@seams/wallet 0.7.3 → 0.8.0

package/dist/esm/core/signingEngine/session/passkey/ed25519YaoWarmRecovery.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
 import { isPlainObject, requireRecord, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
 import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
 import { toAccountId } from "../../../types/accountIds.js";
 import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { normalizeRuntimePolicyScope, sameRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
@@ -52,22 +52,10 @@ async function resolveExactWarmRecoveryRecord(subject, runtime) {
 		authMethod: "passkey",
 		materialActivation: subject.materialActivation
 	}));
-	if (record && (record.curve !== "ed25519" || !sealedRecordMatchesSubject(record, subject) || !mpcMaterialActivationRefsEqual(record.ed25519Restore.materialActivation, subject.materialActivation))) return {
-		kind: "unavailable",
-		reason: "sealed_session_missing"
-	};
-	if (!record) return {
-		kind: "unavailable",
-		reason: "sealed_session_missing"
-	};
-	if (record.expiresAtMs <= runtime.nowMs()) return {
-		kind: "unavailable",
-		reason: "sealed_session_expired"
-	};
-	if (record.remainingUses < 1) return {
-		kind: "unavailable",
-		reason: "sealed_session_exhausted"
-	};
+	if (record && (record.curve !== "ed25519" || !sealedRecordMatchesSubject(record, subject) || !mpcMaterialActivationRefsEqual(record.ed25519Restore.materialActivation, subject.materialActivation))) return { kind: "unavailable" };
+	if (!record) return { kind: "unavailable" };
+	if (record.expiresAtMs <= runtime.nowMs()) return { kind: "unavailable" };
+	if (record.remainingUses < 1) return { kind: "unavailable" };
 	return {
 		kind: "ready",
 		record
@@ -215,10 +203,7 @@ async function parseWarmRecoveryDescriptor(args) {
 }
 async function resolvePasskeyEd25519YaoExportContextV1(input, runtime) {
 	const exactRecord = await resolveExactWarmRecoveryRecord(input.subject, runtime);
-	if (exactRecord.kind === "unavailable") return {
-		kind: "capability_recovery_required",
-		reason: exactRecord.reason
-	};
+	if (exactRecord.kind === "unavailable") return { kind: "capability_recovery_required" };
 	const walletId = parseWalletId(exactRecord.record.walletId);
 	if (!walletId.ok) throw new Error("[SigningEngine][near] sealed Ed25519 wallet identity is invalid");
 	const credentialIdB64u = requireTrimmedString(exactRecord.record.ed25519Restore.credentialIdB64u, "ed25519Restore.credentialIdB64u");
@@ -230,15 +215,9 @@ async function resolvePasskeyEd25519YaoExportContextV1(input, runtime) {
 			credentialIdB64u
 		});
 	} catch {
-		return {
-			kind: "capability_recovery_required",
-			reason: "wallet_session_expired"
-		};
+		return { kind: "capability_recovery_required" };
 	}
-	if (!expectedAuthorityRef) return {
-		kind: "capability_recovery_required",
-		reason: "wallet_session_expired"
-	};
+	if (!expectedAuthorityRef) return { kind: "capability_recovery_required" };
 	const selectedAuthorization = await readExactSelectedPasskeyWalletSessionAuthorization({
 		walletId: walletId.value,
 		rpId: exactRecord.record.ed25519Restore.rpId,
@@ -246,10 +225,7 @@ async function resolvePasskeyEd25519YaoExportContextV1(input, runtime) {
 		expectedAuthorityRef,
 		runtime
 	});
-	if (!selectedAuthorization) return {
-		kind: "capability_recovery_required",
-		reason: "wallet_session_expired"
-	};
+	if (!selectedAuthorization) return { kind: "capability_recovery_required" };
 	const authorization = await requirePasskeyEd25519RestoreAuthorization({
 		record: exactRecord.record,
 		authorizationRead: selectedAuthorization.authorizationRead,
@@ -259,10 +235,7 @@ async function resolvePasskeyEd25519YaoExportContextV1(input, runtime) {
 		expectedAuthorityRevocationEpoch: selectedAuthorization.authorityRevocationEpoch,
 		nowMs: runtime.nowMs()
 	});
-	if (!authorization) return {
-		kind: "capability_recovery_required",
-		reason: "wallet_session_expired"
-	};
+	if (!authorization) return { kind: "capability_recovery_required" };
 	const bootstrap = await fetchWarmRecoveryBootstrap({
 		request: ownerWarmRecoveryBootstrapRequest(exactRecord.record, input.subject.thresholdSessionId),
 		authorization,
@@ -272,19 +245,13 @@ async function resolvePasskeyEd25519YaoExportContextV1(input, runtime) {
 		relayerUrl: input.relayerUrl,
 		fetch: input.fetch
 	});
-	if (bootstrap.kind === "unavailable") return {
-		kind: "capability_recovery_required",
-		reason: bootstrap.reason
-	};
+	if (bootstrap.kind === "unavailable") return { kind: "capability_recovery_required" };
 	const descriptor = bootstrap.descriptor;
 	const walletCustodyEnvelope = await runtime.readPasskeyCustodySessionEnvelope({
 		walletId: String(descriptor.walletId),
 		credentialIdB64u: descriptor.credentialIdB64u
 	});
-	if (!walletCustodyEnvelope || walletCustodyEnvelope.binding.kind !== "wallet_custody_seed_v1") return {
-		kind: "capability_recovery_required",
-		reason: "wallet_custody_envelope_missing"
-	};
+	if (!walletCustodyEnvelope || walletCustodyEnvelope.binding.kind !== "wallet_custody_seed_v1") return { kind: "capability_recovery_required" };
 	return {
 		kind: "ready",
 		context: {

