@seams/wallet 0.6.1 → 0.7.1

package/dist/esm/react/SeamsWeb/operations/registration/pendingRegistrationRecovery.js

@@ -1,9 +1,9 @@
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
-import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { parseEmailOtpWalletAuthAuthority } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { toAccountId } from "../../../core/types/accountIds.js";
+import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { parseEd25519YaoRecoveryCapabilityV1 } from "../../../core/signingEngine/session/passkey/ed25519YaoRecoveryCapability.js";
 import { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND } from "../../../core/indexedDB/walletCustodyEd25519MaterialRecord.js";
 import { assertPendingWalletRegistrationIdentity } from "../../../core/indexedDB/pendingWalletRegistrationCommit.js";

package/dist/esm/react/SeamsWeb/operations/registration/registration.js

@@ -1,31 +1,32 @@
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import { deriveImplicitNearAccountIdFromEd25519PublicKey } from "../../../shared-ts/src/utils/near.js";
 import { getUserFriendlyErrorMessage } from "../../../shared-ts/src/utils/errors.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { isObject } from "../../../shared-ts/src/utils/validation.js";
 import { alphabetizeStringify, sha256BytesUtf8, sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { redactCredentialExtensionOutputs } from "../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
 import { parseThresholdEd25519SessionId, parseWalletAuthMethodId, parseWebAuthnCredentialIdB64u } from "../../../shared-ts/src/utils/domainIds.js";
-import { requireEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
-import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { parseCorrelationId, parseDigestB64u, parseIsoTimestamp } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseCanonicalEcdsaServerActivationRequest } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
-import { findRegistrationSignerPlanEvmFamilyEcdsaBranch, findRegistrationSignerPlanNearEd25519Branch, parseNearEd25519SigningKeyId, registrationSignerPlanFromSelection, walletIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { walletSessionPreservesCapabilities } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { buildEmailOtpWalletAuthAuthority, parseEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseRouterAbEcdsaVerifiedClientActivationFactsV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { thresholdEcdsaChainTargetFromChainFamily, toWalletId } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
+import { parseNearEd25519SigningKeyId, walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
+import { requireEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
+import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import "../../../shared-ts/src/signing-lanes/index.js";
+import { thresholdEcdsaChainTargetFromChainFamily, toWalletId } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { toParticipantId, toRpId } from "../../../core/signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
 import { nearEd25519SignerBindingFromBoundaryFields } from "../../../core/signingEngine/session/identity/exactSigningLaneIdentity.js";
 import { buildEmailOtpAuthContext, emailOtpAuthContextEmailHashHex, emailOtpAuthContextProvider, emailOtpAuthContextProviderUserId } from "../../../core/signingEngine/session/identity/laneIdentity.js";
 import { toAccountId } from "../../../core/types/accountIds.js";
-import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRelayerKeyId, parseEcdsaRoleLocalBindingDigest, parseEcdsaThresholdKeyId } from "../../../core/signingEngine/session/keyMaterialBrands.js";
-import { walletSessionPreservesCapabilities } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
+import { parseEcdsaRelayerKeyId } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
+import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRoleLocalBindingDigest, parseEcdsaThresholdKeyId } from "../../../core/signingEngine/session/keyMaterialBrands.js";
 import { buildEmailOtpEnvelopeFactor, buildPasskeyEnvelopeFactor } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import { walletCustodyCommitPayloadWithRecoveryBackupAcknowledgement } from "../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
