@seams/wallet 0.7.1 → 0.7.3

package/dist/esm/core/signingEngine/flows/signEvmFamily/signers/ecdsaDerivationClientSigningMaterialSource.js

@@ -1,4 +1,4 @@
-import { storeEcdsaRoleLocalSigningMaterialWasm, thresholdEcdsaLinkedHolderPresignSessionInitWasm, thresholdEcdsaRoleLocalAdmitPresignatureWasm, thresholdEcdsaRoleLocalCommitPresignatureWasm, thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, thresholdEcdsaRoleLocalDestroyPresignatureWasm, thresholdEcdsaRoleLocalListAvailablePresignaturesWasm, thresholdEcdsaRoleLocalPresignSessionAbortWasm, thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, thresholdEcdsaRoleLocalPresignSessionStepWasm, thresholdEcdsaRoleLocalReservePresignatureWasm } from "../../../threshold/crypto/ecdsaDerivationClientWasm.js";
+import { storeEcdsaRoleLocalSigningMaterialWasm, thresholdEcdsaLinkedHolderPresignSessionInitWasm, thresholdEcdsaListAvailablePresignaturesWasm, thresholdEcdsaRoleLocalAdmitPresignatureWasm, thresholdEcdsaRoleLocalCommitPresignatureWasm, thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, thresholdEcdsaRoleLocalDestroyPresignatureWasm, thresholdEcdsaRoleLocalPresignSessionAbortWasm, thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, thresholdEcdsaRoleLocalPresignSessionStepWasm, thresholdEcdsaRoleLocalReservePresignatureWasm } from "../../../threshold/crypto/ecdsaDerivationClientWasm.js";
 //#region src/core/signingEngine/flows/signEvmFamily/signers/ecdsaDerivationClientSigningMaterialSource.ts
 async function ensureRoleLocalSigningMaterialLoaded(args) {
 	const material = args.clientShare.material;
@@ -18,21 +18,7 @@ async function loadRouterAbEcdsaDerivationSigningMaterialSource(args) {
 		const holderHandleId = clientShare.holderHandleId;
 		return {
 			signerSession,
-			clientSigningMaterial: {
-				kind: "router_ab_ecdsa_derivation_client_signing_material_source_v1",
-				initClientPresignSession: async (input) => await thresholdEcdsaLinkedHolderPresignSessionInitWasm({
-					holderHandleId,
-					...input
-				}),
-				stepClientPresignSession: thresholdEcdsaRoleLocalPresignSessionStepWasm,
-				abortClientPresignSession: thresholdEcdsaRoleLocalPresignSessionAbortWasm,
-				admitClientPresignature: thresholdEcdsaRoleLocalAdmitPresignatureWasm,
-				destroyClientPresignature: thresholdEcdsaRoleLocalDestroyPresignatureWasm,
-				reserveClientPresignature: thresholdEcdsaRoleLocalReservePresignatureWasm,
-				commitClientPresignature: thresholdEcdsaRoleLocalCommitPresignatureWasm,
-				listAvailableClientPresignatures: thresholdEcdsaRoleLocalListAvailablePresignaturesWasm,
-				computeSignatureShareFromPresignatureHandle: thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm
-			},
+			clientSigningMaterial: createLinkedHolderClientSigningMaterialSource(holderHandleId),
 			cleanupAfterSign: async () => void 0
 		};
 	}
@@ -64,13 +50,33 @@ async function loadRouterAbEcdsaDerivationSigningMaterialSource(args) {
 			destroyClientPresignature: thresholdEcdsaRoleLocalDestroyPresignatureWasm,
 			reserveClientPresignature: thresholdEcdsaRoleLocalReservePresignatureWasm,
 			commitClientPresignature: thresholdEcdsaRoleLocalCommitPresignatureWasm,
-			listAvailableClientPresignatures: thresholdEcdsaRoleLocalListAvailablePresignaturesWasm,
+			listAvailableClientPresignatures: thresholdEcdsaListAvailablePresignaturesWasm.bind(void 0, "role_local_derivation_handle"),
 			computeSignatureShareFromPresignatureHandle: thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm
 		},
 		cleanupAfterSign: async () => void 0
 	};
 }
+async function initLinkedHolderPresignSession(holderHandleId, input) {
+	return await thresholdEcdsaLinkedHolderPresignSessionInitWasm({
+		holderHandleId,
+		...input
+	});
+}
+function createLinkedHolderClientSigningMaterialSource(holderHandleId) {
+	return {
+		kind: "router_ab_ecdsa_derivation_client_signing_material_source_v1",
+		initClientPresignSession: initLinkedHolderPresignSession.bind(void 0, holderHandleId),
+		stepClientPresignSession: thresholdEcdsaRoleLocalPresignSessionStepWasm,
+		abortClientPresignSession: thresholdEcdsaRoleLocalPresignSessionAbortWasm,
+		admitClientPresignature: thresholdEcdsaRoleLocalAdmitPresignatureWasm,
+		destroyClientPresignature: thresholdEcdsaRoleLocalDestroyPresignatureWasm,
+		reserveClientPresignature: thresholdEcdsaRoleLocalReservePresignatureWasm,
+		commitClientPresignature: thresholdEcdsaRoleLocalCommitPresignatureWasm,
+		listAvailableClientPresignatures: thresholdEcdsaListAvailablePresignaturesWasm.bind(void 0, "linked_holder_signing_material"),
+		computeSignatureShareFromPresignatureHandle: thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm
+	};
+}
 //#endregion
-export { loadRouterAbEcdsaDerivationSigningMaterialSource };
+export { createLinkedHolderClientSigningMaterialSource, loadRouterAbEcdsaDerivationSigningMaterialSource };
 
