@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/core/signingEngine/session/material/ecdsaRoleLocalMaterialResolver.js

@@ -15,7 +15,6 @@ function errorMessage(error) {
 function corruptResolution(args) {
 	return {
 		kind: "corrupt",
-		purpose: args.purpose,
 		reason: args.reason,
 		message: args.message
 	};
@@ -24,21 +23,17 @@ function resolutionFromRehydrationFailure(args) {
 	switch (args.failure.reason) {
 		case "missing": return {
 			kind: "device_link_required",
-			purpose: args.purpose,
 			reason: "missing_local_material"
 		};
 		case "expired": return corruptResolution({
-			purpose: args.purpose,
 			reason: "expired",
 			message: "ECDSA role-local persisted material has expired"
 		});
 		case "binding_mismatch": return corruptResolution({
-			purpose: args.purpose,
 			reason: "binding_mismatch",
 			message: "ECDSA role-local persisted material binding does not match its public facts"
 		});
 		case "corrupt": return corruptResolution({
-			purpose: args.purpose,
 			reason: "corrupt_persistence",
 			message: "ECDSA role-local persisted material is corrupt"
 		});
@@ -74,7 +69,6 @@ async function resolveEcdsaRoleLocalMaterial(input) {
 	switch (input.source.kind) {
 		case "unavailable": return {
 			kind: "device_link_required",
-			purpose: input.purpose,
 			reason: input.source.reason
 		};
 		case "persisted": try {
@@ -83,29 +77,22 @@ async function resolveEcdsaRoleLocalMaterial(input) {
 				materialActivation: input.source.materialActivation,
 				workerCtx: input.workerCtx
 			});
-			if (!rehydrated.ok) return resolutionFromRehydrationFailure({
-				purpose: input.purpose,
-				failure: rehydrated
-			});
+			if (!rehydrated.ok) return resolutionFromRehydrationFailure({ failure: rehydrated });
 			if (!mpcMaterialActivationRefsEqual(rehydrated.materialRef.materialActivation, input.source.materialActivation) || !materialRefMatchesPublicFacts(rehydrated.materialRef, input.source.publicFacts)) return corruptResolution({
-				purpose: input.purpose,
 				reason: "worker_identity_mismatch",
 				message: "ECDSA role-local worker restored a different material identity"
 			});
 			if (!liveHandleMatchesMaterialRef(rehydrated.liveHandle, rehydrated.materialRef)) return corruptResolution({
-				purpose: input.purpose,
 				reason: "worker_identity_mismatch",
 				message: "ECDSA role-local worker restored a different durable material"
 			});
 			return {
 				kind: "rehydrated",
-				purpose: input.purpose,
 				liveHandle: rehydrated.liveHandle,
 				materialRef: rehydrated.materialRef
 			};
 		} catch (error) {
 			return corruptResolution({
-				purpose: input.purpose,
 				reason: "persistence_unavailable",
 				message: errorMessage(error)
 			});

package/dist/esm/core/signingEngine/session/material/ecdsaSigningCapability.js

@@ -226,6 +226,6 @@ async function buildCanonicalEvmFamilyEcdsaSigningCapability(input) {
 	};
 }
 //#endregion
-export { authorizeEvmFamilyEcdsaSigningCapability, buildCanonicalEvmFamilyEcdsaSigningCapability, buildEcdsaPreprocessingCapability, buildExactEcdsaDirectCapabilityRuntime, buildExactEvmFamilyWalletSessionAuthorization, exactEcdsaWalletSessionRuntimesMatch, signingAuthorizationFromPreprocessing };
+export { authorizeEvmFamilyEcdsaSigningCapability, buildCanonicalEvmFamilyEcdsaSigningCapability, buildEcdsaPreprocessingCapability, buildExactEcdsaDirectCapabilityRuntime, buildExactEvmFamilyWalletSessionAuthorization, exactAuthorizationMatchesCapability, exactEcdsaWalletSessionRuntimesMatch, signingAuthorizationFromPreprocessing };
 
