@seams/wallet 0.7.1 → 0.7.3

package/dist/esm/core/indexedDB/seamsWalletDB/laneHolderMaterialStore.js

@@ -1,6 +1,7 @@
 import { parseLaneEnrollmentId, parseLaneOperationId, parseLaneShareEpoch, parseMpcMaterialActivationId, parseSigningLaneId, parseWalletId, parseWalletKeyId } from "../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { requireParsed } from "../../../shared-ts/src/passkey-custody/primitives.js";
 import { parseLaneHolderCustodyBindingId } from "../../../shared-ts/src/signing-lanes/participants.js";
 import { signingSessionSealsRepository } from "./signingSessionSeals.js";
 //#region src/core/indexedDB/seamsWalletDB/laneHolderMaterialStore.ts
@@ -74,10 +75,6 @@ function laneSealedHolderKind(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
 	return Reflect.get(value, "kind");
 }
-function parsed(result, label) {
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
 function parsedDigest(value, label) {
 	try {
 		return parseDigestB64u(value);
@@ -103,15 +100,15 @@ function parseDecodedLaneSealedHolderRecord(record) {
 	if (record.kind !== "lane_sealed_holder_record_v1") throw new Error("lane sealed holder record kind is invalid");
 	return {
 		kind: "lane_sealed_holder_record_v1",
-		operationId: parsed(parseLaneOperationId(record.operationId), "operationId"),
-		enrollmentId: parsed(parseLaneEnrollmentId(record.enrollmentId), "enrollmentId"),
-		walletId: parsed(parseWalletId(record.walletId), "walletId"),
-		walletKeyId: parsed(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
-		laneId: parsed(parseSigningLaneId(record.laneId), "laneId"),
-		laneShareEpoch: parsed(parseLaneShareEpoch(record.laneShareEpoch), "laneShareEpoch"),
-		targetMaterialActivationId: parsed(parseMpcMaterialActivationId(record.targetMaterialActivationId), "targetMaterialActivationId"),
+		operationId: requireParsed(parseLaneOperationId(record.operationId), "operationId"),
+		enrollmentId: requireParsed(parseLaneEnrollmentId(record.enrollmentId), "enrollmentId"),
+		walletId: requireParsed(parseWalletId(record.walletId), "walletId"),
+		walletKeyId: requireParsed(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
+		laneId: requireParsed(parseSigningLaneId(record.laneId), "laneId"),
+		laneShareEpoch: requireParsed(parseLaneShareEpoch(record.laneShareEpoch), "laneShareEpoch"),
+		targetMaterialActivationId: requireParsed(parseMpcMaterialActivationId(record.targetMaterialActivationId), "targetMaterialActivationId"),
 		holderParticipantBindingDigestB64u: parsedDigest(record.holderParticipantBindingDigestB64u, "holderParticipantBindingDigestB64u"),
-		custodyBindingId: parsed(parseLaneHolderCustodyBindingId(record.custodyBindingId), "custodyBindingId"),
+		custodyBindingId: requireParsed(parseLaneHolderCustodyBindingId(record.custodyBindingId), "custodyBindingId"),
 		holderRecipientKeyDigestB64u: parsedDigest(record.holderRecipientKeyDigestB64u, "holderRecipientKeyDigestB64u"),
 		holderCiphertextDigestSetB64u: parsedDigest(record.holderCiphertextDigestSetB64u, "holderCiphertextDigestSetB64u"),
 		sealedHolderRecordDigestB64u: parsedDigest(record.sealedHolderRecordDigestB64u, "sealedHolderRecordDigestB64u"),
@@ -186,7 +183,7 @@ var LaneSealedHolderMaterialRepository = class {
 		return parsed;
 	}
 	async listForEnrollmentV1(input) {
-		const enrollmentId = parsed(parseLaneEnrollmentId(input.enrollmentId), "enrollmentId");
+		const enrollmentId = requireParsed(parseLaneEnrollmentId(input.enrollmentId), "enrollmentId");
 		const records = /* @__PURE__ */ new Map();
 		for (const [key, record] of this.volatileRecords) if (record.enrollmentId === enrollmentId) records.set(key, record);
 		const entries = await this.seals.collectRawSealedRecordEntriesByEnrollmentId(enrollmentId);

