@seams/wallet 0.6.2 → 0.7.3

package/dist/esm/core/rpcClients/relayer/walletRegistration.js

@@ -1,18 +1,22 @@
 import { parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { parseWalletAddAuthMethodRegistrationOptions } from "../../../shared-ts/src/utils/addAuthMethodRegistration.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../shared-ts/src/utils/near.js";
-import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeRegistrationIntentDigestB64u, normalizeRegistrationAuthMethodInput, normalizeRegistrationSignerPlan, parseAddAuthMethodIntentV1, parseAddSignerIntentV1, registrationSignerSetSelectionFromPlan, sameAddAuthMethodIntentV1, sameAddSignerIntentV1, walletIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { parseWebAuthnAuthenticatorDeviceInfo } from "../../../shared-ts/src/utils/webauthnDeviceInfo.js";
-import { parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { parseWalletAuthAuthority } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { parseRouterAbEcdsaRegistrationPublicActivationReceiptV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, requireRouterAbEcdsaDerivationNormalSigningStateV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildBearerAuthorizationHeader, buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
+import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { thresholdEcdsaChainTargetsEqual } from "../../signingEngine/interfaces/ecdsaChainTarget.js";
 import { normalizeThresholdRuntimePolicyScope } from "../../signingEngine/threshold/sessionPolicy.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import { parseWalletCustodyRegistrationOutcome } from "../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
+import { parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { parseWalletAuthAuthority } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseRouterAbEcdsaRegistrationPublicActivationReceiptV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, requireRouterAbEcdsaDerivationNormalSigningStateV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { parseWalletAddAuthMethodRegistrationOptions } from "../../../shared-ts/src/utils/addAuthMethodRegistration.js";
+import { normalizeRegistrationAuthMethodInput } from "../../../shared-ts/src/utils/registrationAuthMethodInput.js";
+import { parseWalletAuthorityV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
+import { parseWebAuthnAuthenticatorDeviceInfo } from "../../../shared-ts/src/utils/webauthnDeviceInfo.js";
+import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeRegistrationIntentDigestB64u, parseAddAuthMethodIntentV1, parseAddSignerIntentV1, sameAddAuthMethodIntentV1, sameAddSignerIntentV1 } from "../../../shared-ts/src/utils/registrationIntent.js";
 import { parseRegistrationEstablishedSessionResultV2 } from "../../../shared-ts/src/utils/registrationEstablishedSession.js";
 import { parseThresholdEcdsaKeyIdentityTargets } from "../../signingEngine/session/passkey/ecdsaKeyFactsInventory.js";
 import { parseThresholdEcdsaDerivationRoleLocalBootstrapValue } from "./thresholdEcdsa.js";
@@ -251,7 +255,7 @@ function readWalletRegistrationResponseField(record, field, label) {
 	if (!Object.keys(record).includes(field)) throw new Error(`${label} is missing ${field}`);
 	return Reflect.get(record, field);
 }
-function readOptionalWalletRegistrationResponseField(record, field, label) {
+function readOptionalWalletRegistrationResponseField(record, field, _label) {
 	if (!Object.keys(record).includes(field)) return void 0;
 	return Reflect.get(record, field);
 }
@@ -1314,7 +1318,8 @@ function parseWalletAddSignerFinalizeResponse(args) {
 		"rpId",
 		"credentialIdB64u",
 		"ed25519",
-		"ecdsa"
+		"ecdsa",
+		"authority"
 	], responseName);
 	const ok = readWalletRegistrationResponseField(record, "ok", responseName);
 	const kind = readWalletRegistrationResponseField(record, "kind", responseName);
@@ -1327,7 +1332,7 @@ function parseWalletAddSignerFinalizeResponse(args) {
 	const rpId = requireResponseRpId(readWalletRegistrationResponseField(record, "rpId", responseName), responseName);
 	switch (kind) {
 		case "near_ed25519": {
-			if (readOptionalWalletRegistrationResponseField(record, "ecdsa", responseName) !== void 0) throw new Error(`${responseName} response mixed signer branches`);
+			if (readOptionalWalletRegistrationResponseField(record, "ecdsa", responseName) !== void 0 || readOptionalWalletRegistrationResponseField(record, "authority", responseName) !== void 0) throw new Error(`${responseName} response mixed signer branches`);
 			const ed25519 = parseWalletEd25519YaoSignerPublicResult(readWalletRegistrationResponseField(record, "ed25519", responseName), "Wallet add-signer Ed25519 finalize");
 			return {
 				ok: true,
@@ -1352,12 +1357,15 @@ function parseWalletAddSignerFinalizeResponse(args) {
 			assertWalletRegistrationResponseKeys(ecdsa, ["walletKeys"], responseName);
 			const walletKeys = requireWalletRegistrationResponseArray(readWalletRegistrationResponseField(ecdsa, "walletKeys", responseName), `${responseName} walletKeys`);
 			if (walletKeys.length === 0) throw new Error(`${responseName} response has invalid walletKeys`);
+			const authority = parseWalletAuthorityV1(readWalletRegistrationResponseField(record, "authority", responseName));
+			if (!authority.ok || authority.value.state !== "active" || authority.value.walletId !== walletId) throw new Error(`${responseName} response has invalid authority`);
 			return {
 				ok: true,
 				walletId,
 				kind: "evm_family_ecdsa",
 				rpId,
-				ecdsa: { walletKeys: walletKeys.map(parseWalletAddSignerEcdsaFinalizeWalletKey) }
+				ecdsa: { walletKeys: walletKeys.map(parseWalletAddSignerEcdsaFinalizeWalletKey) },
+				authority: authority.value
 			};
 		}
 		default: throw new Error(`${responseName} response has invalid kind`);
@@ -1468,8 +1476,8 @@ function parseWalletEcdsaKeyFactsInventoryResponse(args) {
 	};
 }
 /**
-* Refactor 94C. `POST /wallets/register/setup` — the single admitted entry
-* point replacing the grant, intent, and start calls below.
+* `POST /wallets/register/setup` — the single admitted entry point replacing
+* the grant, intent, and start calls below.
 *
 * It is called *before* the WebAuthn create prompt, because its response
 * carries the challenge that create must sign. The server-side preparation
@@ -1575,7 +1583,7 @@ function parseRevokeWalletAuthMethodResponse(value) {
 	}
 }
 /**
-* R109C: revoke one auth method using a proof from a different active one.
+* Revoke one auth method using a proof from a different active one.
 *
 * The route is the wallet's own auth-method management, not device linking:
 * a sibling on the same device is not a device, and the linked-device
@@ -1586,7 +1594,7 @@ async function revokeWalletAuthMethod(args) {
 	const walletId = String(args.walletId || "").trim();
 	const walletAuthMethodId = String(args.walletAuthMethodId || "").trim();
 	if (!walletId || !walletAuthMethodId) throw new Error("auth-method revoke requires a wallet and a target method");
-	return parseRevokeWalletAuthMethodResponse(await postJson({
+	const request = {
 		relayerUrl: args.relayerUrl,
 		path: `/wallets/${encodeURIComponent(walletId)}/auth-methods/${encodeURIComponent(walletAuthMethodId)}/revoke`,
 		body: {
@@ -1595,7 +1603,15 @@ async function revokeWalletAuthMethod(args) {
 			requestedAtMs: args.requestedAtMs,
 			sourceProof: args.sourceProof
 		}
-	}));
+	};
+	let response;
+	try {
+		response = await postJson(request);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		response = await postJson(request);
+	}
+	return parseRevokeWalletAuthMethodResponse(response);
 }
 async function createWalletAddAuthMethodIntent(args) {
 	const walletId = String(args.walletId || "").trim();
@@ -2258,11 +2274,19 @@ async function finalizeWalletAddAuthMethod(args) {
 		webauthnRegistration: args.webauthnRegistration,
 		custodyEnvelope: parsePasskeyCustodyEnvelopeRecord(args.custodyEnvelope)
 	};
-	return parseWalletAddAuthMethodFinalizeResponse(await postJson({
+	const request = {
 		relayerUrl: args.relayerUrl,
 		path: `/wallets/${encodeURIComponent(walletId)}/auth-methods/finalize`,
 		body
-	}));
+	};
+	let response;
+	try {
+		response = await postJson(request);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		response = await postJson(request);
+	}
+	return parseWalletAddAuthMethodFinalizeResponse(response);
 }
 async function fetchWalletEcdsaKeyFactsInventoryWithOperationCredential(args) {
 	const walletId = String(args.walletId || "").trim();

