@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/core/signingEngine/flows/signNear/shared/ed25519YaoNormalSigning.js

@@ -1,21 +1,23 @@
 import { parseCapabilityId, parseCapabilityOperationId, parsePrincipalId, parseTenantId } from "../../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { WorkerResponseType } from "../../../../types/signer-worker.js";
+import { resolveNearNetwork } from "../../../../config/chains.js";
+import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from "../../../../config/defaultConfigs.js";
+import { activeWalletSessionV1RecordsEqual } from "../../../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { base58Decode } from "../../../../../shared-ts/src/utils/base58.js";
 import { ensureEd25519Prefix } from "../../../../../shared-ts/src/utils/near.js";
-import { resolveNearNetwork } from "../../../../config/chains.js";
 import { SigningSessionIds } from "../../../session/operationState/types.js";
 import { ActionType, fromActionArgsWasm } from "../../../../../shared-ts/src/near/actions.js";
-import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from "../../../../config/defaultConfigs.js";
 import { emitEd25519SigningTiming } from "../../../session/operationState/trace.js";
+import { buildCapabilityOperationEnvelope, parseSigningOperationFingerprintDigest } from "../../../../../shared-ts/src/authorization/operationFingerprint.js";
+import { WalletSessionStatusReadScope } from "../../../../rpcClients/relayer/walletSessionAuthorizationStatus.js";
+import { buildRouterAbEd25519DelegateActionPrepareRequestV2, buildRouterAbEd25519NearTransactionPrepareRequestV2, buildRouterAbEd25519Nep413PrepareRequestV2, buildRouterAbEd25519NormalSigningFinalizeRequestV2, finalizeRouterAbNormalSigningV2, prepareRouterAbNormalSigningV2, routerAbCanonicalWireBytesToB64u, routerAbNormalSigningActionFingerprint } from "../../../../rpcClients/relayer/routerAbNormalSigning.js";
 import { parseThresholdEd25519NearTransaction, thresholdEd25519NearTransactionOperationFingerprint } from "../../../../../shared-ts/src/threshold/ed25519OperationFingerprint.js";
-import { WorkerResponseType } from "../../../../types/signer-worker.js";
 import { buildThresholdEd25519DelegateSigningPayloadWasm, buildThresholdEd25519NearTxUnsignedBorshWasm, decodeThresholdEd25519SignedNearTxBorshWasm, finalizeThresholdEd25519DelegateFromSignatureWasm, finalizeThresholdEd25519NearTxFromSignatureWasm } from "../../../chains/near/nearSignerWasm.js";
-import { buildRouterAbEd25519DelegateActionPrepareRequestV2, buildRouterAbEd25519NearTransactionPrepareRequestV2, buildRouterAbEd25519Nep413PrepareRequestV2, buildRouterAbEd25519NormalSigningFinalizeRequestV2, finalizeRouterAbNormalSigningV2, prepareRouterAbNormalSigningV2, routerAbCanonicalWireBytesToB64u, routerAbNormalSigningActionFingerprint } from "../../../../rpcClients/relayer/routerAbNormalSigning.js";
 import { requireRouterAbNormalSigningPrepareMatchesRequest, requireRouterAbNormalSigningResponseMatchesRequest } from "../../../../rpcClients/relayer/routerAbNormalSigningValidation.js";
 import { requireRouterAbEd25519NormalSigningReadyState } from "../../../session/warmCapabilities/routerAbWalletSessionCredential.js";
 import { nearEd25519YaoMaterialActivationFromMetadata } from "../../../session/material/nearEd25519YaoMaterialActivation.js";
-import { buildCapabilityOperationEnvelope, parseSigningOperationFingerprintDigest } from "../../../../../shared-ts/src/authorization/operationFingerprint.js";
 import { requireNearOperationStepUpMaterialActivation } from "./operationStepUpPreparation.js";
 import { issueEd25519OperationStepUpAuthorization } from "../../../threshold/ed25519/walletSession.js";
 //#region src/core/signingEngine/flows/signNear/shared/ed25519YaoNormalSigning.ts
@@ -292,12 +294,30 @@ async function finalizeRouterAbEd25519NormalSigningSignature(args, operationId)
 		relayerUrl: args.walletSessionState.relayerUrl
 	} : args.materialFacts;
 	const prepareStartedAt = performance.now();
-	const prepareResponse = await prepareRouterAbNormalSigningV2({
+	const prepared = args.startedResponse ? await args.startedResponse : await prepareRouterAbNormalSigningV2({
 		relayServerUrl: materialFacts.relayerUrl,
 		credential: args.credential,
 		request: args.prepare.request
 	});
 	emitEd25519SigningTiming(operationId, "prepare", prepareStartedAt);
+	if (args.authorization === "reusable_wallet_session") {
+		if (prepared.kind !== "reusable_wallet_session") throw new Error("Ed25519 prepare returned the wrong authorization kind");
+		const current = await args.sessionCoordinator.resolveActiveAuthorizedRouterAbEd25519WalletSessionState({
+			state: args.walletSessionState,
+			nowMs: Date.now()
+		});
+		const status = prepared.sessionStatus;
