@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/core/rpcClients/relayer/walletSessionAuthorizationStatus.js

@@ -1,34 +1,165 @@
 import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildRelayerJsonPostRequestInit, buildWalletSessionAuthorizationHeaders, normalizeRelayerBaseUrl } from "./relayerHttp.js";
 import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
-import { buildBearerAuthorizationHeader, buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
 //#region src/core/rpcClients/relayer/walletSessionAuthorizationStatus.ts
 const EXACT_WALLET_SESSION_STATUS_PATH = "/wallet/session/status";
 const defaultStatusFetch = (input, init) => globalThis.fetch(input, init);
+const observationsByFetch = /* @__PURE__ */ new WeakMap();
+let observationSequence = 0;
+const registrationSessions = /* @__PURE__ */ new Map();
+/** Every key of one credential starts with this, so a credential's entries can be found. */
+function statusCredentialKey(token) {
+	return JSON.stringify([token]);
+}
+function statusIdentityKey(options, identity) {
+	return statusCredentialKey(options.operationCredential.token) + JSON.stringify([
+		normalizeRelayerBaseUrl(options.relayerUrl),
+		identity.walletSessionId,
+		identity.quotaId
+	]);
+}
+function recordStatusObservation(fetchImpl, key, sequence, status) {
+	let observations = observationsByFetch.get(fetchImpl);
+	if (!observations) {
+		observations = /* @__PURE__ */ new Map();
+		observationsByFetch.set(fetchImpl, observations);
+	}
+	const previous = observations.get(key);
+	if (previous && previous.sequence > sequence) return status;
+	registrationSessions.delete(key);
+	observations.delete(key);
+	observations.set(key, {
+		kind: "local_wallet_session_observation",
+		sequence,
+		status
+	});
+	if (observations.size > 32) {
+		const oldest = observations.keys().next();
+		if (!oldest.done) observations.delete(oldest.value);
+	}
+	return status;
+}
+/** Prepare reports the quota it admitted against, then claims one use of it.
+* The next operation plans against what that claim left. */
+function statusAfterPrepareClaim(status) {
+	const remainingUses = status.remainingUses - 1;
+	if (remainingUses > 0) return {
+		...status,
+		remainingUses
+	};
+	return {
+		...status,
+		status: "exhausted",
+		remainingUses: 0,
+		quotaLifecycle: "exhausted"
+	};
+}
 /** One operation owns this snapshot; subsequent operations create a new scope. */
-var WalletSessionStatusReadScope = class {
+var WalletSessionStatusReadScope = class WalletSessionStatusReadScope {
 	constructor() {
 		this.readsByFetch = /* @__PURE__ */ new Map();
+		this.suppliedStatus = { kind: "remote" };
+	}
+	static fromPrepare(options, status) {
+		const scope = new WalletSessionStatusReadScope();
+		scope.suppliedStatus = {
+			kind: "server_response",
+			key: statusIdentityKey(options, status),
+			status,
+			observation: statusAfterPrepareClaim(status)
+		};
+		return scope;
+	}
+	/** Initial prefill uses the issued response. Each refill request still verifies
+	* current server authorization before it generates or admits material. */
+	static fromRegistration(relayerUrl, session) {
+		const status = registrationSessionStatus(session);
+		const scope = new WalletSessionStatusReadScope();
+		scope.suppliedStatus = {
+			kind: "server_response",
+			key: statusIdentityKey({
+				relayerUrl,
+				operationCredential: session.operationCredential
+			}, status),
+			status,
+			observation: status
+		};
+		return scope;
+	}
+	/**
+	* A NEAR-only registration's finalize response states the session the server
+	* issued as its last step. The wallet host's next observation of this exact
+	* session reads it from the response; asking the server would repeat it.
+	* An ECDSA registration keeps changing its session after it is issued, so
+	* that path observes the server.
+	*/
+	static acceptRegistrationSession(relayerUrl, session) {
+		const status = registrationSessionStatus(session);
+		registrationSessions.set(statusIdentityKey({
+			relayerUrl,
+			operationCredential: session.operationCredential
+		}, status), status);
+		if (registrationSessions.size > 8) {
+			const oldest = registrationSessions.keys().next();
+			if (!oldest.done) registrationSessions.delete(oldest.value);
