@seams/wallet 0.6.1 → 0.7.1

package/dist/esm/core/signingEngine/flows/registration/services/passkeyEd25519YaoAddSigner.js

@@ -1,13 +1,10 @@
-import { computeAddSignerNearEd25519SigningKeyId, registrationNearEd25519BranchKey } from "../../../../../shared-ts/src/utils/registrationIntent.js";
-import { ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { coerceNonNullishString } from "../../../../../shared-ts/src/utils/validation.js";
+import { computeAddSignerNearEd25519SigningKeyId } from "../../../../../shared-ts/src/utils/registrationIds.js";
 import { deriveSigningRootId, normalizeRuntimePolicyScope } from "../../../../../shared-ts/src/threshold/signingRootScope.js";
+import { ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { RouterAbEd25519YaoHttpActivationTransportV1 } from "../../../threshold/ed25519/yaoClient.js";
+import { registrationNearEd25519BranchKey } from "../../../../../shared-ts/src/utils/registrationSignerPlan.js";
 //#region src/core/signingEngine/flows/registration/services/passkeyEd25519YaoAddSigner.ts
-function requireNonEmptyString(value, label) {
-	const normalized = String(value ?? "").trim();
-	if (!normalized) throw new Error(`${label} is required`);
-	return normalized;
-}
 function requireMatchingString(left, right, label) {
 	if (left !== right) throw new Error(`${label} does not match the verified add-signer intent`);
 }
@@ -15,9 +12,9 @@ function requireMatchingParticipantIds(intended, admitted) {
 	if (intended.length !== 2 || intended[0] !== admitted[0] || intended[1] !== admitted[1]) throw new Error("Yao participant IDs do not match the verified add-signer intent");
 }
 function transportConfig(input) {
-	const bearerToken = requireNonEmptyString(input.verifiedIntent.addSignerIntentGrant, "add-signer intent grant");
+	const bearerToken = coerceNonNullishString(input.verifiedIntent.addSignerIntentGrant, "add-signer intent grant");
 	return {
-		routerOrigin: requireNonEmptyString(input.httpTransport.routerOrigin, "Yao Router origin"),
+		routerOrigin: coerceNonNullishString(input.httpTransport.routerOrigin, "Yao Router origin"),
 		authorization: {
 			kind: "bearer",
 			value: `Bearer ${bearerToken}`
@@ -30,13 +27,13 @@ async function prepareVerifiedPasskeyEd25519YaoAddSignerV1(input) {
 	const selection = intent.signerSelection.ed25519;
 	requireMatchingString(String(intent.walletId), String(input.verifiedAuthority.walletId), "Passkey authority wallet ID");
 	requireMatchingString(input.verifiedIntent.addSignerIntentDigestB64u, input.verifiedAuthority.addSignerIntentDigestB64u, "Passkey authority intent digest");
-	requireNonEmptyString(input.verifiedAuthority.credentialIdB64u, "passkey credential ID");
+	coerceNonNullishString(input.verifiedAuthority.credentialIdB64u, "passkey credential ID");
 	const runtimePolicyScope = normalizeRuntimePolicyScope(intent.runtimePolicyScope);
 	const signingRootId = deriveSigningRootId(runtimePolicyScope);
 	const parsedAdmission = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(input.admissionRequest);
 	if (!parsedAdmission.ok) throw new Error(parsedAdmission.message);
 	const admission = parsedAdmission.value;
-	const ceremonyId = requireNonEmptyString(input.verifiedIntent.addSignerCeremonyId, "add-signer ceremony ID");
+	const ceremonyId = coerceNonNullishString(input.verifiedIntent.addSignerCeremonyId, "add-signer ceremony ID");
 	requireMatchingString(admission.scope.lifecycle_id, ceremonyId, "Yao lifecycle ID");
 	requireMatchingString(admission.scope.threshold_session_id, ceremonyId, "Yao Threshold Session ID");
 	requireMatchingString(admission.scope.account_id, String(intent.walletId), "Yao account ID");

package/dist/esm/core/signingEngine/flows/signEvmFamily/authPlanning.js

@@ -1,8 +1,8 @@
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { signingLaneAuthMethod } from "../../session/identity/signingLaneAuthBinding.js";
 import { SigningOperationIntent, SigningSessionPlanKind } from "../../session/operationState/types.js";
+import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { SigningAuthPlanKind } from "../../stepUpConfirmation/types.js";
 import { signingAuthPlanFromSigningSessionPlan } from "../shared/signingConfirmation.js";
 import { createEmailOtpEcdsaTransactionSigningBridge, emailOtpEcdsaCapabilityStepUpAuthority } from "./emailOtpSigningSession.js";