+		if (!current || status.walletSessionId !== current.walletSessionOperationCredential.walletSessionId || status.quotaId !== current.walletSessionAuthorization.quotaId || status.quotaLifecycle !== "active" || status.remainingUses <= 0 || status.expiresAtMs <= Date.now() || !activeWalletSessionV1RecordsEqual(status.authorization, current.walletSessionAuthorization)) throw new Error("Wallet Session authority changed before Ed25519 client signing");
+		const statusOptions = {
+			relayerUrl: materialFacts.relayerUrl,
+			operationCredential: current.walletSessionOperationCredential
+		};
+		await WalletSessionStatusReadScope.fromPrepare(statusOptions, status).read(statusOptions, {
+			walletSessionId: status.walletSessionId,
+			quotaId: status.quotaId
+		});
+	} else if (prepared.kind !== "operation_step_up") throw new Error("Ed25519 step-up prepare returned a reusable Wallet Session");
+	const prepareResponse = prepared.signing;
 	requireRouterAbNormalSigningPrepareMatchesRequest({
 		request: args.prepare.request,
 		signingPayloadDigest: args.prepare.admissionMaterial.signingPayloadDigest,
@@ -351,7 +371,7 @@ async function finalizeRouterAbEd25519NormalSigningSignature(args, operationId)
 		signerPublicKey: args.thresholdKeyMaterial.publicKey
 	};
 }
-async function buildRouterAbEd25519SignatureOnlyPrepareRequest(args) {
+async function buildRouterAbEd25519SignatureOnlyPrepareRequestForScope(args) {
 	const nearNetworkId = normalizeNearNetworkId(args.ctx);
 	return args.intent.kind === "nep413_message_v1" ? await buildRouterAbEd25519Nep413PrepareRequestV2({
 		scope: args.scope,
@@ -364,7 +384,7 @@ async function buildRouterAbEd25519SignatureOnlyPrepareRequest(args) {
 		message: args.intent.message,
 		recipient: args.intent.recipient,
 		nonce: args.intent.nonce,
-		...args.intent.state ? { callbackUrl: args.intent.state } : {},
+		callbackUrl: args.intent.callbackUrl,
 		expectedSigningDigestB64u: args.signingDigestB64u
 	}) : await buildRouterAbEd25519DelegateActionPrepareRequestV2({
 		scope: args.scope,
@@ -403,7 +423,7 @@ async function prepareRouterAbEd25519SignatureOnlyOperationStepUp(args) {
 		walletId: args.walletId,
 		operationId: args.operationId
 	});
-	const prepare = await buildRouterAbEd25519SignatureOnlyPrepareRequest({
+	const prepare = await buildRouterAbEd25519SignatureOnlyPrepareRequestForScope({
 		ctx: args.ctx,
 		thresholdSessionId: args.thresholdSessionId,
 		scope,
@@ -549,6 +569,36 @@ async function tryFinalizeRouterAbEd25519SignatureOnlyNormalSigning(args) {
 			})
 		};
 	}
+	const started = args.startedPrepare && args.startedPrepare.displayDigest === args.displayDigest && args.startedPrepare.signingDigestB64u === args.signingDigestB64u ? args.startedPrepare : null;
+	if (args.startedPrepare && !started) abandonRouterAbEd25519StartedPrepare(args.startedPrepare);
+	const prepare = started?.prepare ?? await buildRouterAbEd25519SignatureOnlyPrepareRequest(args);
+	if (!prepare) return null;
+	return {
+		kind: "router_ab_ed25519_signature_only_normal_signing_result_v1",
+		authorization: "reusable_wallet_session",
+		...await tryFinalizeRouterAbEd25519NormalSigningSignature({
+			thresholdSessionId: args.thresholdSessionId,
+			walletSessionState: args.walletSessionState,
+			sessionCoordinator: args.sessionCoordinator,
+			thresholdKeyMaterial: args.thresholdKeyMaterial,
+			walletId: args.walletId,
+			nearAccountId: args.nearAccountId,
+			activeClient: args.activeClient,
+			signingDigestB64u: args.signingDigestB64u,
+			signingPayloadLabel: "signature-only payload digest",
+			prepare,
+			startedResponse: started?.response,
+			credential: requireRouterAbEd25519NormalSigningReadyState({
+				state: args.walletSessionState,
+				thresholdSessionId: args.thresholdSessionId,
+				nearAccountId: args.nearAccountId,
+				thresholdKeyMaterial: args.thresholdKeyMaterial
+			}).credential,
+			authorization: args.authorization.kind
+		})
+	};
+}
+async function buildRouterAbEd25519SignatureOnlyPrepareRequest(args) {
 	const scope = buildRouterAbNormalSigningScope({
 		activeClient: args.activeClient,
 		walletSessionState: args.walletSessionState,
@@ -556,7 +606,7 @@ async function tryFinalizeRouterAbEd25519SignatureOnlyNormalSigning(args) {
 		operationId: args.operationId
 	});
 	if (!scope) return null;
-	const prepare = await buildRouterAbEd25519SignatureOnlyPrepareRequest({
+	return await buildRouterAbEd25519SignatureOnlyPrepareRequestForScope({
 		ctx: args.ctx,
 		thresholdSessionId: args.thresholdSessionId,
 		scope,
@@ -571,29 +621,41 @@ async function tryFinalizeRouterAbEd25519SignatureOnlyNormalSigning(args) {
 		signingDigestB64u: args.signingDigestB64u,
 		intent: args.intent
 	});
+}
+/**
+* Sends the prepare of a warm-session signature before the user confirms.