package/dist/esm/core/rpcClients/relayer/walletRegistrationTerminalResponse.js

@@ -1,24 +1,18 @@
 import { parseThresholdEd25519SessionId, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
-import { parseWalletAuthorityV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../shared-ts/src/utils/near.js";
-import { parseNearEd25519SigningKeyId, parseWalletAuthMethodRecordV2, walletIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
-import { isPasskeyWalletAuthAuthority, parseWalletAuthAuthority } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { parseRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { requireRouterAbEd25519NormalSigningState } from "../../../shared-ts/src/utils/signingSessionSeal.js";
+import { parseNearEd25519SigningKeyId, walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey } from "../../signingEngine/interfaces/ecdsaChainTarget.js";
 import { normalizeThresholdRuntimePolicyScope } from "../../signingEngine/threshold/sessionPolicy.js";
 import { parseWalletCustodyRegistrationOutcome } from "../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
+import { isPasskeyWalletAuthAuthority, parseWalletAuthAuthority } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { parseWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { parseWalletAuthorityV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
 //#region src/core/rpcClients/relayer/walletRegistrationTerminalResponse.ts
-/**
-* Strict terminal response parsing for wallet registration.
-*
-* The registration RPC orchestration remains in `walletRegistration.ts`; this
-* module owns the response boundary validators and the terminal finalize
-* projection used by registration activation and provisioning.
-*/
 function requireResponseString(args) {
 	const value = String(args.value || "").trim();
 	if (!value) throw new Error(`${args.responseName} response missing ${args.field}`);

