildHydratedEcdsaSignerMaterialInput = {
     readonly walletId: WalletId;
     readonly materialActivation: MpcMaterialActivationRef;
     readonly publicFacts: VerifiedEcdsaPublicFacts;
-    readonly chainTarget: ThresholdEcdsaChainTarget;
     readonly transport: HydratedEcdsaSignerTransport;
     readonly clientShare: ThresholdEcdsaSignerClientShare;
     readonly routerAbEcdsaDerivationNormalSigning: HydratedRouterAbEcdsaDerivationNormalSigning;
@@ -245,7 +241,6 @@ export declare function deriveEvmFamilySigningKeySlotId(input: {
 }): EvmFamilySigningKeySlotId;
 export declare function toThresholdOwnerAddress(value: unknown): ThresholdOwnerAddress;
 export declare function toRpId(value: unknown): RpId;
-export declare function toEmailOtpAuthSubjectId(value: unknown): EmailOtpAuthSubjectId;
 export declare function toEvmFamilyEcdsaKeyHandle(value: unknown): EvmFamilyEcdsaKeyHandle;
 export declare function resolveThresholdEcdsaKeyIdFromRecord(args: {
     record: {

package/dist/types/wallet/src/core/signingEngine/session/identity/exactSigningLaneIdentity.d.ts

@@ -82,20 +82,17 @@ type EvmFamilyEcdsaSignerBindingInput = {
     key: EvmFamilyEcdsaKeyIdentity;
     materialActivation: MpcMaterialActivationRef;
 };
-type ExactSigningLaneIdentityInput = ExactEd25519SigningLaneIdentityInput | ExactEcdsaSigningLaneIdentityInput;
 export declare function nearEd25519SignerBindingFromBoundaryFields(input: NearEd25519SignerBoundaryFields): NearEd25519SignerBinding;
 export declare function buildEvmFamilyEcdsaSignerBinding(args: EvmFamilyEcdsaSignerBindingInput): EvmFamilyEcdsaSignerBinding;
 export declare function exactSigningLaneIdentityKey(identity: ExactSigningLaneIdentity): ExactSigningLaneIdentityKey;
 export declare function exactEd25519SigningLaneIdentity<A extends SigningLaneAuthBinding>(lane: ExactEd25519SigningLaneIdentityInput<A>): ExactEd25519SigningLaneIdentity<A>;
 export declare function exactEd25519ExportMaterialIdentity<A extends SigningLaneAuthBinding>(lane: ExactEd25519ExportMaterialIdentityInput<A>): ExactEd25519ExportMaterialIdentity<A>;
 export declare function exactEcdsaSigningLaneIdentity(lane: ExactEcdsaSigningLaneIdentityInput): ExactEcdsaSigningLaneIdentity;
-export declare function exactSigningLaneIdentity(lane: ExactSigningLaneIdentityInput): ExactSigningLaneIdentity;
 export declare function exactSigningLaneIdentityFromSelectedLane(lane: SelectedLane | ExactSigningLaneIdentityCarrier): ExactSigningLaneIdentity;
 export declare function exactEd25519SigningLaneIdentityFromSelectedLane(lane: SelectedEd25519Lane | ExactEd25519SigningLaneIdentityCarrier): ExactEd25519SigningLaneIdentity;
 export declare function exactEcdsaSigningLaneIdentityFromSelectedLane(lane: SelectedEcdsaLane | ExactEcdsaSigningLaneIdentityCarrier): ExactEcdsaSigningLaneIdentity;
 export declare function parseExactEd25519ExportMaterialIdentity(value: unknown): ExactEd25519ExportMaterialIdentity;
 export declare function parseExactEcdsaSigningLaneIdentity(value: unknown): ExactEcdsaSigningLaneIdentity;
-export declare function isExactEd25519SigningLaneIdentity(identity: ExactSigningLaneIdentity): identity is ExactEd25519SigningLaneIdentity;
 export declare function isExactEcdsaSigningLaneIdentity(identity: ExactSigningLaneIdentity): identity is ExactEcdsaSigningLaneIdentity;
 export declare function exactSigningLaneWalletId(identity: ExactSigningLaneIdentity): WalletId;
 export declare function requireEvmFamilyEcdsaSigner(identity: ExactSigningLaneIdentity, context: string): EvmFamilyEcdsaSignerBinding;

package/dist/types/wallet/src/core/signingEngine/session/identity/exactWalletSessionCredential.d.ts