 //# sourceMappingURL=ecdsaSigningCapability.js.map

package/dist/esm/core/signingEngine/session/operationState/preparedOperation.js

@@ -1,10 +1,7 @@
 import { signingLaneAuthMethod } from "../identity/signingLaneAuthBinding.js";
 //#region src/core/signingEngine/session/operationState/preparedOperation.ts
 async function prepareThresholdSigningOperation(args) {
-	const lifecycle = await args.lifecycleAdapter.prepare({
-		intent: args.intent,
-		...args.operation ? { operation: args.operation } : {}
-	});
+	const lifecycle = await args.lifecycleAdapter.prepare({ ...args.operation ? { operation: args.operation } : {} });
 	if (lifecycle.lane.curve !== lifecycle.readiness.readiness.curve) throw new Error("[SigningSession] prepared lane and readiness curves do not match");
 	const coordinatorInput = {
 		lane: lifecycle.lane,
@@ -19,7 +16,6 @@ async function prepareThresholdSigningOperation(args) {
 	};
 	const resolved = await args.coordinator.resolveAuthPlanFromReadiness(coordinatorInput, args.onPlannerTrace);
 	return {
-		intent: args.intent,
 		...args.operation ? { operation: args.operation } : {},
 		lane: lifecycle.lane,
 		authMethod: signingLaneAuthMethod(lifecycle.lane.auth),

package/dist/esm/core/signingEngine/session/passkey/ecdsaBootstrap.js

@@ -74,8 +74,7 @@ function toActivateEcdsaSessionRequest(request, relayerUrl) {
 			existingRoleLocalMaterial: exactRequest.existingRoleLocalMaterial,
 			...exactRequest.requestId ? { requestId: exactRequest.requestId } : {},
 			...auth,
-			...walletSessionRouteAuth ? { walletSessionRouteAuth } : {},
-			runtimeScopeBootstrap: exactRequest.runtimeScopeBootstrap
+			...walletSessionRouteAuth ? { walletSessionRouteAuth } : {}
 		};
 	};
 	const preauthorizedExactSessionRequest = (exactRequest) => ({
@@ -90,8 +89,7 @@ function toActivateEcdsaSessionRequest(request, relayerUrl) {
 		...exactRequest.requestId ? { requestId: exactRequest.requestId } : {},
 		authKind: "passkey",
 		passkeyCredentialIdB64u: exactRequest.passkeyCredentialIdB64u,
-		preauthorizedSessionActivation: exactRequest.sessionActivation,
-		runtimeScopeBootstrap: exactRequest.runtimeScopeBootstrap
+		preauthorizedSessionActivation: exactRequest.sessionActivation
 	});
 	switch (request.kind) {
 		case "passkey_fresh_ecdsa_bootstrap": return exactSessionRequest(request, request.routeAuth, {
@@ -119,8 +117,7 @@ function toActivateEcdsaSessionRequest(request, relayerUrl) {
 				existingRoleLocalMaterial: request.existingRoleLocalMaterial,
 				...request.requestId ? { requestId: request.requestId } : {},
 				...auth,
-				preauthorizedSessionActivation: request.sessionActivation,
-				runtimeScopeBootstrap: request.runtimeScopeBootstrap
+				preauthorizedSessionActivation: request.sessionActivation
 			} : exactSessionRequest(request, request.routeAuth, auth);
 		}
 	}

package/dist/esm/core/signingEngine/session/passkey/ecdsaKeyFactsInventory.js

@@ -105,7 +105,6 @@ function parseProfileContinuityEcdsaWarmKey(args) {
 		reason: keyHandleResolution.reason
 	};
 	const walletKey = parseProfileContinuityEvmFamilyEcdsaWalletKey({
-		walletId: args.walletId,
 		metadata,
 		keyHandle: keyHandleResolution.keyHandle,
 		chainTarget

package/dist/esm/core/signingEngine/session/passkey/ecdsaRecovery.js

@@ -18,10 +18,7 @@ async function checkCurrentPasskeyEcdsaRuntime(args) {
 		walletId: toWalletId(args.record.walletId),
 		chainTarget: args.record.chainTarget
 	});
-	if (resolution.kind === "resolved" && mpcMaterialActivationRefsEqual(resolution.runtime.materialActivation, args.record.roleLocalMaterialRef.materialActivation)) return {
-		kind: "current",
-		resolution
-	};
+	if (resolution.kind === "resolved" && mpcMaterialActivationRefsEqual(resolution.runtime.materialActivation, args.record.roleLocalMaterialRef.materialActivation)) return { kind: "current" };
 	return {
 		kind: "superseded",
 		status: {