package/dist/esm/core/signingEngine/session/persistence/clientSessionPersistence.js

@@ -15,8 +15,7 @@ async function readEd25519ClientWalletSessionAuthorization(deps, request) {
 		return parseWalletSessionAuthorizationBoundary({
 			observation: {
 				kind: "unavailable",
-				source,
-				reason: "persistence_unavailable"
+				source
 			},
 			nowMs: request.nowMs
 		});
@@ -24,8 +23,7 @@ async function readEd25519ClientWalletSessionAuthorization(deps, request) {
 	if (selected.kind !== "resolved") return parseWalletSessionAuthorizationBoundary({
 		observation: selected.kind === "integrity_error" ? {
 			kind: "invalid",
-			source,
-			reason: "malformed"
+			source
 		} : {
 			kind: "missing",
 			source
@@ -35,8 +33,7 @@ async function readEd25519ClientWalletSessionAuthorization(deps, request) {
 	if (!selectedAuthorityMatchesEd25519Lane(selected, identity)) return parseWalletSessionAuthorizationBoundary({
 		observation: {
 			kind: "invalid",
-			source,
-			reason: "scope_mismatch"
+			source
 		},
 		nowMs: request.nowMs
 	});
@@ -51,8 +48,7 @@ async function readEd25519ClientWalletSessionAuthorization(deps, request) {
 		return parseWalletSessionAuthorizationBoundary({
 			observation: {
 				kind: "unavailable",
-				source,
-				reason: "persistence_unavailable"
+				source
 			},
 			nowMs: request.nowMs
 		});
@@ -69,16 +65,14 @@ async function readEd25519ClientWalletSessionAuthorization(deps, request) {
 		case "upgrade_required": return parseWalletSessionAuthorizationBoundary({
 			observation: {
 				kind: "invalid",
-				source,
-				reason: "malformed"
+				source
 			},
 			nowMs: request.nowMs
 		});
 		case "persistence_unavailable": return parseWalletSessionAuthorizationBoundary({
 			observation: {
 				kind: "unavailable",
-				source,
-				reason: "persistence_unavailable"
+				source
 			},
 			nowMs: request.nowMs
 		});
@@ -87,16 +81,14 @@ async function readEd25519ClientWalletSessionAuthorization(deps, request) {
 	if (authorization.record.walletId !== walletId || authorization.record.authorityId !== selected.authority.authorityId || authorization.record.authMethodId !== selected.authMethod.walletAuthMethodId || authorization.operationCredential.walletSessionId !== identity.walletSessionId || authorization.record.quotaId !== identity.quotaId) return parseWalletSessionAuthorizationBoundary({
 		observation: {
 			kind: "invalid",
-			source,
-			reason: "scope_mismatch"
+			source
 		},
 		nowMs: request.nowMs
 	});
 	if (authorization.record.authorityDigestB64u !== selected.authority.authorityDigestB64u || authorization.record.authorityRevocationEpoch !== selected.authority.revocationEpoch) return parseWalletSessionAuthorizationBoundary({
 		observation: {
 			kind: "invalid",
-			source,
-			reason: "authority_mismatch"
+			source
 		},
 		nowMs: request.nowMs
 	});