@@ -18,12 +18,12 @@
 import { type ActiveWalletSessionV1, type WalletSessionAuthorizationRepository, type WalletSessionOperationCredentialV1 } from '../../../indexedDB/seamsWalletDB/walletSessionAuthorizationStore';
 import type { ResolveSelectedWalletAuthorityResultV1 } from '../../../indexedDB/seamsWalletDB/repositories';
 import type { MpcWalletSigningQuotaId, WalletSessionId } from '../../../../../../shared-ts/src/authorization/capabilityKinds';
-import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type MpcMaterialActivationRef } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { SignerAuthMethod } from '../../../../../../shared-ts/src/utils/signerDomain';
 import type { WalletId } from '../../interfaces/ecdsaChainTarget';
 import { type ExactSigningLaneIdentity } from './exactSigningLaneIdentity';
 import type { ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 /** The signer material one operation needs the exact session to authorize. */
 type RequiredExactWalletSessionSigningSubject = {
     readonly keyFamily: 'ed25519';
@@ -41,23 +41,19 @@ type ExactWalletSessionExpiryRequirement = {
 };
 export type ExactWalletSessionCredentialUnavailableReason = 'selected_authority_missing' | 'selected_authority_invalid' | 'wallet_locked' | 'auth_method_inactive' | 'auth_method_mismatch' | 'authority_inactive' | 'authority_identity_mismatch' | 'signer_material_missing' | 'signer_material_mismatch' | 'wallet_session_missing' | 'wallet_session_upgrade_required' | 'wallet_session_identity_mismatch' | 'wallet_session_expired' | 'wallet_session_not_expired' | 'wallet_session_capability_mismatch' | 'persistence_unavailable';
 type ResolvedExactWalletSessionCredential = {
-    readonly walletId: WalletId;
-    readonly authority: ActiveWalletAuthorityV1;
     readonly authMethod: ActiveWalletAuthMethodRecordV2;
     readonly session: ActiveWalletSessionV1;
     readonly operationCredential: WalletSessionOperationCredentialV1;
     readonly walletSessionId: WalletSessionId;
     readonly materialActivation: MpcMaterialActivationRef;
 };
-type ExactWalletSessionCredentialResolution = {
+type ExactWalletSessionCredentialResolution = ReadonlyExclusiveUnion<{
     readonly kind: 'resolved';
     readonly resolved: ResolvedExactWalletSessionCredential;
-    readonly reason?: never;
 } | {
     readonly kind: 'unavailable';
     readonly reason: ExactWalletSessionCredentialUnavailableReason;
-    readonly resolved?: never;
-};
+}>;
 type ResolveExactWalletSessionCredentialInput = {
     readonly walletId: WalletId;
     readonly authMethod: SignerAuthMethod;

package/dist/types/wallet/src/core/signingEngine/session/identity/exactWalletSessionReader.d.ts

@@ -3,7 +3,8 @@ import { type WalletSessionAuthorizationExactOperationCredentialReadResult } fro
 import type { WalletAuthMethodId } from '../../../../../../shared-ts/src/utils/domainIds';
 import type { WalletId } from '../../interfaces/ecdsaChainTarget';
 import type { ExactWalletSessionReadPorts } from './exactWalletSessionCredential';
-export type ExactWalletSessionAuthenticationReadResult = {
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
+export type ExactWalletSessionAuthenticationReadResult = ReadonlyExclusiveUnion<{
     readonly kind: 'authenticated';
     readonly state: Extract<WalletAuthenticationState, {
         readonly kind: 'authenticated';
@@ -13,13 +14,9 @@ export type ExactWalletSessionAuthenticationReadResult = {
     readonly walletAuthMethodId: WalletAuthMethodId;
 } | {
     readonly kind: 'missing';
-    readonly state?: never;
-    readonly walletAuthMethodId?: never;
 } | {
     readonly kind: 'upgrade_required';
-    readonly state?: never;
-    readonly walletAuthMethodId?: never;
-};
+}>;
 export declare function readExactWalletSessionAuthentication(args: {
     readonly walletId: WalletId;
     readonly ports: ExactWalletSessionReadPorts;

package/dist/types/wallet/src/core/signingEngine/session/identity/laneIdentity.d.ts