package/dist/esm/core/rpcClients/relayer/walletSessionAuthorizationStatus.js

@@ -1,5 +1,5 @@
 import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/parsers.js";
+import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { buildBearerAuthorizationHeader, buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
 //#region src/core/rpcClients/relayer/walletSessionAuthorizationStatus.ts
 const EXACT_WALLET_SESSION_STATUS_PATH = "/wallet/session/status";

package/dist/esm/core/signingEngine/assembly/ports/evmFamily.js

@@ -1,6 +1,6 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { isEmailOtpWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
+import { isEmailOtpWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { authorizeEvmFamilyEcdsaSigningCapability } from "../../session/material/ecdsaSigningCapability.js";
 import { browserExactWalletSessionReadPorts } from "./emailOtp.js";
 //#region src/core/signingEngine/assembly/ports/evmFamily.ts

package/dist/esm/core/signingEngine/assembly/ports/recovery.js

@@ -26,7 +26,7 @@ function createRecoveryPublicDeps(args) {
 			}, {
 				...completeConfiguredEcdsaTargets(availableLanesArgs),
 				requiredEcdsaCapability: "export_keys"
-			}, new WalletSessionStatusReadScope()),
+			}, new WalletSessionStatusReadScope(), "all"),
 			readOwnerScopedAvailableSigningLanesForTargets: async (availableLanesArgs) => await readOwnerScopedAvailableSigningLanes({
 				activeWalletAuthorityEcdsaRuntimeReadPorts: browserExactWalletSessionReadPorts,
 				ed25519YaoPublicCapabilityLanes: args.ed25519YaoPublicCapabilityLanes,

package/dist/esm/core/signingEngine/assembly/ports/stepUpRuntime.js

@@ -40,7 +40,6 @@ function createStepUpRuntime(args) {
 		listExactSealedSessionsForWallet: args.sealedSessionStore.listExactSealedSessionsForWallet,
 		acquireSigningSessionRestoreLease: args.sealedSessionStore.acquireSigningSessionRestoreLease,
 		releaseSigningSessionRestoreLease: args.sealedSessionStore.releaseSigningSessionRestoreLease,
-		deleteDurableSealedSessionRecord: args.sealedSessionStore.deleteDurableSealedSessionRecord,
 		updateExactSealedSessionPolicy: args.sealedSessionStore.updateExactSealedSessionPolicy
 	});
 	const passkeyMpcSession = createWarmSessionAwarePasskeyMpcSession({

package/dist/esm/core/signingEngine/chains/evm/display/evmTx.js

@@ -19,11 +19,6 @@ function makeField(label, value, copyValue) {
 		...typeof copyValue === "string" && copyValue.trim() ? { copyValue } : {}
 	};
 }
-function shortenHexAddress(address) {
-	const normalized = String(address || "").trim();
-	if (!/^0x[0-9a-fA-F]{40}$/.test(normalized)) return normalized;
-	return `${normalized.slice(0, 8)}...${normalized.slice(-4)}`;
-}
 function buildAbiDecodeHint(args) {
 	const normalizedDataHex = normalizeHexData(args.dataHex);
 	if (normalizedDataHex === "0x") return void 0;
@@ -37,7 +32,7 @@ function buildDefaultContractCallOperation(args) {
 	const functionLabel = resolveFunctionDisplayName(args.selector, args.to);
 	const hasCallData = !!args.to && args.dataHex !== "0x";
 	const formattedGasLimit = formatCompactGas(args.tx.gasLimit);
-	const rowLabel = args.to ? `Transaction to contract ${shortenHexAddress(args.to)}` : "Contract Deployment";
+	const rowLabel = args.to ? "Transaction to contract" : "Contract Deployment";
 	const dataField = makeField("Data", formatCalldataForDisplay(args.dataHex), args.dataHex);
 	if (dataField) {
 		dataField.renderAs = "file-content";