 //# sourceMappingURL=ecdsaDerivationClientSigningMaterialSource.js.map

package/dist/esm/core/signingEngine/flows/signEvmFamily/signingFlow.js

@@ -575,10 +575,12 @@ async function signEvmFamilyWithUiConfirm(args) {
 		signedResult = await intent.finalize(signatures);
 		thresholdSignatureCreated = true;
 		await markNonceReservationSigned();
-		if (activeThresholdEcdsaOperation) {
-			const operationId = String(activeThresholdEcdsaOperation.intent.operationId);
-			emitEcdsaSigningTiming(operationId, "transaction_assembly", assemblyStartedAt);
-			emitEcdsaSigningTiming(operationId, "commit_total", commitStartedAt);
+		let completedEcdsaOperationId = null;
+		if (activeThresholdEcdsaOperation) completedEcdsaOperationId = String(activeThresholdEcdsaOperation.intent.operationId);
+		else if (input.authorization.kind === "active_wallet_authority" && input.signingOperation) completedEcdsaOperationId = String(input.signingOperation.operationId);
+		if (completedEcdsaOperationId !== null) {
+			emitEcdsaSigningTiming(completedEcdsaOperationId, "transaction_assembly", assemblyStartedAt);
+			emitEcdsaSigningTiming(completedEcdsaOperationId, "commit_total", commitStartedAt);
 		}
 		emitProgress({
 			phase: SigningEventPhase.STEP_11_TRANSACTION_SIGNED,

package/dist/esm/core/signingEngine/flows/signEvmFamily/signingFlowRuntime.js

@@ -4,9 +4,9 @@ import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ec
 import { requireEvmFamilyEcdsaSigner } from "../../session/identity/exactSigningLaneIdentity.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { isEd25519ExtensionOfEcdsaWalletAuthority } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { exactEcdsaWalletSessionRuntimesMatch } from "../../session/material/ecdsaSigningCapability.js";
+import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
+import { exactAuthorizationMatchesCapability, exactEcdsaWalletSessionRuntimesMatch } from "../../session/material/ecdsaSigningCapability.js";
 import { emitEvmFamilySigningOperationTrace } from "./events.js";
-import { resolveThresholdEcdsaSigningQueueKey } from "../../threshold/ecdsa/signingQueue.js";
 import { loadSecp256k1EngineCtor, loadWebAuthnP256EngineCtor } from "./signerLoader.js";
 import { attachExactEcdsaWalletSessionAuthorization, buildActiveWalletAuthorityReadySecp256k1Material, resolveHydratedSecp256k1SigningMaterial } from "./readySecp256k1Material.js";
 import { resolveExactEcdsaCapabilityRuntime } from "../../session/material/activeEcdsaCapabilityRuntime.js";
@@ -109,7 +109,7 @@ async function prepareSessionBoundEcdsaOperationStepUp(sessionScope, input) {
 }
 async function runSerializedEcdsaMaterialUse(args, task) {
 	return await args.deps.withThresholdEcdsaSigningQueue({
-		queueKey: resolveThresholdEcdsaSigningQueueKey({ materialActivation: args.materialActivation }),
+		queueKey: resolveThresholdCommitQueueKey({ materialActivation: args.materialActivation }),
 		walletId: args.walletId,
 		enabled: true,
 		...args.shouldAbort ? { shouldAbort: args.shouldAbort } : {},
@@ -259,18 +259,19 @@ async function createEvmFamilySigningFlowRuntime(args) {
 	const ctx = args.deps.touchConfirm.getContext();
 	const walletId = toWalletId(args.walletSession.walletId);
 	const relayerUrl = requireEvmFamilyRelayerUrl(args.deps);
-	const resolvedSigner = args.senderSignatureAlgorithm === "secp256k1" ? requireEvmFamilyEcdsaSigner(args.getEcdsaSigningLaneIdentity(), "ECDSA signing material hydration") : void 0;
+	const resolvedSigner = args.senderSignatureAlgorithm === "secp256k1" ? requireEvmFamilyEcdsaSigner(args.preparedSession.kind === "authorized" ? args.preparedSession.signingLane.identity : args.preparedSession.identity, "ECDSA signing material hydration") : void 0;
 	if (args.activeWalletAuthority && !resolvedSigner) throw new Error("[SigningEngine] active Wallet Authority runtime requires a threshold ECDSA signer");
 	const capability = resolvedSigner && !args.activeWalletAuthority ? await args.deps.resolveCanonicalEcdsaSigningCapability({
 		walletId: resolvedSigner.walletId,
 		chainTarget: resolvedSigner.chainTarget,
 		materialActivation: resolvedSigner.materialActivation
 	}) : void 0;
-	const activeAuthorization = resolvedSigner && !args.activeWalletAuthority ? await args.deps.resolveActiveEcdsaWalletSessionAuthorization({
-		walletId: resolvedSigner.walletId,
-		chainTarget: resolvedSigner.chainTarget,
-		materialActivation: resolvedSigner.materialActivation
-	}) : null;
+	const preparedAuthorization = args.preparedSession?.kind === "authorized" ? args.preparedSession.selection.lane.authorization : null;
+	const activeAuthorization = capability && preparedAuthorization && preparedAuthorization.runtime.remainingUses > 0 && exactAuthorizationMatchesCapability({
+		capability,
+		authorization: preparedAuthorization,
+		nowMs: Date.now()
+	}) ? preparedAuthorization : null;
 	const exactOperationCredentialScope = resolvedSigner && capability && !args.activeWalletAuthority ? {
 		walletId: resolvedSigner.walletId,
 		chainTarget: resolvedSigner.chainTarget,

package/dist/esm/core/signingEngine/flows/signEvmFamily/transactionExecutor.js

@@ -13,9 +13,6 @@ function requireRawEip1559ThresholdOwnerNonceSenderIdentity(args) {
 	if (args.state.kind === "not_required") throw new Error(`[SigningEngine][evm-family] raw EIP-1559 signing requires prepared threshold ECDSA owner address for ${args.walletId}`);
 	return thresholdOwnerNonceSenderIdentity(args.state.thresholdOwnerAddress);
 }
-function resolvePreparedNonceSenderIdentity(args) {
-	return resolveThresholdOwnerNonceSenderIdentity(args);
-}
 function resolveFallbackChainAccountNonceSenderIdentity(args) {
 	return resolveWalletChainNonceSenderIdentity({
 		deps: args.deps,
@@ -70,7 +67,7 @@ async function executeEvmFamilyTransactionSigning(args) {
 			walletId: args.walletId,
 			chainTarget: args.chainTarget
 		}) : void 0;
-		const preparedSenderIdentity = resolvePreparedNonceSenderIdentity({ state: args.thresholdEcdsaState });
+		const preparedSenderIdentity = resolveThresholdOwnerNonceSenderIdentity({ state: args.thresholdEcdsaState });
 		const getSenderIdentity = (nonceArgs) => {
 			const exactSenderIdentity = rawEip1559SenderIdentity || preparedSenderIdentity;
 			if (exactSenderIdentity) return Promise.resolve(exactSenderIdentity);
@@ -109,7 +106,7 @@ async function executeEvmFamilyTransactionSigning(args) {
 		});
 	}
 	let tempoFallbackSenderIdentityPromise = null;
-	const tempoPreparedSenderIdentity = resolvePreparedNonceSenderIdentity({ state: args.thresholdEcdsaState });
+	const tempoPreparedSenderIdentity = resolveThresholdOwnerNonceSenderIdentity({ state: args.thresholdEcdsaState });
 	const getTempoSenderIdentity = (nonceArgs) => {
 		if (tempoPreparedSenderIdentity) return Promise.resolve(tempoPreparedSenderIdentity);
 		if (!tempoFallbackSenderIdentityPromise) tempoFallbackSenderIdentityPromise = resolveFallbackChainAccountNonceSenderIdentity({

