@seams/wallet 0.6.2 → 0.7.3

package/dist/esm/core/signingEngine/session/public.js

@@ -29,7 +29,7 @@ async function discoverPersistedSessionsForWallet(deps, args) {
 async function readPersistedAvailableSigningLanes(deps, args) {
 	return await readPersistedAvailableSigningLanes$1(deps.availableLanes, args, deps.getConfiguredEcdsaChainTargets());
 }
-/** R103C human operational read: one exact owner, configured ECDSA targets. */
+/** Human operational read: one exact owner, configured ECDSA targets. */
 async function readOwnerScopedSigningLanes(deps, args, statusReads) {
 	return await readOwnerScopedAvailableSigningLanes(deps.availableLanes, {
 		walletId: args.walletId,

package/dist/esm/core/signingEngine/session/sealedRecovery/recoveryRecord.js

@@ -1,9 +1,9 @@
-import { signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { buildPasskeyWalletAuthAuthority, parseEmailOtpWalletAuthAuthority, parseWalletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { thresholdEcdsaChainTargetFromRequest } from "../../interfaces/ecdsaChainTarget.js";
+import { signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { normalizeThresholdRuntimePolicyScope } from "../../threshold/sessionPolicy.js";
 import { parseEcdsaRoleLocalPersistedMaterialRef } from "../keyMaterialBrands.js";
+import { buildPasskeyWalletAuthAuthority, parseEmailOtpWalletAuthAuthority, parseWalletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 //#region src/core/signingEngine/session/sealedRecovery/recoveryRecord.ts
 function normalizeNonEmptyString(value) {
 	return String(value ?? "").trim() || null;

package/dist/esm/core/signingEngine/session/warmCapabilities/capabilityReaderCore.js

@@ -34,7 +34,7 @@ async function resolveEcdsaAuthorizationForResolution(args) {
 }
 /** The PRF claim for a resolved ECDSA capability. Correlation has already proved
 * the material, so the claim is the sealed runtime's own allowance and expiry --
-* the same facts the shared Refactor 92 rule classifies. A blocked resolution
+* the same facts the shared runtime-policy rule classifies. A blocked resolution
 * has no runtime and so no claim to report.
 *
 * The wallet-scoped relayer claim is not consulted here. It is read by lane, and

package/dist/esm/core/signingEngine/session/warmCapabilities/ecdsaLoginPrefill.js

@@ -1,5 +1,6 @@
 import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaThresholdKeyId } from "../keyMaterialBrands.js";
+import { parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";
+import { parseEcdsaThresholdKeyId } from "../keyMaterialBrands.js";
 import { MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS } from "../../workerManager/ecdsaPresignLifecycle.js";
 import { resolveRouterAbEcdsaDerivationPresignaturePoolPolicy, scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill, waitForRouterAbEcdsaDerivationClientPresignaturePoolReady } from "../../routerAb/ecdsaDerivation/presignaturePool.js";
 //#region src/core/signingEngine/session/warmCapabilities/ecdsaLoginPrefill.ts

package/dist/esm/core/signingEngine/session/warmCapabilities/ecdsaLoginPrefillSigningMaterialSource.js

@@ -1,4 +1,4 @@
-import { thresholdEcdsaRoleLocalAdmitPresignatureWasm, thresholdEcdsaRoleLocalCommitPresignatureWasm, thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, thresholdEcdsaRoleLocalDestroyPresignatureWasm, thresholdEcdsaRoleLocalListAvailablePresignaturesWasm, thresholdEcdsaRoleLocalPresignSessionAbortWasm, thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, thresholdEcdsaRoleLocalPresignSessionStepWasm, thresholdEcdsaRoleLocalReservePresignatureWasm } from "../../threshold/crypto/ecdsaDerivationClientWasm.js";
+import { thresholdEcdsaListAvailablePresignaturesWasm, thresholdEcdsaRoleLocalAdmitPresignatureWasm, thresholdEcdsaRoleLocalCommitPresignatureWasm, thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, thresholdEcdsaRoleLocalDestroyPresignatureWasm, thresholdEcdsaRoleLocalPresignSessionAbortWasm, thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, thresholdEcdsaRoleLocalPresignSessionStepWasm, thresholdEcdsaRoleLocalReservePresignatureWasm } from "../../threshold/crypto/ecdsaDerivationClientWasm.js";
 import { ecdsaRoleLocalPersistedMaterialSource, resolveEcdsaRoleLocalMaterial } from "../material/ecdsaRoleLocalMaterialResolver.js";
 //#region src/core/signingEngine/session/warmCapabilities/ecdsaLoginPrefillSigningMaterialSource.ts
 function requireResolvedLoginPrefillMaterial(resolution) {
@@ -40,7 +40,7 @@ function createEcdsaLoginPrefillClientSigningMaterialSource(args) {
 		destroyClientPresignature: thresholdEcdsaRoleLocalDestroyPresignatureWasm,
 		reserveClientPresignature: thresholdEcdsaRoleLocalReservePresignatureWasm,
 		commitClientPresignature: thresholdEcdsaRoleLocalCommitPresignatureWasm,
-		listAvailableClientPresignatures: thresholdEcdsaRoleLocalListAvailablePresignaturesWasm,
+		listAvailableClientPresignatures: thresholdEcdsaListAvailablePresignaturesWasm.bind(void 0, "role_local_derivation_handle"),
 		computeSignatureShareFromPresignatureHandle: thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm
 	};
 }

package/dist/esm/core/signingEngine/session/warmCapabilities/ecdsaProvisionPlan.js

