@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/core/signingEngine/flows/signEvmFamily/readySecp256k1Material.js

@@ -1,13 +1,12 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
 import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { buildHydratedEcdsaSignerMaterial } from "../../session/identity/evmFamilyEcdsaIdentity.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { routerAbEcdsaDerivationActiveStateId } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { buildHydratedEcdsaSignerMaterial } from "../../session/identity/evmFamilyEcdsaIdentity.js";
 import { projectEcdsaRoleLocalPublicFactsToChainTarget } from "../../session/persistence/ecdsaRoleLocalRecords.js";
 import { authorizeEvmFamilyEcdsaSigningCapability } from "../../session/material/ecdsaSigningCapability.js";
 import { ecdsaRoleLocalPersistedMaterialSource, resolveEcdsaRoleLocalMaterial } from "../../session/material/ecdsaRoleLocalMaterialResolver.js";
 import { buildRouterAbEcdsaDerivationSigningMaterialRef } from "../../routerAb/ecdsaDerivation/signingMaterialRef.js";
-import { buildReadySecp256k1SigningMaterial } from "./signers/secp256k1.js";
 //#region src/core/signingEngine/flows/signEvmFamily/readySecp256k1Material.ts
 async function hydrateEcdsaRoleLocalMaterialForSigning(args) {
 	return resolveEcdsaRoleLocalMaterial({
@@ -16,6 +15,38 @@ async function hydrateEcdsaRoleLocalMaterialForSigning(args) {
 		workerCtx: args.workerCtx
 	});
 }
+function buildReadySecp256k1SigningMaterial(args) {
+	const walletId = String(args.walletId || "").trim();
+	if (!walletId) throw new Error("[multichain] Missing wallet id for ready secp256k1 signing material");
+	const signerSession = args.signerSession;
+	if (walletId !== String(signerSession.walletId)) throw new Error("[multichain] ready secp256k1 material wallet identity mismatch");
+	const expiresAtMs = Math.floor(Number(args.expiresAtMs));
+	if (!Number.isSafeInteger(expiresAtMs) || expiresAtMs <= Date.now()) throw new Error("[multichain] ready secp256k1 authorization expiry is invalid");
+	const base = {
+		kind: "ready_secp256k1_signing_material",
+		walletId,
+		signerSession,
+		expiresAtMs,
+		singleUseEmailOtpSession: args.singleUseEmailOtpSession
+	};
+	switch (args.authorization.kind) {
+		case "reusable_wallet_session":
+			if (args.credential.kind !== "reusable_wallet_session") throw new Error("[multichain] exact Wallet Session authorization requires its operation credential");
+			return {
+				...base,
+				authorization: args.authorization,
+				credential: args.credential
+			};
+		case "operation_step_up":
+			if (!args.operationStepUpPreparation) throw new Error("[multichain] operation step-up preparation is required");
+			return {
+				...base,
+				authorization: args.authorization,
+				credential: args.credential,
+				operationStepUpPreparation: args.operationStepUpPreparation
+			};
+	}
+}
 /** Ready ECDSA signing material, assembled from each fact's canonical owner:
 * the manifest names the material and its public facts, the exact durable
 * runtime supplies normal-signing state, policy scope, and transport, and the
@@ -125,7 +156,9 @@ function attachExactEcdsaWalletSessionAuthorization(args) {
 		},
 		credential: {
 			kind: "reusable_wallet_session",
-			walletSessionToken: operationCredential.token
+			walletSessionToken: operationCredential.token,
+			home: operationCredential.home,
+			ownershipGeneration: operationCredential.ownershipGeneration
 		},
 		expiresAtMs: session.expiresAtMs,
 		singleUseEmailOtpSession: false
@@ -177,13 +210,15 @@ function buildActiveWalletAuthorityReadySecp256k1Material(args) {
 		},
 		credential: {
 			kind: "reusable_wallet_session",
-			walletSessionToken: operationCredential.token
+			walletSessionToken: operationCredential.token,
+			home: operationCredential.home,
+			ownershipGeneration: operationCredential.ownershipGeneration
 		},
 		expiresAtMs: session.expiresAtMs,
 		singleUseEmailOtpSession: false
 	});
 }
 //#endregion
-export { attachExactEcdsaWalletSessionAuthorization, buildActiveWalletAuthorityReadySecp256k1Material, resolveHydratedSecp256k1SigningMaterial };
+export { attachExactEcdsaWalletSessionAuthorization, buildActiveWalletAuthorityReadySecp256k1Material, buildReadySecp256k1SigningMaterial, resolveHydratedSecp256k1SigningMaterial };
 