package/dist/esm/core/rpcClients/relayer/walletRecoveryPrepare.js

@@ -1,5 +1,7 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { requireArray } from "../../../shared-ts/src/utils/validation.js";
+import { wireLiteral, wireObject, wireResult } from "../../../shared-ts/src/utils/wireSchema.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseUnixMs } from "../../../shared-ts/src/passkey-custody/primitives.js";
 import { buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
@@ -15,6 +17,7 @@ import "../../../shared-ts/src/passkey-custody/index.js";
 import { parseRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { parseWalletRecoveryEcdsaPossessionChallengeV1 } from "../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.js";
+import { thresholdEcdsaChainTargetKey } from "../../../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
 import { parseWalletRecoveryEnvelopeEntry } from "../../../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js";
 import "../../../shared-ts/src/wallet-recovery/index.js";
 import { parseWalletRecoveryTargetV1 } from "../../../shared-ts/src/wallet-recovery/walletRecoveryTarget.js";
@@ -124,7 +127,7 @@ async function parseWalletRecoveryPrepareResponse(args) {
 	const body = decodeJsonObjectOrNull(await response.json().catch(() => ({})));
 	if (response.status === 200 && body && readJsonField(body, "ok") === true) try {
 		const preparedResponse = decodeExactJsonObject(body, args.target.kind === "passkey" ? WALLET_RECOVERY_PREPARE_PASSKEY_RESPONSE_FIELDS : WALLET_RECOVERY_PREPARE_COMMON_RESPONSE_FIELDS, "walletRecoveryPrepare");
-		const wrap = parsePreparedRecoveryWrap(readJsonField(preparedResponse, "wrap"));
+		const wrap = preparedRecoveryWrap()(readJsonField(preparedResponse, "wrap"), "walletRecoveryPrepare.wrap");
 		const entries = parsePreparedRecoveryEntries(readJsonField(preparedResponse, "entries"));
 		const walletIdResult = parseWalletId(readJsonField(preparedResponse, "walletId"));
 		if (!walletIdResult.ok) throw new Error("walletRecoveryPrepare.walletId is invalid");
@@ -157,7 +160,7 @@ async function parseWalletRecoveryPrepareResponse(args) {
 		};
 		switch (target.kind) {
 			case "passkey": {
-				const registration = parseWalletRecoveryRegistrationOptions(readJsonField(preparedResponse, "registration"), String(walletId), target.rpId);
+				const registration = walletRecoveryRegistrationOptions(String(walletId), target.rpId)(readJsonField(preparedResponse, "registration"), "registration");
 				if (registration.walletAuthMethodId !== targetWalletAuthMethodId.value) throw new Error("wallet recovery registration changed the target auth method");
 				return {
 					...common,
@@ -181,115 +184,69 @@ async function parseWalletRecoveryPrepareResponse(args) {
 	if (response.status === 401 || response.status === 400) return { kind: "refused" };
 	return { kind: "transport_uncertain" };
 }
-function parseWalletRecoveryRegistrationOptions(raw, expectedWalletId, expectedRpId) {
-	const registration = decodeExactJsonObject(raw, [
-		"kind",
-		"challengeId",
-		"challengeB64u",
-		"replacementId",
-		"walletAuthMethodId",
-		"rpId",
-		"user",
-		"pubKeyCredParams",
-		"authenticatorSelection",
-		"timeoutMs",
-		"attestation",
-		"extensions",
-		"excludeCredentials"
-	], "walletRecoveryPrepare.registration");
-	if (readJsonField(registration, "kind") !== "webauthn_recovery_registration_v1") throw new Error("walletRecoveryPrepare.registration kind is invalid");
-	const challengeId = requireResponseString(readJsonField(registration, "challengeId"), "registration.challengeId");
-	const challengeB64u = requireCanonicalBytesB64u(readJsonField(registration, "challengeB64u"), 32, "registration.challengeB64u");
-	const replacementId = requireResponseString(readJsonField(registration, "replacementId"), "registration.replacementId");
-	const walletAuthMethodId = parseWalletAuthMethodId(readJsonField(registration, "walletAuthMethodId"));
-	if (!walletAuthMethodId.ok) throw new Error("walletRecoveryPrepare.registration.walletAuthMethodId is invalid");
-	const rpIdResult = parseWebAuthnRpId(readJsonField(registration, "rpId"));
-	if (!rpIdResult.ok) throw new Error("walletRecoveryPrepare.registration.rpId is invalid");
-	if (rpIdResult.value !== expectedRpId) throw new Error("walletRecoveryPrepare.registration changed the relying party");
-	const user = decodeExactJsonObject(readJsonField(registration, "user"), [
-		"idB64u",
-		"name",
-		"displayName"
-	], "walletRecoveryPrepare.registration.user");
+function walletRecoveryRegistrationOptions(expectedWalletId, expectedRpId) {
 	const expectedUserIdB64u = base64UrlEncode(new TextEncoder().encode(expectedWalletId));
-	const idB64u = requireCanonicalNonEmptyB64u(readJsonField(user, "idB64u"), "registration.user.idB64u");
-	if (idB64u !== expectedUserIdB64u) throw new Error("walletRecoveryPrepare.registration user is bound to another wallet");