+* The caller shows the dialog meanwhile and passes the result to the
+* signature; a result that is never passed on expires with its lease and
+* keeps the quota use it claimed.
+*/
+async function startRouterAbEd25519SignatureOnlyPrepare(args) {
+	const prepare = await buildRouterAbEd25519SignatureOnlyPrepareRequest(args);
+	if (!prepare) return null;
+	const ready = requireRouterAbEd25519NormalSigningReadyState({
+		state: args.walletSessionState,
+		thresholdSessionId: args.thresholdSessionId,
+		nearAccountId: args.nearAccountId,
+		thresholdKeyMaterial: args.thresholdKeyMaterial
+	});
+	const sentAt = performance.now();
+	const response = prepareRouterAbNormalSigningV2({
+		relayServerUrl: args.walletSessionState.relayerUrl,
+		credential: ready.credential,
+		request: prepare.request
+	});
+	response.catch(() => {});
+	emitEd25519SigningTiming(String(args.operationId), "prepare_sent", sentAt);
 	return {
-		kind: "router_ab_ed25519_signature_only_normal_signing_result_v1",
-		authorization: "reusable_wallet_session",
-		...await tryFinalizeRouterAbEd25519NormalSigningSignature({
-			thresholdSessionId: args.thresholdSessionId,
-			walletSessionState: args.walletSessionState,
-			thresholdKeyMaterial: args.thresholdKeyMaterial,
-			walletId: args.walletId,
-			nearAccountId: args.nearAccountId,
-			activeClient: args.activeClient,
-			signingDigestB64u: args.signingDigestB64u,
-			signingPayloadLabel: "signature-only payload digest",
-			prepare,
-			credential: requireRouterAbEd25519NormalSigningReadyState({
-				state: args.walletSessionState,
-				thresholdSessionId: args.thresholdSessionId,
-				nearAccountId: args.nearAccountId,
-				thresholdKeyMaterial: args.thresholdKeyMaterial
-			}).credential,
-			authorization: args.authorization.kind
-		})
+		prepare,
+		displayDigest: args.displayDigest,
+		signingDigestB64u: args.signingDigestB64u,
+		response
 	};
 }
+/** Leaves a started prepare to expire with its lease. */
+function abandonRouterAbEd25519StartedPrepare(started) {
+	started.response.catch(() => {});
+}
 async function prepareRouterAbEd25519NearTransactionOperationStepUp(args) {
 	const unsigned = await buildThresholdEd25519NearTxUnsignedBorshWasm({
 		txSigningRequest: args.txSigningRequest,
@@ -663,6 +725,82 @@ function routerAbEd25519NormalSigningMaterialFacts(args) {
 		relayerUrl: args.walletSessionState.relayerUrl
 	};
 }
+async function nearTransactionPrepareInputs(args, unsigned) {
+	const nearNetworkId = normalizeNearNetworkId(args.ctx);
+	const parsedTransaction = parseThresholdEd25519NearTransaction(args.txSigningRequest, "txSigningRequest");
+	return {
+		nearNetworkId,
+		parsedTransaction,
+		operationFingerprint: SigningSessionIds.signingOperationFingerprint(await thresholdEd25519NearTransactionOperationFingerprint({
+			nearAccountId: args.nearAccountId,
+			nearNetworkId,
+			relayerKeyId: args.thresholdKeyMaterial.relayerKeyId,
+			signerPublicKey: args.thresholdKeyMaterial.publicKey,
+			transactions: [parsedTransaction],
+			unsignedTransactionBorshB64u: unsigned.unsignedTransactionBorshB64u,
+			signingDigestB64u: unsigned.signingDigestB64u
+		}))
+	};
+}
+async function buildRouterAbEd25519NearTransactionWarmPrepare(args, unsigned, inputs) {
+	const scope = buildRouterAbNormalSigningScope({
+		activeClient: args.activeClient,
+		walletSessionState: args.walletSessionState,
+		walletId: args.walletId,
+		operationId: args.operationId
+	});
+	if (!scope) throw new Error("[SigningEngine][near] Router A/B Ed25519 signing scope is missing");
+	return await buildRouterAbEd25519NearTransactionPrepareRequestV2({
+		scope,
+		expiresAtMs: routerAbNormalSigningExpiresAtMs({
+			walletSessionExpiresAtMs: args.walletSessionState.signingWalletSession.expiresAtMs,
+			requestedTtlMs: ROUTER_AB_NORMAL_SIGNING_REQUEST_TTL_MS
+		}),
+		operationId: args.operationId,
+		operationFingerprint: inputs.operationFingerprint,
+		displayDigestB64u: args.displayDigest,
+		nearAccountId: args.nearAccountId,
+		nearNetworkId: inputs.nearNetworkId,
+		transactions: [{
+			receiverId: inputs.parsedTransaction.receiverId,
