@seams/wallet 0.6.2 → 0.7.1

package/dist/esm/core/signingEngine/flows/registration/services/passkeyEd25519YaoAddSigner.js

@@ -1,13 +1,10 @@
-import { computeAddSignerNearEd25519SigningKeyId, registrationNearEd25519BranchKey } from "../../../../../shared-ts/src/utils/registrationIntent.js";
-import { ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { coerceNonNullishString } from "../../../../../shared-ts/src/utils/validation.js";
+import { computeAddSignerNearEd25519SigningKeyId } from "../../../../../shared-ts/src/utils/registrationIds.js";
 import { deriveSigningRootId, normalizeRuntimePolicyScope } from "../../../../../shared-ts/src/threshold/signingRootScope.js";
+import { ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { RouterAbEd25519YaoHttpActivationTransportV1 } from "../../../threshold/ed25519/yaoClient.js";
+import { registrationNearEd25519BranchKey } from "../../../../../shared-ts/src/utils/registrationSignerPlan.js";
 //#region src/core/signingEngine/flows/registration/services/passkeyEd25519YaoAddSigner.ts
-function requireNonEmptyString(value, label) {
-	const normalized = String(value ?? "").trim();
-	if (!normalized) throw new Error(`${label} is required`);
-	return normalized;
-}
 function requireMatchingString(left, right, label) {
 	if (left !== right) throw new Error(`${label} does not match the verified add-signer intent`);
 }
@@ -15,9 +12,9 @@ function requireMatchingParticipantIds(intended, admitted) {
 	if (intended.length !== 2 || intended[0] !== admitted[0] || intended[1] !== admitted[1]) throw new Error("Yao participant IDs do not match the verified add-signer intent");
 }
 function transportConfig(input) {
-	const bearerToken = requireNonEmptyString(input.verifiedIntent.addSignerIntentGrant, "add-signer intent grant");
+	const bearerToken = coerceNonNullishString(input.verifiedIntent.addSignerIntentGrant, "add-signer intent grant");
 	return {
-		routerOrigin: requireNonEmptyString(input.httpTransport.routerOrigin, "Yao Router origin"),
+		routerOrigin: coerceNonNullishString(input.httpTransport.routerOrigin, "Yao Router origin"),
 		authorization: {
 			kind: "bearer",
 			value: `Bearer ${bearerToken}`
@@ -30,13 +27,13 @@ async function prepareVerifiedPasskeyEd25519YaoAddSignerV1(input) {
 	const selection = intent.signerSelection.ed25519;
 	requireMatchingString(String(intent.walletId), String(input.verifiedAuthority.walletId), "Passkey authority wallet ID");
 	requireMatchingString(input.verifiedIntent.addSignerIntentDigestB64u, input.verifiedAuthority.addSignerIntentDigestB64u, "Passkey authority intent digest");
-	requireNonEmptyString(input.verifiedAuthority.credentialIdB64u, "passkey credential ID");
+	coerceNonNullishString(input.verifiedAuthority.credentialIdB64u, "passkey credential ID");
 	const runtimePolicyScope = normalizeRuntimePolicyScope(intent.runtimePolicyScope);
 	const signingRootId = deriveSigningRootId(runtimePolicyScope);
 	const parsedAdmission = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(input.admissionRequest);
 	if (!parsedAdmission.ok) throw new Error(parsedAdmission.message);
 	const admission = parsedAdmission.value;
-	const ceremonyId = requireNonEmptyString(input.verifiedIntent.addSignerCeremonyId, "add-signer ceremony ID");
+	const ceremonyId = coerceNonNullishString(input.verifiedIntent.addSignerCeremonyId, "add-signer ceremony ID");
 	requireMatchingString(admission.scope.lifecycle_id, ceremonyId, "Yao lifecycle ID");
 	requireMatchingString(admission.scope.threshold_session_id, ceremonyId, "Yao Threshold Session ID");
 	requireMatchingString(admission.scope.account_id, String(intent.walletId), "Yao account ID");

package/dist/esm/core/signingEngine/flows/signEvmFamily/authPlanning.js

@@ -1,8 +1,8 @@
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { signingLaneAuthMethod } from "../../session/identity/signingLaneAuthBinding.js";
 import { SigningOperationIntent, SigningSessionPlanKind } from "../../session/operationState/types.js";
+import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { SigningAuthPlanKind } from "../../stepUpConfirmation/types.js";
 import { signingAuthPlanFromSigningSessionPlan } from "../shared/signingConfirmation.js";
 import { createEmailOtpEcdsaTransactionSigningBridge, emailOtpEcdsaCapabilityStepUpAuthority } from "./emailOtpSigningSession.js";