+import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { RegistrationEventPhase, createRegistrationFlowEvent } from "../../../core/types/sdkSentEvents.js";
 import { WalletSessionStatusReadScope } from "../../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { publishNearProvisioningState, runSingleFlightNearProvisioning } from "../../../core/signingEngine/flows/registration/nearProvisioningRegistry.js";
@@ -35,27 +36,28 @@ import { createRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/route
 import { RouterAbEd25519YaoClientV1 } from "../../../core/signingEngine/threshold/ed25519/yaoClient.js";
 import { buildRecoveredCustodyEnvelopeRecord } from "../../../core/signingEngine/walletCustody/recoveryReplacementEnvelope.js";
 import { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND } from "../../../core/indexedDB/walletCustodyEd25519MaterialRecord.js";
+import { findRegistrationSignerPlanEvmFamilyEcdsaBranch, findRegistrationSignerPlanNearEd25519Branch, registrationSignerPlanFromSelection } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { planPendingNearRegistration, preparePendingNearRegistration } from "../../../core/indexedDB/pendingWalletRegistrationCommit.js";
 import { walletSessionAuthorizations } from "../../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
 import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { nearEd25519YaoMaterialActivationFromMetadata } from "../../../core/signingEngine/session/material/nearEd25519YaoMaterialActivation.js";
-import { activateWalletRegistration, authorizeWalletRegistrationNearAdmission, completeWalletRegistrationNearProvisioning, createWalletAddSignerIntent, finalizeWalletAddSigner, isEmailOtpWalletRegistrationFinalizeResponse, parseWalletRegistrationEcdsaDerivationRespond, respondWalletRegistration, setupWalletRegistration, startWalletAddSigner } from "../../../core/rpcClients/relayer/walletRegistration.js";
+import { activateWalletRegistration, completeWalletRegistrationNearProvisioning, createWalletAddSignerIntent, finalizeWalletAddSigner, isEmailOtpWalletRegistrationFinalizeResponse, parseWalletRegistrationEcdsaDerivationRespond, respondWalletRegistration, setupWalletRegistration, startWalletAddSigner } from "../../../core/rpcClients/relayer/walletRegistration.js";
 import { persistPasskeyEd25519YaoSignerMaterialV1 } from "../../../core/signingEngine/session/passkey/ed25519YaoLocalMaterial.js";
-import { buildPasskeyEd25519RestoreMetadata } from "../../../core/signingEngine/session/passkey/ed25519YaoSealedSession.js";
 import { prepareWalletEcdsaRegistrationPublication, prepareWalletEd25519RegistrationPublication, prepareWalletEmailOtpEd25519RegistrationPublication } from "../../../core/signingEngine/flows/registration/accountLifecycle.js";
 import { computeAddSignerIntentDigest } from "../../../utils/intentDigest.js";
 import { establishUnlockedWalletEd25519ExportRootCapabilityV1, walletCustodyCeremonyTransportFromWorkerContextV1 } from "../../../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
 import { rememberPasskeyCustodySessionEnvelope } from "../../../core/signingEngine/session/passkey/passkeyCustodySessionCache.js";
 import { listConfiguredThresholdEcdsaPublicationTargets } from "../session/thresholdEcdsaProvisioning.js";
 import { openWalletCustodyEd25519ActiveClientV1, walletCustodyCacheEnvelopeFromRecordV1 } from "../../../core/signingEngine/walletCustody/openCustodyCache.js";
-import { RegistrationTimingRecorder, assertNever, createFailedRegistrationTimingSummary, createSucceededRegistrationTimingSummary, emitNearRegistrationTiming, emitRegistrationTimingSpan, emitRegistrationTimingSummary, recordNearRegistrationSessionTiming, recordRegistrationServerTimingBuckets, recordStrictEcdsaServerTimingBuckets, registrationTimingSignerSetFromPlan, roundDurationMs, zeroEmailOtpYaoPrewarmDiagnostics } from "./registrationTiming.js";
