@kingdomchain/wallet-client 0.6.1 → 0.6.3

package/dist/index.d.ts

@@ -413,6 +413,18 @@ interface VaultStorageOptions {
     /** When set, vault is stored under this account-scoped key instead of {@link VAULT_LEGACY_KEY}. */
     scopeId?: string;
 }
+/**
+ * Encrypted, expiring session-unlock cache (see {@link file://./sessionCache.ts}).
+ * The `key` is a non-extractable AES-GCM {@link CryptoKey} stored directly in
+ * IndexedDB via structured clone — its raw bytes can never be read back out by
+ * any JavaScript. `ciphertext`/`iv` are base64; `expiresAt` is epoch millis.
+ */
+interface EmbeddedWalletSessionCacheRecord {
+    key: CryptoKey;
+    iv: string;
+    ciphertext: string;
+    expiresAt: number;
+}
 interface PasscodeLockoutRecord {
     failedAttempts: number;
     lockoutTier: number;
@@ -425,6 +437,42 @@ declare function clearVaultFromIndexedDb(options?: VaultStorageOptions): Promise
 declare function loadPasscodeLockoutRecord(publicAddress: string): Promise<PasscodeLockoutRecord | null>;
 declare function savePasscodeLockoutRecord(publicAddress: string, record: PasscodeLockoutRecord): Promise<void>;
 declare function clearPasscodeLockoutRecord(publicAddress: string): Promise<void>;
+declare function saveSessionCacheRecord(record: EmbeddedWalletSessionCacheRecord, options?: VaultStorageOptions): Promise<void>;
+declare function loadSessionCacheRecord(options?: VaultStorageOptions): Promise<EmbeddedWalletSessionCacheRecord | null>;
+declare function clearSessionCacheRecord(options?: VaultStorageOptions): Promise<void>;
+
+/**
+ * How long a passcode/passkey unlock stays valid across page reloads and new
+ * tabs (same browser, same device) before the unlock form is required again.
+ *
+ * Phase 1 session-persistent unlock: 12 hours of wall-clock time from the last
+ * unlock. Deliberately bounded — not "until tab closes" (too strict, reintroduces
+ * daily friction) and not "forever" (that is phase 2's job, backed by WebAuthn).
+ * Tune here; it is intentionally the single source of truth for the window.
+ */
+declare const EMBEDDED_WALLET_SESSION_TTL_MS: number;
+interface CacheUnlockedSessionOptions extends VaultStorageOptions {
+    /** Decrypted vault material needed to rebuild the signer without the passcode. */
+    plaintext: EmbeddedWalletPlaintext;
+    /** Override the default session window (mainly for tests). */
+    ttlMs?: number;
+}
+/**
+ * Encrypt the just-decrypted session material under a fresh non-extractable key
+ * and persist it (with an expiry) so a reload or new tab can restore the signer
+ * without re-prompting for the passcode. Best-effort: callers should not fail an
+ * unlock if this throws.
+ */
+declare function cacheUnlockedSession(options: CacheUnlockedSessionOptions): Promise<void>;
+/**
+ * Restore the decrypted session material from the cache for a scope, or return
+ * `null` when there is nothing valid cached. "No session" is a normal, expected
+ * state — this never throws for it. An expired or undecryptable record is wiped
+ * and treated as `null`.
+ */
+declare function restoreCachedSessionPlaintext(options?: VaultStorageOptions): Promise<EmbeddedWalletPlaintext | null>;
+/** Wipe the cached session key + ciphertext for a scope. */
+declare function clearUnlockedSession(options?: VaultStorageOptions): Promise<void>;
 
 /** Consecutive wrong passcodes before lockout triggers. */
 declare const PASSCODE_LOCKOUT_FAILURE_THRESHOLD = 5;
@@ -582,7 +630,20 @@ declare function enableEmbeddedPasskeyUnlock(options: EnableEmbeddedPasskeyUnloc
 }>;
 /** Unlock existing vault with passcode (default) or passkey (opt-in upgrade path). */
 declare function unlockEmbeddedWallet(options?: UnlockEmbeddedWalletOptions): Promise<EmbeddedWalletSession>;
-/** Clear in-memory signer. */
+/**
+ * Silently restore a still-valid unlock cached by a previous {@link unlockEmbeddedWallet}
+ * (this page load, a prior one, or another tab in the same browser), without the
+ * passcode. Returns the same session shape {@link unlockEmbeddedWallet} returns,
+ * or `null` when nothing valid is cached — "no session" is a normal state and is
+ * never thrown. The vault encryption/passcode mechanism is untouched; this only
+ * reads a parallel, expiring session cache.
+ */
+declare function tryRestoreUnlockedSession(options?: EmbeddedWalletScopeOptions): Promise<EmbeddedWalletSession | null>;
+/**
+ * Clear the in-memory signer and wipe the persistent session cache for the
+ * active scope. Wiring the cache clear here guarantees an explicit lock/logout
+ * never leaves a silent-unlock path alive.
