@openzeppelin/miden-multisig-client 0.17.0 → 0.18.0-rc.1

package/README.md

@@ -17,9 +17,14 @@ Miden multisig accounts store their authentication logic on-chain, but **their s
 ## Installation
 
 ```bash
-npm install @openzeppelin/miden-multisig-client @miden-sdk/miden-sdk@0.16.0
+npm install @openzeppelin/miden-multisig-client@0.18.0-rc.1 @miden-sdk/miden-sdk@0.17.0-rc.3
 ```
 
+Miden 0.17 requires a new client database: a store created under 0.16 does
+not open. Pass a fresh `storeName` when creating the `MidenClient`, or delete
+the existing IndexedDB database first. Accounts and pending proposals from the
+0.16 line do not carry over; see the compatibility document below.
+
 > **Why the peer version is exact**: the transaction-summary layout and the
 > guarded-multisig procedure roots are only byte-compatible between one
 > `@miden-sdk/miden-sdk` build and the `miden-standards` version its WASM
@@ -32,6 +37,7 @@ matches your Miden node:
 
 | This package | Miden protocol |
 |---|---|
+| 0.18.x | 0.17.x (pre-release) |
 | 0.17.x | 0.16.x |
 | 0.16.x | 0.15.x |
 | 0.15.x | 0.15.x |
@@ -69,6 +75,42 @@ const client = new MultisigClient(midenClient, {
 });
 ```
 
+For an ECDSA cosigner using an EIP-1193 wallet (including Ledger), call
+`Eip712Signer.connect(provider)` once to select the Ethereum address and
+recover its secp256k1 public key from a dedicated key-discovery signature.
+Alternatively, pass an already-enrolled public key and its matching address
+to `new Eip712Signer(provider, publicKeyHex, address)`. `LedgerSigner` remains
+an alias. Use the resulting signer with the same `client.load(accountId, signer)`,
+proposal-creation methods, and
+`multisig.signProposal(id)` flow as a raw signer. The Ledger user can create
+the proposal, then approve it. The approval and Guardian submission each
+require a separate `eth_signTypedData_v4` signature; authenticated reads in
+the flow also prompt the device. All signatures use the enrolled key; no
+separate Guardian signing endpoint is needed. The device displays hashes,
+not human-readable transferred assets. `recoverByKey` uses a separate
+`GuardianLookup(bytes32 lookupHash)` typed-data signature to discover accounts.
+EIP-712 execution requires an account compiled with the Miden 0.17 multisig
+authentication component; changing Guardian's signature format does not upgrade
+an older account's code root.
+
+For example, a Ledger-backed proposer follows the same proposal lifecycle as a
+raw signer:
+
+```typescript
+import { Eip712Signer } from '@openzeppelin/miden-multisig-client';
+
+const signer = await Eip712Signer.connect(provider); // key-discovery prompt
+const multisig = await client.load(accountId, signer); // authenticated reads may prompt
+const proposal = await multisig.createAddSignerProposal(newSignerCommitment); // request-auth prompt
+await multisig.signProposal(proposal.id); // EIP-712 approval and request-auth prompts
+await multisig.executeProposal(proposal.id); // authenticated calls may prompt again
+```
+
+The proposal ID is the transaction-summary commitment. The wallet signs an
+EIP-712 digest derived from that commitment, so the digest displayed by the
+wallet need not equal the proposal ID. The approval signature and the
+Guardian request-authentication signature are separate.
+
 The nested `prover` configuration is optional. Without it, the injected Miden
 client's prover is preserved. By default, cloneable remote provers get two total
 attempts; endpoint-less injected provers, including local and callback provers,
@@ -232,6 +274,13 @@ the min of the current threshold and the remaining signer count on remove.
 The option shapes are exported as `CreateProposalOptions`,
 `CreateSignerProposalOptions`, and `CreateP2idProposalOptions`.
 
+All methods also accept `approvalExpirationDelta` (1 to 65535): the number of blocks after
+the proposal's anchor block by which the transaction must be included. Past
+that block the approvers' signatures no longer authorize it, the SDK refuses to
+execute it, and the node rejects it as expired. The summary binds the value, so
+the executing party cannot change it. Omitted, the approval never expires,
+which is the Miden default.
+
 > **Breaking change (issue #387):** these methods previously took `nonce` (and
 > `newThreshold`) as positional parameters. Passing the old positional form
 > now throws at runtime instead of silently applying defaults.
@@ -264,7 +313,7 @@ console.log('Signatures:', signedProposal.signatures.length);
 
 ### Sync Proposals
 
-Fetches proposals from the GUARDIAN server and updates local state:
+Fetches proposals from the GUARDIAN server and reconciles local state. A proposal GUARDIAN reported on an earlier sync but no longer reports (executed, canonicalized, or abandoned) is pruned from the cache. A proposal GUARDIAN holds but has not listed yet (a freshly pushed create) survives the first listing that omits it, absorbing a read-your-writes lag, and is pruned once a second consecutive listing omits it. Proposals GUARDIAN never received (offline switch-guardian creations and imports) are not pruned by listings. The response is parsed in full before the cache changes (a malformed payload rejects and leaves the cache untouched), a proposal that fails metadata-binding verification is still cached and returned with `verification.status === 'failed'` (see [Proposal Verification Status](#proposal-verification-status)), a proposal executed or signed offline while a sync is in flight keeps that local outcome (it is neither reverted to the listed state nor pruned by that sync), and overlapping calls share a single in-flight sync:
 