 //# sourceMappingURL=readySecp256k1Material.js.map

package/dist/esm/core/signingEngine/flows/signEvmFamily/signEvmFamily.js

@@ -1,18 +1,18 @@
+import { thresholdEcdsaChainTargetKey, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { SigningEventPhase } from "../../../types/sdkSentEvents.js";
-import { thresholdEcdsaChainTargetKey, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { signingLaneAuthBindingKey } from "../../session/identity/signingLaneAuthBinding.js";
 import { SigningOperationIntent } from "../../session/operationState/types.js";
 import { exactEcdsaSigningLaneIdentityFromSelectedLane, requireEvmFamilyEcdsaSigner } from "../../session/identity/exactSigningLaneIdentity.js";
 import { reviewAdmissionForBinding } from "../../uiConfirm/transactionReviewAdmission.js";
+import { buildEvmDisplayModel } from "../../chains/evm/display/evmTx.js";
+import { buildTempoDisplayModel } from "../../chains/tempo/display.js";
 import { isEmailOtpSigningAuthPlan, isPasskeySigningAuthPlan } from "../../stepUpConfirmation/types.js";
 import { emitSigningSessionFlowTrace } from "../../session/operationState/trace.js";
-import { buildOperationAuthorizationQueueKey } from "../../session/operationState/authorizationAdmission.js";
 import { parseSigningOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import { computeSigningOperationFingerprint } from "../../session/planning/operationFingerprint.js";
-import { buildEvmDisplayModel } from "../../chains/evm/display/evmTx.js";
-import { buildTempoDisplayModel } from "../../chains/tempo/display.js";
 import { isEvmFamilyEcdsaMaterialSupersededError } from "./signingFlow.js";
+import { buildOperationAuthorizationQueueKey } from "../../session/operationState/authorizationAdmission.js";
 import { ensureSealedRefreshStartupParityForTransactionSigning } from "../../session/warmCapabilities/sealedRefreshParity.js";
 import { evmFamilySigningTargetFromExplicitTarget } from "./types.js";
 import { throwIfEvmFamilySigningCancelled } from "./errors.js";

package/dist/esm/core/signingEngine/flows/signEvmFamily/signers/ecdsaDerivationClientSigningMaterialSource.js

@@ -77,6 +77,6 @@ function createLinkedHolderClientSigningMaterialSource(holderHandleId) {
 	};
 }
 //#endregion
-export { createLinkedHolderClientSigningMaterialSource, loadRouterAbEcdsaDerivationSigningMaterialSource };
+export { loadRouterAbEcdsaDerivationSigningMaterialSource };
 
