@seams/wallet 0.6.2 → 0.7.3

package/dist/esm/core/signingEngine/flows/registration/services/passkeyEd25519YaoAddSigner.js

@@ -1,13 +1,10 @@
-import { computeAddSignerNearEd25519SigningKeyId, registrationNearEd25519BranchKey } from "../../../../../shared-ts/src/utils/registrationIntent.js";
-import { ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { coerceNonNullishString } from "../../../../../shared-ts/src/utils/validation.js";
+import { computeAddSignerNearEd25519SigningKeyId } from "../../../../../shared-ts/src/utils/registrationIds.js";
 import { deriveSigningRootId, normalizeRuntimePolicyScope } from "../../../../../shared-ts/src/threshold/signingRootScope.js";
+import { ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { RouterAbEd25519YaoHttpActivationTransportV1 } from "../../../threshold/ed25519/yaoClient.js";
+import { registrationNearEd25519BranchKey } from "../../../../../shared-ts/src/utils/registrationSignerPlan.js";
 //#region src/core/signingEngine/flows/registration/services/passkeyEd25519YaoAddSigner.ts
-function requireNonEmptyString(value, label) {
-	const normalized = String(value ?? "").trim();
-	if (!normalized) throw new Error(`${label} is required`);
-	return normalized;
-}
 function requireMatchingString(left, right, label) {
 	if (left !== right) throw new Error(`${label} does not match the verified add-signer intent`);
 }
@@ -15,9 +12,9 @@ function requireMatchingParticipantIds(intended, admitted) {
 	if (intended.length !== 2 || intended[0] !== admitted[0] || intended[1] !== admitted[1]) throw new Error("Yao participant IDs do not match the verified add-signer intent");
 }
 function transportConfig(input) {
-	const bearerToken = requireNonEmptyString(input.verifiedIntent.addSignerIntentGrant, "add-signer intent grant");
+	const bearerToken = coerceNonNullishString(input.verifiedIntent.addSignerIntentGrant, "add-signer intent grant");
 	return {
-		routerOrigin: requireNonEmptyString(input.httpTransport.routerOrigin, "Yao Router origin"),
+		routerOrigin: coerceNonNullishString(input.httpTransport.routerOrigin, "Yao Router origin"),
 		authorization: {
 			kind: "bearer",
 			value: `Bearer ${bearerToken}`
@@ -30,13 +27,13 @@ async function prepareVerifiedPasskeyEd25519YaoAddSignerV1(input) {
 	const selection = intent.signerSelection.ed25519;
 	requireMatchingString(String(intent.walletId), String(input.verifiedAuthority.walletId), "Passkey authority wallet ID");
 	requireMatchingString(input.verifiedIntent.addSignerIntentDigestB64u, input.verifiedAuthority.addSignerIntentDigestB64u, "Passkey authority intent digest");
-	requireNonEmptyString(input.verifiedAuthority.credentialIdB64u, "passkey credential ID");
+	coerceNonNullishString(input.verifiedAuthority.credentialIdB64u, "passkey credential ID");
 	const runtimePolicyScope = normalizeRuntimePolicyScope(intent.runtimePolicyScope);
 	const signingRootId = deriveSigningRootId(runtimePolicyScope);
 	const parsedAdmission = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(input.admissionRequest);
 	if (!parsedAdmission.ok) throw new Error(parsedAdmission.message);
 	const admission = parsedAdmission.value;
-	const ceremonyId = requireNonEmptyString(input.verifiedIntent.addSignerCeremonyId, "add-signer ceremony ID");
+	const ceremonyId = coerceNonNullishString(input.verifiedIntent.addSignerCeremonyId, "add-signer ceremony ID");
 	requireMatchingString(admission.scope.lifecycle_id, ceremonyId, "Yao lifecycle ID");
 	requireMatchingString(admission.scope.threshold_session_id, ceremonyId, "Yao Threshold Session ID");
 	requireMatchingString(admission.scope.account_id, String(intent.walletId), "Yao account ID");

package/dist/esm/core/signingEngine/flows/signEvmFamily/authPlanning.js

@@ -1,8 +1,8 @@
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { signingLaneAuthMethod } from "../../session/identity/signingLaneAuthBinding.js";
 import { SigningOperationIntent, SigningSessionPlanKind } from "../../session/operationState/types.js";
+import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { SigningAuthPlanKind } from "../../stepUpConfirmation/types.js";
 import { signingAuthPlanFromSigningSessionPlan } from "../shared/signingConfirmation.js";
 import { createEmailOtpEcdsaTransactionSigningBridge, emailOtpEcdsaCapabilityStepUpAuthority } from "./emailOtpSigningSession.js";

package/dist/esm/core/signingEngine/flows/signEvmFamily/ecdsaSelection.js

@@ -1,7 +1,7 @@
-import { isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
 import { exactEcdsaSigningLaneIdentityFromSelectedLane } from "../../session/identity/exactSigningLaneIdentity.js";
+import { isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { laneCandidateAuthMethod } from "../../session/identity/laneIdentity.js";
 import { buildEvmTransactionSigningLane, buildTempoTransactionSigningLane } from "../../session/operationState/lanes.js";
 import { logEvmFamilyEcdsaLaneDiagnostic, requireResolvedEvmFamilyEcdsaSigningLane, summarizeEvmFamilyEcdsaLane } from "./ecdsaLanes.js";

package/dist/esm/core/signingEngine/flows/signEvmFamily/emailOtpSigningSession.js

