@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/core/signingEngine/flows/recovery/ecdsaExportMaterial.js

@@ -25,26 +25,42 @@ function exactEcdsaParticipantIds(value) {
 	if (!Number.isSafeInteger(first) || !Number.isSafeInteger(second) || first <= 0 || second <= 0 || first === second) throw new Error("[SigningEngine][ecdsa-export] ECDSA participant set is invalid");
 	return [first, second];
 }
-function resolveCanonicalEmailOtpEcdsaExportMaterialForLane(args) {
-	const { exportLane } = args;
+function requireCanonicalEcdsaExportLane(args) {
+	const { exportLane, label } = args;
 	const capability = exportLane.capability;
-	if (!isEmailOtpWalletAuthAuthority(capability.authority)) throw new Error("[SigningEngine][ecdsa-export] Email OTP capability authority mismatch");
 	const signer = capability.manifest.signer;
-	if (signer.walletId !== exportLane.key.walletId || !signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, exportLane.chainTarget))) throw new Error("[SigningEngine][ecdsa-export] Email OTP capability target mismatch");
-	if (exportLane.laneIdentity.auth.kind !== "email_otp" || exportLane.laneIdentity.auth.providerSubjectId !== capability.authority.factor.providerUserId) throw new Error("[SigningEngine][ecdsa-export] Email OTP capability auth mismatch");
-	if (!mpcMaterialActivationRefsEqual(capability.manifest.activation.materialActivation, exportLane.laneIdentity.signer.materialActivation)) throw new Error("[SigningEngine][ecdsa-export] Email OTP material activation mismatch");
+	if (signer.walletId !== exportLane.key.walletId || !signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, exportLane.chainTarget))) throw new Error(`[SigningEngine][ecdsa-export] ${label} capability target mismatch`);
+	if (!args.authMatches()) throw new Error(`[SigningEngine][ecdsa-export] ${label} capability auth mismatch`);
+	if (!mpcMaterialActivationRefsEqual(capability.manifest.activation.materialActivation, exportLane.laneIdentity.signer.materialActivation)) throw new Error(`[SigningEngine][ecdsa-export] ${label} material activation mismatch`);
 	assertMatchingVerifiedEcdsaPublicFacts({
 		expected: exportLane.publicFacts,
-		actual: capability.manifest.signer.registeredPublicFacts,
-		context: "canonical Email OTP export lane"
+		actual: signer.registeredPublicFacts,
+		context: `canonical ${label} export lane`
 	});
 	const materialFacts = capability.material.publicFacts;
-	if (materialFacts.walletId !== signer.walletId || String(materialFacts.keyHandle) !== String(exportLane.publicFacts.keyHandle) || String(materialFacts.groupPublicKey33B64u) !== String(exportLane.publicFacts.publicKeyB64u) || String(materialFacts.ethereumAddress) !== String(exportLane.publicFacts.thresholdOwnerAddress) || materialFacts.participantIds.length !== exportLane.publicFacts.participantIds.length || materialFacts.participantIds.some((participantId, index) => participantId !== exportLane.publicFacts.participantIds[index])) throw new Error("[SigningEngine][ecdsa-export] canonical Email OTP export material mismatch");
+	if (materialFacts.walletId !== signer.walletId || String(materialFacts.keyHandle) !== String(exportLane.publicFacts.keyHandle) || String(materialFacts.groupPublicKey33B64u) !== String(exportLane.publicFacts.publicKeyB64u) || String(materialFacts.ethereumAddress) !== String(exportLane.publicFacts.thresholdOwnerAddress) || materialFacts.participantIds.length !== exportLane.publicFacts.participantIds.length || materialFacts.participantIds.some((participantId, index) => participantId !== exportLane.publicFacts.participantIds[index])) throw new Error(`[SigningEngine][ecdsa-export] canonical ${label} export material mismatch`);
 	const durable = capability.manifest.durableMaterial;
 	const runtimePolicyScope = durable.runtimePolicyScope;
 	const relayerUrl = String(args.deps.relayerUrl).trim().replace(/\/+$/g, "");
-	if (!runtimePolicyScope) throw new Error("[SigningEngine][ecdsa-export] Email OTP runtime policy scope is missing");
-	if (!relayerUrl) throw new Error("[SigningEngine][ecdsa-export] Email OTP export relayer URL is missing");
+	if (!runtimePolicyScope) throw new Error(`[SigningEngine][ecdsa-export] ${label} runtime policy scope is missing`);
+	if (!relayerUrl) throw new Error(`[SigningEngine][ecdsa-export] ${label} export relayer URL is missing`);