+ */
 declare function lockEmbeddedWallet(): void;
 declare function getEmbeddedWalletSession(): EmbeddedWalletSession | null;
 /** Offline signer for CosmJS; enforces backup gate before signing. */
@@ -743,4 +804,4 @@ interface MessageFns<T> {
     fromPartial(object: DeepPartial<T>): T;
 }
 
-export { ATTESTATION_TYPE_CITIZENSHIP_APPLICATION, ATTESTATION_TYPE_RECOVERY, type AcknowledgeEmbeddedBackupOptions, ApplicationStatus, type AttestationPayloadInput, BECH32_PREFIX, type BankBalanceResponse, type BroadcastConfirmOptions, type BroadcastConfirmResult, type BrowserWalletApi, CHAIN_COIN_TYPE, type ChainCurrency, type ChainInfo, CitizenTxError, type CitizenTxErrorCode, type ClearEmbeddedWalletOptions, type CosmostationWindowApi, type CreateEmbeddedWalletOptions, DEFAULT_CHAIN_ID, DEFAULT_REST_URL, DEFAULT_RPC_URL, EMBEDDED_WALLET_KDF_PBKDF2, EMBEDDED_WALLET_KDF_PIN, EMBEDDED_WALLET_KDF_PRF, EMBEDDED_WALLET_KEY_DIRECT_ENTROPY, EMBEDDED_WALLET_KEY_HD_DERIVED, EMBEDDED_WALLET_PASSCODE_MAX_LENGTH, EMBEDDED_WALLET_PASSCODE_MIN_LENGTH, EMBEDDED_WALLET_PASSKEY_PBKDF2_ITERATIONS, EMBEDDED_WALLET_PIN_PBKDF2_ITERATIONS, EMBEDDED_WALLET_RECOVERY_PHRASE_DIRECT_ENTROPY_WARNING, EMBEDDED_WALLET_RECOVERY_PHRASE_GENERAL_WARNING, EMBEDDED_WALLET_VAULT_VERSION, type EmbeddedWalletBackupFileV1, EmbeddedWalletBackupRequiredError, EmbeddedWalletDecryptError, type EmbeddedWalletKdf, type EmbeddedWalletKeyType, EmbeddedWalletLockoutError, type EmbeddedWalletPlaintext, type EmbeddedWalletRecoveryPhraseReveal, type EmbeddedWalletRecoveryPhraseWarning, type EmbeddedWalletScopeOptions, type EmbeddedWalletSession, EmbeddedWalletVaultError, type EmbeddedWalletVaultV1, EmbeddedWalletWeakPasscodeError, type EnableEmbeddedPasskeyUnlockOptions, type EncryptWalletOptions, type FeeGrantAllowancesResponse, FinalizedReward, type ImportEmbeddedBackupOptions, InvalidChainConfigError, type MigrateLegacyEmbeddedWalletOptions, MsgClaimReward, MsgSubmitApplication, MsgSubmitRecoveryAttestation, PASSCODE_LOCKOUT_FAILURE_THRESHOLD, PASSCODE_LOCKOUT_INITIAL_MS, PASSCODE_LOCKOUT_MAX_MS, type PasscodeBlockReason, type PasscodeLockoutRecord, type PasscodeStrengthLabel, type PasscodeStrengthResult, type PasskeyAssertionResult, type PasskeyRegistrationResult, type RecoverEmbeddedWalletOptions, RecoveryAttestationStatus, RestQueryError, type RevealEmbeddedRecoveryPhraseOptions, RpcConnectionError, type SubmitApplicationParams, UKDR_DECIMALS, UKDR_DISPLAY_DENOM, UKDR_MINIMAL_DENOM, type UnclaimedRewardsResponse, type UnlockEmbeddedWalletOptions, VAULT_LEGACY_KEY, type VaultStorageOptions, WALLETCONNECT_COSMOS_METHODS, WALLETCONNECT_COSMOS_NAMESPACE, WEBAUTHN_RP_NAME, WalletAccountError, type WalletConnectChainConfig, type WalletConnectConnectResult, type WalletConnectMetadata, WalletConnectNotInitializedError, WalletConnectSessionError, WalletConnectSigningError, WalletConnectionError, WalletConnectionRejectedError, WalletNotInstalledError, type WebAuthnPrfCapabilities, WebAuthnUnavailableError, WebAuthnUserCancelledError, acknowledgeEmbeddedBackup, addressFromHdMnemonic, addressFromPrivateKey, assertPasscodeAllowedForCreation, assertPasscodeUnlockAllowed, assertPasskey, assertValidPasscode, assertValidRecoveryMnemonic, assertVaultPermitsTransaction, attestationSignPayload, broadcastAndConfirmTx, buildClaimRewardMsg, buildKingdomChainInfo, buildRequiredCosmosNamespaces, buildSendUkdrMsg, buildSubmitApplicationMsg, citizenTxErrorMessage, clearEmbeddedWallet, clearPasscodeLockoutRecord, clearVaultFromIndexedDb, computePasscodeLockoutDurationMs, connectCosmostation, connectKeplr, connectLeap, connectWalletConnect, createBrowserSigningClient, createEmbeddedWallet, createHdDerivedPlaintext, createKingdomChainRegistry, createPasskeyMaterialFromAssertion, createPbkdf2Salt, createWalletConnectOfflineSigner, decodeCredentialId, decodeDirectEntropyMnemonic, decryptWalletPayload, defaultEmbeddedHdPath, defaultUkdrTxFee, deriveKekFromPasscode, deriveKekFromPbkdf2, deriveKekFromPrf, derivePrivateKeyFromHdMnemonic, detectRecoveryMnemonicKeyType, detectWebAuthnPrfCapabilities, disconnectWalletConnect, downloadEmbeddedBackupFile, embeddedPlaintextToSigner, enableEmbeddedPasskeyUnlock, encodeCredentialId, encodeDirectEntropyMnemonic, encryptWalletPayload, evaluatePasscodeStrength, exportEncryptedBackup, fetchFeeGrantGranter, fetchUkdrBalance, fetchUnclaimedFinalizedRewards, formatUkdrAsKdr, getCosmostationKeplrApi, getEmbeddedOfflineSigner, getEmbeddedWalletSession, getPasscodeLockoutState, hasEmbeddedWallet, hasLegacyEmbeddedWallet, hasMixedCharacterClasses, importEmbeddedBackup, initWalletConnectClient, isCosmostationAvailable, isKeplrAvailable, isLeapAvailable, loadPasscodeLockoutRecord, loadVaultFromIndexedDb, lockEmbeddedWallet, markVaultBackupAcknowledged, migrateLegacyEmbeddedWallet, normalizePasscode, normalizeRecoveryMnemonic, parseEncryptedBackup, parseKdrToUkdr, parseWalletConnectAccount, plaintextFromRecoveryMnemonic, providerSeedFromHex, publicKeyFromPrivateSeed, readPrfOutput, recordPasscodeUnlockFailure, recordPasscodeUnlockSuccess, recoverEmbeddedWalletFromMnemonic, recoveryMnemonicAddress, recoveryMnemonicFromPlaintext, registerPasskey, resolvePlaintextKeyType, resolveVaultStorageKey, restoreWalletConnectSession, revealEmbeddedRecoveryPhrase, savePasscodeLockoutRecord, saveVaultToIndexedDb, selectEmbeddedWalletKdf, serializeBackupFile, signAttestationPayload, signCitizenshipAttestation, suggestAndConnect, toWalletConnectCosmosChainId, ukdrCoin, unlockEmbeddedWallet, validateChainConfig, vaultUsesPasscodeUnlock, vaultUsesPasskeyUnlock };
+export { ATTESTATION_TYPE_CITIZENSHIP_APPLICATION, ATTESTATION_TYPE_RECOVERY, type AcknowledgeEmbeddedBackupOptions, ApplicationStatus, type AttestationPayloadInput, BECH32_PREFIX, type BankBalanceResponse, type BroadcastConfirmOptions, type BroadcastConfirmResult, type BrowserWalletApi, CHAIN_COIN_TYPE, type CacheUnlockedSessionOptions, type ChainCurrency, type ChainInfo, CitizenTxError, type CitizenTxErrorCode, type ClearEmbeddedWalletOptions, type CosmostationWindowApi, type CreateEmbeddedWalletOptions, DEFAULT_CHAIN_ID, DEFAULT_REST_URL, DEFAULT_RPC_URL, EMBEDDED_WALLET_KDF_PBKDF2, EMBEDDED_WALLET_KDF_PIN, EMBEDDED_WALLET_KDF_PRF, EMBEDDED_WALLET_KEY_DIRECT_ENTROPY, EMBEDDED_WALLET_KEY_HD_DERIVED, EMBEDDED_WALLET_PASSCODE_MAX_LENGTH, EMBEDDED_WALLET_PASSCODE_MIN_LENGTH, EMBEDDED_WALLET_PASSKEY_PBKDF2_ITERATIONS, EMBEDDED_WALLET_PIN_PBKDF2_ITERATIONS, EMBEDDED_WALLET_RECOVERY_PHRASE_DIRECT_ENTROPY_WARNING, EMBEDDED_WALLET_RECOVERY_PHRASE_GENERAL_WARNING, EMBEDDED_WALLET_SESSION_TTL_MS, EMBEDDED_WALLET_VAULT_VERSION, type EmbeddedWalletBackupFileV1, EmbeddedWalletBackupRequiredError, EmbeddedWalletDecryptError, type EmbeddedWalletKdf, type EmbeddedWalletKeyType, EmbeddedWalletLockoutError, type EmbeddedWalletPlaintext, type EmbeddedWalletRecoveryPhraseReveal, type EmbeddedWalletRecoveryPhraseWarning, type EmbeddedWalletScopeOptions, type EmbeddedWalletSession, type EmbeddedWalletSessionCacheRecord, EmbeddedWalletVaultError, type EmbeddedWalletVaultV1, EmbeddedWalletWeakPasscodeError, type EnableEmbeddedPasskeyUnlockOptions, type EncryptWalletOptions, type FeeGrantAllowancesResponse, FinalizedReward, type ImportEmbeddedBackupOptions, InvalidChainConfigError, type MigrateLegacyEmbeddedWalletOptions, MsgClaimReward, MsgSubmitApplication, MsgSubmitRecoveryAttestation, PASSCODE_LOCKOUT_FAILURE_THRESHOLD, PASSCODE_LOCKOUT_INITIAL_MS, PASSCODE_LOCKOUT_MAX_MS, type PasscodeBlockReason, type PasscodeLockoutRecord, type PasscodeStrengthLabel, type PasscodeStrengthResult, type PasskeyAssertionResult, type PasskeyRegistrationResult, type RecoverEmbeddedWalletOptions, RecoveryAttestationStatus, RestQueryError, type RevealEmbeddedRecoveryPhraseOptions, RpcConnectionError, type SubmitApplicationParams, UKDR_DECIMALS, UKDR_DISPLAY_DENOM, UKDR_MINIMAL_DENOM, type UnclaimedRewardsResponse, type UnlockEmbeddedWalletOptions, VAULT_LEGACY_KEY, type VaultStorageOptions, WALLETCONNECT_COSMOS_METHODS, WALLETCONNECT_COSMOS_NAMESPACE, WEBAUTHN_RP_NAME, WalletAccountError, type WalletConnectChainConfig, type WalletConnectConnectResult, type WalletConnectMetadata, WalletConnectNotInitializedError, WalletConnectSessionError, WalletConnectSigningError, WalletConnectionError, WalletConnectionRejectedError, WalletNotInstalledError, type