+		}
+	}
+	/** One wallet-host observation. It reads a session that a registration response
+	* issued once; every other read, and every explicit session query, asks the server. */
+	static forHostObservation() {
+		const scope = new WalletSessionStatusReadScope();
+		scope.suppliedStatus = { kind: "host_observation" };
+		return scope;
+	}
+	/**
+	* The server refused an operation under this credential's session and asked
+	* for step-up. What the wallet holds about that session no longer plans a
+	* confirmation, so the next plan reads the server. Signing requests use the
+	* default fetch, and so do the observations they contradict.
+	*/
+	static forgetCredential(token) {
+		const credentialKey = statusCredentialKey(token);
+		for (const sessions of [observationsByFetch.get(defaultStatusFetch), registrationSessions]) {
+			if (!sessions) continue;
+			for (const key of [...sessions.keys()]) if (key.startsWith(credentialKey)) sessions.delete(key);
+		}
+	}
+	static observationForConfirmation(options, identity) {
+		return observationsByFetch.get(options.fetchImpl ?? defaultStatusFetch)?.get(statusIdentityKey(options, identity)) ?? null;
 	}
 	read(options, identity) {
+		if (this.suppliedStatus.kind === "server_response") {
+			if (this.suppliedStatus.key !== statusIdentityKey(options, identity)) throw new Error("Wallet Session response identity changed before reconciliation");
+			recordStatusObservation(options.fetchImpl ?? defaultStatusFetch, this.suppliedStatus.key, ++observationSequence, this.suppliedStatus.observation);
+			return Promise.resolve(this.suppliedStatus.status);
+		}
 		const fetchImpl = options.fetchImpl ?? defaultStatusFetch;
 		let reads = this.readsByFetch.get(fetchImpl);
 		if (!reads) {
 			reads = /* @__PURE__ */ new Map();
 			this.readsByFetch.set(fetchImpl, reads);
 		}
-		const key = JSON.stringify([
-			normalizeRelayerBaseUrl(options.relayerUrl),
-			options.operationCredential.token,
-			identity.walletSessionId,
-			identity.quotaId
-		]);
+		const key = statusIdentityKey(options, identity);
 		const existing = reads.get(key);
 		if (existing) return existing;
-		const pending = createRelayerExactWalletSessionStatusPort(options).read(identity);
+		const sequence = ++observationSequence;
+		const issued = this.suppliedStatus.kind === "host_observation" ? registrationSessions.get(key) : void 0;
+		const pending = issued ? Promise.resolve(recordStatusObservation(fetchImpl, key, sequence, issued)) : createRelayerExactWalletSessionStatusPort(options).read(identity).then(recordStatusObservation.bind(null, fetchImpl, key, sequence));
 		reads.set(key, pending);
 		return pending;
 	}
 };
+function registrationSessionStatus(session) {
+	return {
+		status: "active",
+		walletSessionId: session.walletSessionId,
+		quotaId: session.quotaId,
+		remainingUses: session.remainingUses,
+		expiresAtMs: session.expiresAtMs,
+		quotaLifecycle: "active",
+		authorization: session.walletSession
+	};
+}
 const OBSERVED_FIELDS = [
 	"ok",
 	"status",
@@ -131,6 +262,9 @@ function parseObservedStatusFacts(value, identity) {
 		authorization
 	};
 }
+function parseExactWalletSessionStatusResponse(value, expected) {
+	return parseDecodedWalletSessionStatusResponse(decodeWalletSessionStatusResponse(value), expected);
+}
 function parseDecodedWalletSessionStatusResponse(value, expected) {
 	if (value.kind === "error") return null;
 	const identity = parseIdentity(value, expected);
@@ -188,10 +322,7 @@ var RelayerExactWalletSessionStatusPort = class {
 					walletSessionId: input.walletSessionId,
 					quotaId: input.quotaId
 				},
-				headers: buildBearerAuthorizationHeader({
-					token: this.operationCredential.token,
-					missingMessage: "Wallet Session token is required for Wallet Session status"
-				})
+				headers: buildWalletSessionAuthorizationHeaders(this.operationCredential)
 			}),
 			credentials: "omit"
 		});
@@ -209,6 +340,6 @@ function createRelayerExactWalletSessionStatusPort(options) {
 	return new RelayerExactWalletSessionStatusPort(options);
 }
 //#endregion
-export { WalletSessionStatusReadScope, createRelayerExactWalletSessionStatusPort };
+export { WalletSessionStatusReadScope, parseExactWalletSessionStatusResponse };
 