package/dist/esm/core/signingEngine/flows/signNear/signNear.js

@@ -19,7 +19,7 @@ import { WalletSessionQuotaAdmissionError, buildWalletSessionQuotaAdmissionQueue
 import { walletSessionFailureFromError } from "../../session/lifecycle/walletSessionFailure.js";
 import { resolveNearSigningSessionAuthContext } from "./shared/signingSessionAuthMode.js";
 import { signNearWithUiConfirm } from "./nearSigningFlow.js";
-import { resolveThresholdEd25519CommitQueueKey } from "../../threshold/ed25519/commitQueue.js";
+import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
 import { demoEmailOtpCodeFromDelivery } from "../../session/emailOtp/challengeDelivery.js";
 import { requireAuthoritativeExpiredWalletSessionAuthorizationBoundary } from "../../session/identity/clientSessionPersistenceState.js";
 import { receiveTransactionIntent, recordAvailableSigningLanesRead, selectNearEd25519MaterialCandidate, selectTransactionLaneFromAvailableLanes } from "../../session/identity/selectLane.js";
@@ -446,7 +446,7 @@ async function prepareNearAdHocSigningSession(args) {
 	};
 }
 async function withThresholdEd25519CommitQueue(args) {
-	const queueKey = resolveThresholdEd25519CommitQueueKey({ materialActivation: args.materialActivation });
+	const queueKey = resolveThresholdCommitQueueKey({ materialActivation: args.materialActivation });
 	return await args.deps.withThresholdEd25519CommitQueue({
 		queueKey,
 		nearAccountId: args.nearAccountId,

package/dist/esm/core/signingEngine/routerAb/ecdsaDerivation/presignaturePool.js

@@ -853,6 +853,7 @@ async function signRouterAbEcdsaDerivationDigestWithPoolHitAttempt(args, retryCo
 			});
 		}
 		if (!presignature && supply.kind === "on_demand") {
+			const foregroundRefillStartedAt = performance.now();
 			let refill = await refillRouterAbEcdsaDerivationClientPresignaturePool({
 				...supply.refill,
 				trafficClass: "foreground"
@@ -876,6 +877,7 @@ async function signRouterAbEcdsaDerivationDigestWithPoolHitAttempt(args, retryCo
 				clientSigningMaterial: args.clientSigningMaterial,
 				workerCtx: args.workerCtx
 			});
+			emitEcdsaSigningTiming(args.operationId, "foreground_refill", foregroundRefillStartedAt);
 		}
 		emitSigningSessionFlowTrace("evm-family", {
 			event: "ecdsa_presignature_selection",

package/dist/esm/core/signingEngine/session/availability/availableSigningLanes.js

@@ -8,6 +8,7 @@ import { parseSignerSlot } from "../../../../shared-ts/src/utils/signerSlot.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { canonicalizeLaneFacts, serverIssuedGenerationFromNumber } from "./canonicalLaneInventory.js";
 import { nearEd25519SessionMatchesMaterialActivation } from "../material/nearEd25519YaoSigningPreparation.js";
+import { materialActivationKey } from "../sealedRecovery/materialActivationKey.js";
 //#region src/core/signingEngine/session/availability/availableSigningLanes.ts
 function activeWalletAuthorityAvailableLaneFromProjection(projection) {
 	const base = {
@@ -39,16 +40,6 @@ function ecdsaAuthorizationPolicyMatchesLane(lane) {
 	if (!authorization) return true;
 	return lane.remainingUses === authorization.runtime.remainingUses && lane.expiresAtMs === authorization.runtime.expiresAtMs;
 }
-function materialActivationKey(activation) {
-	return [
-		activation.activationId,
-		activation.capability,
-		activation.materialOwner,
-		activation.keyBinding,
-		activation.lifecycleBinding,
-		activation.signingWorker
-	].map((part) => encodeURIComponent(String(part))).join(":");
-}
 function availableEcdsaSigningLaneAuthMethod(lane) {
 	return signingLaneAuthMethod(lane.auth);
 }

package/dist/esm/core/signingEngine/session/availability/persistedAvailableSigningLanes.js

@@ -82,7 +82,7 @@ async function readPersistedAvailableSigningLanes(deps, args, ecdsaChainTargets)
 		...args,
 		ecdsaChainTargets,
 		requiredEcdsaCapability: "sign"
-	}, new WalletSessionStatusReadScope());
+	}, new WalletSessionStatusReadScope(), "all");
 }
 /**
 * Human operational read: lanes for one exact owner. The auth-method
@@ -97,7 +97,7 @@ async function readOwnerScopedAvailableSigningLanes(deps, args, statusReads) {
 		ecdsaChainTargets: args.ecdsaChainTargets,
 		requiredEcdsaCapability: args.requiredEcdsaCapability,
 		...args.nowMs !== void 0 ? { nowMs: args.nowMs } : {}
-	}, statusReads);
+	}, statusReads, "all");
 }
 async function readPersistedAvailableSigningLanesForSigning(deps, args, defaultEcdsaChainTargets) {
 	if (args.curve === "ecdsa") {
@@ -108,7 +108,7 @@ async function readPersistedAvailableSigningLanesForSigning(deps, args, defaultE
 			...availableLanesArgs,
 			ecdsaChainTargets: [...ecdsaChainTargetsByKey.values()],
 			requiredEcdsaCapability: "sign"
-		}, new WalletSessionStatusReadScope());
+		}, new WalletSessionStatusReadScope(), "ecdsa");
 	}
 	const { curve, ...availableLanesArgs } = args;
 	return await readPersistedAvailableSigningLanes(deps, availableLanesArgs, []);
@@ -133,17 +133,18 @@ function filterEmailOtpCompanionEcdsaRecords(records, chainTargets) {
 	}
 	return matchingRecords;
 }
-async function readPersistedAvailableSigningLanesForTargets(deps, args, statusReads) {
+async function readPersistedAvailableSigningLanesForTargets(deps, args, statusReads, curves) {
 	const walletId = String(toWalletId(args.walletId)).trim();
 	return await readAvailableSigningLanes({
 		...args,
 		walletId,
 		ecdsaChainTargets: args.ecdsaChainTargets
 	}, {
-		listPublicCapabilityReferences: deps.ed25519YaoPublicCapabilityLanes ? deps.ed25519YaoPublicCapabilityLanes.listLanes.bind(deps.ed25519YaoPublicCapabilityLanes) : void 0,
+		listPublicCapabilityReferences: curves === "all" && deps.ed25519YaoPublicCapabilityLanes ? deps.ed25519YaoPublicCapabilityLanes.listLanes.bind(deps.ed25519YaoPublicCapabilityLanes) : void 0,
 		isPublicCapabilityActive: deps.isEd25519YaoPublicCapabilityActive,
-		readActiveWalletSessionAuthorization: deps.readActiveWalletSessionAuthorization?.bind(null, statusReads),
+		readActiveWalletSessionAuthorization: curves === "all" ? deps.readActiveWalletSessionAuthorization?.bind(null, statusReads) : void 0,
 		listSealedRecordsForWallet: async ({ walletId: recordWalletId, filter }) => {
+			if (curves === "ecdsa") return [];
 			const listByAuthMethod = async (authMethod) => {
 				const ed25519Records = await listExactSealedSessionsForWallet({
 					walletId: recordWalletId,