package/dist/esm/core/signingEngine/chains/evm/display/functionSelectors.js

@@ -38,9 +38,6 @@ const KNOWN_CONTRACT_FUNCTION_SIGNATURES = Object.freeze({
 		"0xcfae3217": "greet()"
 	})
 });
-function normalizeSelector(selector) {
-	return normalizeHexSelector(selector);
-}
 function normalizeContractAddress(contractAddress) {
 	const normalized = String(contractAddress || "").trim().toLowerCase();
 	if (!EVM_ADDRESS_RE.test(normalized)) return void 0;
@@ -50,7 +47,7 @@ function selectorFromHexData(data) {
 	return deriveSelectorFromHexData(data);
 }
 function resolveFunctionSignature(selector, contractAddress) {
-	const normalized = normalizeSelector(selector);
+	const normalized = normalizeHexSelector(selector);
 	if (!normalized) return void 0;
 	const normalizedContractAddress = normalizeContractAddress(contractAddress);
 	if (normalizedContractAddress) {
@@ -66,7 +63,7 @@ function resolveFunctionDisplayName(selector, contractAddress) {
 		const normalizedName = (idx > 0 ? signature.slice(0, idx) : signature).trim();
 		if (normalizedName) return `${normalizedName}()`;
 	}
-	const normalizedSelector = normalizeSelector(selector);
+	const normalizedSelector = normalizeHexSelector(selector);
 	if (normalizedSelector) return `function ${normalizedSelector}`;
 }
 //#endregion

package/dist/esm/core/signingEngine/chains/evm/evmCryptoWasm.js

@@ -65,24 +65,6 @@ async function encodeEip1559SignedTxFromSignature65Wasm(args) {
 	});
 	return new Uint8Array(ab);
 }
-async function signSecp256k1RecoverableWasm(args) {
-	const digestBuf = args.digest32.slice().buffer;
-	const pkBuf = args.privateKey32.slice().buffer;
-	const ab = await executeWorkerOperation({
-		ctx: args.workerCtx,
-		kind: EVM_CRYPTO_WORKER_KIND,
-		request: {
-			type: "signSecp256k1Recoverable",
-			payload: {
-				digest32: digestBuf,
-				privateKey32: pkBuf
-			},
-			timeoutMs: EVM_CRYPTO_WORKER_TIMEOUT_MS,
-			transfer: [digestBuf, pkBuf]
-		}
-	});
-	return new Uint8Array(ab);
-}
 async function verifySecp256k1RecoverableSignatureAgainstPublicKey33Wasm(args) {
 	if (!(args.digest32 instanceof Uint8Array) || args.digest32.length !== 32) throw new Error("digest32 must be 32 bytes");
 	if (!(args.signature65 instanceof Uint8Array) || args.signature65.length !== 65) throw new Error("signature65 must be 65 bytes");
@@ -112,23 +94,6 @@ async function verifySecp256k1RecoverableSignatureAgainstPublicKey33Wasm(args) {
 	if (recoveredPublicKey33.length !== 33) throw new Error(`verifySecp256k1RecoverableSignatureAgainstPublicKey33 expected 33-byte output (got ${recoveredPublicKey33.length})`);
 	return recoveredPublicKey33;
 }
-async function secp256k1PrivateKey32ToPublicKey33Wasm(args) {
-	if (!(args.privateKey32 instanceof Uint8Array) || args.privateKey32.length !== 32) throw new Error("privateKey32 must be 32 bytes");
-	const privateKey32 = args.privateKey32.slice().buffer;
-	const ab = await executeWorkerOperation({
-		ctx: args.workerCtx,
-		kind: EVM_CRYPTO_WORKER_KIND,
-		request: {
-			type: "secp256k1PrivateKey32ToPublicKey33",
-			payload: { privateKey32 },
-			timeoutMs: EVM_CRYPTO_WORKER_TIMEOUT_MS,
-			transfer: [privateKey32]
-		}
-	});
-	const publicKey33 = new Uint8Array(ab);
-	if (publicKey33.length !== 33) throw new Error(`secp256k1PrivateKey32ToPublicKey33 expected 33-byte output (got ${publicKey33.length})`);
-	return publicKey33;
-}
 async function validateSecp256k1PublicKey33Wasm(args) {
 	if (!(args.publicKey33 instanceof Uint8Array) || args.publicKey33.length !== 33) throw new Error("publicKey33 must be 33 bytes");
 	const publicKey33 = args.publicKey33.slice();
@@ -228,6 +193,6 @@ async function decodeCoseP256PublicKeyWasm(args) {
 	};
 }
 //#endregion
-export { addSecp256k1PublicKeys33Wasm, buildWebauthnP256SignatureWasm, computeEip1559TxHashWasm, decodeCoseP256PublicKeyWasm, encodeEip1559SignedTxFromSignature65Wasm, secp256k1PrivateKey32ToPublicKey33Wasm, signSecp256k1RecoverableWasm, validateSecp256k1PublicKey33Wasm, verifySecp256k1RecoverableSignatureAgainstPublicKey33Wasm };
+export { addSecp256k1PublicKeys33Wasm, buildWebauthnP256SignatureWasm, computeEip1559TxHashWasm, decodeCoseP256PublicKeyWasm, encodeEip1559SignedTxFromSignature65Wasm, validateSecp256k1PublicKey33Wasm, verifySecp256k1RecoverableSignatureAgainstPublicKey33Wasm };
 