+import { RegistrationTimingRecorder, assertNever, createFailedRegistrationTimingSummary, createSucceededRegistrationTimingSummary, emitNearRegistrationTiming, emitRegistrationTimingSpan, emitRegistrationTimingSummary, recordRegistrationServerTimingBuckets, recordStrictEcdsaServerTimingBuckets, registrationTimingSignerSetFromPlan, roundDurationMs, zeroEmailOtpYaoPrewarmDiagnostics } from "./registrationTiming.js";
 import { joinCustodyWireFromEnvelopeRecord } from "../../../core/signingEngine/walletCustody/joinCustodyWire.js";
 import { buildStrictRegistrationClientBootstrap, closeStrictEcdsaRegistrationCeremony, finalizeStrictEcdsaFamilyLocalActivation, measureStrictEcdsaCeremonyStep, registrationRouteHeaders, requireIssuedRegistrationEstablishedSession, runStrictEcdsaFamilyCeremony } from "./registrationStrictEcdsa.js";
-import { admitDeferredNearRegistration, buildRegistrationEmailOtpEd25519SessionState, passkeyWalletAuthAuthorityFromCredential, registrationEd25519MaterialFacts, registrationEstablishedEd25519Session, requireEd25519YaoRegistrationPublicResultMatches, requireEmailOtpEd25519YaoRegistrationPublicResultMatches, requireEmailOtpRegistrationEnrollmentMaterial, requirePasskeyRegistrationIntent } from "./registrationEd25519Yao.js";
+import { admitDeferredNearRegistration, buildRegistrationEmailOtpEd25519SessionState, buildRegistrationPasskeyEd25519SessionHydration, passkeyWalletAuthAuthorityFromCredential, registrationEd25519MaterialFacts, requireEd25519YaoRegistrationPublicResultMatches, requireEmailOtpEd25519YaoRegistrationPublicResultMatches, requireEmailOtpRegistrationEnrollmentMaterial, requirePasskeyRegistrationIntent } from "./registrationEd25519Yao.js";
 import { requirePasskeyPrfFirstB64u } from "../authMethods/passkey/ecdsaBootstrap.js";
 import { registrationProjectionFromPending, restorePendingNearRegistrationMaterial } from "./pendingRegistrationRecovery.js";
 import { scheduleEcdsaSessionPresignaturePrefill } from "../auth/scheduleEcdsaSessionPresignaturePrefill.js";
 import { resolveManagedRuntimeScopeBootstrap } from "../../../core/config/managedRuntimeScope.js";
+import { exactPasskeyWalletAuthAuthorityRefForCredential } from "../authMethods/passkey/exactPasskeyAuthority.js";
 import { collectPasskeyRegistrationAuthority } from "../authMethods/passkey/registrationAuthority.js";
 import { showWalletRecoveryCodeBackupUi } from "../recovery/walletRecoveryCodeBackup.js";
 import { pendingWalletRecoveryCodeBackupRepository } from "../../../core/indexedDB/seamsWalletDB/pendingWalletRecoveryCodeBackup.js";
@@ -472,17 +474,10 @@ function registrationThreeRouteAuthorityPayload(authority) {
 		default: return assertNever(authority);
 	}
 }
-async function startEarlyNearRegistrationAdmission(args) {
+async function startNearRegistrationAdmission(args) {
 	const startedAt = performance.now();
 	try {
-		const deferredNear = (await authorizeWalletRegistrationNearAdmission({
-			relayerUrl: args.relayerUrl,
-			headers: registrationRouteHeaders(args.traceContext),
-			registrationCeremonyId: args.registrationCeremonyId,
-			signedSetup: args.signedSetup,
-			...registrationThreeRouteAuthorityPayload(args.authority)
-		})).ed25519;
-		const admissionReceipt = await admitDeferredNearRegistration(deferredNear, {
+		const admissionReceipt = await admitDeferredNearRegistration(args.deferredNear, {
 			routerOrigin: new URL(args.relayerUrl).origin,
 			authorization: {
 				kind: "bearer",
@@ -498,7 +493,7 @@ async function startEarlyNearRegistrationAdmission(args) {
 			outcome: "success"
 		});
 		return {
-			deferredNear,
+			deferredNear: args.deferredNear,
 			admissionReceipt
 		};
 	} catch (error) {
@@ -511,7 +506,7 @@ async function startEarlyNearRegistrationAdmission(args) {
 		throw error;
 	}
 }
-function requireEarlyNearRegistrationAdmission(admission) {
+function requireNearRegistrationAdmission(admission) {
 	if (!admission) throw new Error("Mixed registration did not start NEAR admission");
 	return admission;
 }
@@ -580,8 +575,8 @@ function ethereumAddressFromAddress20B64u(value) {
 	return `0x${Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
 }
 /**
-* Refactor 94C. Calls `/wallets/register/setup`, which replaces the bootstrap
-* grant, the registration intent, and registration start.
+* Calls `/wallets/register/setup`, which replaces the bootstrap grant, the
+* registration intent, and registration start.