 //# sourceMappingURL=walletSessionAuthorizationStatus.js.map

package/dist/esm/core/signingEngine/chains/evm/bytes.js

@@ -1,22 +1,8 @@
 //#region src/core/signingEngine/chains/evm/bytes.ts
-function hexToBytes(hex) {
-	const raw = String(hex || "");
-	const normalized = raw.startsWith("0x") ? raw.slice(2) : raw;
-	if (normalized.length === 0) return new Uint8Array();
-	if (normalized.length % 2 !== 0) throw new Error(`Invalid hex (odd length): ${hex}`);
-	const bytes = new Uint8Array(normalized.length / 2);
-	for (let i = 0; i < bytes.length; i++) {
-		const byte = normalized.slice(i * 2, i * 2 + 2);
-		const value = Number.parseInt(byte, 16);
-		if (!Number.isFinite(value)) throw new Error(`Invalid hex: ${hex}`);
-		bytes[i] = value;
-	}
-	return bytes;
-}
 function bytesToHex(bytes) {
 	return `0x${Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("")}`;
 }
 //#endregion
-export { bytesToHex, hexToBytes };
+export { bytesToHex };
 
 //# sourceMappingURL=bytes.js.map

package/dist/esm/core/signingEngine/chains/evm/evmAdapter.js

@@ -1,5 +1,5 @@
-import { bytesToHex } from "./bytes.js";
 import { computeEip1559TxHashWasm, encodeEip1559SignedTxFromSignature65Wasm } from "./evmCryptoWasm.js";
+import { bytesToHex } from "./bytes.js";
 //#region src/core/signingEngine/chains/evm/evmAdapter.ts
 var EvmAdapter = class {
 	constructor(workerCtx) {

package/dist/esm/core/signingEngine/chains/near/display.js

@@ -203,32 +203,6 @@ function buildNearDisplayModel(args) {
 		} } : {}
 	};
 }
-function buildNearMessageDisplayModel(args) {
-	const operation = {
-		id: "near.message",
-		kind: "near.message",
-		label: "Message signature",
-		fields: [
-			makeField("Signer", args.signerAccount, args.signerAccount),
-			makeField("Recipient", args.recipient, args.recipient),
-			{
-				label: "Message",
-				value: args.message,
-				copyValue: args.message,
-				renderAs: "file-content",
-				hideChevron: true
-			}
-		].filter(Boolean)
-	};
-	return {
-		chain: "near",
-		intentDigest: args.intentDigest,
-		signerAccount: args.signerAccount,
-		title: args.title || "NEP-413 message",
-		subtitle: args.subtitle,
-		operations: [operation]
-	};
-}
 function buildNearPreparationDisplayModel(args) {
 	try {
 		return buildNearDisplayModel(args);
@@ -243,6 +217,6 @@ function buildNearPreparationDisplayModel(args) {
 	}
 }
 //#endregion
-export { buildNearDisplayModel, buildNearMessageDisplayModel, buildNearPreparationDisplayModel };
+export { buildNearPreparationDisplayModel };
 
 //# sourceMappingURL=display.js.map

package/dist/esm/core/signingEngine/chains/near/nearSignerWasm.js

@@ -1,5 +1,5 @@
-import { executeWorkerOperation } from "../../workerManager/executeWorkerOperation.js";
 import { NearSignerWorkerCustomRequestType } from "../../../types/signer-worker.js";
+import { executeWorkerOperation } from "../../workerManager/executeWorkerOperation.js";
 //#region src/core/signingEngine/chains/near/nearSignerWasm.ts
 const NEAR_SIGNER_WORKER_TIMEOUT_MS = 2e4;
 async function computeThresholdEd25519Nep413SigningDigestWasm(args) {
@@ -13,7 +13,7 @@ async function computeThresholdEd25519Nep413SigningDigestWasm(args) {
 				message: args.message,
 				recipient: args.recipient,
 				nonce: args.nonce,
-				...args.state ? { state: args.state } : {}
+				callbackUrl: args.callbackUrl
 			}
 		}
 	}));