package/dist/esm/core/signingEngine/flows/signEvmFamily/ecdsaSelection.js

@@ -1,7 +1,7 @@
-import { isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
 import { exactEcdsaSigningLaneIdentityFromSelectedLane } from "../../session/identity/exactSigningLaneIdentity.js";
+import { isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { laneCandidateAuthMethod } from "../../session/identity/laneIdentity.js";
 import { buildEvmTransactionSigningLane, buildTempoTransactionSigningLane } from "../../session/operationState/lanes.js";
 import { logEvmFamilyEcdsaLaneDiagnostic, requireResolvedEvmFamilyEcdsaSigningLane, summarizeEvmFamilyEcdsaLane } from "./ecdsaLanes.js";

package/dist/esm/core/signingEngine/flows/signEvmFamily/emailOtpSigningSession.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { isEmailOtpWalletAuthAuthority, walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { SigningEventPhase } from "../../../types/sdkSentEvents.js";
 import { buildVerifiedEcdsaPublicFacts, toEvmFamilyEcdsaKeyHandle } from "../../session/identity/evmFamilyEcdsaIdentity.js";
+import { isEmailOtpWalletAuthAuthority, walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { createSigningBoundaryTraceEvent, emitSigningBoundaryTrace } from "../../session/operationState/trace.js";
 import { demoEmailOtpCodeFromDelivery } from "../../session/emailOtp/challengeDelivery.js";
 import { buildEmailOtpRoutePlan } from "../../stepUpConfirmation/otpPrompt/authLane.js";

package/dist/esm/core/signingEngine/flows/signEvmFamily/readySecp256k1Material.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { routerAbEcdsaDerivationActiveStateId } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { buildHydratedEcdsaSignerMaterial } from "../../session/identity/evmFamilyEcdsaIdentity.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { routerAbEcdsaDerivationActiveStateId } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { projectEcdsaRoleLocalPublicFactsToChainTarget } from "../../session/persistence/ecdsaRoleLocalRecords.js";
 import { authorizeEvmFamilyEcdsaSigningCapability } from "../../session/material/ecdsaSigningCapability.js";
 import { ecdsaRoleLocalPersistedMaterialSource, resolveEcdsaRoleLocalMaterial } from "../../session/material/ecdsaRoleLocalMaterialResolver.js";

package/dist/esm/core/signingEngine/flows/signEvmFamily/signEvmFamily.js

@@ -26,7 +26,6 @@ import { executeEvmFamilyTransactionSigning } from "./transactionExecutor.js";
 import { buildActiveWalletAuthorityConfirmationAuthPlan, createEvmFamilySigningFlowRuntime } from "./signingFlowRuntime.js";
 import { classifyEvmFamilyFreshAuthRetry, nextEvmFamilyFreshAuthRetrySideEffectState, runEvmFamilyFreshAuthRetry } from "./freshAuthRetryPolicy.js";
 import { resolveEvmFamilyWalletSessionExpiryContext, retryEvmFamilyWithFreshWalletSessionAuthWhenRequired } from "./freshWalletSessionRetry.js";
-import { requiredEvmFamilyRequestSignatureUses } from "./signatureUses.js";
 import { bindEvmFamilyCallerProvidedOperationIdToFingerprint, createEvmFamilySigningOperationIds, ensureEvmFamilyConfirmationOperationId } from "./operationIds.js";
 import { buildPreparedEvmFamilyExecutorThresholdEcdsaState } from "./executorThresholdState.js";
 //#region src/core/signingEngine/flows/signEvmFamily/signEvmFamily.ts
@@ -147,7 +146,6 @@ async function signEvmFamilyAttempt(deps, args, attempt) {
 		request: args.request,
 		chainTarget: args.chainTarget
 	});
-	requiredEvmFamilyRequestSignatureUses(args.request);
 	await ensureSealedRefreshStartupParityForTransactionSigning(deps.ensureSealedRefreshStartupParity, {
 		walletId,
 		chainTarget: signingTarget
@@ -353,7 +351,7 @@ async function signEvmFamilyAttempt(deps, args, attempt) {
 		if (reResolved) return reResolved;
 		throw error;
 	}
-	const { signingAuthPlan, signingSessionPlan, emailOtpSigning, flowArgs } = preparedFlow;
+	const { signingAuthPlan, emailOtpSigning, flowArgs } = preparedFlow;
 	let freshAuthRetryHandledFinalization = false;
 	const retryWithFreshWalletSessionAuth = async (error) => {
 		return await retryEvmFamilyWithFreshWalletSessionAuthWhenRequired({

package/dist/esm/core/signingEngine/flows/signEvmFamily/signEvmFamilyWithUiConfirmForTempo.js