 //# sourceMappingURL=evmCryptoWasm.js.map

package/dist/esm/core/signingEngine/chains/near/display.js

@@ -229,7 +229,20 @@ function buildNearMessageDisplayModel(args) {
 		operations: [operation]
 	};
 }
+function buildNearPreparationDisplayModel(args) {
+	try {
+		return buildNearDisplayModel(args);
+	} catch {
+		return {
+			chain: "near",
+			signerAccount: args.signerAccount,
+			...args.title ? { title: args.title } : {},
+			...args.subtitle ? { subtitle: args.subtitle } : {},
+			operations: []
+		};
+	}
+}
 //#endregion
-export { buildNearDisplayModel, buildNearMessageDisplayModel };
+export { buildNearDisplayModel, buildNearMessageDisplayModel, buildNearPreparationDisplayModel };
 
 //# sourceMappingURL=display.js.map

package/dist/esm/core/signingEngine/chains/tempo/display.js

@@ -28,11 +28,6 @@ function buildAbiDecodeHint(args) {
 		abi: args.abi
 	};
 }
-function shortenHexAddress(address) {
-	const normalized = String(address || "").trim();
-	if (!/^0x[0-9a-fA-F]{40}$/.test(normalized)) return normalized;
-	return `${normalized.slice(0, 8)}...${normalized.slice(-4)}`;
-}
 function buildTempoCallDetailsOperation(args) {
 	const { rootId, call, tx } = args;
 	const to = String(call.to || "").trim();
@@ -73,7 +68,7 @@ function buildTempoCallOperation(args) {
 	const { call, callIndex, callCount, tx } = args;
 	const id = `tempo.tx.${callIndex}`;
 	const to = String(call.to || "").trim();
-	const rowLabel = `${callCount > 1 ? `Transaction ${callIndex + 1} to contract ` : "Transaction to contract "}${shortenHexAddress(to) || "unknown contract"}`;
+	const rowLabel = callCount > 1 ? `Transaction ${callIndex + 1} to contract` : "Transaction to contract";
 	const child = buildTempoCallDetailsOperation({
 		rootId: id,
 		call,

package/dist/esm/core/signingEngine/flows/recovery/ecdsaDerivationExport.js

@@ -1,12 +1,12 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, parseRouterAbEcdsaExplicitExportForwardedResponseV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { SigningSessionIds } from "../../session/operationState/types.js";
+import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { closeRouterAbEcdsaPostRegistrationCeremonyWasm, createEcdsaHolderOrdinaryExportRequestWasm, createRouterAbEcdsaPostRegistrationCeremonyWasm, finalizeEcdsaHolderOrdinaryExportWasm, finalizeRouterAbEcdsaExplicitExportWasm } from "../../threshold/crypto/ecdsaDerivationClientWasm.js";
+import { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, parseRouterAbEcdsaExplicitExportForwardedResponseV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { WALLET_SESSION_FAILURE_CODES } from "../../../../shared-ts/src/utils/walletSessionFailure.js";
 import { WalletSessionFailureError, walletSessionFailureFromCode } from "../../session/lifecycle/walletSessionFailure.js";
 import { ecdsaRoleLocalPersistedMaterialSource, resolveEcdsaRoleLocalMaterial } from "../../session/material/ecdsaRoleLocalMaterialResolver.js";
@@ -14,7 +14,7 @@ import { ecdsaRoleLocalPersistedMaterialSource, resolveEcdsaRoleLocalMaterial }
 const ECDSA_DERIVATION_EXPORT_CONFIRMATION_DIGEST_VERSION = "ecdsa-derivation:role-local:product-export-confirmation:v5";
 const ECDSA_DERIVATION_EXPORT_AUTHORIZATION_DIGEST_VERSION = "ecdsa-derivation:role-local:product-export-authorization:v5";
 const ECDSA_DERIVATION_EXPORT_AUTH_TTL_MS = 6e4;
-function exportAuthorizationWire(authorization) {
+function exportAuthorizationWire(_authorization) {
 	return { kind: "operation_step_up" };
 }
 function exportAuthorizationDigestFields(authorization) {