-	const name = requireResponseString(readJsonField(user, "name"), "registration.user.name");
-	const displayName = requireResponseString(readJsonField(user, "displayName"), "registration.user.displayName");
-	if (name !== expectedWalletId || displayName !== expectedWalletId) throw new Error("walletRecoveryPrepare.registration user labels changed the wallet identity");
-	const pubKeyCredParams = parseRecoveryPublicKeyParameters(readJsonField(registration, "pubKeyCredParams"));
-	const authenticatorSelection = parseRecoveryAuthenticatorSelection(readJsonField(registration, "authenticatorSelection"));
-	const timeoutMs = Number(readJsonField(registration, "timeoutMs"));
-	if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new Error("walletRecoveryPrepare.registration.timeoutMs is invalid");
-	if (readJsonField(registration, "attestation") !== "none") throw new Error("walletRecoveryPrepare.registration.attestation is invalid");
-	const extensions = parseRecoveryPrfExtensions(readJsonField(registration, "extensions"));
-	const excludeCredentials = parseRecoveryExcludeCredentials(readJsonField(registration, "excludeCredentials"));
-	return {
-		kind: "webauthn_recovery_registration_v1",
-		challengeId,
-		challengeB64u,
-		replacementId,
-		walletAuthMethodId: walletAuthMethodId.value,
-		rpId: rpIdResult.value,
-		user: {
-			idB64u,
-			name,
-			displayName
+	const credentialDescriptor = wireObject({
+		type: wireLiteral("public-key"),
+		id: (raw, label) => {
+			const id = wireResult(parseWebAuthnCredentialIdB64u)(raw, label);
+			requireCanonicalNonEmptyB64u(id, label);
+			return id;
+		}
+	});
+	return wireObject({
+		kind: wireLiteral("webauthn_recovery_registration_v1"),
+		challengeId: requireResponseString,
+		challengeB64u: (raw, label) => requireCanonicalBytesB64u(raw, 32, label),
+		replacementId: requireResponseString,
+		walletAuthMethodId: wireResult(parseWalletAuthMethodId),
+		rpId: wireResult(parseWebAuthnRpId),
+		user: wireObject({
+			idB64u: requireCanonicalNonEmptyB64u,
+			name: requireResponseString,
+			displayName: requireResponseString
+		}, (user, label) => {
+			if (user.idB64u !== expectedUserIdB64u || user.name !== expectedWalletId || user.displayName !== expectedWalletId) throw new Error(`${label} is bound to another wallet`);
+		}),
+		pubKeyCredParams: (raw, label) => {
+			if (!Array.isArray(raw) || raw.length !== 2) throw new Error(`${label} is invalid`);
+			return [publicKeyCredentialParameter(-7)(raw[0], `${label}[0]`), publicKeyCredentialParameter(-257)(raw[1], `${label}[1]`)];
 		},
-		pubKeyCredParams,
-		authenticatorSelection,
-		timeoutMs,
-		attestation: "none",
-		extensions,
-		excludeCredentials
-	};
-}
-function parseRecoveryPrfExtensions(raw) {
-	const evaluation = decodeExactJsonObject(readJsonField(decodeExactJsonObject(readJsonField(decodeExactJsonObject(raw, ["prf"], "walletRecoveryPrepare.registration.extensions"), "prf"), ["eval"], "walletRecoveryPrepare.registration.extensions.prf"), "eval"), ["firstB64u", "secondB64u"], "walletRecoveryPrepare.registration.extensions.prf.eval");
-	const firstB64u = requireCanonicalBytesB64u(readJsonField(evaluation, "firstB64u"), PASSKEY_PRF_FIRST_SALT_V1.length, "registration.extensions.prf.eval.firstB64u");
-	const secondB64u = requireCanonicalBytesB64u(readJsonField(evaluation, "secondB64u"), PASSKEY_PRF_SECOND_SALT_V1.length, "registration.extensions.prf.eval.secondB64u");
-	if (firstB64u !== base64UrlEncode(PASSKEY_PRF_FIRST_SALT_V1) || secondB64u !== base64UrlEncode(PASSKEY_PRF_SECOND_SALT_V1)) throw new Error("walletRecoveryPrepare.registration PRF salts are unsupported");
-	return { prf: { eval: {
-		firstB64u,
-		secondB64u
-	} } };
+		authenticatorSelection: wireObject({
+			residentKey: wireLiteral("required"),
+			userVerification: wireLiteral("preferred")
+		}),
+		timeoutMs: (raw, label) => {
+			const timeoutMs = Number(raw);
+			if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new Error(`${label} is invalid`);
+			return timeoutMs;
+		},
+		attestation: wireLiteral("none"),
+		extensions: wireObject({ prf: wireObject({ eval: wireObject({
+			firstB64u: prfSalt(PASSKEY_PRF_FIRST_SALT_V1),
+			secondB64u: prfSalt(PASSKEY_PRF_SECOND_SALT_V1)
+		}) }) }),
+		excludeCredentials: (raw, label) => requireArray(raw, label).map((entry, index) => credentialDescriptor(entry, `${label}[${index}]`))
+	}, (registration, label) => {
+		if (registration.rpId !== expectedRpId) throw new Error(`${label} changed the relying party`);
+	});
 }
-function parseRecoveryPublicKeyParameters(raw) {
-	if (!Array.isArray(raw) || raw.length !== 2) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams is invalid");
-	const first = decodeExactJsonObject(raw[0], ["type", "alg"], "walletRecoveryPrepare.registration.pubKeyCredParams[0]");
-	const second = decodeExactJsonObject(raw[1], ["type", "alg"], "walletRecoveryPrepare.registration.pubKeyCredParams[1]");