package/dist/esm/core/signingEngine/session/emailOtp/EmailOtpWalletSessionCoordinator.js

@@ -1,44 +1,128 @@
-import { EmailOtpWalletSessionRuntime } from "./coordinatorRuntime.js";
+import { createEmailOtpEcdsaSigningSessionMaterialRestorer } from "./ecdsaRecovery.js";
+import { EmailOtpEcdsaLifecycleRuntime } from "./ecdsaLifecycleRuntime.js";
+import { EmailOtpExportRecoveryRuntime } from "./exportRecoveryRuntime.js";
+import { EmailOtpRuntimeConfig } from "./runtimeConfig.js";
+import { EmailOtpSealedSessionRegistry } from "./sealedSessionRegistry.js";
+import { EmailOtpSealedRefreshPolicy } from "./sealedRefreshPolicy.js";
+import { EmailOtpSealedRestoreOrchestrator } from "./sealedRestoreOrchestrator.js";
+import { EmailOtpWarmSessionRuntime, createEmailOtpWarmSessionWorkerClient } from "./warmSessionRuntime.js";
 //#region src/core/signingEngine/session/emailOtp/EmailOtpWalletSessionCoordinator.ts
 var EmailOtpWalletSessionCoordinator = class {
 	constructor(deps) {
-		this.runtime = new EmailOtpWalletSessionRuntime(deps);
+		this.sealedRefreshDiagnosticLogAtMsByKey = /* @__PURE__ */ new Map();
+		this.runtimeConfig = new EmailOtpRuntimeConfig({
+			configs: deps.configs,
+			getRpId: deps.getRpId
+		});
+		this.sealedSessionRegistry = new EmailOtpSealedSessionRegistry({
+			configs: deps.configs,
+			getSignerWorkerContext: deps.getSignerWorkerContext,
+			commitEvmFamilyThresholdEcdsaSessions: deps.commitEvmFamilyThresholdEcdsaSessions,
+			listActiveEcdsaCapabilityManifestsForWallet: deps.listActiveEcdsaCapabilityManifestsForWallet,
+			writeExactSealedSession: deps.writeExactSealedSession,
+			readExactSealedSession: deps.readExactSealedSession,
+			clearEcdsaRestoreCaches: () => this.clearEcdsaRestoreCaches()
+		});
+		this.ecdsaLifecycleRuntime = new EmailOtpEcdsaLifecycleRuntime({
+			configs: deps.configs,
+			getSignerWorkerContext: deps.getSignerWorkerContext,
+			loadWalletCustodyEd25519Material: deps.loadWalletCustodyEd25519Material,
+			restoreWalletCustodyEcdsaContinuity: deps.restoreWalletCustodyEcdsaContinuity,
+			provisionThresholdEcdsaSession: deps.provisionThresholdEcdsaSession,
+			provisionEmailOtpEcdsaExplicitExportSession: deps.provisionEmailOtpEcdsaExplicitExportSession,
+			runtimeConfig: this.runtimeConfig,
+			ownerLaneScopeStores: deps.ownerLaneScopeStores,
+			resolveSelectedWalletAuthority: deps.resolveSelectedWalletAuthority,
+			resolveCurrentEcdsaCapabilityRuntime: deps.resolveCurrentEcdsaCapabilityRuntime,
+			publicationPorts: () => this.sealedSessionRegistry.ecdsaPublicationPorts()
+		});
+		this.exportRecoveryRuntime = new EmailOtpExportRecoveryRuntime({
+			getSignerWorkerContext: deps.getSignerWorkerContext,
+			requireRelayUrl: () => this.runtimeConfig.requireRelayUrl(),
+			requireSigningSessionSealGroupId: () => this.runtimeConfig.requireSigningSessionSealGroupId(),
+			resolveSelectedWalletAuthority: deps.resolveSelectedWalletAuthority,
+			prepareEcdsaExportCapability: (request) => this.ecdsaLifecycleRuntime.prepareEcdsaExportCapability(request)
+		});
+		const restoreEcdsaSigningSessionMaterialFromSealedRecord = createEmailOtpEcdsaSigningSessionMaterialRestorer({
+			configs: deps.configs,
+			withThresholdEcdsaSigningQueue: deps.withThresholdEcdsaSigningQueue,
+			getSignerWorkerContext: deps.getSignerWorkerContext,
+			resolveSelectedWalletAuthority: deps.resolveSelectedWalletAuthority,
+			readExactWalletSessionAuthorization: deps.readExactWalletSessionAuthorization,
+			provisionThresholdEcdsaSession: deps.provisionThresholdEcdsaSession,
+			commitEvmFamilyThresholdEcdsaSessions: deps.commitEvmFamilyThresholdEcdsaSessions,
+			resolveCurrentEcdsaCapabilityRuntime: deps.resolveCurrentEcdsaCapabilityRuntime
+		});
+		const warmSessionWorkerClient = createEmailOtpWarmSessionWorkerClient({ worker: deps.signerWorkerManager });
+		this.sealedRefreshPolicy = new EmailOtpSealedRefreshPolicy({
+			updateExactSealedSessionPolicy: deps.updateExactSealedSessionPolicy,
+			clearEcdsaRestoreCaches: () => this.clearEcdsaRestoreCaches()
+		});
+		this.sealedRestoreOrchestrator = new EmailOtpSealedRestoreOrchestrator({
+			sessionPersistenceMode: deps.configs.signing.sessionPersistenceMode,