package/dist/esm/core/signingEngine/session/persistence/sealedSessionRecords.js

@@ -321,7 +321,6 @@ function classifyRawSealedSessionRecord(raw) {
 	raw = storagePayloadFromSealedStoreRow(raw);
 	const obj = asRecord(raw);
 	if (!obj) return classifyNonCurrentRecord("malformed", null, "invalid_payload");
-	if (obj.kind === "lane_sealed_holder_record_v1") return classifyNonCurrentRecord("unrelated_record", obj, "owned_by_lane_holder_store");
 	if (hasRetiredAuthorizationIdentityField(obj)) return classifyNonCurrentRecord("delete_required", obj, "invalid_identity");
 	if (obj.recordKind === "ecdsa_reauth_anchor_v1") return classifyNonCurrentRecord("delete_required", obj, "invalid_header");
 	if (obj.recordKind === ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND) {
@@ -601,7 +600,6 @@ function inactiveEcdsaSealedMaterialRecord(args) {
 function logSealedSessionClassification(args) {
 	if (args.classification.kind === "ecdsa_inactive_material") return;
 	if (args.classification.kind === "rebuild_required") return;
-	if (args.classification.kind === "unrelated_record") return;
 	const outcome = args.classification.kind === "malformed" ? "malformed" : "rejected";
 	const payload = {
 		operation: args.operation,

package/dist/esm/core/signingEngine/session/postconditions/runtimePostconditions.js

@@ -147,8 +147,6 @@ async function readWalletRuntimePostconditions(args) {
 	return {
 		ok: true,
 		inventory: {
-			walletId,
-			authMethod,
 			...ed25519 ? { ed25519 } : {},
 			ecdsaByTarget
 		}

package/dist/esm/core/signingEngine/session/routerAbSigningWalletSession.js

@@ -13,14 +13,8 @@ function normalizeActiveSessionNowMs(nowMs) {
 	return Number.isSafeInteger(normalized) && normalized >= 0 ? normalized : null;
 }
 function inactiveSigningSessionState(args) {
-	if (args.expiresAtMs <= args.nowMs) return {
-		kind: "expired",
-		expiresAtMs: args.expiresAtMs
-	};
-	if (args.remainingUses <= 0) return {
-		kind: "exhausted",
-		remainingUses: args.remainingUses
-	};
+	if (args.expiresAtMs <= args.nowMs) return { kind: "expired" };
+	if (args.remainingUses <= 0) return { kind: "exhausted" };
 	return null;
 }
 function buildWalletSessionOpaqueAuth(tokenRaw) {

package/dist/esm/core/signingEngine/session/warmCapabilities/readModel.js

@@ -140,17 +140,11 @@ function toSigningSessionStatus(args) {
 * authorization of its own, so without a live Wallet Session there is nothing to
 * seal against and the transport is withheld rather than emitted unauthorized. */
 function resolveEcdsaSealTransport(args) {
-	const walletSessionToken = args.auth?.operationCredential.token || null;
-	if (!walletSessionToken) return null;
-	const relayerUrl = String(args.runtime.relayerUrl || "").trim();
-	if (!relayerUrl) return null;
+	if (!(args.auth?.operationCredential.token || null)) return null;
+	if (!String(args.runtime.relayerUrl || "").trim()) return null;
 	const groupId = String(args.groupId || "").trim();
 	return {
 		curve: "ecdsa",
-		walletId: String(args.runtime.walletId),
-		chainTarget: args.runtime.chainTarget,
-		relayerUrl,
-		walletSessionToken,
 		...args.signingSessionSealKeyVersion ? { signingSessionSealKeyVersion: args.signingSessionSealKeyVersion } : {},
 		...groupId ? { groupId } : {}
 	};

package/dist/esm/core/signingEngine/session/warmCapabilities/routerAbWalletSessionCredential.js