 ```typescript
 const proposals = await multisig.syncProposals();
@@ -325,6 +374,45 @@ for (const p of proposals) {
 }
 ```
 
+### Proposal Verification Status
+
+`syncProposals()` checks every proposal's metadata against its signed
+summary and records the outcome in `proposal.verification`:
+`{ status: 'unchecked' }`, `{ status: 'verified' }`, or
+`{ status: 'failed', retryable, message }`. A proposal that fails the
+check is still returned, so one stale or corrupt proposal cannot hide the
+others; only the check itself writes `verified`, and a freshly parsed or
+imported proposal is `unchecked`. `retryable: true` means the
+re-execution hit a transient node error and the proposal may verify on
+the next sync; `retryable: false` means it cannot be reproduced (tampered
+metadata, or an anchor block the node has pruned) and has to be
+re-proposed. Verification is deliberately not part of `status`: a fully
+signed proposal can be dead, so `'ready'` keeps meaning "threshold met"
+and `isProposalActionable(proposal)` answers "verified and ready".
+`signProposal` and `executeProposal` re-verify the one proposal they act
+on and throw the real error. A payload that does not parse at all still
+rejects, so malformed GUARDIAN data is never silently dropped.
+
+```typescript
+import { isProposalActionable } from '@openzeppelin/miden-multisig-client';
+
+for (const p of await multisig.syncProposals()) {
+  if (p.verification.status === 'failed') {
+    const { retryable, message } = p.verification;
+    console.log(`${p.id}: ${retryable ? 'retry later' : 're-propose'} — ${message}`);
+  } else if (isProposalActionable(p)) {
+    await multisig.executeProposal(p.id);
+  }
+}
+```
+
+Anchored re-execution needs the node to serve account state at the
+proposal's reference block, and nodes keep that history only briefly
+(devnet: about 50 blocks); once it is gone the proposal is reported as
+`failed` with `retryable: false` for everyone, the proposer included.
+Collect signatures and execute promptly, and re-propose once a proposal
+has aged out.
+
 ### Execute a Proposal
 
 When a proposal has enough signatures:
@@ -401,7 +489,7 @@ exported/imported through the normal flow, but the SDK cannot build its on-chain
 transaction — the integration owns that recipe and submits it itself.
 
 ```typescript
-import { buildP2idTransactionRequest } from '@openzeppelin/miden-multisig-client';
+import { buildP2idTransactionRequest, chainAnchorBlockNum } from '@openzeppelin/miden-multisig-client';
 
 // Producer: build a transaction and propose it under a custom label.
 // The options object accepts `noteType` (`NoteType.Public` (default) or
@@ -412,7 +500,12 @@ import { buildP2idTransactionRequest } from '@openzeppelin/miden-multisig-client
 // The typed path is `createP2idProposal(recipient, faucet, amount,
 // { nonce, noteType, reclaimHeight, timelockHeight })`, which persists the
 // choices in signed metadata.
-const { request, salt } = buildP2idTransactionRequest(senderId, recipientId, faucetId, amount);
+//
+// The builder takes the Miden client because the executing account decides
+// the auth args the request has to carry (see below).
+const { request, salt } = await buildP2idTransactionRequest(
+  midenClient, senderId, recipientId, faucetId, amount, { midenRpcEndpoint },
+);
 const proposal = await multisig.createCustomProposal(request.serialize(), 'b2agg');
 
 // Cosigners review and sign through the usual signProposal flow.
@@ -423,51 +516,54 @@ const proposal = await multisig.createCustomProposal(request.serialize(), 'b2agg
 const advice = await multisig.prepareCustomExecution(proposal.id, request.serialize());
 
