@seams/wallet 0.7.3 → 0.8.0

package/dist/esm/react/core/signingEngine/flows/signEvmFamily/signingFlowRuntime.js

@@ -1,392 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { walletSessionPreservesCapabilities } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { requireEvmFamilyEcdsaSigner } from "../../session/identity/exactSigningLaneIdentity.js";
-import { isEd25519ExtensionOfEcdsaWalletAuthority } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
-import { exactAuthorizationMatchesCapability, exactEcdsaWalletSessionRuntimesMatch } from "../../session/material/ecdsaSigningCapability.js";
-import { emitEvmFamilySigningOperationTrace } from "./events.js";
-import { loadSecp256k1EngineCtor, loadWebAuthnP256EngineCtor } from "./signerLoader.js";
-import { attachExactEcdsaWalletSessionAuthorization, buildActiveWalletAuthorityReadySecp256k1Material, resolveHydratedSecp256k1SigningMaterial } from "./readySecp256k1Material.js";
-import { resolveExactEcdsaCapabilityRuntime } from "../../session/material/activeEcdsaCapabilityRuntime.js";
-import { authorizeEvmFamilyEcdsaOperationStepUp, prepareEvmFamilyEcdsaOperationStepUp } from "./thresholdAdmission.js";
-import { resolveActiveWalletAuthorityEcdsaRuntimeV1 } from "../../session/material/activeWalletAuthorityEcdsaRuntime.js";
-//#region src/core/signingEngine/flows/signEvmFamily/signingFlowRuntime.ts
-function buildActiveWalletAuthorityConfirmationAuthPlan(runtime) {
-	return {
-		kind: "active_wallet_authority",
-		method: runtime.auth.kind,
-		accountId: String(runtime.walletId),
-		intent: "transaction_sign",
-		curve: "ecdsa",
-		walletSessionId: runtime.operationCredential.walletSessionId,
-		authorityId: runtime.authorityId,
-		authMethodId: runtime.walletAuthMethodId,
-		expiresAtMs: runtime.session.expiresAtMs
-	};
-}
-function signerAuthMethodForWalletAuthority(authority) {
-	switch (authority.factor.kind) {
-		case "passkey": return "passkey";
-		case "email_otp": return "email_otp";
-		default:
-			authority.factor;
-			throw new Error("[SigningEngine] unsupported wallet authorization factor");
-	}
-}
-function capabilityMatchesOperationScope(args) {
-	const manifest = args.capability.manifest;
-	return manifest.signer.walletId === args.scope.walletId && mpcMaterialActivationRefsEqual(manifest.activation.materialActivation, args.scope.materialActivation) && manifest.signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, args.scope.chainTarget));
-}
-function sessionAuthorizesCanonicalEcdsaCapability(args) {
-	const materialActivation = args.capability.manifest.activation.materialActivation;
-	return args.session.capabilitySubjects.filter((subject) => subject.kind === "sign" && subject.keyFamily === "ecdsa_secp256k1" && mpcMaterialActivationRefsEqual(subject.materialActivation, materialActivation)).length === 1;
-}
-async function resolveExactEcdsaOperationStepUpSession(args) {
-	if (!capabilityMatchesOperationScope(args)) throw new Error("[SigningEngine] exact ECDSA Wallet Session material changed");
-	const ports = args.ports;
-	const selected = await ports.resolveSelectedWalletAuthority(String(args.scope.walletId));
-	const selectedReason = selectedStepUpAuthorityUnavailableReason(selected, args.scope.walletId);
-	if (selectedReason || selected.kind !== "resolved") throw exactEcdsaWalletSessionUnavailable(selectedReason ?? "selected_authority_invalid");
-	const capabilityAuthority = await walletAuthAuthorityRef({ authority: args.capability.authority });
-	const manifestAuthority = args.capability.manifest.signer.authority;
-	const selectedActivation = selected.authority.signerActivations.ecdsa;