 //# sourceMappingURL=ecdsaDerivationClientSigningMaterialSource.js.map

package/dist/esm/core/signingEngine/flows/signEvmFamily/signers/secp256k1.js

@@ -1,42 +1,10 @@
+import { MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS } from "../../../../config/presignatures.js";
 import { routerAbMpcMaterialActivationRefToWire } from "../../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseEcdsaKeyHandle } from "../../../../../shared-ts/src/threshold/keyMaterialBrands.js";
-import { MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS } from "../../../workerManager/ecdsaPresignLifecycle.js";
 import { emitEcdsaSigningTiming, emitSigningSessionFlowTrace } from "../../../session/operationState/trace.js";
 import { scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill, signRouterAbEcdsaDerivationDigestWithPool } from "../../../routerAb/ecdsaDerivation/presignaturePool.js";
 import { loadRouterAbEcdsaDerivationSigningMaterialSource } from "./ecdsaDerivationClientSigningMaterialSource.js";
 //#region src/core/signingEngine/flows/signEvmFamily/signers/secp256k1.ts
-function buildReadySecp256k1SigningMaterial(args) {
-	const walletId = String(args.walletId || "").trim();
-	if (!walletId) throw new Error("[multichain] Missing wallet id for ready secp256k1 signing material");
-	const signerSession = args.signerSession;
-	if (walletId !== String(signerSession.walletId)) throw new Error("[multichain] ready secp256k1 material wallet identity mismatch");
-	const expiresAtMs = Math.floor(Number(args.expiresAtMs));
-	if (!Number.isSafeInteger(expiresAtMs) || expiresAtMs <= Date.now()) throw new Error("[multichain] ready secp256k1 authorization expiry is invalid");
-	const base = {
-		kind: "ready_secp256k1_signing_material",
-		walletId,
-		signerSession,
-		expiresAtMs,
-		singleUseEmailOtpSession: args.singleUseEmailOtpSession
-	};
-	switch (args.authorization.kind) {
-		case "reusable_wallet_session":
-			if (args.credential.kind !== "reusable_wallet_session") throw new Error("[multichain] exact Wallet Session authorization requires its operation credential");
-			return {
-				...base,
-				authorization: args.authorization,
-				credential: args.credential
-			};
-		case "operation_step_up":
-			if (!args.operationStepUpPreparation) throw new Error("[multichain] operation step-up preparation is required");
-			return {
-				...base,
-				authorization: args.authorization,
-				credential: args.credential,
-				operationStepUpPreparation: args.operationStepUpPreparation
-			};
-	}
-}
 function isSecp256k1DigestSignRequest(req) {
 	return req.kind === "digest" && req.algorithm === "secp256k1";
 }
@@ -49,16 +17,20 @@ function routerAbTransportCredential(credential) {
 	switch (credential.kind) {
 		case "reusable_wallet_session": return {
 			kind: "wallet_session_opaque",
-			walletSessionToken: credential.walletSessionToken
+			walletSessionToken: credential.walletSessionToken,
+			home: credential.home,
+			ownershipGeneration: credential.ownershipGeneration
 		};
 		case "operation_step_up": return {
 			kind: "wallet_session_opaque",
-			walletSessionToken: credential.walletSessionToken
+			walletSessionToken: credential.walletSessionToken,
+			home: credential.home,
+			ownershipGeneration: credential.ownershipGeneration
 		};
 	}
 	throw new Error("[multichain] unsupported ECDSA signing credential");
 }
-function scheduleRouterAbEcdsaDerivationPostSignRefill(args) {
+function scheduleRouterAbEcdsaDerivationSigningRefill(args) {
 	const signerSession = args.loadedMaterial.signerSession;
 	const publicFacts = signerSession.publicFacts;
 	const signingMaterial = signerSession.transport.signingMaterial;
@@ -82,7 +54,7 @@ function scheduleRouterAbEcdsaDerivationPostSignRefill(args) {
 		authorization: args.authorization
 	});
 	emitSigningSessionFlowTrace("evm-family", {
-		event: "ecdsa_post_sign_refill",
+		event: "ecdsa_signing_refill",
 		operationId: args.operationId,
 		scheduled: result.scheduled,
 		reason: result.reason,
@@ -96,6 +68,7 @@ var Secp256k1Engine = class {
 		this.beforeSigning = opts.beforeSigning;
 		this.shouldAbort = opts.shouldAbort;
 		this.workerCtx = opts.workerCtx;
+		this.reconcileSession = opts.reconcileSession;
 	}
 	async signReadySecp256k1Digest(req, material, operation, operationDigests) {
 		const operationId = requireEvmSigningOperationId(operation);
@@ -129,10 +102,25 @@ var Secp256k1Engine = class {
 				workerCtx: this.workerCtx
 			};
 			this.beforeSigning?.();
+			if (material.authorization.kind === "reusable_wallet_session") scheduleRouterAbEcdsaDerivationSigningRefill({
+				operationId,
+				loadedMaterial,
+				workerCtx: this.workerCtx,
+				credential: transportCredential,
+				expiresAtMs: material.expiresAtMs,
+				authorization: material.authorization
+			});
+			else emitSigningSessionFlowTrace("evm-family", {
+				event: "ecdsa_signing_refill",
+				operationId,
+				scheduled: false,
+				reason: "operation_step_up"
+			});
 			let signed;
 			if (material.authorization.kind === "reusable_wallet_session") signed = await signRouterAbEcdsaDerivationDigestWithPool({
 				...signingInput,
-				authorization: material.authorization
+				authorization: material.authorization,
+				reconcileSession: this.reconcileSession
 			});
 			else {
 				const operationStepUpPreparation = material.operationStepUpPreparation;
@@ -144,20 +132,6 @@ var Secp256k1Engine = class {
 				});
 			}
 			if (!signed.ok) throw new Error(signed.message || signed.code || "[multichain] Router A/B ECDSA derivation signing failed");
-			if (material.authorization.kind === "reusable_wallet_session") scheduleRouterAbEcdsaDerivationPostSignRefill({
-				operationId,
-				loadedMaterial,
-				workerCtx: this.workerCtx,
-				credential: transportCredential,
-				expiresAtMs: material.expiresAtMs,
-				authorization: material.authorization
-			});
-			else emitSigningSessionFlowTrace("evm-family", {
-				event: "ecdsa_post_sign_refill",
-				operationId,
-				scheduled: false,
-				reason: "operation_step_up"
-			});
 			signatureCreated = true;
 			return signed.signature65;
 		} finally {
@@ -177,6 +151,6 @@ var Secp256k1Engine = class {
 	}
 };
 //#endregion
-export { Secp256k1Engine, buildReadySecp256k1SigningMaterial };
+export { Secp256k1Engine };
 