package/dist/esm/core/signingEngine/flows/signEvmFamily/ecdsaSelection.js

@@ -1,7 +1,7 @@
-import { isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
 import { exactEcdsaSigningLaneIdentityFromSelectedLane } from "../../session/identity/exactSigningLaneIdentity.js";
+import { isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { laneCandidateAuthMethod } from "../../session/identity/laneIdentity.js";
 import { buildEvmTransactionSigningLane, buildTempoTransactionSigningLane } from "../../session/operationState/lanes.js";
 import { logEvmFamilyEcdsaLaneDiagnostic, requireResolvedEvmFamilyEcdsaSigningLane, summarizeEvmFamilyEcdsaLane } from "./ecdsaLanes.js";

package/dist/esm/core/signingEngine/flows/signEvmFamily/emailOtpSigningSession.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { isEmailOtpWalletAuthAuthority, walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { SigningEventPhase } from "../../../types/sdkSentEvents.js";
 import { buildVerifiedEcdsaPublicFacts, toEvmFamilyEcdsaKeyHandle } from "../../session/identity/evmFamilyEcdsaIdentity.js";
+import { isEmailOtpWalletAuthAuthority, walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { createSigningBoundaryTraceEvent, emitSigningBoundaryTrace } from "../../session/operationState/trace.js";
 import { demoEmailOtpCodeFromDelivery } from "../../session/emailOtp/challengeDelivery.js";
 import { buildEmailOtpRoutePlan } from "../../stepUpConfirmation/otpPrompt/authLane.js";

package/dist/esm/core/signingEngine/flows/signEvmFamily/readySecp256k1Material.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { routerAbEcdsaDerivationActiveStateId } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { buildHydratedEcdsaSignerMaterial } from "../../session/identity/evmFamilyEcdsaIdentity.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { routerAbEcdsaDerivationActiveStateId } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { projectEcdsaRoleLocalPublicFactsToChainTarget } from "../../session/persistence/ecdsaRoleLocalRecords.js";
 import { authorizeEvmFamilyEcdsaSigningCapability } from "../../session/material/ecdsaSigningCapability.js";
 import { ecdsaRoleLocalPersistedMaterialSource, resolveEcdsaRoleLocalMaterial } from "../../session/material/ecdsaRoleLocalMaterialResolver.js";

package/dist/esm/core/signingEngine/flows/signEvmFamily/signEvmFamily.js

@@ -26,7 +26,6 @@ import { executeEvmFamilyTransactionSigning } from "./transactionExecutor.js";
 import { buildActiveWalletAuthorityConfirmationAuthPlan, createEvmFamilySigningFlowRuntime } from "./signingFlowRuntime.js";
 import { classifyEvmFamilyFreshAuthRetry, nextEvmFamilyFreshAuthRetrySideEffectState, runEvmFamilyFreshAuthRetry } from "./freshAuthRetryPolicy.js";
 import { resolveEvmFamilyWalletSessionExpiryContext, retryEvmFamilyWithFreshWalletSessionAuthWhenRequired } from "./freshWalletSessionRetry.js";
-import { requiredEvmFamilyRequestSignatureUses } from "./signatureUses.js";
 import { bindEvmFamilyCallerProvidedOperationIdToFingerprint, createEvmFamilySigningOperationIds, ensureEvmFamilyConfirmationOperationId } from "./operationIds.js";
 import { buildPreparedEvmFamilyExecutorThresholdEcdsaState } from "./executorThresholdState.js";
 //#region src/core/signingEngine/flows/signEvmFamily/signEvmFamily.ts
@@ -147,7 +146,6 @@ async function signEvmFamilyAttempt(deps, args, attempt) {
 		request: args.request,
 		chainTarget: args.chainTarget
 	});
-	requiredEvmFamilyRequestSignatureUses(args.request);
 	await ensureSealedRefreshStartupParityForTransactionSigning(deps.ensureSealedRefreshStartupParity, {
 		walletId,
 		chainTarget: signingTarget
@@ -353,7 +351,7 @@ async function signEvmFamilyAttempt(deps, args, attempt) {
 		if (reResolved) return reResolved;
 		throw error;
 	}
-	const { signingAuthPlan, signingSessionPlan, emailOtpSigning, flowArgs } = preparedFlow;
+	const { signingAuthPlan, emailOtpSigning, flowArgs } = preparedFlow;
 	let freshAuthRetryHandledFinalization = false;
 	const retryWithFreshWalletSessionAuth = async (error) => {
 		return await retryEvmFamilyWithFreshWalletSessionAuthWhenRequired({

package/dist/esm/core/signingEngine/flows/signEvmFamily/signEvmFamilyWithUiConfirmForTempo.js