@@ -1,15 +1,15 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { isEmailOtpWalletAuthAuthority, walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { SigningEventPhase } from "../../../types/sdkSentEvents.js";
 import { buildVerifiedEcdsaPublicFacts, toEvmFamilyEcdsaKeyHandle } from "../../session/identity/evmFamilyEcdsaIdentity.js";
+import { isEmailOtpWalletAuthAuthority, walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { createSigningBoundaryTraceEvent, emitSigningBoundaryTrace } from "../../session/operationState/trace.js";
+import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
 import { demoEmailOtpCodeFromDelivery } from "../../session/emailOtp/challengeDelivery.js";
 import { buildEmailOtpRoutePlan } from "../../stepUpConfirmation/otpPrompt/authLane.js";
 import { emailOtpEcdsaSigningSessionAuthLane, resolveExactEmailOtpEcdsaSigningSessionAuthority } from "../../session/emailOtp/ecdsaSigningSessionAuthority.js";
 import { emitEvmFamilySigningEvent } from "./events.js";
 import { throwEmailOtpSigningSessionAuthStateError } from "../../session/emailOtp/routePlan.js";
-import { resolveThresholdEcdsaSigningQueueKey } from "../../threshold/ecdsa/signingQueue.js";
 //#region src/core/signingEngine/flows/signEvmFamily/emailOtpSigningSession.ts
 /** The capability is the authority. Anything the caller or the confirmation
 * plan supplies must agree with it exactly, or the OTP would be sent to a
@@ -211,7 +211,7 @@ async function refreshEmailOtpSigningSession(deps, args) {
 		chainTarget: args.chainTarget
 	})).runtime.materialActivation;
 	return await deps.withThresholdEcdsaSigningQueue({
-		queueKey: resolveThresholdEcdsaSigningQueueKey({ materialActivation: activationBeforeRefresh }),
+		queueKey: resolveThresholdCommitQueueKey({ materialActivation: activationBeforeRefresh }),
 		walletId: args.walletSession.walletId,
 		enabled: true,
 		task: runFencedEmailOtpSigningSessionRefresh.bind(void 0, {

package/dist/esm/core/signingEngine/flows/signEvmFamily/preparedSigning.js

@@ -294,13 +294,6 @@ async function prepareEvmFamilyEcdsaSigningSession(args) {
 				diagnostics: selection.diagnostics
 			});
 			const committedSelectionAuthMethod = selection.committedLane.authority.factor.kind;
-			const availableLanes = await args.deps.readAvailableSigningLanesForSigning({
-				walletId,
-				curve: "ecdsa",
-				ecdsaChainTargets: [chainTarget],
-				authMethod: committedSelectionAuthMethod,
-				ownerScope
-			});
 			emitSigningLaneResolutionTrace("evm-family", selection.lane, { reason: "evm_family_ecdsa_selection" });
 			args.diagnostics.selection = {
 				kind: selection.kind,
@@ -343,7 +336,7 @@ async function prepareEvmFamilyEcdsaSigningSession(args) {
 					expiresAtMs: readiness.expiresAtMs,
 					remainingUses: readiness.remainingUses
 				},
-				availableLanesGeneration: availableLanes.generation,
+				availableLanesGeneration: candidateAvailableLanes.generation,
 				metadata: {
 					accountAuth: selection.accountAuth,
 					authMethod: committedSelectionAuthMethod,
@@ -354,7 +347,7 @@ async function prepareEvmFamilyEcdsaSigningSession(args) {
 						...args.signingOperation.operationFingerprint ? { operationFingerprint: args.signingOperation.operationFingerprint } : {},
 						laneIdentityKey: exactSigningLaneIdentityKey(exactSigningLaneIdentityFromSelectedLane(resolvedLane))
 					},
-					availableLanesGeneration: availableLanes.generation
+					availableLanesGeneration: candidateAvailableLanes.generation
 				}
 			};
 		} }

package/dist/esm/core/signingEngine/flows/signEvmFamily/readySecp256k1Material.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { routerAbEcdsaDerivationActiveStateId } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { buildHydratedEcdsaSignerMaterial } from "../../session/identity/evmFamilyEcdsaIdentity.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { routerAbEcdsaDerivationActiveStateId } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { projectEcdsaRoleLocalPublicFactsToChainTarget } from "../../session/persistence/ecdsaRoleLocalRecords.js";
 import { authorizeEvmFamilyEcdsaSigningCapability } from "../../session/material/ecdsaSigningCapability.js";
 import { ecdsaRoleLocalPersistedMaterialSource, resolveEcdsaRoleLocalMaterial } from "../../session/material/ecdsaRoleLocalMaterialResolver.js";