+	return {
+		durable,
+		runtimePolicyScope,
+		relayerUrl
+	};
+}
+function resolveCanonicalEmailOtpEcdsaExportMaterialForLane(args) {
+	const { exportLane } = args;
+	const capability = exportLane.capability;
+	const authority = capability.authority;
+	if (!isEmailOtpWalletAuthAuthority(authority)) throw new Error("[SigningEngine][ecdsa-export] Email OTP capability authority mismatch");
+	const { durable, runtimePolicyScope, relayerUrl } = requireCanonicalEcdsaExportLane({
+		deps: args.deps,
+		exportLane,
+		label: "Email OTP",
+		authMatches: () => exportLane.laneIdentity.auth.kind === "email_otp" && exportLane.laneIdentity.auth.providerSubjectId === authority.factor.providerUserId
+	});
 	return {
 		source: "canonical_capability",
 		kind: "fresh_email_otp_route_auth_ready",
@@ -58,30 +74,21 @@ function resolveCanonicalEmailOtpEcdsaExportMaterialForLane(args) {
 		relayerUrl,
 		authorization: {
 			kind: "fresh_operation_authorization_required",
-			authority: capability.authority
+			authority
 		}
 	};
 }
 function resolveCanonicalPasskeyEcdsaExportMaterialForLane(args) {
 	const { exportLane } = args;
 	const capability = exportLane.capability;
-	if (!isPasskeyWalletAuthAuthority(capability.authority)) throw new Error("[SigningEngine][ecdsa-export] passkey capability authority mismatch");
-	const signer = capability.manifest.signer;
-	if (signer.walletId !== exportLane.key.walletId || !signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, exportLane.chainTarget))) throw new Error("[SigningEngine][ecdsa-export] passkey capability target mismatch");
-	if (exportLane.laneIdentity.auth.kind !== "passkey" || exportLane.laneIdentity.auth.credentialIdB64u !== capability.authority.factor.credentialIdB64u) throw new Error("[SigningEngine][ecdsa-export] passkey capability auth mismatch");
-	if (!mpcMaterialActivationRefsEqual(capability.manifest.activation.materialActivation, exportLane.laneIdentity.signer.materialActivation)) throw new Error("[SigningEngine][ecdsa-export] passkey material activation mismatch");
-	assertMatchingVerifiedEcdsaPublicFacts({
-		expected: exportLane.publicFacts,
-		actual: signer.registeredPublicFacts,
-		context: "canonical passkey export lane"
+	const authority = capability.authority;
+	if (!isPasskeyWalletAuthAuthority(authority)) throw new Error("[SigningEngine][ecdsa-export] passkey capability authority mismatch");
+	const { durable, runtimePolicyScope, relayerUrl } = requireCanonicalEcdsaExportLane({
+		deps: args.deps,
+		exportLane,
+		label: "passkey",
+		authMatches: () => exportLane.laneIdentity.auth.kind === "passkey" && exportLane.laneIdentity.auth.credentialIdB64u === authority.factor.credentialIdB64u
 	});
-	const materialFacts = capability.material.publicFacts;
-	if (materialFacts.walletId !== signer.walletId || String(materialFacts.keyHandle) !== String(exportLane.publicFacts.keyHandle) || String(materialFacts.groupPublicKey33B64u) !== String(exportLane.publicFacts.publicKeyB64u) || String(materialFacts.ethereumAddress) !== String(exportLane.publicFacts.thresholdOwnerAddress) || materialFacts.participantIds.length !== exportLane.publicFacts.participantIds.length || materialFacts.participantIds.some((participantId, index) => participantId !== exportLane.publicFacts.participantIds[index])) throw new Error("[SigningEngine][ecdsa-export] canonical passkey export material mismatch");
-	const durable = capability.manifest.durableMaterial;
-	const runtimePolicyScope = durable.runtimePolicyScope;
-	const relayerUrl = String(args.deps.relayerUrl).trim().replace(/\/+$/g, "");
-	if (!runtimePolicyScope) throw new Error("[SigningEngine][ecdsa-export] passkey runtime policy scope is missing");
-	if (!relayerUrl) throw new Error("[SigningEngine][ecdsa-export] passkey export relayer URL is missing");
 	return {
 		source: "canonical_capability",
 		kind: "fresh_passkey_needs_authorization",
@@ -189,7 +196,6 @@ async function resolveFreshEmailOtpEcdsaExportMaterialForLane(deps, exportLane)
 	});
 	if (resolution.kind !== "resolved") throw new Error(`[SigningEngine][ecdsa-export] Email OTP capability runtime unavailable: ${resolution.reason}`);
 	return sealedEmailOtpExportMaterial({
-		deps,
 		exportLane,
 		resolution
 	});