WebAuthnPrfCapabilities, WebAuthnUnavailableError, WebAuthnUserCancelledError, acknowledgeEmbeddedBackup, addressFromHdMnemonic, addressFromPrivateKey, assertPasscodeAllowedForCreation, assertPasscodeUnlockAllowed, assertPasskey, assertValidPasscode, assertValidRecoveryMnemonic, assertVaultPermitsTransaction, attestationSignPayload, broadcastAndConfirmTx, buildClaimRewardMsg, buildKingdomChainInfo, buildRequiredCosmosNamespaces, buildSendUkdrMsg, buildSubmitApplicationMsg, cacheUnlockedSession, citizenTxErrorMessage, clearEmbeddedWallet, clearPasscodeLockoutRecord, clearSessionCacheRecord, clearUnlockedSession, clearVaultFromIndexedDb, computePasscodeLockoutDurationMs, connectCosmostation, connectKeplr, connectLeap, connectWalletConnect, createBrowserSigningClient, createEmbeddedWallet, createHdDerivedPlaintext, createKingdomChainRegistry, createPasskeyMaterialFromAssertion, createPbkdf2Salt, createWalletConnectOfflineSigner, decodeCredentialId, decodeDirectEntropyMnemonic, decryptWalletPayload, defaultEmbeddedHdPath, defaultUkdrTxFee, deriveKekFromPasscode, deriveKekFromPbkdf2, deriveKekFromPrf, derivePrivateKeyFromHdMnemonic, detectRecoveryMnemonicKeyType, detectWebAuthnPrfCapabilities, disconnectWalletConnect, downloadEmbeddedBackupFile, embeddedPlaintextToSigner, enableEmbeddedPasskeyUnlock, encodeCredentialId, encodeDirectEntropyMnemonic, encryptWalletPayload, evaluatePasscodeStrength, exportEncryptedBackup, fetchFeeGrantGranter, fetchUkdrBalance, fetchUnclaimedFinalizedRewards, formatUkdrAsKdr, getCosmostationKeplrApi, getEmbeddedOfflineSigner, getEmbeddedWalletSession, getPasscodeLockoutState, hasEmbeddedWallet, hasLegacyEmbeddedWallet, hasMixedCharacterClasses, importEmbeddedBackup, initWalletConnectClient, isCosmostationAvailable, isKeplrAvailable, isLeapAvailable, loadPasscodeLockoutRecord, loadSessionCacheRecord, loadVaultFromIndexedDb, lockEmbeddedWallet, markVaultBackupAcknowledged, migrateLegacyEmbeddedWallet, normalizePasscode, normalizeRecoveryMnemonic, parseEncryptedBackup, parseKdrToUkdr, parseWalletConnectAccount, plaintextFromRecoveryMnemonic, providerSeedFromHex, publicKeyFromPrivateSeed, readPrfOutput, recordPasscodeUnlockFailure, recordPasscodeUnlockSuccess, recoverEmbeddedWalletFromMnemonic, recoveryMnemonicAddress, recoveryMnemonicFromPlaintext, registerPasskey, resolvePlaintextKeyType, resolveVaultStorageKey, restoreCachedSessionPlaintext, restoreWalletConnectSession, revealEmbeddedRecoveryPhrase, savePasscodeLockoutRecord, saveSessionCacheRecord, saveVaultToIndexedDb, selectEmbeddedWalletKdf, serializeBackupFile, signAttestationPayload, signCitizenshipAttestation, suggestAndConnect, toWalletConnectCosmosChainId, tryRestoreUnlockedSession, ukdrCoin, unlockEmbeddedWallet, validateChainConfig, vaultUsesPasscodeUnlock, vaultUsesPasskeyUnlock };

package/dist/index.js

@@ -2519,9 +2519,10 @@ function decodeCredentialId(encoded) {
 
 // src/embeddedWallet/storage.ts
 var DB_NAME = "kingdom-os-wallet";
-var DB_VERSION = 2;
+var DB_VERSION = 3;
 var VAULT_STORE_NAME = "vault";
 var LOCKOUT_STORE_NAME = "passcode-lockout";
+var SESSION_STORE_NAME = "session-cache";
 var VAULT_LEGACY_KEY = "primary";
 function resolveVaultStorageKey(scopeId) {
   const trimmed = scopeId?.trim();
@@ -2539,6 +2540,9 @@ function openDb() {
       if (!db.objectStoreNames.contains(LOCKOUT_STORE_NAME)) {
         db.createObjectStore(LOCKOUT_STORE_NAME);
       }
+      if (!db.objectStoreNames.contains(SESSION_STORE_NAME)) {
+        db.createObjectStore(SESSION_STORE_NAME);
+      }
     };
     request.onsuccess = () => resolve(request.result);
   });
@@ -2613,6 +2617,115 @@ async function clearPasscodeLockoutRecord(publicAddress) {
   });
   db.close();
 }
+async function saveSessionCacheRecord(record, options = {}) {
+  const key = resolveVaultStorageKey(options.scopeId);
+  const db = await openDb();
+  await new Promise((resolve, reject) => {
+    const tx = db.transaction(SESSION_STORE_NAME, "readwrite");
+    tx.objectStore(SESSION_STORE_NAME).put(record, key);
+    tx.oncomplete = () => resolve();
+    tx.onerror = () => reject(tx.error ?? new Error("IndexedDB write failed"));
+  });
+  db.close();
+}
+async function loadSessionCacheRecord(options = {}) {
+  const key = resolveVaultStorageKey(options.scopeId);
+  const db = await openDb();
+  const record = await new Promise((resolve, reject) => {
+    const tx = db.transaction(SESSION_STORE_NAME, "readonly");