 // The browser TransactionRequest is immutable, so rebuild from the same recipe
-// (inputs + salt) with the advice, then submit. `submitTransaction` takes the
-// proposal id to execute at the proposal's anchored reference block, since the
-// collected signatures only authorize the summary produced there.
-const { request: finalRequest } = buildP2idTransactionRequest(
-  senderId, recipientId, faucetId, amount, { salt, signatureAdviceMap: advice },
+// (inputs + salt + bound block) with the advice, then submit. `submitTransaction`
+// takes the proposal id to execute at the proposal's anchored reference block,
+// since the collected signatures only authorize the summary produced there.
+const boundBlockNum = chainAnchorBlockNum(proposal.metadata.chainAnchor);
+const { request: finalRequest } = await buildP2idTransactionRequest(
+  midenClient, senderId, recipientId, faucetId, amount,
+  { salt, boundBlockNum, signatureAdviceMap: advice, midenRpcEndpoint },
 );
 await multisig.submitTransaction(proposal.id, finalRequest);
 ```
 
-The exported transaction builders declare the proposal salt through
-`TransactionRequestBuilder.withFeeConversionSalt`. Miden-client derives the
-native 1:1 conversion info from the execution reference header. Integrations
-that build a request directly must retain the original salt and call
-`withFeeConversionSalt(salt)` on their builder when they create and rebuild the
-request.
-
-The integration keeps only its own recipe (build inputs + salt) so it can
-reproduce the exact transaction at execute time — the SDK does not store the
-serialized request. The binding check guarantees the rebuilt transaction matches the
-commitment the cosigners signed.
-
-The salt cannot be recovered from the summary. Once the auth arg became the
-commitment `hash(CONVERSION_INFO || SALT)` it stopped being invertible, so a
-recipe that was not retained cannot be reconstructed from the signed summary —
-keep the salt, or read it from the proposal's `saltHex` metadata, which is what
-the SDK's own execution path does.
-
-The summary exposes the committed auth argument for inspection:
+Since Miden 0.17 a multisig auth procedure reads three words out of the
+transaction's auth arg: the block the summary binds together with the approval
+expiration, the salt, and the fee conversion info. The exported builders get
+them from `client.feeAwareTransactionRequestBuilder(account, { feeConversionSalt,
+boundBlockNum })`, which sets the commitment as the request's auth arg and puts
+the preimage in its advice map. An integration that assembles a request itself
+must start from that builder for a multisig account, and must not call
+`withFeeConversionSalt` or `withAuthArg` on it: the two setters clear each other
+and either one discards the auth args. The approval never expires unless the
+integration asks for one through `approvalExpirationDelta`, which the
+`create*Proposal` methods forward from their options.
+
+The integration keeps its own recipe (build inputs + salt) and reads the bound
+block from the proposal's chain anchor, so it can reproduce the exact
+transaction at execute time — the SDK does not store the serialized request.
+The binding check guarantees the rebuilt transaction matches the commitment the
+cosigners signed. A request built at one sync height and anchored at another is
+refused by `executeForSummary` with `SummaryAnchorMismatchError`; rebuild and
+retry.
+
+The summary binds the salt itself, so the value the cosigners signed over is
+readable back out of it:
 
 ```typescript
-import { summaryAuthArg } from '@openzeppelin/miden-multisig-client';
+import { summarySalt, summaryApprovalExpirationBlockNum } from '@openzeppelin/miden-multisig-client';
 import { TransactionSummary } from '@miden-sdk/miden-sdk';
 
-const signedAuthArg = summaryAuthArg(TransactionSummary.deserialize(bytes));
+const summary = TransactionSummary.deserialize(bytes);
+const salt = summarySalt(summary);
+const expiresAt = summaryApprovalExpirationBlockNum(summary); // undefined: never
 ```
 
-Do not use `signedAuthArg` as the salt when rebuilding the request.
-`withFeeConversionSalt` would derive and commit a second value from it, and the
-rebuilt summary would not match the summary that the cosigners signed.
-
-On the Miden 0.16 line a summary binds seven user-defined elements,
-and the guarded-multisig auth component zeroes the leading three and passes the
-auth arg as the trailing four. `summaryAuthArg` reads that convention, so prefer
-it over indexing `userParams()` by hand. It replaced `summarySalt`, whose name
-claimed an inversion that no longer exists.
+The SDK's own verification path compares `summarySalt(summary)` with the
+proposal's `saltHex` metadata before rebuilding, so a proposal GUARDIAN serves
+with a summary and metadata that disagree fails by name rather than as a
+generic summary mismatch. A request carries the same two values in its auth
+args; `requestSaltHex(request)` and `requestBoundBlockNum(request)` read them.
 
 > **Rust ↔ TS parity:** both SDKs expose the same producer surface —
 > `createCustomProposal` / `propose_custom_transaction`, `prepareCustomExecution` /
@@ -497,8 +593,8 @@ if (recovered.length === 0) {
 ```
 