@@ -1,9 +1,9 @@
 import { buildEvmDisplayModel } from "../../chains/evm/display/evmTx.js";
 import { buildTempoDisplayModel } from "../../chains/tempo/display.js";
 import { signEvmFamilyWithUiConfirm } from "./signingFlow.js";
-import { requiredEvmFamilyRequestSignatureUses } from "./signatureUses.js";
 import { TempoAdapter } from "../../chains/tempo/tempoAdapter.js";
 import { EvmAdapter } from "../../chains/evm/evmAdapter.js";
+import { requiredEvmFamilyRequestSignatureUses } from "./signatureUses.js";
 import { resolveWebAuthnP256KeyRefForWallet } from "./webauthnP256KeyRef.js";
 //#region src/core/signingEngine/flows/signEvmFamily/signEvmFamilyWithUiConfirmForTempo.ts
 async function signEvmFamilyWithUiConfirmForTempo(args) {

package/dist/esm/core/signingEngine/flows/signEvmFamily/signEvmWithUiConfirm.js

@@ -1,7 +1,7 @@
 import { buildEvmDisplayModel } from "../../chains/evm/display/evmTx.js";
 import { signEvmFamilyWithUiConfirm } from "./signingFlow.js";
-import { requiredEvmFamilyRequestSignatureUses } from "./signatureUses.js";
 import { EvmAdapter } from "../../chains/evm/evmAdapter.js";
+import { requiredEvmFamilyRequestSignatureUses } from "./signatureUses.js";
 //#region src/core/signingEngine/flows/signEvmFamily/signEvmWithUiConfirm.ts
 async function signEvmWithUiConfirm(args) {
 	return await signEvmFamilyWithUiConfirm({

package/dist/esm/core/signingEngine/flows/signEvmFamily/signers/secp256k1.js

@@ -1,5 +1,5 @@
 import { routerAbMpcMaterialActivationRefToWire } from "../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseEcdsaKeyHandle } from "../../../session/keyMaterialBrands.js";
+import { parseEcdsaKeyHandle } from "../../../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS } from "../../../workerManager/ecdsaPresignLifecycle.js";
 import { emitEcdsaSigningTiming, emitSigningSessionFlowTrace } from "../../../session/operationState/trace.js";
 import { scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill, signRouterAbEcdsaDerivationDigestWithPool } from "../../../routerAb/ecdsaDerivation/presignaturePool.js";
@@ -94,7 +94,6 @@ var Secp256k1Engine = class {
 	constructor(opts) {
 		this.algorithm = "secp256k1";
 		this.beforeSigning = opts.beforeSigning;
-		this.getRpId = opts.getRpId;
 		this.shouldAbort = opts.shouldAbort;
 		this.workerCtx = opts.workerCtx;
 	}

package/dist/esm/core/signingEngine/flows/signEvmFamily/signingFlow.js

@@ -1,6 +1,6 @@
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u, sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { SigningEventPhase, createSigningFlowEvent } from "../../../types/sdkSentEvents.js";
 import { SigningSessionIds } from "../../session/operationState/types.js";
 import { normalizeAuthenticationCredential } from "../../webauthnAuth/credentials/helpers.js";
@@ -58,7 +58,7 @@ async function buildEvmFamilyOperationDigests(input) {
 	return {
 		laneDigest: parseSigningOperationFingerprintDigest(SigningSessionIds.signingOperationFingerprint(operationFingerprint)),
 		intentDigest: parseDigestB64u(base64UrlEncode(input.signingDigest32)),
-		displayDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(input.displayModel))))
+		displayDigest: await sha256Utf8DigestB64u(alphabetizeStringify(input.displayModel))
 	};
 }
 function intentDigestPreparationFromEvmIntent(args) {
@@ -299,7 +299,7 @@ async function signEvmFamilyWithUiConfirm(args) {
 	let signedResult = null;
 	let ecdsaSigningMaterialSource = null;
 	let preparedEcdsaOperationStepUp = null;
-	const ensureReadySecp256k1SigningMaterial = async (signReq, operation, operationDigests) => {
+	const ensureReadySecp256k1SigningMaterial = async (_signReq, operation, operationDigests) => {
 		if (input.resolveEcdsaSigningMaterialPlan) {
 			const plan = await input.resolveEcdsaSigningMaterialPlan();
 			switch (plan.kind) {

