fix(step-up): stop prompting where the flow already proves the passkey

[jjramirezn]

Summary

FE half of peanutprotocol/peanut-api-ts#1241 — removes stepUp: true from prepareWithdrawal and submitWithdrawSessionApproval. These flows are self-proving (admin EIP-712 / enable signature follow immediately from the same passkey), so the step-up assertion added by #2463 only added a third fingerprint sheet to every collateral-funded send (the triple-prompt reports from Hugo and Jota, confirmed on-chain: the send tx carries exactly 2 WebAuthn signatures).

Card PAN/CVV/PIN and bank-account add keep step-up.

Risks / breaking changes

• Deploy order: backend PR first. If STEP_UP_ENFORCED is on and this ships before the BE drops the gate, withdraw prepare would 401.

QA

• prettier clean, step-up service tests pass (8/8), 0 typecheck errors in changed file. 3 failing suites are the known missing-submodule worktree gotcha (content/countryCurrency/add-money), green in CI.
• After both deploy: a collateral-funded send link = 2 fingerprint prompts (admin sig + userop); card-detail reveal still prompts.

Screenshots: N/A (no UI change — prompt-count behavior only)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
peanut-wallet	Building	Preview, Comment	Jul 24, 2026 10:34pm

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a2b16c11-2678-45e4-adab-da2f36847d08

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/step-up-self-proving-withdrawals

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Code-analysis diff

Painscore total: 6267.93 → 6268.05 (+0.12)
Findings: 0 net (+2 new, -2 resolved)

🆕 New findings (2)

• critical complexity — src/services/rain.ts — CC 65, MI 60.08, SLOC 262
• medium hotspot — src/services/rain.ts — 27 commits, +868/-119 lines since 6 months ago

✅ Resolved (2)

• src/services/rain.ts — CC 65, MI 59.99, SLOC 264
• src/services/rain.ts — 26 commits, +859/-117 lines since 6 months ago

[github-actions]

🧪 UI test report — ✅ all green

Suites

• ✅ unit: 2142 ran, 0 failed, 0 skipped, 36.4s

📊 Coverage (unit)

metric	%
statements	60.7%
branches	44.2%
functions	49.9%
lines	61.1%

⏱ 10 slowest test cases

time	test
4.0s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › never places two stickers in heavy overlap (broad seed sweep)
1.2s	src/utils/__tests__/demo-api.test.ts › isDemoMode() is false when not running under Capacitor
0.4s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › every sticker stays within canvas at any count
0.4s	src/app/actions/__tests__/api-headers.test.ts › should include Content-Type in validateInviteCode
0.3s	src/app/actions/__tests__/api-headers-extended.test.ts › should not include apiKey in validateInviteCode body
0.3s	src/app/(mobile-ui)/withdraw/__tests__/withdraw-states.test.tsx › Bank withdrawal keeps the $1 minimum for sub-$1 amounts
0.3s	src/components/Card/share-asset/__tests__/shareAssetLayout.test.ts › keeps stickers off the username pill (final pass respects the keep-out)
0.2s	src/utils/__tests__/demo-balance.test.ts › debits and floors at zero
0.2s	src/utils/__tests__/demo-balance.test.ts › starts at the full balance on a fresh install and stamps a timestamp
0.2s	src/utils/__tests__/demo.test.ts › is false on web even when the localStorage flag is set directly

_{📍 Inline annotations are in the **Unit test report** check above. Coverage artifact: `coverage-unit`. Generated by `.github/workflows/tests.yml`.}

[jjramirezn]

Superseded by hotfix #2515 (targets main). dev gets it via back-merge.