@@ -14,14 +14,9 @@ import type { ExactEvmFamilyWalletSessionAuthorization } from '../material/ecdsa
 import type { ActiveWalletAuthorityEcdsaRuntimeV1 } from '../material/activeWalletAuthorityEcdsaRuntime';
 import type { ExactNearEd25519WalletSessionAuthorization } from '../material/nearEd25519YaoSigningPreparation';
 import type { NearEd25519SigningKeyId } from '../../../../../../shared-ts/src/utils/registrationIds';
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 export type { SigningCurve };
 export type { EcdsaThresholdKeyId };
-export type SigningRootId = string & {
-    readonly __brand?: 'SigningRootId';
-};
-export type SigningRootVersion = string & {
-    readonly __brand?: 'SigningRootVersion';
-};
 export type ThresholdEcdsaSessionStoreSource = 'login' | 'registration' | 'manual-bootstrap' | 'email_otp';
 export type ThresholdEd25519SessionStoreSource = 'login' | 'registration' | 'add-signer' | 'manual-connect' | 'bootstrap' | 'email_otp' | 'sealed_restore';
 export type ThresholdEcdsaEmailOtpAuthContext = {
@@ -89,27 +84,23 @@ type BuildEmailOtpAuthContextForWalletAuthMethodArgs = {
     emailHashHex: unknown;
     provider: EmailOtpProvider;
     providerUserId: unknown;
-} & ({
+} & ExclusiveUnion<{
     retention: 'session';
     reason: 'login' | 'sign';
-    consumedAtMs?: never;
 } | {
     retention: 'single_use';
-    reason?: never;
     consumedAtMs?: number;
-});
+}>;
 type BuildEmailOtpAuthContextFromExactAuthorityArgs = {
     policy: EmailOtpAuthPolicy;
     authority: EmailOtpWalletAuthAuthority;
-} & ({
+} & ExclusiveUnion<{
     retention: 'session';
     reason: 'login' | 'sign';
-    consumedAtMs?: never;
 } | {
     retention: 'single_use';
-    reason?: never;
     consumedAtMs?: number;
-});
+}>;
 export declare function buildEmailOtpAuthContext(args: BuildEmailOtpSessionAuthContextArgs): ThresholdEcdsaEmailOtpSessionAuthContext;
 export declare function buildEmailOtpAuthContext(args: BuildEmailOtpPendingSingleUseAuthContextArgs): ThresholdEcdsaEmailOtpPendingSingleUseAuthContext;
 export declare function buildEmailOtpAuthContext(args: BuildEmailOtpConsumedSingleUseAuthContextArgs): ThresholdEcdsaEmailOtpConsumedSingleUseAuthContext;

package/dist/types/wallet/src/core/signingEngine/session/identity/signingLaneAuthBinding.d.ts

@@ -3,17 +3,15 @@ import { SIGNER_AUTH_METHODS, type SignerAuthMethod } from '../../../../../../sh
 import type { DigestB64u } from '../../../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { LinkedDeviceEnrollmentId, LinkedDeviceId } from '../../../../../../shared-ts/src/signing-lanes/ids';
 import type { WalletAuthMethodId, WalletAuthorityBindingDigest } from '../../../../../../shared-ts/src/utils/domainIds';
-export type SigningLaneAuthBinding = {
+import type { ExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
+export type SigningLaneAuthBinding = ExclusiveUnion<{
     kind: typeof SIGNER_AUTH_METHODS.passkey;
     rpId: RpId;
     credentialIdB64u: string;
-    providerSubjectId?: never;
 } | {
     kind: typeof SIGNER_AUTH_METHODS.emailOtp;
     providerSubjectId: string;
-    rpId?: never;
-    credentialIdB64u?: never;
-};
+}>;
 /**
  * Identity that distinguishes one linked Email OTP owner from the wallet-wide
  * factor and from another enrollment using that factor. It is separate from

package/dist/types/wallet/src/core/signingEngine/session/identity/walletUnlockSubject.d.ts

@@ -29,12 +29,4 @@ export type WalletUnlockSubjectSet = {
     readonly walletId: WalletId;
     readonly subjects: readonly [WalletUnlockSubject, ...WalletUnlockSubject[]];
 };
-export type EvmFamilyEcdsaWalletUnlockSubjectSet = {
-    readonly kind: 'wallet_unlock_subject_set';
-    readonly walletId: WalletId;
-    readonly subjects: readonly [
-        EvmFamilyEcdsaWalletUnlockSubject,
-        ...EvmFamilyEcdsaWalletUnlockSubject[]
-    ];
-};
 //# sourceMappingURL=walletUnlockSubject.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/keyMaterialBrands.d.ts