package/dist/esm/core/signingEngine/flows/signEvmFamily/signingFlowRuntime.js

@@ -1,9 +1,9 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { isEd25519ExtensionOfEcdsaWalletAuthority } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { walletSessionPreservesCapabilities } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { requireEvmFamilyEcdsaSigner } from "../../session/identity/exactSigningLaneIdentity.js";
-import { walletSessionPreservesCapabilities } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { isEd25519ExtensionOfEcdsaWalletAuthority } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { exactEcdsaWalletSessionRuntimesMatch } from "../../session/material/ecdsaSigningCapability.js";
 import { emitEvmFamilySigningOperationTrace } from "./events.js";
 import { resolveThresholdEcdsaSigningQueueKey } from "../../threshold/ecdsa/signingQueue.js";
@@ -47,7 +47,8 @@ async function resolveExactEcdsaOperationStepUpSession(args) {
 	if (!capabilityMatchesOperationScope(args)) throw new Error("[SigningEngine] exact ECDSA Wallet Session material changed");
 	const ports = args.ports;
 	const selected = await ports.resolveSelectedWalletAuthority(String(args.scope.walletId));
-	if (selected.kind !== "resolved" || selected.selection.lockState !== "unlocked" || selected.selection.walletId !== args.scope.walletId || selected.authMethod.status !== "active" || selected.authMethod.walletId !== args.scope.walletId || selected.selection.walletAuthMethodId !== selected.authMethod.walletAuthMethodId || selected.authority.state !== "active" || selected.authority.walletId !== args.scope.walletId || selected.authMethod.walletAuthorityId !== selected.authority.authorityId) throw new Error("[SigningEngine] exact ECDSA Wallet Session is unavailable");
+	const selectedReason = selectedStepUpAuthorityUnavailableReason(selected, args.scope.walletId);
+	if (selectedReason || selected.kind !== "resolved") throw exactEcdsaWalletSessionUnavailable(selectedReason ?? "selected_authority_invalid");
 	const capabilityAuthority = await walletAuthAuthorityRef({ authority: args.capability.authority });
 	const manifestAuthority = args.capability.manifest.signer.authority;
 	const selectedActivation = selected.authority.signerActivations.ecdsa;
@@ -57,17 +58,46 @@ async function resolveExactEcdsaOperationStepUpSession(args) {
 		authorityId: selected.authority.authorityId,
 		authMethodId: selected.authMethod.walletAuthMethodId
 	});
-	if (read.kind !== "found") throw new Error("[SigningEngine] exact ECDSA Wallet Session is unavailable");
+	if (read.kind !== "found") throw exactEcdsaWalletSessionUnavailable(read.kind === "missing" ? "wallet_session_missing" : "wallet_session_upgrade_required");
 	const session = read.record;
-	if (session.walletId !== args.scope.walletId || session.authorityId !== selected.authority.authorityId || session.authMethodId !== selected.authMethod.walletAuthMethodId || session.authorityDigestB64u !== selected.authority.authorityDigestB64u || session.authorityRevocationEpoch !== selected.authority.revocationEpoch || session.expiresAtMs <= Date.now() || !read.operationCredential.token.trim() || !sessionAuthorizesCanonicalEcdsaCapability({
+	const sessionReason = stepUpSessionRecordUnavailableReason({
 		session,
+		operationCredential: read.operationCredential,
+		walletId: args.scope.walletId,
+		authority: selected.authority,
+		authMethod: selected.authMethod,
 		capability: args.capability
-	})) throw new Error("[SigningEngine] exact ECDSA Wallet Session is unavailable");
+	});
+	if (sessionReason) throw exactEcdsaWalletSessionUnavailable(sessionReason);
 	return {
 		credential: read.operationCredential,
 		expiresAtMs: session.expiresAtMs
 	};
 }
+function exactEcdsaWalletSessionUnavailable(reason) {
+	return /* @__PURE__ */ new Error(`[SigningEngine] exact ECDSA Wallet Session is unavailable: ${reason}`);
+}
+function selectedStepUpAuthorityUnavailableReason(selected, walletId) {
+	if (selected.kind !== "resolved") return selected.kind === "missing_selection" ? "selected_authority_missing" : "selected_authority_invalid";
+	if (selected.selection.walletId !== walletId || selected.authMethod.walletId !== walletId || selected.authority.walletId !== walletId || selected.selection.walletAuthMethodId !== selected.authMethod.walletAuthMethodId || selected.authMethod.walletAuthorityId !== selected.authority.authorityId) return "authority_identity_mismatch";
+	if (selected.selection.lockState !== "unlocked") return "wallet_locked";
+	if (selected.authMethod.status !== "active") return "auth_method_inactive";
+	if (selected.authority.state !== "active") return "authority_inactive";
+	return null;
+}
+function stepUpSessionRecordUnavailableReason(args) {
+	const { session } = args;
+	if (session.walletId !== args.walletId || session.authorityId !== args.authority.authorityId || session.authMethodId !== args.authMethod.walletAuthMethodId) return "wallet_session_identity_mismatch (authority or method)";
+	if (session.authorityDigestB64u !== args.authority.authorityDigestB64u) return "wallet_session_identity_mismatch (authority digest)";
+	if (session.authorityRevocationEpoch !== args.authority.revocationEpoch) return "wallet_session_identity_mismatch (authority revocation epoch)";
+	if (!args.operationCredential.token.trim()) return "wallet_session_identity_mismatch (operation credential)";
+	if (session.expiresAtMs <= Date.now()) return "wallet_session_expired";
+	if (!sessionAuthorizesCanonicalEcdsaCapability({
+		session,
+		capability: args.capability
+	})) return "wallet_session_capability_mismatch";
+	return null;
+}
 async function prepareSessionBoundEcdsaOperationStepUp(sessionScope, input) {
 	const session = await resolveExactEcdsaOperationStepUpSession(sessionScope);
 	return await prepareEvmFamilyEcdsaOperationStepUp({
@@ -107,11 +137,11 @@ async function resolveCurrentActiveWalletAuthorityRuntime(args) {
 	if (runtime.authorityId !== args.prepared.authorityId || runtime.walletAuthMethodId !== args.prepared.walletAuthMethodId || runtime.authorityDigestB64u !== args.prepared.authorityDigestB64u || runtime.authorityRevocationEpoch !== args.prepared.authorityRevocationEpoch || runtime.walletSessionId !== args.prepared.walletSessionId || runtime.publicFacts.keyHandle !== args.signer.keyHandle) throw new Error("[SigningEngine] active Wallet Authority ECDSA runtime was replaced");
 	return runtime;
 }
-/** R90-INV-010. The wallet's active manifest names the material that may be
-* used right now. When it has moved on from the one this operation was prepared
-* against, the preparation is superseded -- material activation is advance-only,
-* so the prepared side is always the stale one. That is a re-resolution, not a
-* failure and not a request for the wrong material. */
+/** The wallet's active manifest names the material that may be used right now.
+* When it has moved on from the one this operation was prepared against, the
+* preparation is superseded -- material activation is advance-only, so the
+* prepared side is always the stale one. That is a re-resolution, not a failure
+* and not a request for the wrong material. */
 function ecdsaSigningMaterialSupersession(args) {
 	if (mpcMaterialActivationRefsEqual(args.currentMaterialActivation, args.preparedMaterialActivation)) return null;
 	return {