@@ -1,4 +1,3 @@
-import "../../../../shared-ts/src/threshold/participants.js";
 import { SigningSessionIds } from "../operationState/types.js";
 //#region src/core/signingEngine/session/warmCapabilities/ecdsaProvisionPlan.ts
 function buildEcdsaSessionIdentity(args) {

package/dist/esm/core/signingEngine/session/warmCapabilities/ed25519SealedSessionRuntime.js

@@ -1,15 +1,15 @@
-import { nearEd25519SigningKeyIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { parseEmailOtpWalletAuthAuthority, parsePasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { toAccountId } from "../../../types/accountIds.js";
 import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
+import { nearEd25519SigningKeyIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
+import { signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { SigningSessionIds } from "../operationState/types.js";
 import { toRpId } from "../identity/evmFamilyEcdsaIdentity.js";
 import { normalizeThresholdRuntimePolicyScope } from "../../threshold/sessionPolicy.js";
 import { parseSignerSlot } from "../../../../shared-ts/src/utils/signerSlot.js";
+import { parseEmailOtpWalletAuthAuthority, parsePasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { nearEd25519SessionMatchesMaterialActivation } from "../material/nearEd25519YaoSigningPreparation.js";
 import { listExactSealedSessionsForWallet } from "../persistence/sealedSessionStore.js";
 //#region src/core/signingEngine/session/warmCapabilities/ed25519SealedSessionRuntime.ts

package/dist/esm/core/signingEngine/session/warmCapabilities/nearEd25519CapabilityRehydration.js

@@ -2,8 +2,8 @@ import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/
 import { signingLaneAuthBindingKey } from "../identity/signingLaneAuthBinding.js";
 import { SigningSessionIds } from "../operationState/types.js";
 import { exactEd25519SigningLaneIdentity, exactSigningLaneIdentityKey, exactSigningLaneIdentityMatches, nearEd25519SignerBindingFromBoundaryFields } from "../identity/exactSigningLaneIdentity.js";
-import { isConcreteAvailableSigningLane } from "../availability/availableSigningLanes.js";
 import { materialActivationKey } from "../sealedRecovery/materialActivationKey.js";
+import { isConcreteAvailableSigningLane } from "../availability/availableSigningLanes.js";
 //#region src/core/signingEngine/session/warmCapabilities/nearEd25519CapabilityRehydration.ts
 function exactEd25519LaneIdentityFromAvailableLane(lane) {
 	if (!lane.authorization) throw new Error("Available Ed25519 lane requires Wallet Session authorization");

package/dist/esm/core/signingEngine/session/warmCapabilities/routerAbEd25519WalletSessionState.js

@@ -1,7 +1,7 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { signingLaneAuthMethod } from "../identity/signingLaneAuthBinding.js";
 import { SigningSessionIds } from "../operationState/types.js";
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { buildNearTransactionSigningLane } from "../operationState/lanes.js";
 import { requiredSigningSubjectForExactSigningLane, resolveExactWalletSessionOperationCredential } from "../identity/exactWalletSessionCredential.js";
 import { buildRouterAbEd25519SigningWalletSession } from "../routerAbSigningWalletSession.js";

package/dist/esm/core/signingEngine/session/warmCapabilities/types.js

@@ -1,4 +1,3 @@
-import "../../../../shared-ts/src/utils/signerDomain.js";
 import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
 import { signingLaneAuthMethod } from "../identity/signingLaneAuthBinding.js";
 import { laneCandidateStateFromRuntimePolicy } from "../identity/laneIdentity.js";

package/dist/esm/core/signingEngine/session/warmCapabilities/volatileWarmMaterialCommands.js

@@ -1,10 +1,8 @@
 import { parseThresholdSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { asRecordOrArray } from "../../../../shared-ts/src/utils/validation.js";
 //#region src/core/signingEngine/session/warmCapabilities/volatileWarmMaterialCommands.ts
-function asRecord(value) {
-	return typeof value === "object" && value !== null ? value : null;
-}
 function parseVolatileWarmSessionScope(value) {
-	const raw = asRecord(value);
+	const raw = asRecordOrArray(value);
 	if (!raw) return null;
 	if (raw.kind === "all") return { kind: "all" };
 	if (raw.kind !== "session") return null;
@@ -16,7 +14,7 @@ function parseVolatileWarmSessionScope(value) {
 	};
 }
 function parseClearVolatileWarmMaterialCommand(value) {
-	const raw = asRecord(value);
+	const raw = asRecordOrArray(value);
 	if (!raw || raw.kind !== "clear_volatile_warm_material") return null;
 	if (raw.durableRecord != null || raw.resolvedIdentity != null || raw.deleteReason != null) return null;
 	const scope = parseVolatileWarmSessionScope(raw.scope);

package/dist/esm/core/signingEngine/stepUpConfirmation/passkeyPrompt/touchIdPrompt.js