-	if (capabilityAuthority.walletId !== manifestAuthority.walletId || capabilityAuthority.walletAuthMethodId !== manifestAuthority.walletAuthMethodId || capabilityAuthority.authorityDigest !== manifestAuthority.authorityDigest || manifestAuthority.walletId !== selected.authority.walletId || manifestAuthority.walletAuthMethodId !== selected.authMethod.walletAuthMethodId || !selectedActivation || !mpcMaterialActivationRefsEqual(selectedActivation.materialActivation, args.scope.materialActivation)) throw new Error("[SigningEngine] exact ECDSA Wallet Session material changed");
-	const read = await ports.readExactWithOperationCredential({
-		walletId: args.scope.walletId,
-		authorityId: selected.authority.authorityId,
-		authMethodId: selected.authMethod.walletAuthMethodId
-	});
-	if (read.kind !== "found") throw exactEcdsaWalletSessionUnavailable(read.kind === "missing" ? "wallet_session_missing" : "wallet_session_upgrade_required");
-	const session = read.record;
-	const sessionReason = stepUpSessionRecordUnavailableReason({
-		session,
-		operationCredential: read.operationCredential,
-		walletId: args.scope.walletId,
-		authority: selected.authority,
-		authMethod: selected.authMethod,
-		capability: args.capability
-	});
-	if (sessionReason) throw exactEcdsaWalletSessionUnavailable(sessionReason);
-	return {
-		credential: read.operationCredential,
-		expiresAtMs: session.expiresAtMs
-	};
-}
-function exactEcdsaWalletSessionUnavailable(reason) {
-	return /* @__PURE__ */ new Error(`[SigningEngine] exact ECDSA Wallet Session is unavailable: ${reason}`);
-}
-function selectedStepUpAuthorityUnavailableReason(selected, walletId) {
-	if (selected.kind !== "resolved") return selected.kind === "missing_selection" ? "selected_authority_missing" : "selected_authority_invalid";
-	if (selected.selection.walletId !== walletId || selected.authMethod.walletId !== walletId || selected.authority.walletId !== walletId || selected.selection.walletAuthMethodId !== selected.authMethod.walletAuthMethodId || selected.authMethod.walletAuthorityId !== selected.authority.authorityId) return "authority_identity_mismatch";
-	if (selected.selection.lockState !== "unlocked") return "wallet_locked";
-	if (selected.authMethod.status !== "active") return "auth_method_inactive";
-	if (selected.authority.state !== "active") return "authority_inactive";
-	return null;
-}
-function stepUpSessionRecordUnavailableReason(args) {
-	const { session } = args;
-	if (session.walletId !== args.walletId || session.authorityId !== args.authority.authorityId || session.authMethodId !== args.authMethod.walletAuthMethodId) return "wallet_session_identity_mismatch (authority or method)";
-	if (session.authorityDigestB64u !== args.authority.authorityDigestB64u) return "wallet_session_identity_mismatch (authority digest)";
-	if (session.authorityRevocationEpoch !== args.authority.revocationEpoch) return "wallet_session_identity_mismatch (authority revocation epoch)";
-	if (!args.operationCredential.token.trim()) return "wallet_session_identity_mismatch (operation credential)";
-	if (session.expiresAtMs <= Date.now()) return "wallet_session_expired";
-	if (!sessionAuthorizesCanonicalEcdsaCapability({
-		session,
-		capability: args.capability
-	})) return "wallet_session_capability_mismatch";
-	return null;
-}
-async function prepareSessionBoundEcdsaOperationStepUp(sessionScope, input) {
-	const session = await resolveExactEcdsaOperationStepUpSession(sessionScope);
-	return await prepareEvmFamilyEcdsaOperationStepUp({
-		operation: input.operation,
-		operationDigests: input.operationDigests,
-		material: input.material,
-		sessionExpiresAtMs: session.expiresAtMs
-	});
-}
-async function runSerializedEcdsaMaterialUse(args, task) {
-	return await args.deps.withThresholdEcdsaSigningQueue({