package/dist/esm/core/signingEngine/flows/signNear/shared/ed25519YaoNormalSigning.js

@@ -1,9 +1,9 @@
 import { parseCapabilityId, parseCapabilityOperationId, parsePrincipalId, parseTenantId } from "../../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { base64UrlDecode, base64UrlEncode } from "../../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Decode } from "../../../../../shared-ts/src/utils/base58.js";
 import { ensureEd25519Prefix } from "../../../../../shared-ts/src/utils/near.js";
 import "../../../../../shared-ts/src/utils/validation.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { resolveNearNetwork } from "../../../../config/chains.js";
 import { SigningSessionIds } from "../../../session/operationState/types.js";
 import { ActionType, fromActionArgsWasm } from "../../../../../shared-ts/src/near/actions.js";

package/dist/esm/core/signingEngine/flows/signNear/shared/signatureOnlySigning.js

@@ -0,0 +1,343 @@
+import { SigningSessionIds, SigningSessionPlanKind } from "../../../session/operationState/types.js";
+import { nearEd25519SignerBindingFromBoundaryFields } from "../../../session/identity/exactSigningLaneIdentity.js";
+import { SigningOperationCommandKind, runSigningOperationCommand } from "../../shared/signingStateMachine.js";
+import { requireNearStepUpAuth, signingAuthPlanForNearMaterialRequirement } from "../requireNearStepUpAuth.js";
+import { buildSigningConfirmationAuthParams } from "../../../stepUpConfirmation/confirmOperation.js";
+import { confirmationConfigForSigningAuthPlan, runSigningConfirmationCommand } from "../../shared/signingConfirmation.js";
+import { emitNearSigningConfirmationProgress } from "./confirmationProgress.js";
+import { buildNearEd25519StepUpAuthorization } from "../stepUpAuthorization.js";
+import { parseSigningOperationFingerprintDigest } from "../../../../../shared-ts/src/authorization/operationFingerprint.js";
+import { clearNearOperationStepUpBuilder, consumePreparedNearOperationStepUp, registerNearOperationStepUpBuilder } from "./operationStepUpPreparation.js";
+import { buildNearEd25519OperationStepUpProof, prepareRouterAbEd25519SignatureOnlyOperationStepUp, requireIssuedNearEd25519OperationStepUpAuthorization, tryFinalizeRouterAbEd25519SignatureOnlyNormalSigning } from "./ed25519YaoNormalSigning.js";
+import { nearOperationStepUpMaterialFacts, prepareNearOperationStepUpMaterial, resolveConfirmedNearEd25519YaoCapability, resolveNearOperationStepUpMaterial } from "./ed25519YaoCapabilityResolution.js";
+import { planSigningSession } from "../../../session/planning/planner.js";
+import { buildNearSigningSessionAuthPlan, resolveNearSigningSessionAuthContext } from "./signingSessionAuthMode.js";
+//#region src/core/signingEngine/flows/signNear/shared/signatureOnlySigning.ts
+const REQUIRED_SIGNATURE_USES = 1;
+function requireOperationStepUpPreparationRef(label, value) {
+	if (!value) throw new Error(`[SigningEngine][near] ${label} operation step-up preparation is missing`);
+	return value;
+}
+function requirePreparedSignatureOnlyStepUp(label, value) {
+	if (!value || value.kind !== "near_signature_only") throw new Error(`[SigningEngine][near] ${label} operation step-up preparation kind changed`);
+	return value;
+}
+function requireOperationStepUpMaterial(label, value) {
+	if (!value) throw new Error(`[SigningEngine][near] ${label} operation step-up material is missing`);
+	return value;
+}
+function requireSigningDigest(label, value) {
+	if (!value) throw new Error(`[SigningEngine][near] ${label} operation signing digest is missing`);
+	return value;
+}
+function requireAuthorizedWalletSessionState(value) {
+	if (!value) throw new Error("[SigningEngine][near] reusable Wallet Session authorization is unavailable");
+	return value;
+}
+async function resolveSignatureOnlyOperationStepUpCapability(args) {
+	if (args.authorization.kind === "passkey") {
+		if (args.material.kind !== "passkey_live" && args.material.kind !== "passkey_sealed") throw new Error(`[SigningEngine][near] passkey ${args.label} material changed factor`);
+		return await resolveNearOperationStepUpMaterial({