package/dist/esm/core/signingEngine/flows/recovery/ed25519YaoExportFlow.js

@@ -2,7 +2,7 @@ import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/
 import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
 import { KeyExportEventPhase } from "../../../types/sdkSentEvents.js";
 import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { resolveThresholdEd25519CommitQueueKey } from "../../threshold/ed25519/commitQueue.js";
+import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
 import { isExportViewerSessionOpen, removeExportViewerHostIfPresent } from "../../uiConfirm/ui/export-viewer-host.js";
 import { createExportUiRequestId, emitKeyExportEvent } from "./keyExportFlow.js";
 import { requestEmailOtpEd25519KeyExportAuthorization, showEd25519ExportViewer } from "./keyExportConfirmation.js";
@@ -204,7 +204,7 @@ async function exportEd25519YaoKeyWithFreshAuthorization(deps, args) {
 		}
 	});
 	const result = await deps.withThresholdEd25519CommitQueue({
-		queueKey: resolveThresholdEd25519CommitQueueKey({ materialActivation: passkeyEd25519ExportMaterialActivation(resolved) }),
+		queueKey: resolveThresholdCommitQueueKey({ materialActivation: passkeyEd25519ExportMaterialActivation(resolved) }),
 		nearAccountId: args.nearAccountId,
 		enabled: true,
 		task: () => deps.passkeyMpcExport.exportPrivateKeysWithUi(buildWorkerPayload({
@@ -300,7 +300,7 @@ async function exportEd25519YaoKeyWithFreshEmailOtp(deps, args) {
 			onEvent: args.onEvent
 		});
 		const artifact = await deps.withThresholdEd25519CommitQueue({
-			queueKey: resolveThresholdEd25519CommitQueueKey({ materialActivation: emailOtpEd25519ExportMaterialActivation(resolved.context) }),
+			queueKey: resolveThresholdCommitQueueKey({ materialActivation: emailOtpEd25519ExportMaterialActivation(resolved.context) }),
 			nearAccountId: args.nearAccountId,
 			enabled: resolved.context.material.kind === "active_capability",
 			task: () => deps.emailOtp.exportSeedWithFreshAuthorization({

package/dist/esm/core/signingEngine/flows/recovery/exportKeypairOperation.js

@@ -196,14 +196,11 @@ async function exportEd25519KeypairWithFlowId(deps, args) {
 		onEvent: args.options.onEvent
 	});
 }
-async function exportEd25519KeypairWithSessionLifecycle(deps, args) {
-	return await exportEd25519KeypairWithFlowId(deps, args);
-}
 async function exportKeypairWithUI(deps, input) {
 	return await runKeyExportWithFlowEvents(input, async (args) => {
 		switch (args.kind) {
 			case "ecdsa": return await exportEcdsaKeypairWithSessionLifecycle(deps, args, { kind: "initial" });
-			case "ed25519": return await exportEd25519KeypairWithSessionLifecycle(deps, args);
+			case "ed25519": return await exportEd25519KeypairWithFlowId(deps, args);
 		}
 	});
 }

package/dist/esm/core/signingEngine/flows/recovery/passkeyEd25519YaoRecovery.js

@@ -1,13 +1,13 @@
 import { mpcMaterialActivationRefsEqual, parseWalletAuthMethodId, parseWalletAuthorityId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
 import { requireRecord, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
 import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
 import { toAccountId } from "../../../types/accountIds.js";
 import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { normalizeRuntimePolicyScope, sameRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { toRpId } from "../../session/identity/evmFamilyEcdsaIdentity.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
@@ -76,9 +76,6 @@ function parseExactRecoverySession(raw, participantIds, identity, walletSession,
 		operationCredential
 	};
 }
-function sameRuntimePolicyScope(left, right) {
-	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
 function assertEd25519YaoRecoveryDescriptorStableIdentity(parsed) {
 	const capability = parsed.capability;
 	const session = parsed.session;

package/dist/esm/core/signingEngine/flows/recovery/stepUpAuthorization.js

@@ -1,5 +1,5 @@
-import { normalizeAuthenticationCredential } from "../../webauthnAuth/credentials/helpers.js";
 import { SigningAuthPlanKind } from "../../stepUpConfirmation/types.js";
+import { normalizeAuthenticationCredential } from "../../webauthnAuth/credentials/helpers.js";
 //#region src/core/signingEngine/flows/recovery/stepUpAuthorization.ts
 function assertNeverExportAuthorizationIdentity(value) {
 	throw new Error(`[SigningEngine][export] unsupported authorization identity: ${String(value)}`);

package/dist/esm/core/signingEngine/flows/registration/accountLifecycle.js

@@ -1,6 +1,6 @@
-import { compactImplicitNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { compactImplicitNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { toAccountId } from "../../../types/accountIds.js";
 import { SIGNER_AUTH_METHODS, SIGNER_KINDS, SIGNER_SOURCES } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { nearEd25519SigningKeyIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
@@ -9,9 +9,9 @@ import { parseSignerSlot } from "../../../../shared-ts/src/utils/signerSlot.js";
 import { buildNearAccountRefs, inferNearChainIdKey } from "../../../accountData/near/accountRefs.js";
 import { resolveProfileAccountContextFromCandidates, resolveProfileAccountProjection } from "../../../indexedDB/profileAccountProjection.js";
 import { buildWalletCustodyEd25519MaterialRecordV1 } from "../../../indexedDB/walletCustodyEd25519MaterialRecord.js";
-import { normalizeIndexedDbAccountAddress, toIndexedDbChainTargetKey } from "../../../indexedDB/normalization.js";
 import { buildNearProfileId, parseNearAccountProjectionProfileId } from "../../../accountData/near/profileId.js";
 import { NEAR_ED25519_YAO_KEY_VERSION_V1 } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { normalizeIndexedDbAccountAddress, toIndexedDbChainTargetKey } from "../../../indexedDB/normalization.js";
 import { getLastSelectedNearAccountProjection, getNearAccountProjection, listNearAccountProjections } from "../../../accountData/near/accountProjection.js";
 //#region src/core/signingEngine/flows/registration/accountLifecycle.ts
 const WALLET_SUBJECT_CHAIN_ID_KEY = "wallet";
@@ -38,11 +38,7 @@ async function resolveNearProfileContext(deps, nearAccountId) {
 	if (!context?.profileId) return null;
 	const profileId = parseNearAccountProjectionProfileId(context.profileId);
 	if (!profileId.ok) return null;
-	return {
-		profileId: profileId.value,
-		chainIdKey: context.accountRef.chainIdKey,
-		accountAddress: context.accountRef.accountAddress
-	};
+	return { profileId: profileId.value };
 }
 async function storeUserData(deps, userData) {
 	const nearAccountId = toAccountId(userData.nearAccountId);
@@ -99,7 +95,6 @@ async function storeUserData(deps, userData) {
 		...userData.preferences ? { preferences: userData.preferences } : {}
 	});
 	await deps.accountStore.setLastProfileStateForProfile(profileId, activation.signerSlot);
-	return { signerSlot: activation.signerSlot };
 }
 function getAllUsers(deps) {
 	return listNearAccountProjections(deps.accountStore);