package/dist/esm/core/signingEngine/session/passkey/ed25519SessionProvision.js

@@ -108,7 +108,6 @@ async function provisionThresholdEd25519Session(deps, args) {
 		touchIdPrompt: deps.touchIdPrompt,
 		relayerUrl,
 		relayerKeyId: args.relayerKeyId,
-		walletId: protocol.walletId,
 		nearEd25519SigningKeyId: protocol.nearEd25519SigningKeyId,
 		authority: args.authority,
 		...args.auth ? { auth: args.auth } : {},

package/dist/esm/core/signingEngine/session/passkey/ed25519YaoLocalMaterial.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef, parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
 import { asRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { requireRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
 import { normalizeThresholdRuntimePolicyScope } from "../../threshold/sessionPolicy.js";
 import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { ROUTER_AB_ED25519_YAO_ACTIVE_CLIENT_KIND_V1, RouterAbEd25519YaoClientV1 } from "../../threshold/ed25519/yaoClient.js";
@@ -466,8 +466,7 @@ async function hydratePasskeyEd25519YaoLocalMaterialV1(input) {
 			if (!material || material.activeClient.status().kind !== "active" || !mpcMaterialActivationRefsEqual(plan.materialActivation, nearEd25519YaoMaterialActivationFromMetadata(material.activeClient.metadata()))) throw new Error("Near Ed25519 live hydration plan lost its exact runtime");
 			return {
 				kind: "live",
-				plan,
-				material
+				plan
 			};
 		}
 		case "rehydrate_material_activation": {