-		queueKey: resolveThresholdCommitQueueKey({ materialActivation: args.materialActivation }),
-		walletId: args.walletId,
-		enabled: true,
-		...args.shouldAbort ? { shouldAbort: args.shouldAbort } : {},
-		task
-	});
-}
-function requireEvmFamilyRelayerUrl(deps) {
-	const relayerUrl = String(deps.seamsWebConfigs.network.relayer?.url || "").trim();
-	if (!relayerUrl) throw new Error("[SigningEngine] EVM-family signing requires relayerUrl");
-	return relayerUrl;
-}
-async function resolveCurrentActiveWalletAuthorityRuntime(args) {
-	const current = await resolveActiveWalletAuthorityEcdsaRuntimeV1({
-		ports: args.deps.activeWalletAuthorityEcdsaRuntimeReadPorts,
-		input: {
-			walletId: args.signer.walletId,
-			chainTarget: args.signer.chainTarget,
-			requiredCapability: "sign",
-			materialActivation: args.signer.materialActivation,
-			nowMs: Date.now()
-		}
-	});
-	if (current.kind !== "resolved") throw new Error(`[SigningEngine] active Wallet Authority ECDSA runtime is ${current.reason}`);
-	const runtime = current.runtime;
-	if (runtime.authorityId !== args.prepared.authorityId || runtime.walletAuthMethodId !== args.prepared.walletAuthMethodId || runtime.authorityDigestB64u !== args.prepared.authorityDigestB64u || runtime.authorityRevocationEpoch !== args.prepared.authorityRevocationEpoch || runtime.walletSessionId !== args.prepared.walletSessionId || runtime.publicFacts.keyHandle !== args.signer.keyHandle) throw new Error("[SigningEngine] active Wallet Authority ECDSA runtime was replaced");
-	return runtime;
-}
-/** The wallet's active manifest names the material that may be used right now.
-* When it has moved on from the one this operation was prepared against, the
-* preparation is superseded -- material activation is advance-only, so the
-* prepared side is always the stale one. That is a re-resolution, not a failure
-* and not a request for the wrong material. */
-function ecdsaSigningMaterialSupersession(args) {
-	if (mpcMaterialActivationRefsEqual(args.currentMaterialActivation, args.preparedMaterialActivation)) return null;
-	return {
-		kind: "superseded",
-		supersessionKind: "material_activation_replaced",
-		preparedMaterialActivation: args.preparedMaterialActivation,
-		currentMaterialActivation: args.currentMaterialActivation
-	};
-}
-function ecdsaSigningCapabilitySupersession(args) {
-	const preparedManifest = args.preparedCapability.manifest;
-	const preparedActivation = preparedManifest.activation.materialActivation;
-	const currentActivation = args.currentManifest.activation.materialActivation;
-	const activationSupersession = ecdsaSigningMaterialSupersession({
-		preparedMaterialActivation: preparedActivation,
-		currentMaterialActivation: currentActivation
-	});
-	if (activationSupersession) return activationSupersession;
-	const preparedSigner = preparedManifest.signer;
-	const currentSigner = args.currentManifest.signer;
-	if (String(preparedManifest.identity.manifestId) === String(args.currentManifest.identity.manifestId) && Number(preparedManifest.identity.manifestRevision) === Number(args.currentManifest.identity.manifestRevision) && String(preparedSigner.capability) === String(currentSigner.capability) && String(preparedSigner.authority.walletId) === String(currentSigner.authority.walletId) && String(preparedSigner.authority.authorityDigest) === String(currentSigner.authority.authorityDigest)) return null;
-	return {
-		kind: "superseded",
-		supersessionKind: "capability_authority_replaced",
-		preparedMaterialActivation: preparedActivation,
-		currentMaterialActivation: currentActivation
-	};
-}
-function ecdsaSigningAuthorizationSupersession(args) {
-	const prepared = args.preparedAuthorization;