@@ -1,6 +1,6 @@
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { secureRandomBase36 } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { getPrfFirstSaltV1, getPrfSecondSaltV1, serializeAuthenticationCredentialWithPRF } from "../../webauthnAuth/credentials/helpers.js";
 import { executeWebAuthnWithParentFallbacksSafari } from "../../webauthnAuth/fallbacks/safari-fallbacks.js";
@@ -30,9 +30,8 @@ function requireExpectedPasskeyRegistrationUser(input) {
 * and generates credentials, and PRF Outputs
 */
 var TouchIdPrompt = class TouchIdPrompt {
-	constructor(rpIdOverride, safariGetWebauthnRegistrationFallback = false) {
+	constructor(rpIdOverride, _safariGetWebauthnRegistrationFallback = false) {
 		this.rpIdOverride = rpIdOverride;
-		this.safariGetWebauthnRegistrationFallback = safariGetWebauthnRegistrationFallback === true;
 	}
 	getRpId() {
 		try {

package/dist/esm/core/signingEngine/threshold/commitQueueShared.js

@@ -8,6 +8,11 @@ function normalizeQueueLimit(value, fallback) {
 		min: 1
 	});
 }
+function thresholdCommitQueueError(code, message) {
+	const err = /* @__PURE__ */ new Error(`[SigningEngine] ${message}`);
+	err.code = code;
+	return err;
+}
 function getOrCreateQueueState(queueByKey, queueKey) {
 	const existing = queueByKey.get(queueKey);
 	if (existing) return existing;
@@ -63,14 +68,23 @@ function clearThresholdCommitQueue(queueByKey) {
 	}
 	queueByKey.clear();
 }
+function resolveThresholdCommitQueueKey(args) {
+	return [
+		"material",
+		encodeURIComponent(String(args.materialActivation.materialOwner)),
+		encodeURIComponent(String(args.materialActivation.capability)),
+		encodeURIComponent(String(args.materialActivation.activationId))
+	].join(":");
+}
 async function withThresholdCommitQueue(args) {
-	if (!args.enabled) return await args.task();
+	const { labels, owner } = args;
 	const queueKey = String(args.queueKey || "").trim();
-	if (!queueKey) throw new Error("[SigningEngine] threshold commit queue requires non-empty queueKey");
+	if (!queueKey) throw new Error(`[SigningEngine] ${labels.queue} requires non-empty queueKey`);
+	if (!args.enabled) return await args.task();
 	const maxQueueLength = normalizeQueueLimit(args.maxQueueLength, DEFAULT_MAX_QUEUE_LENGTH);
 	const queueTimeoutMs = normalizeQueueLimit(args.queueTimeoutMs, DEFAULT_QUEUE_TIMEOUT_MS);
 	const state = getOrCreateQueueState(args.queueByKey, queueKey);
-	if (state.items.length + (state.running ? 1 : 0) >= maxQueueLength) throw args.errors.makeOverflowError(queueKey, maxQueueLength);
+	if (state.items.length + (state.running ? 1 : 0) >= maxQueueLength) throw thresholdCommitQueueError("commit_queue_overflow", `${labels.queue} overflow for ${owner} (queueKey=${queueKey}, max=${maxQueueLength})`);
 	return await new Promise((resolve, reject) => {
 		let timeoutHandle = null;
 		let settled = false;
@@ -91,8 +105,8 @@ async function withThresholdCommitQueue(args) {
 			clearTimeoutHandle();
 			resolve(value);
 		};
-		const makeCancelledError = (reason) => args.errors.makeCancelledError(queueKey, reason);
-		const makeTimeoutError = (timeoutMs) => args.errors.makeTimeoutError(queueKey, timeoutMs);
+		const makeCancelledError = (reason) => thresholdCommitQueueError("cancelled", `${labels.queuedOperation} cancelled for ${owner} (queueKey=${queueKey}${reason === "queue_cleared" ? ", queue_cleared" : ""})`);
+		const makeTimeoutError = (timeoutMs) => thresholdCommitQueueError("commit_queue_timeout", `${labels.queue} timeout for ${owner} (queueKey=${queueKey}, waited>${timeoutMs}ms before start)`);
 		const item = {
 			enqueuedAtMs: Date.now(),
 			timeoutMs: queueTimeoutMs,
@@ -120,6 +134,6 @@ async function withThresholdCommitQueue(args) {
 	});
 }
 //#endregion
-export { clearThresholdCommitQueue, withThresholdCommitQueue };
+export { clearThresholdCommitQueue, resolveThresholdCommitQueueKey, withThresholdCommitQueue };
 
