@seams/wallet 0.6.1 → 0.7.1

package/dist/esm/core/signingEngine/workerManager/deviceLinkingSourceContribution.js

@@ -1,17 +1,19 @@
 import { mpcMaterialActivationRefsEqual, parseWalletKeyId } from "../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { deriveRouterAbEd25519YaoApplicationBindingDigestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { deriveEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
-import { parseLinkedDeviceEd25519SourcePreservingReservationV1 } from "../../../shared-ts/src/device-linking/sourceContribution.js";
 import "../../../shared-ts/src/signing-lanes/index.js";
+import { deriveRouterAbEd25519YaoApplicationBindingDigestV1 } from "../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { parseEcdsaThresholdKeyId } from "../session/keyMaterialBrands.js";
 import { prepareLinkedDeviceEcdsaSourceContributionWasm } from "../threshold/crypto/ecdsaDerivationClientWasm.js";
+import { parseLinkedDeviceEd25519SourcePreservingReservationV1 } from "../../../shared-ts/src/device-linking/sourceContribution.js";
 import { openEd25519YaoLaneWorkerSourceFromUnlockedCapabilityV1 } from "../threshold/crypto/ed25519YaoLaneWasm.js";
 //#region src/core/signingEngine/workerManager/deviceLinkingSourceContribution.ts
 function createDeviceLinkingEcdsaSourceContributionMetadataReaderV1(context) {
 	return async ({ preparation }) => {
 		const sourceActivation = preparation.source.activation;
+		const linked = context.readLinkedEcdsaHolderV1({ materialActivation: sourceActivation });
+		if (linked) return linkedEcdsaSourceMetadataV1(linked, sourceActivation);
 		const manifest = await context.readActiveEcdsaCapabilityManifestV1({ materialActivation: sourceActivation });
 		assertExactEcdsaSourceMetadataContextV1({
 			sourceActivation,
@@ -28,6 +30,28 @@ function createDeviceLinkingEcdsaSourceContributionMetadataReaderV1(context) {
 		};
 	};
 }
+function linkedEcdsaSourceMetadataV1(holder, sourceActivation) {
+	if (!mpcMaterialActivationRefsEqual(holder.materialActivation, sourceActivation)) throw new Error("linked ECDSA holder activation does not match preparation");
+	const normalSigning = holder.activationReceipt.normalSigning;
+	const scope = normalSigning.scope;
+	const signingKeySlotId = deriveEvmFamilySigningKeySlotId({
+		walletId: holder.walletId,
+		signingRootId: scope.signing_root_id,
+		signingRootVersion: scope.signing_root_version
+	});
+	const walletKeyId = parseWalletKeyId(`wallet-key:ecdsa:${holder.walletId}:${signingKeySlotId}`);
+	if (!walletKeyId.ok) throw new Error(`linked ECDSA source wallet key identity: ${walletKeyId.error.message}`);
+	return {
+		walletKeyId: walletKeyId.value,
+		sourceDerivation: {
+			applicationBindingDigestB64u: parseDigestB64u(scope.context.application_binding_digest_b64u),
+			clientShareRetryCounter: scope.public_identity.client_share_retry_counter,
+			ecdsaThresholdKeyId: parseEcdsaThresholdKeyId(holder.ecdsaThresholdKeyId),
+			sourceNormalSigning: normalSigning
+		},
+		linkedHolderHandleId: holder.holderHandleId
+	};
+}
 function assertExactEcdsaSourceMetadataContextV1(input) {
 	if (!mpcMaterialActivationRefsEqual(input.manifest.activation.materialActivation, input.sourceActivation)) throw new Error("ECDSA capability manifest activation does not match preparation");
 }
@@ -107,7 +131,8 @@ async function produceEcdsaSourceContributionV1(input) {
 	const metadata = await input.readMetadataV1({ preparation: input.preparation });
 	const prepared = await prepareLinkedDeviceEcdsaSourceContributionWasm({
 		preparation: input.preparation,
-		workerCtx: input.workerContext
+		workerCtx: input.workerContext,
+		...metadata.linkedHolderHandleId === void 0 ? {} : { linkedHolderHandleId: metadata.linkedHolderHandleId }
 	});
 	return {
 		kind: "linked_device_ecdsa_source_contribution_v1",

package/dist/esm/core/signingEngine/workerManager/ecdsaClientWorkerChannels.js

@@ -1,7 +1,9 @@
 import "../../../shared-ts/src/utils/validation.js";
+import "../../../shared-ts/src/signing-lanes/rotationProtocolParsers.js";
+import "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import "../../../shared-ts/src/utils/routerAbPublicKeyset.js";
 import "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import "../../../shared-ts/src/device-linking/sourceContribution.js";
-import "../../../shared-ts/src/signing-lanes/rotationParsers.js";
 //#region src/core/signingEngine/workerManager/ecdsaClientWorkerChannels.ts
 const EcdsaClientWorkerControlKind = {
 	AttachDerivationToPresign: "attach_ecdsa_derivation_to_presign_v1",