-	const current = args.currentAuthorization;
-	if (current && prepared.selectedAuthority.authorityId === current.selectedAuthority.authorityId && prepared.selectedAuthMethod.kind === current.selectedAuthMethod.kind && prepared.selectedAuthMethod.walletAuthMethodId === current.selectedAuthMethod.walletAuthMethodId && prepared.session.walletId === current.session.walletId && prepared.session.authorityId === current.session.authorityId && prepared.session.authMethodId === current.session.authMethodId && prepared.session.authorizationId === current.session.authorizationId && prepared.session.quotaId === current.session.quotaId && (prepared.session.authorityDigestB64u === current.session.authorityDigestB64u || isEd25519ExtensionOfEcdsaWalletAuthority(prepared.selectedAuthority, current.selectedAuthority) && walletSessionPreservesCapabilities(prepared.session, current.session)) && prepared.session.issuedAtMs === current.session.issuedAtMs && prepared.session.expiresAtMs === current.session.expiresAtMs && prepared.session.authorityRevocationEpoch === current.session.authorityRevocationEpoch && prepared.operationCredential.walletSessionId === current.operationCredential.walletSessionId && prepared.operationCredential.token === current.operationCredential.token && exactEcdsaWalletSessionRuntimesMatch(prepared.runtime, current.runtime) && mpcMaterialActivationRefsEqual(current.runtime.materialActivation, args.materialActivation)) return null;
-	return {
-		kind: "superseded",
-		supersessionKind: "reusable_authorization_replaced",
-		preparedMaterialActivation: args.materialActivation,
-		currentMaterialActivation: args.materialActivation
-	};
-}
-async function resolveEcdsaSigningMaterialHydrationPlan(args) {
-	const activeRuntimeResolution = await resolveExactEcdsaCapabilityRuntime({
-		manifest: args.capability.manifest,
-		chainTarget: args.chainTarget,
-		relayerUrl: args.relayerUrl
-	});
-	if (activeRuntimeResolution.kind !== "resolved") return {
-		kind: "failed",
-		failure: {
-			kind: "unavailable",
-			reason: "runtime_correlation_mismatch"
-		}
-	};
-	const superseded = ecdsaSigningCapabilitySupersession({
-		preparedCapability: args.capability,
-		currentManifest: activeRuntimeResolution.manifest
-	});
-	if (superseded) return {
-		kind: "superseded",
-		replacement: superseded
-	};
-	if (args.preparedAuthorization) {
-		const authorizationSupersession = ecdsaSigningAuthorizationSupersession({
-			preparedAuthorization: args.preparedAuthorization,
-			currentAuthorization: args.currentAuthorization,
-			materialActivation: args.materialActivation
-		});
-		if (authorizationSupersession) return {
-			kind: "superseded",
-			replacement: authorizationSupersession
-		};
-	}
-	const resolution = await resolveHydratedSecp256k1SigningMaterial({
-		capability: args.capability,
-		runtime: activeRuntimeResolution.runtime,
-		chainTarget: args.chainTarget,
-		materialActivation: args.materialActivation,
-		workerCtx: args.workerCtx
-	});
-	if (resolution.kind === "unavailable") return {
-		kind: "failed",
-		failure: resolution
-	};
-	if (!args.preparedAuthorization) return {
-		kind: "authorization_required",
-		requirement: {
-			kind: "material_for_step_up",
-			material: resolution.material
-		}
-	};
-	if (!args.currentAuthorization) return {
-		kind: "superseded",
-		replacement: {
-			kind: "superseded",
-			supersessionKind: "reusable_authorization_replaced",
-			preparedMaterialActivation: args.materialActivation,
-			currentMaterialActivation: args.materialActivation
-		}
-	};
-	return {
-		kind: "ready",
-		value: {
-			kind: "material_from_canonical_capability",
-			material: attachExactEcdsaWalletSessionAuthorization({