package/dist/esm/core/signingEngine/flows/registration/accountLifecycle.js

@@ -1,17 +1,17 @@
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { thresholdEcdsaChainTargetKey, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { compactImplicitNearAccountId } from "../../../../shared-ts/src/utils/near.js";
 import { toAccountId } from "../../../types/accountIds.js";
 import { SIGNER_AUTH_METHODS, SIGNER_KINDS, SIGNER_SOURCES } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { nearEd25519SigningKeyIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { thresholdEcdsaChainTargetKey, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { parseSignerSlot } from "../../../../shared-ts/src/utils/signerSlot.js";
-import { buildNearAccountRefs, inferNearChainIdKey } from "../../../accountData/near/accountRefs.js";
-import { resolveProfileAccountContextFromCandidates, resolveProfileAccountProjection } from "../../../indexedDB/profileAccountProjection.js";
-import { buildWalletCustodyEd25519MaterialRecordV1 } from "../../../indexedDB/walletCustodyEd25519MaterialRecord.js";
+import { normalizeIndexedDbAccountAddress, toIndexedDbChainTargetKey } from "../../../indexedDB/normalization.js";
 import { buildNearProfileId, parseNearAccountProjectionProfileId } from "../../../accountData/near/profileId.js";
 import { NEAR_ED25519_YAO_KEY_VERSION_V1 } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
-import { normalizeIndexedDbAccountAddress, toIndexedDbChainTargetKey } from "../../../indexedDB/normalization.js";
+import { resolveProfileAccountContextFromCandidates, resolveProfileAccountProjection } from "../../../indexedDB/profileAccountProjection.js";
+import { buildNearAccountRefs, inferNearChainIdKey } from "../../../accountData/near/accountRefs.js";
+import { buildWalletCustodyEd25519MaterialRecordV1 } from "../../../indexedDB/walletCustodyEd25519MaterialRecord.js";
 import { getLastSelectedNearAccountProjection, getNearAccountProjection, listNearAccountProjections } from "../../../accountData/near/accountProjection.js";
 //#region src/core/signingEngine/flows/registration/accountLifecycle.ts
 const WALLET_SUBJECT_CHAIN_ID_KEY = "wallet";
@@ -582,30 +582,6 @@ function storedRegistrationResult(result, ecdsaActivations) {
 		storedSigners
 	};
 }
-function prepareWalletEd25519RegistrationPublication(args) {
-	return buildWalletEd25519RegistrationPublication(prepareWalletEd25519RegistrationBatch(args, { kind: "fresh_registration" }, { kind: "near_ed25519_only" }), args, args.participantIds, [args.custodyMaterial]);
-}
-function prepareWalletEd25519RegistrationProjectionPublication(args) {
-	const credentialId = String(args.credentialIdB64u || "").trim();
-	if (!credentialId) throw new Error("SeamsWalletDB: registration credential projection id is required");
-	return buildWalletEd25519RegistrationPublication(prepareWalletEd25519RegistrationBatchFromFacts({
-		walletId: args.walletId,
-		nearAccountId: args.nearAccountId,
-		nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
-		rpId: args.rpId,
-		signerSlot: args.signerSlot,
-		operationalPublicKey: args.operationalPublicKey,
-		relayerKeyId: args.relayerKeyId,
-		keyVersion: args.keyVersion,
-		participantIds: args.participantIds,
-		credentialFacts: {
-			credentialId,
-			credentialDisplayId: credentialId,
-			credentialPublicKey: verifiedCredentialPublicKeyBytes(args.credentialPublicKeyB64u, "credentialPublicKeyB64u"),
-			transports: [...args.transports]
-		}
-	}, { kind: "fresh_registration" }, { kind: "near_ed25519_only" }), args, args.participantIds, [args.custodyMaterial]);
-}
 function buildWalletEd25519RegistrationPublication(prepared, identity, participantIds, materials) {
 	const nearAccountId = toAccountId(identity.nearAccountId);
 	const custodyMaterials = materials.map((material) => {
@@ -785,12 +761,6 @@ async function storeWalletEd25519RegistrationDataWithMode(deps, args, mode, comp
 async function storeWalletEd25519RegistrationData(deps, args) {
 	return { signerSlot: (await storeWalletEd25519RegistrationDataWithMode(deps, args, { kind: "fresh_registration" }, { kind: "near_ed25519_only" })).signerSlot };
 }
-async function storeWalletMixedRegistrationData(deps, args) {
-	return await storeWalletEd25519RegistrationDataWithMode(deps, args, { kind: "fresh_registration" }, {
-		kind: "near_ed25519_and_evm_family_ecdsa",
-		walletKeys: args.walletKeys
-	});
-}
 async function storeWalletEd25519RecoveryRegistrationData(deps, args) {
 	return { signerSlot: (await storeWalletEd25519RegistrationDataWithMode(deps, args, { kind: "wallet_recovery_replacement" }, { kind: "near_ed25519_only" })).signerSlot };
 }
@@ -850,9 +820,6 @@ async function storeWalletEmailOtpEd25519RegistrationDataWithComposition(deps, a
 		storedSigners
 	};
 }
-async function prepareWalletEmailOtpEd25519RegistrationPublication(args) {
-	return buildWalletEd25519RegistrationPublication(await prepareWalletEmailOtpEd25519RegistrationBatch(args, { kind: "near_ed25519_only" }), args, args.participantIds, [args.custodyMaterial]);
-}
 async function storeWalletEmailOtpEd25519RegistrationData(deps, args) {
 	return { signerSlot: (await storeWalletEmailOtpEd25519RegistrationDataWithComposition(deps, args, { kind: "near_ed25519_only" })).signerSlot };
 }
@@ -1088,6 +1055,6 @@ async function storeWalletEmailOtpEcdsaRegistrationData(deps, args) {
 	}) };
 }
 //#endregion
-export { activateAuthenticatedWalletState, finalizeWalletEcdsaRegistration, finalizeWalletEd25519SignerRegistration, getAllUsers, getLastUser, getUserBySignerSlot, getWalletNearProvisioningState, hasPasskeyCredential, nearAuthenticatorsByAccount, prepareWalletEcdsaRegistrationPublication, prepareWalletEd25519RegistrationProjectionPublication, prepareWalletEd25519RegistrationPublication, prepareWalletEmailOtpEd25519RegistrationPublication, prepareWalletRecoveryEmailOtpPublication, prepareWalletRecoveryPasskeyPublication, rollbackUserRegistration, rollbackWalletEd25519SignerRegistration, setLastUser, setWalletNearProvisioningState, storeAuthenticator, storeUserData, storeWalletEcdsaRecoverySignerRecords, storeWalletEcdsaSignerRecords, storeWalletEd25519RecoveryRegistrationData, storeWalletEd25519RegistrationData, storeWalletEmailOtpEcdsaRegistrationData, storeWalletEmailOtpEcdsaSignerRecords, storeWalletEmailOtpEd25519RegistrationData, storeWalletEmailOtpMixedRegistrationData, storeWalletMixedRegistrationData };
+export { activateAuthenticatedWalletState, finalizeWalletEcdsaRegistration, finalizeWalletEd25519SignerRegistration, getAllUsers, getLastUser, getUserBySignerSlot, getWalletNearProvisioningState, hasPasskeyCredential, nearAuthenticatorsByAccount, prepareWalletRecoveryEmailOtpPublication, prepareWalletRecoveryPasskeyPublication, rollbackUserRegistration, rollbackWalletEd25519SignerRegistration, setLastUser, setWalletNearProvisioningState, storeAuthenticator, storeUserData, storeWalletEcdsaRecoverySignerRecords, storeWalletEcdsaSignerRecords, storeWalletEd25519RecoveryRegistrationData, storeWalletEd25519RegistrationData, storeWalletEmailOtpEcdsaRegistrationData, storeWalletEmailOtpEcdsaSignerRecords, storeWalletEmailOtpEd25519RegistrationData, storeWalletEmailOtpMixedRegistrationData };
 