 //# sourceMappingURL=secp256k1.js.map

package/dist/esm/core/signingEngine/flows/signEvmFamily/signingFlow.js

@@ -3,14 +3,14 @@ import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { SigningEventPhase, createSigningFlowEvent } from "../../../types/sdkSentEvents.js";
 import { SigningSessionIds } from "../../session/operationState/types.js";
+import { normalizeAuthenticationCredential } from "../../webauthnAuth/credentials/helpers.js";
+import { bytesToHex } from "../../chains/evm/bytes.js";
 import { isActiveWalletAuthoritySigningAuthPlan, isWarmSessionSigningAuthPlan } from "../../stepUpConfirmation/types.js";
+import { toManagedNonceReservationSnapshot } from "../../../rpcClients/evm/nonceBackend.js";
 import { emitEcdsaSigningTiming } from "../../session/operationState/trace.js";
+import { parseSigningOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import { SigningOperationCommandKind, buildSigningOperationCommandSteps, createSigningOperationPlan, runSigningOperationCommandSteps, runUnplannedSigningOperationCommandSequence } from "../shared/signingStateMachine.js";
 import { createSigningConfirmationCommandHandler, inferDigest32FromSignRequest, makeRequestId, mapSigningConfirmationProgress, resolveSigningConfirmationAuthMethod } from "../shared/signingConfirmation.js";
-import { normalizeAuthenticationCredential } from "../../webauthnAuth/credentials/helpers.js";
-import { parseSigningOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
-import { toManagedNonceReservationSnapshot } from "../../../rpcClients/evm/nonceBackend.js";
-import { bytesToHex } from "../../chains/evm/bytes.js";
 import { requireEvmFamilyStepUpAuth, signingAuthPlanFromThresholdEcdsaStepUp } from "./requireEvmFamilyStepUpAuth.js";
 import { buildEvmFamilyEcdsaStepUpAuthorization } from "./stepUpAuthorization.js";
 import { PENDING_CHALLENGE_B64U, PENDING_INTENT_DIGEST, registerIntentDigestPreparation } from "../../stepUpConfirmation/intentDigestPreparation.js";
@@ -628,6 +628,6 @@ async function signEvmFamilyWithUiConfirm(args) {
 	}
 }
 //#endregion
-export { EvmFamilyEcdsaMaterialSupersededError, isEvmFamilyEcdsaMaterialSupersededError, signEvmFamilyWithUiConfirm };
+export { isEvmFamilyEcdsaMaterialSupersededError, signEvmFamilyWithUiConfirm };
 