 The `Signer` passed to `recoverByKey` MUST implement `signLookupMessage`
-(the bundled `FalconSigner` and `EcdsaSigner` both do). The lookup endpoint
-authenticates by proof-of-possession of the queried commitment — same key
+(the bundled `FalconSigner`, `EcdsaSigner`, and `Eip712Signer` do). The lookup
+endpoint authenticates by proof-of-possession of the queried commitment — same key
 that already authenticates per-account requests, so revealing the account ID
 does not grant any new capability. See the design doc for the security
 analysis.
@@ -628,11 +724,26 @@ discriminator.
   [issue #229](https://github.com/OpenZeppelin/guardian/issues/229).
 - **v2 (self-contained)** — `metadataVersion: 2` plus a `notes` array
   of base64-encoded `Note.serialize()` bytes, aligned by index with
-  `noteIds`. Verification rebuilds the request from the embedded notes
-  alone — no `getInputNote`, no network call. Restores the same
-  "rebuild from signed metadata" invariant every other proposal type
-  already satisfied (and that audit finding **M-08** remediated for
-  `p2id`).
+  `noteIds`. Verification rebuilds the request from the embedded notes,
+  never from whatever notes the verifier's store happens to hold.
+  Restores the same "rebuild from signed metadata" invariant every other
+  proposal type already satisfied (and that audit finding **M-08**
+  remediated for `p2id`).
+
+  The rebuild is not store-independent by itself, though: miden-client
+  consumes each input note as *authenticated* when the local store holds
+  its inclusion proof and as *unauthenticated* otherwise, and the two
+  commit differently into the signed summary (issue #409). Authenticated
+  is the canonical mode, so before every rebuild (`syncProposals`,
+  `signProposal`, `executeProposal`) the verifier authenticates the
+  embedded notes: notes already authenticated locally are left alone,
+  the rest get their inclusion proofs from the Miden node in one round
+  trip and are imported into the local store as committed (with one
+  `syncState` if the store is behind the note's block). Verification
+  therefore reads and writes the local store and contacts the node.
+  `createConsumeNotesProposal` does the same before the summary and its
+  chain anchor are captured, and refuses a note that is not yet
+  committed on chain.
 
 `createConsumeNotesProposal` always emits v2 starting with this
 release; the proposer is the one party guaranteed to hold the notes
@@ -645,6 +756,7 @@ signature collection begins.
 import {
   MAX_CONSUME_NOTES_METADATA_BYTES,
   CONSUME_NOTES_METADATA_VERSION_V2,
+  ConsumeNoteNotAuthenticatedError,
   ConsumeNotesMetadataOversizeError,
   LegacyConsumeNotesNoteMissingError,
   NoteBindingMismatchError,
@@ -665,6 +777,7 @@ dashboards can branch on one taxonomy.
 | `UnsupportedMetadataVersionError` | `consume_notes_unsupported_metadata_version` | Unrecognized version (including v1 on a cut-over build) |
 | `ConsumeNotesMetadataOversizeError` | `consume_notes_metadata_oversize` | v2 metadata serialization exceeds 256 KiB at creation |
 | `LegacyConsumeNotesNoteMissingError` | `consume_notes_legacy_note_missing` | v1 path: local store does not contain the referenced note |
+| `ConsumeNoteNotAuthenticatedError` | `consume_notes_note_not_authenticated` | A note could not be authenticated: not committed on chain yet, the node served no proof, the import failed, or the store could not verify it after a sync |
 
 ### Cut-over policy
 

package/dist/account/builder.d.ts

@@ -3,17 +3,17 @@
  *
  * This module provides functionality to create multisig accounts.
  */
-import { type MidenClient } from "@miden-sdk/miden-sdk";
+import { type RawClientSource } from "../raw-client.js";
 import type { MultisigConfig, CreateAccountResult } from "../types.js";
 /**
  * Creates a multisig account with GUARDIAN authentication.
  *
- * @param midenClient - Initialized MidenClient
+ * @param client - Initialized MidenClient, or the WASM client behind one
  * @param config - Multisig configuration
- * @param midenRpcEndpoint - RPC endpoint for the MidenClient's network
+ * @param midenRpcEndpoint - RPC endpoint for the client's network
  * @returns The created account and seed
  */
-export declare function createMultisigAccount(midenClient: MidenClient, config: MultisigConfig, midenRpcEndpoint: string): Promise<CreateAccountResult>;
+export declare function createMultisigAccount(client: RawClientSource, config: MultisigConfig, midenRpcEndpoint: string): Promise<CreateAccountResult>;
 /**
  * Validates a multisig configuration.
  *

package/dist/account/builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../src/account/builder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAQL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAgEvE;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,cAAc,EACtB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,mBAAmB,CAAC,CAiC9B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CA2EnE"}
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../src/account/builder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAgEvE;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,cAAc,EACtB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,mBAAmB,CAAC,CAqC9B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAgFnE"}