+			listExactSealedSessionsForWallet: deps.listExactSealedSessionsForWallet,
+			readExactSealedSession: deps.readExactSealedSession,
+			acquireSigningSessionRestoreLease: deps.acquireSigningSessionRestoreLease,
+			releaseSigningSessionRestoreLease: deps.releaseSigningSessionRestoreLease,
+			readWarmSessionStatusFromWorker: (thresholdSessionId) => warmSessionWorkerClient.readStatus({
+				kind: "ecdsa",
+				thresholdSessionId
+			}),
+			restoreEcdsaSigningSessionMaterialFromSealedRecord: (restoreArgs) => restoreEcdsaSigningSessionMaterialFromSealedRecord(restoreArgs),
+			recordSessionMaterialRestored: (purpose, status) => this.sealedRefreshPolicy.recordSessionMaterialRestored(purpose, status),
+			shouldLogDiagnostic: (key) => this.shouldLogSealedRefreshDiagnostic(key)
+		});
+		this.warmSessionRuntime = new EmailOtpWarmSessionRuntime({
+			workerClient: warmSessionWorkerClient,
+			sealedRefreshPolicy: this.sealedRefreshPolicy,
+			sealedRestoreOrchestrator: this.sealedRestoreOrchestrator
+		});
 	}
-	persistEcdsaSessionForRefresh(args) {
-		return this.runtime.persistEcdsaSessionForRefresh(args);
+	async persistEcdsaSessionForRefresh(args) {
+		await this.sealedSessionRegistry.persistEcdsaSessionForRefresh(args);
 	}
-	discoverPersistedSessionsForWallet(args) {
-		return this.runtime.discoverPersistedSessionsForWallet(args);
+	clearEcdsaRestoreCaches() {
+		this.sealedRestoreOrchestrator.clearCache();
 	}
-	restorePersistedSessionForSigning(args) {
-		return this.runtime.restorePersistedSessionForSigning(args);
+	shouldLogSealedRefreshDiagnostic(key, nowMs = Date.now()) {
+		const normalizedKey = String(key || "").trim();
+		if (!normalizedKey) return false;
+		if (nowMs - (this.sealedRefreshDiagnosticLogAtMsByKey.get(normalizedKey) || 0) < 6e4) return false;
+		this.sealedRefreshDiagnosticLogAtMsByKey.set(normalizedKey, nowMs);
+		return true;
 	}
-	readWarmSessionStatusOnly(target) {
-		return this.runtime.readWarmSessionStatusOnly(target);
+	async discoverPersistedSessionsForWallet(args) {
+		return await this.sealedRestoreOrchestrator.discoverPersistedSessionsForWallet(args);
 	}
-	consumeWarmSessionUses(args) {
-		return this.runtime.consumeWarmSessionUses(args);
+	async restorePersistedSessionForSigning(args) {
+		return await this.sealedRestoreOrchestrator.restorePersistedSessionForSigning(args);
 	}
-	clearVolatileWarmSessionMaterial(target) {
-		return this.runtime.clearVolatileWarmSessionMaterial(target);
+	async readWarmSessionStatusOnly(target) {
+		return await this.warmSessionRuntime.readWarmSessionStatusOnly(target);
+	}
+	async consumeWarmSessionUses(args) {
+		return await this.warmSessionRuntime.consumeWarmSessionUses(args);
+	}
+	async clearVolatileWarmSessionMaterial(target) {
+		await this.warmSessionRuntime.clearVolatileWarmSessionMaterial(target);
 	}
 	async requestTransactionSigningChallenge(args) {
-		return await this.runtime.requestTransactionSigningChallenge(args);
+		return await this.exportRecoveryRuntime.requestTransactionSigningChallenge(args);
 	}
 	async requestExportChallenge(args) {
-		return await this.runtime.requestExportChallenge(args);
+		return await this.exportRecoveryRuntime.requestExportChallenge(args);
 	}
-	exportEcdsaKeyWithDurableAuthorization(args) {
-		return this.runtime.exportEcdsaKeyWithDurableAuthorization(args);
+	async exportEcdsaKeyWithDurableAuthorization(args) {
+		return await this.exportRecoveryRuntime.exportEcdsaKeyWithDurableAuthorization(args);
 	}
-	exportEd25519YaoSeedWithFreshEmailOtpLane(args) {
-		return this.runtime.exportEd25519YaoSeedWithFreshEmailOtpLane(args);
+	async exportEd25519YaoSeedWithFreshEmailOtpLane(args) {
+		return await this.exportRecoveryRuntime.exportEd25519YaoSeedWithFreshEmailOtpLane(args);
 	}
-	loginWithEcdsaCapabilityForSigning(args) {
-		return this.runtime.loginWithEcdsaCapabilityForSigning(args);
+	async loginWithEcdsaCapabilityForSigning(args) {
+		return await this.ecdsaLifecycleRuntime.loginWithEcdsaCapabilityForSigning(args);
 	}
-	loginWithEcdsaCapabilityInternal(args) {
-		return this.runtime.loginWithEcdsaCapabilityInternal(args);
+	async loginWithEcdsaCapabilityInternal(args) {
+		return await this.ecdsaLifecycleRuntime.loginWithEcdsaCapabilityInternal(args);
 	}
 };
 //#endregion

