@seams/wallet 0.5.1 → 0.5.3

package/dist/.build-inputs.sha256

@@ -1 +1 @@
-9e6339642b68ce46bda1fabd01c5f6377195e50758961179b1f43feb0d24fafb
+b5b2bc0f0d923ec728dc7382b6332ea8ed424a567a5c77e1979ed72c282ee2b0

package/dist/esm/SeamsWeb/signingSurface/BrowserSigningSurface.js

@@ -71,7 +71,7 @@ import { reconcileTempoNonceLane, reportTempoBroadcastAccepted, reportTempoBroad
 import { UserConfirmationType } from "../../core/signingEngine/stepUpConfirmation/userConfirmationType.js";
 import { exportKeypairWithUI, resolveExactKeyExportLane } from "../../core/signingEngine/flows/recovery/public.js";
 import { activateAuthenticatedWalletState, finalizeWalletEcdsaRegistration, finalizeWalletEd25519SignerRegistration, getAllUsers, getAuthenticationCredentialsSerialized, getLastUser, getUserBySignerSlot, getWalletNearProvisioningState, hasPasskeyCredential, nearAuthenticatorsByAccount, requestRegistrationCredentialConfirmation, rollbackUserRegistration, rollbackWalletEd25519SignerRegistration, setLastUser, setWalletNearProvisioningState, storeAuthenticator, storeUserData, storeWalletEcdsaRecoverySignerRecords, storeWalletEcdsaSignerRecords, storeWalletEd25519RecoveryRegistrationData, storeWalletEd25519RegistrationData, storeWalletEmailOtpEcdsaRegistrationData, storeWalletEmailOtpEcdsaSignerRecords, storeWalletEmailOtpEd25519RegistrationData, storeWalletEmailOtpMixedRegistrationData, storeWalletMixedRegistrationData } from "../../core/signingEngine/flows/registration/public.js";
-import { exactWalletSessionWithOperationCredentialOrThrow, readExactOwnerLaneWalletSession } from "../../core/signingEngine/session/identity/exactWalletSessionReader.js";
+import { exactWalletSessionWithOperationCredentialOrThrow } from "../../core/signingEngine/session/identity/exactWalletSessionReader.js";
 import { enrollEmailOtpInternal, loginWithEmailOtpEcdsaCapabilityInternal, prepareEmailOtpRegistrationEnrollmentMaterialInternal, refreshEmailOtpSigningSession, requestEmailOtpSigningSessionChallenge } from "../../core/signingEngine/flows/signEvmFamily/emailOtpPublic.js";
 import { __isWalletIframeHostMode } from "../../core/browser/walletIframe/host-mode.js";
 import { destroyUnlockedWalletEd25519ExportRootCapabilitiesV1, establishUnlockedWalletEd25519ExportRootCapabilityV1, setUnlockedCustodyEnvelopeUpgradeSinkV1 } from "../../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
@@ -1141,7 +1141,7 @@ var BrowserSigningSurface = class {
 				emailOtpSessions: this.emailOtpSessions,
 				sealedSigningSessionStore: deps.sealedSigningSessionStore
 			}, input),
-			resolveOwnerLaneScope: (walletId) => this.resolveActiveOwnerLaneScope(walletId)
+			resolveOwnerLaneScope: (walletId) => this.resolveSelectedOwnerLaneScope(walletId)
 		});
 		this.enginePorts = createBrowserSigningSurfaceEnginePorts({
 			runtimePorts: this.runtimePorts,
@@ -1167,7 +1167,7 @@ var BrowserSigningSurface = class {
 			workerWarmupPolicy: deps.workerWarmupPolicy,
 			getTheme: () => this.appearance.theme.mode,
 			ensureSealedRefreshStartupParity: () => this.ensureSealedRefreshStartupParity(),
-			resolveOwnerLaneScope: (walletId) => this.resolveActiveOwnerLaneScope(walletId),
+			resolveOwnerLaneScope: (walletId) => this.resolveSelectedOwnerLaneScope(walletId),
 			getEnginePorts: () => this.enginePorts,
 			getRegistrationPublicDeps: () => this.registrationPublicDeps,
 			prepareNearEd25519YaoMaterialBoundary: this.prepareExactNearEd25519YaoMaterialBoundary.bind(this)
@@ -1488,11 +1488,11 @@ var BrowserSigningSurface = class {
 		return await readOwnerScopedSigningLanes(this.sessionPublicDeps, args);
 	}
 	/**
-	* R103C derivation chain for post-login operations: the unique active Wallet
-	* Session authority resolves through the active wallet auth method to one
-	* exact owner scope. Callers never supply credential or slot hints.
+	* Resolves the selected active Wallet Authority and auth method to one exact
+	* owner scope. Session availability is resolved by the lane inventory so an
+	* expired session can enter operation step-up.
 	*/
-	async resolveActiveOwnerLaneScope(walletId) {
+	async resolveSelectedOwnerLaneScope(walletId) {
 		const parsedWalletId = parseWalletId(walletId);
 		if (!parsedWalletId.ok) throw new Error(parsedWalletId.error.message);
 		const stores = {
@@ -1506,13 +1506,6 @@ var BrowserSigningSurface = class {
 			const { selection, authMethod, authority } = selected;
 			if (selection.walletId !== parsedWalletId.value || selection.walletAuthMethodId !== authMethod.walletAuthMethodId || authMethod.walletId !== parsedWalletId.value || authMethod.walletAuthorityId !== authority.authorityId || authority.walletId !== parsedWalletId.value) throw new Error("[SigningEngine] selected Wallet Authority identity mismatch");
 			if (selection.lockState !== "unlocked" || authMethod.status !== "active" || authority.state !== "active") throw new Error("[SigningEngine] selected Wallet Authority is inactive or locked");
-			await readExactOwnerLaneWalletSession({
-				walletId: parsedWalletId.value,
-				authorityId: authority.authorityId,
-				authMethodId: authMethod.walletAuthMethodId,
-				authorityDigestB64u: authority.authorityDigestB64u,
-				authorityRevocationEpoch: authority.revocationEpoch
-			});
 			if (authority.provenance.kind === "device_link" && authMethod.kind === "passkey" && authority.signerActivations.ed25519) return buildExactPasskeyOwnerLaneScope({
 				authMethod,
 				signerSlot: await resolveLinkedPasskeyOwnerSignerSlot({