@@ -33,7 +33,6 @@ function requireRouterAbEd25519NormalSigningReadyState(args) {
 	requireNonEmpty(state.signingLane.identity.signer.account.wallet.walletId, "state.signingLane.identity.signer.account.wallet.walletId");
 	requireEqual(requireNonEmpty(args.thresholdKeyMaterial.nearAccountId, "thresholdKeyMaterial.nearAccountId"), nearAccountId, "threshold key accountId");
 	const routerAbState = signingWalletSession.routerAbNormalSigning;
-	const runtimePolicyScope = signingWalletSession.runtimePolicyScope;
 	const walletSessionToken = requireNonEmpty(signingWalletSession.auth.walletSessionToken, "Wallet Session bearer token");
 	const signingRootId = requireNonEmpty(state.signingRootId, "state.signingRootId");
 	const signingRootVersion = requireNonEmpty(state.signingRootVersion, "state.signingRootVersion");
@@ -43,24 +42,14 @@ function requireRouterAbEd25519NormalSigningReadyState(args) {
 	requireEqual(signingWalletSession.signingRootId, signingRootId, "signingRootId");
 	requireEqual(signingWalletSession.signingRootVersion, signingRootVersion, "signingRootVersion");
 	requireEqual(state.routerAbNormalSigning.signingWorkerId, routerAbState.signingWorkerId, "signingWorkerId");
-	const expiresAtMs = requireFutureEpochMs(signingWalletSession.expiresAtMs, "expiresAtMs");
+	requireFutureEpochMs(signingWalletSession.expiresAtMs, "expiresAtMs");
 	const remainingUses = requirePositiveInteger(signingWalletSession.remainingUses, "remainingUses");
 	if (state.remainingUses !== remainingUses) throw new Error("Router A/B Ed25519 normal-signing ready state remainingUses mismatch");
 	return {
 		kind: "router_ab_ed25519_normal_signing_ready_state_v1",
-		walletSessionId,
-		quotaId,
-		thresholdSessionId,
-		nearAccountId,
 		relayerUrl: requireNonEmpty(state.relayerUrl, "relayerUrl"),
-		routerAbNormalSigning: routerAbState,
 		signingWorkerId: requireNonEmpty(routerAbState.signingWorkerId, "signingWorkerId"),
 		signerPublicKey: requireNonEmpty(args.thresholdKeyMaterial.publicKey, "signerPublicKey"),
-		signingRootId,
-		signingRootVersion,
-		remainingUses,
-		expiresAtMs,
-		runtimePolicyScope,
 		credential: {
 			kind: "wallet_session_opaque",
 			walletSessionToken

package/dist/esm/core/signingEngine/session/warmCapabilities/transitions.js

@@ -14,17 +14,13 @@ function summarizeWarmSessionCapabilityTransition(capability) {
 	};
 }
 function summarizeWarmSessionTransition(envelope) {
-	return {
-		walletId: envelope.walletId,
-		capabilities: {
-			ed25519: summarizeWarmSessionCapabilityTransition(envelope.capabilities.ed25519),
-			ecdsa: {
-				evm: summarizeWarmSessionCapabilityTransition(envelope.capabilities.ecdsa.evm),
-				tempo: summarizeWarmSessionCapabilityTransition(envelope.capabilities.ecdsa.tempo)
-			}
-		},
-		updatedAtMs: envelope.updatedAtMs
-	};
+	return { capabilities: {
+		ed25519: summarizeWarmSessionCapabilityTransition(envelope.capabilities.ed25519),
+		ecdsa: {
+			evm: summarizeWarmSessionCapabilityTransition(envelope.capabilities.ecdsa.evm),
+			tempo: summarizeWarmSessionCapabilityTransition(envelope.capabilities.ecdsa.tempo)
+		}
+	} };
 }
 function emitWarmSessionTransition(args) {
 	if (typeof args.onTransition !== "function") return;

package/dist/esm/core/signingEngine/stepUpConfirmation/otpPrompt/authLane.js

@@ -1,4 +1,3 @@
-import "../../../../shared-ts/src/utils/validation.js";
 import { isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import "../../../../shared-ts/src/device-linking/index.js";
 //#region src/core/signingEngine/stepUpConfirmation/otpPrompt/authLane.ts

package/dist/esm/core/signingEngine/stepUpConfirmation/passkeyPrompt/touchIdPrompt.js