 //# sourceMappingURL=commitQueueShared.js.map

package/dist/esm/core/signingEngine/threshold/crypto/ecdsaDerivationClientWasm.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { executeWorkerOperation } from "../../workerManager/executeWorkerOperation.js";
 import { EcdsaDerivationClientCustomRequestType, EcdsaDerivationClientCustomResponseType, EcdsaOnlineClientRequestType, EcdsaOnlineClientResponseType, EcdsaPresignClientRequestType, EcdsaPresignClientResponseType } from "../../workerManager/workerTypes.js";
 import { parseEcdsaRoleLocalPersistedMaterialRef, parseEcdsaRoleLocalWorkerHandle } from "../../session/keyMaterialBrands.js";
+import { parseWalletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 //#region src/core/signingEngine/threshold/crypto/ecdsaDerivationClientWasm.ts
 const ECDSA_DERIVATION_CLIENT_WORKER_TIMEOUT_MS = 2e4;
 function parseListedClientPresignature(ref) {
@@ -266,7 +266,8 @@ async function prepareLinkedDeviceEcdsaSourceContributionWasm(input) {
 			timeoutMs: ECDSA_DERIVATION_CLIENT_WORKER_TIMEOUT_MS,
 			payload: {
 				kind: "prepare_linked_device_ecdsa_source_contribution_v1",
-				preparation: input.preparation
+				preparation: input.preparation,
+				...input.linkedHolderHandleId === void 0 ? {} : { linkedHolderHandleId: input.linkedHolderHandleId }
 			}
 		}
 	});
@@ -563,16 +564,19 @@ async function thresholdEcdsaRoleLocalCommitPresignatureWasm(input) {
 		}
 	})).type !== EcdsaPresignClientResponseType.CommitSuccess) throw new Error("ThresholdEcdsaRoleLocalCommitPresignature failed");
 }
-async function thresholdEcdsaRoleLocalListAvailablePresignaturesWasm(input) {
+async function thresholdEcdsaListAvailablePresignaturesWasm(authorityKind, input) {
 	const response = await requestEcdsaPresignOperation({
 		workerCtx: input.workerCtx,
 		request: {
 			type: EcdsaPresignClientRequestType.ListAvailable,
 			timeoutMs: ECDSA_DERIVATION_CLIENT_WORKER_TIMEOUT_MS,
-			payload: { poolIdentity: input.poolIdentity }
+			payload: {
+				authority: { kind: authorityKind },
+				poolIdentity: input.poolIdentity
+			}
 		}
 	});
-	if (response.type !== EcdsaPresignClientResponseType.ListAvailableSuccess) throw new Error("ThresholdEcdsaRoleLocalListAvailablePresignatures failed");
+	if (response.type !== EcdsaPresignClientResponseType.ListAvailableSuccess) throw new Error("ThresholdEcdsaListAvailablePresignatures failed");
 	return response.payload.map(parseListedClientPresignature);
 }
 async function thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm(input) {
@@ -610,6 +614,6 @@ async function thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandl
 	return new Uint8Array(response.payload);
 }
 //#endregion
-export { clearLinkedDeviceEcdsaHolderMaterialsWasm, closeRouterAbEcdsaPostRegistrationCeremonyWasm, closeRouterAbEcdsaRegistrationCeremonyWasm, createEcdsaHolderOrdinaryExportRequestWasm, createRouterAbEcdsaPostRegistrationCeremonyWasm, createRouterAbEcdsaRegistrationCeremonyWasm, destroyLinkedDeviceEcdsaHolderMaterialWasm, destroyLinkedDeviceEcdsaHolderMaterialsWasm, finalizeEcdsaClientBootstrapCommandWasm, finalizeEcdsaHolderOrdinaryExportWasm, finalizeRouterAbEcdsaExplicitExportWasm, finalizeRouterAbEcdsaRegistrationActivationWasm, openEcdsaRoleLocalSigningMaterialWasm, persistInitialCanonicalEcdsaActivationWasm, prepareEcdsaClientBootstrapCommandWasm, prepareLinkedDeviceEcdsaSourceContributionWasm, reconcileCanonicalEcdsaActivationWasm, signWalletRecoveryEcdsaMaterialPossessionProofWasm, storeEcdsaRoleLocalSigningMaterialWasm, storeLinkedDeviceEcdsaHolderMaterialWasm, thresholdEcdsaLinkedHolderPresignSessionInitWasm, thresholdEcdsaRoleLocalAdmitPresignatureWasm, thresholdEcdsaRoleLocalCommitPresignatureWasm, thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, thresholdEcdsaRoleLocalDestroyPresignatureWasm, thresholdEcdsaRoleLocalListAvailablePresignaturesWasm, thresholdEcdsaRoleLocalPresignSessionAbortWasm, thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, thresholdEcdsaRoleLocalPresignSessionStepWasm, thresholdEcdsaRoleLocalReservePresignatureWasm, verifyRouterAbEcdsaRegistrationClientProofsWasm };
+export { clearLinkedDeviceEcdsaHolderMaterialsWasm, closeRouterAbEcdsaPostRegistrationCeremonyWasm, closeRouterAbEcdsaRegistrationCeremonyWasm, createEcdsaHolderOrdinaryExportRequestWasm, createRouterAbEcdsaPostRegistrationCeremonyWasm, createRouterAbEcdsaRegistrationCeremonyWasm, destroyLinkedDeviceEcdsaHolderMaterialWasm, destroyLinkedDeviceEcdsaHolderMaterialsWasm, finalizeEcdsaClientBootstrapCommandWasm, finalizeEcdsaHolderOrdinaryExportWasm, finalizeRouterAbEcdsaExplicitExportWasm, finalizeRouterAbEcdsaRegistrationActivationWasm, openEcdsaRoleLocalSigningMaterialWasm, persistInitialCanonicalEcdsaActivationWasm, prepareEcdsaClientBootstrapCommandWasm, prepareLinkedDeviceEcdsaSourceContributionWasm, reconcileCanonicalEcdsaActivationWasm, signWalletRecoveryEcdsaMaterialPossessionProofWasm, storeEcdsaRoleLocalSigningMaterialWasm, storeLinkedDeviceEcdsaHolderMaterialWasm, thresholdEcdsaLinkedHolderPresignSessionInitWasm, thresholdEcdsaListAvailablePresignaturesWasm, thresholdEcdsaRoleLocalAdmitPresignatureWasm, thresholdEcdsaRoleLocalCommitPresignatureWasm, thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, thresholdEcdsaRoleLocalDestroyPresignatureWasm, thresholdEcdsaRoleLocalPresignSessionAbortWasm, thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, thresholdEcdsaRoleLocalPresignSessionStepWasm, thresholdEcdsaRoleLocalReservePresignatureWasm, verifyRouterAbEcdsaRegistrationClientProofsWasm };
 