package/dist/esm/core/signingEngine/flows/signEvmFamily/signingFlow.js

@@ -132,6 +132,7 @@ async function signEvmFamilyWithUiConfirm(args) {
 	const thresholdEcdsaStepUp = input.thresholdEcdsaStepUp;
 	const thresholdEcdsaStepUpRuntime = thresholdEcdsaStepUp.kind === "not_required" ? void 0 : thresholdEcdsaStepUp.runtime;
 	const signingAuthPlan = signingAuthPlanFromThresholdEcdsaStepUp(thresholdEcdsaStepUp);
+	const requiresThresholdEcdsaOperationStepUp = input.authorization.kind === "owner" && thresholdEcdsaStepUp.kind === "required" && (thresholdEcdsaStepUp.runtime.reusableAuthorization.kind === "absent" || !isWarmSessionSigningAuthPlan(thresholdEcdsaStepUp.authPlan.signingAuthPlan));
 	if (hasThresholdEcdsaRequest && !signingAuthPlan) switch (input.authorization.kind) {
 		case "owner": throw new Error("[chains] threshold ECDSA transaction signing requires an explicit auth plan");
 		case "active_wallet_authority": break;
@@ -239,7 +240,7 @@ async function signEvmFamilyWithUiConfirm(args) {
 			subtitle: config.body
 		});
 		let challengeB64u = base64UrlEncode(firstDigest);
-		if (firstSignRequest.algorithm === "secp256k1" && thresholdEcdsaStepUpRuntime && activeThresholdEcdsaOperation && input.resolveEcdsaSigningMaterialPlan) {
+		if (requiresThresholdEcdsaOperationStepUp && firstSignRequest.algorithm === "secp256k1" && thresholdEcdsaStepUpRuntime && activeThresholdEcdsaOperation && input.resolveEcdsaSigningMaterialPlan) {
 			const operationDigests = await buildEvmFamilyOperationDigests({
 				operationFingerprint: input.signingOperation?.operationFingerprint,
 				signingDigest32: inferDigest32FromSignRequest(firstSignRequest),