@@ -1,9 +1,9 @@
 import { buildEvmDisplayModel } from "../../chains/evm/display/evmTx.js";
 import { buildTempoDisplayModel } from "../../chains/tempo/display.js";
 import { signEvmFamilyWithUiConfirm } from "./signingFlow.js";
-import { requiredEvmFamilyRequestSignatureUses } from "./signatureUses.js";
 import { TempoAdapter } from "../../chains/tempo/tempoAdapter.js";
 import { EvmAdapter } from "../../chains/evm/evmAdapter.js";
+import { requiredEvmFamilyRequestSignatureUses } from "./signatureUses.js";
 import { resolveWebAuthnP256KeyRefForWallet } from "./webauthnP256KeyRef.js";
 //#region src/core/signingEngine/flows/signEvmFamily/signEvmFamilyWithUiConfirmForTempo.ts
 async function signEvmFamilyWithUiConfirmForTempo(args) {

package/dist/esm/core/signingEngine/flows/signEvmFamily/signEvmWithUiConfirm.js

@@ -1,7 +1,7 @@
 import { buildEvmDisplayModel } from "../../chains/evm/display/evmTx.js";
 import { signEvmFamilyWithUiConfirm } from "./signingFlow.js";
-import { requiredEvmFamilyRequestSignatureUses } from "./signatureUses.js";
 import { EvmAdapter } from "../../chains/evm/evmAdapter.js";
+import { requiredEvmFamilyRequestSignatureUses } from "./signatureUses.js";
 //#region src/core/signingEngine/flows/signEvmFamily/signEvmWithUiConfirm.ts
 async function signEvmWithUiConfirm(args) {
 	return await signEvmFamilyWithUiConfirm({

package/dist/esm/core/signingEngine/flows/signEvmFamily/signers/secp256k1.js

@@ -1,5 +1,5 @@
 import { routerAbMpcMaterialActivationRefToWire } from "../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseEcdsaKeyHandle } from "../../../session/keyMaterialBrands.js";
+import { parseEcdsaKeyHandle } from "../../../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS } from "../../../workerManager/ecdsaPresignLifecycle.js";
 import { emitEcdsaSigningTiming, emitSigningSessionFlowTrace } from "../../../session/operationState/trace.js";
 import { scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill, signRouterAbEcdsaDerivationDigestWithPool } from "../../../routerAb/ecdsaDerivation/presignaturePool.js";
@@ -94,7 +94,6 @@ var Secp256k1Engine = class {
 	constructor(opts) {
 		this.algorithm = "secp256k1";
 		this.beforeSigning = opts.beforeSigning;
-		this.getRpId = opts.getRpId;
 		this.shouldAbort = opts.shouldAbort;
 		this.workerCtx = opts.workerCtx;
 	}

package/dist/esm/core/signingEngine/flows/signEvmFamily/signingFlow.js

@@ -1,6 +1,6 @@
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u, sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { SigningEventPhase, createSigningFlowEvent } from "../../../types/sdkSentEvents.js";
 import { SigningSessionIds } from "../../session/operationState/types.js";
 import { normalizeAuthenticationCredential } from "../../webauthnAuth/credentials/helpers.js";
@@ -58,7 +58,7 @@ async function buildEvmFamilyOperationDigests(input) {
 	return {
 		laneDigest: parseSigningOperationFingerprintDigest(SigningSessionIds.signingOperationFingerprint(operationFingerprint)),
 		intentDigest: parseDigestB64u(base64UrlEncode(input.signingDigest32)),
-		displayDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(input.displayModel))))
+		displayDigest: await sha256Utf8DigestB64u(alphabetizeStringify(input.displayModel))
 	};
 }
 function intentDigestPreparationFromEvmIntent(args) {
@@ -299,7 +299,7 @@ async function signEvmFamilyWithUiConfirm(args) {
 	let signedResult = null;
 	let ecdsaSigningMaterialSource = null;
 	let preparedEcdsaOperationStepUp = null;
-	const ensureReadySecp256k1SigningMaterial = async (signReq, operation, operationDigests) => {
+	const ensureReadySecp256k1SigningMaterial = async (_signReq, operation, operationDigests) => {
 		if (input.resolveEcdsaSigningMaterialPlan) {
 			const plan = await input.resolveEcdsaSigningMaterialPlan();
 			switch (plan.kind) {