package/dist/esm/core/signingEngine/workerManager/workerTransport.js

@@ -32,6 +32,18 @@ const SIGNER_WORKER_KINDS = [
 	"walletCustodyCeremony"
 ];
 const MULTICHAIN_WORKER_DEFAULT_TIMEOUT_MS = 2e4;
+/**
+* A timed-out operation resets its worker, and resetting a presign or
+* derivation worker discards the state other ceremonies hold in it. Name the
+* operation that caused the reset.
+*/
+function warnWorkerOperationTimedOut(kind, type, timeoutMs) {
+	console.warn("[WorkerTransport] operation timed out; resetting worker", {
+		kind,
+		type: String(type),
+		timeoutMs
+	});
+}
 function makeId(prefix) {
 	return secureRandomId(prefix, 32, "signer worker request IDs");
 }
@@ -136,11 +148,11 @@ var WorkerTransport = class {
 		return readiness.promise;
 	}
 	/**
-	* Refactor 94C. Initializes the ECDSA derivation and registration WASM
-	* inside the derivation worker during the authentication prompt, so the
-	* first ceremony call after auth does not pay module init (measured 654 ms
-	* cold vs 88 ms warm on `ecdsaRegistrationClientCreateMs`). Fire-and-forget
-	* safe: failure leaves the lazy init path exactly as it was.
+	* Initializes the ECDSA derivation and registration WASM inside the
+	* derivation worker during the authentication prompt, so the first ceremony
+	* call after auth does not pay module init (measured 654 ms cold vs 88 ms
+	* warm on `ecdsaRegistrationClientCreateMs`). Fire-and-forget safe: failure
+	* leaves the lazy init path exactly as it was.
 	*/
 	async prewarmEcdsaRegistrationCrypto() {
 		const existing = this.ecdsaRegistrationCryptoPrewarmPromise;
@@ -252,6 +264,7 @@ var WorkerTransport = class {
 					code: "TIMEOUT",
 					workerKind: "nearSigner"
 				}));
+				warnWorkerOperationTimedOut("nearSigner", type, timeoutMs);
 				this.resetWorker("nearSigner");
 				try {
 					const seconds = Math.round(timeoutMs / 1e3);
@@ -293,6 +306,7 @@ var WorkerTransport = class {
 					code: "TIMEOUT",
 					workerKind: "ecdsaDerivationClient"
 				}));
+				warnWorkerOperationTimedOut("ecdsaDerivationClient", type, timeoutMs);
 				this.resetWorker("ecdsaDerivationClient");
 			}, timeoutMs);
 			this.getPendingMap("ecdsaDerivationClient").set(requestId, {
@@ -327,6 +341,7 @@ var WorkerTransport = class {
 					code: "TIMEOUT",
 					workerKind: kind
 				}));
+				warnWorkerOperationTimedOut(kind, request.type, timeoutMs);
 				this.resetWorker(kind);
 			}, timeoutMs);
 			this.getPendingMap(kind).set(requestId, {

package/dist/esm/core/signingEngine/workerManager/workerTypes.js

@@ -79,11 +79,12 @@ const EcdsaPresignClientResponseType = {
 };
 const EcdsaOnlineClientRequestType = { ComputeSignatureShare: 72e3 };
 const EcdsaOnlineClientResponseType = { ComputeSignatureShareSuccess: 72100 };
+const DEFAULT_SIGNER_HOST_ERROR_CODE = "SIGNER_INTERNAL";
 var SignerWorkerOperationError = class extends Error {
 	constructor(args) {
 		super(args.message);
 		this.name = "SignerWorkerOperationError";
-		this.code = (args.code || "SIGNER_INTERNAL").trim();
+		this.code = (args.code || DEFAULT_SIGNER_HOST_ERROR_CODE).trim();
 		this.coreCode = args.coreCode?.trim() || void 0;
 		this.workerKind = args.workerKind;
 	}

package/dist/esm/core/types/linkDevice.js

@@ -16,9 +16,8 @@ let DeviceLinkingErrorCode = /* @__PURE__ */ function(DeviceLinkingErrorCode) {
 	DeviceLinkingErrorCode["INSUFFICIENT_BALANCE"] = "INSUFFICIENT_BALANCE";
 	DeviceLinkingErrorCode["REGISTRATION_FAILED"] = "REGISTRATION_FAILED";
 	/**
-	* R103 zero-prompt handoff: Device 1 is not unlocked with the custody
-	* capability linking needs. The QR flow never prompts; the user unlocks the
-	* wallet and scans again.
+	* Device 1 is not unlocked with the custody capability linking needs. The
+	* QR flow never prompts; the user unlocks the wallet and scans again.
 	*/
 	DeviceLinkingErrorCode["WALLET_UNLOCK_REQUIRED"] = "WALLET_UNLOCK_REQUIRED";
 	/**