package/dist/esm/core/signingEngine/flows/signNear/signNear.js

@@ -276,19 +276,16 @@ function buildNearPasskeyEd25519OperationStepUp(args) {
 	if (args.auth.kind !== "passkey") return void 0;
 	const auth = args.auth;
 	return { prepare: async () => {
-		const materialFacts = await resolveNearPasskeyStepUpMaterialFacts({
-			preparation: args.preparation,
-			executor: args.materialExecutor
-		});
 		const signer = args.signer;
+		const authority = await exactPasskeyStepUpAuthority({
+			authorityRef: nearPasskeyPreparationAuthority(args.preparation),
+			walletId: signer.account.wallet.walletId,
+			rpId: auth.rpId,
+			credentialIdB64u: auth.credentialIdB64u
+		});
 		return {
-			thresholdSessionId: materialFacts.thresholdSessionId,
-			authority: await exactPasskeyStepUpAuthority({
-				authorityRef: nearPasskeyPreparationAuthority(args.preparation),
-				walletId: signer.account.wallet.walletId,
-				rpId: auth.rpId,
-				credentialIdB64u: auth.credentialIdB64u
-			})
+			thresholdSessionId: args.thresholdSessionId,
+			authority
 		};
 	} };
 }
@@ -321,17 +318,6 @@ async function exactPasskeyStepUpAuthority(args) {
 	if (resolvedRef.walletId !== args.authorityRef.walletId || resolvedRef.walletAuthMethodId !== args.authorityRef.walletAuthMethodId || resolvedRef.authorityDigest !== args.authorityRef.authorityDigest) throw new Error("[SigningEngine][near] exact Passkey step-up authority changed");
 	return authority;
 }
-async function resolveNearPasskeyStepUpMaterialFacts(args) {
-	switch (args.preparation.hydration.kind) {
-		case "use_live_runtime": return (await args.executor.resolve(args.preparation)).facts;
-		case "rehydrate_material_activation": return (await args.executor.preparePasskeyOperationStepUp(args.preparation)).facts;
-		case "reauthorize_public_anchor": throw new Error("[SigningEngine][near] retired material cannot prepare Passkey step-up");
-		case "blocked": throw new Error(`[SigningEngine][near] Passkey step-up material is blocked: ${args.preparation.hydration.reason}`);
-		default:
-			args.preparation.hydration;
-			throw new Error("[SigningEngine][near] unsupported Passkey step-up material source");
-	}
-}
 function buildNearEmailOtpEd25519StepUp(args) {
 	if (args.auth.kind !== SIGNER_AUTH_METHODS.emailOtp || typeof args.deps.requestEmailOtpEd25519SigningChallenge !== "function") return;
 	if (!args.preparation.hydration.materialActivation) return;
@@ -402,8 +388,8 @@ async function prepareNearAdHocSigningSession(args) {
 			passkeyEd25519OperationStepUp: buildNearPasskeyEd25519OperationStepUp({
 				auth: candidate.auth,
 				signer,
-				preparation: materialBoundary.preparation,
-				materialExecutor: materialBoundary.executor
+				thresholdSessionId: materialIdentity.thresholdSessionId,
+				preparation: materialBoundary.preparation
 			}) || null,
 			emailOtpEd25519StepUp: buildNearEmailOtpEd25519StepUp({
 				deps: args.deps,
@@ -430,8 +416,8 @@ async function prepareNearAdHocSigningSession(args) {
 		passkeyEd25519OperationStepUp: buildNearPasskeyEd25519OperationStepUp({
 			auth: selectedLane.auth,
 			signer: selectedLane.identity.signer,
-			preparation: materialBoundary.preparation,
-			materialExecutor: materialBoundary.executor
+			thresholdSessionId: selectedLane.identity.thresholdSessionId,
+			preparation: materialBoundary.preparation
 		}) || null,
 		emailOtpEd25519StepUp: buildNearEmailOtpEd25519StepUp({
 			deps: args.deps,
@@ -494,8 +480,8 @@ async function prepareNearAuthorizationRequiredTransaction(args) {
 		passkeyEd25519OperationStepUp: buildNearPasskeyEd25519OperationStepUp({
 			auth: candidate.auth,
 			signer,
-			preparation: materialBoundary.preparation,
-			materialExecutor: materialBoundary.executor
+			thresholdSessionId: materialIdentity.thresholdSessionId,
+			preparation: materialBoundary.preparation
 		}) || null,
 		emailOtpEd25519StepUp: buildNearEmailOtpEd25519StepUp({
 			deps: args.deps,
@@ -849,8 +835,8 @@ async function signTransactionWithActions(deps, args, attempt = {}) {
 				const passkeyEd25519OperationStepUp = buildNearPasskeyEd25519OperationStepUp({
 					auth: transactionLane.auth,
 					signer: transactionLane.identity.signer,
-					preparation: materialBoundary.preparation,
-					materialExecutor: materialBoundary.executor
+					thresholdSessionId,
+					preparation: materialBoundary.preparation
 				});
 				const emailOtpEd25519StepUp = buildNearEmailOtpEd25519StepUp({
 					deps,