@@ -1,10 +1,9 @@
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
-import "../../../../shared-ts/src/utils/encoders.js";
 import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { secureRandomBase36 } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { getPrfFirstSaltV1, getPrfSecondSaltV1, serializeAuthenticationCredentialWithPRF } from "../../webauthnAuth/credentials/helpers.js";
-import { executeWebAuthnWithParentFallbacksSafari } from "../../webauthnAuth/fallbacks/safari-fallbacks.js";
 import { webAuthnPromptCoordinator } from "./webauthnPromptCoordinator.js";
+import { executeWalletOriginWebAuthn } from "../../webauthnAuth/walletOriginWebAuthn.js";
 //#region src/core/signingEngine/stepUpConfirmation/passkeyPrompt/touchIdPrompt.ts
 function resolveRpId(override, host) {
 	return (override || host || "").toLowerCase();
@@ -29,8 +28,8 @@ function requireExpectedPasskeyRegistrationUser(input) {
 * manages WebAuthn touchID prompts,
 * and generates credentials, and PRF Outputs
 */
-var TouchIdPrompt = class TouchIdPrompt {
-	constructor(rpIdOverride, _safariGetWebauthnRegistrationFallback = false) {
+var TouchIdPrompt = class {
+	constructor(rpIdOverride) {
 		this.rpIdOverride = rpIdOverride;
 	}
 	getRpId() {
@@ -40,13 +39,6 @@ var TouchIdPrompt = class TouchIdPrompt {
 			return this.rpIdOverride || "";
 		}
 	}
-	static _inIframe() {
-		try {
-			return window.self !== window.top;
-		} catch {
-			return true;
-		}
-	}
 	/**
 	* Authenticate with a caller-provided 32-byte challenge (base64url string).
 	*
@@ -85,14 +77,8 @@ var TouchIdPrompt = class TouchIdPrompt {
 			transports: credential.transports
 		}));
 		try {
-			const credentialMaybe = await executeWebAuthnWithParentFallbacksSafari("get", publicKey, {
-				rpId,
-				inIframe: TouchIdPrompt._inIframe(),
-				timeoutMs: publicKey.timeout,
-				abortSignal: this.abortController.signal
-			});
-			const serialized = isSerializedAuthenticationCredential(credentialMaybe) ? credentialMaybe : serializeAuthenticationCredentialWithPRF({
-				credential: credentialMaybe,
+			const serialized = serializeAuthenticationCredentialWithPRF({
+				credential: await executeWalletOriginWebAuthn("get", publicKey, { abortSignal: this.abortController.signal }),
 				firstPrfOutput: true,
 				secondPrfOutput: includeSecondPrfOutput
 			});
@@ -197,13 +183,7 @@ var TouchIdPrompt = class TouchIdPrompt {
 			} } }
 		};
 		try {
-			return await executeWebAuthnWithParentFallbacksSafari("create", publicKey, {
-				rpId,
-				inIframe: TouchIdPrompt._inIframe(),
-				registrationOriginPolicy: "wallet_origin_only",
-				timeoutMs: publicKey.timeout,
-				abortSignal: this.abortController.signal
-			});
+			return await executeWalletOriginWebAuthn("create", publicKey, { abortSignal: this.abortController.signal });
 		} finally {
 			this.removePageAbortHandlers?.();
 			this.removePageAbortHandlers = void 0;
@@ -224,10 +204,6 @@ function attachExternalAbortSignal(controller, cancellation) {
 	signal.addEventListener("abort", abort, { once: true });
 	return signal.removeEventListener.bind(signal, "abort", abort);
 }
-function isSerializedAuthenticationCredential(x) {
-	if (!x || typeof x !== "object") return false;
-	return typeof x.response?.authenticatorData === "string";
-}
 function normalizeChallengeB64uForComparison(value) {
 	return String(value || "").trim().replace(/=+$/g, "");
 }

package/dist/esm/core/signingEngine/stepUpConfirmation/passkeyPrompt/webauthnPromptCoordinator.js