package/dist/esm/core/types/sdkSentEvents.js

@@ -1,6 +1,8 @@
 import { parseLinkedDeviceEnrollmentId, parseWalletId } from "../../shared-ts/src/utils/domainIds.js";
 import { parseWalletSessionId } from "../../shared-ts/src/authorization/capabilityKinds.js";
 import { isWalletAuthMethod } from "../../shared-ts/src/utils/signerDomain.js";
+//#region src/core/types/sdkSentEvents.ts
+const SDK_LIFECYCLE_EVENT_VERSION = 1;
 const SIGNING_SESSION_EXPIRY_DETECTION_SOURCES = {
 	restore: "restore",
 	visibility: "visibility",
@@ -10,7 +12,7 @@ const SIGNING_SESSION_EXPIRY_DETECTION_SOURCES = {
 };
 function createNearProvisioningStateChangedEvent(input) {
 	return {
-		version: 1,
+		version: SDK_LIFECYCLE_EVENT_VERSION,
 		event: "registration.near_provisioning_changed",
 		walletId: input.walletId,
 		state: input.state
@@ -84,7 +86,7 @@ function createSigningSessionExpiredEvent(input) {
 	if (!isPositiveSafeInteger(input.detectedAtMs)) throw new Error("signing_session.expired detectedAtMs must be a positive safe integer");
 	if (input.expiresAtMs > input.detectedAtMs) throw new Error("signing_session.expired timeline is invalid");
 	return {
-		version: 1,
+		version: SDK_LIFECYCLE_EVENT_VERSION,
 		event: "signing_session.expired",
 		walletId: input.walletId,
 		walletSessionId: input.walletSessionId,
@@ -96,14 +98,14 @@ function createSigningSessionExpiredEvent(input) {
 }
 function parseSdkLifecycleEvent(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	if (Reflect.get(value, "version") !== 1) return null;
+	if (Reflect.get(value, "version") !== SDK_LIFECYCLE_EVENT_VERSION) return null;
 	switch (Reflect.get(value, "event")) {
 		case "registration.near_provisioning_changed": {
 			const walletId = parseWalletId(Reflect.get(value, "walletId"));
 			const state = parseNearProvisioningState(Reflect.get(value, "state"));
 			if (!walletId.ok || !state) return null;
 			return {
-				version: 1,
+				version: SDK_LIFECYCLE_EVENT_VERSION,
 				event: "registration.near_provisioning_changed",
 				walletId: walletId.value,
 				state
@@ -126,7 +128,7 @@ function parseSdkLifecycleEvent(value) {
 	const source = parseSigningSessionExpiryDetectionSource(Reflect.get(value, "source"));
 	if (!source) return null;
 	return {
-		version: 1,
+		version: SDK_LIFECYCLE_EVENT_VERSION,
 		event: "signing_session.expired",
 		walletId: walletId.value,
 		walletSessionId: walletSessionId.value,