 //# sourceMappingURL=ecdsaDerivationClientWasm.js.map

package/dist/esm/core/signingEngine/threshold/crypto/ed25519YaoLaneWasm.js

@@ -1,6 +1,6 @@
-import "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import "../../../../shared-ts/src/signing-lanes/rotationParsers.js";
 import "../../../../shared-ts/src/signing-lanes/rotationDigests.js";
+import "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { executeWorkerOperation } from "../../workerManager/executeWorkerOperation.js";
 //#region src/core/signingEngine/threshold/crypto/ed25519YaoLaneWasm.ts
 function requestJson(value) {

package/dist/esm/core/signingEngine/threshold/ecdsa/activation.js

@@ -1,8 +1,9 @@
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { parseRouterAbEcdsaOperationStepUpPreparationV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { thresholdEcdsaChainTargetKey, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { deriveEvmFamilyKeyFingerprint } from "../../session/identity/evmFamilyEcdsaIdentity.js";
-import { parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEcdsaThresholdKeyId } from "../../session/keyMaterialBrands.js";
+import { parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";
+import { parseEcdsaThresholdKeyId } from "../../session/keyMaterialBrands.js";
+import { parseRouterAbEcdsaOperationStepUpPreparationV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { buildEcdsaRoleLocalEmailOtpAuthMethod, buildEcdsaRoleLocalPasskeyAuthMethod, buildEcdsaRoleLocalPublicFacts } from "../../session/persistence/ecdsaRoleLocalRecords.js";
 import { bootstrapEcdsaSession } from "./bootstrapSession.js";
 //#region src/core/signingEngine/threshold/ecdsa/activation.ts

package/dist/esm/core/signingEngine/threshold/ecdsa/signingQueue.js

@@ -1,58 +1,16 @@
-import { clearThresholdCommitQueue, withThresholdCommitQueue } from "../commitQueueShared.js";
+import { withThresholdCommitQueue } from "../commitQueueShared.js";
 //#region src/core/signingEngine/threshold/ecdsa/signingQueue.ts
-function ecdsaSigningQueueWalletIdLabel(walletId) {
-	return String(walletId).trim();
-}
-function createThresholdEcdsaSigningQueueOverflowError(walletId, queueKey, maxQueueLength) {
-	const normalizedWalletId = ecdsaSigningQueueWalletIdLabel(walletId);
-	const err = /* @__PURE__ */ new Error(`[SigningEngine] threshold ECDSA signing queue overflow for ${normalizedWalletId} (queueKey=${queueKey}, max=${maxQueueLength})`);
-	err.code = "commit_queue_overflow";
-	return err;
-}
-function createThresholdEcdsaSigningQueueTimeoutError(walletId, queueKey, timeoutMs) {
-	const normalizedWalletId = ecdsaSigningQueueWalletIdLabel(walletId);
-	const err = /* @__PURE__ */ new Error(`[SigningEngine] threshold ECDSA signing queue timeout for ${normalizedWalletId} (queueKey=${queueKey}, waited>${timeoutMs}ms before start)`);
-	err.code = "commit_queue_timeout";
-	return err;
-}
-function createThresholdEcdsaSigningQueueCancelledError(walletId, queueKey, reason = "cancelled") {
-	const normalizedWalletId = ecdsaSigningQueueWalletIdLabel(walletId);
-	const message = reason === "queue_cleared" ? `[SigningEngine] threshold ECDSA queued signing operation cancelled for ${normalizedWalletId} (queueKey=${queueKey}, queue_cleared)` : `[SigningEngine] threshold ECDSA queued signing operation cancelled for ${normalizedWalletId} (queueKey=${queueKey})`;
-	const err = new Error(message);
-	err.code = "cancelled";
-	return err;
-}
-function resolveThresholdEcdsaSigningQueueKey(args) {
-	return [
-		"material",
-		encodeURIComponent(String(args.materialActivation.materialOwner)),
-		encodeURIComponent(String(args.materialActivation.capability)),
-		encodeURIComponent(String(args.materialActivation.activationId))
-	].join(":");
-}
-function clearThresholdEcdsaSigningQueue(queueByKey) {
-	clearThresholdCommitQueue(queueByKey);
-}
 async function withThresholdEcdsaSigningQueue(args) {
-	const queueKey = String(args.queueKey || "").trim();
-	if (!queueKey) throw new Error("[SigningEngine] threshold ECDSA signing queue requires non-empty queueKey");
-	const walletKey = args.walletId;
 	return await withThresholdCommitQueue({
-		queueByKey: args.queueByKey,
-		queueKey,
-		enabled: args.enabled,
-		shouldAbort: args.shouldAbort,
-		maxQueueLength: args.maxQueueLength,
-		queueTimeoutMs: args.queueTimeoutMs,
-		task: args.task,
-		errors: {
-			makeOverflowError: (queueKey, maxQueueLength) => createThresholdEcdsaSigningQueueOverflowError(walletKey, queueKey, maxQueueLength),
-			makeTimeoutError: (queueKey, timeoutMs) => createThresholdEcdsaSigningQueueTimeoutError(walletKey, queueKey, timeoutMs),
-			makeCancelledError: (queueKey, reason) => createThresholdEcdsaSigningQueueCancelledError(walletKey, queueKey, reason)
-		}
+		...args,
+		labels: {
+			queue: "threshold ECDSA signing queue",
+			queuedOperation: "threshold ECDSA queued signing operation"
+		},
+		owner: String(args.walletId).trim()
 	});
 }
 //#endregion
-export { clearThresholdEcdsaSigningQueue, resolveThresholdEcdsaSigningQueueKey, withThresholdEcdsaSigningQueue };
+export { withThresholdEcdsaSigningQueue };
 