package/dist/esm/core/signingEngine/session/passkey/ed25519YaoWarmRecovery.js

@@ -1,11 +1,11 @@
 import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
 import { isPlainObject, requireRecord, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
 import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
 import { toAccountId } from "../../../types/accountIds.js";
 import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { normalizeRuntimePolicyScope, sameRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { ed25519DurableMaterialLocator } from "../sealedRecovery/materialActivationKey.js";
 import { parseEd25519YaoRecoveryCapabilityV1 } from "./ed25519YaoRecoveryCapability.js";
@@ -52,22 +52,10 @@ async function resolveExactWarmRecoveryRecord(subject, runtime) {
 		authMethod: "passkey",
 		materialActivation: subject.materialActivation
 	}));
-	if (record && (record.curve !== "ed25519" || !sealedRecordMatchesSubject(record, subject) || !mpcMaterialActivationRefsEqual(record.ed25519Restore.materialActivation, subject.materialActivation))) return {
-		kind: "unavailable",
-		reason: "sealed_session_missing"
-	};
-	if (!record) return {
-		kind: "unavailable",
-		reason: "sealed_session_missing"
-	};
-	if (record.expiresAtMs <= runtime.nowMs()) return {
-		kind: "unavailable",
-		reason: "sealed_session_expired"
-	};
-	if (record.remainingUses < 1) return {
-		kind: "unavailable",
-		reason: "sealed_session_exhausted"
-	};
+	if (record && (record.curve !== "ed25519" || !sealedRecordMatchesSubject(record, subject) || !mpcMaterialActivationRefsEqual(record.ed25519Restore.materialActivation, subject.materialActivation))) return { kind: "unavailable" };
+	if (!record) return { kind: "unavailable" };
+	if (record.expiresAtMs <= runtime.nowMs()) return { kind: "unavailable" };
+	if (record.remainingUses < 1) return { kind: "unavailable" };
 	return {
 		kind: "ready",
 		record
@@ -162,9 +150,6 @@ async function parseJsonResponseOrNull(response) {
 		return null;
 	}
 }
-function sameRuntimePolicyScope(left, right) {
-	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
 async function parseWarmRecoveryDescriptor(args) {
 	const record = args.record;
 	const response = args.response;
@@ -218,10 +203,7 @@ async function parseWarmRecoveryDescriptor(args) {
 }
 async function resolvePasskeyEd25519YaoExportContextV1(input, runtime) {
 	const exactRecord = await resolveExactWarmRecoveryRecord(input.subject, runtime);
-	if (exactRecord.kind === "unavailable") return {
-		kind: "capability_recovery_required",
-		reason: exactRecord.reason
-	};
+	if (exactRecord.kind === "unavailable") return { kind: "capability_recovery_required" };
 	const walletId = parseWalletId(exactRecord.record.walletId);
 	if (!walletId.ok) throw new Error("[SigningEngine][near] sealed Ed25519 wallet identity is invalid");
 	const credentialIdB64u = requireTrimmedString(exactRecord.record.ed25519Restore.credentialIdB64u, "ed25519Restore.credentialIdB64u");
@@ -233,15 +215,9 @@ async function resolvePasskeyEd25519YaoExportContextV1(input, runtime) {
 			credentialIdB64u
 		});
 	} catch {
-		return {
-			kind: "capability_recovery_required",
-			reason: "wallet_session_expired"
-		};
+		return { kind: "capability_recovery_required" };
 	}
-	if (!expectedAuthorityRef) return {
-		kind: "capability_recovery_required",
-		reason: "wallet_session_expired"
-	};
+	if (!expectedAuthorityRef) return { kind: "capability_recovery_required" };
 	const selectedAuthorization = await readExactSelectedPasskeyWalletSessionAuthorization({
 		walletId: walletId.value,
 		rpId: exactRecord.record.ed25519Restore.rpId,
@@ -249,10 +225,7 @@ async function resolvePasskeyEd25519YaoExportContextV1(input, runtime) {
 		expectedAuthorityRef,
 		runtime
 	});
-	if (!selectedAuthorization) return {
-		kind: "capability_recovery_required",
-		reason: "wallet_session_expired"
-	};
+	if (!selectedAuthorization) return { kind: "capability_recovery_required" };
 	const authorization = await requirePasskeyEd25519RestoreAuthorization({
 		record: exactRecord.record,
 		authorizationRead: selectedAuthorization.authorizationRead,
@@ -262,10 +235,7 @@ async function resolvePasskeyEd25519YaoExportContextV1(input, runtime) {
 		expectedAuthorityRevocationEpoch: selectedAuthorization.authorityRevocationEpoch,
 		nowMs: runtime.nowMs()
 	});
-	if (!authorization) return {
-		kind: "capability_recovery_required",
-		reason: "wallet_session_expired"
-	};
+	if (!authorization) return { kind: "capability_recovery_required" };
 	const bootstrap = await fetchWarmRecoveryBootstrap({
 		request: ownerWarmRecoveryBootstrapRequest(exactRecord.record, input.subject.thresholdSessionId),
 		authorization,
@@ -275,19 +245,13 @@ async function resolvePasskeyEd25519YaoExportContextV1(input, runtime) {
 		relayerUrl: input.relayerUrl,
 		fetch: input.fetch
 	});
-	if (bootstrap.kind === "unavailable") return {
-		kind: "capability_recovery_required",
-		reason: bootstrap.reason
-	};
+	if (bootstrap.kind === "unavailable") return { kind: "capability_recovery_required" };
 	const descriptor = bootstrap.descriptor;
 	const walletCustodyEnvelope = await runtime.readPasskeyCustodySessionEnvelope({
 		walletId: String(descriptor.walletId),
 		credentialIdB64u: descriptor.credentialIdB64u
 	});
-	if (!walletCustodyEnvelope || walletCustodyEnvelope.binding.kind !== "wallet_custody_seed_v1") return {
-		kind: "capability_recovery_required",
-		reason: "wallet_custody_envelope_missing"
-	};
+	if (!walletCustodyEnvelope || walletCustodyEnvelope.binding.kind !== "wallet_custody_seed_v1") return { kind: "capability_recovery_required" };
 	return {
 		kind: "ready",
 		context: {

package/dist/esm/core/signingEngine/session/persistence/clientSessionPersistence.js