package/dist/esm/core/types/signer-worker.js

@@ -21,13 +21,6 @@ let WorkerResponseType = /* @__PURE__ */ function(WorkerResponseType) {
 	WorkerResponseType[WorkerResponseType["DeriveThresholdEd25519ClientVerifyingShareFailure"] = 11] = "DeriveThresholdEd25519ClientVerifyingShareFailure";
 	return WorkerResponseType;
 }({});
-const DEFAULT_THRESHOLD_BEHAVIOR = "strict";
-function isThresholdBehavior(input) {
-	return input === "fallback" || input === "strict";
-}
-function resolveThresholdBehavior(input, fallback = DEFAULT_THRESHOLD_BEHAVIOR) {
-	return isThresholdBehavior(input) ? input : fallback;
-}
 const NearSignerWorkerCustomRequestType = {
 	ThresholdEd25519ComputeNep413SigningDigest: "thresholdEd25519ComputeNep413SigningDigest",
 	ThresholdEd25519ComputeDelegateSigningDigest: "thresholdEd25519ComputeDelegateSigningDigest",
@@ -42,36 +35,6 @@ const DEFAULT_CONFIRMATION_CONFIG = {
 	behavior: "requireClick",
 	autoProceedDelay: 0
 };
-const WASM_CONFIRMATION_UI_MODE = {
-	Skip: 0,
-	Modal: 1,
-	Drawer: 2
-};
-const WASM_CONFIRMATION_BEHAVIOR = {
-	RequireClick: 0,
-	AutoProceed: 1
-};
-function assertNeverSignerWorkerConfirmation(value) {
-	throw new Error(`Unsupported confirmation option: ${String(value)}`);
-}
-const mapUIModeToWasm = (uiMode) => {
-	switch (uiMode) {
-		case "none": return WASM_CONFIRMATION_UI_MODE.Skip;
-		case "modal": return WASM_CONFIRMATION_UI_MODE.Modal;
-		case "drawer": return WASM_CONFIRMATION_UI_MODE.Drawer;
-		default: return assertNeverSignerWorkerConfirmation(uiMode);
-	}
-};
-const mapBehaviorToWasm = (behavior) => {
-	switch (behavior) {
-		case "requireClick": return WASM_CONFIRMATION_BEHAVIOR.RequireClick;
-		case "skipClick": return WASM_CONFIRMATION_BEHAVIOR.AutoProceed;
-		default: return assertNeverSignerWorkerConfirmation(behavior);
-	}
-};
-function isProgressMessage(obj) {
-	return typeof obj === "object" && obj !== null && typeof obj.message_type === "string" && typeof obj.step === "string" && typeof obj.message === "string" && typeof obj.status === "string";
-}
 let ProgressMessageType = /* @__PURE__ */ function(ProgressMessageType) {
 	ProgressMessageType["REGISTRATION_PROGRESS"] = "REGISTRATION_PROGRESS";
 	ProgressMessageType["REGISTRATION_COMPLETE"] = "REGISTRATION_COMPLETE";
@@ -88,17 +51,6 @@ let ProgressStep = /* @__PURE__ */ function(ProgressStep) {
 	ProgressStep["ERROR"] = "error";
 	return ProgressStep;
 }({});
-let WorkerErrorCode = /* @__PURE__ */ function(WorkerErrorCode) {
-	WorkerErrorCode["WASM_INIT_FAILED"] = "WASM_INIT_FAILED";
-	WorkerErrorCode["INVALID_REQUEST"] = "INVALID_REQUEST";
-	WorkerErrorCode["TIMEOUT"] = "TIMEOUT";
-	WorkerErrorCode["ENCRYPTION_FAILED"] = "ENCRYPTION_FAILED";
-	WorkerErrorCode["DECRYPTION_FAILED"] = "DECRYPTION_FAILED";
-	WorkerErrorCode["SIGNING_FAILED"] = "SIGNING_FAILED";
-	WorkerErrorCode["STORAGE_FAILED"] = "STORAGE_FAILED";
-	WorkerErrorCode["UNKNOWN_ERROR"] = "UNKNOWN_ERROR";
-	return WorkerErrorCode;
-}({});
 function isWorkerProgress(response) {
 	return response.type === WorkerResponseType.RegistrationProgress || response.type === WorkerResponseType.RegistrationComplete || response.type === WorkerResponseType.ExecuteActionsProgress || response.type === WorkerResponseType.ExecuteActionsComplete;
 }
@@ -108,16 +60,7 @@ function isWorkerSuccess(response) {
 function isWorkerError(response) {
 	return response.type === WorkerResponseType.SignTransactionsWithActionsFailure || response.type === WorkerResponseType.SignDelegateActionFailure || response.type === WorkerResponseType.SignNep413MessageFailure || response.type === WorkerResponseType.DeriveThresholdEd25519ClientVerifyingShareFailure;
 }
-function isSignTransactionsWithActionsSuccess(response) {
-	return response.type === WorkerResponseType.SignTransactionsWithActionsSuccess;
-}
-function isSignDelegateActionSuccess(response) {
-	return response.type === WorkerResponseType.SignDelegateActionSuccess;
-}
-function isSignNep413MessageSuccess(response) {
-	return response.type === WorkerResponseType.SignNep413MessageSuccess;
-}
 //#endregion
-export { DEFAULT_CONFIRMATION_CONFIG, DEFAULT_THRESHOLD_BEHAVIOR, NearSignerWorkerCustomRequestType, ProgressMessageType, ProgressStep, WorkerErrorCode, WorkerRequestType, WorkerResponseType, isProgressMessage, isSignDelegateActionSuccess, isSignNep413MessageSuccess, isSignTransactionsWithActionsSuccess, isThresholdBehavior, isWorkerError, isWorkerProgress, isWorkerSuccess, mapBehaviorToWasm, mapUIModeToWasm, resolveThresholdBehavior };
+export { DEFAULT_CONFIRMATION_CONFIG, NearSignerWorkerCustomRequestType, ProgressMessageType, ProgressStep, WorkerRequestType, WorkerResponseType, isWorkerError, isWorkerProgress, isWorkerSuccess };
 