package/dist/esm/core/signingEngine/flows/signNear/signTransactions.js

@@ -112,6 +112,51 @@ function createNearTransactionSigningOperationId() {
 	const randomId = secureRandomBase64Url(32, "NEAR transaction signing operation IDs");
 	return SigningSessionIds.signingOperation(`near-transaction-sign:${randomId}`);
 }
+async function prepareNearTransactionConfirmationReadiness(args) {
+	const material = await prepareNearOperationStepUpMaterial({
+		method: args.method,
+		preparation: args.preparation,
+		executor: args.executor
+	});
+	const materialFacts = nearOperationStepUpMaterialFacts(material);
+	if (String(materialFacts.thresholdSessionId) !== args.expectedThresholdSessionId) throw new Error("[SigningEngine][near] prepared operation material changed threshold session");
+	registerNearOperationStepUpBuilder({
+		requestId: args.requestId,
+		build: async (preparation) => {
+			if (preparation.kind !== "near_transaction") throw new Error("[SigningEngine][near] transaction step-up preparation kind changed");
+			if (preparation.operationId !== String(args.operation.operationId)) throw new Error("[SigningEngine][near] operation step-up operation identity changed");
+			return await prepareRouterAbEd25519NearTransactionOperationStepUp({
+				...args.operation,
+				thresholdSessionId: materialFacts.thresholdSessionId,
+				materialFacts,
+				materialActivation: material.materialActivation,
+				transactionContext: preparation.transactionContext,
+				displayDigest: preparation.displayDigest
+			});
+		}
+	});
+	registerNearImplicitAccountFunder({
+		requestId: args.requestId,
+		fund: async (request) => await fundNearImplicitAccountForOperationStepUp({
+			...args.funding,
+			request,
+			fundingSession: await args.executor.resolveFundingSession(),
+			method: args.method
+		})
+	});
+	return material;
+}
+function clearNearTransactionConfirmationResources(requestId) {
+	clearNearOperationStepUpBuilder(requestId);
+	clearNearImplicitAccountFunder(requestId);
+}
+function clearNearTransactionConfirmationReadinessWhenSettled(args) {
+	if (!args.readiness) {
+		clearNearTransactionConfirmationResources(args.requestId);
+		return;
+	}
+	args.readiness.then(clearNearTransactionConfirmationResources.bind(void 0, args.requestId), clearNearTransactionConfirmationResources.bind(void 0, args.requestId));
+}
 /**
 * Sign one NEAR transaction. A transaction may contain multiple actions.
 */
@@ -201,44 +246,28 @@ async function runNearAuthorizationRequiredTransactionSigning(payload) {
 		...emailOtpEd25519StepUp ? { emailOtpEd25519StepUp } : {}
 	});
 	if (preparedStepUp.kind === "warm_session") throw new Error("[SigningEngine][near] deferred Ed25519 transaction cannot use warm session");
-	const operationStepUpMaterial = await prepareNearOperationStepUpMaterial({
-		method: preparedStepUp.kind,
-		preparation: yaoSigningPreparation,
-		executor: yaoMaterialExecutor
-	});
-	const materialFacts = nearOperationStepUpMaterialFacts(operationStepUpMaterial);
 	const signingOperationUses = requiredNearTransactionSignatureUses(transaction);
-	registerNearOperationStepUpBuilder({
-		requestId: String(operationId),
-		build: async (preparation) => {
-			if (preparation.kind !== "near_transaction") throw new Error("[SigningEngine][near] transaction step-up preparation kind changed");
-			return await prepareRouterAbEd25519NearTransactionOperationStepUp({
-				ctx,
-				thresholdSessionId: materialFacts.thresholdSessionId,
-				materialFacts,
-				thresholdKeyMaterial: signingContext.threshold.thresholdKeyMaterial,
-				walletId: commandSubject.walletSession.walletId,
-				nearAccountId,
-				materialActivation: operationStepUpMaterial.materialActivation,
-				operationId,
-				operationFingerprint,
-				txSigningRequest,
-				transactionContext: preparation.transactionContext,
-				displayDigest: preparation.displayDigest
-			});
-		}
-	});
-	registerNearImplicitAccountFunder({
+	const operationStepUpReadiness = prepareNearTransactionConfirmationReadiness({
 		requestId: String(operationId),
-		fund: async (fundingRequest) => await fundNearImplicitAccountForOperationStepUp({
-			request: fundingRequest,
+		expectedThresholdSessionId: String(deferredIdentity.thresholdSessionId),
+		method: preparedStepUp.kind,
+		preparation: yaoSigningPreparation,
+		executor: yaoMaterialExecutor,
+		operation: {
+			ctx,
+			thresholdKeyMaterial: signingContext.threshold.thresholdKeyMaterial,
+			walletId: commandSubject.walletSession.walletId,
+			nearAccountId,
+			operationId,
+			operationFingerprint,
+			txSigningRequest
+		},
+		funding: {
 			ctx,
 			nearPublicKeyStr: signingContext.signingNearPublicKeyStr,
-			fundingSession: await yaoMaterialExecutor.resolveFundingSession(),
-			method: preparedStepUp.kind,
 			signingOperation,