+			actionFingerprint: await routerAbNormalSigningActionFingerprint(inputs.parsedTransaction.actions)
+		}],
+		unsignedTransactionBorshB64u: unsigned.unsignedTransactionBorshB64u,
+		expectedSigningDigestB64u: unsigned.signingDigestB64u
+	});
+}
+/**
+* Sends the prepare of a warm-session transaction while the confirmation
+* dialog is open. The transaction context is the one the dialog reserved.
+*/
+async function startRouterAbEd25519NearTransactionPrepare(args) {
+	const unsigned = await buildThresholdEd25519NearTxUnsignedBorshWasm({
+		txSigningRequest: args.txSigningRequest,
+		transactionContext: args.transactionContext,
+		workerCtx: args.ctx
+	});
+	const prepare = await buildRouterAbEd25519NearTransactionWarmPrepare(args, unsigned, await nearTransactionPrepareInputs(args, unsigned));
+	const ready = requireRouterAbEd25519NormalSigningReadyState({
+		state: args.walletSessionState,
+		thresholdSessionId: args.thresholdSessionId,
+		nearAccountId: args.nearAccountId,
+		thresholdKeyMaterial: args.thresholdKeyMaterial
+	});
+	const sentAt = performance.now();
+	const response = prepareRouterAbNormalSigningV2({
+		relayServerUrl: args.walletSessionState.relayerUrl,
+		credential: ready.credential,
+		request: prepare.request
+	});
+	response.catch(() => {});
+	emitEd25519SigningTiming(String(args.operationId), "prepare_sent", sentAt);
+	return {
+		prepare,
+		displayDigest: args.displayDigest,
+		signingDigestB64u: unsigned.signingDigestB64u,
+		response
+	};
+}
 async function tryFinalizeRouterAbEd25519NearTransactionNormalSigning(args) {
 	const materialFacts = routerAbEd25519NormalSigningMaterialFacts(args);
 	if (!materialFacts.routerAbNormalSigning) throw new Error("[SigningEngine][near] Router A/B Ed25519 normal-signing state is missing");
@@ -677,17 +815,8 @@ async function tryFinalizeRouterAbEd25519NearTransactionNormalSigning(args) {
 		workerCtx: args.ctx
 	});
 	if (base64UrlDecode(unsigned.signingDigestB64u).length !== 32) throw new Error("Router A/B normal-signing NEAR payload digest must be 32 bytes");
-	const nearNetworkId = normalizeNearNetworkId(args.ctx);
-	const parsedTransaction = parseThresholdEd25519NearTransaction(args.txSigningRequest, "txSigningRequest");
-	const operationFingerprint = SigningSessionIds.signingOperationFingerprint(await thresholdEd25519NearTransactionOperationFingerprint({
-		nearAccountId: args.nearAccountId,
-		nearNetworkId,
-		relayerKeyId: args.thresholdKeyMaterial.relayerKeyId,
-		signerPublicKey: args.thresholdKeyMaterial.publicKey,
-		transactions: [parsedTransaction],
-		unsignedTransactionBorshB64u: unsigned.unsignedTransactionBorshB64u,
-		signingDigestB64u: unsigned.signingDigestB64u
-	}));
+	const prepareInputs = await nearTransactionPrepareInputs(args, unsigned);
+	let started = null;
 	let prepare;
 	let credential;
 	let issuedAuthorization;
@@ -710,31 +839,9 @@ async function tryFinalizeRouterAbEd25519NearTransactionNormalSigning(args) {
 		if (prepare.request.scope.authorization.kind !== "operation_step_up" || issued.kind !== "verified_step_up") throw new Error("[SigningEngine][near] issued operation step-up evidence changed identity");
 		issuedAuthorization = issued;
 	} else {
-		const scope = buildRouterAbNormalSigningScope({
-			activeClient: args.activeClient,
-			walletSessionState: args.walletSessionState,
-			walletId: args.walletId,
-			operationId: args.operationId
-		});
-		if (!scope) throw new Error("[SigningEngine][near] Router A/B Ed25519 signing scope is missing");
-		prepare = await buildRouterAbEd25519NearTransactionPrepareRequestV2({
-			scope,
-			expiresAtMs: routerAbNormalSigningExpiresAtMs({
-				walletSessionExpiresAtMs: args.walletSessionState.signingWalletSession.expiresAtMs,
-				requestedTtlMs: ROUTER_AB_NORMAL_SIGNING_REQUEST_TTL_MS
-			}),
-			operationId: args.operationId,
-			operationFingerprint,
-			displayDigestB64u: args.displayDigest,
-			nearAccountId: args.nearAccountId,
-			nearNetworkId,
-			transactions: [{
-				receiverId: parsedTransaction.receiverId,