@@ -2,8 +2,7 @@ import { type EcdsaThresholdKeyId } from '../../../../../shared-ts/src/threshold
 import { type Brand } from '../../../../../shared-ts/src/threshold/keyMaterialBrands';
 import { type MpcMaterialActivationRef } from '../../../../../shared-ts/src/utils/domainIds';
 export type { EcdsaThresholdKeyId };
-export { formatEcdsaClientVerifyingShareB64uForWire, formatEcdsaDerivationKeyVersionForWire, formatEcdsaKeyHandleForWire, formatEcdsaRelayerKeyIdForWire, formatEcdsaThresholdKeyIdForWire, formatEd25519RelayerKeyIdForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaDerivationKeyVersion, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEd25519RelayerKeyId, parseSigningSessionSealKeyVersion, type EcdsaClientVerifyingShareB64u, type EcdsaDerivationKeyVersion, type EcdsaKeyHandle, type EcdsaRelayerKeyId, type Ed25519RelayerKeyId, type SigningSessionSealKeyVersion, } from '../../../../../shared-ts/src/threshold/keyMaterialBrands';
-export type Ed25519KeyVersion = Brand<string, 'Ed25519KeyVersion'>;
+export { formatEcdsaKeyHandleForWire, formatSigningSessionSealKeyVersionForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseSigningSessionSealKeyVersion, type EcdsaClientVerifyingShareB64u, type EcdsaKeyHandle, type EcdsaRelayerKeyId, type SigningSessionSealKeyVersion, } from '../../../../../shared-ts/src/threshold/keyMaterialBrands';
 export type EcdsaClientVerifyingPublicKey33B64u = Brand<string, 'EcdsaClientVerifyingPublicKey33B64u'>;
 type EcdsaRoleLocalMaterialHandle = Brand<string, 'EcdsaRoleLocalMaterialHandle'>;
 export type EcdsaRoleLocalBindingDigest = Brand<string, 'EcdsaRoleLocalBindingDigest'>;
@@ -27,6 +26,4 @@ export declare function parseEcdsaRoleLocalBindingDigest(value: unknown): EcdsaR
 export declare function parseEcdsaRoleLocalDurableMaterialRef(value: unknown): EcdsaRoleLocalDurableMaterialRef;
 export declare function parseEcdsaRoleLocalPersistedMaterialRef(value: unknown): EcdsaRoleLocalPersistedMaterialRef;
 export declare function parseEcdsaRoleLocalWorkerHandle(value: unknown): EcdsaRoleLocalWorkerHandle;
-export declare function formatEd25519KeyVersionForWire(value: Ed25519KeyVersion): string;
-export declare function formatEcdsaClientVerifyingPublicKey33B64uForWire(value: EcdsaClientVerifyingPublicKey33B64u): string;
 //# sourceMappingURL=keyMaterialBrands.d.ts.map

package/dist/types/wallet/src/core/signingEngine/session/material/activeEcdsaCapabilityRuntime.d.ts