package/dist/esm/core/signingEngine/flows/signEvmFamily/signEvmFamily.js

@@ -26,7 +26,6 @@ import { executeEvmFamilyTransactionSigning } from "./transactionExecutor.js";
 import { buildActiveWalletAuthorityConfirmationAuthPlan, createEvmFamilySigningFlowRuntime } from "./signingFlowRuntime.js";
 import { classifyEvmFamilyFreshAuthRetry, nextEvmFamilyFreshAuthRetrySideEffectState, runEvmFamilyFreshAuthRetry } from "./freshAuthRetryPolicy.js";
 import { resolveEvmFamilyWalletSessionExpiryContext, retryEvmFamilyWithFreshWalletSessionAuthWhenRequired } from "./freshWalletSessionRetry.js";
-import { requiredEvmFamilyRequestSignatureUses } from "./signatureUses.js";
 import { bindEvmFamilyCallerProvidedOperationIdToFingerprint, createEvmFamilySigningOperationIds, ensureEvmFamilyConfirmationOperationId } from "./operationIds.js";
 import { buildPreparedEvmFamilyExecutorThresholdEcdsaState } from "./executorThresholdState.js";
 //#region src/core/signingEngine/flows/signEvmFamily/signEvmFamily.ts
@@ -147,7 +146,6 @@ async function signEvmFamilyAttempt(deps, args, attempt) {
 		request: args.request,
 		chainTarget: args.chainTarget
 	});
-	requiredEvmFamilyRequestSignatureUses(args.request);
 	await ensureSealedRefreshStartupParityForTransactionSigning(deps.ensureSealedRefreshStartupParity, {
 		walletId,
 		chainTarget: signingTarget
@@ -259,10 +257,6 @@ async function signEvmFamilyAttempt(deps, args, attempt) {
 		if (preparedEcdsaSigningSession) return preparedEcdsaSigningSession;
 		throw new Error("[SigningEngine][ecdsa] prepared signing session is required");
 	};
-	const getEcdsaSigningLaneIdentity = () => {
-		const prepared = getPreparedEcdsaSigningSession();
-		return prepared.kind === "authorized" ? prepared.signingLane.identity : prepared.identity;
-	};
 	const getPreparedEcdsaSigningSessionIfEcdsa = () => args.request.senderSignatureAlgorithm === "secp256k1" ? getPreparedEcdsaSigningSession() : void 0;
 	const reResolveSupersededPreparation = async (error) => {
 		if (!isEvmFamilyEcdsaMaterialSupersededError(error)) return null;
@@ -326,7 +320,11 @@ async function signEvmFamilyAttempt(deps, args, attempt) {
 			walletSession: args.walletSession,
 			request: args.request,
 			chainTarget: requestChainTarget,
-			senderSignatureAlgorithm: args.request.senderSignatureAlgorithm,
+			...args.request.senderSignatureAlgorithm === "secp256k1" ? {
+				senderSignatureAlgorithm: args.request.senderSignatureAlgorithm,
+				preparedSession: getPreparedEcdsaSigningSession(),
+				...activeWalletAuthorityFlowRuntime ? { activeWalletAuthority: activeWalletAuthorityFlowRuntime } : {}
+			} : { senderSignatureAlgorithm: args.request.senderSignatureAlgorithm },
 			...signingSessionPlan ? { signingSessionPlan } : {},
 			signingOperation: createTransactionSigningOperation(),
 			onSigningOperationTransition: emitEvmFamilySigningOperationTrace,
@@ -334,9 +332,7 @@ async function signEvmFamilyAttempt(deps, args, attempt) {
 			confirmationConfigOverride: args.confirmationConfigOverride,
 			shouldAbort: args.shouldAbort,
 			onEvent: args.onEvent,
-			onAuthSideEffectStarted: markFreshAuthRetrySideEffect,
-			getEcdsaSigningLaneIdentity,
-			...activeWalletAuthorityFlowRuntime ? { activeWalletAuthority: activeWalletAuthorityFlowRuntime } : {}
+			onAuthSideEffectStarted: markFreshAuthRetrySideEffect
 		});
 		return {
 			signingAuthPlan,
@@ -353,7 +349,7 @@ async function signEvmFamilyAttempt(deps, args, attempt) {
 		if (reResolved) return reResolved;
 		throw error;
 	}
-	const { signingAuthPlan, signingSessionPlan, emailOtpSigning, flowArgs } = preparedFlow;
+	const { signingAuthPlan, emailOtpSigning, flowArgs } = preparedFlow;
 	let freshAuthRetryHandledFinalization = false;
 	const retryWithFreshWalletSessionAuth = async (error) => {
 		return await retryEvmFamilyWithFreshWalletSessionAuthWhenRequired({

package/dist/esm/core/signingEngine/flows/signEvmFamily/signEvmFamilyWithUiConfirmForTempo.js