 //# sourceMappingURL=signer-worker.js.map

package/dist/esm/index.js

@@ -2,8 +2,8 @@ import { toAccountId } from "./core/types/accountIds.js";
 import { AccountSyncEventPhase, KeyExportEventPhase, LinkDeviceEventPhase, RegistrationEventPhase, SigningEventPhase, UnlockEventPhase, WALLET_FLOW_EVENT_MESSAGES, WALLET_FLOW_EVENT_STEPS, WALLET_FLOW_EVENT_VERSION, createAccountSyncFlowEvent, createKeyExportFlowEvent, createLinkDeviceFlowEvent, createRegistrationFlowEvent, createSigningFlowEvent, createUnlockFlowEvent, createWalletFlowEvent, isWalletFlowEvent } from "./core/types/sdkSentEvents.js";
 import { configuredThresholdEcdsaChainTargets, nearAccountRefFromAccountId, thresholdEcdsaChainTargetFromChainFamily, thresholdEcdsaChainTargetFromConfig, thresholdEcdsaChainTargetFromConfiguredRequest, thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual, toWalletId, walletIdFromWalletProfile, walletSessionRefFromSession } from "./core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { ActionType } from "./shared-ts/src/near/actions.js";
-import { DEFAULT_WAIT_STATUS } from "./core/types/rpc.js";
 import { PASSKEY_MANAGER_DEFAULT_CONFIGS, buildConfigsFromEnv } from "./core/config/defaultConfigs.js";
+import { DEFAULT_WAIT_STATUS } from "./core/types/rpc.js";
 import { DEVICE_LINKING_CONFIG, SIGNER_WORKER_MANAGER_CONFIG } from "./config.js";
 import { BrowserCapabilityUnavailableError } from "./SeamsWeb/publicApi/capabilitySelection.js";
 import { SeamsWeb } from "./SeamsWeb/SeamsWeb.js";

package/dist/esm/plugins/vite.js

@@ -48,7 +48,7 @@ function seamsServeSdk(opts = {}) {
 		apply: "serve",
 		enforce: "pre",
 		configureServer(server) {
-			if (enableDebugRoutes) server.middlewares.use("/__sdk-root", (req, res) => {
+			if (enableDebugRoutes) server.middlewares.use("/__sdk-root", (_req, res) => {
 				res.setHeader("Content-Type", "text/plain; charset=utf-8");
 				res.setHeader("Cache-Control", "no-store, max-age=0");
 				res.end(sdkDistRoot);