 //# sourceMappingURL=signingFlow.js.map

package/dist/esm/core/signingEngine/flows/signEvmFamily/signingFlowRuntime.js

@@ -1,16 +1,17 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { walletSessionPreservesCapabilities } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { requireEvmFamilyEcdsaSigner } from "../../session/identity/exactSigningLaneIdentity.js";
+import { activeWalletSessionV1RecordsEqual, walletSessionPreservesCapabilities } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { isEd25519ExtensionOfEcdsaWalletAuthority } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
-import { exactAuthorizationMatchesCapability, exactEcdsaWalletSessionRuntimesMatch } from "../../session/material/ecdsaSigningCapability.js";
+import { requireEvmFamilyEcdsaSigner } from "../../session/identity/exactSigningLaneIdentity.js";
 import { emitEvmFamilySigningOperationTrace } from "./events.js";
+import { exactAuthorizationMatchesCapability, exactEcdsaWalletSessionRuntimesMatch } from "../../session/material/ecdsaSigningCapability.js";
 import { loadSecp256k1EngineCtor, loadWebAuthnP256EngineCtor } from "./signerLoader.js";
+import { WalletSessionStatusReadScope } from "../../../rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { attachExactEcdsaWalletSessionAuthorization, buildActiveWalletAuthorityReadySecp256k1Material, resolveHydratedSecp256k1SigningMaterial } from "./readySecp256k1Material.js";
 import { resolveExactEcdsaCapabilityRuntime } from "../../session/material/activeEcdsaCapabilityRuntime.js";
 import { authorizeEvmFamilyEcdsaOperationStepUp, prepareEvmFamilyEcdsaOperationStepUp } from "./thresholdAdmission.js";
+import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
 import { resolveActiveWalletAuthorityEcdsaRuntimeV1 } from "../../session/material/activeWalletAuthorityEcdsaRuntime.js";
 //#region src/core/signingEngine/flows/signEvmFamily/signingFlowRuntime.ts
 function buildActiveWalletAuthorityConfirmationAuthPlan(runtime) {
@@ -202,17 +203,6 @@ async function resolveEcdsaSigningMaterialHydrationPlan(args) {
 		kind: "superseded",
 		replacement: superseded
 	};
-	if (args.preparedAuthorization) {
-		const authorizationSupersession = ecdsaSigningAuthorizationSupersession({
-			preparedAuthorization: args.preparedAuthorization,
-			currentAuthorization: args.currentAuthorization,
-			materialActivation: args.materialActivation
-		});
-		if (authorizationSupersession) return {
-			kind: "superseded",
-			replacement: authorizationSupersession
-		};
-	}
 	const resolution = await resolveHydratedSecp256k1SigningMaterial({
 		capability: args.capability,
 		runtime: activeRuntimeResolution.runtime,
@@ -224,22 +214,13 @@ async function resolveEcdsaSigningMaterialHydrationPlan(args) {
 		kind: "failed",
 		failure: resolution
 	};
-	if (!args.preparedAuthorization) return {
+	if (!args.candidateAuthorization) return {
 		kind: "authorization_required",
 		requirement: {
 			kind: "material_for_step_up",
 			material: resolution.material
 		}
 	};
-	if (!args.currentAuthorization) return {
-		kind: "superseded",
-		replacement: {
-			kind: "superseded",
-			supersessionKind: "reusable_authorization_replaced",
-			preparedMaterialActivation: args.materialActivation,
-			currentMaterialActivation: args.materialActivation
-		}
-	};
 	return {
 		kind: "ready",
 		value: {
@@ -247,12 +228,30 @@ async function resolveEcdsaSigningMaterialHydrationPlan(args) {
 			material: attachExactEcdsaWalletSessionAuthorization({
 				material: resolution.material,
 				capability: args.capability,
-				authorization: args.currentAuthorization,
+				authorization: args.candidateAuthorization,
 				nowMs: Date.now()
 			})
 		}
 	};
 }
+async function reconcilePreparedEcdsaSession(input, status) {
+	const current = await input.resolve(input.scope, WalletSessionStatusReadScope.fromPrepare({
+		relayerUrl: input.relayerUrl,
+		operationCredential: input.prepared.operationCredential
+	}, status));
+	if (ecdsaSigningAuthorizationSupersession({
+		preparedAuthorization: input.prepared,
+		currentAuthorization: current,
+		materialActivation: input.scope.materialActivation
+	})) throw new Error("Wallet Session authority changed before client signing");
+}
+async function reconcilePreparedLinkedEcdsaSession(input, status) {
+	const current = await resolveCurrentActiveWalletAuthorityRuntime(input);
+	if (status.walletSessionId !== current.operationCredential.walletSessionId || status.quotaId !== current.session.quotaId || status.quotaLifecycle !== "active" || status.remainingUses <= 0 || status.expiresAtMs <= Date.now() || status.expiresAtMs !== current.session.expiresAtMs || !activeWalletSessionV1RecordsEqual(status.authorization, current.session)) throw new Error("Linked Wallet Session authority changed before client signing");
+}
+async function rejectUnexpectedReusableSession() {
+	throw new Error("Operation step-up cannot reconcile a reusable Wallet Session");
+}
 async function createEvmFamilySigningFlowRuntime(args) {
 	const [Secp256k1Engine, WebAuthnP256Engine] = await Promise.all([loadSecp256k1EngineCtor(), loadWebAuthnP256EngineCtor()]);
 	const workerCtx = args.deps.getSignerWorkerContext();
@@ -302,13 +301,26 @@ async function createEvmFamilySigningFlowRuntime(args) {
 					authorization,
 					prepared,
 					material,
-					walletSessionToken: session.credential.token
+					operationCredential: session.credential
 				});
 			}
 		},
 		...args.onAuthSideEffectStarted ? { onAuthSideEffectStarted: args.onAuthSideEffectStarted } : {}
 	} : void 0;
+	let reconcileSession = rejectUnexpectedReusableSession;
+	if (args.activeWalletAuthority && resolvedSigner) reconcileSession = reconcilePreparedLinkedEcdsaSession.bind(null, {
+		deps: args.deps,
+		prepared: args.activeWalletAuthority.runtime,
+		signer: resolvedSigner
+	});
+	else if (activeAuthorization && exactOperationCredentialScope) reconcileSession = reconcilePreparedEcdsaSession.bind(null, {
+		resolve: args.deps.resolveActiveEcdsaWalletSessionAuthorization,
+		scope: exactOperationCredentialScope,
+		prepared: activeAuthorization,
+		relayerUrl
+	});
 	const secp256k1Engine = new Secp256k1Engine({
+		reconcileSession,
 		beforeSigning: args.deps.beforeSigning,
 		getRpId: () => ctx.touchIdPrompt.getRpId(),
 		workerCtx,
@@ -365,12 +377,7 @@ async function createEvmFamilySigningFlowRuntime(args) {
 			}),
 			resolveEcdsaSigningMaterialPlan: async () => await resolveEcdsaSigningMaterialHydrationPlan({
 				capability,
-				preparedAuthorization: activeAuthorization,
-				currentAuthorization: activeAuthorization ? await args.deps.resolveActiveEcdsaWalletSessionAuthorization({
-					walletId: resolvedSigner.walletId,
-					chainTarget: resolvedSigner.chainTarget,
-					materialActivation: resolvedSigner.materialActivation
-				}) : null,
+				candidateAuthorization: activeAuthorization,
 				walletId: resolvedSigner.walletId,
 				chainTarget: resolvedSigner.chainTarget,
 				materialActivation: resolvedSigner.materialActivation,