package/dist/esm/core/signingEngine/flows/signEvmFamily/signingFlowRuntime.js

@@ -1,9 +1,9 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { isEd25519ExtensionOfEcdsaWalletAuthority } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { walletSessionPreservesCapabilities } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { requireEvmFamilyEcdsaSigner } from "../../session/identity/exactSigningLaneIdentity.js";
-import { walletSessionPreservesCapabilities } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { isEd25519ExtensionOfEcdsaWalletAuthority } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { exactEcdsaWalletSessionRuntimesMatch } from "../../session/material/ecdsaSigningCapability.js";
 import { emitEvmFamilySigningOperationTrace } from "./events.js";
 import { resolveThresholdEcdsaSigningQueueKey } from "../../threshold/ecdsa/signingQueue.js";
@@ -47,7 +47,8 @@ async function resolveExactEcdsaOperationStepUpSession(args) {
 	if (!capabilityMatchesOperationScope(args)) throw new Error("[SigningEngine] exact ECDSA Wallet Session material changed");
 	const ports = args.ports;
 	const selected = await ports.resolveSelectedWalletAuthority(String(args.scope.walletId));
-	if (selected.kind !== "resolved" || selected.selection.lockState !== "unlocked" || selected.selection.walletId !== args.scope.walletId || selected.authMethod.status !== "active" || selected.authMethod.walletId !== args.scope.walletId || selected.selection.walletAuthMethodId !== selected.authMethod.walletAuthMethodId || selected.authority.state !== "active" || selected.authority.walletId !== args.scope.walletId || selected.authMethod.walletAuthorityId !== selected.authority.authorityId) throw new Error("[SigningEngine] exact ECDSA Wallet Session is unavailable");
+	const selectedReason = selectedStepUpAuthorityUnavailableReason(selected, args.scope.walletId);
+	if (selectedReason || selected.kind !== "resolved") throw exactEcdsaWalletSessionUnavailable(selectedReason ?? "selected_authority_invalid");
 	const capabilityAuthority = await walletAuthAuthorityRef({ authority: args.capability.authority });
 	const manifestAuthority = args.capability.manifest.signer.authority;
 	const selectedActivation = selected.authority.signerActivations.ecdsa;
@@ -57,17 +58,46 @@ async function resolveExactEcdsaOperationStepUpSession(args) {
 		authorityId: selected.authority.authorityId,
 		authMethodId: selected.authMethod.walletAuthMethodId
 	});
-	if (read.kind !== "found") throw new Error("[SigningEngine] exact ECDSA Wallet Session is unavailable");
+	if (read.kind !== "found") throw exactEcdsaWalletSessionUnavailable(read.kind === "missing" ? "wallet_session_missing" : "wallet_session_upgrade_required");
 	const session = read.record;
-	if (session.walletId !== args.scope.walletId || session.authorityId !== selected.authority.authorityId || session.authMethodId !== selected.authMethod.walletAuthMethodId || session.authorityDigestB64u !== selected.authority.authorityDigestB64u || session.authorityRevocationEpoch !== selected.authority.revocationEpoch || session.expiresAtMs <= Date.now() || !read.operationCredential.token.trim() || !sessionAuthorizesCanonicalEcdsaCapability({
+	const sessionReason = stepUpSessionRecordUnavailableReason({
 		session,
+		operationCredential: read.operationCredential,
+		walletId: args.scope.walletId,
+		authority: selected.authority,
+		authMethod: selected.authMethod,
 		capability: args.capability
-	})) throw new Error("[SigningEngine] exact ECDSA Wallet Session is unavailable");
+	});
+	if (sessionReason) throw exactEcdsaWalletSessionUnavailable(sessionReason);
 	return {
 		credential: read.operationCredential,