 *
 * Runs before the authenticator prompt, because its response carries the
 * challenge that prompt must sign — so the Router's ECDSA preparation overlaps
@@ -688,14 +683,6 @@ async function runEcdsaEnabledThreeRouteRegistrationCeremony(args) {
 				clientCeremony: args.clientCeremony
 			})
 		});
-		const earlyNearAdmission = args.signerPlanKind === "near_ed25519_and_evm_family_ecdsa" ? startEarlyNearRegistrationAdmission({
-			relayerUrl: args.relayerUrl,
-			registrationCeremonyId: ceremonyId,
-			signedSetup: args.signedSetup,
-			authority: args.authority,
-			traceContext: args.traceContext
-		}) : null;
-		earlyNearAdmission?.catch(ignoreNearCustodyFailure);
 		const responded = await measureStrictEcdsaCeremonyStep({
 			registrationTiming: args.registrationTiming,
 			bucket: "ecdsaRegistrationGatewayRespondMs",
@@ -716,6 +703,14 @@ async function runEcdsaEnabledThreeRouteRegistrationCeremony(args) {
 		});
 		if (responded.kind === "near_ed25519") throw new Error("ECDSA registration ceremony received an Ed25519-only respond result");
 		const deferredNear = responded.kind === "near_ed25519_and_evm_family_ecdsa" ? responded.ed25519 : null;
+		const nearAdmission = deferredNear ? startNearRegistrationAdmission({
+			relayerUrl: args.relayerUrl,
+			registrationCeremonyId: ceremonyId,
+			signedSetup: args.signedSetup,
+			deferredNear,
+			traceContext: args.traceContext
+		}) : null;
+		nearAdmission?.catch(ignoreNearCustodyFailure);
 		const verified = await measureStrictEcdsaCeremonyStep({
 			registrationTiming: args.registrationTiming,
 			bucket: "ecdsaRegistrationClientProofVerifyMs",
@@ -776,8 +771,7 @@ async function runEcdsaEnabledThreeRouteRegistrationCeremony(args) {
 						deferredNear
 					});
 					deferredNearCustodyWork = args.startDeferredNearCustody({
-						deferredNear,
-						earlyAdmission: requireEarlyNearRegistrationAdmission(earlyNearAdmission),
+						admission: requireNearRegistrationAdmission(nearAdmission),
 						establishedEvmCustodyCommit: bootstrap.preActivationCommitPayload
 					});
 					deferredNearCustodyWork.catch(ignoreNearCustodyFailure);
@@ -1075,14 +1069,14 @@ async function startDeferredNearWalletCustody(base, input) {
 			operation: "near_provisioning"
 		});
 		if (!pending || pending.operation !== "near_provisioning" || pending.phase !== "planned") throw new Error("NEAR registration has no planned continuation");
-		let earlyAdmissionReceipt;
+		let preAdmittedReceipt;
 		try {
-			const early = await input.earlyAdmission;
-			if (!sameRouterAbEd25519YaoRegistrationAdmissionRequestV1(early.deferredNear.admissionRequest, pending.admissionRequest)) throw new Error("Early NEAR admission changed the authorized request");
-			earlyAdmissionReceipt = early.admissionReceipt;
+			const admitted = await input.admission;
+			if (!sameRouterAbEd25519YaoRegistrationAdmissionRequestV1(admitted.deferredNear.admissionRequest, pending.admissionRequest)) throw new Error("NEAR admission changed the authorized request");
+			preAdmittedReceipt = admitted.admissionReceipt;
 		} catch (error) {
-			if (error instanceof Error && error.message === "Early NEAR admission changed the authorized request") throw error;
-			earlyAdmissionReceipt = void 0;
+			if (error instanceof Error && error.message === "NEAR admission changed the authorized request") throw error;
+			preAdmittedReceipt = void 0;
 		}
 		const { joined, admissionReceipt } = await continueNearRegistrationCustody({
 			pending,
@@ -1091,7 +1085,7 @@ async function startDeferredNearWalletCustody(base, input) {
 			credential: base.signedSetup,
 			traceContext: base.traceContext,
 			factorSecret,
-			...earlyAdmissionReceipt ? { admitted: earlyAdmissionReceipt } : {}
+			...preAdmittedReceipt ? { admitted: preAdmittedReceipt } : {}
 		});
 		outcome = "success";
 		return {
@@ -1705,43 +1699,31 @@ async function commitDeferredEd25519Registration(args) {
 			outcome: "success"
 		});