package/dist/esm/core/signingEngine/session/emailOtp/ecdsaLogin.js

@@ -2,6 +2,7 @@ import { mpcMaterialActivationRefsEqual, parseThresholdEcdsaSessionId, parseWall
 import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
+import { sameRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { SigningSessionIds } from "../operationState/types.js";
 import { buildEvmFamilyEcdsaRecoveredMaterialLanePolicy, buildEvmFamilyEcdsaSessionLanePolicy, toEvmFamilyEcdsaKeyHandle } from "../identity/evmFamilyEcdsaIdentity.js";
 import { DEFAULT_THRESHOLD_SESSION_POLICY, DEFAULT_UNLOCK_REMAINING_USES, clampThresholdSessionPolicy, resolveWalletUnlockSessionUsesFromRequestedUses } from "../../threshold/sessionPolicy.js";
@@ -288,12 +289,9 @@ function requireEmailOtpEcdsaCustodySigner(continuity, walletId, keyHandle) {
 	const first = continuity.signers[0];
 	if (!first) throw new Error("Email OTP ECDSA custody continuity is empty");
 	if (first.walletKey.walletId !== walletId || first.walletKey.keyHandle !== keyHandle) throw new Error("Email OTP ECDSA custody continuity changed the requested wallet key");
-	for (const signer of continuity.signers) if (signer.walletKey.walletId !== first.walletKey.walletId || signer.walletKey.keyHandle !== first.walletKey.keyHandle || signer.walletKey.ecdsaThresholdKeyId !== first.walletKey.ecdsaThresholdKeyId || signer.walletKey.signingRootId !== first.walletKey.signingRootId || signer.walletKey.signingRootVersion !== first.walletKey.signingRootVersion || signer.walletKey.relayerKeyId !== first.walletKey.relayerKeyId || !sameRouterAbEcdsaDerivationPublicCapabilityV1(signer.walletKey.publicCapability, first.walletKey.publicCapability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(signer.activationReceipt, first.activationReceipt) || !sameEmailOtpRuntimePolicyScope(signer.runtimePolicyScope, first.runtimePolicyScope)) throw new Error("Email OTP ECDSA custody continuity conflicts across targets");
+	for (const signer of continuity.signers) if (signer.walletKey.walletId !== first.walletKey.walletId || signer.walletKey.keyHandle !== first.walletKey.keyHandle || signer.walletKey.ecdsaThresholdKeyId !== first.walletKey.ecdsaThresholdKeyId || signer.walletKey.signingRootId !== first.walletKey.signingRootId || signer.walletKey.signingRootVersion !== first.walletKey.signingRootVersion || signer.walletKey.relayerKeyId !== first.walletKey.relayerKeyId || !sameRouterAbEcdsaDerivationPublicCapabilityV1(signer.walletKey.publicCapability, first.walletKey.publicCapability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(signer.activationReceipt, first.activationReceipt) || !sameRuntimePolicyScope(signer.runtimePolicyScope, first.runtimePolicyScope)) throw new Error("Email OTP ECDSA custody continuity conflicts across targets");
 	return first;
 }
-function sameEmailOtpRuntimePolicyScope(left, right) {
-	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
 function nonEmptyEmailOtpEcdsaChainTargets(continuity) {
 	const [first, ...rest] = continuity.signers;
 	if (!first) throw new Error("Email OTP ECDSA custody continuity is empty");
@@ -504,7 +502,7 @@ async function provisionEmailOtpExistingKeySessions(args) {
 		},
 		authorization: additionalAuthorization
 	};
-	const bootstraps = [primaryBootstrap, ...await Promise.all(args.publicationChainTargets.slice(1).map(provisionEmailOtpAdditionalExistingKeySessionForTarget.bind(null, additionalContext)))];
+	const bootstraps = [primaryBootstrap, ...await Promise.all(args.publicationChainTargets.slice(1).map(provisionEmailOtpExistingKeySessionForTarget.bind(null, additionalContext)))];
 	if (!primaryBootstrap) throw new Error("Email OTP ECDSA activation did not return a primary warm session");
 	return bootstraps;
 }
@@ -526,9 +524,6 @@ async function provisionEmailOtpExistingKeySessionForTarget(context, chainTarget
 		authorization: context.authorization
 	}));
 }
-async function provisionEmailOtpAdditionalExistingKeySessionForTarget(context, chainTarget) {
-	return await provisionEmailOtpExistingKeySessionForTarget(context, chainTarget);
-}
 async function provisionEmailOtpExplicitExportSession(args) {
 	return await args.ports.provisionEmailOtpEcdsaExplicitExportSession(buildEmailOtpExplicitExportEcdsaActivation({
 		relayerUrl: args.relayerUrl,

package/dist/esm/core/signingEngine/session/emailOtp/ecdsaRecovery.js

@@ -7,9 +7,9 @@ import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAu
 import { parseEmailOtpWorkerIssuedSessionHandle } from "../../../platform/secretSources.js";
 import { buildEcdsaRoleLocalPublicFacts } from "../persistence/ecdsaRoleLocalRecords.js";
 import { buildEmailOtpAuthContextForWalletAuthMethod, emailOtpAuthContextProviderUserId, emailOtpAuthContextRetention } from "../identity/laneIdentity.js";
+import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
 import { buildCanonicalEvmFamilyEcdsaSigningCapability, buildExactEvmFamilyWalletSessionAuthorization } from "../material/ecdsaSigningCapability.js";
 import { buildPersistedEcdsaRoleLocalMaterial } from "../material/ecdsaRoleLocalMaterialResolver.js";
-import { resolveThresholdEcdsaSigningQueueKey } from "../../threshold/ecdsa/signingQueue.js";
 import { requestRehydrateEmailOtpEcdsaWarmSessionMaterial } from "./workerRequests.js";
 import { emailOtpEcdsaSealAuthorizationThresholdSessionId } from "./ecdsaPublication.js";
 import { buildEmailOtpRecoveredKeyActivation } from "./ecdsaLogin.js";
@@ -147,7 +147,7 @@ async function restoreEmailOtpEcdsaSigningSessionMaterialFromSealedRecord(args)
 	if (sealedRecord.authMethod !== "email_otp" || sealedRecord.curve !== "ecdsa") return null;
 	const materialActivation = sealedRecord.roleLocalMaterialRef.materialActivation;
 	return await args.withThresholdEcdsaSigningQueue({
-		queueKey: resolveThresholdEcdsaSigningQueueKey({ materialActivation }),
+		queueKey: resolveThresholdCommitQueueKey({ materialActivation }),
 		walletId: toWalletId(sealedRecord.walletId),
 		enabled: true,
 		task: async () => await restoreEmailOtpEcdsaSigningSessionMaterialFromSealedRecordInQueue(args)