@@ -1,9 +1,9 @@
 import { buildEvmDisplayModel } from "../../chains/evm/display/evmTx.js";
 import { buildTempoDisplayModel } from "../../chains/tempo/display.js";
 import { signEvmFamilyWithUiConfirm } from "./signingFlow.js";
-import { requiredEvmFamilyRequestSignatureUses } from "./signatureUses.js";
 import { TempoAdapter } from "../../chains/tempo/tempoAdapter.js";
 import { EvmAdapter } from "../../chains/evm/evmAdapter.js";
+import { requiredEvmFamilyRequestSignatureUses } from "./signatureUses.js";
 import { resolveWebAuthnP256KeyRefForWallet } from "./webauthnP256KeyRef.js";
 //#region src/core/signingEngine/flows/signEvmFamily/signEvmFamilyWithUiConfirmForTempo.ts
 async function signEvmFamilyWithUiConfirmForTempo(args) {

package/dist/esm/core/signingEngine/flows/signEvmFamily/signEvmWithUiConfirm.js

@@ -1,7 +1,7 @@
 import { buildEvmDisplayModel } from "../../chains/evm/display/evmTx.js";
 import { signEvmFamilyWithUiConfirm } from "./signingFlow.js";
-import { requiredEvmFamilyRequestSignatureUses } from "./signatureUses.js";
 import { EvmAdapter } from "../../chains/evm/evmAdapter.js";
+import { requiredEvmFamilyRequestSignatureUses } from "./signatureUses.js";
 //#region src/core/signingEngine/flows/signEvmFamily/signEvmWithUiConfirm.ts
 async function signEvmWithUiConfirm(args) {
 	return await signEvmFamilyWithUiConfirm({

package/dist/esm/core/signingEngine/flows/signEvmFamily/signers/ecdsaDerivationClientSigningMaterialSource.js

@@ -1,4 +1,4 @@
-import { storeEcdsaRoleLocalSigningMaterialWasm, thresholdEcdsaLinkedHolderPresignSessionInitWasm, thresholdEcdsaRoleLocalAdmitPresignatureWasm, thresholdEcdsaRoleLocalCommitPresignatureWasm, thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, thresholdEcdsaRoleLocalDestroyPresignatureWasm, thresholdEcdsaRoleLocalListAvailablePresignaturesWasm, thresholdEcdsaRoleLocalPresignSessionAbortWasm, thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, thresholdEcdsaRoleLocalPresignSessionStepWasm, thresholdEcdsaRoleLocalReservePresignatureWasm } from "../../../threshold/crypto/ecdsaDerivationClientWasm.js";
+import { storeEcdsaRoleLocalSigningMaterialWasm, thresholdEcdsaLinkedHolderPresignSessionInitWasm, thresholdEcdsaListAvailablePresignaturesWasm, thresholdEcdsaRoleLocalAdmitPresignatureWasm, thresholdEcdsaRoleLocalCommitPresignatureWasm, thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, thresholdEcdsaRoleLocalDestroyPresignatureWasm, thresholdEcdsaRoleLocalPresignSessionAbortWasm, thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, thresholdEcdsaRoleLocalPresignSessionStepWasm, thresholdEcdsaRoleLocalReservePresignatureWasm } from "../../../threshold/crypto/ecdsaDerivationClientWasm.js";
 //#region src/core/signingEngine/flows/signEvmFamily/signers/ecdsaDerivationClientSigningMaterialSource.ts
 async function ensureRoleLocalSigningMaterialLoaded(args) {
 	const material = args.clientShare.material;
@@ -18,21 +18,7 @@ async function loadRouterAbEcdsaDerivationSigningMaterialSource(args) {
 		const holderHandleId = clientShare.holderHandleId;
 		return {
 			signerSession,
-			clientSigningMaterial: {
-				kind: "router_ab_ecdsa_derivation_client_signing_material_source_v1",
-				initClientPresignSession: async (input) => await thresholdEcdsaLinkedHolderPresignSessionInitWasm({
-					holderHandleId,
-					...input
-				}),
-				stepClientPresignSession: thresholdEcdsaRoleLocalPresignSessionStepWasm,
-				abortClientPresignSession: thresholdEcdsaRoleLocalPresignSessionAbortWasm,
-				admitClientPresignature: thresholdEcdsaRoleLocalAdmitPresignatureWasm,
-				destroyClientPresignature: thresholdEcdsaRoleLocalDestroyPresignatureWasm,
-				reserveClientPresignature: thresholdEcdsaRoleLocalReservePresignatureWasm,
-				commitClientPresignature: thresholdEcdsaRoleLocalCommitPresignatureWasm,
-				listAvailableClientPresignatures: thresholdEcdsaRoleLocalListAvailablePresignaturesWasm,
-				computeSignatureShareFromPresignatureHandle: thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm
-			},
+			clientSigningMaterial: createLinkedHolderClientSigningMaterialSource(holderHandleId),
 			cleanupAfterSign: async () => void 0
 		};
 	}
@@ -64,13 +50,33 @@ async function loadRouterAbEcdsaDerivationSigningMaterialSource(args) {
 			destroyClientPresignature: thresholdEcdsaRoleLocalDestroyPresignatureWasm,
 			reserveClientPresignature: thresholdEcdsaRoleLocalReservePresignatureWasm,
 			commitClientPresignature: thresholdEcdsaRoleLocalCommitPresignatureWasm,
-			listAvailableClientPresignatures: thresholdEcdsaRoleLocalListAvailablePresignaturesWasm,
+			listAvailableClientPresignatures: thresholdEcdsaListAvailablePresignaturesWasm.bind(void 0, "role_local_derivation_handle"),
 			computeSignatureShareFromPresignatureHandle: thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm
 		},
 		cleanupAfterSign: async () => void 0
 	};
 }
+async function initLinkedHolderPresignSession(holderHandleId, input) {
+	return await thresholdEcdsaLinkedHolderPresignSessionInitWasm({
+		holderHandleId,
+		...input
+	});
+}
+function createLinkedHolderClientSigningMaterialSource(holderHandleId) {
+	return {
+		kind: "router_ab_ecdsa_derivation_client_signing_material_source_v1",
+		initClientPresignSession: initLinkedHolderPresignSession.bind(void 0, holderHandleId),
+		stepClientPresignSession: thresholdEcdsaRoleLocalPresignSessionStepWasm,
+		abortClientPresignSession: thresholdEcdsaRoleLocalPresignSessionAbortWasm,
+		admitClientPresignature: thresholdEcdsaRoleLocalAdmitPresignatureWasm,
+		destroyClientPresignature: thresholdEcdsaRoleLocalDestroyPresignatureWasm,
+		reserveClientPresignature: thresholdEcdsaRoleLocalReservePresignatureWasm,
+		commitClientPresignature: thresholdEcdsaRoleLocalCommitPresignatureWasm,
+		listAvailableClientPresignatures: thresholdEcdsaListAvailablePresignaturesWasm.bind(void 0, "linked_holder_signing_material"),
+		computeSignatureShareFromPresignatureHandle: thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm
+	};
+}
 //#endregion
-export { loadRouterAbEcdsaDerivationSigningMaterialSource };
+export { createLinkedHolderClientSigningMaterialSource, loadRouterAbEcdsaDerivationSigningMaterialSource };
 