package/dist/esm/core/signingEngine/flows/signEvmFamily/thresholdAdmission.js

@@ -1,5 +1,5 @@
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { buildReadySecp256k1SigningMaterial } from "./signers/secp256k1.js";
+import { buildReadySecp256k1SigningMaterial } from "./readySecp256k1Material.js";
 import { issueEcdsaOperationStepUpAuthorization, prepareEcdsaOperationStepUp } from "../../threshold/ecdsa/operationStepUp.js";
 //#region src/core/signingEngine/flows/signEvmFamily/thresholdAdmission.ts
 async function prepareEvmFamilyEcdsaOperationStepUp(args) {
@@ -28,6 +28,10 @@ async function authorizeEvmFamilyEcdsaOperationStepUp(args) {
 	});
 	const authorization = await issueEcdsaOperationStepUpAuthorization({
 		relayerUrl: args.relayerUrl,
+		transport: {
+			kind: "wallet_session",
+			credential: args.operationCredential
+		},
 		request: {
 			kind: "router_ab_ecdsa_operation_step_up_v1",
 			operation: args.prepared.operation,
@@ -36,7 +40,9 @@ async function authorizeEvmFamilyEcdsaOperationStepUp(args) {
 	});
 	const credential = {
 		kind: "operation_step_up",
-		walletSessionToken: args.walletSessionToken
+		walletSessionToken: args.operationCredential.token,
+		home: args.operationCredential.home,
+		ownershipGeneration: args.operationCredential.ownershipGeneration
 	};
 	return buildReadySecp256k1SigningMaterial({
 		walletId: args.material.walletId,

package/dist/esm/core/signingEngine/flows/signNear/implicitAccountFunding.js

@@ -1,6 +1,6 @@
-import { fundImplicitNearAccountForTesting } from "../../../rpcClients/relayer/walletRegistration.js";
 import { nonceLeaseToRef } from "../../nonce/nonceLaneKeys.js";
 import { buildNearNonceLane } from "../../nonce/nearNonceLaneIdentity.js";
+import { fundImplicitNearAccountForTesting } from "../../../rpcClients/relayer/walletRegistration.js";
 //#region src/core/signingEngine/flows/signNear/implicitAccountFunding.ts
 const ACCESS_KEY_POLL_ATTEMPTS = 12;
 const ACCESS_KEY_POLL_DELAY_MS = 1e3;