package/dist/account/builder.js

@@ -5,6 +5,8 @@
  */
 import { AccountBuilder, AccountStorageMode, AuthGuardedMultisigConfig, ProcedureThreshold, Word, createAuthGuardedMultisig, } from "@miden-sdk/miden-sdk";
 import { getProcedureRoot } from "../procedures.js";
+import { isPublicMidenClient } from "../raw-client.js";
+import { MAX_SIGNERS } from "./layout.js";
 import { normalizeSignerCommitment } from "../utils/signature.js";
 /**
  * Discriminants of the SDK's wasm `AuthScheme` enum, which `AuthGuardedMultisigConfig` takes.
@@ -44,12 +46,12 @@ function buildGuardedMultisigComponent(config) {
 /**
  * Creates a multisig account with GUARDIAN authentication.
  *
- * @param midenClient - Initialized MidenClient
+ * @param client - Initialized MidenClient, or the WASM client behind one
  * @param config - Multisig configuration
- * @param midenRpcEndpoint - RPC endpoint for the MidenClient's network
+ * @param midenRpcEndpoint - RPC endpoint for the client's network
  * @returns The created account and seed
  */
-export async function createMultisigAccount(midenClient, config, midenRpcEndpoint) {
+export async function createMultisigAccount(client, config, midenRpcEndpoint) {
     validateMultisigConfig(config);
     const authComponent = buildGuardedMultisigComponent(config);
     let seed = config.seed;
@@ -67,10 +69,15 @@ export async function createMultisigAccount(midenClient, config, midenRpcEndpoin
         .withAuthComponent(authComponent)
         .withBasicWalletComponent();
     const result = accountBuilder.buildWithoutSchemaCommitment();
-    await midenClient.accounts.insert({
-        account: result.account,
-        overwrite: false,
-    });
+    if (isPublicMidenClient(client)) {
+        await client.accounts.insert({
+            account: result.account,
+            overwrite: false,
+        });
+    }
+    else {
+        await client.newAccount(result.account, false);
+    }
     return {
         account: result.account,
         seed,
@@ -97,6 +104,9 @@ export function validateMultisigConfig(config) {
         }
         signerCommitments.add(normalizedCommitment);
     }
+    if (config.signerCommitments.length > MAX_SIGNERS) {
+        throw new Error(`too many signers (${config.signerCommitments.length}): a multisig account holds at most ${MAX_SIGNERS}`);
+    }
     if (config.threshold > config.signerCommitments.length) {
         throw new Error(`threshold (${config.threshold}) cannot exceed number of signers (${config.signerCommitments.length})`);
     }

package/dist/account/builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"builder.js","sourceRoot":"","sources":["../../src/account/builder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,cAAc,EAEd,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,IAAI,EACJ,yBAAyB,GAE1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAW,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,SAAS,6BAA6B,CACpC,MAAsB;IAEtB,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAC5D,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC,CACpD,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAC3B,yBAAyB,CAAC,MAAM,CAAC,kBAAkB,CAAC,CACrD,CAAC;IACF,MAAM,MAAM,GACV,WAAW,CAAC,MAAM,CAAC,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAEvE,MAAM,UAAU,GAAG,IAAI,yBAAyB,CAC9C,SAAS,EACT,MAAM,CAAC,SAAS,EAChB,QAAQ,EACR,MAAM,CACP,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;QACxC,OAAO,yBAAyB,CAAC,UAAU,CAAC,CAAC,oBAAoB,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAC/C,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,kBAAkB,CACpB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAC/C,KAAK,CAAC,SAAS,CAChB,CACJ,CAAC;IAEF,OAAO,yBAAyB,CAC9B,UAAU,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAC1C,CAAC,oBAAoB,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,WAAwB,EACxB,MAAsB,EACtB,gBAAwB;IAExB,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,aAAa,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC;IAE5D,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACvB,uCAAuC;IACvC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,WAAW,GACf,MAAM,CAAC,WAAW,KAAK,QAAQ;QAC7B,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAC7B,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;IAEnC,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC;SAC5C,WAAW,CAAC,WAAW,CAAC;SACxB,iBAAiB,CAAC,aAAa,CAAC;SAChC,wBAAwB,EAAE,CAAC;IAE9B,MAAM,MAAM,GAAG,cAAc,CAAC,4BAA4B,EAAE,CAAC;IAE7D,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI;KACL,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAsB;IAC3D,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,KAAK,MAAM,gBAAgB,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,oBAAoB,GAAG,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QACzE,IAAI,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,gCAAgC,oBAAoB,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,CAAC,SAAS,sCAAsC,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IACE,iBAAiB,CAAC,GAAG,CAAC,yBAAyB,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAC3E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,4CAA4C;IAC5C,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC5C,IAAI,EAAE,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,EAAE,CAAC,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CACb,wBAAwB,EAAE,CAAC,SAAS,sCAAsC,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAC7G,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,sCAAsC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,mEAAmE;QACnE,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,cAAc,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,CACpD,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,KAAK,4BAA4B,CACtD,EAAE,SAAS,CAAC;QACb,MAAM,eAAe,GAAG,cAAc,IAAI,MAAM,CAAC,SAAS,CAAC;QAE3D,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC5C,IAAI,EAAE,CAAC,SAAS,GAAG,eAAe,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,oCAAoC,EAAE,CAAC,SAAS,KAAK,EAAE,CAAC,SAAS,gBAAgB;oBAC/E,gBAAgB,eAAe,mDAAmD;oBAClF,oFAAoF;oBACpF,wBAAwB,EAAE,CAAC,SAAS,yBAAyB,CAChE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"builder.js","sourceRoot":"","sources":["../../src/account/builder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,cAAc,EAEd,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,IAAI,EACJ,yBAAyB,GAE1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAwB,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAW,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,SAAS,6BAA6B,CACpC,MAAsB;IAEtB,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAC5D,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC,CACpD,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAC3B,yBAAyB,CAAC,MAAM,CAAC,kBAAkB,CAAC,CACrD,CAAC;IACF,MAAM,MAAM,GACV,WAAW,CAAC,MAAM,CAAC,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAEvE,MAAM,UAAU,GAAG,IAAI,yBAAyB,CAC9C,SAAS,EACT,MAAM,CAAC,SAAS,EAChB,QAAQ,EACR,MAAM,CACP,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;QACxC,OAAO,yBAAyB,CAAC,UAAU,CAAC,CAAC,oBAAoB,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAC/C,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,kBAAkB,CACpB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAC/C,KAAK,CAAC,SAAS,CAChB,CACJ,CAAC;IAEF,OAAO,yBAAyB,CAC9B,UAAU,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAC1C,CAAC,oBAAoB,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAuB,EACvB,MAAsB,EACtB,gBAAwB;IAExB,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,aAAa,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC;IAE5D,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACvB,uCAAuC;IACvC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,WAAW,GACf,MAAM,CAAC,WAAW,KAAK,QAAQ;QAC7B,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAC7B,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;IAEnC,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC;SAC5C,WAAW,CAAC,WAAW,CAAC;SACxB,iBAAiB,CAAC,aAAa,CAAC;SAChC,wBAAwB,EAAE,CAAC;IAE9B,MAAM,MAAM,GAAG,cAAc,CAAC,4BAA4B,EAAE,CAAC;IAE7D,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI;KACL,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAsB;IAC3D,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,KAAK,MAAM,gBAAgB,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,oBAAoB,GAAG,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;QACzE,IAAI,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,gCAAgC,oBAAoB,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,qBAAqB,MAAM,CAAC,iBAAiB,CAAC,MAAM,uCAAuC,WAAW,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,CAAC,SAAS,sCAAsC,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IACE,iBAAiB,CAAC,GAAG,CAAC,yBAAyB,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAC3E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,4CAA4C;IAC5C,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC5C,IAAI,EAAE,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,EAAE,CAAC,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CACb,wBAAwB,EAAE,CAAC,SAAS,sCAAsC,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAC7G,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,sCAAsC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,mEAAmE;QACnE,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,cAAc,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,CACpD,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,KAAK,4BAA4B,CACtD,EAAE,SAAS,CAAC;QACb,MAAM,eAAe,GAAG,cAAc,IAAI,MAAM,CAAC,SAAS,CAAC;QAE3D,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC5C,IAAI,EAAE,CAAC,SAAS,GAAG,eAAe,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,oCAAoC,EAAE,CAAC,SAAS,KAAK,EAAE,CAAC,SAAS,gBAAgB;oBAC/E,gBAAgB,eAAe,mDAAmD;oBAClF,oFAAoF;oBACpF,wBAAwB,EAAE,CAAC,SAAS,yBAAyB,CAChE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/account/layout.d.ts