-	if (readJsonField(first, "type") !== "public-key" || readJsonField(first, "alg") !== -7) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams[0] is invalid");
-	if (readJsonField(second, "type") !== "public-key" || readJsonField(second, "alg") !== -257) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams[1] is invalid");
-	return [{
-		type: "public-key",
-		alg: -7
-	}, {
-		type: "public-key",
-		alg: -257
-	}];
+function publicKeyCredentialParameter(alg) {
+	return wireObject({
+		type: wireLiteral("public-key"),
+		alg: (raw, label) => {
+			if (raw !== alg) throw new Error(`${label} is invalid`);
+			return alg;
+		}
+	});
 }
-function parseRecoveryAuthenticatorSelection(raw) {
-	const selection = decodeExactJsonObject(raw, ["residentKey", "userVerification"], "walletRecoveryPrepare.registration.authenticatorSelection");
-	if (readJsonField(selection, "residentKey") !== "required" || readJsonField(selection, "userVerification") !== "preferred") throw new Error("walletRecoveryPrepare.registration.authenticatorSelection is invalid");
-	return {
-		residentKey: "required",
-		userVerification: "preferred"
+function prfSalt(salt) {
+	return (raw, label) => {
+		const value = requireCanonicalBytesB64u(raw, salt.length, label);
+		if (value !== base64UrlEncode(salt)) throw new Error(`${label} is unsupported`);
+		return value;
 	};
 }
-function parseRecoveryExcludeCredentials(raw) {
-	if (!Array.isArray(raw)) throw new Error("walletRecoveryPrepare.registration.excludeCredentials is invalid");
-	return raw.map((entry, index) => {
-		const descriptor = decodeExactJsonObject(entry, ["type", "id"], `walletRecoveryPrepare.registration.excludeCredentials[${index}]`);
-		if (readJsonField(descriptor, "type") !== "public-key") throw new Error("walletRecoveryPrepare.registration.excludeCredentials type is invalid");
-		const parsedId = parseWebAuthnCredentialIdB64u(readJsonField(descriptor, "id"));
-		if (!parsedId.ok) throw new Error("walletRecoveryPrepare.registration.excludeCredentials id is invalid");
-		requireCanonicalNonEmptyB64u(parsedId.value, "registration.excludeCredentials.id");
-		return {
-			type: "public-key",
-			id: parsedId.value
-		};
-	});
-}
 function recoveryTargetsMatch(left, right) {
 	if (left.kind !== right.kind) return false;
 	switch (left.kind) {
@@ -301,18 +258,12 @@ function recoveryTargetsMatch(left, right) {
 function assertNeverRecoveryTarget(value) {
 	throw new Error(`unsupported wallet recovery target: ${String(value)}`);
 }
-const PREPARED_WRAP_FIELDS = [
-	"nonceB64u",
-	"wrappedManifestKekB64u",
-	"aadHashB64u"
-];
-function parsePreparedRecoveryWrap(raw) {
-	const wrap = decodeExactJsonObject(raw, PREPARED_WRAP_FIELDS, "walletRecoveryPrepare.wrap");
-	return {
-		nonceB64u: parseEnvelopeNonceB64u(readJsonField(wrap, "nonceB64u"), "walletRecoveryPrepare.wrap.nonceB64u"),
-		wrappedManifestKekB64u: parseEnvelopeCiphertextB64u(readJsonField(wrap, "wrappedManifestKekB64u"), "walletRecoveryPrepare.wrap.wrappedManifestKekB64u"),
-		aadHashB64u: parseDigestField(readJsonField(wrap, "aadHashB64u"), "walletRecoveryPrepare.wrap.aadHashB64u")
-	};
+function preparedRecoveryWrap() {
+	return wireObject({
+		nonceB64u: parseEnvelopeNonceB64u,
+		wrappedManifestKekB64u: parseEnvelopeCiphertextB64u,
+		aadHashB64u: parseDigestField
+	});
 }
 function parsePreparedRecoveryEntries(raw) {
 	if (!Array.isArray(raw) || raw.length !== 1) throw new Error("walletRecoveryPrepare.entries must contain exactly one custody seed");
@@ -474,7 +425,7 @@ function parseWalletRecoveryPreparationEcdsaRecoveryBasis(raw, expectedWalletId)
 function parseWalletRecoveryEcdsaChainTargets(raw) {
 	if (!Array.isArray(raw) || raw.length === 0) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are invalid");
 	const targets = raw.map((value, index) => parseWalletRecoveryEcdsaChainTarget(value, index));
-	if (new Set(targets.map(walletRecoveryEcdsaChainTargetKey)).size !== targets.length) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are duplicated");
+	if (new Set(targets.map(thresholdEcdsaChainTargetKey)).size !== targets.length) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are duplicated");
 	const first = targets[0];
 	if (!first) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are invalid");
 	return [first, ...targets.slice(1)];
@@ -514,9 +465,6 @@ function parseWalletRecoveryEcdsaChainTarget(raw, index) {
 	};
 	throw new Error("walletRecoveryPrepare ECDSA recovery chain family is invalid");
 }
-function walletRecoveryEcdsaChainTargetKey(target) {
-	return target.kind === "evm" ? `evm:eip155:${target.chainId}` : `tempo:${target.chainId}`;
-}
 function parseWalletRecoveryEcdsaParticipantIds(raw) {
 	if (!Array.isArray(raw) || raw.length !== 2 || raw[0] !== 1 || raw[1] !== 2) throw new Error("walletRecoveryPrepare ECDSA recovery participant IDs are invalid");
 	return [1, 2];