-				actionFingerprint: await routerAbNormalSigningActionFingerprint(parsedTransaction.actions)
-			}],
-			unsignedTransactionBorshB64u: unsigned.unsignedTransactionBorshB64u,
-			expectedSigningDigestB64u: unsigned.signingDigestB64u
-		});
+		started = args.startedPrepare && args.startedPrepare.displayDigest === args.displayDigest && args.startedPrepare.signingDigestB64u === unsigned.signingDigestB64u ? args.startedPrepare : null;
+		if (args.startedPrepare && !started) abandonRouterAbEd25519StartedPrepare(args.startedPrepare);
+		prepare = started ? started.prepare : await buildRouterAbEd25519NearTransactionWarmPrepare(args, unsigned, prepareInputs);
 		credential = requireRouterAbEd25519NormalSigningReadyState({
 			state: args.walletSessionState,
 			thresholdSessionId: args.thresholdSessionId,
@@ -758,6 +865,7 @@ async function tryFinalizeRouterAbEd25519NearTransactionNormalSigning(args) {
 	}) : await tryFinalizeRouterAbEd25519NormalSigningSignature({
 		thresholdSessionId: args.thresholdSessionId,
 		walletSessionState: args.walletSessionState,
+		sessionCoordinator: args.sessionCoordinator,
 		thresholdKeyMaterial: args.thresholdKeyMaterial,
 		walletId: args.walletId,
 		nearAccountId: args.nearAccountId,
@@ -766,7 +874,8 @@ async function tryFinalizeRouterAbEd25519NearTransactionNormalSigning(args) {
 		signingPayloadLabel: "NEAR payload digest",
 		prepare,
 		credential,
-		authorization: "reusable_wallet_session"
+		authorization: "reusable_wallet_session",
+		startedResponse: started?.response
 	});
 	const finalized = await finalizeThresholdEd25519NearTxFromSignatureWasm({
 		unsignedTransactionBorshB64u: unsigned.unsignedTransactionBorshB64u,
@@ -808,6 +917,6 @@ async function tryFinalizeRouterAbEd25519NearTransactionNormalSigning(args) {
 	};
 }
 //#endregion
-export { buildNearEd25519OperationStepUpProof, buildNearEmailOtpEd25519OperationStepUpProof, finalizeThresholdEd25519DelegateSignatureResult, prepareRouterAbEd25519NearTransactionOperationStepUp, prepareRouterAbEd25519SignatureOnlyOperationStepUp, requireIssuedNearEd25519OperationStepUpAuthorization, requireNearEd25519OperationStepUpProof, tryFinalizeRouterAbEd25519NearTransactionNormalSigning, tryFinalizeRouterAbEd25519SignatureOnlyNormalSigning };
+export { abandonRouterAbEd25519StartedPrepare, buildNearEd25519OperationStepUpProof, buildNearEmailOtpEd25519OperationStepUpProof, finalizeThresholdEd25519DelegateSignatureResult, prepareRouterAbEd25519NearTransactionOperationStepUp, prepareRouterAbEd25519SignatureOnlyOperationStepUp, requireIssuedNearEd25519OperationStepUpAuthorization, requireNearEd25519OperationStepUpProof, startRouterAbEd25519NearTransactionPrepare, startRouterAbEd25519SignatureOnlyPrepare, tryFinalizeRouterAbEd25519NearTransactionNormalSigning, tryFinalizeRouterAbEd25519SignatureOnlyNormalSigning };
 
 //# sourceMappingURL=ed25519YaoNormalSigning.js.map

package/dist/esm/core/signingEngine/flows/signNear/shared/implicitAccountFundingPort.js

@@ -11,14 +11,7 @@ function registerNearImplicitAccountFunder(input) {
 function clearNearImplicitAccountFunder(requestId) {
 	pendingFunders.delete(String(requestId || "").trim());
 }
-const nearImplicitAccountFundingPort = { async fund(input) {
-	const requestId = requireFunderRequestId(input.requestId);
-	const funder = pendingFunders.get(requestId);
-	if (!funder) throw new Error("[SigningEngine][near] implicit-account funding is unavailable");
-	pendingFunders.delete(requestId);
-	return await funder(input.request);
-} };
 //#endregion
-export { clearNearImplicitAccountFunder, nearImplicitAccountFundingPort, registerNearImplicitAccountFunder };
+export { clearNearImplicitAccountFunder, registerNearImplicitAccountFunder };
 
 //# sourceMappingURL=implicitAccountFundingPort.js.map

package/dist/esm/core/signingEngine/flows/signNear/shared/operationStepUpPreparation.js

@@ -1,6 +1,4 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../../shared-ts/src/utils/domainIds.js";
-import { secureRandomBase64Url } from "../../../../../shared-ts/src/utils/secureRandomId.js";