+    const request = tx.objectStore(SESSION_STORE_NAME).get(key);
+    request.onsuccess = () => resolve(request.result ?? null);
+    request.onerror = () => reject(request.error ?? new Error("IndexedDB read failed"));
+  });
+  db.close();
+  return record;
+}
+async function clearSessionCacheRecord(options = {}) {
+  const key = resolveVaultStorageKey(options.scopeId);
+  const db = await openDb();
+  await new Promise((resolve, reject) => {
+    const tx = db.transaction(SESSION_STORE_NAME, "readwrite");
+    tx.objectStore(SESSION_STORE_NAME).delete(key);
+    tx.oncomplete = () => resolve();
+    tx.onerror = () => reject(tx.error ?? new Error("IndexedDB delete failed"));
+  });
+  db.close();
+}
+var EMBEDDED_WALLET_SESSION_TTL_MS = 12 * 60 * 60 * 1e3;
+var AES_GCM_IV_BYTES2 = 12;
+function serializeSessionPlaintext(plaintext) {
+  const wire = {
+    privateKey: toBase64(plaintext.privateKey),
+    hdPath: plaintext.hdPath,
+    createdAt: plaintext.createdAt,
+    keyType: plaintext.keyType ?? EMBEDDED_WALLET_KEY_DIRECT_ENTROPY
+  };
+  if (plaintext.mnemonic) {
+    wire.mnemonic = plaintext.mnemonic;
+  }
+  return new TextEncoder().encode(JSON.stringify(wire));
+}
+function deserializeSessionPlaintext(bytes) {
+  const wire = JSON.parse(new TextDecoder().decode(bytes));
+  const plaintext = {
+    privateKey: fromBase64(wire.privateKey),
+    hdPath: wire.hdPath,
+    createdAt: wire.createdAt,
+    keyType: wire.keyType ?? EMBEDDED_WALLET_KEY_DIRECT_ENTROPY
+  };
+  if (wire.mnemonic) {
+    plaintext.mnemonic = wire.mnemonic;
+  }
+  return plaintext;
+}
+async function generateNonExtractableSessionKey() {
+  return crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, false, [
+    "encrypt",
+    "decrypt"
+  ]);
+}
+async function cacheUnlockedSession(options) {
+  const { plaintext, ttlMs, ...storageOptions } = options;
+  const key = await generateNonExtractableSessionKey();
+  const iv = crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES2));
+  const material = serializeSessionPlaintext(plaintext);
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    key,
+    new Uint8Array(material)
+  );
+  const record = {
+    key,
+    iv: toBase64(iv),
+    ciphertext: toBase64(new Uint8Array(ciphertext)),
+    expiresAt: Date.now() + (ttlMs ?? EMBEDDED_WALLET_SESSION_TTL_MS)
+  };
+  await saveSessionCacheRecord(record, storageOptions);
+}
+async function restoreCachedSessionPlaintext(options = {}) {
+  const record = await loadSessionCacheRecord(options);
+  if (!record) {
+    return null;
+  }
+  if (typeof record.expiresAt !== "number" || Date.now() >= record.expiresAt) {
+    await clearSessionCacheRecord(options).catch(() => void 0);
+    return null;
+  }
+  try {
+    const plaintextBytes = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: new Uint8Array(fromBase64(record.iv)) },
+      record.key,
+      new Uint8Array(fromBase64(record.ciphertext))
+    );
+    return deserializeSessionPlaintext(new Uint8Array(plaintextBytes));
+  } catch {
+    await clearSessionCacheRecord(options).catch(() => void 0);
+    return null;
+  }
+}
+async function clearUnlockedSession(options = {}) {
+  await clearSessionCacheRecord(options);
+}
 
 // src/embeddedWallet/lockout.ts
 var PASSCODE_LOCKOUT_FAILURE_THRESHOLD = 5;
@@ -2905,24 +3018,25 @@ async function encryptPlaintextWithPasskeyRegistration(plaintext, registration,
   return { address: account.address, vault };
 }
 async function unlockVaultToSession(vault, options = {}) {
+  const scopeId = scopeFromOptions(options);
+  let plaintext;
   if (vaultUsesPasscodeUnlock(vault)) {
-    const plaintext2 = await decryptVaultWithPasscodeProtected(vault, options.passcode);
-    const signer2 = await embeddedPlaintextToSigner(plaintext2);
-    const [account2] = await signer2.getAccounts();
-    const session2 = { address: account2.address, vault, signer: signer2 };
-    activeSession = session2;
-    activeScopeId = scopeFromOptions(options);
-    return session2;
-  }
-  const credentialId = decodeCredentialId(vault.credentialId);
-  const prfSalt = vault.prfSalt ? decodeCredentialId(vault.prfSalt) : void 0;
-  const assertion = await assertPasskey({ credentialId, rpId: void 0, prfSalt });