@@ -30,9 +30,6 @@ var WebAuthnPromptCoordinator = class {
 		this.reservationExpiryTimer = null;
 		this.consumedReservationIds = /* @__PURE__ */ new Set();
 	}
-	snapshot() {
-		return this.state;
-	}
 	async reserveRegistrationPrompt(args) {
 		this.throwIfReservationCancelled(args.cancellation);
 		if (Date.now() >= args.expiresAtMs) throw new WebAuthnPromptCoordinatorError("webauthn_prompt_reservation_expired", "WebAuthn prompt reservation expired before acquisition");

package/dist/esm/core/signingEngine/stepUpConfirmation/requireStepUpAuth.js

@@ -12,11 +12,7 @@ async function prepareStepUpAuth(args) {
 		authorization: route.authorization
 	};
 	if (route.method === "passkey") {
-		const prompt = await route.runner.prepare({
-			operation: args.operation,
-			selectedLane: args.selectedLane,
-			policy: args.policy
-		});
+		const prompt = await route.runner.prepare();
 		return {
 			method: "passkey",
 			prompt,

package/dist/esm/core/signingEngine/threshold/crypto/ed25519YaoLaneWasm.js

@@ -1,6 +1,3 @@
-import "../../../../shared-ts/src/signing-lanes/rotationDigests.js";
-import "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { executeWorkerOperation } from "../../workerManager/executeWorkerOperation.js";
 //#region src/core/signingEngine/threshold/crypto/ed25519YaoLaneWasm.ts
 function requestJson(value) {

package/dist/esm/core/signingEngine/threshold/ecdsa/bootstrapSession.js

@@ -1,8 +1,8 @@
 import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
-import { computeEcdsaDerivationRoleLocalRelayerKeyId } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { secureRandomId } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { normalizeThresholdRuntimePolicyScope } from "../sessionPolicy.js";
+import { computeEcdsaDerivationRoleLocalRelayerKeyId } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { bytesToHex } from "../../chains/evm/bytes.js";
 import { activateStrictEcdsaPostRegistrationSession, adoptStrictEcdsaCredentialFreePostRegistrationSession, adoptStrictEcdsaPostRegistrationSession, isEcdsaCredentialFreeSessionActivationAuthorization } from "./postRegistrationSessionActivation.js";
 //#region src/core/signingEngine/threshold/ecdsa/bootstrapSession.ts
@@ -64,16 +64,12 @@ async function bootstrapStrictExistingEcdsaSession(args, rpId) {
 		keygenSessionId: String(args.requestId || "").trim() || secureRandomId("tecdsa-keygen", 32, "threshold ECDSA session IDs"),
 		rpId,
 		keyHandle: String(args.keyHandle),
-		ecdsaThresholdKeyId: String(args.key.ecdsaThresholdKeyId),
 		clientVerifyingShareB64u: publicIdentity.derivation_client_share_public_key33_b64u,
 		thresholdEcdsaPublicKeyB64u: publicIdentity.threshold_public_key33_b64u,
 		ethereumAddress: bytesToHex(base64UrlDecode(publicIdentity.ethereum_address20_b64u)),
 		relayerKeyId,
 		relayerVerifyingShareB64u: publicIdentity.server_public_key33_b64u,
-		clientShareRetryCounter: publicIdentity.client_share_retry_counter,
-		relayerShareRetryCounter: publicIdentity.server_share_retry_counter,
 		participantIds: args.key.participantIds.map(Number),
-		chainId: args.lanePolicy.chainTarget.chainId,
 		thresholdSessionId: session.thresholdSessionId,
 		authorizationSessionId: session.authorizationSessionId,
 		authorizationId: session.authorizationId,

package/dist/esm/core/signingEngine/threshold/ed25519/walletSession.js

@@ -9,9 +9,9 @@ import { ROUTER_AB_ED25519_WALLET_SESSION_PATH } from "../../../../shared-ts/src
 import { toRpId } from "../../session/identity/evmFamilyEcdsaIdentity.js";
 import { normalizeThresholdRuntimePolicyScope } from "../sessionPolicy.js";
 import { getPrfFirstB64uFromCredential, redactCredentialExtensionOutputs } from "../../webauthnAuth/credentials/credentialExtensions.js";
-import { buildWebAuthnPrfFirstSecretSource } from "../../../platform/secretSources.js";
 import "../../../../shared-ts/src/device-linking/index.js";
 import { errorMessage } from "../../../../shared-ts/src/utils/errors.js";
+import { buildWebAuthnPrfFirstSecretSource } from "../../../platform/secretSources.js";
 import { parseWalletSessionAlreadyCommittedResponseV1 } from "../../../../shared-ts/src/authorization/walletSessionIssuance.js";
 import "../../../../shared-ts/src/authorization/index.js";
 //#region src/core/signingEngine/threshold/ed25519/walletSession.ts