-import { computeCapabilityOperationFingerprintDigest } from "../../../../../shared-ts/src/authorization/operationFingerprint.js";
 import { parseNearOperationStepUpPreparationRef } from "../../../interfaces/operationStepUpPreparation.js";
 //#region src/core/signingEngine/flows/signNear/shared/operationStepUpPreparation.ts
 const pendingBuilders = /* @__PURE__ */ new Map();
@@ -16,41 +14,6 @@ function registerNearOperationStepUpBuilder(input) {
 function clearNearOperationStepUpBuilder(requestId) {
 	pendingBuilders.delete(String(requestId || "").trim());
 }
-const nearOperationStepUpPreparationPort = {
-	async prepare(input) {
-		const requestId = requirePreparationIdentity(input.requestId, "requestId");
-		const builder = pendingBuilders.get(requestId);
-		if (!builder) throw new Error("[SigningEngine][near] operation step-up preparation is unavailable");
-		pendingBuilders.delete(requestId);
-		const prepared = input.kind === "near_transaction" ? await builder({
-			kind: "near_transaction",
-			transactionContext: input.transactionContext,
-			operationId: requirePreparationIdentity(input.operationId, "operationId"),
-			operationFingerprint: requirePreparationIdentity(input.operationFingerprint, "operationFingerprint"),
-			displayDigest: requirePreparationIdentity(input.displayDigest, "displayDigest")
-		}) : await builder({
-			kind: "near_signature_only",
-			displayDigest: requirePreparationIdentity(input.displayDigest, "displayDigest")
-		});
-		const challengeB64u = await computeCapabilityOperationFingerprintDigest(prepared.envelope);
-		const ref = parseNearOperationStepUpPreparationRef({
-			kind: "near_operation_step_up_prepared_v1",
-			handle: `near-operation-step-up:${secureRandomBase64Url(24, "operation step-up handle")}`,
-			challengeB64u
-		});
-		preparedOperations.set(ref.handle, {
-			requestId,
-			operation: prepared.operation
-		});
-		return ref;
-	},
-	cancel(input) {
-		const requestId = String(input.requestId || "").trim();
-		if (requestId) pendingBuilders.delete(requestId);
-		if (input.handle) preparedOperations.delete(input.handle);
-		for (const [handle, prepared] of preparedOperations) if (prepared.requestId === requestId) preparedOperations.delete(handle);
-	}
-};
 function consumePreparedNearOperationStepUp(input) {
 	const requestId = requirePreparationIdentity(input.requestId, "requestId");
 	const handle = requirePreparationIdentity(parseNearOperationStepUpPreparationRef(input.ref).handle, "operation step-up handle");
@@ -63,6 +26,6 @@ function requireNearOperationStepUpMaterialActivation(args) {
 	if (!mpcMaterialActivationRefsEqual(args.expected, args.actual)) throw new Error("[SigningEngine][near] operation assertion changed material activation");
 }
 //#endregion
-export { clearNearOperationStepUpBuilder, consumePreparedNearOperationStepUp, nearOperationStepUpPreparationPort, registerNearOperationStepUpBuilder, requireNearOperationStepUpMaterialActivation };
+export { clearNearOperationStepUpBuilder, consumePreparedNearOperationStepUp, registerNearOperationStepUpBuilder, requireNearOperationStepUpMaterialActivation };
 
 //# sourceMappingURL=operationStepUpPreparation.js.map

package/dist/esm/core/signingEngine/flows/signNear/shared/signatureOnlySigning.js

@@ -1,14 +1,15 @@
 import { SigningSessionIds, SigningSessionPlanKind } from "../../../session/operationState/types.js";
 import { nearEd25519SignerBindingFromBoundaryFields } from "../../../session/identity/exactSigningLaneIdentity.js";
+import { computeUiIntentDigestFromNep413 } from "../../../../../utils/intentDigest.js";
+import { parseSigningOperationFingerprintDigest } from "../../../../../shared-ts/src/authorization/operationFingerprint.js";
 import { SigningOperationCommandKind, runSigningOperationCommand } from "../../shared/signingStateMachine.js";
-import { requireNearStepUpAuth, signingAuthPlanForNearMaterialRequirement } from "../requireNearStepUpAuth.js";
 import { buildSigningConfirmationAuthParams } from "../../../stepUpConfirmation/confirmOperation.js";
 import { confirmationConfigForSigningAuthPlan, runSigningConfirmationCommand } from "../../shared/signingConfirmation.js";