-				material: resolution.material,
-				capability: args.capability,
-				authorization: args.currentAuthorization,
-				nowMs: Date.now()
-			})
-		}
-	};
-}
-async function createEvmFamilySigningFlowRuntime(args) {
-	const [Secp256k1Engine, WebAuthnP256Engine] = await Promise.all([loadSecp256k1EngineCtor(), loadWebAuthnP256EngineCtor()]);
-	const workerCtx = args.deps.getSignerWorkerContext();
-	const ctx = args.deps.touchConfirm.getContext();
-	const walletId = toWalletId(args.walletSession.walletId);
-	const relayerUrl = requireEvmFamilyRelayerUrl(args.deps);
-	const resolvedSigner = args.senderSignatureAlgorithm === "secp256k1" ? requireEvmFamilyEcdsaSigner(args.preparedSession.kind === "authorized" ? args.preparedSession.signingLane.identity : args.preparedSession.identity, "ECDSA signing material hydration") : void 0;
-	if (args.activeWalletAuthority && !resolvedSigner) throw new Error("[SigningEngine] active Wallet Authority runtime requires a threshold ECDSA signer");
-	const capability = resolvedSigner && !args.activeWalletAuthority ? await args.deps.resolveCanonicalEcdsaSigningCapability({
-		walletId: resolvedSigner.walletId,
-		chainTarget: resolvedSigner.chainTarget,
-		materialActivation: resolvedSigner.materialActivation
-	}) : void 0;
-	const preparedAuthorization = args.preparedSession?.kind === "authorized" ? args.preparedSession.selection.lane.authorization : null;
-	const activeAuthorization = capability && preparedAuthorization && preparedAuthorization.runtime.remainingUses > 0 && exactAuthorizationMatchesCapability({
-		capability,
-		authorization: preparedAuthorization,
-		nowMs: Date.now()
-	}) ? preparedAuthorization : null;
-	const exactOperationCredentialScope = resolvedSigner && capability && !args.activeWalletAuthority ? {
-		walletId: resolvedSigner.walletId,
-		chainTarget: resolvedSigner.chainTarget,
-		materialActivation: resolvedSigner.materialActivation
-	} : void 0;
-	const thresholdEcdsaStepUpRuntime = !args.activeWalletAuthority && capability && exactOperationCredentialScope ? {
-		...args.emailOtpSigningForFlow ? { emailOtpSigning: args.emailOtpSigningForFlow } : {},
-		reusableAuthorization: activeAuthorization ? { kind: "active" } : {
-			kind: "absent",
-			requiredFactor: signerAuthMethodForWalletAuthority(capability.authority)
-		},
-		operationStepUp: {
-			prepare: prepareSessionBoundEcdsaOperationStepUp.bind(void 0, {
-				ports: args.deps.activeWalletAuthorityEcdsaRuntimeReadPorts,
-				scope: exactOperationCredentialScope,
-				capability
-			}),
-			authorize: async ({ authorization, prepared, material }) => {
-				args.onAuthSideEffectStarted?.(authorization.kind === "passkey" ? "passkey_reauth" : "email_otp_challenge");
-				const session = await resolveExactEcdsaOperationStepUpSession({
-					ports: args.deps.activeWalletAuthorityEcdsaRuntimeReadPorts,
-					scope: exactOperationCredentialScope,
-					capability
-				});
-				return await authorizeEvmFamilyEcdsaOperationStepUp({
-					relayerUrl,
-					authority: capability.authority,
-					authorization,
-					prepared,
-					material,
-					walletSessionToken: session.credential.token
-				});
-			}
-		},
-		...args.onAuthSideEffectStarted ? { onAuthSideEffectStarted: args.onAuthSideEffectStarted } : {}
-	} : void 0;
-	const secp256k1Engine = new Secp256k1Engine({
-		beforeSigning: args.deps.beforeSigning,
-		getRpId: () => ctx.touchIdPrompt.getRpId(),
-		workerCtx,
-		shouldAbort: args.shouldAbort
-	});
-	const activeWalletAuthority = args.activeWalletAuthority;
-	const activeWalletAuthorityAuthorization = activeWalletAuthority && resolvedSigner ? {
-		kind: "active_wallet_authority",
-		confirmationAuthPlan: activeWalletAuthority.confirmationAuthPlan,