 //# sourceMappingURL=ecdsaDerivationClientSigningMaterialSource.js.map

package/dist/esm/core/signingEngine/flows/signEvmFamily/signers/secp256k1.js

@@ -1,5 +1,5 @@
 import { routerAbMpcMaterialActivationRefToWire } from "../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseEcdsaKeyHandle } from "../../../session/keyMaterialBrands.js";
+import { parseEcdsaKeyHandle } from "../../../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS } from "../../../workerManager/ecdsaPresignLifecycle.js";
 import { emitEcdsaSigningTiming, emitSigningSessionFlowTrace } from "../../../session/operationState/trace.js";
 import { scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill, signRouterAbEcdsaDerivationDigestWithPool } from "../../../routerAb/ecdsaDerivation/presignaturePool.js";
@@ -94,7 +94,6 @@ var Secp256k1Engine = class {
 	constructor(opts) {
 		this.algorithm = "secp256k1";
 		this.beforeSigning = opts.beforeSigning;
-		this.getRpId = opts.getRpId;
 		this.shouldAbort = opts.shouldAbort;
 		this.workerCtx = opts.workerCtx;
 	}

package/dist/esm/core/signingEngine/flows/signEvmFamily/signingFlow.js

@@ -1,6 +1,6 @@
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u, sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { SigningEventPhase, createSigningFlowEvent } from "../../../types/sdkSentEvents.js";
 import { SigningSessionIds } from "../../session/operationState/types.js";
 import { normalizeAuthenticationCredential } from "../../webauthnAuth/credentials/helpers.js";
@@ -58,7 +58,7 @@ async function buildEvmFamilyOperationDigests(input) {
 	return {
 		laneDigest: parseSigningOperationFingerprintDigest(SigningSessionIds.signingOperationFingerprint(operationFingerprint)),
 		intentDigest: parseDigestB64u(base64UrlEncode(input.signingDigest32)),
-		displayDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(input.displayModel))))
+		displayDigest: await sha256Utf8DigestB64u(alphabetizeStringify(input.displayModel))
 	};
 }
 function intentDigestPreparationFromEvmIntent(args) {
@@ -299,7 +299,7 @@ async function signEvmFamilyWithUiConfirm(args) {
 	let signedResult = null;
 	let ecdsaSigningMaterialSource = null;
 	let preparedEcdsaOperationStepUp = null;
-	const ensureReadySecp256k1SigningMaterial = async (signReq, operation, operationDigests) => {
+	const ensureReadySecp256k1SigningMaterial = async (_signReq, operation, operationDigests) => {
 		if (input.resolveEcdsaSigningMaterialPlan) {
 			const plan = await input.resolveEcdsaSigningMaterialPlan();
 			switch (plan.kind) {
@@ -575,10 +575,12 @@ async function signEvmFamilyWithUiConfirm(args) {
 		signedResult = await intent.finalize(signatures);
 		thresholdSignatureCreated = true;
 		await markNonceReservationSigned();
-		if (activeThresholdEcdsaOperation) {
-			const operationId = String(activeThresholdEcdsaOperation.intent.operationId);
-			emitEcdsaSigningTiming(operationId, "transaction_assembly", assemblyStartedAt);
-			emitEcdsaSigningTiming(operationId, "commit_total", commitStartedAt);
+		let completedEcdsaOperationId = null;
+		if (activeThresholdEcdsaOperation) completedEcdsaOperationId = String(activeThresholdEcdsaOperation.intent.operationId);
+		else if (input.authorization.kind === "active_wallet_authority" && input.signingOperation) completedEcdsaOperationId = String(input.signingOperation.operationId);
+		if (completedEcdsaOperationId !== null) {
+			emitEcdsaSigningTiming(completedEcdsaOperationId, "transaction_assembly", assemblyStartedAt);
+			emitEcdsaSigningTiming(completedEcdsaOperationId, "commit_total", commitStartedAt);
 		}
 		emitProgress({
 			phase: SigningEventPhase.STEP_11_TRANSACTION_SIGNED,