+import { requireNearStepUpAuth, signingAuthPlanForNearMaterialRequirement } from "../requireNearStepUpAuth.js";
 import { emitNearSigningConfirmationProgress } from "./confirmationProgress.js";
 import { buildNearEd25519StepUpAuthorization } from "../stepUpAuthorization.js";
-import { parseSigningOperationFingerprintDigest } from "../../../../../shared-ts/src/authorization/operationFingerprint.js";
 import { clearNearOperationStepUpBuilder, consumePreparedNearOperationStepUp, registerNearOperationStepUpBuilder } from "./operationStepUpPreparation.js";
-import { buildNearEd25519OperationStepUpProof, prepareRouterAbEd25519SignatureOnlyOperationStepUp, requireIssuedNearEd25519OperationStepUpAuthorization, tryFinalizeRouterAbEd25519SignatureOnlyNormalSigning } from "./ed25519YaoNormalSigning.js";
+import { abandonRouterAbEd25519StartedPrepare, buildNearEd25519OperationStepUpProof, prepareRouterAbEd25519SignatureOnlyOperationStepUp, requireIssuedNearEd25519OperationStepUpAuthorization, startRouterAbEd25519SignatureOnlyPrepare, tryFinalizeRouterAbEd25519SignatureOnlyNormalSigning } from "./ed25519YaoNormalSigning.js";
 import { nearOperationStepUpMaterialFacts, prepareNearOperationStepUpMaterial, resolveConfirmedNearEd25519YaoCapability, resolveNearOperationStepUpMaterial } from "./ed25519YaoCapabilityResolution.js";
 import { planSigningSession } from "../../../session/planning/planner.js";
 import { buildNearSigningSessionAuthPlan, resolveNearSigningSessionAuthContext } from "./signingSessionAuthMode.js";
@@ -239,9 +240,49 @@ function authorizeNearSignatureOnlyOperation(operation, stepUp, confirmation) {
 		...requireOperationStepUpMaterial(operation.label, stepUp.operationStepUp)
 	};
 }
-async function resolveNearSignatureOnlySigningMaterial(operation, authorization) {
+/**
+* Sends the server prepare of a warm-session NEP-413 signature while the
+* confirmation dialog is open. The request is bound to the digest the dialog
+* shows and to the signing digest. A confirmation that returns another digest,
+* a declined confirmation or a step-up leaves the prepare to expire with its
+* lease; the quota use it claimed stays spent.
+*/
+async function startNearSignatureOnlyPrepare(operation, stepUp, signingSessionCoordinator) {
+	if (stepUp.preparedStepUp.kind !== "warm_session" || operation.intent.kind !== "nep413_message_v1") return null;
+	const resolved = await resolveConfirmedNearEd25519YaoCapability({
+		preparation: operation.preparation,
+		executor: operation.executor
+	});
+	const walletSessionState = requireAuthorizedWalletSessionState(await signingSessionCoordinator.resolveActiveAuthorizedRouterAbEd25519WalletSessionState({
+		state: resolved.walletSessionState,
+		nowMs: Date.now()
+	}));
+	const started = await startRouterAbEd25519SignatureOnlyPrepare({
+		ctx: operation.ctx,
+		thresholdSessionId: resolved.thresholdSessionId,
+		activeClient: resolved.material.activeClient,
+		walletSessionState,
+		walletId: operation.walletId,
+		thresholdKeyMaterial: operation.thresholdKeyMaterial,
+		nearAccountId: operation.nearAccountId,
+		operationId: operation.signingOperation.operationId,
+		operationFingerprint: operation.signingOperation.operationFingerprint,
+		displayDigest: await computeUiIntentDigestFromNep413({
+			nearAccountId: operation.nearAccountId,
+			recipient: operation.intent.recipient,
+			message: operation.intent.message
+		}),
+		signingDigestB64u: await operation.computeSigningDigestB64u(),
+		intent: operation.intent
+	});
+	return started ? {
+		resolved,
+		started
+	} : null;
+}
+async function resolveNearSignatureOnlySigningMaterial(operation, authorization, startedPrepare = null) {
 	if (authorization.kind === "warm_session") {
-		const resolved = await resolveConfirmedNearEd25519YaoCapability({
+		const resolved = startedPrepare?.resolved ?? await resolveConfirmedNearEd25519YaoCapability({
 			preparation: operation.preparation,
 			executor: operation.executor
 		});
@@ -249,9 +290,11 @@ async function resolveNearSignatureOnlySigningMaterial(operation, authorization)
 			kind: "warm_session",