-  const plaintext = await decryptVaultWithUnlockMaterial(vault, void 0, assertion);
+    plaintext = await decryptVaultWithPasscodeProtected(vault, options.passcode);
+  } else {
+    const credentialId = decodeCredentialId(vault.credentialId);
+    const prfSalt = vault.prfSalt ? decodeCredentialId(vault.prfSalt) : void 0;
+    const assertion = await assertPasskey({ credentialId, rpId: void 0, prfSalt });
+    plaintext = await decryptVaultWithUnlockMaterial(vault, void 0, assertion);
+  }
   const signer = await embeddedPlaintextToSigner(plaintext);
   const [account] = await signer.getAccounts();
   const session = { address: account.address, vault, signer };
   activeSession = session;
-  activeScopeId = scopeFromOptions(options);
+  activeScopeId = scopeId;
+  try {
+    await cacheUnlockedSession({ scopeId, plaintext });
+  } catch {
+  }
   return session;
 }
 async function hasEmbeddedWallet(options = {}) {
@@ -3084,9 +3198,33 @@ async function unlockEmbeddedWallet(options = {}) {
   }
   return unlockVaultToSession(vault, options);
 }
+async function tryRestoreUnlockedSession(options = {}) {
+  const scopeId = scopeFromOptions(options) ?? activeScopeId;
+  const plaintext = await restoreCachedSessionPlaintext({ scopeId });
+  if (!plaintext) {
+    return null;
+  }
+  const vault = await loadVaultForScope(scopeId);
+  if (!vault) {
+    await clearUnlockedSession({ scopeId }).catch(() => void 0);
+    return null;
+  }
+  const signer = await embeddedPlaintextToSigner(plaintext);
+  const [account] = await signer.getAccounts();
+  if (account.address !== vault.publicAddress) {
+    await clearUnlockedSession({ scopeId }).catch(() => void 0);
+    return null;
+  }
+  const session = { address: account.address, vault, signer };
+  activeSession = session;
+  activeScopeId = scopeId;
+  return session;
+}
 function lockEmbeddedWallet() {
+  const scopeId = activeScopeId;
   activeSession = null;
   activeScopeId = void 0;
+  void clearUnlockedSession({ scopeId }).catch(() => void 0);
 }
 function getEmbeddedWalletSession() {
   return activeSession;
@@ -3141,6 +3279,7 @@ async function importEmbeddedBackup(json, options = {}) {
 async function clearEmbeddedWallet(options = {}) {
   const scopeId = scopeFromOptions(options) ?? activeScopeId;
   lockEmbeddedWallet();
+  await clearUnlockedSession({ scopeId });
   await clearVaultFromIndexedDb({ scopeId });
 }
 
@@ -3352,14 +3491,33 @@ function citizenTxErrorMessage(code) {
       return "The transaction could not be completed. Please try again.";
   }
 }
+function withTimeout(promise, ms, label) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(
+      () => reject(new Error(`[citizenTx] ${label} did not respond within ${ms}ms`)),
+      ms
+    );
+  });
+  return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
 async function broadcastAndConfirmTx(client, signerAddress, messages, fee, memo = "", options = {}) {
   const pollIntervalMs = options.pollIntervalMs ?? 1500;
   const timeoutMs = options.timeoutMs ?? 9e4;
   let deliverTx;
   try {
-    deliverTx = await client.signAndBroadcast(signerAddress, messages, fee, memo);
+    console.log("[citizenTx] signAndBroadcast: starting", { signerAddress, messages });
+    deliverTx = await withTimeout(
+      client.signAndBroadcast(signerAddress, messages, fee, memo),
+      2e4,
+      "signAndBroadcast"
+    );
+    console.log("[citizenTx] signAndBroadcast: settled", {
+      code: deliverTx.code,
+      hash: deliverTx.transactionHash
+    });
   } catch (err) {
-    console.error("[citizenTx] broadcast threw before inclusion:", err);
+    console.error("[citizenTx] broadcast threw or timed out before inclusion:", err);
     const message = err instanceof Error ? err.message : String(err);
     if (message.toLowerCase().includes("insufficient")) {
       throw new CitizenTxError(citizenTxErrorMessage("INSUFFICIENT_FEE"), "INSUFFICIENT_FEE", err);
@@ -3377,7 +3535,8 @@ async function broadcastAndConfirmTx(client, signerAddress, messages, fee, memo
   const hash = deliverTx.transactionHash;
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
-    const indexed = await client.getTx(hash);
+    console.log("[citizenTx] getTx poll: checking", { hash });