package/dist/esm/core/signingEngine/flows/registration/services/passkeyEd25519YaoAddSigner.js

@@ -73,8 +73,7 @@ async function admitVerifiedPasskeyEd25519YaoAddSignerV1(input) {
 	if (!receipt.ok) throw new Error(receipt.message);
 	return {
 		request: prepared.request,
-		receipt: receipt.value,
-		transportConfig: prepared.transportConfig
+		receipt: receipt.value
 	};
 }
 //#endregion

package/dist/esm/core/signingEngine/flows/shared/signingStateMachine.js

@@ -259,7 +259,6 @@ async function runSigningOperationCommandSteps(args) {
 			return {
 				ok: false,
 				finalState: failedStep.to,
-				steps: executedSteps,
 				error
 			};
 		}
@@ -267,16 +266,14 @@ async function runSigningOperationCommandSteps(args) {
 		executedSteps.push(step);
 		if (step.to.kind === SigningOperationStateKind.Failed) return {
 			ok: true,
-			finalState: step.to,
-			steps: executedSteps
+			finalState: step.to
 		};
 	}
 	const finalState = executedSteps.at(-1)?.to || args.steps.at(-1)?.from;
 	if (!finalState) throw new Error("[SigningOperationMachine] command sequence produced no steps");
 	return {
 		ok: true,
-		finalState,
-		steps: executedSteps
+		finalState
 	};
 }
 async function runUnplannedSigningOperationCommandSequence(args) {

package/dist/esm/core/signingEngine/flows/signEvmFamily/emailOtpSigningSession.js

@@ -4,12 +4,12 @@ import { SigningEventPhase } from "../../../types/sdkSentEvents.js";
 import { buildVerifiedEcdsaPublicFacts, toEvmFamilyEcdsaKeyHandle } from "../../session/identity/evmFamilyEcdsaIdentity.js";
 import { isEmailOtpWalletAuthAuthority, walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { createSigningBoundaryTraceEvent, emitSigningBoundaryTrace } from "../../session/operationState/trace.js";
+import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
 import { demoEmailOtpCodeFromDelivery } from "../../session/emailOtp/challengeDelivery.js";
 import { buildEmailOtpRoutePlan } from "../../stepUpConfirmation/otpPrompt/authLane.js";
 import { emailOtpEcdsaSigningSessionAuthLane, resolveExactEmailOtpEcdsaSigningSessionAuthority } from "../../session/emailOtp/ecdsaSigningSessionAuthority.js";
 import { emitEvmFamilySigningEvent } from "./events.js";
 import { throwEmailOtpSigningSessionAuthStateError } from "../../session/emailOtp/routePlan.js";
-import { resolveThresholdEcdsaSigningQueueKey } from "../../threshold/ecdsa/signingQueue.js";
 //#region src/core/signingEngine/flows/signEvmFamily/emailOtpSigningSession.ts
 /** The capability is the authority. Anything the caller or the confirmation
 * plan supplies must agree with it exactly, or the OTP would be sent to a
@@ -211,7 +211,7 @@ async function refreshEmailOtpSigningSession(deps, args) {
 		chainTarget: args.chainTarget
 	})).runtime.materialActivation;
 	return await deps.withThresholdEcdsaSigningQueue({
-		queueKey: resolveThresholdEcdsaSigningQueueKey({ materialActivation: activationBeforeRefresh }),
+		queueKey: resolveThresholdCommitQueueKey({ materialActivation: activationBeforeRefresh }),
 		walletId: args.walletSession.walletId,
 		enabled: true,
 		task: runFencedEmailOtpSigningSessionRefresh.bind(void 0, {