package/dist/esm/core/signingEngine/flows/signEvmFamily/signingFlowRuntime.js

@@ -1,12 +1,12 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { isEd25519ExtensionOfEcdsaWalletAuthority } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { walletSessionPreservesCapabilities } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { requireEvmFamilyEcdsaSigner } from "../../session/identity/exactSigningLaneIdentity.js";
-import { walletSessionPreservesCapabilities } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
-import { exactEcdsaWalletSessionRuntimesMatch } from "../../session/material/ecdsaSigningCapability.js";
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { isEd25519ExtensionOfEcdsaWalletAuthority } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
+import { exactAuthorizationMatchesCapability, exactEcdsaWalletSessionRuntimesMatch } from "../../session/material/ecdsaSigningCapability.js";
 import { emitEvmFamilySigningOperationTrace } from "./events.js";
-import { resolveThresholdEcdsaSigningQueueKey } from "../../threshold/ecdsa/signingQueue.js";
 import { loadSecp256k1EngineCtor, loadWebAuthnP256EngineCtor } from "./signerLoader.js";
 import { attachExactEcdsaWalletSessionAuthorization, buildActiveWalletAuthorityReadySecp256k1Material, resolveHydratedSecp256k1SigningMaterial } from "./readySecp256k1Material.js";
 import { resolveExactEcdsaCapabilityRuntime } from "../../session/material/activeEcdsaCapabilityRuntime.js";
@@ -47,7 +47,8 @@ async function resolveExactEcdsaOperationStepUpSession(args) {
 	if (!capabilityMatchesOperationScope(args)) throw new Error("[SigningEngine] exact ECDSA Wallet Session material changed");
 	const ports = args.ports;
 	const selected = await ports.resolveSelectedWalletAuthority(String(args.scope.walletId));
-	if (selected.kind !== "resolved" || selected.selection.lockState !== "unlocked" || selected.selection.walletId !== args.scope.walletId || selected.authMethod.status !== "active" || selected.authMethod.walletId !== args.scope.walletId || selected.selection.walletAuthMethodId !== selected.authMethod.walletAuthMethodId || selected.authority.state !== "active" || selected.authority.walletId !== args.scope.walletId || selected.authMethod.walletAuthorityId !== selected.authority.authorityId) throw new Error("[SigningEngine] exact ECDSA Wallet Session is unavailable");
+	const selectedReason = selectedStepUpAuthorityUnavailableReason(selected, args.scope.walletId);
+	if (selectedReason || selected.kind !== "resolved") throw exactEcdsaWalletSessionUnavailable(selectedReason ?? "selected_authority_invalid");
 	const capabilityAuthority = await walletAuthAuthorityRef({ authority: args.capability.authority });
 	const manifestAuthority = args.capability.manifest.signer.authority;
 	const selectedActivation = selected.authority.signerActivations.ecdsa;
@@ -57,17 +58,46 @@ async function resolveExactEcdsaOperationStepUpSession(args) {
 		authorityId: selected.authority.authorityId,
 		authMethodId: selected.authMethod.walletAuthMethodId
 	});
-	if (read.kind !== "found") throw new Error("[SigningEngine] exact ECDSA Wallet Session is unavailable");
+	if (read.kind !== "found") throw exactEcdsaWalletSessionUnavailable(read.kind === "missing" ? "wallet_session_missing" : "wallet_session_upgrade_required");
 	const session = read.record;
-	if (session.walletId !== args.scope.walletId || session.authorityId !== selected.authority.authorityId || session.authMethodId !== selected.authMethod.walletAuthMethodId || session.authorityDigestB64u !== selected.authority.authorityDigestB64u || session.authorityRevocationEpoch !== selected.authority.revocationEpoch || session.expiresAtMs <= Date.now() || !read.operationCredential.token.trim() || !sessionAuthorizesCanonicalEcdsaCapability({
+	const sessionReason = stepUpSessionRecordUnavailableReason({
 		session,
+		operationCredential: read.operationCredential,
+		walletId: args.scope.walletId,
+		authority: selected.authority,
+		authMethod: selected.authMethod,
 		capability: args.capability
-	})) throw new Error("[SigningEngine] exact ECDSA Wallet Session is unavailable");
+	});
+	if (sessionReason) throw exactEcdsaWalletSessionUnavailable(sessionReason);
 	return {
 		credential: read.operationCredential,
 		expiresAtMs: session.expiresAtMs
 	};
 }
+function exactEcdsaWalletSessionUnavailable(reason) {
+	return /* @__PURE__ */ new Error(`[SigningEngine] exact ECDSA Wallet Session is unavailable: ${reason}`);
+}
+function selectedStepUpAuthorityUnavailableReason(selected, walletId) {
+	if (selected.kind !== "resolved") return selected.kind === "missing_selection" ? "selected_authority_missing" : "selected_authority_invalid";
+	if (selected.selection.walletId !== walletId || selected.authMethod.walletId !== walletId || selected.authority.walletId !== walletId || selected.selection.walletAuthMethodId !== selected.authMethod.walletAuthMethodId || selected.authMethod.walletAuthorityId !== selected.authority.authorityId) return "authority_identity_mismatch";
+	if (selected.selection.lockState !== "unlocked") return "wallet_locked";
+	if (selected.authMethod.status !== "active") return "auth_method_inactive";
+	if (selected.authority.state !== "active") return "authority_inactive";