@@ -15,8 +15,7 @@ async function readEd25519ClientWalletSessionAuthorization(deps, request) {
 		return parseWalletSessionAuthorizationBoundary({
 			observation: {
 				kind: "unavailable",
-				source,
-				reason: "persistence_unavailable"
+				source
 			},
 			nowMs: request.nowMs
 		});
@@ -24,8 +23,7 @@ async function readEd25519ClientWalletSessionAuthorization(deps, request) {
 	if (selected.kind !== "resolved") return parseWalletSessionAuthorizationBoundary({
 		observation: selected.kind === "integrity_error" ? {
 			kind: "invalid",
-			source,
-			reason: "malformed"
+			source
 		} : {
 			kind: "missing",
 			source
@@ -35,8 +33,7 @@ async function readEd25519ClientWalletSessionAuthorization(deps, request) {
 	if (!selectedAuthorityMatchesEd25519Lane(selected, identity)) return parseWalletSessionAuthorizationBoundary({
 		observation: {
 			kind: "invalid",
-			source,
-			reason: "scope_mismatch"
+			source
 		},
 		nowMs: request.nowMs
 	});
@@ -51,8 +48,7 @@ async function readEd25519ClientWalletSessionAuthorization(deps, request) {
 		return parseWalletSessionAuthorizationBoundary({
 			observation: {
 				kind: "unavailable",
-				source,
-				reason: "persistence_unavailable"
+				source
 			},
 			nowMs: request.nowMs
 		});
@@ -69,16 +65,14 @@ async function readEd25519ClientWalletSessionAuthorization(deps, request) {
 		case "upgrade_required": return parseWalletSessionAuthorizationBoundary({
 			observation: {
 				kind: "invalid",
-				source,
-				reason: "malformed"
+				source
 			},
 			nowMs: request.nowMs
 		});
 		case "persistence_unavailable": return parseWalletSessionAuthorizationBoundary({
 			observation: {
 				kind: "unavailable",
-				source,
-				reason: "persistence_unavailable"
+				source
 			},
 			nowMs: request.nowMs
 		});
@@ -87,16 +81,14 @@ async function readEd25519ClientWalletSessionAuthorization(deps, request) {
 	if (authorization.record.walletId !== walletId || authorization.record.authorityId !== selected.authority.authorityId || authorization.record.authMethodId !== selected.authMethod.walletAuthMethodId || authorization.operationCredential.walletSessionId !== identity.walletSessionId || authorization.record.quotaId !== identity.quotaId) return parseWalletSessionAuthorizationBoundary({
 		observation: {
 			kind: "invalid",
-			source,
-			reason: "scope_mismatch"
+			source
 		},
 		nowMs: request.nowMs
 	});
 	if (authorization.record.authorityDigestB64u !== selected.authority.authorityDigestB64u || authorization.record.authorityRevocationEpoch !== selected.authority.revocationEpoch) return parseWalletSessionAuthorizationBoundary({
 		observation: {
 			kind: "invalid",
-			source,
-			reason: "authority_mismatch"
+			source
 		},
 		nowMs: request.nowMs
 	});