 		await requireCurrentNearRegistrationSession(args.sessionAuthority);
-		if (args.authMaterial.kind === "passkey" && registrationSession.remainingUses > 0) {
-			const registrationEd25519Session = registrationEstablishedEd25519Session(registrationSession);
-			hydration = hydrateDeferredNearRegistrationSession({
-				signingEngine: args.context.signingEngine,
+		if (args.authMaterial.kind === "passkey" && registrationSession.remainingUses > 0) hydration = hydrateDeferredNearRegistrationSession({
+			signingEngine: args.context.signingEngine,
+			ceremonyId: args.registrationCeremonyId,
+			input: buildRegistrationPasskeyEd25519SessionHydration({
+				session: registrationSession,
 				ceremonyId: args.registrationCeremonyId,
-				input: {
-					thresholdSessionId: String(registrationEd25519Session.thresholdSessionId),
-					diagnostics: { recordDuration: recordNearRegistrationSessionTiming.bind(void 0, args.registrationCeremonyId) },
-					prfFirstB64u: args.authMaterial.prfFirstB64u,
-					expiresAtMs: registrationSession.expiresAtMs,
-					remainingUses: registrationSession.remainingUses,
-					...preparedSessionSeal && finalized.sessionSeal ? { preparedServerSeal: {
-						preparationId: preparedSessionSeal.preparationId,
-						...finalized.sessionSeal
-					} } : {},
-					transport: {
-						curve: "ed25519",
-						authMethod: "passkey",
-						walletId: String(args.walletId),
-						relayerUrl: args.relayerUrl,
-						walletSessionToken: registrationSession.operationCredential.token,
-						ed25519Restore: buildPasskeyEd25519RestoreMetadata({
-							rpId: args.authMaterial.rpId,
-							nearAccountId: String(nearAccountId),
-							nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
-							relayerKeyId: finalized.ed25519.relayerKeyId,
-							participantIds: [...finalized.ed25519.participantIds],
-							runtimePolicyScope: registrationEd25519Session.runtimePolicyScope,
-							signerSlot: finalized.ed25519.signerSlot,
-							routerAbNormalSigning: registrationEd25519Session.routerAbNormalSigning,
-							credentialIdB64u: args.authMaterial.credentialIdB64u,
-							materialActivation
-						})
-					}
+				walletId: String(args.walletId),
+				relayerUrl: args.relayerUrl,
+				prfFirstB64u: args.authMaterial.prfFirstB64u,
+				preparedServerSeal: preparedSessionSeal && finalized.sessionSeal ? {
+					preparationId: preparedSessionSeal.preparationId,
+					...finalized.sessionSeal
+				} : null,
+				restore: {
+					rpId: args.authMaterial.rpId,
+					nearAccountId: String(nearAccountId),
+					nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
+					relayerKeyId: finalized.ed25519.relayerKeyId,
+					participantIds: finalized.ed25519.participantIds,
+					signerSlot: finalized.ed25519.signerSlot,
+					credentialIdB64u: args.authMaterial.credentialIdB64u,
+					materialActivation
 				}
-			});
-		}
+			})
+		});
 		const sessionStartedAt = performance.now();
 		await args.context.signingEngine.activateAuthenticatedWalletState({
 			walletId: args.walletId,
@@ -2877,6 +2859,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			recorder: registrationTiming,
 			passkeyExecution: args.passkeyExecution
 		});
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.setup");
 		const intent = requirePasskeyRegistrationIntent(setup.intent);
 		const eventAccountId = registrationEventAccountId(String(intent.walletId));
 		emitRegistrationEvent(options.onEvent, eventAccountId, {
@@ -2902,6 +2885,8 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			passkeyExecution: args.passkeyExecution
 		});
 		postTouchIdCompletedAt = performance.now();
+		registrationTiming.capturePasskeyAuthDiagnostics(passkeyAuthority.diagnostics);
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.authentication");
 		emitRegistrationEvent(options.onEvent, eventAccountId, {
 			authMethod: "passkey",
 			phase: RegistrationEventPhase.STEP_04_PASSKEY_CREATE_SUCCEEDED,
@@ -2920,6 +2905,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			kind: "passkey",