 		expiresAtMs: session.expiresAtMs
 	};
 }
+function exactEcdsaWalletSessionUnavailable(reason) {
+	return /* @__PURE__ */ new Error(`[SigningEngine] exact ECDSA Wallet Session is unavailable: ${reason}`);
+}
+function selectedStepUpAuthorityUnavailableReason(selected, walletId) {
+	if (selected.kind !== "resolved") return selected.kind === "missing_selection" ? "selected_authority_missing" : "selected_authority_invalid";
+	if (selected.selection.walletId !== walletId || selected.authMethod.walletId !== walletId || selected.authority.walletId !== walletId || selected.selection.walletAuthMethodId !== selected.authMethod.walletAuthMethodId || selected.authMethod.walletAuthorityId !== selected.authority.authorityId) return "authority_identity_mismatch";
+	if (selected.selection.lockState !== "unlocked") return "wallet_locked";
+	if (selected.authMethod.status !== "active") return "auth_method_inactive";
+	if (selected.authority.state !== "active") return "authority_inactive";
+	return null;
+}
+function stepUpSessionRecordUnavailableReason(args) {
+	const { session } = args;
+	if (session.walletId !== args.walletId || session.authorityId !== args.authority.authorityId || session.authMethodId !== args.authMethod.walletAuthMethodId) return "wallet_session_identity_mismatch (authority or method)";
+	if (session.authorityDigestB64u !== args.authority.authorityDigestB64u) return "wallet_session_identity_mismatch (authority digest)";
+	if (session.authorityRevocationEpoch !== args.authority.revocationEpoch) return "wallet_session_identity_mismatch (authority revocation epoch)";
+	if (!args.operationCredential.token.trim()) return "wallet_session_identity_mismatch (operation credential)";
+	if (session.expiresAtMs <= Date.now()) return "wallet_session_expired";
+	if (!sessionAuthorizesCanonicalEcdsaCapability({
+		session,
+		capability: args.capability
+	})) return "wallet_session_capability_mismatch";
+	return null;
+}
 async function prepareSessionBoundEcdsaOperationStepUp(sessionScope, input) {
 	const session = await resolveExactEcdsaOperationStepUpSession(sessionScope);
 	return await prepareEvmFamilyEcdsaOperationStepUp({
@@ -107,11 +137,11 @@ async function resolveCurrentActiveWalletAuthorityRuntime(args) {
 	if (runtime.authorityId !== args.prepared.authorityId || runtime.walletAuthMethodId !== args.prepared.walletAuthMethodId || runtime.authorityDigestB64u !== args.prepared.authorityDigestB64u || runtime.authorityRevocationEpoch !== args.prepared.authorityRevocationEpoch || runtime.walletSessionId !== args.prepared.walletSessionId || runtime.publicFacts.keyHandle !== args.signer.keyHandle) throw new Error("[SigningEngine] active Wallet Authority ECDSA runtime was replaced");
 	return runtime;
 }
-/** R90-INV-010. The wallet's active manifest names the material that may be
-* used right now. When it has moved on from the one this operation was prepared
-* against, the preparation is superseded -- material activation is advance-only,
-* so the prepared side is always the stale one. That is a re-resolution, not a
-* failure and not a request for the wrong material. */
+/** The wallet's active manifest names the material that may be used right now.
+* When it has moved on from the one this operation was prepared against, the
+* preparation is superseded -- material activation is advance-only, so the
+* prepared side is always the stale one. That is a re-resolution, not a failure
+* and not a request for the wrong material. */
 function ecdsaSigningMaterialSupersession(args) {
 	if (mpcMaterialActivationRefsEqual(args.currentMaterialActivation, args.preparedMaterialActivation)) return null;
 	return {