@@ -22,10 +22,10 @@ export declare const GUARDIAN_SLOT_NAMES: {
     readonly SCHEME_ID: "miden::standards::auth::guardian::scheme";
 };
 /**
- * Sanity ceiling for the signer count read from `threshold_config`. The
- * contract has no on-chain maximum (the felt is only asserted to be a u32),
- * so a corrupt or adversarial account could report an arbitrarily large
- * count; readers bound their loops with this instead of trusting it.
+ * The most approvers a multisig account can hold: `ApproverSet::MAX_APPROVERS`
+ * in miden-standards, enforced at account creation and again on-chain by
+ * `update_signers_and_threshold`. Readers bound their loops with it, so a
+ * corrupt `threshold_config` cannot drive an unbounded storage walk.
  */
-export declare const MAX_SIGNERS = 1000;
+export declare const MAX_SIGNERS = 64;
 //# sourceMappingURL=layout.d.ts.map

package/dist/account/layout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../../src/account/layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AAEX,eAAO,MAAM,mBAAmB;;;CAGtB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,WAAW,OAAO,CAAC"}
+{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../../src/account/layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AAEX,eAAO,MAAM,mBAAmB;;;CAGtB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,WAAW,KAAK,CAAC"}

package/dist/account/layout.js

@@ -22,10 +22,10 @@ export const GUARDIAN_SLOT_NAMES = {
     SCHEME_ID: 'miden::standards::auth::guardian::scheme',
 };
 /**
- * Sanity ceiling for the signer count read from `threshold_config`. The
- * contract has no on-chain maximum (the felt is only asserted to be a u32),
- * so a corrupt or adversarial account could report an arbitrarily large
- * count; readers bound their loops with this instead of trusting it.
+ * The most approvers a multisig account can hold: `ApproverSet::MAX_APPROVERS`
+ * in miden-standards, enforced at account creation and again on-chain by
+ * `update_signers_and_threshold`. Readers bound their loops with it, so a
+ * corrupt `threshold_config` cannot drive an unbounded storage walk.
  */
-export const MAX_SIGNERS = 1000;
+export const MAX_SIGNERS = 64;
 //# sourceMappingURL=layout.js.map