 			webauthnRegistration: passkeyAuthority.webauthnRegistration
 		});
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.respond");
 		if (responded.kind !== "near_ed25519") throw new Error("Ed25519-only registration respond returned a different signer branch");
 		const parsedCredentialId = parseWebAuthnCredentialIdB64u(String(passkeyAuthority.credential.rawId || passkeyAuthority.credential.id || "").trim());
 		if (!parsedCredentialId.ok) throw new Error(`passkey credential id ${parsedCredentialId.error.message}`);
@@ -2956,6 +2942,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 		} finally {
 			zeroizeArrayBuffer(walletCustodyFactorSecret);
 		}
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.custody");
 		await confirmWalletRecoveryCodesBackedUp(context, String(intent.walletId), options.recoveryCodeBackup, established.recoveryCodes);
 		const walletCustodyCommit = walletCustodyCommitPayloadWithRecoveryBackupAcknowledgement(established.commitPayload);
 		if (!established.localMaterial) throw new Error("Passkey registration produced no sealed local custody material");
@@ -2983,6 +2970,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 				}
 			}
 		});
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.backup_and_checkpoint");
 		const activated = await activateWalletRegistration({
 			relayerUrl,
 			registrationCeremonyId: setup.registrationCeremonyId,
@@ -2991,6 +2979,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			headers: registrationRouteHeaders(traceContext),
 			idempotencyKey: finalizeIdempotencyKey
 		});
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.activate");
 		if (activated.kind !== "near_ed25519" || activated.nearProvisioning?.status !== "near_pending") throw new Error("Ed25519-only activate did not return a wallet pending NEAR provisioning");
 		const nearProvisioningIdempotencyKey = await deriveNearProvisioningIdempotencyKey({
 			registrationCeremonyId: setup.registrationCeremonyId,
@@ -3026,6 +3015,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			operation: "registration_activate"
 		});
 		const clientPublicKey = `ed25519:${base58Encode(established.metadata.registeredPublicKey)}`;
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.provision_checkpoint");
 		const finalized = await completeWalletRegistrationNearProvisioning({
 			relayerUrl,
 			registrationCeremonyId: setup.registrationCeremonyId,
@@ -3036,6 +3026,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			auth: { kind: "passkey" },
 			walletCustodyCommit
 		});
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.finalize");
 		if (!finalized.ok || finalized.kind !== "near_ed25519") throw new Error("Deferred NEAR provisioning returned a different signer branch");
 		if (established.commitPayload && finalized.walletCustody?.status !== "committed") {
 			const status = finalized.walletCustody?.status ?? "not_reported";
@@ -3124,6 +3115,31 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			registration
 		})).signerActivations[1];
 		if (!storedNearActivation || storedNearActivation.signerSlot !== finalized.ed25519.signerSlot) throw new Error("Ed25519 Yao registration persisted a different signer slot");
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.publication");
+		const hydration = await hydrateDeferredNearRegistrationSession({
+			signingEngine: context.signingEngine,
+			ceremonyId: setup.registrationCeremonyId,
+			input: buildRegistrationPasskeyEd25519SessionHydration({
+				session: registrationSession,
+				ceremonyId: setup.registrationCeremonyId,
+				walletId: String(finalized.walletId),
+				relayerUrl,
+				prfFirstB64u: passkeyAuthority.prfFirstB64u,
+				preparedServerSeal: null,
+				restore: {
+					rpId: finalizedPasskey.rpId,
+					nearAccountId: String(nearAccountId),
+					nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
+					relayerKeyId: finalized.ed25519.relayerKeyId,