 //# sourceMappingURL=signingQueue.js.map

package/dist/esm/core/signingEngine/threshold/ed25519/commitQueue.js

@@ -1,52 +1,16 @@
 import { withThresholdCommitQueue } from "../commitQueueShared.js";
 //#region src/core/signingEngine/threshold/ed25519/commitQueue.ts
-function createThresholdEd25519CommitQueueOverflowError(nearAccountId, queueKey, maxQueueLength) {
-	const accountId = String(nearAccountId);
-	const err = /* @__PURE__ */ new Error(`[SigningEngine] threshold Ed25519 commit queue overflow for ${accountId} (queueKey=${queueKey}, max=${maxQueueLength})`);
-	err.code = "commit_queue_overflow";
-	return err;
-}
-function createThresholdEd25519CommitQueueTimeoutError(nearAccountId, queueKey, timeoutMs) {
-	const accountId = String(nearAccountId);
-	const err = /* @__PURE__ */ new Error(`[SigningEngine] threshold Ed25519 commit queue timeout for ${accountId} (queueKey=${queueKey}, waited>${timeoutMs}ms before start)`);
-	err.code = "commit_queue_timeout";
-	return err;
-}
-function createThresholdEd25519CommitQueueCancelledError(nearAccountId, queueKey, reason = "cancelled") {
-	const accountId = String(nearAccountId);
-	const message = reason === "queue_cleared" ? `[SigningEngine] threshold Ed25519 queued commit cancelled for ${accountId} (queueKey=${queueKey}, queue_cleared)` : `[SigningEngine] threshold Ed25519 queued commit cancelled for ${accountId} (queueKey=${queueKey})`;
-	const err = new Error(message);
-	err.code = "cancelled";
-	return err;
-}
-function resolveThresholdEd25519CommitQueueKey(args) {
-	return [
-		"material",
-		encodeURIComponent(String(args.materialActivation.materialOwner)),
-		encodeURIComponent(String(args.materialActivation.capability)),
-		encodeURIComponent(String(args.materialActivation.activationId))
-	].join(":");
-}
 async function withThresholdEd25519CommitQueue(args) {
-	const queueKey = String(args.queueKey || "").trim();
-	if (!queueKey) throw new Error("[SigningEngine] threshold Ed25519 commit queue requires non-empty queueKey");
-	const accountKey = String(args.nearAccountId);
 	return await withThresholdCommitQueue({
-		queueByKey: args.queueByKey,
-		queueKey,
-		enabled: args.enabled,
-		shouldAbort: args.shouldAbort,
-		maxQueueLength: args.maxQueueLength,
-		queueTimeoutMs: args.queueTimeoutMs,
-		task: args.task,
-		errors: {
-			makeOverflowError: (queueKey, maxQueueLength) => createThresholdEd25519CommitQueueOverflowError(accountKey, queueKey, maxQueueLength),
-			makeTimeoutError: (queueKey, timeoutMs) => createThresholdEd25519CommitQueueTimeoutError(accountKey, queueKey, timeoutMs),
-			makeCancelledError: (queueKey, reason) => createThresholdEd25519CommitQueueCancelledError(accountKey, queueKey, reason)
-		}
+		...args,
+		labels: {
+			queue: "threshold Ed25519 commit queue",
+			queuedOperation: "threshold Ed25519 queued commit"
+		},
+		owner: String(args.nearAccountId)
 	});
 }
 //#endregion
-export { resolveThresholdEd25519CommitQueueKey, withThresholdEd25519CommitQueue };
+export { withThresholdEd25519CommitQueue };
 