+			kind: "passkey",
+			material: args.material,
+			expectedActivation: args.prepared.materialActivation,
+			credential: args.authorization.credential
+		});
+	}
+	if (args.material.kind !== "email_otp_live" && args.material.kind !== "email_otp_sealed") throw new Error(`[SigningEngine][near] Email OTP ${args.label} material changed factor`);
+	if (!args.emailOtpProof) throw new Error(`[SigningEngine][near] Email OTP ${args.label} proof is missing`);
+	if (args.material.kind === "email_otp_live") return await resolveNearOperationStepUpMaterial({
+		kind: "email_otp_live",
+		material: args.material,
+		expectedActivation: args.prepared.materialActivation
+	});
+	return await resolveNearOperationStepUpMaterial({
+		kind: "email_otp_sealed",
+		material: args.material,
+		expectedActivation: args.prepared.materialActivation,
+		normalSigningRequest: args.prepared.prepare.request,
+		displayDigest: args.displayDigest,
+		proof: args.emailOtpProof
+	});
+}
+/**
+* Plans the signing session for the selected lane. A lane still awaiting authorization signs
+* once, through an operation step-up on its deferred material.
+*/
+function resolveNearSignatureOnlySigningPlans(args) {
+	if (args.selection.kind === "authorized") {
+		const context = resolveNearSigningSessionAuthContext({
+			requiredSignatureUses: REQUIRED_SIGNATURE_USES,
+			commandSubject: args.commandSubject,
+			forceFreshAuth: args.forceFreshAuth,
+			selectedLane: args.selection.selectedLane,
+			preparation: args.preparation
+		});
+		const resolvedSigningSession = {
+			signingSessionPlan: planSigningSession({
+				lane: context.coordinatorInput.lane,
+				readiness: context.coordinatorInput.readiness,
+				forceFreshAuth: context.coordinatorInput.forceFreshAuth
+			}),
+			readiness: context.coordinatorInput.readiness,
+			expiresAtMs: context.coordinatorInput.expiresAtMs || 0,
+			remainingUses: context.coordinatorInput.remainingUses || 0
+		};
+		return {
+			signingAuthPlan: buildNearSigningSessionAuthPlan({
+				context,
+				resolvedSigningSession
+			}).signingAuthPlan,
+			signingSessionPlan: resolvedSigningSession.signingSessionPlan
+		};
+	}
+	const candidate = args.selection.candidate;
+	const signingAuthPlan = signingAuthPlanForNearMaterialRequirement(candidate.auth);
+	const deferredIdentity = {
+		kind: "deferred_ed25519_material_identity",
+		signer: nearEd25519SignerBindingFromBoundaryFields({
+			walletId: candidate.walletId,
+			nearAccountId: candidate.nearAccountId,
+			nearEd25519SigningKeyId: candidate.nearEd25519SigningKeyId,
+			signerSlot: candidate.signerSlot
+		}),
+		materialActivation: candidate.materialActivation,
+		thresholdSessionId: SigningSessionIds.thresholdEd25519Session(candidate.thresholdSessionId)
+	};
+	return {
+		signingAuthPlan,
+		signingSessionPlan: {
+			kind: SigningSessionPlanKind.OperationStepUp,
+			lane: {
+				identity: deferredIdentity,
+				auth: candidate.auth,
+				curve: "ed25519",
+				keyKind: "threshold_ed25519",
+				chainFamily: "near",
+				sessionOrigin: "per_operation",
+				storageSource: "sealed_restore",
+				retention: "single_use",
+				materialActivation: deferredIdentity.materialActivation,
+				thresholdSessionId: deferredIdentity.thresholdSessionId
+			}
+		}
+	};
+}
+/**
+* Prepares the step-up. Unless a warm session covers the operation, this also prepares the
+* operation material and registers the builder the confirmation calls to prepare the
+* Router A/B request.
+*/
+async function prepareNearSignatureOnlyStepUp(operation, args) {
+	const preparedStepUp = await requireNearStepUpAuth({
+		signingAuthPlan: args.signingAuthPlan,
+		signingLaneAuth: operation.auth,
+		requiredSignatureUses: REQUIRED_SIGNATURE_USES,
+		operationFingerprintDigest: parseSigningOperationFingerprintDigest(operation.signingOperation.operationFingerprint),
+		passkeyEd25519OperationStepUp: args.passkeyEd25519OperationStepUp,
+		emailOtpEd25519StepUp: args.emailOtpEd25519StepUp
+	});
+	if (preparedStepUp.kind === "warm_session") return {
+		preparedStepUp,
+		operationStepUp: null
+	};
+	const material = await prepareNearOperationStepUpMaterial({