+    const indexed = await withTimeout(client.getTx(hash), 15e3, `getTx(${hash})`);
     if (indexed) {
       if (indexed.code !== 0) {
         console.error("[citizenTx] indexed tx failed:", {
@@ -3403,6 +3562,6 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-export { ATTESTATION_TYPE_CITIZENSHIP_APPLICATION, ATTESTATION_TYPE_RECOVERY, ApplicationStatus, BECH32_PREFIX, CHAIN_COIN_TYPE, CitizenTxError, DEFAULT_CHAIN_ID, DEFAULT_REST_URL, DEFAULT_RPC_URL, EMBEDDED_WALLET_KDF_PBKDF2, EMBEDDED_WALLET_KDF_PIN, EMBEDDED_WALLET_KDF_PRF, EMBEDDED_WALLET_KEY_DIRECT_ENTROPY, EMBEDDED_WALLET_KEY_HD_DERIVED, EMBEDDED_WALLET_PASSCODE_MAX_LENGTH, EMBEDDED_WALLET_PASSCODE_MIN_LENGTH, EMBEDDED_WALLET_PASSKEY_PBKDF2_ITERATIONS, EMBEDDED_WALLET_PIN_PBKDF2_ITERATIONS, EMBEDDED_WALLET_RECOVERY_PHRASE_DIRECT_ENTROPY_WARNING, EMBEDDED_WALLET_RECOVERY_PHRASE_GENERAL_WARNING, EMBEDDED_WALLET_VAULT_VERSION, EmbeddedWalletBackupRequiredError, EmbeddedWalletDecryptError, EmbeddedWalletLockoutError, EmbeddedWalletVaultError, EmbeddedWalletWeakPasscodeError, InvalidChainConfigError, MsgClaimReward, MsgSubmitApplication, MsgSubmitRecoveryAttestation, PASSCODE_LOCKOUT_FAILURE_THRESHOLD, PASSCODE_LOCKOUT_INITIAL_MS, PASSCODE_LOCKOUT_MAX_MS, RecoveryAttestationStatus, RestQueryError, RpcConnectionError, UKDR_DECIMALS, UKDR_DISPLAY_DENOM, UKDR_MINIMAL_DENOM, VAULT_LEGACY_KEY, WALLETCONNECT_COSMOS_METHODS, WALLETCONNECT_COSMOS_NAMESPACE, WEBAUTHN_RP_NAME, WalletAccountError, WalletConnectNotInitializedError, WalletConnectSessionError, WalletConnectSigningError, WalletConnectionError, WalletConnectionRejectedError, WalletNotInstalledError, WebAuthnUnavailableError, WebAuthnUserCancelledError, acknowledgeEmbeddedBackup, addressFromHdMnemonic, addressFromPrivateKey, assertPasscodeAllowedForCreation, assertPasscodeUnlockAllowed, assertPasskey, assertValidPasscode, assertValidRecoveryMnemonic, assertVaultPermitsTransaction, attestationSignPayload, broadcastAndConfirmTx, buildClaimRewardMsg, buildKingdomChainInfo, buildRequiredCosmosNamespaces, buildSendUkdrMsg, buildSubmitApplicationMsg, citizenTxErrorMessage, clearEmbeddedWallet, clearPasscodeLockoutRecord, clearVaultFromIndexedDb, computePasscodeLockoutDurationMs, connectCosmostation, connectKeplr, connectLeap, connectWalletConnect, createBrowserSigningClient, createEmbeddedWallet, createHdDerivedPlaintext, createKingdomChainRegistry, createPasskeyMaterialFromAssertion, createPbkdf2Salt, createWalletConnectOfflineSigner, decodeCredentialId, decodeDirectEntropyMnemonic, decryptWalletPayload, defaultEmbeddedHdPath, defaultUkdrTxFee, deriveKekFromPasscode, deriveKekFromPbkdf2, deriveKekFromPrf, derivePrivateKeyFromHdMnemonic, detectRecoveryMnemonicKeyType, detectWebAuthnPrfCapabilities, disconnectWalletConnect, downloadEmbeddedBackupFile, embeddedPlaintextToSigner, enableEmbeddedPasskeyUnlock, encodeCredentialId, encodeDirectEntropyMnemonic, encryptWalletPayload, evaluatePasscodeStrength, exportEncryptedBackup, fetchFeeGrantGranter, fetchUkdrBalance, fetchUnclaimedFinalizedRewards, formatUkdrAsKdr, getCosmostationKeplrApi, getEmbeddedOfflineSigner, getEmbeddedWalletSession, getPasscodeLockoutState, hasEmbeddedWallet, hasLegacyEmbeddedWallet, hasMixedCharacterClasses, importEmbeddedBackup, initWalletConnectClient, isCosmostationAvailable, isKeplrAvailable, isLeapAvailable, loadPasscodeLockoutRecord, loadVaultFromIndexedDb, lockEmbeddedWallet, markVaultBackupAcknowledged, migrateLegacyEmbeddedWallet, normalizePasscode, normalizeRecoveryMnemonic, parseEncryptedBackup, parseKdrToUkdr, parseWalletConnectAccount, plaintextFromRecoveryMnemonic, providerSeedFromHex, publicKeyFromPrivateSeed, readPrfOutput, recordPasscodeUnlockFailure, recordPasscodeUnlockSuccess, recoverEmbeddedWalletFromMnemonic, recoveryMnemonicAddress, recoveryMnemonicFromPlaintext, registerPasskey, resolvePlaintextKeyType, resolveVaultStorageKey, restoreWalletConnectSession, revealEmbeddedRecoveryPhrase, savePasscodeLockoutRecord, saveVaultToIndexedDb, selectEmbeddedWalletKdf, serializeBackupFile, signAttestationPayload, signCitizenshipAttestation, suggestAndConnect, toWalletConnectCosmosChainId, ukdrCoin, unlockEmbeddedWallet, validateChainConfig, vaultUsesPasscodeUnlock, vaultUsesPasskeyUnlock };