package/dist/esm/core/signingEngine/threshold/ed25519/yaoClient.js

@@ -75,8 +75,7 @@ function parseRouterAbEd25519YaoClientEmailOtpFactorReleaseV1(value) {
 	return {
 		kind: "email_otp_login_grant",
 		challengeId,
-		loginGrant,
-		expiresAtMs
+		loginGrant
 	};
 }
 function parseRouterAbEd25519YaoClientExportAdmissionEnvelopeV1(value) {
@@ -208,8 +207,6 @@ async function parseHttpResponse(response) {
 	} catch (error) {
 		return {
 			ok: false,
-			code: "invalid_router_response",
-			status: response.status,
 			message: error instanceof Error ? error.message : String(error)
 		};
 	}
@@ -223,8 +220,6 @@ async function parseHttpResponse(response) {
 	}
 	return {
 		ok: false,
-		code: "router_rejected",
-		status: response.status,
 		message: JSON.stringify(value)
 	};
 }
@@ -256,9 +251,6 @@ var RouterAbEd25519YaoHttpActivationTransportV1 = class {
 	constructor(config) {
 		this.config = parseHttpTransportConfig(config);
 	}
-	traceContext() {
-		return this.config.traceContext;
-	}
 	async send(request) {
 		let response;
 		try {
@@ -279,8 +271,6 @@ var RouterAbEd25519YaoHttpActivationTransportV1 = class {
 		} catch (error) {
 			return {
 				ok: false,
-				code: "transport_failed",
-				status: 0,
 				message: error instanceof Error ? error.message : String(error)
 			};
 		}
@@ -450,10 +440,6 @@ var RouterAbEd25519YaoClientV1 = class RouterAbEd25519YaoClientV1 {
 		await __wbg_init();
 		return new RouterAbEd25519YaoClientV1();
 	}
-	static async initialize(moduleOrPath) {
-		await __wbg_init({ module_or_path: moduleOrPath });
-		return new RouterAbEd25519YaoClientV1();
-	}
 	importLocalMaterial(input) {
 		return importVerifiedActiveClient(input);
 	}
@@ -483,38 +469,28 @@ var RouterAbEd25519YaoClientV1 = class RouterAbEd25519YaoClientV1 {
 		} catch (error) {
 			return {
 				ok: false,
-				code: "invalid_router_response",
-				status: 0,
 				message: error instanceof Error ? error.message : String(error)
 			};
 		}
 		if (!exportAdmissionMatchesRequest(args.request, admissionEnvelope.protocol)) return {
 			ok: false,
-			code: "invalid_router_response",
-			status: 0,
 			message: "Router export admission does not match the requested exact capability"
 		};
 		let custodyEnvelope;
 		if (isPasskeyExportSeedInput(args)) {
 			if (admissionEnvelope.kind !== "protocol_only") return {
 				ok: false,
-				code: "invalid_router_response",
-				status: 0,
 				message: "Passkey export admission returned an Email OTP factor release"
 			};
 			custodyEnvelope = args.custodyEnvelope;
 		} else {
 			if (admissionEnvelope.kind !== "protocol_with_factor_release") return {
 				ok: false,
-				code: "invalid_router_response",
-				status: 0,
 				message: "Email OTP export admission did not return the matching factor release"
 			};
 			const factorRelease = admissionEnvelope.factorRelease;
 			if (!factorRelease || factorRelease.challengeId !== args.authorization.challengeId) return {
 				ok: false,
-				code: "invalid_router_response",
-				status: 0,
 				message: "Email OTP export admission did not return the matching factor release"
 			};
 			try {
@@ -522,8 +498,6 @@ var RouterAbEd25519YaoClientV1 = class RouterAbEd25519YaoClientV1 {
 			} catch (error) {
 				return {
 					ok: false,
-					code: "invalid_factor_secret",
-					status: 0,
 					message: error instanceof Error ? error.message : String(error)
 				};
 			}
@@ -541,8 +515,6 @@ var RouterAbEd25519YaoClientV1 = class RouterAbEd25519YaoClientV1 {
 		} catch (error) {
 			return {
 				ok: false,
-				code: "invalid_client_result",
-				status: 0,
 				message: error instanceof Error ? error.message : String(error)
 			};
 		} finally {
@@ -553,8 +525,6 @@ var RouterAbEd25519YaoClientV1 = class RouterAbEd25519YaoClientV1 {
 			const executeRequest = parseRouterAbEd25519YaoExportExecuteRequestV1(JSON.parse(session.execute_request_json()));
 			if (!executeRequest.ok) return {
 				ok: false,
-				code: "invalid_client_result",
-				status: 0,
 				message: executeRequest.message
 			};
 			const executeResponse = await args.transport.send({
@@ -566,8 +536,6 @@ var RouterAbEd25519YaoClientV1 = class RouterAbEd25519YaoClientV1 {
 			const result = parseRouterAbEd25519YaoExportResultV1(executeResponse.value);
 			if (!result.ok) return {
 				ok: false,
-				code: "invalid_router_response",
-				status: 0,
 				message: result.message
 			};
 			const exported = session.complete(JSON.stringify(result.value));
@@ -582,8 +550,6 @@ var RouterAbEd25519YaoClientV1 = class RouterAbEd25519YaoClientV1 {
 		} catch (error) {
 			return {
 				ok: false,
-				code: "invalid_client_result",
-				status: 0,
 				message: error instanceof Error ? error.message : String(error)
 			};
 		} finally {