 			signatureUses: signingOperationUses
-		})
+		}
 	});
 	let confirmation;
 	try {
@@ -274,6 +303,10 @@ async function runNearAuthorizationRequiredTransactionSigning(payload) {
 				}),
 				title,
 				body,
+				confirmationReadiness: {
+					promise: operationStepUpReadiness,
+					body: "Preparing secure signing session…"
+				},
 				onProgress: emitNearSigningConfirmationProgress.bind(void 0, {
 					onEvent,
 					nearAccountId,
@@ -282,9 +315,13 @@ async function runNearAuthorizationRequiredTransactionSigning(payload) {
 			}
 		});
 	} finally {
-		clearNearOperationStepUpBuilder(String(operationId));
-		clearNearImplicitAccountFunder(String(operationId));
+		clearNearTransactionConfirmationReadinessWhenSettled({
+			requestId: String(operationId),
+			readiness: operationStepUpReadiness
+		});
 	}
+	const operationStepUpMaterial = await operationStepUpReadiness;
+	const materialFacts = nearOperationStepUpMaterialFacts(operationStepUpMaterial);
 	const stepUpAuthorization = buildNearEd25519StepUpAuthorization({
 		prepared: preparedStepUp,
 		confirmation
@@ -493,50 +530,28 @@ async function runAuthorizedNearTransactionWithActionsSigning({ ctx, commandSubj
 			overlay: "show"
 		}
 	});
-	let operationStepUpMaterial = null;
-	if (preparedStepUp.kind !== "warm_session") {
-		operationStepUpMaterial = await prepareNearOperationStepUpMaterial({
-			method: preparedStepUp.kind,
-			preparation: yaoSigningPreparation,
-			executor: yaoMaterialExecutor
-		});
-		const material = operationStepUpMaterial;
-		const materialFacts = nearOperationStepUpMaterialFacts(material);
-		registerNearOperationStepUpBuilder({
-			requestId: thresholdSessionId,
-			build: async (preparation) => {
-				if (preparation.kind !== "near_transaction") throw new Error("[SigningEngine][near] transaction step-up preparation kind changed");
-				if (preparation.operationId !== String(signingOperation.operationId)) throw new Error("[SigningEngine][near] operation step-up operation identity changed");
-				return await prepareRouterAbEd25519NearTransactionOperationStepUp({
-					ctx,
-					thresholdSessionId: materialFacts.thresholdSessionId,
-					materialFacts,
-					thresholdKeyMaterial: signingContext.threshold.thresholdKeyMaterial,
-					walletId: commandSubject.walletSession.walletId,
-					nearAccountId,
-					materialActivation: material.materialActivation,
-					operationId: signingOperation.operationId,
-					operationFingerprint,
-					txSigningRequest,
-					transactionContext: preparation.transactionContext,
-					displayDigest: preparation.displayDigest
-				});
-			}
-		});
-		const stepUpFundingMethod = preparedStepUp.kind;
-		registerNearImplicitAccountFunder({
-			requestId: thresholdSessionId,
-			fund: async (fundingRequest) => await fundNearImplicitAccountForOperationStepUp({
-				request: fundingRequest,
-				ctx,
-				nearPublicKeyStr: signingContext.signingNearPublicKeyStr,
-				fundingSession: await yaoMaterialExecutor.resolveFundingSession(),
-				method: stepUpFundingMethod,
-				signingOperation,
-				signatureUses: requiredSignatureUses
-			})
-		});
-	}
+	const operationStepUpReadiness = preparedStepUp.kind === "warm_session" ? null : prepareNearTransactionConfirmationReadiness({
+		requestId: thresholdSessionId,
+		expectedThresholdSessionId: thresholdSessionId,
+		method: preparedStepUp.kind,
+		preparation: yaoSigningPreparation,
+		executor: yaoMaterialExecutor,
+		operation: {
+			ctx,
+			thresholdKeyMaterial: signingContext.threshold.thresholdKeyMaterial,
+			walletId: commandSubject.walletSession.walletId,
+			nearAccountId,
+			operationId: signingOperation.operationId,
+			operationFingerprint,
+			txSigningRequest
+		},
+		funding: {
+			ctx,
+			nearPublicKeyStr: signingContext.signingNearPublicKeyStr,
+			signingOperation,
+			signatureUses: requiredSignatureUses
+		}
+	});
 	let confirmation;
 	try {
 		confirmation = await runSigningConfirmationCommand({
@@ -571,13 +586,20 @@ async function runAuthorizedNearTransactionWithActionsSigning({ ctx, commandSubj
 				}),
 				title,
 				body,
+				...operationStepUpReadiness ? { confirmationReadiness: {
+					promise: operationStepUpReadiness,
+					body: "Preparing secure signing session…"
+				} } : {},
 				onProgress: emitUiConfirmProgress
 			}
 		});
 	} finally {
-		clearNearOperationStepUpBuilder(thresholdSessionId);
-		clearNearImplicitAccountFunder(thresholdSessionId);
+		clearNearTransactionConfirmationReadinessWhenSettled({
+			requestId: thresholdSessionId,
+			readiness: operationStepUpReadiness
+		});
 	}
+	const operationStepUpMaterial = operationStepUpReadiness ? await operationStepUpReadiness : null;
 	emitNearSigningEvent(onEvent, nearAccountId, {
 		phase: SigningEventPhase.STEP_05_CONFIRMATION_APPROVED,
 		status: "succeeded",