package/dist/esm/react/SeamsWeb/SeamsWeb.js

@@ -7,12 +7,12 @@ import { resolvePrimaryNearRpcUrl } from "../core/config/chains.js";
 import { resolveAppearanceTheme, resolveThemePalette } from "../core/config/configHelpers.js";
 import { buildConfigsFromEnv } from "../core/config/defaultConfigs.js";
 import { parseMpcMaterialActivationRef, parseWalletAuthMethodId } from "../shared-ts/src/utils/domainIds.js";
-import { createServerAllocatedWalletId } from "../shared-ts/src/utils/registrationIntent.js";
-import { parseLinkedDeviceApprovalResultV1 } from "../shared-ts/src/device-linking/parsers.js";
 import { isEmailOtpWalletAuthAuthority, parseWalletAuthAuthorityRef } from "../shared-ts/src/utils/walletAuthAuthority.js";
-import { nearAccountBindingFromRaw } from "../shared-ts/src/utils/walletCapabilityBindings.js";
+import { createServerAllocatedWalletId } from "../shared-ts/src/utils/registrationIds.js";
 import { configuredThresholdEcdsaChainTargets, nearAccountRefFromAccountId, thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetsEqual, toWalletId, walletSessionRefFromSession } from "../core/signingEngine/interfaces/ecdsaChainTarget.js";
+import { nearAccountBindingFromRaw } from "../shared-ts/src/utils/walletCapabilityBindings.js";
 import { parseExactEcdsaSigningLaneIdentity, parseExactEd25519ExportMaterialIdentity } from "../core/signingEngine/session/identity/exactSigningLaneIdentity.js";
+import { parseLinkedDeviceApprovalResultV1 } from "../shared-ts/src/device-linking/parsers.js";
 import "../shared-ts/src/device-linking/index.js";
 import { RegistrationEventPhase, UnlockEventPhase, createRegistrationFlowEvent, createUnlockFlowEvent } from "../core/types/sdkSentEvents.js";
 import { WalletSessionStatusReadScope } from "../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
@@ -21,9 +21,10 @@ import { isRegistrationBenchmarkDiagnosticsEnabled } from "../core/signingEngine
 import { walletSessionAuthorizations } from "../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
 import { IndexedDBManager } from "../core/indexedDB/index.js";
 import { IndexedDbEcdsaCapabilityManifestStore } from "../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
+import { resolveLinkedEcdsaHolderRuntimeV1 } from "../core/signingEngine/session/material/linkedEcdsaHolderRuntime.js";
 import { activateEmailOtpWalletAfterUnlock, persistVerifiedEmailOtpAuthorityAfterUnlock, walletAuthAuthorityRefForVerifiedEmailOtpUnlock } from "./operations/authMethods/emailOtp/walletActivation.js";
 import { __isWalletIframeHostMode } from "../core/browser/walletIframe/host-mode.js";
-import { readUnlockedWalletEd25519ExportRootCapabilityV1, walletCustodyCeremonyTransportFromWorkerContextV1 } from "../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
+import { readUnlockedEd25519ExportRootLinkingCapabilityV1, walletCustodyCeremonyTransportFromWorkerContextV1 } from "../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
 import { resolveAmbiguousEcdsaActivationForSelectedAuthMethod } from "./assembly/browserSigningSurfaceAssembly.js";
 import { BrowserSigningSurface } from "./signingSurface/BrowserSigningSurface.js";
 import { WALLET_IFRAME_TRANSPORT_TIMING_LABEL } from "./operations/registration/registrationTiming.js";
@@ -52,8 +53,8 @@ import { resolveConfiguredChainTarget } from "./publicApi/chainTargets.js";
 import { buildNearWalletRegistrationSignerSetSelection, resolvePasskeyRegistrationAccountProvisioning } from "./operations/registration/registrationSignerSet.js";
 import { requireTempoFeeTokenPreferenceSigningRequest } from "../core/signingEngine/chains/tempo/feeToken.js";
 import { createPublicApi } from "./publicApi/createPublicApi.js";
-import { createWalletHostCompositionV1 } from "./operations/devices/walletHostComposition.js";
 import { createWalletHostOwnerAuthoritiesV1 } from "./operations/devices/walletHostOwnerAuthority.js";
+import { createWalletHostCompositionV1 } from "./operations/devices/walletHostComposition.js";
 import { createDeviceLinkingEcdsaSourceContributionMetadataReaderV1, createDeviceLinkingEd25519SourceContributionPortV1, createDeviceLinkingSourceContributionPortV1 } from "../core/signingEngine/workerManager/deviceLinkingSourceContribution.js";
 import { beginGoogleEmailOtpWalletAuth } from "./operations/authMethods/emailOtp/googleEmailOtpWalletAuthFlow.js";
 import { acknowledgeWalletRecoveryBackup, readWalletRecoveryCodeStatus, requestWalletCustodyEmailOtpChallenge } from "../core/rpcClients/relayer/walletRecoveryRotate.js";
@@ -404,21 +405,31 @@ function createWalletHostOwnerApprovalUpdatesV1(args) {
 	};
 }
 function createWalletHostEcdsaSourceContributionMetadataReaderV1(args) {
-	return createDeviceLinkingEcdsaSourceContributionMetadataReaderV1({ readActiveEcdsaCapabilityManifestV1: async ({ materialActivation }) => {
-		const authentication = args.signingEngine.readWalletAuthenticationState();
-		if (authentication.kind !== "authenticated") throw new Error("ECDSA source metadata requires an authenticated wallet");
-		let lookup = await ecdsaCapabilityManifestStore.lookupByMaterialActivation({