package/dist/esm/core/signingEngine/flows/signEvmFamily/preparedSigning.js

@@ -294,13 +294,6 @@ async function prepareEvmFamilyEcdsaSigningSession(args) {
 				diagnostics: selection.diagnostics
 			});
 			const committedSelectionAuthMethod = selection.committedLane.authority.factor.kind;
-			const availableLanes = await args.deps.readAvailableSigningLanesForSigning({
-				walletId,
-				curve: "ecdsa",
-				ecdsaChainTargets: [chainTarget],
-				authMethod: committedSelectionAuthMethod,
-				ownerScope
-			});
 			emitSigningLaneResolutionTrace("evm-family", selection.lane, { reason: "evm_family_ecdsa_selection" });
 			args.diagnostics.selection = {
 				kind: selection.kind,
@@ -343,7 +336,7 @@ async function prepareEvmFamilyEcdsaSigningSession(args) {
 					expiresAtMs: readiness.expiresAtMs,
 					remainingUses: readiness.remainingUses
 				},
-				availableLanesGeneration: availableLanes.generation,
+				availableLanesGeneration: candidateAvailableLanes.generation,
 				metadata: {
 					accountAuth: selection.accountAuth,
 					authMethod: committedSelectionAuthMethod,
@@ -354,7 +347,7 @@ async function prepareEvmFamilyEcdsaSigningSession(args) {
 						...args.signingOperation.operationFingerprint ? { operationFingerprint: args.signingOperation.operationFingerprint } : {},
 						laneIdentityKey: exactSigningLaneIdentityKey(exactSigningLaneIdentityFromSelectedLane(resolvedLane))
 					},
-					availableLanesGeneration: availableLanes.generation
+					availableLanesGeneration: candidateAvailableLanes.generation
 				}
 			};
 		} }

package/dist/esm/core/signingEngine/flows/signEvmFamily/readySecp256k1Material.js

@@ -83,7 +83,6 @@ async function resolveHydratedSecp256k1SigningMaterial(args) {
 			walletId: manifest.signer.walletId,
 			materialActivation: manifest.activation.materialActivation,
 			publicFacts: manifest.signer.registeredPublicFacts,
-			chainTarget: roleLocalFacts.chainTarget,
 			transport: {
 				kind: "threshold_ecdsa_signer_transport",
 				relayerUrl: runtime.relayerUrl,
@@ -152,7 +151,6 @@ function buildActiveWalletAuthorityReadySecp256k1Material(args) {
 		walletId: toWalletId(runtime.walletId),
 		materialActivation: runtime.materialActivation,
 		publicFacts: authorityRuntime.publicFacts,
-		chainTarget: args.chainTarget,
 		transport: {
 			kind: "threshold_ecdsa_signer_transport",
 			relayerUrl,

package/dist/esm/core/signingEngine/flows/signEvmFamily/signEvmFamily.js

@@ -257,10 +257,6 @@ async function signEvmFamilyAttempt(deps, args, attempt) {
 		if (preparedEcdsaSigningSession) return preparedEcdsaSigningSession;
 		throw new Error("[SigningEngine][ecdsa] prepared signing session is required");
 	};
-	const getEcdsaSigningLaneIdentity = () => {
-		const prepared = getPreparedEcdsaSigningSession();
-		return prepared.kind === "authorized" ? prepared.signingLane.identity : prepared.identity;
-	};
 	const getPreparedEcdsaSigningSessionIfEcdsa = () => args.request.senderSignatureAlgorithm === "secp256k1" ? getPreparedEcdsaSigningSession() : void 0;
 	const reResolveSupersededPreparation = async (error) => {
 		if (!isEvmFamilyEcdsaMaterialSupersededError(error)) return null;
@@ -324,7 +320,11 @@ async function signEvmFamilyAttempt(deps, args, attempt) {
 			walletSession: args.walletSession,
 			request: args.request,
 			chainTarget: requestChainTarget,
-			senderSignatureAlgorithm: args.request.senderSignatureAlgorithm,
+			...args.request.senderSignatureAlgorithm === "secp256k1" ? {
+				senderSignatureAlgorithm: args.request.senderSignatureAlgorithm,
+				preparedSession: getPreparedEcdsaSigningSession(),
+				...activeWalletAuthorityFlowRuntime ? { activeWalletAuthority: activeWalletAuthorityFlowRuntime } : {}
+			} : { senderSignatureAlgorithm: args.request.senderSignatureAlgorithm },
 			...signingSessionPlan ? { signingSessionPlan } : {},
 			signingOperation: createTransactionSigningOperation(),
 			onSigningOperationTransition: emitEvmFamilySigningOperationTrace,
@@ -332,9 +332,7 @@ async function signEvmFamilyAttempt(deps, args, attempt) {
 			confirmationConfigOverride: args.confirmationConfigOverride,
 			shouldAbort: args.shouldAbort,
 			onEvent: args.onEvent,
-			onAuthSideEffectStarted: markFreshAuthRetrySideEffect,
-			getEcdsaSigningLaneIdentity,
-			...activeWalletAuthorityFlowRuntime ? { activeWalletAuthority: activeWalletAuthorityFlowRuntime } : {}
+			onAuthSideEffectStarted: markFreshAuthRetrySideEffect
 		});
 		return {
 			signingAuthPlan,

package/dist/esm/core/signingEngine/flows/signEvmFamily/signers/ecdsaDerivationClientSigningMaterialSource.js