+export { ATTESTATION_TYPE_CITIZENSHIP_APPLICATION, ATTESTATION_TYPE_RECOVERY, ApplicationStatus, BECH32_PREFIX, CHAIN_COIN_TYPE, CitizenTxError, DEFAULT_CHAIN_ID, DEFAULT_REST_URL, DEFAULT_RPC_URL, EMBEDDED_WALLET_KDF_PBKDF2, EMBEDDED_WALLET_KDF_PIN, EMBEDDED_WALLET_KDF_PRF, EMBEDDED_WALLET_KEY_DIRECT_ENTROPY, EMBEDDED_WALLET_KEY_HD_DERIVED, EMBEDDED_WALLET_PASSCODE_MAX_LENGTH, EMBEDDED_WALLET_PASSCODE_MIN_LENGTH, EMBEDDED_WALLET_PASSKEY_PBKDF2_ITERATIONS, EMBEDDED_WALLET_PIN_PBKDF2_ITERATIONS, EMBEDDED_WALLET_RECOVERY_PHRASE_DIRECT_ENTROPY_WARNING, EMBEDDED_WALLET_RECOVERY_PHRASE_GENERAL_WARNING, EMBEDDED_WALLET_SESSION_TTL_MS, EMBEDDED_WALLET_VAULT_VERSION, EmbeddedWalletBackupRequiredError, EmbeddedWalletDecryptError, EmbeddedWalletLockoutError, EmbeddedWalletVaultError, EmbeddedWalletWeakPasscodeError, InvalidChainConfigError, MsgClaimReward, MsgSubmitApplication, MsgSubmitRecoveryAttestation, PASSCODE_LOCKOUT_FAILURE_THRESHOLD, PASSCODE_LOCKOUT_INITIAL_MS, PASSCODE_LOCKOUT_MAX_MS, RecoveryAttestationStatus, RestQueryError, RpcConnectionError, UKDR_DECIMALS, UKDR_DISPLAY_DENOM, UKDR_MINIMAL_DENOM, VAULT_LEGACY_KEY, WALLETCONNECT_COSMOS_METHODS, WALLETCONNECT_COSMOS_NAMESPACE, WEBAUTHN_RP_NAME, WalletAccountError, WalletConnectNotInitializedError, WalletConnectSessionError, WalletConnectSigningError, WalletConnectionError, WalletConnectionRejectedError, WalletNotInstalledError, WebAuthnUnavailableError, WebAuthnUserCancelledError, acknowledgeEmbeddedBackup, addressFromHdMnemonic, addressFromPrivateKey, assertPasscodeAllowedForCreation, assertPasscodeUnlockAllowed, assertPasskey, assertValidPasscode, assertValidRecoveryMnemonic, assertVaultPermitsTransaction, attestationSignPayload, broadcastAndConfirmTx, buildClaimRewardMsg, buildKingdomChainInfo, buildRequiredCosmosNamespaces, buildSendUkdrMsg, buildSubmitApplicationMsg, cacheUnlockedSession, citizenTxErrorMessage, clearEmbeddedWallet, clearPasscodeLockoutRecord, clearSessionCacheRecord, clearUnlockedSession, clearVaultFromIndexedDb, computePasscodeLockoutDurationMs, connectCosmostation, connectKeplr, connectLeap, connectWalletConnect, createBrowserSigningClient, createEmbeddedWallet, createHdDerivedPlaintext, createKingdomChainRegistry, createPasskeyMaterialFromAssertion, createPbkdf2Salt, createWalletConnectOfflineSigner, decodeCredentialId, decodeDirectEntropyMnemonic, decryptWalletPayload, defaultEmbeddedHdPath, defaultUkdrTxFee, deriveKekFromPasscode, deriveKekFromPbkdf2, deriveKekFromPrf, derivePrivateKeyFromHdMnemonic, detectRecoveryMnemonicKeyType, detectWebAuthnPrfCapabilities, disconnectWalletConnect, downloadEmbeddedBackupFile, embeddedPlaintextToSigner, enableEmbeddedPasskeyUnlock, encodeCredentialId, encodeDirectEntropyMnemonic, encryptWalletPayload, evaluatePasscodeStrength, exportEncryptedBackup, fetchFeeGrantGranter, fetchUkdrBalance, fetchUnclaimedFinalizedRewards, formatUkdrAsKdr, getCosmostationKeplrApi, getEmbeddedOfflineSigner, getEmbeddedWalletSession, getPasscodeLockoutState, hasEmbeddedWallet, hasLegacyEmbeddedWallet, hasMixedCharacterClasses, importEmbeddedBackup, initWalletConnectClient, isCosmostationAvailable, isKeplrAvailable, isLeapAvailable, loadPasscodeLockoutRecord, loadSessionCacheRecord, loadVaultFromIndexedDb, lockEmbeddedWallet, markVaultBackupAcknowledged, migrateLegacyEmbeddedWallet, normalizePasscode, normalizeRecoveryMnemonic, parseEncryptedBackup, parseKdrToUkdr, parseWalletConnectAccount, plaintextFromRecoveryMnemonic, providerSeedFromHex, publicKeyFromPrivateSeed, readPrfOutput, recordPasscodeUnlockFailure, recordPasscodeUnlockSuccess, recoverEmbeddedWalletFromMnemonic, recoveryMnemonicAddress, recoveryMnemonicFromPlaintext, registerPasskey, resolvePlaintextKeyType, resolveVaultStorageKey, restoreCachedSessionPlaintext, restoreWalletConnectSession, revealEmbeddedRecoveryPhrase, savePasscodeLockoutRecord, saveSessionCacheRecord, saveVaultToIndexedDb, selectEmbeddedWalletKdf, serializeBackupFile, signAttestationPayload, signCitizenshipAttestation, suggestAndConnect, toWalletConnectCosmosChainId, tryRestoreUnlockedSession, ukdrCoin, unlockEmbeddedWallet, validateChainConfig, vaultUsesPasscodeUnlock, vaultUsesPasskeyUnlock };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map