 //# sourceMappingURL=commitQueue.js.map

package/dist/esm/core/signingEngine/threshold/ed25519/connectSession.js

@@ -1,6 +1,6 @@
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { SigningSessionIds } from "../../session/operationState/types.js";
 import { buildEd25519SessionPolicy } from "../sessionPolicy.js";
+import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { buildThresholdEd25519WebAuthnPrfSecretSource, localPrfFirstForEd25519WalletSessionMintAuthorization, mintEd25519WalletSession } from "./walletSession.js";
 import { collectAuthenticationCredentialForChallengeB64u } from "../../webauthnAuth/credentials/collectAuthenticationCredentialForChallengeB64u.js";
 //#region src/core/signingEngine/threshold/ed25519/connectSession.ts

package/dist/esm/core/signingEngine/threshold/ed25519/walletSession.js

@@ -1,9 +1,9 @@
 import { parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { normalizeTrimmedString, stripTrailingSlashes } from "../../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
-import { parseWalletSessionOperationCredentialV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseWalletSessionOperationCredentialV1 } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { buildBearerAuthorizationHeader, buildRelayerJsonPostRequestInit } from "../../../rpcClients/relayer/relayerHttp.js";
 import { ROUTER_AB_ED25519_WALLET_SESSION_PATH } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { toRpId } from "../../session/identity/evmFamilyEcdsaIdentity.js";

package/dist/esm/core/signingEngine/threshold/ed25519/yaoActiveClientRegistry.js

@@ -1,6 +1,6 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { THRESHOLD_ED25519_2P_PARTICIPANT_IDS } from "../../../../shared-ts/src/threshold/participants.js";
+import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { nearEd25519YaoMaterialActivationFromMetadata } from "../../session/material/nearEd25519YaoMaterialActivation.js";
 //#region src/core/signingEngine/threshold/ed25519/yaoActiveClientRegistry.ts
 const MAX_ACTIVE_ED25519_YAO_CLIENTS = 64;

package/dist/esm/core/signingEngine/threshold/ed25519/yaoPublicCapabilityReferences.js

@@ -1,6 +1,7 @@
 import { parseMpcMaterialActivationRef, parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { nearEd25519SigningKeyIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { toAccountId } from "../../../types/accountIds.js";
+import { nearEd25519SigningKeyIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { toRpId } from "../../session/identity/evmFamilyEcdsaIdentity.js";
 import { normalizeThresholdRuntimePolicyScope } from "../sessionPolicy.js";
@@ -28,19 +29,11 @@ async function publishEd25519YaoPublicCapabilityReferenceAndLane(store, referenc
 	await store.upsert(identity);
 	await store.upsertLane(reference);
 }
-function requireRecord(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
 function requireExactKeys(record, expectedKeys, label) {
 	const actual = Object.keys(record).sort();
 	const expected = [...expectedKeys].sort();
 	if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) throw new Error(`${label} contains unexpected fields`);
 }
-function requireNonEmptyString(value, label) {
-	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error(`${label} must be a non-empty normalized string`);
-	return value;
-}
 function requireNonNegativeInteger(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative integer`);
 	return value;
@@ -51,7 +44,7 @@ function requirePositiveInteger(value, label) {
 }
 function parseSigningLaneAuth(value, label) {
 	const record = requireRecord(value, label);
-	const kind = requireNonEmptyString(record.kind, `${label}.kind`);
+	const kind = requireCanonicalString(record.kind, `${label}.kind`, "must be a non-empty normalized string");
 	switch (kind) {
 		case "passkey":
 			requireExactKeys(record, [
@@ -61,14 +54,14 @@ function parseSigningLaneAuth(value, label) {
 			], label);
 			return {
 				kind,
-				rpId: toRpId(requireNonEmptyString(record.rpId, `${label}.rpId`)),
-				credentialIdB64u: requireNonEmptyString(record.credentialIdB64u, `${label}.credentialIdB64u`)
+				rpId: toRpId(requireCanonicalString(record.rpId, `${label}.rpId`, "must be a non-empty normalized string")),
+				credentialIdB64u: requireCanonicalString(record.credentialIdB64u, `${label}.credentialIdB64u`, "must be a non-empty normalized string")
 			};
 		case "email_otp":
 			requireExactKeys(record, ["kind", "providerSubjectId"], label);
 			return {
 				kind,
-				providerSubjectId: requireNonEmptyString(record.providerSubjectId, `${label}.providerSubjectId`)
+				providerSubjectId: requireCanonicalString(record.providerSubjectId, `${label}.providerSubjectId`, "must be a non-empty normalized string")
 			};
 		default: throw new Error(`${label}.kind is invalid`);
 	}
@@ -89,8 +82,8 @@ function parsePublicCapabilityIdentity(value, label) {
 	const runtimePolicyScope = normalizeThresholdRuntimePolicyScope(record.runtimePolicyScope);
 	if (!runtimePolicyScope) throw new Error(`${label}.runtimePolicyScope is invalid`);
 	return {
-		walletId: toWalletId(requireNonEmptyString(record.walletId, `${label}.walletId`)),
-		nearAccountId: toAccountId(requireNonEmptyString(record.nearAccountId, `${label}.nearAccountId`)),
+		walletId: toWalletId(requireCanonicalString(record.walletId, `${label}.walletId`, "must be a non-empty normalized string")),
+		nearAccountId: toAccountId(requireCanonicalString(record.nearAccountId, `${label}.nearAccountId`, "must be a non-empty normalized string")),
 		thresholdSessionId: thresholdSessionId.value,
 		runtimePolicyScope,
 		materialActivation: materialActivation.value
@@ -121,7 +114,7 @@ function parsePublicCapabilityLane(value, label) {
 	if (signerSlot === null) throw new Error(`${label}.signerSlot is invalid`);
 	const common = {
 		...base,
-		nearEd25519SigningKeyId: nearEd25519SigningKeyIdFromString(requireNonEmptyString(record.nearEd25519SigningKeyId, `${label}.nearEd25519SigningKeyId`)),
+		nearEd25519SigningKeyId: nearEd25519SigningKeyIdFromString(requireCanonicalString(record.nearEd25519SigningKeyId, `${label}.nearEd25519SigningKeyId`, "must be a non-empty normalized string")),
 		signerSlot
 	};
 	switch (auth.kind) {
@@ -141,7 +134,7 @@ function parsePublicCapabilityLane(value, label) {
 function parseEd25519YaoPublicCapabilityReferencesV1(value) {
 	const record = requireRecord(value, "Ed25519 Yao public capability references");
 	requireExactKeys(record, ["kind", "identities"], "Ed25519 Yao public capability references");
-	if (record.kind !== "ed25519_yao_public_capability_references_v1") throw new Error("Ed25519 Yao public capability references kind is invalid");
+	if (record.kind !== ED25519_YAO_PUBLIC_CAPABILITY_REFERENCES_KIND_V1) throw new Error("Ed25519 Yao public capability references kind is invalid");
 	if (!Array.isArray(record.identities)) throw new Error("Ed25519 Yao public capability identities must be an array");
 	if (record.identities.length > MAX_PUBLIC_CAPABILITY_REFERENCES) throw new Error("Ed25519 Yao public capability reference capacity is exceeded");
 	const identities = record.identities.map((identity, index) => parsePublicCapabilityIdentity(identity, `Ed25519 Yao public capability identity ${index}`));
@@ -154,7 +147,7 @@ function parseEd25519YaoPublicCapabilityReferencesV1(value) {
 function parseEd25519YaoPublicCapabilityLanesV1(value) {
 	const record = requireRecord(value, "Ed25519 Yao public capability lanes");
 	requireExactKeys(record, ["kind", "lanes"], "Ed25519 Yao public capability lanes");
-	if (record.kind !== "ed25519_yao_public_capability_lanes_v1") throw new Error("Ed25519 Yao public capability lanes kind is invalid");
+	if (record.kind !== ED25519_YAO_PUBLIC_CAPABILITY_LANES_KIND_V1) throw new Error("Ed25519 Yao public capability lanes kind is invalid");
 	if (!Array.isArray(record.lanes)) throw new Error("Ed25519 Yao public capability lanes must be an array");
 	if (record.lanes.length > MAX_PUBLIC_CAPABILITY_LANES) throw new Error("Ed25519 Yao public capability lane capacity is exceeded");
 	const lanes = record.lanes.map((lane, index) => parsePublicCapabilityLane(lane, `Ed25519 Yao public capability lane ${index}`));
@@ -197,7 +190,7 @@ function clonePublicCapabilityLane(lane) {
 }
 async function upsertEd25519YaoPublicCapabilityReferenceInTransaction(store, identity) {
 	const currentRow = await store.get(ED25519_YAO_PUBLIC_CAPABILITY_REFERENCES_APP_STATE_KEY);
-	if (currentRow !== void 0 && currentRow.key !== "ed25519YaoPublicCapabilityReferencesV1") throw new Error("Ed25519 Yao public capability reference app-state key is inconsistent");
+	if (currentRow !== void 0 && currentRow.key !== ED25519_YAO_PUBLIC_CAPABILITY_REFERENCES_APP_STATE_KEY) throw new Error("Ed25519 Yao public capability reference app-state key is inconsistent");
 	const current = currentRow === void 0 ? emptyPublicCapabilityReferences() : parseEd25519YaoPublicCapabilityReferencesV1(currentRow.value);
 	const normalized = clonePublicCapabilityIdentity(identity);
 	const identities = current.identities.filter((candidate) => String(candidate.walletId) !== String(normalized.walletId) || String(candidate.nearAccountId) !== String(normalized.nearAccountId));