 //# sourceMappingURL=accountLifecycle.js.map

package/dist/esm/core/signingEngine/flows/shared/signingConfirmation.js

@@ -1,8 +1,8 @@
+import { isUserCancellationError } from "../../../../shared-ts/src/utils/errors.js";
+import { secureRandomId } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { SigningEventPhase } from "../../../types/sdkSentEvents.js";
 import { signingLaneAuthMethod } from "../../session/identity/signingLaneAuthBinding.js";
 import { SigningKeyRefIntentKind, SigningSessionPlanKind } from "../../session/operationState/types.js";
-import { secureRandomId } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { isUserCancellationError } from "../../../../shared-ts/src/utils/errors.js";
 import { SigningAuthPlanKind } from "../../stepUpConfirmation/types.js";
 import { SigningOperationCancellationPhase, SigningOperationCommandKind, applySigningOperationInteractionEvent, cancelSigningOperation, planSigningOperationAttempt, runSigningOperationCommand } from "./signingStateMachine.js";
 import { confirmSigningOperation } from "../../stepUpConfirmation/confirmOperation.js";

package/dist/esm/core/signingEngine/flows/shared/signingStateMachine.js

@@ -206,13 +206,6 @@ function cancelSigningOperation(stateRef) {
 	stateRef.current = cancelled;
 	return cancelled;
 }
-function isSigningOperationReviewApprovedStateKind(kind) {
-	switch (kind) {
-		case SigningOperationStateKind.Planned: return false;
-		case SigningOperationStateKind.ConfirmationApproved: return true;
-		default: return assertNeverSigningOperationStateKind(kind);
-	}
-}
 function isSigningOperationReviewApprovedState(state) {
 	switch (state.kind) {
 		case SigningOperationStateKind.Created:
@@ -473,10 +466,7 @@ function assertNeverSigningOperationState(value) {
 function assertNeverSigningOperationInteractionEvent(value) {
 	throw new Error(`[SigningOperationMachine] unsupported interaction event: ${String(value)}`);
 }
-function assertNeverSigningOperationStateKind(value) {
-	throw new Error(`Unsupported signing operation state kind: ${String(value)}`);
-}
 //#endregion
-export { SigningOperationCancellationPhase, SigningOperationCommandKind, SigningOperationInteractionEventKind, applySigningOperationInteractionEvent, buildSigningOperationCommandSteps, cancelSigningOperation, createSigningOperationPlan, createSigningOperationStateRef, isSigningOperationReviewApprovedState, isSigningOperationReviewApprovedStateKind, planSigningOperationAttempt, runSigningOperationCommand, runSigningOperationCommandSteps, runUnplannedSigningOperationCommandSequence };
+export { SigningOperationCancellationPhase, SigningOperationCommandKind, applySigningOperationInteractionEvent, buildSigningOperationCommandSteps, cancelSigningOperation, createSigningOperationPlan, createSigningOperationStateRef, isSigningOperationReviewApprovedState, planSigningOperationAttempt, runSigningOperationCommand, runSigningOperationCommandSteps, runUnplannedSigningOperationCommandSequence };
 