@@ -3,30 +3,25 @@ import { type ThresholdEcdsaChainTarget, type WalletId } from '../../interfaces/
 import { type ExactEcdsaCapabilityRuntime, type ExactEcdsaSealedRuntime, type ExactEcdsaSealedRuntimeResolution } from './ecdsaSealedRuntime';
 import type { ActiveEcdsaCapabilityManifest } from './ecdsaCapabilityManifest';
 import type { ExactWalletSessionReadPorts } from '../identity/exactWalletSessionCredential';
-export type ActiveEcdsaCapabilityRuntimeResolution = {
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
+export type ActiveEcdsaCapabilityRuntimeResolution = ReadonlyExclusiveUnion<{
     readonly kind: 'resolved';
     readonly manifest: ActiveEcdsaCapabilityManifest;
     readonly runtime: ExactEcdsaSealedRuntime;
-    readonly reason?: never;
 } | {
     readonly kind: 'blocked';
     readonly reason: Extract<ExactEcdsaSealedRuntimeResolution, {
         kind: 'blocked';
     }>['reason'] | 'missing_capability';
-    readonly manifest?: never;
-    readonly runtime?: never;
-};
-type ExactEcdsaCapabilityRuntimeResolution = {
+}>;
+type ExactEcdsaCapabilityRuntimeResolution = ReadonlyExclusiveUnion<{
     readonly kind: 'resolved';
     readonly manifest: ActiveEcdsaCapabilityManifest;
     readonly runtime: ExactEcdsaCapabilityRuntime;
-    readonly reason?: never;
 } | {
     readonly kind: 'blocked';
     readonly reason: 'chain_mismatch' | 'corrupt';
-    readonly manifest?: never;
-    readonly runtime?: never;
-};
+}>;
 export type ActiveEcdsaCapabilityRuntimeReadPorts = Pick<ExactWalletSessionReadPorts, 'resolveSelectedWalletAuthority'> & {
     readonly listActiveEcdsaCapabilityManifestsForWallet: (walletId: WalletId) => Promise<readonly ActiveEcdsaCapabilityManifest[]>;
     readonly listExactSealedSessionsForWallet: typeof listExactSealedSessionsForWallet;

package/dist/types/wallet/src/core/signingEngine/session/material/activeWalletAuthorityEcdsaRuntime.d.ts

@@ -10,6 +10,7 @@ import type { SigningLaneAuthBinding } from '../identity/signingLaneAuthBinding'
 import { type LinkedEcdsaHolderRuntimeV1 } from './linkedEcdsaHolderRuntime';
 import type { ExactWalletSessionReadPorts } from '../identity/exactWalletSessionCredential';
 import type { ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
+import type { ReadonlyExclusiveUnion } from '../../../../../../shared-ts/src/utils/variant';
 type ActiveWalletAuthorityEcdsaAuth = {
     readonly auth: Extract<SigningLaneAuthBinding, {
         readonly kind: 'passkey';
@@ -83,20 +84,16 @@ export type ActiveWalletAuthorityEcdsaLaneProjectionV1 = ActiveWalletAuthorityEc
     readonly state: 'deferred';
     readonly authorizationState: 'authorization_required';
 };
-type ActiveWalletAuthorityEcdsaRuntimeBlockReason = 'missing_selected_authority' | 'invalid_selected_authority' | 'wallet_locked' | 'auth_method_inactive' | 'authority_inactive' | 'authority_identity_mismatch' | 'missing_wallet_session' | 'upgrade_required' | 'wallet_session_inactive' | 'wallet_session_expired' | 'wallet_session_identity_mismatch' | 'wallet_session_capability_mismatch' | 'missing_ecdsa_signer' | 'missing_holder_runtime' | 'holder_runtime_identity_mismatch' | 'normal_signing_identity_mismatch' | 'invalid_public_facts' | 'persistence_unavailable';
-type ActiveWalletAuthorityEcdsaRuntimeResolution = {
+type ActiveWalletAuthorityEcdsaRuntimeBlockReason = 'missing_selected_authority' | 'invalid_selected_authority' | 'wallet_locked' | 'auth_method_inactive' | 'authority_inactive' | 'authority_identity_mismatch' | 'missing_wallet_session' | 'upgrade_required' | 'wallet_session_expired' | 'wallet_session_identity_mismatch' | 'wallet_session_capability_mismatch' | 'missing_ecdsa_signer' | 'missing_holder_runtime' | 'holder_runtime_identity_mismatch' | 'normal_signing_identity_mismatch' | 'invalid_public_facts' | 'persistence_unavailable';
+type ActiveWalletAuthorityEcdsaRuntimeResolution = ReadonlyExclusiveUnion<{
     readonly kind: 'resolved';
     readonly runtime: ActiveWalletAuthorityEcdsaRuntimeV1;
     readonly lane: ActiveWalletAuthorityEcdsaLaneProjectionV1 | null;
-    readonly reason?: never;
-    readonly message?: never;
 } | {
     readonly kind: 'blocked';
     readonly reason: ActiveWalletAuthorityEcdsaRuntimeBlockReason;
     readonly message?: string;
-    readonly runtime?: never;
-    readonly lane?: never;
-};
+}>;
 type ResolveActiveWalletAuthorityEcdsaRuntimeV1Input = {
     readonly walletId: WalletId | string;
     readonly chainTarget?: ThresholdEcdsaChainTarget;