package/dist/esm/core/signingEngine/session/identity/exactWalletSessionReader.js

@@ -1,4 +1,4 @@
-import { WalletSessionAuthorizationUpgradeRequiredError, walletSessionAuthorizations } from "../../../indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
+import { WalletSessionAuthorizationUpgradeRequiredError } from "../../../indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
 //#region src/core/signingEngine/session/identity/exactWalletSessionReader.ts
 function exactWalletSessionMatchesAuthorityScope(args) {
 	const { record, operationCredential, scope } = args;
@@ -48,32 +48,7 @@ function exactWalletSessionWithOperationCredentialOrThrow(result, message) {
 		case "upgrade_required": throw new WalletSessionAuthorizationUpgradeRequiredError(message);
 	}
 }
-async function readExactOwnerLaneWalletSession(args) {
-	const read = await walletSessionAuthorizations.readExactActiveForWallet({
-		walletId: args.walletId,
-		authorityId: args.authorityId,
-		authMethodId: args.authMethodId
-	});
-	switch (read.kind) {
-		case "found":
-			if (!exactWalletSessionMatchesAuthorityScope({
-				record: read.record,
-				operationCredential: read.operationCredential,
-				scope: args
-			})) throw new Error("[SigningEngine] selected Wallet Authority session identity mismatch");
-			if (read.record.expiresAtMs <= Date.now()) throw new Error("[SigningEngine] selected Wallet Authority session is unavailable: expired");
-			return;
-		case "missing": throw new Error("[SigningEngine] selected Wallet Authority session is unavailable: missing");
-		case "upgrade_required": throw new WalletSessionAuthorizationUpgradeRequiredError("[SigningEngine] selected Wallet Authority Wallet Session requires a newer client");
-		case "corrupt": throw new Error("[SigningEngine] selected Wallet Authority session is unavailable: corrupt");
-		case "persistence_unavailable": throw new Error("[SigningEngine] selected Wallet Authority session is unavailable: persistence_unavailable");
-		default: return assertNeverWalletSessionAuthorizationRead(read);
-	}
-}
-function assertNeverWalletSessionAuthorizationRead(value) {
-	throw new Error(`Unknown exact Wallet Session authorization read: ${String(value)}`);
-}
 //#endregion
-export { exactWalletSessionWithOperationCredentialOrThrow, readExactOwnerLaneWalletSession, readExactWalletSessionAuthentication };
+export { exactWalletSessionWithOperationCredentialOrThrow, readExactWalletSessionAuthentication };
 
 //# sourceMappingURL=exactWalletSessionReader.js.map

package/dist/esm/core/signingEngine/uiConfirm/handlers/flows/signing.js

@@ -496,7 +496,7 @@ async function handleIntentDigestSigningFlow(ctx, request, worker, opts) {
 		};
 		const promptDecisionPromise = session.promptUser({
 			securityContext,
-			loading: !!intentPreparation,
+			loading: !!intentPreparation && signingAuthMode !== "warmSession",
 			onMounted: () => {
 				markPromptReady();
 			}

package/dist/esm/react/SeamsWeb/signingSurface/BrowserSigningSurface.js

@@ -71,7 +71,7 @@ import { reconcileTempoNonceLane, reportTempoBroadcastAccepted, reportTempoBroad
 import { UserConfirmationType } from "../../core/signingEngine/stepUpConfirmation/userConfirmationType.js";
 import { exportKeypairWithUI, resolveExactKeyExportLane } from "../../core/signingEngine/flows/recovery/public.js";
 import { activateAuthenticatedWalletState, finalizeWalletEcdsaRegistration, finalizeWalletEd25519SignerRegistration, getAllUsers, getAuthenticationCredentialsSerialized, getLastUser, getUserBySignerSlot, getWalletNearProvisioningState, hasPasskeyCredential, nearAuthenticatorsByAccount, requestRegistrationCredentialConfirmation, rollbackUserRegistration, rollbackWalletEd25519SignerRegistration, setLastUser, setWalletNearProvisioningState, storeAuthenticator, storeUserData, storeWalletEcdsaRecoverySignerRecords, storeWalletEcdsaSignerRecords, storeWalletEd25519RecoveryRegistrationData, storeWalletEd25519RegistrationData, storeWalletEmailOtpEcdsaRegistrationData, storeWalletEmailOtpEcdsaSignerRecords, storeWalletEmailOtpEd25519RegistrationData, storeWalletEmailOtpMixedRegistrationData, storeWalletMixedRegistrationData } from "../../core/signingEngine/flows/registration/public.js";
-import { exactWalletSessionWithOperationCredentialOrThrow, readExactOwnerLaneWalletSession } from "../../core/signingEngine/session/identity/exactWalletSessionReader.js";
+import { exactWalletSessionWithOperationCredentialOrThrow } from "../../core/signingEngine/session/identity/exactWalletSessionReader.js";
 import { enrollEmailOtpInternal, loginWithEmailOtpEcdsaCapabilityInternal, prepareEmailOtpRegistrationEnrollmentMaterialInternal, refreshEmailOtpSigningSession, requestEmailOtpSigningSessionChallenge } from "../../core/signingEngine/flows/signEvmFamily/emailOtpPublic.js";
 import { __isWalletIframeHostMode } from "../../core/browser/walletIframe/host-mode.js";
 import { destroyUnlockedWalletEd25519ExportRootCapabilitiesV1, establishUnlockedWalletEd25519ExportRootCapabilityV1, setUnlockedCustodyEnvelopeUpgradeSinkV1 } from "../../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
@@ -1141,7 +1141,7 @@ var BrowserSigningSurface = class {
 				emailOtpSessions: this.emailOtpSessions,
 				sealedSigningSessionStore: deps.sealedSigningSessionStore
 			}, input),
-			resolveOwnerLaneScope: (walletId) => this.resolveActiveOwnerLaneScope(walletId)
+			resolveOwnerLaneScope: (walletId) => this.resolveSelectedOwnerLaneScope(walletId)
 		});
 		this.enginePorts = createBrowserSigningSurfaceEnginePorts({
 			runtimePorts: this.runtimePorts,
@@ -1167,7 +1167,7 @@ var BrowserSigningSurface = class {
 			workerWarmupPolicy: deps.workerWarmupPolicy,
 			getTheme: () => this.appearance.theme.mode,
 			ensureSealedRefreshStartupParity: () => this.ensureSealedRefreshStartupParity(),
-			resolveOwnerLaneScope: (walletId) => this.resolveActiveOwnerLaneScope(walletId),
+			resolveOwnerLaneScope: (walletId) => this.resolveSelectedOwnerLaneScope(walletId),
 			getEnginePorts: () => this.enginePorts,
 			getRegistrationPublicDeps: () => this.registrationPublicDeps,
 			prepareNearEd25519YaoMaterialBoundary: this.prepareExactNearEd25519YaoMaterialBoundary.bind(this)
@@ -1488,11 +1488,11 @@ var BrowserSigningSurface = class {
 		return await readOwnerScopedSigningLanes(this.sessionPublicDeps, args);
 	}
 	/**
-	* R103C derivation chain for post-login operations: the unique active Wallet
-	* Session authority resolves through the active wallet auth method to one
-	* exact owner scope. Callers never supply credential or slot hints.
+	* Resolves the selected active Wallet Authority and auth method to one exact
+	* owner scope. Session availability is resolved by the lane inventory so an
+	* expired session can enter operation step-up.
 	*/
-	async resolveActiveOwnerLaneScope(walletId) {
+	async resolveSelectedOwnerLaneScope(walletId) {
 		const parsedWalletId = parseWalletId(walletId);
 		if (!parsedWalletId.ok) throw new Error(parsedWalletId.error.message);
 		const stores = {
@@ -1506,13 +1506,6 @@ var BrowserSigningSurface = class {
 			const { selection, authMethod, authority } = selected;
 			if (selection.walletId !== parsedWalletId.value || selection.walletAuthMethodId !== authMethod.walletAuthMethodId || authMethod.walletId !== parsedWalletId.value || authMethod.walletAuthorityId !== authority.authorityId || authority.walletId !== parsedWalletId.value) throw new Error("[SigningEngine] selected Wallet Authority identity mismatch");
 			if (selection.lockState !== "unlocked" || authMethod.status !== "active" || authority.state !== "active") throw new Error("[SigningEngine] selected Wallet Authority is inactive or locked");
-			await readExactOwnerLaneWalletSession({
-				walletId: parsedWalletId.value,
-				authorityId: authority.authorityId,
-				authMethodId: authMethod.walletAuthMethodId,
-				authorityDigestB64u: authority.authorityDigestB64u,
-				authorityRevocationEpoch: authority.revocationEpoch
-			});
 			if (authority.provenance.kind === "device_link" && authMethod.kind === "passkey" && authority.signerActivations.ed25519) return buildExactPasskeyOwnerLaneScope({
 				authMethod,
 				signerSlot: await resolveLinkedPasskeyOwnerSignerSlot({

