fix(core): report expired sessions without logging the passkey out

[mariano-aguero]

What

When a session expires while the page is open, the provider now tells the dApp: it drops the signer, emits accountsChanged with an empty list and disconnect, and answers later requests as it would for a first visit. The passkey stays logged in and the transport stays up, so reconnecting takes one approval. Signing requests made without a session also clean up their temporary signer when they fail.

Why

A signer restored from an earlier visit kept answering after its session had expired. The dApp kept showing the account, and the first signing request came back with 4100, which the provider read as a dead session and tore down completely: passkey logged out, iframe dropped. The provider now treats a signer with no stored account as not connected and reports it once.

A 4100 now disconnects only the session the failing request went through. A late error from a signer that was already dropped cannot log out a session a parallel connect just set up, and a reconnect approved while a read dropped the signer puts that signer back and emits connect.

The ephemeral signer used for wallet_sendCalls, wallet_sign, the permission methods and wallet_addFunds left session keys (CrossPlatform) or a persisted account (AppSpecific) behind when the request was rejected. Cleanup now runs in a finally, and AppSpecificSigner.cleanup clears its own state even when the UI handler's cleanup throws. If a connect finished while the temporary signer was open, its cleanup is skipped, because the stored account, signer type and keys now belong to the new session.

Backend refusals from #321 are kept: a 4100 the backend marks as a refusal still never disconnects, so the teardown now needs all three: a 4100, from the signer this request used, that is not a backend refusal. Two new tests send a 403 through the real AppSpecific signer, on a live session and on an expired one, and both fail if the refusal check is removed.

The provider conformance suite now runs in both authentication modes, and the comment on the chain lists says the readonly guard is shallow.

Closes N/A. Part of ENGR-1282.

How to test

bun install
bunx nx run-many -t typecheck lint test --projects=@jaw.id/core
bunx nx build @jaw.id/core

By hand, in the playground in AppSpecific mode: connect, then shorten the session (or move the clock past the auth TTL) and call eth_accounts. The dApp should receive accountsChanged with [] and one disconnect, and a reconnect should ask for the passkey once without a fresh login. Rejecting a wallet_sendCalls made while disconnected should leave no stored account behind.

Checklist

• The title is a conventional commit and reads as the subject it becomes on squash. nx release takes the version bump from its type
• bunx prettier --check . and bunx nx affected -t lint test typecheck build api-check pass, which is what CI runs
• @jaw.id/core's public API is unchanged, or bunx nx api-update @jaw.id/core ran and the report diff is part of this PR
• Docs updated, if this changes behaviour somebody integrates against

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
demo	Ready	Preview	Sep 23, 2026 5:01pm UTC
jaw-docs	Ready	Preview	Sep 23, 2026 5:01pm UTC
keys-jaw-id	Ready	Preview	Sep 23, 2026 5:01pm UTC
playground	Ready	Preview	Sep 23, 2026 5:01pm UTC

[linear]

ENGR-1282

[justalab-agents]

Findings outside the diff

These sit on lines this PR did not change, but this PR is what makes them wrong. They cannot be posted as inline comments.

• [WARNING] .github:2 — Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: amannn/action-semantic-pull-request@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Reviewer callouts (1)

Non-blocking observations. Nothing here needs to change before merge.

• .github:1 — "The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see actions/runner-images#14748"