-		sign: async (input) => {
-			if (String(activeWalletAuthority.intent.operationId) !== input.operationId) throw new Error("[SigningEngine] active Wallet Authority signing operation identity changed");
-			return await runSerializedEcdsaMaterialUse({
-				deps: args.deps,
-				walletId: resolvedSigner.walletId,
-				materialActivation: resolvedSigner.materialActivation,
-				...args.shouldAbort ? { shouldAbort: args.shouldAbort } : {}
-			}, async () => {
-				const readyMaterial = buildActiveWalletAuthorityReadySecp256k1Material({
-					authorityRuntime: await resolveCurrentActiveWalletAuthorityRuntime({
-						deps: args.deps,
-						prepared: activeWalletAuthority.runtime,
-						signer: resolvedSigner
-					}),
-					chainTarget: resolvedSigner.chainTarget,
-					relayerUrl
-				});
-				return await secp256k1Engine.signReady({
-					kind: "digest",
-					algorithm: "secp256k1",
-					digest32: input.signingDigest32
-				}, readyMaterial, {
-					intent: activeWalletAuthority.intent,
-					authPlan: activeWalletAuthority.confirmationAuthPlan
-				}, input.operationDigests);
-			});
-		}
-	} : void 0;
-	return { flowArgs: {
-		ctx,
-		touchConfirm: args.deps.touchConfirm,
-		workerCtx,
-		walletId,
-		onEvent: args.onEvent,
-		engines: {
-			secp256k1: secp256k1Engine,
-			webauthnP256: new WebAuthnP256Engine(workerCtx, args.deps.beforeSigning)
-		},
-		...resolvedSigner && capability ? {
-			runEcdsaMaterialUse: runSerializedEcdsaMaterialUse.bind(null, {
-				deps: args.deps,
-				walletId: resolvedSigner.walletId,
-				materialActivation: resolvedSigner.materialActivation,
-				...args.shouldAbort ? { shouldAbort: args.shouldAbort } : {}
-			}),
-			resolveEcdsaSigningMaterialPlan: async () => await resolveEcdsaSigningMaterialHydrationPlan({
-				capability,
-				preparedAuthorization: activeAuthorization,
-				currentAuthorization: activeAuthorization ? await args.deps.resolveActiveEcdsaWalletSessionAuthorization({
-					walletId: resolvedSigner.walletId,
-					chainTarget: resolvedSigner.chainTarget,
-					materialActivation: resolvedSigner.materialActivation
-				}) : null,
-				walletId: resolvedSigner.walletId,
-				chainTarget: resolvedSigner.chainTarget,
-				materialActivation: resolvedSigner.materialActivation,
-				relayerUrl,
-				workerCtx
-			})
-		} : {},
-		...activeWalletAuthorityAuthorization ? { authorization: activeWalletAuthorityAuthorization } : {},
-		...args.signingSessionPlan ? { signingSessionPlan: args.signingSessionPlan } : {},
-		...args.signingOperation ? { signingOperation: args.signingOperation } : {},
-		onSigningOperationTransition: args.onSigningOperationTransition || emitEvmFamilySigningOperationTrace,
-		...thresholdEcdsaStepUpRuntime ? { thresholdEcdsaStepUpRuntime } : {},
-		confirmationConfigOverride: args.confirmationConfigOverride
-	} };
-}
-//#endregion
-export { buildActiveWalletAuthorityConfirmationAuthPlan, createEvmFamilySigningFlowRuntime };
-
-//# sourceMappingURL=signingFlowRuntime.js.map

package/dist/esm/react/core/signingEngine/flows/signEvmFamily/stepUpAuthorization.js

@@ -1,56 +0,0 @@
-import { normalizeAuthenticationCredential } from "../../webauthnAuth/credentials/helpers.js";
-//#region src/core/signingEngine/flows/signEvmFamily/stepUpAuthorization.ts
-function buildEvmFamilyWarmSessionStepUpAuthorization(args) {
-	return {
-		kind: "warm_session",
-		signingAuthPlan: args.signingAuthPlan,
-		materialActivation: args.signingAuthPlan.materialActivation,
-		authorization: args.signingAuthPlan.authorization,
-		expiresAtMs: args.signingAuthPlan.expiresAtMs,
-		remainingUses: args.signingAuthPlan.remainingUses
-	};
-}
-function buildEvmFamilyEmailOtpStepUpAuthorization(args) {