@@ -1,4 +1,4 @@
-import { storeEcdsaRoleLocalSigningMaterialWasm, thresholdEcdsaLinkedHolderPresignSessionInitWasm, thresholdEcdsaRoleLocalAdmitPresignatureWasm, thresholdEcdsaRoleLocalCommitPresignatureWasm, thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, thresholdEcdsaRoleLocalDestroyPresignatureWasm, thresholdEcdsaRoleLocalListAvailablePresignaturesWasm, thresholdEcdsaRoleLocalPresignSessionAbortWasm, thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, thresholdEcdsaRoleLocalPresignSessionStepWasm, thresholdEcdsaRoleLocalReservePresignatureWasm } from "../../../threshold/crypto/ecdsaDerivationClientWasm.js";
+import { storeEcdsaRoleLocalSigningMaterialWasm, thresholdEcdsaLinkedHolderPresignSessionInitWasm, thresholdEcdsaListAvailablePresignaturesWasm, thresholdEcdsaRoleLocalAdmitPresignatureWasm, thresholdEcdsaRoleLocalCommitPresignatureWasm, thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, thresholdEcdsaRoleLocalDestroyPresignatureWasm, thresholdEcdsaRoleLocalPresignSessionAbortWasm, thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, thresholdEcdsaRoleLocalPresignSessionStepWasm, thresholdEcdsaRoleLocalReservePresignatureWasm } from "../../../threshold/crypto/ecdsaDerivationClientWasm.js";
 //#region src/core/signingEngine/flows/signEvmFamily/signers/ecdsaDerivationClientSigningMaterialSource.ts
 async function ensureRoleLocalSigningMaterialLoaded(args) {
 	const material = args.clientShare.material;
@@ -18,21 +18,7 @@ async function loadRouterAbEcdsaDerivationSigningMaterialSource(args) {
 		const holderHandleId = clientShare.holderHandleId;
 		return {
 			signerSession,
-			clientSigningMaterial: {
-				kind: "router_ab_ecdsa_derivation_client_signing_material_source_v1",
-				initClientPresignSession: async (input) => await thresholdEcdsaLinkedHolderPresignSessionInitWasm({
-					holderHandleId,
-					...input
-				}),
-				stepClientPresignSession: thresholdEcdsaRoleLocalPresignSessionStepWasm,
-				abortClientPresignSession: thresholdEcdsaRoleLocalPresignSessionAbortWasm,
-				admitClientPresignature: thresholdEcdsaRoleLocalAdmitPresignatureWasm,
-				destroyClientPresignature: thresholdEcdsaRoleLocalDestroyPresignatureWasm,
-				reserveClientPresignature: thresholdEcdsaRoleLocalReservePresignatureWasm,
-				commitClientPresignature: thresholdEcdsaRoleLocalCommitPresignatureWasm,
-				listAvailableClientPresignatures: thresholdEcdsaRoleLocalListAvailablePresignaturesWasm,
-				computeSignatureShareFromPresignatureHandle: thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm
-			},
+			clientSigningMaterial: createLinkedHolderClientSigningMaterialSource(holderHandleId),
 			cleanupAfterSign: async () => void 0
 		};
 	}
@@ -64,13 +50,33 @@ async function loadRouterAbEcdsaDerivationSigningMaterialSource(args) {
 			destroyClientPresignature: thresholdEcdsaRoleLocalDestroyPresignatureWasm,
 			reserveClientPresignature: thresholdEcdsaRoleLocalReservePresignatureWasm,
 			commitClientPresignature: thresholdEcdsaRoleLocalCommitPresignatureWasm,
-			listAvailableClientPresignatures: thresholdEcdsaRoleLocalListAvailablePresignaturesWasm,
+			listAvailableClientPresignatures: thresholdEcdsaListAvailablePresignaturesWasm.bind(void 0, "role_local_derivation_handle"),
 			computeSignatureShareFromPresignatureHandle: thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm
 		},
 		cleanupAfterSign: async () => void 0
 	};
 }
+async function initLinkedHolderPresignSession(holderHandleId, input) {
+	return await thresholdEcdsaLinkedHolderPresignSessionInitWasm({
+		holderHandleId,
+		...input
+	});
+}
+function createLinkedHolderClientSigningMaterialSource(holderHandleId) {
+	return {
+		kind: "router_ab_ecdsa_derivation_client_signing_material_source_v1",
+		initClientPresignSession: initLinkedHolderPresignSession.bind(void 0, holderHandleId),
+		stepClientPresignSession: thresholdEcdsaRoleLocalPresignSessionStepWasm,
+		abortClientPresignSession: thresholdEcdsaRoleLocalPresignSessionAbortWasm,
+		admitClientPresignature: thresholdEcdsaRoleLocalAdmitPresignatureWasm,
+		destroyClientPresignature: thresholdEcdsaRoleLocalDestroyPresignatureWasm,
+		reserveClientPresignature: thresholdEcdsaRoleLocalReservePresignatureWasm,
+		commitClientPresignature: thresholdEcdsaRoleLocalCommitPresignatureWasm,
+		listAvailableClientPresignatures: thresholdEcdsaListAvailablePresignaturesWasm.bind(void 0, "linked_holder_signing_material"),
+		computeSignatureShareFromPresignatureHandle: thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm
+	};
+}
 //#endregion
-export { loadRouterAbEcdsaDerivationSigningMaterialSource };
+export { createLinkedHolderClientSigningMaterialSource, loadRouterAbEcdsaDerivationSigningMaterialSource };
 