 			thresholdSessionId: resolved.thresholdSessionId,
 			displayDigest: authorization.displayDigest,
-			resolved
+			resolved,
+			startedPrepare: startedPrepare?.started
 		};
 	}
+	if (startedPrepare) abandonRouterAbEd25519StartedPrepare(startedPrepare.started);
 	return {
 		kind: "operation_step_up",
 		thresholdSessionId: nearOperationStepUpMaterialFacts(authorization.material).thresholdSessionId,
@@ -276,6 +319,7 @@ async function signNearSignatureOnlyOperation(operation, material, signingSessio
 		ctx: operation.ctx,
 		thresholdSessionId: material.thresholdSessionId,
 		activeClient: material.resolved.material.activeClient,
+		sessionCoordinator: signingSessionCoordinator,
 		walletSessionState: requireAuthorizedWalletSessionState(await signingSessionCoordinator.resolveActiveAuthorizedRouterAbEd25519WalletSessionState({
 			state: material.resolved.walletSessionState,
 			nowMs: Date.now()
@@ -288,7 +332,8 @@ async function signNearSignatureOnlyOperation(operation, material, signingSessio
 		displayDigest: material.displayDigest,
 		signingDigestB64u,
 		intent: operation.intent,
-		authorization: { kind: "reusable_wallet_session" }
+		authorization: { kind: "reusable_wallet_session" },
+		startedPrepare: material.startedPrepare
 	}) : await tryFinalizeRouterAbEd25519SignatureOnlyNormalSigning({
 		ctx: operation.ctx,
 		thresholdSessionId: material.thresholdSessionId,
@@ -336,6 +381,6 @@ async function runNearSignatureOnlySignCommand(operation, execute) {
 	});
 }
 //#endregion
-export { authorizeNearSignatureOnlyOperation, confirmNearSignatureOnlyOperation, prepareNearSignatureOnlyStepUp, resolveNearSignatureOnlySigningMaterial, resolveNearSignatureOnlySigningPlans, runNearSignatureOnlySignCommand, signNearSignatureOnlyOperation };
+export { authorizeNearSignatureOnlyOperation, confirmNearSignatureOnlyOperation, prepareNearSignatureOnlyStepUp, resolveNearSignatureOnlySigningMaterial, resolveNearSignatureOnlySigningPlans, runNearSignatureOnlySignCommand, signNearSignatureOnlyOperation, startNearSignatureOnlyPrepare };
 
 //# sourceMappingURL=signatureOnlySigning.js.map

package/dist/esm/core/signingEngine/flows/signNear/signDelegate.js

@@ -1,16 +1,16 @@
+import { WorkerResponseType } from "../../../types/signer-worker.js";
+import { resolveNearNetwork, resolvePrimaryNearRpcUrl } from "../../../config/chains.js";
+import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
+import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from "../../../config/defaultConfigs.js";
 import { ensureEd25519Prefix } from "../../../../shared-ts/src/utils/near.js";
 import { toAccountId } from "../../../types/accountIds.js";
 import { SigningEventPhase, createSigningFlowEvent } from "../../../types/sdkSentEvents.js";
-import { resolveNearNetwork, resolvePrimaryNearRpcUrl } from "../../../config/chains.js";
-import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
 import { SigningOperationIntent, SigningSessionIds } from "../../session/operationState/types.js";
 import { isWarmSessionSigningAuthPlan } from "../../stepUpConfirmation/types.js";
-import { PASSKEY_MANAGER_DEFAULT_CONFIGS } from "../../../config/defaultConfigs.js";
+import { SigningOperationCommandKind, runSigningOperationCommand } from "../shared/signingStateMachine.js";
 import { resolveNearSigningMaterials } from "./shared/signingMaterials.js";
 import { buildNearDelegateSigningPayloads } from "../../chains/near/payloads.js";
 import { parseThresholdEd25519NearAction, thresholdEd25519DelegateActionOperationFingerprint } from "../../../../shared-ts/src/threshold/ed25519OperationFingerprint.js";
-import { SigningOperationCommandKind, runSigningOperationCommand } from "../shared/signingStateMachine.js";
-import { WorkerResponseType } from "../../../types/signer-worker.js";
 import { computeThresholdEd25519DelegateSigningDigestWasm } from "../../chains/near/nearSignerWasm.js";
 import { finalizeThresholdEd25519DelegateSignatureResult } from "./shared/ed25519YaoNormalSigning.js";
 import { toPublicKeyString } from "../../workerManager/validation.js";