+		method: preparedStepUp.kind,
+		preparation: operation.preparation,
+		executor: operation.executor
+	});
+	const materialFacts = nearOperationStepUpMaterialFacts(material);
+	const signingDigestB64u = await operation.computeSigningDigestB64u();
+	registerNearOperationStepUpBuilder({
+		requestId: String(operation.signingOperation.operationId),
+		build: async (preparation) => {
+			if (preparation.kind !== "near_signature_only") throw new Error(`[SigningEngine][near] ${operation.label} operation step-up preparation kind changed`);
+			return await prepareRouterAbEd25519SignatureOnlyOperationStepUp({
+				ctx: operation.ctx,
+				thresholdSessionId: materialFacts.thresholdSessionId,
+				materialFacts,
+				thresholdKeyMaterial: operation.thresholdKeyMaterial,
+				walletId: operation.walletId,
+				nearAccountId: operation.nearAccountId,
+				materialActivation: material.materialActivation,
+				operationId: operation.signingOperation.operationId,
+				operationFingerprint: operation.signingOperation.operationFingerprint,
+				displayDigest: preparation.displayDigest,
+				signingDigestB64u,
+				intent: operation.intent
+			});
+		}
+	});
+	return {
+		preparedStepUp,
+		operationStepUp: {
+			material,
+			signingDigestB64u
+		}
+	};
+}
+/** Shows the confirmation, then drops the step-up builder whether or not it was used. */
+async function confirmNearSignatureOnlyOperation(operation, args) {
+	const requestId = String(operation.signingOperation.operationId);
+	try {
+		return await runSigningConfirmationCommand({
+			signingSessionPlan: operation.signingSessionPlan,
+			signingOperation: operation.signingOperation,
+			runtime: args.touchConfirm,
+			request: {
+				ctx: { touchConfirm: args.touchConfirm },
+				sessionId: requestId,
+				chain: "near",
+				...args.request,
+				...buildSigningConfirmationAuthParams({ signingAuthPlan: args.signingAuthPlan }),
+				walletId: String(operation.walletId),
+				nearAccountId: operation.nearAccountId,
+				nearPublicKeyStr: args.nearPublicKeyStr,
+				title: args.title,
+				body: args.body,
+				confirmationConfigOverride: confirmationConfigForSigningAuthPlan({
+					signingAuthPlan: args.signingAuthPlan,
+					override: args.confirmationConfigOverride
+				}),
+				onProgress: emitNearSigningConfirmationProgress.bind(void 0, {
+					onEvent: args.onEvent,
+					nearAccountId: operation.nearAccountId,
+					signingAuthPlan: args.signingAuthPlan
+				})
+			}
+		});
+	} finally {
+		clearNearOperationStepUpBuilder(requestId);
+	}
+}
+/** Turns the confirmation into the authorization that the signing step presents. */
+function authorizeNearSignatureOnlyOperation(operation, stepUp, confirmation) {
+	const stepUpAuthorization = buildNearEd25519StepUpAuthorization({
+		prepared: stepUp.preparedStepUp,
+		confirmation
+	});
+	if (stepUpAuthorization.kind === "warm_session") return {
+		kind: "warm_session",
+		displayDigest: confirmation.intentDigest,
+		stepUpAuthorization
+	};
+	const proof = buildNearEd25519OperationStepUpProof({
+		authorization: stepUpAuthorization,
+		preparation: operation.preparation,
+		auth: operation.auth,
+		walletId: operation.walletId
+	});
+	const prepared = requirePreparedSignatureOnlyStepUp(operation.label, consumePreparedNearOperationStepUp({
+		requestId: String(operation.signingOperation.operationId),
+		ref: requireOperationStepUpPreparationRef(operation.label, confirmation.operationStepUpPreparation)
+	}));
+	return {
+		kind: "operation_step_up",
+		displayDigest: confirmation.intentDigest,
+		stepUpAuthorization,
+		proof,
+		prepared,
+		...requireOperationStepUpMaterial(operation.label, stepUp.operationStepUp)
+	};
+}
+async function resolveNearSignatureOnlySigningMaterial(operation, authorization) {
+	if (authorization.kind === "warm_session") {
+		const resolved = await resolveConfirmedNearEd25519YaoCapability({
+			authorization: authorization.stepUpAuthorization,
+			preparation: operation.preparation,
+			executor: operation.executor
+		});
+		return {
+			kind: "warm_session",
+			thresholdSessionId: resolved.thresholdSessionId,