+	return null;
+}
+function stepUpSessionRecordUnavailableReason(args) {
+	const { session } = args;
+	if (session.walletId !== args.walletId || session.authorityId !== args.authority.authorityId || session.authMethodId !== args.authMethod.walletAuthMethodId) return "wallet_session_identity_mismatch (authority or method)";
+	if (session.authorityDigestB64u !== args.authority.authorityDigestB64u) return "wallet_session_identity_mismatch (authority digest)";
+	if (session.authorityRevocationEpoch !== args.authority.revocationEpoch) return "wallet_session_identity_mismatch (authority revocation epoch)";
+	if (!args.operationCredential.token.trim()) return "wallet_session_identity_mismatch (operation credential)";
+	if (session.expiresAtMs <= Date.now()) return "wallet_session_expired";
+	if (!sessionAuthorizesCanonicalEcdsaCapability({
+		session,
+		capability: args.capability
+	})) return "wallet_session_capability_mismatch";
+	return null;
+}
 async function prepareSessionBoundEcdsaOperationStepUp(sessionScope, input) {
 	const session = await resolveExactEcdsaOperationStepUpSession(sessionScope);
 	return await prepareEvmFamilyEcdsaOperationStepUp({
@@ -79,7 +109,7 @@ async function prepareSessionBoundEcdsaOperationStepUp(sessionScope, input) {
 }
 async function runSerializedEcdsaMaterialUse(args, task) {
 	return await args.deps.withThresholdEcdsaSigningQueue({
-		queueKey: resolveThresholdEcdsaSigningQueueKey({ materialActivation: args.materialActivation }),
+		queueKey: resolveThresholdCommitQueueKey({ materialActivation: args.materialActivation }),
 		walletId: args.walletId,
 		enabled: true,
 		...args.shouldAbort ? { shouldAbort: args.shouldAbort } : {},
@@ -107,11 +137,11 @@ async function resolveCurrentActiveWalletAuthorityRuntime(args) {
 	if (runtime.authorityId !== args.prepared.authorityId || runtime.walletAuthMethodId !== args.prepared.walletAuthMethodId || runtime.authorityDigestB64u !== args.prepared.authorityDigestB64u || runtime.authorityRevocationEpoch !== args.prepared.authorityRevocationEpoch || runtime.walletSessionId !== args.prepared.walletSessionId || runtime.publicFacts.keyHandle !== args.signer.keyHandle) throw new Error("[SigningEngine] active Wallet Authority ECDSA runtime was replaced");
 	return runtime;
 }
-/** R90-INV-010. The wallet's active manifest names the material that may be
-* used right now. When it has moved on from the one this operation was prepared
-* against, the preparation is superseded -- material activation is advance-only,
-* so the prepared side is always the stale one. That is a re-resolution, not a
-* failure and not a request for the wrong material. */
+/** The wallet's active manifest names the material that may be used right now.
+* When it has moved on from the one this operation was prepared against, the
+* preparation is superseded -- material activation is advance-only, so the
+* prepared side is always the stale one. That is a re-resolution, not a failure
+* and not a request for the wrong material. */
 function ecdsaSigningMaterialSupersession(args) {
 	if (mpcMaterialActivationRefsEqual(args.currentMaterialActivation, args.preparedMaterialActivation)) return null;
 	return {
@@ -229,18 +259,19 @@ async function createEvmFamilySigningFlowRuntime(args) {
 	const ctx = args.deps.touchConfirm.getContext();
 	const walletId = toWalletId(args.walletSession.walletId);
 	const relayerUrl = requireEvmFamilyRelayerUrl(args.deps);
-	const resolvedSigner = args.senderSignatureAlgorithm === "secp256k1" ? requireEvmFamilyEcdsaSigner(args.getEcdsaSigningLaneIdentity(), "ECDSA signing material hydration") : void 0;
+	const resolvedSigner = args.senderSignatureAlgorithm === "secp256k1" ? requireEvmFamilyEcdsaSigner(args.preparedSession.kind === "authorized" ? args.preparedSession.signingLane.identity : args.preparedSession.identity, "ECDSA signing material hydration") : void 0;
 	if (args.activeWalletAuthority && !resolvedSigner) throw new Error("[SigningEngine] active Wallet Authority runtime requires a threshold ECDSA signer");
 	const capability = resolvedSigner && !args.activeWalletAuthority ? await args.deps.resolveCanonicalEcdsaSigningCapability({
 		walletId: resolvedSigner.walletId,
 		chainTarget: resolvedSigner.chainTarget,
 		materialActivation: resolvedSigner.materialActivation
 	}) : void 0;
-	const activeAuthorization = resolvedSigner && !args.activeWalletAuthority ? await args.deps.resolveActiveEcdsaWalletSessionAuthorization({
-		walletId: resolvedSigner.walletId,
-		chainTarget: resolvedSigner.chainTarget,
-		materialActivation: resolvedSigner.materialActivation
-	}) : null;
+	const preparedAuthorization = args.preparedSession?.kind === "authorized" ? args.preparedSession.selection.lane.authorization : null;
+	const activeAuthorization = capability && preparedAuthorization && preparedAuthorization.runtime.remainingUses > 0 && exactAuthorizationMatchesCapability({
+		capability,
+		authorization: preparedAuthorization,
+		nowMs: Date.now()
+	}) ? preparedAuthorization : null;
 	const exactOperationCredentialScope = resolvedSigner && capability && !args.activeWalletAuthority ? {
 		walletId: resolvedSigner.walletId,
 		chainTarget: resolvedSigner.chainTarget,