package/dist/esm/core/signingEngine/session/persistence/sealedSessionRecords.js

@@ -46,24 +46,21 @@ function storagePayloadFromSealedStoreRow(value) {
 	const obj = asRecord(value);
 	return obj && SEALED_RECORD_PAYLOAD_FIELD in obj ? obj[SEALED_RECORD_PAYLOAD_FIELD] : value;
 }
-function optionalStringForIndex(value) {
-	return normalizeOptionalNonEmptyString(value);
-}
 function durableLaneStorageRow(record) {
 	const ecdsaChainTarget = record.ecdsaRestore?.chainTarget;
-	const ecdsaThresholdSessionId = optionalStringForIndex(record.thresholdSessionIds.ecdsa);
-	const ed25519ThresholdSessionId = optionalStringForIndex(record.thresholdSessionIds.ed25519);
+	const ecdsaThresholdSessionId = normalizeOptionalNonEmptyString(record.thresholdSessionIds.ecdsa);
+	const ed25519ThresholdSessionId = normalizeOptionalNonEmptyString(record.thresholdSessionIds.ed25519);
 	return {
 		store_key: record.storeKey,
 		wallet_id: record.walletId,
 		auth_method: record.authMethod,
 		curve: record.curve,
-		signing_root_id: optionalStringForIndex("signingRootId" in record ? record.signingRootId : void 0),
-		signing_root_version: optionalStringForIndex("signingRootVersion" in record ? record.signingRootVersion : void 0),
+		signing_root_id: normalizeOptionalNonEmptyString("signingRootId" in record ? record.signingRootId : void 0),
+		signing_root_version: normalizeOptionalNonEmptyString("signingRootVersion" in record ? record.signingRootVersion : void 0),
 		ed25519_threshold_session_id: ed25519ThresholdSessionId,
 		ecdsa_threshold_session_id: ecdsaThresholdSessionId,
 		threshold_session_id: ecdsaThresholdSessionId || ed25519ThresholdSessionId,
-		key_handle: optionalStringForIndex(record.ecdsaRestore?.keyHandle),
+		key_handle: normalizeOptionalNonEmptyString(record.ecdsaRestore?.keyHandle),
 		chain_target_key: ecdsaChainTarget ? thresholdEcdsaChainTargetKey(ecdsaChainTarget) : void 0,
 		expires_at_ms: record.expiresAtMs,
 		updated_at: record.updatedAtMs,
@@ -324,7 +321,6 @@ function classifyRawSealedSessionRecord(raw) {
 	raw = storagePayloadFromSealedStoreRow(raw);
 	const obj = asRecord(raw);
 	if (!obj) return classifyNonCurrentRecord("malformed", null, "invalid_payload");
-	if (obj.kind === "lane_sealed_holder_record_v1") return classifyNonCurrentRecord("unrelated_record", obj, "owned_by_lane_holder_store");
 	if (hasRetiredAuthorizationIdentityField(obj)) return classifyNonCurrentRecord("delete_required", obj, "invalid_identity");
 	if (obj.recordKind === "ecdsa_reauth_anchor_v1") return classifyNonCurrentRecord("delete_required", obj, "invalid_header");
 	if (obj.recordKind === ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND) {
@@ -604,7 +600,6 @@ function inactiveEcdsaSealedMaterialRecord(args) {
 function logSealedSessionClassification(args) {
 	if (args.classification.kind === "ecdsa_inactive_material") return;
 	if (args.classification.kind === "rebuild_required") return;
-	if (args.classification.kind === "unrelated_record") return;
 	const outcome = args.classification.kind === "malformed" ? "malformed" : "rejected";
 	const payload = {
 		operation: args.operation,

package/dist/esm/core/signingEngine/session/postconditions/runtimePostconditions.js

@@ -147,8 +147,6 @@ async function readWalletRuntimePostconditions(args) {
 	return {
 		ok: true,
 		inventory: {
-			walletId,
-			authMethod,
 			...ed25519 ? { ed25519 } : {},
 			ecdsaByTarget
 		}

package/dist/esm/core/signingEngine/session/routerAbSigningWalletSession.js

@@ -13,14 +13,8 @@ function normalizeActiveSessionNowMs(nowMs) {
 	return Number.isSafeInteger(normalized) && normalized >= 0 ? normalized : null;
 }
 function inactiveSigningSessionState(args) {
-	if (args.expiresAtMs <= args.nowMs) return {
-		kind: "expired",
-		expiresAtMs: args.expiresAtMs
-	};
-	if (args.remainingUses <= 0) return {
-		kind: "exhausted",
-		remainingUses: args.remainingUses
-	};
+	if (args.expiresAtMs <= args.nowMs) return { kind: "expired" };
+	if (args.remainingUses <= 0) return { kind: "exhausted" };
 	return null;
 }
 function buildWalletSessionOpaqueAuth(tokenRaw) {

package/dist/esm/core/signingEngine/session/warmCapabilities/ecdsaLoginPrefillSigningMaterialSource.js