 //# sourceMappingURL=signingStateMachine.js.map

package/dist/esm/core/signingEngine/flows/signEvmFamily/authPlanning.js

@@ -1,8 +1,8 @@
-import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
+import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { signingLaneAuthMethod } from "../../session/identity/signingLaneAuthBinding.js";
 import { SigningOperationIntent, SigningSessionPlanKind } from "../../session/operationState/types.js";
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { SigningAuthPlanKind } from "../../stepUpConfirmation/types.js";
 import { signingAuthPlanFromSigningSessionPlan } from "../shared/signingConfirmation.js";
 import { createEmailOtpEcdsaTransactionSigningBridge, emailOtpEcdsaCapabilityStepUpAuthority } from "./emailOtpSigningSession.js";

package/dist/esm/core/signingEngine/flows/signEvmFamily/ecdsaSelection.js

@@ -1,11 +1,11 @@
-import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
-import { exactEcdsaSigningLaneIdentityFromSelectedLane } from "../../session/identity/exactSigningLaneIdentity.js";
 import { isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
+import { exactEcdsaSigningLaneIdentityFromSelectedLane } from "../../session/identity/exactSigningLaneIdentity.js";
 import { laneCandidateAuthMethod } from "../../session/identity/laneIdentity.js";
-import { buildEvmTransactionSigningLane, buildTempoTransactionSigningLane } from "../../session/operationState/lanes.js";
 import { logEvmFamilyEcdsaLaneDiagnostic, requireResolvedEvmFamilyEcdsaSigningLane, summarizeEvmFamilyEcdsaLane } from "./ecdsaLanes.js";
 import { resolveEvmFamilyTransactionWalletAuth } from "./accountAuth.js";
+import { buildEvmTransactionSigningLane, buildTempoTransactionSigningLane } from "../../session/operationState/lanes.js";
 import { emailOtpEcdsaSigningSessionAuthLane } from "../../session/emailOtp/ecdsaSigningSessionAuthority.js";
 //#region src/core/signingEngine/flows/signEvmFamily/ecdsaSelection.ts
 function ecdsaLaneCandidateAuthMethod(candidate) {

package/dist/esm/core/signingEngine/flows/signEvmFamily/emailOtpSigningSession.js