package/dist/esm/core/signingEngine/flows/recovery/ecdsaExportFlow.js

@@ -1,14 +1,13 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
-import { sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { sameRouterAbEcdsaDerivationNormalSigningStateV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
+import { sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { activeWalletSessionV1RecordsEqual } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { KeyExportEventPhase } from "../../../types/sdkSentEvents.js";
 import { thresholdEcdsaChainTargetKey, walletSessionRefFromSession } from "../../interfaces/ecdsaChainTarget.js";
-import { activeWalletSessionV1RecordsEqual } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
-import { resolveThresholdEcdsaSigningQueueKey } from "../../threshold/ecdsa/signingQueue.js";
+import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { sameRouterAbEcdsaDerivationNormalSigningStateV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
 import { issueEcdsaOperationStepUpAuthorization, prepareEcdsaOperationStepUp } from "../../threshold/ecdsa/operationStepUp.js";
 import { resolveActiveWalletAuthorityEcdsaRuntimeV1 } from "../../session/material/activeWalletAuthorityEcdsaRuntime.js";
 import { ecdsaExportBoundaryChain, resolveEcdsaExportMaterialForLane, resolveFreshEmailOtpEcdsaExportMaterialForLane } from "./ecdsaExportMaterial.js";
@@ -108,7 +107,7 @@ async function prepareAndShowEcdsaExportArtifact(deps, args) {
 		});
 		const materialActivation = args.exportLane.laneIdentity.signer.materialActivation;
 		const artifact = await deps.withThresholdEcdsaSigningQueue({
-			queueKey: resolveThresholdEcdsaSigningQueueKey({ materialActivation }),
+			queueKey: resolveThresholdCommitQueueKey({ materialActivation }),
 			walletId: args.exportLane.key.walletId,
 			enabled: true,
 			task: async () => {
@@ -163,7 +162,7 @@ function requirePasskeyEcdsaExportAuth(exportLane) {
 	return auth;
 }
 async function exportOperationDigest(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(value))));
+	return sha256Utf8DigestB64u(alphabetizeStringify(value));
 }
 async function prepareExplicitEcdsaExportOperationWithRuntime(args) {
 	const chainTargetKey = thresholdEcdsaChainTargetKey(args.chainTarget);