-			walletId: authentication.walletId,
-			materialActivation
-		});
-		if (lookup.kind === "ambiguous_authority") lookup = await resolveAmbiguousEcdsaActivationForSelectedAuthMethod({
-			walletId: authentication.walletId,
-			materialActivation,
-			authorities: lookup.authorities
-		});
-		if (lookup.kind !== "active") throw new Error(`ECDSA source metadata manifest is ${lookup.kind}`);
-		return lookup.manifest;
-	} });
+	return createDeviceLinkingEcdsaSourceContributionMetadataReaderV1({
+		readActiveEcdsaCapabilityManifestV1: async ({ materialActivation }) => {
+			const authentication = args.signingEngine.readWalletAuthenticationState();
+			if (authentication.kind !== "authenticated") throw new Error("ECDSA source metadata requires an authenticated wallet");
+			let lookup = await ecdsaCapabilityManifestStore.lookupByMaterialActivation({
+				walletId: authentication.walletId,
+				materialActivation
+			});
+			if (lookup.kind === "ambiguous_authority") lookup = await resolveAmbiguousEcdsaActivationForSelectedAuthMethod({
+				walletId: authentication.walletId,
+				materialActivation,
+				authorities: lookup.authorities
+			});
+			if (lookup.kind !== "active") throw new Error(`ECDSA source metadata manifest is ${lookup.kind}`);
+			return lookup.manifest;
+		},
+		readLinkedEcdsaHolderV1: ({ materialActivation }) => {
+			const authentication = args.signingEngine.readWalletAuthenticationState();
+			if (authentication.kind !== "authenticated") return null;
+			return resolveLinkedEcdsaHolderRuntimeV1({
+				walletId: authentication.walletId,
+				materialActivation
+			});
+		}
+	});
 }
 function createWalletHostDeviceDomainConstructionV1(args) {
 	const relayerUrl = String(args.configs.network.relayer?.url || "").trim();
@@ -429,7 +440,7 @@ function createWalletHostDeviceDomainConstructionV1(args) {
 		walletSessions: walletSessionAuthorizations,
 		resolveSelectedWalletAuthority: IndexedDBManager.resolveSelectedWalletAuthority.bind(IndexedDBManager),
 		readWalletAuthenticationState: args.signingEngine.readWalletAuthenticationState.bind(args.signingEngine),
-		readUnlockedEd25519ExportRootCapabilityV1: readUnlockedWalletEd25519ExportRootCapabilityV1
+		readUnlockedEd25519ExportRootCapabilityV1: readUnlockedEd25519ExportRootLinkingCapabilityV1
 	});
 	return {
 		platform,
@@ -957,76 +968,6 @@ var SeamsWeb = class {
 			error: { message: input.error.message }
 		});
 	}
-	emitEmailOtpRegistrationWorkerProgress(onEvent, args) {
-		const base = {
-			flowId: args.flowId,
-			walletId: args.walletId,
-			authMethod: "email_otp",
-			...args.challengeId ? { requestId: args.challengeId } : {}
-		};
-		switch (args.progress.code) {
-			case "otp.verify.succeeded":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_04_OTP_VERIFY_SUCCEEDED,
-					status: "succeeded",
-					interaction: {
-						kind: "otp_input",
-						overlay: "hide"
-					}
-				});
-				return RegistrationEventPhase.STEP_04_OTP_VERIFY_SUCCEEDED;
-			case "signer.email_otp.enroll.started":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_STARTED,
-					status: "running"
-				});
-				return RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_STARTED;
-			case "signer.email_otp.enroll.succeeded":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_SUCCEEDED,
-					status: "succeeded"
-				});
-				return RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_SUCCEEDED;
-			case "signer.ecdsa.bootstrap.started":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED,
-					status: "running",
-					data: { chainTarget: args.chainTarget }
-				});
-				return RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED;
-			case "signer.ecdsa.bootstrap.prepared":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED,
-					status: "running",
-					message: "Coordinating EVM signing session",
-					data: { chainTarget: args.chainTarget }
-				});
-				return RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED;
-			case "signer.ecdsa.bootstrap.responded":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED,
-					status: "running",
-					message: "Finalizing EVM signing session",
-					data: { chainTarget: args.chainTarget }
-				});
-				return RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED;
-			case "signer.ecdsa.bootstrap.succeeded":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_SUCCEEDED,
-					status: "succeeded",
-					data: { chainTarget: args.chainTarget }
-				});
-				return RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_SUCCEEDED;
-			default: return null;
-		}
-	}
 	emitEmailOtpUnlockWorkerProgress(onEvent, args) {
 		const chainLabel = args.chainTarget.kind === "tempo" ? "Tempo" : "EVM";
 		const base = {
@@ -1663,7 +1604,6 @@ var SeamsWeb = class {
 				this.emitEmailOtpUnlockEvent(args.onEvent, input);
 			};
 			let timingStartedAtMs = nowMs();
-			String(args.relayUrl || this.configs.network.relayer.url).trim();
 			const emailHashHex = await this.emailOtpEmailHashHex(args.emailOtpAuthorityEmail || "");
 			recordEmailOtpUnlockTiming(unlockTiming.timings, "emailHashLookupMs", timingStartedAtMs);
 			timingStartedAtMs = nowMs();