package/dist/esm/core/signingEngine/threshold/sessionPolicy.js

@@ -1,6 +1,5 @@
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../shared-ts/src/threshold/participants.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";

package/dist/esm/core/signingEngine/uiConfirm/PasskeyMpcSessionDurableState.js

@@ -218,10 +218,7 @@ var PasskeyMpcSessionDurableState = class {
 			code: "invalid_args",
 			message: "Passkey seal persistence requires one exact record purpose"
 		};
-		const singleFlightKey = persistenceSingleFlightKey({
-			thresholdSessionId,
-			transport: args.transport
-		});
+		const singleFlightKey = persistenceSingleFlightKey({ transport: args.transport });
 		const inFlight = signingSessionSealPersistSingleFlight.get(singleFlightKey);
 		if (inFlight) return await inFlight;
 		let persistTask;

package/dist/esm/core/signingEngine/uiConfirm/PasskeyMpcSessionManager.js

@@ -3,11 +3,11 @@ import { thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual, toWallet
 import { parseSigningSessionSealKeyVersion } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { walletSessionAuthorizations } from "../../indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-import { IndexedDBManager } from "../../indexedDB/index.js";
 import { resolveThresholdCommitQueueKey } from "../threshold/commitQueueShared.js";
 import { materialActivationKey } from "../session/sealedRecovery/materialActivationKey.js";
 import { createDeleteDurableSealedSessionCommand } from "../session/persistence/durableSealedSessionCommands.js";
 import { acquireSigningSessionRestoreLease, deleteDurableSealedSessionRecord, listExactSealedSessionsForWallet, releaseSigningSessionRestoreLease } from "../session/persistence/sealedSessionStore.js";
+import { IndexedDBManager } from "../../indexedDB/index.js";
 import { withThresholdEcdsaSigningQueue } from "../threshold/ecdsa/signingQueue.js";
 import { parseUserConfirmWorkerResponse } from "../../types/secure-confirm-worker.js";
 import BUILD_PATHS from "../../../build-paths.js";

package/dist/esm/core/signingEngine/uiConfirm/UiConfirmManager.js

@@ -82,7 +82,6 @@ var UiConfirmWorkerManagerImpl = class {
 			workerUrl: BUILD_PATHS.RUNTIME.TOUCH_CONFIRM_WORKER,
 			workerTimeout: 6e4,
 			debug: false,
-			signingSessionPersistenceMode: "none",
 			...config
 		};
 		this.context = { ...context };