-	return {
-		kind: "email_otp",
-		signingAuthPlan: args.signingAuthPlan,
-		challengeId: normalizeChallengeId(args.confirmation.emailOtpChallengeId, args.prompt, "EVM-family step-up authorization"),
-		otpCode: normalizeOtpCode(args.confirmation.otpCode),
-		...args.prompt.emailHint ? { emailHint: args.prompt.emailHint } : {}
-	};
-}
-function buildEvmFamilyPasskeyStepUpAuthorization(args) {
-	if (!args.confirmation.credential) throw new Error("[chains] missing WebAuthn credential for EVM-family step-up authorization");
-	return {
-		kind: "passkey",
-		signingAuthPlan: args.signingAuthPlan,
-		credential: normalizeAuthenticationCredential(args.confirmation.credential)
-	};
-}
-function buildEvmFamilyEcdsaStepUpAuthorization(args) {
-	if (args.prepared.kind === "active_wallet_authority") throw new Error("[chains] active Wallet Authority confirmation has no threshold step-up");
-	if (args.prepared.kind === "warm_session") return buildEvmFamilyWarmSessionStepUpAuthorization({ signingAuthPlan: args.prepared.confirmationAuthPayload.signingAuthPlan });
-	if (args.prepared.kind === "email_otp") return buildEvmFamilyEmailOtpStepUpAuthorization({
-		signingAuthPlan: args.prepared.confirmationAuthPayload.signingAuthPlan,
-		prompt: args.prepared.emailOtpPrompt,
-		confirmation: args.confirmation
-	});
-	return buildEvmFamilyPasskeyStepUpAuthorization({
-		signingAuthPlan: args.prepared.confirmationAuthPayload.signingAuthPlan,
-		confirmation: args.confirmation
-	});
-}
-function normalizeOtpCode(otpCodeRaw) {
-	const otpCode = String(otpCodeRaw || "").trim();
-	if (!/^\d{6}$/.test(otpCode)) throw new Error("[chains] missing Email OTP code from touchConfirm");
-	return otpCode;
-}
-function normalizeChallengeId(challengeIdRaw, prompt, context) {
-	const challengeId = String(challengeIdRaw || prompt.challengeId || "").trim();
-	if (!challengeId) throw new Error(`[chains] missing Email OTP challenge id for ${context}`);
-	return challengeId;
-}
-//#endregion
-export { buildEvmFamilyEcdsaStepUpAuthorization };
-
-//# sourceMappingURL=stepUpAuthorization.js.map

package/dist/esm/react/core/signingEngine/flows/signEvmFamily/tempoNonceLifecycle.js

@@ -1,47 +0,0 @@
-import { evmNonceLeaseToManagedReservation, evmReserveNonceInputToLane } from "../../nonce/nonceLaneKeys.js";
-import { reserveNonceInputFromBoundary } from "../../../rpcClients/evm/nonceBackend.js";
-import { mapToRetryableNonceStateError } from "./errors.js";
-import { resolveManagedNonceSender, resolveNonceNetworkKey } from "./nonceResolution.js";
-//#region src/core/signingEngine/flows/signEvmFamily/tempoNonceLifecycle.ts
-async function reserveManagedTempoNonceForRequest(args) {
-	const sender = await resolveManagedNonceSender({ senderIdentity: args.senderIdentity });
-	const reservationInput = reserveNonceInputFromBoundary({
-		chain: "tempo",
-		networkKey: resolveNonceNetworkKey({
-			configs: args.deps.seamsWebConfigs,
-			request: args.request
-		}),
-		chainId: args.request.tx.chainId,
-		sender,
-		nonceKey: args.request.tx.nonceKey,
-		walletId: args.walletId
-	});
-	let reservation;
-	try {
-		reservation = evmNonceLeaseToManagedReservation(await args.deps.nonceCoordinator.reserve({
-			lane: evmReserveNonceInputToLane(reservationInput),
-			operation: args.operation
-		}));
-	} catch (error) {
-		throw mapToRetryableNonceStateError({
-			error,
-			chain: "tempo",
-			networkKey: reservationInput.chainTarget.networkSlug,
-			chainId: reservationInput.chainTarget.chainId
-		});
-	}
-	return {
-		request: {
-			...args.request,
-			tx: {
-				...args.request.tx,
-				nonce: reservation.nonce
-			}
-		},
-		reservation
-	};
-}
-//#endregion