package/dist/esm/core/signingEngine/flows/signEvmFamily/transactionExecutor.js

@@ -13,9 +13,6 @@ function requireRawEip1559ThresholdOwnerNonceSenderIdentity(args) {
 	if (args.state.kind === "not_required") throw new Error(`[SigningEngine][evm-family] raw EIP-1559 signing requires prepared threshold ECDSA owner address for ${args.walletId}`);
 	return thresholdOwnerNonceSenderIdentity(args.state.thresholdOwnerAddress);
 }
-function resolvePreparedNonceSenderIdentity(args) {
-	return resolveThresholdOwnerNonceSenderIdentity(args);
-}
 function resolveFallbackChainAccountNonceSenderIdentity(args) {
 	return resolveWalletChainNonceSenderIdentity({
 		deps: args.deps,
@@ -70,7 +67,7 @@ async function executeEvmFamilyTransactionSigning(args) {
 			walletId: args.walletId,
 			chainTarget: args.chainTarget
 		}) : void 0;
-		const preparedSenderIdentity = resolvePreparedNonceSenderIdentity({ state: args.thresholdEcdsaState });
+		const preparedSenderIdentity = resolveThresholdOwnerNonceSenderIdentity({ state: args.thresholdEcdsaState });
 		const getSenderIdentity = (nonceArgs) => {
 			const exactSenderIdentity = rawEip1559SenderIdentity || preparedSenderIdentity;
 			if (exactSenderIdentity) return Promise.resolve(exactSenderIdentity);
@@ -109,7 +106,7 @@ async function executeEvmFamilyTransactionSigning(args) {
 		});
 	}
 	let tempoFallbackSenderIdentityPromise = null;
-	const tempoPreparedSenderIdentity = resolvePreparedNonceSenderIdentity({ state: args.thresholdEcdsaState });
+	const tempoPreparedSenderIdentity = resolveThresholdOwnerNonceSenderIdentity({ state: args.thresholdEcdsaState });
 	const getTempoSenderIdentity = (nonceArgs) => {
 		if (tempoPreparedSenderIdentity) return Promise.resolve(tempoPreparedSenderIdentity);
 		if (!tempoFallbackSenderIdentityPromise) tempoFallbackSenderIdentityPromise = resolveFallbackChainAccountNonceSenderIdentity({

package/dist/esm/core/signingEngine/flows/signNear/shared/ed25519YaoNormalSigning.js

@@ -1,9 +1,9 @@
 import { parseCapabilityId, parseCapabilityOperationId, parsePrincipalId, parseTenantId } from "../../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { base64UrlDecode, base64UrlEncode } from "../../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Decode } from "../../../../../shared-ts/src/utils/base58.js";
 import { ensureEd25519Prefix } from "../../../../../shared-ts/src/utils/near.js";
 import "../../../../../shared-ts/src/utils/validation.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { resolveNearNetwork } from "../../../../config/chains.js";
 import { SigningSessionIds } from "../../../session/operationState/types.js";
 import { ActionType, fromActionArgsWasm } from "../../../../../shared-ts/src/near/actions.js";