package/dist/account/layout.js.map

@@ -1 +1 @@
-{"version":3,"file":"layout.js","sourceRoot":"","sources":["../../src/account/layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,gBAAgB,EAAE,oDAAoD;IACtE,kBAAkB,EAAE,wDAAwD;IAC5E,iBAAiB,EAAE,oDAAoD;IACvE,qBAAqB,EAAE,yDAAyD;IAChF,oBAAoB,EAAE,wDAAwD;CACtE,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,UAAU,EAAE,2CAA2C;IACvD,SAAS,EAAE,0CAA0C;CAC7C,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC"}
+{"version":3,"file":"layout.js","sourceRoot":"","sources":["../../src/account/layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,gBAAgB,EAAE,oDAAoD;IACtE,kBAAkB,EAAE,wDAAwD;IAC5E,iBAAiB,EAAE,oDAAoD;IACvE,qBAAqB,EAAE,yDAAyD;IAChF,oBAAoB,EAAE,wDAAwD;CACtE,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,UAAU,EAAE,2CAA2C;IACvD,SAAS,EAAE,0CAA0C;CAC7C,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC"}

package/dist/client.d.ts

@@ -93,7 +93,7 @@ export declare class MultisigClient {
      * which would fail authentication first).
      *
      * @throws if `signer` does not implement `signLookupMessage`. The bundled
-     *   `FalconSigner` and `EcdsaSigner` both do.
+     *   `FalconSigner`, `EcdsaSigner`, and `LedgerSigner` do.
      */
     recoverByKey(signer: Signer): Promise<RecoveredAccount[]>;
     /**
@@ -112,5 +112,22 @@ export declare class MultisigClient {
      * @returns A Multisig instance for the loaded account
      */
     load(accountId: string, signer: Signer): Promise<Multisig>;
+    /**
+     * Reconcile the account GUARDIAN returned with the local store, and answer
+     * with the one that is actually current.
+     *
+     * Writing GUARDIAN's account only when the store held nothing meant a caller
+     * that already had the account kept its own copy while the returned
+     * `Multisig` carried a config derived from GUARDIAN's. One object, two
+     * sources, silently disagreeing: after a membership change the config said
+     * one thing and every account read said another, with no error.
+     *
+     * Overwriting unconditionally is not the fix either. Between pushing a delta
+     * and GUARDIAN canonicalizing it, local is legitimately ahead, and clobbering
+     * it would build the next transaction on a stale nonce. So this applies the
+     * same rule `syncState` does, and returns whichever account wins so the
+     * caller describes the state it will actually read.
+     */
+    private adoptGuardianAccount;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,WAAW,EAAsB,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAIzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAEL,KAAK,YAAY,EAElB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,SAAS,EAEf,MAAM,iBAAiB,CAAC;AAiBzB;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,iFAAiF;IACjF,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuB;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAC9C,OAAO,CAAC,eAAe,CAAqB;gBAEhC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB;IAUlE;;;;OAIG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAM3C;;OAEG;IACH,IAAI,cAAc,IAAI,kBAAkB,CAEvC;IAED;;;;;;;;;OASG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAe/D;;;;;;OAMG;IACG,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAwBvE;;;;;;OAMG;IACG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;CAgDjE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,WAAW,EAAsB,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAIzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzD,OAAO,EAEL,KAAK,YAAY,EAElB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,SAAS,EAEf,MAAM,iBAAiB,CAAC;AAiBzB;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,iFAAiF;IACjF,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuB;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAC9C,OAAO,CAAC,eAAe,CAAqB;gBAEhC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB;IAUlE;;;;OAIG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAM3C;;OAEG;IACH,IAAI,cAAc,IAAI,kBAAkB,CAEvC;IAED;;;;;;;;;OASG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAe/D;;;;;;OAMG;IACG,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAwBvE;;;;;;OAMG;IACG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IA+ChE;;;;;;;;;;;;;;;OAeG;YACW,oBAAoB;CAuEnC"}