package/dist/esm/core/signingEngine/flows/recovery/ecdsaExportMaterial.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
 import { assertMatchingVerifiedEcdsaPublicFacts } from "../../session/identity/evmFamilyEcdsaIdentity.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { isConcreteAvailableSigningLane } from "../../session/availability/availableSigningLanes.js";
 import { buildPersistedEcdsaRoleLocalMaterial } from "../../session/material/ecdsaRoleLocalMaterialResolver.js";
 //#region src/core/signingEngine/flows/recovery/ecdsaExportMaterial.ts
@@ -25,26 +25,42 @@ function exactEcdsaParticipantIds(value) {
 	if (!Number.isSafeInteger(first) || !Number.isSafeInteger(second) || first <= 0 || second <= 0 || first === second) throw new Error("[SigningEngine][ecdsa-export] ECDSA participant set is invalid");
 	return [first, second];
 }
-function resolveCanonicalEmailOtpEcdsaExportMaterialForLane(args) {
-	const { exportLane } = args;
+function requireCanonicalEcdsaExportLane(args) {
+	const { exportLane, label } = args;
 	const capability = exportLane.capability;
-	if (!isEmailOtpWalletAuthAuthority(capability.authority)) throw new Error("[SigningEngine][ecdsa-export] Email OTP capability authority mismatch");
 	const signer = capability.manifest.signer;
-	if (signer.walletId !== exportLane.key.walletId || !signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, exportLane.chainTarget))) throw new Error("[SigningEngine][ecdsa-export] Email OTP capability target mismatch");
-	if (exportLane.laneIdentity.auth.kind !== "email_otp" || exportLane.laneIdentity.auth.providerSubjectId !== capability.authority.factor.providerUserId) throw new Error("[SigningEngine][ecdsa-export] Email OTP capability auth mismatch");
-	if (!mpcMaterialActivationRefsEqual(capability.manifest.activation.materialActivation, exportLane.laneIdentity.signer.materialActivation)) throw new Error("[SigningEngine][ecdsa-export] Email OTP material activation mismatch");
+	if (signer.walletId !== exportLane.key.walletId || !signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, exportLane.chainTarget))) throw new Error(`[SigningEngine][ecdsa-export] ${label} capability target mismatch`);
+	if (!args.authMatches()) throw new Error(`[SigningEngine][ecdsa-export] ${label} capability auth mismatch`);
+	if (!mpcMaterialActivationRefsEqual(capability.manifest.activation.materialActivation, exportLane.laneIdentity.signer.materialActivation)) throw new Error(`[SigningEngine][ecdsa-export] ${label} material activation mismatch`);
 	assertMatchingVerifiedEcdsaPublicFacts({
 		expected: exportLane.publicFacts,
-		actual: capability.manifest.signer.registeredPublicFacts,
-		context: "canonical Email OTP export lane"
+		actual: signer.registeredPublicFacts,
+		context: `canonical ${label} export lane`
 	});
 	const materialFacts = capability.material.publicFacts;
-	if (materialFacts.walletId !== signer.walletId || String(materialFacts.keyHandle) !== String(exportLane.publicFacts.keyHandle) || String(materialFacts.groupPublicKey33B64u) !== String(exportLane.publicFacts.publicKeyB64u) || String(materialFacts.ethereumAddress) !== String(exportLane.publicFacts.thresholdOwnerAddress) || materialFacts.participantIds.length !== exportLane.publicFacts.participantIds.length || materialFacts.participantIds.some((participantId, index) => participantId !== exportLane.publicFacts.participantIds[index])) throw new Error("[SigningEngine][ecdsa-export] canonical Email OTP export material mismatch");
+	if (materialFacts.walletId !== signer.walletId || String(materialFacts.keyHandle) !== String(exportLane.publicFacts.keyHandle) || String(materialFacts.groupPublicKey33B64u) !== String(exportLane.publicFacts.publicKeyB64u) || String(materialFacts.ethereumAddress) !== String(exportLane.publicFacts.thresholdOwnerAddress) || materialFacts.participantIds.length !== exportLane.publicFacts.participantIds.length || materialFacts.participantIds.some((participantId, index) => participantId !== exportLane.publicFacts.participantIds[index])) throw new Error(`[SigningEngine][ecdsa-export] canonical ${label} export material mismatch`);
 	const durable = capability.manifest.durableMaterial;
 	const runtimePolicyScope = durable.runtimePolicyScope;
 	const relayerUrl = String(args.deps.relayerUrl).trim().replace(/\/+$/g, "");
-	if (!runtimePolicyScope) throw new Error("[SigningEngine][ecdsa-export] Email OTP runtime policy scope is missing");
-	if (!relayerUrl) throw new Error("[SigningEngine][ecdsa-export] Email OTP export relayer URL is missing");
+	if (!runtimePolicyScope) throw new Error(`[SigningEngine][ecdsa-export] ${label} runtime policy scope is missing`);
+	if (!relayerUrl) throw new Error(`[SigningEngine][ecdsa-export] ${label} export relayer URL is missing`);
+	return {
+		durable,
+		runtimePolicyScope,
+		relayerUrl
+	};
+}
+function resolveCanonicalEmailOtpEcdsaExportMaterialForLane(args) {
+	const { exportLane } = args;
+	const capability = exportLane.capability;
+	const authority = capability.authority;
+	if (!isEmailOtpWalletAuthAuthority(authority)) throw new Error("[SigningEngine][ecdsa-export] Email OTP capability authority mismatch");
+	const { durable, runtimePolicyScope, relayerUrl } = requireCanonicalEcdsaExportLane({
+		deps: args.deps,
+		exportLane,
+		label: "Email OTP",
+		authMatches: () => exportLane.laneIdentity.auth.kind === "email_otp" && exportLane.laneIdentity.auth.providerSubjectId === authority.factor.providerUserId
+	});
 	return {
 		source: "canonical_capability",
 		kind: "fresh_email_otp_route_auth_ready",
@@ -58,30 +74,21 @@ function resolveCanonicalEmailOtpEcdsaExportMaterialForLane(args) {
 		relayerUrl,
 		authorization: {
 			kind: "fresh_operation_authorization_required",
-			authority: capability.authority
+			authority
 		}
 	};
 }
 function resolveCanonicalPasskeyEcdsaExportMaterialForLane(args) {
 	const { exportLane } = args;
 	const capability = exportLane.capability;
-	if (!isPasskeyWalletAuthAuthority(capability.authority)) throw new Error("[SigningEngine][ecdsa-export] passkey capability authority mismatch");
-	const signer = capability.manifest.signer;
-	if (signer.walletId !== exportLane.key.walletId || !signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, exportLane.chainTarget))) throw new Error("[SigningEngine][ecdsa-export] passkey capability target mismatch");
-	if (exportLane.laneIdentity.auth.kind !== "passkey" || exportLane.laneIdentity.auth.credentialIdB64u !== capability.authority.factor.credentialIdB64u) throw new Error("[SigningEngine][ecdsa-export] passkey capability auth mismatch");
-	if (!mpcMaterialActivationRefsEqual(capability.manifest.activation.materialActivation, exportLane.laneIdentity.signer.materialActivation)) throw new Error("[SigningEngine][ecdsa-export] passkey material activation mismatch");
-	assertMatchingVerifiedEcdsaPublicFacts({
-		expected: exportLane.publicFacts,
-		actual: signer.registeredPublicFacts,
-		context: "canonical passkey export lane"
+	const authority = capability.authority;
+	if (!isPasskeyWalletAuthAuthority(authority)) throw new Error("[SigningEngine][ecdsa-export] passkey capability authority mismatch");
+	const { durable, runtimePolicyScope, relayerUrl } = requireCanonicalEcdsaExportLane({
+		deps: args.deps,
+		exportLane,
+		label: "passkey",
+		authMatches: () => exportLane.laneIdentity.auth.kind === "passkey" && exportLane.laneIdentity.auth.credentialIdB64u === authority.factor.credentialIdB64u
 	});
-	const materialFacts = capability.material.publicFacts;
-	if (materialFacts.walletId !== signer.walletId || String(materialFacts.keyHandle) !== String(exportLane.publicFacts.keyHandle) || String(materialFacts.groupPublicKey33B64u) !== String(exportLane.publicFacts.publicKeyB64u) || String(materialFacts.ethereumAddress) !== String(exportLane.publicFacts.thresholdOwnerAddress) || materialFacts.participantIds.length !== exportLane.publicFacts.participantIds.length || materialFacts.participantIds.some((participantId, index) => participantId !== exportLane.publicFacts.participantIds[index])) throw new Error("[SigningEngine][ecdsa-export] canonical passkey export material mismatch");
-	const durable = capability.manifest.durableMaterial;
-	const runtimePolicyScope = durable.runtimePolicyScope;
-	const relayerUrl = String(args.deps.relayerUrl).trim().replace(/\/+$/g, "");
-	if (!runtimePolicyScope) throw new Error("[SigningEngine][ecdsa-export] passkey runtime policy scope is missing");
-	if (!relayerUrl) throw new Error("[SigningEngine][ecdsa-export] passkey export relayer URL is missing");
 	return {
 		source: "canonical_capability",
 		kind: "fresh_passkey_needs_authorization",