package/dist/esm/react/core/signingEngine/flows/signEvmFamily/signingFlow.js

@@ -132,6 +132,7 @@ async function signEvmFamilyWithUiConfirm(args) {
 	const thresholdEcdsaStepUp = input.thresholdEcdsaStepUp;
 	const thresholdEcdsaStepUpRuntime = thresholdEcdsaStepUp.kind === "not_required" ? void 0 : thresholdEcdsaStepUp.runtime;
 	const signingAuthPlan = signingAuthPlanFromThresholdEcdsaStepUp(thresholdEcdsaStepUp);
+	const requiresThresholdEcdsaOperationStepUp = input.authorization.kind === "owner" && thresholdEcdsaStepUp.kind === "required" && (thresholdEcdsaStepUp.runtime.reusableAuthorization.kind === "absent" || !isWarmSessionSigningAuthPlan(thresholdEcdsaStepUp.authPlan.signingAuthPlan));
 	if (hasThresholdEcdsaRequest && !signingAuthPlan) switch (input.authorization.kind) {
 		case "owner": throw new Error("[chains] threshold ECDSA transaction signing requires an explicit auth plan");
 		case "active_wallet_authority": break;
@@ -239,7 +240,7 @@ async function signEvmFamilyWithUiConfirm(args) {
 			subtitle: config.body
 		});
 		let challengeB64u = base64UrlEncode(firstDigest);
-		if (firstSignRequest.algorithm === "secp256k1" && thresholdEcdsaStepUpRuntime && activeThresholdEcdsaOperation && input.resolveEcdsaSigningMaterialPlan) {
+		if (requiresThresholdEcdsaOperationStepUp && firstSignRequest.algorithm === "secp256k1" && thresholdEcdsaStepUpRuntime && activeThresholdEcdsaOperation && input.resolveEcdsaSigningMaterialPlan) {
 			const operationDigests = await buildEvmFamilyOperationDigests({
 				operationFingerprint: input.signingOperation?.operationFingerprint,
 				signingDigest32: inferDigest32FromSignRequest(firstSignRequest),