@@ -1,4 +1,4 @@
-import { thresholdEcdsaRoleLocalAdmitPresignatureWasm, thresholdEcdsaRoleLocalCommitPresignatureWasm, thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, thresholdEcdsaRoleLocalDestroyPresignatureWasm, thresholdEcdsaRoleLocalListAvailablePresignaturesWasm, thresholdEcdsaRoleLocalPresignSessionAbortWasm, thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, thresholdEcdsaRoleLocalPresignSessionStepWasm, thresholdEcdsaRoleLocalReservePresignatureWasm } from "../../threshold/crypto/ecdsaDerivationClientWasm.js";
+import { thresholdEcdsaListAvailablePresignaturesWasm, thresholdEcdsaRoleLocalAdmitPresignatureWasm, thresholdEcdsaRoleLocalCommitPresignatureWasm, thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, thresholdEcdsaRoleLocalDestroyPresignatureWasm, thresholdEcdsaRoleLocalPresignSessionAbortWasm, thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, thresholdEcdsaRoleLocalPresignSessionStepWasm, thresholdEcdsaRoleLocalReservePresignatureWasm } from "../../threshold/crypto/ecdsaDerivationClientWasm.js";
 import { ecdsaRoleLocalPersistedMaterialSource, resolveEcdsaRoleLocalMaterial } from "../material/ecdsaRoleLocalMaterialResolver.js";
 //#region src/core/signingEngine/session/warmCapabilities/ecdsaLoginPrefillSigningMaterialSource.ts
 function requireResolvedLoginPrefillMaterial(resolution) {
@@ -40,7 +40,7 @@ function createEcdsaLoginPrefillClientSigningMaterialSource(args) {
 		destroyClientPresignature: thresholdEcdsaRoleLocalDestroyPresignatureWasm,
 		reserveClientPresignature: thresholdEcdsaRoleLocalReservePresignatureWasm,
 		commitClientPresignature: thresholdEcdsaRoleLocalCommitPresignatureWasm,
-		listAvailableClientPresignatures: thresholdEcdsaRoleLocalListAvailablePresignaturesWasm,
+		listAvailableClientPresignatures: thresholdEcdsaListAvailablePresignaturesWasm.bind(void 0, "role_local_derivation_handle"),
 		computeSignatureShareFromPresignatureHandle: thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm
 	};
 }

package/dist/esm/core/signingEngine/session/warmCapabilities/nearEd25519CapabilityRehydration.js

@@ -2,8 +2,8 @@ import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/
 import { signingLaneAuthBindingKey } from "../identity/signingLaneAuthBinding.js";
 import { SigningSessionIds } from "../operationState/types.js";
 import { exactEd25519SigningLaneIdentity, exactSigningLaneIdentityKey, exactSigningLaneIdentityMatches, nearEd25519SignerBindingFromBoundaryFields } from "../identity/exactSigningLaneIdentity.js";
-import { isConcreteAvailableSigningLane } from "../availability/availableSigningLanes.js";
 import { materialActivationKey } from "../sealedRecovery/materialActivationKey.js";
+import { isConcreteAvailableSigningLane } from "../availability/availableSigningLanes.js";
 //#region src/core/signingEngine/session/warmCapabilities/nearEd25519CapabilityRehydration.ts
 function exactEd25519LaneIdentityFromAvailableLane(lane) {
 	if (!lane.authorization) throw new Error("Available Ed25519 lane requires Wallet Session authorization");

package/dist/esm/core/signingEngine/session/warmCapabilities/readModel.js

@@ -140,17 +140,11 @@ function toSigningSessionStatus(args) {
 * authorization of its own, so without a live Wallet Session there is nothing to
 * seal against and the transport is withheld rather than emitted unauthorized. */
 function resolveEcdsaSealTransport(args) {
-	const walletSessionToken = args.auth?.operationCredential.token || null;
-	if (!walletSessionToken) return null;
-	const relayerUrl = String(args.runtime.relayerUrl || "").trim();
-	if (!relayerUrl) return null;
+	if (!(args.auth?.operationCredential.token || null)) return null;
+	if (!String(args.runtime.relayerUrl || "").trim()) return null;
 	const groupId = String(args.groupId || "").trim();
 	return {
 		curve: "ecdsa",
-		walletId: String(args.runtime.walletId),
-		chainTarget: args.runtime.chainTarget,
-		relayerUrl,
-		walletSessionToken,
 		...args.signingSessionSealKeyVersion ? { signingSessionSealKeyVersion: args.signingSessionSealKeyVersion } : {},
 		...groupId ? { groupId } : {}
 	};

package/dist/esm/core/signingEngine/session/warmCapabilities/routerAbWalletSessionCredential.js