package/dist/esm/core/signingEngine/flows/recovery/ed25519YaoExportFlow.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
-import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { KeyExportEventPhase } from "../../../types/sdkSentEvents.js";
-import { resolveThresholdEd25519CommitQueueKey } from "../../threshold/ed25519/commitQueue.js";
+import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
 import { isExportViewerSessionOpen, removeExportViewerHostIfPresent } from "../../uiConfirm/ui/export-viewer-host.js";
 import { createExportUiRequestId, emitKeyExportEvent } from "./keyExportFlow.js";
 import { requestEmailOtpEd25519KeyExportAuthorization, showEd25519ExportViewer } from "./keyExportConfirmation.js";
@@ -204,7 +204,7 @@ async function exportEd25519YaoKeyWithFreshAuthorization(deps, args) {
 		}
 	});
 	const result = await deps.withThresholdEd25519CommitQueue({
-		queueKey: resolveThresholdEd25519CommitQueueKey({ materialActivation: passkeyEd25519ExportMaterialActivation(resolved) }),
+		queueKey: resolveThresholdCommitQueueKey({ materialActivation: passkeyEd25519ExportMaterialActivation(resolved) }),
 		nearAccountId: args.nearAccountId,
 		enabled: true,
 		task: () => deps.passkeyMpcExport.exportPrivateKeysWithUi(buildWorkerPayload({
@@ -300,7 +300,7 @@ async function exportEd25519YaoKeyWithFreshEmailOtp(deps, args) {
 			onEvent: args.onEvent
 		});
 		const artifact = await deps.withThresholdEd25519CommitQueue({
-			queueKey: resolveThresholdEd25519CommitQueueKey({ materialActivation: emailOtpEd25519ExportMaterialActivation(resolved.context) }),
+			queueKey: resolveThresholdCommitQueueKey({ materialActivation: emailOtpEd25519ExportMaterialActivation(resolved.context) }),
 			nearAccountId: args.nearAccountId,
 			enabled: resolved.context.material.kind === "active_capability",
 			task: () => deps.emailOtp.exportSeedWithFreshAuthorization({

package/dist/esm/core/signingEngine/flows/recovery/exportKeypairOperation.js

@@ -196,14 +196,11 @@ async function exportEd25519KeypairWithFlowId(deps, args) {
 		onEvent: args.options.onEvent
 	});
 }
-async function exportEd25519KeypairWithSessionLifecycle(deps, args) {
-	return await exportEd25519KeypairWithFlowId(deps, args);
-}
 async function exportKeypairWithUI(deps, input) {
 	return await runKeyExportWithFlowEvents(input, async (args) => {
 		switch (args.kind) {
 			case "ecdsa": return await exportEcdsaKeypairWithSessionLifecycle(deps, args, { kind: "initial" });
-			case "ed25519": return await exportEd25519KeypairWithSessionLifecycle(deps, args);
+			case "ed25519": return await exportEd25519KeypairWithFlowId(deps, args);
 		}
 	});
 }