+			displayDigest: authorization.displayDigest,
+			resolved
+		};
+	}
+	return {
+		kind: "operation_step_up",
+		thresholdSessionId: nearOperationStepUpMaterialFacts(authorization.material).thresholdSessionId,
+		displayDigest: authorization.displayDigest,
+		resolved: await resolveSignatureOnlyOperationStepUpCapability({
+			label: operation.label,
+			material: authorization.material,
+			prepared: authorization.prepared,
+			displayDigest: authorization.displayDigest,
+			authorization: authorization.stepUpAuthorization,
+			emailOtpProof: authorization.proof.kind === "email_otp" ? authorization.proof : null
+		}),
+		proof: authorization.proof,
+		prepared: authorization.prepared,
+		signingDigestB64u: authorization.signingDigestB64u
+	};
+}
+/** Signs through Router A/B with the reusable Wallet Session or the operation step-up. */
+async function signNearSignatureOnlyOperation(operation, material, signingSessionCoordinator) {
+	const signingDigestB64u = material.kind === "warm_session" ? await operation.computeSigningDigestB64u() : requireSigningDigest(operation.label, material.signingDigestB64u);
+	const result = material.kind === "warm_session" ? await tryFinalizeRouterAbEd25519SignatureOnlyNormalSigning({
+		ctx: operation.ctx,
+		thresholdSessionId: material.thresholdSessionId,
+		activeClient: material.resolved.material.activeClient,
+		walletSessionState: requireAuthorizedWalletSessionState(await signingSessionCoordinator.resolveActiveAuthorizedRouterAbEd25519WalletSessionState({
+			state: material.resolved.walletSessionState,
+			nowMs: Date.now()
+		})),
+		walletId: operation.walletId,
+		thresholdKeyMaterial: operation.thresholdKeyMaterial,
+		nearAccountId: operation.nearAccountId,
+		operationId: operation.signingOperation.operationId,
+		operationFingerprint: operation.signingOperation.operationFingerprint,
+		displayDigest: material.displayDigest,
+		signingDigestB64u,
+		intent: operation.intent,
+		authorization: { kind: "reusable_wallet_session" }
+	}) : await tryFinalizeRouterAbEd25519SignatureOnlyNormalSigning({
+		ctx: operation.ctx,
+		thresholdSessionId: material.thresholdSessionId,
+		activeClient: material.resolved.material.activeClient,
+		materialFacts: material.resolved.material.facts,
+		walletId: operation.walletId,
+		thresholdKeyMaterial: operation.thresholdKeyMaterial,
+		nearAccountId: operation.nearAccountId,
+		operationId: operation.signingOperation.operationId,
+		operationFingerprint: operation.signingOperation.operationFingerprint,
+		displayDigest: material.displayDigest,
+		signingDigestB64u,
+		intent: operation.intent,
+		authorization: {
+			kind: "operation_step_up",
+			prepared: material.prepared,
+			proof: material.proof,
+			issuedAuthorization: material.resolved.issuedAuthorization
+		}
+	});
+	if (!result) throw new Error(`[SigningEngine][near] Router A/B Ed25519 ${operation.label} signing is unavailable`);
+	if (material.kind === "operation_step_up" && result.authorization === "operation_step_up") requireIssuedNearEd25519OperationStepUpAuthorization({
+		prepared: material.prepared,
+		issuedAuthorization: result.issuedAuthorization
+	});
+	return {
+		signingDigestB64u,
+		signatureB64u: result.signatureB64u,
+		signerPublicKey: result.signerPublicKey
+	};
+}
+/** Runs the Sign command, rethrowing a thrown non-Error value as an Error. */
+async function runNearSignatureOnlySignCommand(operation, execute) {
+	return await runSigningOperationCommand({
+		signingSessionPlan: operation.signingSessionPlan,
+		signingOperation: operation.signingOperation,
+		commandKind: SigningOperationCommandKind.Sign,
+		execute: async () => {
+			try {
+				return await execute();
+			} catch (e) {
+				throw e instanceof Error ? e : new Error(String(e));
+			}
+		}
+	});
+}
+//#endregion
+export { authorizeNearSignatureOnlyOperation, confirmNearSignatureOnlyOperation, prepareNearSignatureOnlyStepUp, resolveNearSignatureOnlySigningMaterial, resolveNearSignatureOnlySigningPlans, runNearSignatureOnlySignCommand, signNearSignatureOnlyOperation };
+
+//# sourceMappingURL=signatureOnlySigning.js.map