package/dist/esm/core/signingEngine/session/identity/selectLane.js

@@ -35,9 +35,7 @@ function nearEd25519TransactionReauthState(lane) {
 	if (lane.state === "exhausted") return "exhausted";
 	return null;
 }
-function nearEd25519TransactionReadyAvailableLaneProjection(lane) {
-	const state = nearEd25519TransactionReadyState(lane);
-	if (!state) throw new Error("[SigningSessionSelectLane] Ed25519 lane is not transaction-ready");
+function nearEd25519TransactionAvailableLaneProjection(lane, state) {
 	return {
 		auth: lane.auth,
 		curve: "ed25519",
@@ -57,27 +55,15 @@ function nearEd25519TransactionReadyAvailableLaneProjection(lane) {
 		...lane.updatedAtMs == null ? {} : { updatedAtMs: lane.updatedAtMs }
 	};
 }
+function nearEd25519TransactionReadyAvailableLaneProjection(lane) {
+	const state = nearEd25519TransactionReadyState(lane);
+	if (!state) throw new Error("[SigningSessionSelectLane] Ed25519 lane is not transaction-ready");
+	return nearEd25519TransactionAvailableLaneProjection(lane, state);
+}
 function nearEd25519TransactionReauthAvailableLaneProjection(lane) {
 	const state = nearEd25519TransactionReauthState(lane);
 	if (!state) throw new Error("[SigningSessionSelectLane] Ed25519 lane is not transaction-reauthable");
-	return {
-		auth: lane.auth,
-		curve: "ed25519",
-		chain: "near",
-		materialActivation: lane.materialActivation,
-		walletId: lane.walletId,
-		nearAccountId: lane.nearAccountId,
-		nearEd25519SigningKeyId: lane.nearEd25519SigningKeyId,
-		signerSlot: lane.signerSlot,
-		authorizationState: "authorized",
-		authorization: lane.authorization,
-		state,
-		thresholdSessionId: lane.thresholdSessionId,
-		...lane.remainingUses == null ? {} : { remainingUses: lane.remainingUses },
-		...lane.expiresAtMs == null ? {} : { expiresAtMs: lane.expiresAtMs },
-		...lane.policyHint ? { policyHint: lane.policyHint } : {},
-		...lane.updatedAtMs == null ? {} : { updatedAtMs: lane.updatedAtMs }
-	};
+	return nearEd25519TransactionAvailableLaneProjection(lane, state);
 }
 function selectedEd25519LaneForTransactionCandidate(candidate) {
 	return selectedEd25519Lane({

package/dist/esm/core/signingEngine/session/material/activeWalletAuthorityEcdsaRuntime.js

@@ -6,6 +6,7 @@ import { buildBaseEvmFamilyEcdsaKeyIdentity, buildPasskeyEcdsaAuthBinding, build
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { sameRouterAbEcdsaDerivationNormalSigningScopeV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { sameEcdsaSourceSigner, sameEcdsaTarget } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
 import { isActiveEcdsaWalletAuthorityV1, isCombinedWalletSignerActivationSetV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { resolveLinkedEcdsaHolderRuntimeV1 } from "./linkedEcdsaHolderRuntime.js";
 import { bytesToHex } from "../../chains/evm/bytes.js";
@@ -72,14 +73,8 @@ function normalSigningAddress(normalSigning) {
 		return null;
 	}
 }
-function linkedEcdsaSourceSignerIdentitiesEqual(left, right) {
-	return mpcMaterialActivationRefsEqual(left.activation, right.activation) && left.clientPublicKey33B64u === right.clientPublicKey33B64u && left.relayerPublicKey33B64u === right.relayerPublicKey33B64u && left.thresholdPublicKey33B64u === right.thresholdPublicKey33B64u && left.thresholdEthereumAddress20B64u === right.thresholdEthereumAddress20B64u;
-}
-function linkedEcdsaTargetRecipientPreparationsEqual(left, right) {
-	return mpcMaterialActivationRefsEqual(left.activation, right.activation) && left.targetDeviceId === right.targetDeviceId && left.targetFactorVerificationDigestB64u === right.targetFactorVerificationDigestB64u && left.clientRecipientPublicKeyB64u === right.clientRecipientPublicKeyB64u && left.signingWorkerRecipientPublicKeyB64u === right.signingWorkerRecipientPublicKeyB64u;
-}
 function linkedEcdsaSourceContributionBindingsEqual(left, right) {
-	return left.linkSessionId === right.linkSessionId && left.enrollmentId === right.enrollmentId && left.sourceAuthorityId === right.sourceAuthorityId && linkedEcdsaSourceSignerIdentitiesEqual(left.source, right.source) && linkedEcdsaTargetRecipientPreparationsEqual(left.target, right.target) && left.targetClientPublicKey33B64u === right.targetClientPublicKey33B64u;
+	return left.linkSessionId === right.linkSessionId && left.enrollmentId === right.enrollmentId && left.sourceAuthorityId === right.sourceAuthorityId && sameEcdsaSourceSigner(left.source, right.source) && sameEcdsaTarget(left.target, right.target) && left.targetClientPublicKey33B64u === right.targetClientPublicKey33B64u;
 }
 function linkedEcdsaNormalSigningStatesEqual(left, right) {
 	return left.kind === right.kind && sameRouterAbEcdsaDerivationNormalSigningScopeV1(left.scope, right.scope);