package/dist/esm/react/core/signingEngine/flows/signNear/signNear.js

@@ -276,19 +276,16 @@ function buildNearPasskeyEd25519OperationStepUp(args) {
 	if (args.auth.kind !== "passkey") return void 0;
 	const auth = args.auth;
 	return { prepare: async () => {
-		const materialFacts = await resolveNearPasskeyStepUpMaterialFacts({
-			preparation: args.preparation,
-			executor: args.materialExecutor
-		});
 		const signer = args.signer;
+		const authority = await exactPasskeyStepUpAuthority({
+			authorityRef: nearPasskeyPreparationAuthority(args.preparation),
+			walletId: signer.account.wallet.walletId,
+			rpId: auth.rpId,
+			credentialIdB64u: auth.credentialIdB64u
+		});
 		return {
-			thresholdSessionId: materialFacts.thresholdSessionId,
-			authority: await exactPasskeyStepUpAuthority({
-				authorityRef: nearPasskeyPreparationAuthority(args.preparation),
-				walletId: signer.account.wallet.walletId,
-				rpId: auth.rpId,
-				credentialIdB64u: auth.credentialIdB64u
-			})
+			thresholdSessionId: args.thresholdSessionId,
+			authority
 		};
 	} };
 }
@@ -321,17 +318,6 @@ async function exactPasskeyStepUpAuthority(args) {
 	if (resolvedRef.walletId !== args.authorityRef.walletId || resolvedRef.walletAuthMethodId !== args.authorityRef.walletAuthMethodId || resolvedRef.authorityDigest !== args.authorityRef.authorityDigest) throw new Error("[SigningEngine][near] exact Passkey step-up authority changed");
 	return authority;
 }
-async function resolveNearPasskeyStepUpMaterialFacts(args) {
-	switch (args.preparation.hydration.kind) {
-		case "use_live_runtime": return (await args.executor.resolve(args.preparation)).facts;
-		case "rehydrate_material_activation": return (await args.executor.preparePasskeyOperationStepUp(args.preparation)).facts;
-		case "reauthorize_public_anchor": throw new Error("[SigningEngine][near] retired material cannot prepare Passkey step-up");
-		case "blocked": throw new Error(`[SigningEngine][near] Passkey step-up material is blocked: ${args.preparation.hydration.reason}`);
-		default:
-			args.preparation.hydration;
-			throw new Error("[SigningEngine][near] unsupported Passkey step-up material source");
-	}
-}
 function buildNearEmailOtpEd25519StepUp(args) {
 	if (args.auth.kind !== SIGNER_AUTH_METHODS.emailOtp || typeof args.deps.requestEmailOtpEd25519SigningChallenge !== "function") return;
 	if (!args.preparation.hydration.materialActivation) return;
@@ -402,8 +388,8 @@ async function prepareNearAdHocSigningSession(args) {
 			passkeyEd25519OperationStepUp: buildNearPasskeyEd25519OperationStepUp({
 				auth: candidate.auth,
 				signer,
-				preparation: materialBoundary.preparation,
-				materialExecutor: materialBoundary.executor
+				thresholdSessionId: materialIdentity.thresholdSessionId,
+				preparation: materialBoundary.preparation
 			}) || null,
 			emailOtpEd25519StepUp: buildNearEmailOtpEd25519StepUp({
 				deps: args.deps,
@@ -430,8 +416,8 @@ async function prepareNearAdHocSigningSession(args) {
 		passkeyEd25519OperationStepUp: buildNearPasskeyEd25519OperationStepUp({
 			auth: selectedLane.auth,
 			signer: selectedLane.identity.signer,
-			preparation: materialBoundary.preparation,
-			materialExecutor: materialBoundary.executor
+			thresholdSessionId: selectedLane.identity.thresholdSessionId,
+			preparation: materialBoundary.preparation
 		}) || null,
 		emailOtpEd25519StepUp: buildNearEmailOtpEd25519StepUp({
 			deps: args.deps,
@@ -494,8 +480,8 @@ async function prepareNearAuthorizationRequiredTransaction(args) {
 		passkeyEd25519OperationStepUp: buildNearPasskeyEd25519OperationStepUp({
 			auth: candidate.auth,
 			signer,
-			preparation: materialBoundary.preparation,
-			materialExecutor: materialBoundary.executor
+			thresholdSessionId: materialIdentity.thresholdSessionId,
+			preparation: materialBoundary.preparation
 		}) || null,
 		emailOtpEd25519StepUp: buildNearEmailOtpEd25519StepUp({
 			deps: args.deps,
@@ -849,8 +835,8 @@ async function signTransactionWithActions(deps, args, attempt = {}) {
 				const passkeyEd25519OperationStepUp = buildNearPasskeyEd25519OperationStepUp({
 					auth: transactionLane.auth,
 					signer: transactionLane.identity.signer,
-					preparation: materialBoundary.preparation,
-					materialExecutor: materialBoundary.executor
+					thresholdSessionId,
+					preparation: materialBoundary.preparation
 				});
 				const emailOtpEd25519StepUp = buildNearEmailOtpEd25519StepUp({
 					deps,