package/dist/esm/core/signingEngine/assembly/ports/recovery.js

@@ -26,7 +26,7 @@ function createRecoveryPublicDeps(args) {
 			}, {
 				...completeConfiguredEcdsaTargets(availableLanesArgs),
 				requiredEcdsaCapability: "export_keys"
-			}, new WalletSessionStatusReadScope()),
+			}, new WalletSessionStatusReadScope(), "all"),
 			readOwnerScopedAvailableSigningLanesForTargets: async (availableLanesArgs) => await readOwnerScopedAvailableSigningLanes({
 				activeWalletAuthorityEcdsaRuntimeReadPorts: browserExactWalletSessionReadPorts,
 				ed25519YaoPublicCapabilityLanes: args.ed25519YaoPublicCapabilityLanes,

package/dist/esm/core/signingEngine/chains/evm/display/functionSelectors.js

@@ -38,9 +38,6 @@ const KNOWN_CONTRACT_FUNCTION_SIGNATURES = Object.freeze({
 		"0xcfae3217": "greet()"
 	})
 });
-function normalizeSelector(selector) {
-	return normalizeHexSelector(selector);
-}
 function normalizeContractAddress(contractAddress) {
 	const normalized = String(contractAddress || "").trim().toLowerCase();
 	if (!EVM_ADDRESS_RE.test(normalized)) return void 0;
@@ -50,7 +47,7 @@ function selectorFromHexData(data) {
 	return deriveSelectorFromHexData(data);
 }
 function resolveFunctionSignature(selector, contractAddress) {
-	const normalized = normalizeSelector(selector);
+	const normalized = normalizeHexSelector(selector);
 	if (!normalized) return void 0;
 	const normalizedContractAddress = normalizeContractAddress(contractAddress);
 	if (normalizedContractAddress) {
@@ -66,7 +63,7 @@ function resolveFunctionDisplayName(selector, contractAddress) {
 		const normalizedName = (idx > 0 ? signature.slice(0, idx) : signature).trim();
 		if (normalizedName) return `${normalizedName}()`;
 	}
-	const normalizedSelector = normalizeSelector(selector);
+	const normalizedSelector = normalizeHexSelector(selector);
 	if (normalizedSelector) return `function ${normalizedSelector}`;
 }
 //#endregion

package/dist/esm/core/signingEngine/flows/recovery/ecdsaExportFlow.js

@@ -7,7 +7,7 @@ import { thresholdEcdsaChainTargetKey, walletSessionRefFromSession } from "../..
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { sameRouterAbEcdsaDerivationNormalSigningStateV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
-import { resolveThresholdEcdsaSigningQueueKey } from "../../threshold/ecdsa/signingQueue.js";
+import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
 import { issueEcdsaOperationStepUpAuthorization, prepareEcdsaOperationStepUp } from "../../threshold/ecdsa/operationStepUp.js";
 import { resolveActiveWalletAuthorityEcdsaRuntimeV1 } from "../../session/material/activeWalletAuthorityEcdsaRuntime.js";
 import { ecdsaExportBoundaryChain, resolveEcdsaExportMaterialForLane, resolveFreshEmailOtpEcdsaExportMaterialForLane } from "./ecdsaExportMaterial.js";
@@ -107,7 +107,7 @@ async function prepareAndShowEcdsaExportArtifact(deps, args) {
 		});
 		const materialActivation = args.exportLane.laneIdentity.signer.materialActivation;
 		const artifact = await deps.withThresholdEcdsaSigningQueue({
-			queueKey: resolveThresholdEcdsaSigningQueueKey({ materialActivation }),
+			queueKey: resolveThresholdCommitQueueKey({ materialActivation }),
 			walletId: args.exportLane.key.walletId,
 			enabled: true,
 			task: async () => {