 //# sourceMappingURL=ecdsaDerivationClientSigningMaterialSource.js.map

package/dist/esm/core/signingEngine/flows/signEvmFamily/signingFlow.js

@@ -3,11 +3,11 @@ import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { SigningEventPhase, createSigningFlowEvent } from "../../../types/sdkSentEvents.js";
 import { SigningSessionIds } from "../../session/operationState/types.js";
-import { normalizeAuthenticationCredential } from "../../webauthnAuth/credentials/helpers.js";
 import { isActiveWalletAuthoritySigningAuthPlan, isWarmSessionSigningAuthPlan } from "../../stepUpConfirmation/types.js";
 import { emitEcdsaSigningTiming } from "../../session/operationState/trace.js";
 import { SigningOperationCommandKind, buildSigningOperationCommandSteps, createSigningOperationPlan, runSigningOperationCommandSteps, runUnplannedSigningOperationCommandSequence } from "../shared/signingStateMachine.js";
 import { createSigningConfirmationCommandHandler, inferDigest32FromSignRequest, makeRequestId, mapSigningConfirmationProgress, resolveSigningConfirmationAuthMethod } from "../shared/signingConfirmation.js";
+import { normalizeAuthenticationCredential } from "../../webauthnAuth/credentials/helpers.js";
 import { parseSigningOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import { toManagedNonceReservationSnapshot } from "../../../rpcClients/evm/nonceBackend.js";
 import { bytesToHex } from "../../chains/evm/bytes.js";
@@ -575,10 +575,12 @@ async function signEvmFamilyWithUiConfirm(args) {
 		signedResult = await intent.finalize(signatures);
 		thresholdSignatureCreated = true;
 		await markNonceReservationSigned();
-		if (activeThresholdEcdsaOperation) {
-			const operationId = String(activeThresholdEcdsaOperation.intent.operationId);
-			emitEcdsaSigningTiming(operationId, "transaction_assembly", assemblyStartedAt);
-			emitEcdsaSigningTiming(operationId, "commit_total", commitStartedAt);
+		let completedEcdsaOperationId = null;
+		if (activeThresholdEcdsaOperation) completedEcdsaOperationId = String(activeThresholdEcdsaOperation.intent.operationId);
+		else if (input.authorization.kind === "active_wallet_authority" && input.signingOperation) completedEcdsaOperationId = String(input.signingOperation.operationId);
+		if (completedEcdsaOperationId !== null) {
+			emitEcdsaSigningTiming(completedEcdsaOperationId, "transaction_assembly", assemblyStartedAt);
+			emitEcdsaSigningTiming(completedEcdsaOperationId, "commit_total", commitStartedAt);
 		}
 		emitProgress({
 			phase: SigningEventPhase.STEP_11_TRANSACTION_SIGNED,

package/dist/esm/core/signingEngine/flows/signEvmFamily/signingFlowRuntime.js

@@ -4,9 +4,9 @@ import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ec
 import { requireEvmFamilyEcdsaSigner } from "../../session/identity/exactSigningLaneIdentity.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { isEd25519ExtensionOfEcdsaWalletAuthority } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { exactEcdsaWalletSessionRuntimesMatch } from "../../session/material/ecdsaSigningCapability.js";
+import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
+import { exactAuthorizationMatchesCapability, exactEcdsaWalletSessionRuntimesMatch } from "../../session/material/ecdsaSigningCapability.js";
 import { emitEvmFamilySigningOperationTrace } from "./events.js";
-import { resolveThresholdEcdsaSigningQueueKey } from "../../threshold/ecdsa/signingQueue.js";
 import { loadSecp256k1EngineCtor, loadWebAuthnP256EngineCtor } from "./signerLoader.js";
 import { attachExactEcdsaWalletSessionAuthorization, buildActiveWalletAuthorityReadySecp256k1Material, resolveHydratedSecp256k1SigningMaterial } from "./readySecp256k1Material.js";
 import { resolveExactEcdsaCapabilityRuntime } from "../../session/material/activeEcdsaCapabilityRuntime.js";
@@ -109,7 +109,7 @@ async function prepareSessionBoundEcdsaOperationStepUp(sessionScope, input) {
 }
 async function runSerializedEcdsaMaterialUse(args, task) {
 	return await args.deps.withThresholdEcdsaSigningQueue({
-		queueKey: resolveThresholdEcdsaSigningQueueKey({ materialActivation: args.materialActivation }),
+		queueKey: resolveThresholdCommitQueueKey({ materialActivation: args.materialActivation }),
 		walletId: args.walletId,
 		enabled: true,
 		...args.shouldAbort ? { shouldAbort: args.shouldAbort } : {},
@@ -259,18 +259,19 @@ async function createEvmFamilySigningFlowRuntime(args) {
 	const ctx = args.deps.touchConfirm.getContext();
 	const walletId = toWalletId(args.walletSession.walletId);
 	const relayerUrl = requireEvmFamilyRelayerUrl(args.deps);
-	const resolvedSigner = args.senderSignatureAlgorithm === "secp256k1" ? requireEvmFamilyEcdsaSigner(args.getEcdsaSigningLaneIdentity(), "ECDSA signing material hydration") : void 0;
+	const resolvedSigner = args.senderSignatureAlgorithm === "secp256k1" ? requireEvmFamilyEcdsaSigner(args.preparedSession.kind === "authorized" ? args.preparedSession.signingLane.identity : args.preparedSession.identity, "ECDSA signing material hydration") : void 0;
 	if (args.activeWalletAuthority && !resolvedSigner) throw new Error("[SigningEngine] active Wallet Authority runtime requires a threshold ECDSA signer");
 	const capability = resolvedSigner && !args.activeWalletAuthority ? await args.deps.resolveCanonicalEcdsaSigningCapability({
 		walletId: resolvedSigner.walletId,
 		chainTarget: resolvedSigner.chainTarget,
 		materialActivation: resolvedSigner.materialActivation
 	}) : void 0;
-	const activeAuthorization = resolvedSigner && !args.activeWalletAuthority ? await args.deps.resolveActiveEcdsaWalletSessionAuthorization({
-		walletId: resolvedSigner.walletId,
-		chainTarget: resolvedSigner.chainTarget,
-		materialActivation: resolvedSigner.materialActivation
-	}) : null;
+	const preparedAuthorization = args.preparedSession?.kind === "authorized" ? args.preparedSession.selection.lane.authorization : null;
+	const activeAuthorization = capability && preparedAuthorization && preparedAuthorization.runtime.remainingUses > 0 && exactAuthorizationMatchesCapability({
+		capability,
+		authorization: preparedAuthorization,
+		nowMs: Date.now()
+	}) ? preparedAuthorization : null;
 	const exactOperationCredentialScope = resolvedSigner && capability && !args.activeWalletAuthority ? {
 		walletId: resolvedSigner.walletId,
 		chainTarget: resolvedSigner.chainTarget,