package/dist/esm/core/signingEngine/session/material/ecdsaCapabilityManifest.js

@@ -4,7 +4,7 @@ import { isoTimestampFromUnixMs } from "../../../../shared-ts/src/utils/canonica
 import { deriveSigningRootId, normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseEcdsaActivationDigest, parseEcdsaLifecycleId } from "../../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { parseRouterAbEcdsaRegistrationActivationReceiptV1, sameRegistrationRecipientKeys, sameRegistrationSignerSet, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbServerIdentityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 //#region src/core/signingEngine/session/material/ecdsaCapabilityManifest.ts
 var EcdsaCapabilityManifestProof = class {
 	retainProof() {
@@ -468,20 +468,8 @@ function assertDurableMaterialMatchesActivation(durableMaterial, activationBindi
 		receipt: receipt.protocolReceipt
 	});
 }
-function routerAbEcdsaPublicIdentitiesEqual(left, right) {
-	return left.context_binding_b64u === right.context_binding_b64u && left.derivation_client_share_public_key33_b64u === right.derivation_client_share_public_key33_b64u && left.server_public_key33_b64u === right.server_public_key33_b64u && left.threshold_public_key33_b64u === right.threshold_public_key33_b64u && left.ethereum_address20_b64u === right.ethereum_address20_b64u && left.client_share_retry_counter === right.client_share_retry_counter && left.server_share_retry_counter === right.server_share_retry_counter;
-}
-function routerAbServerIdentitiesEqual(left, right) {
-	return left.server_id === right.server_id && left.key_epoch === right.key_epoch && left.recipient_encryption_key === right.recipient_encryption_key;
-}
-function routerAbEcdsaSignerSetsEqual(left, right) {
-	return left.signer_set_id === right.signer_set_id && left.policy === right.policy && left.signer_a.role === right.signer_a.role && left.signer_a.signer_id === right.signer_a.signer_id && left.signer_a.key_epoch === right.signer_a.key_epoch && left.signer_b.role === right.signer_b.role && left.signer_b.signer_id === right.signer_b.signer_id && left.signer_b.key_epoch === right.signer_b.key_epoch && routerAbServerIdentitiesEqual(left.selected_server, right.selected_server);
-}
-function routerAbEcdsaRecipientKeysEqual(left, right) {
-	return left.deriver_a.role === right.deriver_a.role && left.deriver_a.key_epoch === right.deriver_a.key_epoch && left.deriver_a.public_key === right.deriver_a.public_key && left.deriver_b.role === right.deriver_b.role && left.deriver_b.key_epoch === right.deriver_b.key_epoch && left.deriver_b.public_key === right.deriver_b.public_key;
-}
 function routerAbEcdsaDerivationPublicCapabilitiesEqual(left, right) {
-	return left.kind === right.kind && left.context.application_binding_digest_b64u === right.context.application_binding_digest_b64u && routerAbEcdsaPublicIdentitiesEqual(left.public_identity, right.public_identity) && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation) && routerAbEcdsaSignerSetsEqual(left.signer_set, right.signer_set) && routerAbEcdsaRecipientKeysEqual(left.deriver_recipient_keys, right.deriver_recipient_keys) && left.router_id === right.router_id && left.client_id === right.client_id && left.activation_epoch === right.activation_epoch && left.registration_request_digest_b64u === right.registration_request_digest_b64u && left.proof_transcript_digest_b64u === right.proof_transcript_digest_b64u;
+	return left.kind === right.kind && left.context.application_binding_digest_b64u === right.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(left.public_identity, right.public_identity) && sameRouterAbMpcMaterialActivationRef(left.material_activation, right.material_activation) && sameRegistrationSignerSet(left.signer_set, right.signer_set) && sameRegistrationRecipientKeys(left.deriver_recipient_keys, right.deriver_recipient_keys) && left.router_id === right.router_id && left.client_id === right.client_id && left.activation_epoch === right.activation_epoch && left.registration_request_digest_b64u === right.registration_request_digest_b64u && left.proof_transcript_digest_b64u === right.proof_transcript_digest_b64u;
 }
 function assertNormalSigningMatchesActivation(input) {
 	const scope = input.normalSigning.scope;
@@ -496,7 +484,7 @@ function assertNormalSigningMatchesActivation(input) {
 		lifecycleBinding: expectedMaterialActivation.lifecycleBinding,
 		signingWorker: expectedMaterialActivation.signingWorker
 	});
-	if (scope.wallet_id !== String(input.activationBinding.signer.walletId) || scope.ecdsa_threshold_key_id !== String(input.activationBinding.roleLocalBinding.ecdsaThresholdKeyId) || scope.signing_root_id !== String(input.activationBinding.signer.signingRootId) || scope.signing_root_version !== String(input.activationBinding.signer.signingRootVersion) || scope.context.application_binding_digest_b64u !== input.receipt.ecdsa_activation.context.application_binding_digest_b64u || !routerAbEcdsaPublicIdentitiesEqual(scope.public_identity, input.receipt.ecdsa_activation.public_identity) || !routerAbServerIdentitiesEqual(scope.signing_worker, input.receipt.ecdsa_activation.signing_worker) || scope.activation_epoch !== input.receipt.ecdsa_activation.activation_epoch || scope.public_identity.context_binding_b64u !== facts.contextBinding32B64u || scope.public_identity.derivation_client_share_public_key33_b64u !== facts.derivationClientSharePublicKey33B64u || scope.public_identity.server_public_key33_b64u !== facts.relayerPublicKey33B64u || scope.public_identity.threshold_public_key33_b64u !== facts.groupPublicKey33B64u || !sameRouterAbMpcMaterialActivationRef(scope.material_activation, expectedMaterialActivationWire)) throw new Error("ECDSA normal-signing runtime does not match its activation");
+	if (scope.wallet_id !== String(input.activationBinding.signer.walletId) || scope.ecdsa_threshold_key_id !== String(input.activationBinding.roleLocalBinding.ecdsaThresholdKeyId) || scope.signing_root_id !== String(input.activationBinding.signer.signingRootId) || scope.signing_root_version !== String(input.activationBinding.signer.signingRootVersion) || scope.context.application_binding_digest_b64u !== input.receipt.ecdsa_activation.context.application_binding_digest_b64u || !sameRouterAbEcdsaDerivationPublicIdentityV1(scope.public_identity, input.receipt.ecdsa_activation.public_identity) || !sameRouterAbServerIdentityV1(scope.signing_worker, input.receipt.ecdsa_activation.signing_worker) || scope.activation_epoch !== input.receipt.ecdsa_activation.activation_epoch || scope.public_identity.context_binding_b64u !== facts.contextBinding32B64u || scope.public_identity.derivation_client_share_public_key33_b64u !== facts.derivationClientSharePublicKey33B64u || scope.public_identity.server_public_key33_b64u !== facts.relayerPublicKey33B64u || scope.public_identity.threshold_public_key33_b64u !== facts.groupPublicKey33B64u || !sameRouterAbMpcMaterialActivationRef(scope.material_activation, expectedMaterialActivationWire)) throw new Error("ECDSA normal-signing runtime does not match its activation");
 }
 function assertValidEcdsaReplacement(active, replacement) {
 	if (active.identity.manifestId === replacement.identity.manifestId || Number(replacement.identity.manifestRevision) !== Number(active.identity.manifestRevision) + 1 || active.signer.capability !== replacement.signer.capability || active.signer.signerId !== replacement.signer.signerId || active.signer.walletId !== replacement.signer.walletId || active.signer.authority.authorityDigest !== replacement.signer.authority.authorityDigest || active.signer.materialOwner !== replacement.signer.materialOwner || active.durableMaterial.durableMaterialRef === replacement.durableMaterial.durableMaterialRef || active.activation.serverActivation.serverGeneration === replacement.activation.serverActivation.serverGeneration) throw new Error("ECDSA replacement manifest does not exactly replace the active manifest");

package/dist/esm/core/signingEngine/session/material/ecdsaSigningCapability.js

@@ -226,6 +226,6 @@ async function buildCanonicalEvmFamilyEcdsaSigningCapability(input) {
 	};
 }
 //#endregion
-export { authorizeEvmFamilyEcdsaSigningCapability, buildCanonicalEvmFamilyEcdsaSigningCapability, buildEcdsaPreprocessingCapability, buildExactEcdsaDirectCapabilityRuntime, buildExactEvmFamilyWalletSessionAuthorization, exactEcdsaWalletSessionRuntimesMatch, signingAuthorizationFromPreprocessing };
+export { authorizeEvmFamilyEcdsaSigningCapability, buildCanonicalEvmFamilyEcdsaSigningCapability, buildEcdsaPreprocessingCapability, buildExactEcdsaDirectCapabilityRuntime, buildExactEvmFamilyWalletSessionAuthorization, exactAuthorizationMatchesCapability, exactEcdsaWalletSessionRuntimesMatch, signingAuthorizationFromPreprocessing };
 
 //# sourceMappingURL=ecdsaSigningCapability.js.map