package/dist/client.js

@@ -10,6 +10,8 @@ import { Multisig } from './multisig.js';
 import { createMultisigAccount } from './account/index.js';
 import { AccountInspector, assertCompleteDetectedConfig } from './inspector.js';
 import { requireConfigValue, requireMidenRpcEndpoint } from './raw-client.js';
+import { isSafeToAdoptGuardianState, readOnChainCommitment } from './state/adopt.js';
+import { normalizeHexWord } from './utils/encoding.js';
 import { resolveProverConfig, } from './prover/config.js';
 import { resolveRpcConfig, } from './rpc/config.js';
 async function bindSignerAccountKey(signer, midenClient, accountId) {
@@ -84,7 +86,7 @@ export class MultisigClient {
      * which would fail authentication first).
      *
      * @throws if `signer` does not implement `signLookupMessage`. The bundled
-     *   `FalconSigner` and `EcdsaSigner` both do.
+     *   `FalconSigner`, `EcdsaSigner`, and `LedgerSigner` do.
      */
     async recoverByKey(signer) {
         this._guardianClient.setSigner(signer);
@@ -129,7 +131,8 @@ export class MultisigClient {
         for (let i = 0; i < binaryString.length; i++) {
             accountBytes[i] = binaryString.charCodeAt(i);
         }
-        const account = Account.deserialize(accountBytes);
+        const incomingAccount = Account.deserialize(accountBytes);
+        const account = await this.adoptGuardianAccount(accountId, incomingAccount);
         const detected = AccountInspector.fromAccount(account);
         // Fail closed on a partial read: the detected signer set becomes the
         // authoritative config that membership proposals rewrite on-chain.
@@ -140,12 +143,82 @@ export class MultisigClient {
             guardianCommitment: detected.guardianCommitment,
             procedureThresholds: Array.from(detected.procedureThresholds.entries()).map(([procedure, threshold]) => ({ procedure, threshold })),
         };
-        const existingAccount = await this.midenClient.accounts.get(AccountId.fromHex(accountId));
-        if (!existingAccount) {
-            await this.midenClient.accounts.insert({ account, overwrite: true });
-        }
         await bindSignerAccountKey(signer, this.midenClient, accountId);
         return new Multisig(account, config, this._guardianClient, signer, this.midenClient, accountId, this.midenRpcEndpoint, this.proverConfig, this.rpcConfig);
     }
+    /**
+     * Reconcile the account GUARDIAN returned with the local store, and answer
+     * with the one that is actually current.
+     *
+     * Writing GUARDIAN's account only when the store held nothing meant a caller
+     * that already had the account kept its own copy while the returned
+     * `Multisig` carried a config derived from GUARDIAN's. One object, two
+     * sources, silently disagreeing: after a membership change the config said
+     * one thing and every account read said another, with no error.
+     *
+     * Overwriting unconditionally is not the fix either. Between pushing a delta
+     * and GUARDIAN canonicalizing it, local is legitimately ahead, and clobbering
+     * it would build the next transaction on a stale nonce. So this applies the
+     * same rule `syncState` does, and returns whichever account wins so the
+     * caller describes the state it will actually read.
+     */
+    async adoptGuardianAccount(accountId, incomingAccount) {
+        const localAccount = await this.midenClient.accounts.get(AccountId.fromHex(accountId));
+        if (!localAccount) {
+            // Still checked against chain, and through the same rule the other path
+            // uses. An empty store is the ordinary shape for loading an account this
+            // client has never held, so inserting without the check would make it the
+            // one path where GUARDIAN's word is taken on its own. Checking only that
+            // *some* commitment exists is not the check: it admits state that
+            // disagrees with chain, which is the thing being guarded against.
+            // Only for an account that has transacted. One that has not is not
+            // deployed, so there is no on-chain commitment to agree or disagree with,
+            // and reading the node for one would make loading a fresh account depend
+            // on the node as well as on GUARDIAN.
+            const transacted = incomingAccount.nonce().asInt() > BigInt(0);
+            const onChain = transacted
+                ? await readOnChainCommitment(this.midenRpcEndpoint, AccountId.fromHex(accountId), this.rpcConfig)
+                : null;
+            // The one rule the shared predicate cannot apply here. It keys its
+            // null-commitment guard on the *local* nonce, because `syncState`
+            // legitimately meets a higher incoming nonce with no local history. With
+            // no local record at all, the incoming nonce is the only evidence there
+            // is: an account GUARDIAN reports as having transacted is deployed, so a
+            // node reporting nothing for it is an RPC or gateway failure rather than
+            // an undeployed account. `readOnChainCommitment` reports a missing
+            // account by matching `not found`, which a 404 also says.
+            if (transacted && !onChain) {
+                throw new Error(`Refusing to adopt GUARDIAN state for ${accountId}: it has transacted (nonce ${incomingAccount.nonce().asInt().toString()}) but the node reported no on-chain commitment, so it could not be checked against chain`);
+            }
+            // Handed the commitment already read, rather than letting the predicate
+            // read it again: two reads can disagree, and the guard above would then
+            // have passed on a different answer than the comparison rejects.
+            await isSafeToAdoptGuardianState({
+                accountId,
+                incomingAccount,
+                readCommitment: () => Promise.resolve(onChain),
+            });
+            await this.midenClient.accounts.insert({ account: incomingAccount, overwrite: true });
+            return incomingAccount;
+        }
+        const localCommitment = normalizeHexWord(localAccount.to_commitment().toHex());
+        const incomingCommitment = normalizeHexWord(incomingAccount.to_commitment().toHex());
+        // Equal commitments are the same state, and the safety rule reads an equal
+        // nonce as divergence, so it must not be asked about a pair that agrees.
+        if (localCommitment === incomingCommitment) {
+            return localAccount;
+        }
+        const adopt = await isSafeToAdoptGuardianState({
+            accountId,
+            incomingAccount,
+            localAccount,
+            readCommitment: () => readOnChainCommitment(this.midenRpcEndpoint, AccountId.fromHex(accountId), this.rpcConfig),
+        });
+        if (!adopt) {
+            return localAccount;
+        }
+        await this.midenClient.accounts.insert({ account: incomingAccount, overwrite: true });
+        return incomingAccount;
+    }
 }
 //# sourceMappingURL=client.js.map