package/dist/esm/core/signingEngine/flows/signEvmFamily/transactionExecutor.js

@@ -13,9 +13,6 @@ function requireRawEip1559ThresholdOwnerNonceSenderIdentity(args) {
 	if (args.state.kind === "not_required") throw new Error(`[SigningEngine][evm-family] raw EIP-1559 signing requires prepared threshold ECDSA owner address for ${args.walletId}`);
 	return thresholdOwnerNonceSenderIdentity(args.state.thresholdOwnerAddress);
 }
-function resolvePreparedNonceSenderIdentity(args) {
-	return resolveThresholdOwnerNonceSenderIdentity(args);
-}
 function resolveFallbackChainAccountNonceSenderIdentity(args) {
 	return resolveWalletChainNonceSenderIdentity({
 		deps: args.deps,
@@ -67,10 +64,9 @@ async function executeEvmFamilyTransactionSigning(args) {
 		let fallbackSenderIdentityPromise = null;
 		const rawEip1559SenderIdentity = args.request.kind === "eip1559" ? requireRawEip1559ThresholdOwnerNonceSenderIdentity({
 			state: args.thresholdEcdsaState,
-			walletId: args.walletId,
-			chainTarget: args.chainTarget
+			walletId: args.walletId
 		}) : void 0;
-		const preparedSenderIdentity = resolvePreparedNonceSenderIdentity({ state: args.thresholdEcdsaState });
+		const preparedSenderIdentity = resolveThresholdOwnerNonceSenderIdentity({ state: args.thresholdEcdsaState });
 		const getSenderIdentity = (nonceArgs) => {
 			const exactSenderIdentity = rawEip1559SenderIdentity || preparedSenderIdentity;
 			if (exactSenderIdentity) return Promise.resolve(exactSenderIdentity);
@@ -109,7 +105,7 @@ async function executeEvmFamilyTransactionSigning(args) {
 		});
 	}
 	let tempoFallbackSenderIdentityPromise = null;
-	const tempoPreparedSenderIdentity = resolvePreparedNonceSenderIdentity({ state: args.thresholdEcdsaState });
+	const tempoPreparedSenderIdentity = resolveThresholdOwnerNonceSenderIdentity({ state: args.thresholdEcdsaState });
 	const getTempoSenderIdentity = (nonceArgs) => {
 		if (tempoPreparedSenderIdentity) return Promise.resolve(tempoPreparedSenderIdentity);
 		if (!tempoFallbackSenderIdentityPromise) tempoFallbackSenderIdentityPromise = resolveFallbackChainAccountNonceSenderIdentity({

package/dist/esm/core/signingEngine/flows/signNear/implicitAccountFunding.js

@@ -1,5 +1,5 @@
-import { nonceLeaseToRef } from "../../nonce/nonceLaneKeys.js";
 import { fundImplicitNearAccountForTesting } from "../../../rpcClients/relayer/walletRegistration.js";
+import { nonceLeaseToRef } from "../../nonce/nonceLaneKeys.js";
 import { buildNearNonceLane } from "../../nonce/nearNonceLaneIdentity.js";
 //#region src/core/signingEngine/flows/signNear/implicitAccountFunding.ts
 const ACCESS_KEY_POLL_ATTEMPTS = 12;