package/dist/esm/core/signingEngine/flows/signNear/shared/ed25519YaoNormalSigning.js

@@ -1,13 +1,14 @@
 import { parseCapabilityId, parseCapabilityOperationId, parsePrincipalId, parseTenantId } from "../../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { base64UrlDecode, base64UrlEncode } from "../../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Decode } from "../../../../../shared-ts/src/utils/base58.js";
 import { ensureEd25519Prefix } from "../../../../../shared-ts/src/utils/near.js";
 import "../../../../../shared-ts/src/utils/validation.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { resolveNearNetwork } from "../../../../config/chains.js";
 import { SigningSessionIds } from "../../../session/operationState/types.js";
 import { ActionType, fromActionArgsWasm } from "../../../../../shared-ts/src/near/actions.js";
 import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from "../../../../config/defaultConfigs.js";
+import { emitEd25519SigningTiming } from "../../../session/operationState/trace.js";
 import { parseThresholdEd25519NearTransaction, thresholdEd25519NearTransactionOperationFingerprint } from "../../../../../shared-ts/src/threshold/ed25519OperationFingerprint.js";
 import { WorkerResponseType } from "../../../../types/signer-worker.js";
 import { buildThresholdEd25519DelegateSigningPayloadWasm, buildThresholdEd25519NearTxUnsignedBorshWasm, decodeThresholdEd25519SignedNearTxBorshWasm, finalizeThresholdEd25519DelegateFromSignatureWasm, finalizeThresholdEd25519NearTxFromSignatureWasm } from "../../../chains/near/nearSignerWasm.js";
@@ -260,6 +261,18 @@ function requireActiveClientMatchesNormalSigningOperation(args) {
 	if (!sameBytes(metadata.signingWorkerVerifyingShare, args.signingWorkerVerifyingShare)) throw new Error("Router A/B Ed25519 active Client SigningWorker verifying share mismatch");
 }
 async function tryFinalizeRouterAbEd25519NormalSigningSignature(args) {
+	const operationId = args.prepare.request.intent.operation_id;
+	const signatureStartedAt = performance.now();
+	let outcome = "failed";
+	try {
+		const finalized = await finalizeRouterAbEd25519NormalSigningSignature(args, operationId);
+		outcome = "succeeded";
+		return finalized;
+	} finally {
+		emitEd25519SigningTiming(operationId, "signature_total", signatureStartedAt, outcome);
+	}
+}
+async function finalizeRouterAbEd25519NormalSigningSignature(args, operationId) {
 	const signingPayload = base64UrlDecode(args.signingDigestB64u);
 	if (signingPayload.length !== 32) throw new Error(`Router A/B normal-signing ${args.signingPayloadLabel} must be 32 bytes`);
 	const admittedDigest = requireWireBytes32(args.prepare.admissionMaterial.admittedSigningDigest.bytes, "admitted digest");
@@ -279,11 +292,13 @@ async function tryFinalizeRouterAbEd25519NormalSigningSignature(args) {
 		runtimePolicyScope: args.walletSessionState.runtimePolicyScope,
 		relayerUrl: args.walletSessionState.relayerUrl
 	} : args.materialFacts;
+	const prepareStartedAt = performance.now();
 	const prepareResponse = await prepareRouterAbNormalSigningV2({
 		relayServerUrl: materialFacts.relayerUrl,
 		credential: args.credential,
 		request: args.prepare.request
 	});
+	emitEd25519SigningTiming(operationId, "prepare", prepareStartedAt);
 	requireRouterAbNormalSigningPrepareMatchesRequest({
 		request: args.prepare.request,
 		signingPayloadDigest: args.prepare.admissionMaterial.signingPayloadDigest,
@@ -304,12 +319,15 @@ async function tryFinalizeRouterAbEd25519NormalSigningSignature(args) {
 		signingWorkerId: prepareResponse.signing_worker.server_id,
 		signingWorkerVerifyingShare
 	});
+	const clientShareStartedAt = performance.now();
 	const clientShare = await args.activeClient.createSigningShare({
 		admittedDigest,
 		signingWorkerCommitments: prepareResponse.server_commitments,
 		signingWorkerVerifyingShare
 	});
+	emitEd25519SigningTiming(operationId, "client_share", clientShareStartedAt);
 	if (clientShare.clientVerifyingShare.length !== 32) throw new Error("Router A/B normal-signing Client verifying share must be 32 bytes");
+	const finalizeStartedAt = performance.now();
 	const signingResponse = await finalizeRouterAbNormalSigningV2({
 		relayServerUrl: materialFacts.relayerUrl,
 		credential: args.credential,
@@ -323,6 +341,7 @@ async function tryFinalizeRouterAbEd25519NormalSigningSignature(args) {
 			clientSignatureShareB64u: clientShare.clientSignatureShareB64u
 		})
 	});
+	emitEd25519SigningTiming(operationId, "finalize", finalizeStartedAt);
 	requireRouterAbNormalSigningResponseMatchesRequest({
 		request: args.prepare.request,
 		signingPayloadDigest: args.prepare.admissionMaterial.signingPayloadDigest,