package/dist/esm/core/signingEngine/flows/recovery/ecdsaExportMaterial.js

@@ -25,26 +25,42 @@ function exactEcdsaParticipantIds(value) {
 	if (!Number.isSafeInteger(first) || !Number.isSafeInteger(second) || first <= 0 || second <= 0 || first === second) throw new Error("[SigningEngine][ecdsa-export] ECDSA participant set is invalid");
 	return [first, second];
 }
-function resolveCanonicalEmailOtpEcdsaExportMaterialForLane(args) {
-	const { exportLane } = args;
+function requireCanonicalEcdsaExportLane(args) {
+	const { exportLane, label } = args;
 	const capability = exportLane.capability;
-	if (!isEmailOtpWalletAuthAuthority(capability.authority)) throw new Error("[SigningEngine][ecdsa-export] Email OTP capability authority mismatch");
 	const signer = capability.manifest.signer;
-	if (signer.walletId !== exportLane.key.walletId || !signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, exportLane.chainTarget))) throw new Error("[SigningEngine][ecdsa-export] Email OTP capability target mismatch");
-	if (exportLane.laneIdentity.auth.kind !== "email_otp" || exportLane.laneIdentity.auth.providerSubjectId !== capability.authority.factor.providerUserId) throw new Error("[SigningEngine][ecdsa-export] Email OTP capability auth mismatch");
-	if (!mpcMaterialActivationRefsEqual(capability.manifest.activation.materialActivation, exportLane.laneIdentity.signer.materialActivation)) throw new Error("[SigningEngine][ecdsa-export] Email OTP material activation mismatch");
+	if (signer.walletId !== exportLane.key.walletId || !signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, exportLane.chainTarget))) throw new Error(`[SigningEngine][ecdsa-export] ${label} capability target mismatch`);
+	if (!args.authMatches()) throw new Error(`[SigningEngine][ecdsa-export] ${label} capability auth mismatch`);
+	if (!mpcMaterialActivationRefsEqual(capability.manifest.activation.materialActivation, exportLane.laneIdentity.signer.materialActivation)) throw new Error(`[SigningEngine][ecdsa-export] ${label} material activation mismatch`);
 	assertMatchingVerifiedEcdsaPublicFacts({
 		expected: exportLane.publicFacts,
-		actual: capability.manifest.signer.registeredPublicFacts,
-		context: "canonical Email OTP export lane"
+		actual: signer.registeredPublicFacts,
+		context: `canonical ${label} export lane`
 	});
 	const materialFacts = capability.material.publicFacts;
-	if (materialFacts.walletId !== signer.walletId || String(materialFacts.keyHandle) !== String(exportLane.publicFacts.keyHandle) || String(materialFacts.groupPublicKey33B64u) !== String(exportLane.publicFacts.publicKeyB64u) || String(materialFacts.ethereumAddress) !== String(exportLane.publicFacts.thresholdOwnerAddress) || materialFacts.participantIds.length !== exportLane.publicFacts.participantIds.length || materialFacts.participantIds.some((participantId, index) => participantId !== exportLane.publicFacts.participantIds[index])) throw new Error("[SigningEngine][ecdsa-export] canonical Email OTP export material mismatch");
+	if (materialFacts.walletId !== signer.walletId || String(materialFacts.keyHandle) !== String(exportLane.publicFacts.keyHandle) || String(materialFacts.groupPublicKey33B64u) !== String(exportLane.publicFacts.publicKeyB64u) || String(materialFacts.ethereumAddress) !== String(exportLane.publicFacts.thresholdOwnerAddress) || materialFacts.participantIds.length !== exportLane.publicFacts.participantIds.length || materialFacts.participantIds.some((participantId, index) => participantId !== exportLane.publicFacts.participantIds[index])) throw new Error(`[SigningEngine][ecdsa-export] canonical ${label} export material mismatch`);
 	const durable = capability.manifest.durableMaterial;
 	const runtimePolicyScope = durable.runtimePolicyScope;
 	const relayerUrl = String(args.deps.relayerUrl).trim().replace(/\/+$/g, "");
-	if (!runtimePolicyScope) throw new Error("[SigningEngine][ecdsa-export] Email OTP runtime policy scope is missing");
-	if (!relayerUrl) throw new Error("[SigningEngine][ecdsa-export] Email OTP export relayer URL is missing");
+	if (!runtimePolicyScope) throw new Error(`[SigningEngine][ecdsa-export] ${label} runtime policy scope is missing`);
+	if (!relayerUrl) throw new Error(`[SigningEngine][ecdsa-export] ${label} export relayer URL is missing`);
+	return {
+		durable,
+		runtimePolicyScope,
+		relayerUrl
+	};
+}
+function resolveCanonicalEmailOtpEcdsaExportMaterialForLane(args) {
+	const { exportLane } = args;
+	const capability = exportLane.capability;
+	const authority = capability.authority;
+	if (!isEmailOtpWalletAuthAuthority(authority)) throw new Error("[SigningEngine][ecdsa-export] Email OTP capability authority mismatch");
+	const { durable, runtimePolicyScope, relayerUrl } = requireCanonicalEcdsaExportLane({
+		deps: args.deps,
+		exportLane,
+		label: "Email OTP",
+		authMatches: () => exportLane.laneIdentity.auth.kind === "email_otp" && exportLane.laneIdentity.auth.providerSubjectId === authority.factor.providerUserId
+	});
 	return {
 		source: "canonical_capability",
 		kind: "fresh_email_otp_route_auth_ready",
@@ -58,30 +74,21 @@ function resolveCanonicalEmailOtpEcdsaExportMaterialForLane(args) {
 		relayerUrl,
 		authorization: {
 			kind: "fresh_operation_authorization_required",
-			authority: capability.authority
+			authority
 		}
 	};
 }
 function resolveCanonicalPasskeyEcdsaExportMaterialForLane(args) {
 	const { exportLane } = args;
 	const capability = exportLane.capability;
-	if (!isPasskeyWalletAuthAuthority(capability.authority)) throw new Error("[SigningEngine][ecdsa-export] passkey capability authority mismatch");
-	const signer = capability.manifest.signer;
-	if (signer.walletId !== exportLane.key.walletId || !signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, exportLane.chainTarget))) throw new Error("[SigningEngine][ecdsa-export] passkey capability target mismatch");
-	if (exportLane.laneIdentity.auth.kind !== "passkey" || exportLane.laneIdentity.auth.credentialIdB64u !== capability.authority.factor.credentialIdB64u) throw new Error("[SigningEngine][ecdsa-export] passkey capability auth mismatch");
-	if (!mpcMaterialActivationRefsEqual(capability.manifest.activation.materialActivation, exportLane.laneIdentity.signer.materialActivation)) throw new Error("[SigningEngine][ecdsa-export] passkey material activation mismatch");
-	assertMatchingVerifiedEcdsaPublicFacts({
-		expected: exportLane.publicFacts,
-		actual: signer.registeredPublicFacts,
-		context: "canonical passkey export lane"
+	const authority = capability.authority;
+	if (!isPasskeyWalletAuthAuthority(authority)) throw new Error("[SigningEngine][ecdsa-export] passkey capability authority mismatch");
+	const { durable, runtimePolicyScope, relayerUrl } = requireCanonicalEcdsaExportLane({
+		deps: args.deps,
+		exportLane,
+		label: "passkey",
+		authMatches: () => exportLane.laneIdentity.auth.kind === "passkey" && exportLane.laneIdentity.auth.credentialIdB64u === authority.factor.credentialIdB64u
 	});
-	const materialFacts = capability.material.publicFacts;
-	if (materialFacts.walletId !== signer.walletId || String(materialFacts.keyHandle) !== String(exportLane.publicFacts.keyHandle) || String(materialFacts.groupPublicKey33B64u) !== String(exportLane.publicFacts.publicKeyB64u) || String(materialFacts.ethereumAddress) !== String(exportLane.publicFacts.thresholdOwnerAddress) || materialFacts.participantIds.length !== exportLane.publicFacts.participantIds.length || materialFacts.participantIds.some((participantId, index) => participantId !== exportLane.publicFacts.participantIds[index])) throw new Error("[SigningEngine][ecdsa-export] canonical passkey export material mismatch");
-	const durable = capability.manifest.durableMaterial;
-	const runtimePolicyScope = durable.runtimePolicyScope;
-	const relayerUrl = String(args.deps.relayerUrl).trim().replace(/\/+$/g, "");
-	if (!runtimePolicyScope) throw new Error("[SigningEngine][ecdsa-export] passkey runtime policy scope is missing");
-	if (!relayerUrl) throw new Error("[SigningEngine][ecdsa-export] passkey export relayer URL is missing");
 	return {
 		source: "canonical_capability",
 		kind: "fresh_passkey_needs_authorization",