@@ -1,15 +1,9 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { isEmailOtpWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { SigningEventPhase } from "../../../types/sdkSentEvents.js";
-import { buildVerifiedEcdsaPublicFacts, toEvmFamilyEcdsaKeyHandle } from "../../session/identity/evmFamilyEcdsaIdentity.js";
-import { isEmailOtpWalletAuthAuthority, walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { createSigningBoundaryTraceEvent, emitSigningBoundaryTrace } from "../../session/operationState/trace.js";
-import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
 import { demoEmailOtpCodeFromDelivery } from "../../session/emailOtp/challengeDelivery.js";
-import { buildEmailOtpRoutePlan } from "../../stepUpConfirmation/otpPrompt/authLane.js";
-import { emailOtpEcdsaSigningSessionAuthLane, resolveExactEmailOtpEcdsaSigningSessionAuthority } from "../../session/emailOtp/ecdsaSigningSessionAuthority.js";
+import { createSigningBoundaryTraceEvent, emitSigningBoundaryTrace } from "../../session/operationState/trace.js";
 import { emitEvmFamilySigningEvent } from "./events.js";
-import { throwEmailOtpSigningSessionAuthStateError } from "../../session/emailOtp/routePlan.js";
 //#region src/core/signingEngine/flows/signEvmFamily/emailOtpSigningSession.ts
 /** The capability is the authority. Anything the caller or the confirmation
 * plan supplies must agree with it exactly, or the OTP would be sent to a
@@ -94,134 +88,7 @@ function createEmailOtpEcdsaTransactionSigningBridge(args) {
 		};
 	} };
 }
-/** Canonical Email OTP signing-session resolution: the manifest proves exact
-* material, the sealed runtime supplies session-scoped facts and the Email OTP
-* binding, and the reusable Wallet Session is resolved independently. Refresh
-* must land on the same material activation it started from, so the caller
-* checks that before and after; nothing here invokes Yao recovery or device
-* linking. */
-async function resolveEmailOtpEcdsaSigningSessionAuth(args, authorityPorts) {
-	const resolved = await authorityPorts.resolveActiveEcdsaCapabilityRuntime({
-		walletId: args.walletId,
-		chainTarget: args.chainTarget
-	});
-	if (resolved.kind !== "resolved") throwEmailOtpSigningSessionAuthStateError({
-		kind: "auth_lane_missing",
-		source: "evm_signing_refresh",
-		expectedCurve: "ecdsa"
-	});
-	const authority = await resolveExactEmailOtpEcdsaSigningSessionAuthority(authorityPorts, {
-		walletId: args.walletId,
-		chainTarget: args.chainTarget,
-		manifest: resolved.manifest,
-		runtime: resolved.runtime
-	});
-	if (!authority) throwEmailOtpSigningSessionAuthStateError({
-		kind: "auth_lane_missing",
-		source: "evm_signing_refresh",
-		expectedCurve: "ecdsa"
-	});
-	return {
-		manifest: resolved.manifest,
-		runtime: resolved.runtime,
-		authority
-	};
-}
-async function requestEmailOtpSigningSessionChallenge(deps, args) {
-	const { authority } = await deps.resolveSigningSessionAuth({
-		walletId: args.walletSession.walletId,
-		chainTarget: args.chainTarget
-	});
-	return await deps.emailOtpSessions.requestTransactionSigningChallenge({
-		kind: "wallet_session_challenge",
-		walletSession: args.walletSession,
-		chain: args.chainTarget.kind,
-		authLane: emailOtpEcdsaSigningSessionAuthLane(authority)
-	});
-}
-async function resolveFencedEmailOtpSigningSessionAuth(input) {
-	let current;
-	try {
-		current = await input.deps.resolveSigningSessionAuth({
-			walletId: input.args.walletSession.walletId,
-			chainTarget: input.args.chainTarget
-		});
-	} catch {
-		throw new Error(`[SigningEngine][ecdsa] Email OTP signing-session refresh material was superseded ${input.phase}`);
-	}
-	if (!mpcMaterialActivationRefsEqual(current.runtime.materialActivation, input.activationBeforeRefresh)) throw new Error(`[SigningEngine][ecdsa] Email OTP signing-session refresh material was superseded ${input.phase}`);
-	return current;
-}
-async function runFencedEmailOtpSigningSessionRefresh(input) {
-	const { manifest, runtime, authority } = await resolveFencedEmailOtpSigningSessionAuth({
-		deps: input.deps,
-		args: input.args,
-		activationBeforeRefresh: input.activationBeforeRefresh,
-		phase: "before use"
-	});
-	const routePlan = buildEmailOtpRoutePlan({
-		routeFamily: "signing_session",
-		authLane: emailOtpEcdsaSigningSessionAuthLane(authority),
-		operation: WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION
-	});
-	const publicFacts = buildVerifiedEcdsaPublicFacts({
-		keyHandle: toEvmFamilyEcdsaKeyHandle(String(manifest.durableMaterial.roleLocalPublicFacts.keyHandle)),
-		publicKeyB64u: runtime.thresholdEcdsaPublicKeyB64u,
-		participantIds: [...runtime.participantIds],
-		thresholdOwnerAddress: manifest.durableMaterial.roleLocalPublicFacts.ethereumAddress
-	});
-	const emailOtpBinding = runtime.authBinding;
-	if (emailOtpBinding.kind !== "email_otp") throw new Error("Email OTP signing-session refresh requires an Email OTP sealed runtime");
-	const refreshed = await input.deps.emailOtpSessions.loginWithEcdsaCapabilityInternal({
-		walletSession: input.args.walletSession,
-		authoritySelector: {
-			kind: "wallet_auth_method",
-			walletAuthMethodId: String((await walletAuthAuthorityRef({ authority: emailOtpBinding.emailOtpAuthority })).walletAuthMethodId)
-		},
-		chainTarget: input.args.chainTarget,
-		emailOtpAuthPolicy: "session",
-		emailOtpAuthReason: "sign",
-		challengeId: input.args.challengeId,
-		otpCode: input.args.otpCode,
-		operation: WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION,
-		routePlan,
-		publicFacts,
-		ecdsaBootstrapAuthorization: { kind: "route_plan_auth" },
-		providerIdentity: {
-			kind: "explicit_provider_user",
-			provider: emailOtpBinding.emailOtpAuthority.factor.provider,
-			providerUserId: emailOtpBinding.providerSubjectId
-		},
-		emailHashHex: emailOtpBinding.emailHashHex,
-		...typeof input.args.ttlMs === "number" ? { ttlMs: input.args.ttlMs } : {},
-		...typeof input.args.remainingUses === "number" ? { remainingUses: input.args.remainingUses } : {},
-		...runtime.runtimePolicyScope ? { runtimePolicyScope: runtime.runtimePolicyScope } : {}
-	});
-	await resolveFencedEmailOtpSigningSessionAuth({
-		deps: input.deps,
-		args: input.args,
-		activationBeforeRefresh: input.activationBeforeRefresh,
-		phase: "during refresh"
-	});
-	return refreshed;
-}
-async function refreshEmailOtpSigningSession(deps, args) {
-	const activationBeforeRefresh = (await deps.resolveSigningSessionAuth({
-		walletId: args.walletSession.walletId,
-		chainTarget: args.chainTarget
-	})).runtime.materialActivation;
-	return await deps.withThresholdEcdsaSigningQueue({
-		queueKey: resolveThresholdCommitQueueKey({ materialActivation: activationBeforeRefresh }),
-		walletId: args.walletSession.walletId,
-		enabled: true,
-		task: runFencedEmailOtpSigningSessionRefresh.bind(void 0, {
-			deps,
-			args,
-			activationBeforeRefresh
-		})
-	});
-}
 //#endregion
-export { createEmailOtpEcdsaTransactionSigningBridge, emailOtpEcdsaCapabilityStepUpAuthority, refreshEmailOtpSigningSession, requestEmailOtpSigningSessionChallenge, resolveEmailOtpEcdsaSigningSessionAuth };
+export { createEmailOtpEcdsaTransactionSigningBridge, emailOtpEcdsaCapabilityStepUpAuthority };
 