package/dist/esm/core/signingEngine/threshold/sessionPolicy.js

@@ -1,8 +1,8 @@
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../shared-ts/src/threshold/participants.js";
+import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS } from "../../../shared-ts/src/threshold/sessionPolicy.js";
 //#region src/core/signingEngine/threshold/sessionPolicy.ts

package/dist/esm/core/signingEngine/uiConfirm/PasskeyMpcSessionDurableState.js

@@ -1,10 +1,11 @@
 import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
-import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { SIGNING_SESSION_SEAL_GROUP_ID } from "../../../shared-ts/src/utils/signingSessionSeal.js";
 import { thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual } from "../interfaces/ecdsaChainTarget.js";
+import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
+import { sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { ed25519DurableMaterialLocator, materialActivationKey } from "../session/sealedRecovery/materialActivationKey.js";
-import { buildCurrentSealedSessionRecord, readExactEd25519SealedSession, readExactSealedSession, updateExactEd25519SealedSessionPolicy, updateExactSealedSessionPolicy, writeExactSealedSession } from "../session/persistence/sealedSessionStore.js";
+import { buildCurrentSealedSessionRecord } from "../session/persistence/sealedSessionRecords.js";
+import { readExactEd25519SealedSession, readExactSealedSession, updateExactEd25519SealedSessionPolicy, updateExactSealedSessionPolicy, writeExactSealedSession } from "../session/persistence/sealedSessionStore.js";
 //#region src/core/signingEngine/uiConfirm/PasskeyMpcSessionDurableState.ts
 const signingSessionSealPersistSingleFlight = /* @__PURE__ */ new Map();
 function roundDurationMs(startedAt) {