@@ -33,7 +33,6 @@ function requireRouterAbEd25519NormalSigningReadyState(args) {
 	requireNonEmpty(state.signingLane.identity.signer.account.wallet.walletId, "state.signingLane.identity.signer.account.wallet.walletId");
 	requireEqual(requireNonEmpty(args.thresholdKeyMaterial.nearAccountId, "thresholdKeyMaterial.nearAccountId"), nearAccountId, "threshold key accountId");
 	const routerAbState = signingWalletSession.routerAbNormalSigning;
-	const runtimePolicyScope = signingWalletSession.runtimePolicyScope;
 	const walletSessionToken = requireNonEmpty(signingWalletSession.auth.walletSessionToken, "Wallet Session bearer token");
 	const signingRootId = requireNonEmpty(state.signingRootId, "state.signingRootId");
 	const signingRootVersion = requireNonEmpty(state.signingRootVersion, "state.signingRootVersion");
@@ -43,24 +42,14 @@ function requireRouterAbEd25519NormalSigningReadyState(args) {
 	requireEqual(signingWalletSession.signingRootId, signingRootId, "signingRootId");
 	requireEqual(signingWalletSession.signingRootVersion, signingRootVersion, "signingRootVersion");
 	requireEqual(state.routerAbNormalSigning.signingWorkerId, routerAbState.signingWorkerId, "signingWorkerId");
-	const expiresAtMs = requireFutureEpochMs(signingWalletSession.expiresAtMs, "expiresAtMs");
+	requireFutureEpochMs(signingWalletSession.expiresAtMs, "expiresAtMs");
 	const remainingUses = requirePositiveInteger(signingWalletSession.remainingUses, "remainingUses");
 	if (state.remainingUses !== remainingUses) throw new Error("Router A/B Ed25519 normal-signing ready state remainingUses mismatch");
 	return {
 		kind: "router_ab_ed25519_normal_signing_ready_state_v1",
-		walletSessionId,
-		quotaId,
-		thresholdSessionId,
-		nearAccountId,
 		relayerUrl: requireNonEmpty(state.relayerUrl, "relayerUrl"),
-		routerAbNormalSigning: routerAbState,
 		signingWorkerId: requireNonEmpty(routerAbState.signingWorkerId, "signingWorkerId"),
 		signerPublicKey: requireNonEmpty(args.thresholdKeyMaterial.publicKey, "signerPublicKey"),
-		signingRootId,
-		signingRootVersion,
-		remainingUses,
-		expiresAtMs,
-		runtimePolicyScope,
 		credential: {
 			kind: "wallet_session_opaque",
 			walletSessionToken

package/dist/esm/core/signingEngine/session/warmCapabilities/transitions.js

@@ -14,17 +14,13 @@ function summarizeWarmSessionCapabilityTransition(capability) {
 	};
 }
 function summarizeWarmSessionTransition(envelope) {
-	return {
-		walletId: envelope.walletId,
-		capabilities: {
-			ed25519: summarizeWarmSessionCapabilityTransition(envelope.capabilities.ed25519),
-			ecdsa: {
-				evm: summarizeWarmSessionCapabilityTransition(envelope.capabilities.ecdsa.evm),
-				tempo: summarizeWarmSessionCapabilityTransition(envelope.capabilities.ecdsa.tempo)
-			}
-		},
-		updatedAtMs: envelope.updatedAtMs
-	};
+	return { capabilities: {
+		ed25519: summarizeWarmSessionCapabilityTransition(envelope.capabilities.ed25519),
+		ecdsa: {
+			evm: summarizeWarmSessionCapabilityTransition(envelope.capabilities.ecdsa.evm),
+			tempo: summarizeWarmSessionCapabilityTransition(envelope.capabilities.ecdsa.tempo)
+		}
+	} };
 }
 function emitWarmSessionTransition(args) {
 	if (typeof args.onTransition !== "function") return;

package/dist/esm/core/signingEngine/stepUpConfirmation/otpPrompt/authLane.js

@@ -1,4 +1,3 @@
-import "../../../../shared-ts/src/utils/validation.js";
 import { isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import "../../../../shared-ts/src/device-linking/index.js";
 //#region src/core/signingEngine/stepUpConfirmation/otpPrompt/authLane.ts