package/dist/esm/react/SeamsWeb/assembly/browserSigningSurfaceAssembly.js

@@ -1,7 +1,7 @@
 import { mpcMaterialActivationRefsEqual } from "../../shared-ts/src/utils/domainIds.js";
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../shared-ts/src/utils/walletAuthAuthority.js";
-import { configuredThresholdEcdsaChainTargets, thresholdEcdsaChainTargetKey, toWalletId } from "../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { WALLET_AUTH_METHODS } from "../../shared-ts/src/utils/signerDomain.js";
+import { configuredThresholdEcdsaChainTargets, thresholdEcdsaChainTargetKey, toWalletId } from "../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { listExactSealedSessionsForWallet } from "../../core/signingEngine/session/persistence/sealedSessionStore.js";
 import { buildActiveNearEd25519WalletSessionAuthorization } from "../../core/signingEngine/session/material/nearEd25519YaoSigningPreparation.js";
 import { ed25519SealedRuntimeAuthorityRef } from "../../core/signingEngine/session/warmCapabilities/ed25519SealedSessionRuntime.js";
@@ -10,6 +10,7 @@ import { readEmailOtpProviderSubjectForWalletV1 } from "../../core/signingEngine
 import { walletSessionAuthorizations } from "../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
 import { IndexedDBManager } from "../../core/indexedDB/index.js";
 import { IndexedDbEcdsaCapabilityManifestStore } from "../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
+import { emitSigningSessionFlowTrace } from "../../core/signingEngine/session/operationState/trace.js";
 import { withThresholdEd25519CommitQueue } from "../../core/signingEngine/threshold/ed25519/commitQueue.js";
 import { readOwnerWalletExecutionLaneProjectionV1 } from "../../core/rpcClients/relayer/ownerWalletExecutionLanePreflight.js";
 import { hydrateWalletExecutionLane } from "../../core/signingEngine/session/lanes/walletExecutionLaneHydration.js";
@@ -51,7 +52,7 @@ async function noWalletPasskeyAuthenticator() {
 	return null;
 }
 /**
-* R103C: the active wallet auth-method store is the one source that resolves
+* The active wallet auth-method store is the one source that resolves
 * an authority reference to its full authority. Sealed-session restores and
 * loose authenticator lists are history and hints; matching against them let
 * a stale or sibling credential answer for the active authority.
@@ -226,14 +227,22 @@ async function readBrowserExactNearEd25519WalletSessionAuthorization(relayerUrlI
 	const authorizationNowMs = Date.now();
 	if (status.authorization.expiresAtMs <= authorizationNowMs) return { kind: "expired" };
 	if (status.walletSessionId !== exactRead.operationCredential.walletSessionId || status.quotaId !== exactRead.record.quotaId || status.expiresAtMs !== status.authorization.expiresAtMs || !walletSessionImmutableIdentityMatches(status.authorization, exactRead.record) || !walletSessionMatchesSelectedAuthority(status.authorization, currentSelected)) return { kind: "corrupt" };
+	let replaced;
 	try {
-		await walletSessionAuthorizations.replaceExactActive({
+		replaced = await IndexedDBManager.replaceExactActiveWalletSessionFromStatus({
 			active: status.authorization,
 			operationCredential: exactRead.operationCredential
 		});
 	} catch {
 		return { kind: "persistence_unavailable" };
 	}
+	if (replaced.kind === "superseded") {
+		emitSigningSessionFlowTrace("near", {
+			event: "wallet_session_status_superseded",
+			walletSessionId: exactRead.operationCredential.walletSessionId
+		});
+		return { kind: "unavailable" };
+	}
 	let selectedFactorAuthority;
 	try {
 		selectedFactorAuthority = await resolveBrowserSelectedFactorAuthority(currentSelected);
@@ -420,8 +429,9 @@ async function resolveBrowserEcdsaPreprocessingCapability(args, input, statusRea
 		kind: "inactive",
 		reason: "Exact Wallet Session authorization is expired"
 	};
+	let replaced;
 	try {
-		await walletSessionAuthorizations.replaceExactActive({
+		replaced = await IndexedDBManager.replaceExactActiveWalletSessionFromStatus({
 			active: status.authorization,
 			operationCredential: exactAuthorization.operationCredential
 		});
@@ -431,6 +441,16 @@ async function resolveBrowserEcdsaPreprocessingCapability(args, input, statusRea
 			reason: "Exact Wallet Session promotion reconciliation could not be persisted"
 		};
 	}
+	if (replaced.kind === "superseded") {
+		emitSigningSessionFlowTrace("evm-family", {
+			event: "wallet_session_status_superseded",
+			walletSessionId: exactAuthorization.operationCredential.walletSessionId
+		});
+		return {
+			kind: "inactive",
+			reason: "Exact Wallet Session status was superseded by a newer wallet authority"
+		};
+	}
 	const authorizationResolution = await buildBrowserEcdsaPreprocessingCapability({
 		context: args,
 		walletId,
@@ -511,7 +531,7 @@ async function resolveAmbiguousEcdsaActivationForSelectedAuthMethod(input) {
 		authority: chosen
 	});
 }
-async function resolveBrowserCanonicalEcdsaSigningCapability(args, input) {
+async function resolveBrowserCanonicalEcdsaSigningCapability(_args, input) {
 	const walletId = toWalletId(input.walletId);
 	const subjects = await ecdsaCapabilityManifestStore.listActiveWalletCapabilitySubjects(walletId);
 	if (subjects.kind !== "resolved") throw new Error(`ECDSA capability subjects are ${subjects.kind}`);

package/dist/esm/react/SeamsWeb/assembly/createBrowserSigningStores.js

@@ -1,4 +1,4 @@
-import { acquireSigningSessionRestoreLease, deleteDurableSealedSessionRecord, listEcdsaSealedSessionsForWallet, listExactSealedSessionsForWallet, readExactSealedSession, releaseSigningSessionRestoreLease, updateExactSealedSessionPolicy, writeExactSealedSession } from "../../core/signingEngine/session/persistence/sealedSessionStore.js";
+import { acquireSigningSessionRestoreLease, listEcdsaSealedSessionsForWallet, listExactSealedSessionsForWallet, readExactSealedSession, releaseSigningSessionRestoreLease, updateExactSealedSessionPolicy, writeExactSealedSession } from "../../core/signingEngine/session/persistence/sealedSessionStore.js";
 import { IndexedDbEd25519YaoPublicCapabilityReferenceStore } from "../../core/signingEngine/threshold/ed25519/yaoPublicCapabilityReferences.js";
 import { createIndexedDBNonceLaneCoordinationStore } from "../../core/indexedDB/nonceLaneCoordinationStore.js";
 //#region src/SeamsWeb/assembly/createBrowserSigningStores.ts
@@ -28,7 +28,6 @@ function createBrowserSigningStores(indexedDB) {
 			listEcdsaSealedSessionsForWallet,
 			acquireSigningSessionRestoreLease,
 			releaseSigningSessionRestoreLease,
-			deleteDurableSealedSessionRecord,
 			updateExactSealedSessionPolicy
 		},
 		ed25519YaoPublicCapabilityReferences: new IndexedDbEd25519YaoPublicCapabilityReferenceStore(indexedDB)