-export { reserveManagedTempoNonceForRequest };
-
-//# sourceMappingURL=tempoNonceLifecycle.js.map

package/dist/esm/react/core/signingEngine/flows/signEvmFamily/thresholdAdmission.js

@@ -1,87 +0,0 @@
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { buildReadySecp256k1SigningMaterial } from "./signers/secp256k1.js";
-import { issueEcdsaOperationStepUpAuthorization, prepareEcdsaOperationStepUp } from "../../threshold/ecdsa/operationStepUp.js";
-//#region src/core/signingEngine/flows/signEvmFamily/thresholdAdmission.ts
-async function prepareEvmFamilyEcdsaOperationStepUp(args) {
-	const signerSession = args.material;
-	const participantIds = signerSession.publicFacts.participantIds;
-	if (participantIds.length !== 2) throw new Error("[chains] ECDSA operation step-up requires exactly two participants");
-	const operationId = String(args.operation.intent.operationId || "").trim();
-	const expiresAtMs = Math.min(Date.now() + 5 * 6e4, args.sessionExpiresAtMs);
-	return await prepareEcdsaOperationStepUp({
-		walletId: signerSession.walletId,
-		operationKind: "evm.sign_transaction",
-		operationId,
-		operationDigests: args.operationDigests,
-		materialActivation: signerSession.materialActivation,
-		normalSigningScope: signerSession.routerAbEcdsaDerivationNormalSigning.state.scope,
-		keyHandle: signerSession.publicFacts.keyHandle,
-		relayerKeyId: signerSession.transport.relayerKeyId,
-		participantIds: [Number(participantIds[0]), Number(participantIds[1])],
-		expiresAtMs
-	});
-}
-async function authorizeEvmFamilyEcdsaOperationStepUp(args) {
-	const proof = operationStepUpProof({
-		authority: args.authority,
-		authorization: args.authorization
-	});
-	const authorization = await issueEcdsaOperationStepUpAuthorization({
-		relayerUrl: args.relayerUrl,
-		request: {
-			kind: "router_ab_ecdsa_operation_step_up_v1",
-			operation: args.prepared.operation,
-			proof
-		}
-	});
-	const credential = {
-		kind: "operation_step_up",
-		walletSessionToken: args.walletSessionToken
-	};
-	return buildReadySecp256k1SigningMaterial({
-		walletId: args.material.walletId,
-		signerSession: args.material,
-		authorization: { kind: "operation_step_up" },
-		credential,
-		expiresAtMs: authorization.expires_at_ms,
-		singleUseEmailOtpSession: false,
-		operationStepUpPreparation: args.prepared.operation
-	});
-}
-function operationStepUpProof(args) {
-	switch (args.authorization.kind) {
-		case "passkey": {
-			if (!isPasskeyWalletAuthAuthority(args.authority)) throw new Error("[chains] passkey step-up requires the exact passkey authority");
-			const credential = args.authorization.credential;
-			return {
-				kind: "passkey",
-				authority: args.authority,
-				webauthn_authentication: {
-					id: credential.id,
-					rawId: credential.rawId,
-					type: credential.type,
-					authenticatorAttachment: credential.authenticatorAttachment ?? null,
-					response: {
-						clientDataJSON: credential.response.clientDataJSON,
-						authenticatorData: credential.response.authenticatorData,
-						signature: credential.response.signature,
-						userHandle: credential.response.userHandle ?? null
-					},
-					clientExtensionResults: credential.clientExtensionResults ?? null
-				}
-			};
-		}
-		case "email_otp":
-			if (!isEmailOtpWalletAuthAuthority(args.authority)) throw new Error("[chains] Email OTP step-up requires the exact Email OTP authority");
-			return {
-				kind: "email_otp",
-				authority: args.authority,
-				challenge_id: args.authorization.challengeId,
-				otp_code: args.authorization.otpCode
-			};
-	}
-}
-//#endregion
-export { authorizeEvmFamilyEcdsaOperationStepUp, prepareEvmFamilyEcdsaOperationStepUp };
-
-//# sourceMappingURL=thresholdAdmission.js.map