 //# sourceMappingURL=emailOtpSigningSession.js.map

package/dist/esm/core/signingEngine/flows/signEvmFamily/freshWalletSessionRetry.js

@@ -1,8 +1,8 @@
 import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { SIGNING_SESSION_EXPIRY_DETECTION_SOURCES, SigningEventPhase } from "../../../types/sdkSentEvents.js";
+import { emitEvmFamilySigningEvent } from "./events.js";
 import { walletSessionFailureFromError } from "../../session/lifecycle/walletSessionFailure.js";
 import { requireAuthoritativeExpiredWalletSessionAuthorizationBoundary } from "../../session/identity/clientSessionPersistenceState.js";
-import { emitEvmFamilySigningEvent } from "./events.js";
 import { classifyEvmFamilyFreshAuthRetry } from "./freshAuthRetryPolicy.js";
 //#region src/core/signingEngine/flows/signEvmFamily/freshWalletSessionRetry.ts
 function resolveEvmFamilyWalletSessionExpiryContext(args) {

package/dist/esm/core/signingEngine/flows/signEvmFamily/operationIds.js

@@ -1,5 +1,5 @@
-import { SigningSessionIds } from "../../session/operationState/types.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { SigningSessionIds } from "../../session/operationState/types.js";
 //#region src/core/signingEngine/flows/signEvmFamily/operationIds.ts
 function createEvmFamilySigningOperationId() {
 	const randomId = secureRandomBase64Url(32, "EVM family signing operation IDs");

package/dist/esm/core/signingEngine/flows/signEvmFamily/preparedSigning.js

@@ -4,12 +4,12 @@ import { deriveEvmFamilyKeyFingerprintFromPublicFacts } from "../../session/iden
 import { buildEvmFamilyEcdsaSignerBinding, exactEcdsaSigningLaneIdentity, exactEcdsaSigningLaneIdentityFromSelectedLane, exactSigningLaneIdentityFromSelectedLane, exactSigningLaneIdentityKey } from "../../session/identity/exactSigningLaneIdentity.js";
 import { createSigningBoundaryTraceEvent, emitSigningBoundaryTrace, emitSigningLaneResolutionTrace, emitSigningPlannerDecisionTrace, emitSigningSessionFlowFailure, emitSigningSessionFlowTrace } from "../../session/operationState/trace.js";
 import { laneCandidateAuthMethod } from "../../session/identity/laneIdentity.js";
+import { requireResolvedEvmFamilyEcdsaSigningLane, summarizeEvmFamilyEcdsaLane } from "./ecdsaLanes.js";
 import { availableEcdsaSigningLaneAuthMethod, ecdsaAvailableLaneCandidatesForTarget, isConcreteAvailableSigningLane } from "../../session/availability/availableSigningLanes.js";
 import { selectEvmFamilyEcdsaMaterialCandidate } from "../../session/identity/selectLane.js";
 import { prepareTransactionSigningOperation } from "../../session/operationState/transactionState.js";
-import { requireResolvedEvmFamilyEcdsaSigningLane, summarizeEvmFamilyEcdsaLane } from "./ecdsaLanes.js";
-import { exactEcdsaWalletSessionRuntimesMatch } from "../../session/material/ecdsaSigningCapability.js";
 import { resolveEvmFamilyEcdsaSigningSelection } from "./ecdsaSelection.js";
+import { exactEcdsaWalletSessionRuntimesMatch } from "../../session/material/ecdsaSigningCapability.js";
 //#region src/core/signingEngine/flows/signEvmFamily/preparedSigning.ts
 function buildEvmFamilyTransactionSigningIntent(args) {
 	const base = {
@@ -273,7 +273,6 @@ async function prepareEvmFamilyEcdsaSigningSession(args) {
 		coordinator: args.signingSessionCoordinator,
 		operation: args.signingOperation,
 		forceFreshAuth: args.forceFreshAuth === true,
-		missingWhenExpiresAtMissing: true,
 		onPlannerTrace: (event) => emitSigningPlannerDecisionTrace("evm-family", event),
 		lifecycleAdapter: { prepare: async () => {
 			const selection = await resolveEvmFamilyEcdsaSigningSelection({