package/dist/esm/core/signingEngine/flows/recovery/ed25519YaoExportFlow.js

@@ -2,7 +2,7 @@ import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/
 import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
 import { KeyExportEventPhase } from "../../../types/sdkSentEvents.js";
 import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { resolveThresholdEd25519CommitQueueKey } from "../../threshold/ed25519/commitQueue.js";
+import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
 import { isExportViewerSessionOpen, removeExportViewerHostIfPresent } from "../../uiConfirm/ui/export-viewer-host.js";
 import { createExportUiRequestId, emitKeyExportEvent } from "./keyExportFlow.js";
 import { requestEmailOtpEd25519KeyExportAuthorization, showEd25519ExportViewer } from "./keyExportConfirmation.js";
@@ -204,7 +204,7 @@ async function exportEd25519YaoKeyWithFreshAuthorization(deps, args) {
 		}
 	});
 	const result = await deps.withThresholdEd25519CommitQueue({
-		queueKey: resolveThresholdEd25519CommitQueueKey({ materialActivation: passkeyEd25519ExportMaterialActivation(resolved) }),
+		queueKey: resolveThresholdCommitQueueKey({ materialActivation: passkeyEd25519ExportMaterialActivation(resolved) }),
 		nearAccountId: args.nearAccountId,
 		enabled: true,
 		task: () => deps.passkeyMpcExport.exportPrivateKeysWithUi(buildWorkerPayload({
@@ -300,7 +300,7 @@ async function exportEd25519YaoKeyWithFreshEmailOtp(deps, args) {
 			onEvent: args.onEvent
 		});
 		const artifact = await deps.withThresholdEd25519CommitQueue({
-			queueKey: resolveThresholdEd25519CommitQueueKey({ materialActivation: emailOtpEd25519ExportMaterialActivation(resolved.context) }),
+			queueKey: resolveThresholdCommitQueueKey({ materialActivation: emailOtpEd25519ExportMaterialActivation(resolved.context) }),
 			nearAccountId: args.nearAccountId,
 			enabled: resolved.context.material.kind === "active_capability",
 			task: () => deps.emailOtp.exportSeedWithFreshAuthorization({

package/dist/esm/core/signingEngine/flows/recovery/exportKeypairOperation.js

@@ -196,14 +196,11 @@ async function exportEd25519KeypairWithFlowId(deps, args) {
 		onEvent: args.options.onEvent
 	});
 }
-async function exportEd25519KeypairWithSessionLifecycle(deps, args) {
-	return await exportEd25519KeypairWithFlowId(deps, args);
-}
 async function exportKeypairWithUI(deps, input) {
 	return await runKeyExportWithFlowEvents(input, async (args) => {
 		switch (args.kind) {
 			case "ecdsa": return await exportEcdsaKeypairWithSessionLifecycle(deps, args, { kind: "initial" });
-			case "ed25519": return await exportEd25519KeypairWithSessionLifecycle(deps, args);
+			case "ed25519": return await exportEd25519KeypairWithFlowId(deps, args);
 		}
 	});
 }

package/dist/esm/core/signingEngine/flows/recovery/passkeyEd25519YaoRecovery.js

@@ -7,7 +7,7 @@ import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/sr
 import { toAccountId } from "../../../types/accountIds.js";
 import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { normalizeRuntimePolicyScope, sameRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { toRpId } from "../../session/identity/evmFamilyEcdsaIdentity.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
@@ -76,9 +76,6 @@ function parseExactRecoverySession(raw, participantIds, identity, walletSession,
 		operationCredential
 	};
 }
-function sameRuntimePolicyScope(left, right) {
-	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
 function assertEd25519YaoRecoveryDescriptorStableIdentity(parsed) {
 	const capability = parsed.capability;
 	const session = parsed.session;

package/dist/esm/core/signingEngine/flows/signEvmFamily/emailOtpSigningSession.js

@@ -4,12 +4,12 @@ import { SigningEventPhase } from "../../../types/sdkSentEvents.js";
 import { buildVerifiedEcdsaPublicFacts, toEvmFamilyEcdsaKeyHandle } from "../../session/identity/evmFamilyEcdsaIdentity.js";
 import { isEmailOtpWalletAuthAuthority, walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { createSigningBoundaryTraceEvent, emitSigningBoundaryTrace } from "../../session/operationState/trace.js";
+import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
 import { demoEmailOtpCodeFromDelivery } from "../../session/emailOtp/challengeDelivery.js";
 import { buildEmailOtpRoutePlan } from "../../stepUpConfirmation/otpPrompt/authLane.js";
 import { emailOtpEcdsaSigningSessionAuthLane, resolveExactEmailOtpEcdsaSigningSessionAuthority } from "../../session/emailOtp/ecdsaSigningSessionAuthority.js";
 import { emitEvmFamilySigningEvent } from "./events.js";
 import { throwEmailOtpSigningSessionAuthStateError } from "../../session/emailOtp/routePlan.js";
-import { resolveThresholdEcdsaSigningQueueKey } from "../../threshold/ecdsa/signingQueue.js";
 //#region src/core/signingEngine/flows/signEvmFamily/emailOtpSigningSession.ts
 /** The capability is the authority. Anything the caller or the confirmation
 * plan supplies must agree with it exactly, or the OTP would be sent to a
@@ -211,7 +211,7 @@ async function refreshEmailOtpSigningSession(deps, args) {
 		chainTarget: args.chainTarget
 	})).runtime.materialActivation;
 	return await deps.withThresholdEcdsaSigningQueue({
-		queueKey: resolveThresholdEcdsaSigningQueueKey({ materialActivation: activationBeforeRefresh }),
+		queueKey: resolveThresholdCommitQueueKey({ materialActivation: activationBeforeRefresh }),
 		walletId: args.walletSession.walletId,
 		enabled: true,
 		task: runFencedEmailOtpSigningSessionRefresh.bind(void 0, {

package/dist/esm/core/signingEngine/flows/signEvmFamily/preparedSigning.js

@@ -294,13 +294,6 @@ async function prepareEvmFamilyEcdsaSigningSession(args) {
 				diagnostics: selection.diagnostics
 			});
 			const committedSelectionAuthMethod = selection.committedLane.authority.factor.kind;
-			const availableLanes = await args.deps.readAvailableSigningLanesForSigning({
-				walletId,
-				curve: "ecdsa",
-				ecdsaChainTargets: [chainTarget],
-				authMethod: committedSelectionAuthMethod,
-				ownerScope
-			});
 			emitSigningLaneResolutionTrace("evm-family", selection.lane, { reason: "evm_family_ecdsa_selection" });
 			args.diagnostics.selection = {
 				kind: selection.kind,
@@ -343,7 +336,7 @@ async function prepareEvmFamilyEcdsaSigningSession(args) {
 					expiresAtMs: readiness.expiresAtMs,
 					remainingUses: readiness.remainingUses
 				},
-				availableLanesGeneration: availableLanes.generation,
+				availableLanesGeneration: candidateAvailableLanes.generation,
 				metadata: {
 					accountAuth: selection.accountAuth,
 					authMethod: committedSelectionAuthMethod,
@@ -354,7 +347,7 @@ async function prepareEvmFamilyEcdsaSigningSession(args) {
 						...args.signingOperation.operationFingerprint ? { operationFingerprint: args.signingOperation.operationFingerprint } : {},
 						laneIdentityKey: exactSigningLaneIdentityKey(exactSigningLaneIdentityFromSelectedLane(resolvedLane))
 					},
-					availableLanesGeneration: availableLanes.generation
+					availableLanesGeneration: candidateAvailableLanes.generation
 				}
 			};
 		} }

package/dist/esm/core/signingEngine/flows/signEvmFamily/signEvmFamily.js

@@ -257,10 +257,6 @@ async function signEvmFamilyAttempt(deps, args, attempt) {
 		if (preparedEcdsaSigningSession) return preparedEcdsaSigningSession;
 		throw new Error("[SigningEngine][ecdsa] prepared signing session is required");
 	};
-	const getEcdsaSigningLaneIdentity = () => {
-		const prepared = getPreparedEcdsaSigningSession();
-		return prepared.kind === "authorized" ? prepared.signingLane.identity : prepared.identity;
-	};
 	const getPreparedEcdsaSigningSessionIfEcdsa = () => args.request.senderSignatureAlgorithm === "secp256k1" ? getPreparedEcdsaSigningSession() : void 0;
 	const reResolveSupersededPreparation = async (error) => {
 		if (!isEvmFamilyEcdsaMaterialSupersededError(error)) return null;
@@ -324,7 +320,11 @@ async function signEvmFamilyAttempt(deps, args, attempt) {
 			walletSession: args.walletSession,
 			request: args.request,
 			chainTarget: requestChainTarget,
-			senderSignatureAlgorithm: args.request.senderSignatureAlgorithm,
+			...args.request.senderSignatureAlgorithm === "secp256k1" ? {
+				senderSignatureAlgorithm: args.request.senderSignatureAlgorithm,
+				preparedSession: getPreparedEcdsaSigningSession(),
+				...activeWalletAuthorityFlowRuntime ? { activeWalletAuthority: activeWalletAuthorityFlowRuntime } : {}
+			} : { senderSignatureAlgorithm: args.request.senderSignatureAlgorithm },
 			...signingSessionPlan ? { signingSessionPlan } : {},
 			signingOperation: createTransactionSigningOperation(),
 			onSigningOperationTransition: emitEvmFamilySigningOperationTrace,
@@ -332,9 +332,7 @@ async function signEvmFamilyAttempt(deps, args, attempt) {
 			confirmationConfigOverride: args.confirmationConfigOverride,
 			shouldAbort: args.shouldAbort,
 			onEvent: args.onEvent,
-			onAuthSideEffectStarted: markFreshAuthRetrySideEffect,
-			getEcdsaSigningLaneIdentity,
-			...activeWalletAuthorityFlowRuntime ? { activeWalletAuthority: activeWalletAuthorityFlowRuntime } : {}
+			onAuthSideEffectStarted: markFreshAuthRetrySideEffect
 		});
 		return {
 			signingAuthPlan,