+					participantIds: finalized.ed25519.participantIds,
+					signerSlot: finalized.ed25519.signerSlot,
+					credentialIdB64u: finalizedPasskey.credentialIdB64u,
+					materialActivation: nearEd25519YaoMaterialActivationFromMetadata(metadata)
+				}
+			})
+		});
+		if (hydration.kind === "failed") throw hydration.error;
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.session_hydration");
 		await activatePasskeyRegistrationEd25519Material({
 			signingEngine: context.signingEngine,
 			sessionAuthority: {
@@ -3140,6 +3156,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			passkeyPrfFirstB64u: passkeyAuthority.prfFirstB64u,
 			relayerUrl
 		});
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.material_activation");
 		await establishPasskeyRegistrationEd25519ExportRootCapability({
 			signingEngine: context.signingEngine,
 			commit: established.commitPayload,
@@ -3149,6 +3166,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			walletSessionId: String(registrationSession.walletSessionId),
 			expiresAtMs: registrationSession.expiresAtMs
 		});
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.export_capability");
 		await context.signingEngine.activateAuthenticatedWalletState({
 			walletId: finalized.walletId,
 			nearAccountId,
@@ -3177,6 +3195,12 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 				traceContext
 			});
 		}
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.wallet_ready");
+		emitRegistrationTimingSummary(createSucceededRegistrationTimingSummary({
+			recorder: registrationTiming,
+			authMethod: "passkey",
+			signerSet: registrationTimingSignerSetFromPlan(args.signerPlan)
+		}));
 		const result = {
 			success: true,
 			kind: "wallet_registered",
@@ -3548,11 +3572,11 @@ async function addPasskeyEd25519YaoWalletSigner(input) {
 }
 async function addPasskeyEcdsaWalletSigner(input) {
 	if (input.started.authorizationKind !== "webauthn_assertion") throw new Error("Wallet custody ECDSA add-signer requires WebAuthn authorization");
-	const authority = await walletAuthAuthorityRef({ authority: passkeyWalletAuthAuthorityFromCredential({
+	const authority = await exactPasskeyWalletAuthAuthorityRefForCredential({
 		walletId: input.walletId,
 		rpId: input.rpId,
-		credential: input.credential
-	}) });
+		credentialIdB64u: input.credentialIdB64u
+	});
 	const factorSecret = Uint8Array.from(base64UrlDecode(input.passkeyPrfFirstB64u)).buffer;
 	let pendingLocalFinalization;
 	try {
@@ -3570,7 +3594,7 @@ async function addPasskeyEcdsaWalletSigner(input) {
 	} finally {
 		zeroizeArrayBuffer(factorSecret);
 	}
-	const finalized = await finalizeWalletAddSigner({
+	const finalizeRequest = {
 		relayerUrl: input.relayerUrl,
 		walletId: input.walletId,
 		addSignerCeremonyId: input.started.addSignerCeremonyId,
@@ -3578,7 +3602,14 @@ async function addPasskeyEcdsaWalletSigner(input) {
 		kind: "evm_family_ecdsa",
 		ecdsa: { expectedKeyHandles: [pendingLocalFinalization.bootstrap.keyHandle] },
 		custodyKeySet: pendingLocalFinalization.custodyKeySet
-	});
+	};
+	let finalized;
+	try {
+		finalized = await finalizeWalletAddSigner(finalizeRequest);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		finalized = await finalizeWalletAddSigner(finalizeRequest);
+	}
 	if (finalized.kind !== "evm_family_ecdsa" || finalized.walletId !== input.walletId || finalized.rpId !== input.rpId) throw new Error("Wallet add-signer finalize returned a different ECDSA identity");
 	const walletKeys = finalized.ecdsa.walletKeys;
 	const primaryKey = walletKeys[0];
@@ -3601,6 +3632,10 @@ async function addPasskeyEcdsaWalletSigner(input) {
 		walletId: input.walletId,
 		walletKeys: localEcdsaWalletKeys
 	});
+	await IndexedDBManager.adoptAddedEcdsaSignerAuthority({
+		authority: finalized.authority,
+		materialActivation: session.materialActivation
+	});
 	emitAddSignerEventSafely(input.onEvent, input.eventAccountId, {
 		authMethod: "passkey",
 		phase: RegistrationEventPhase.STEP_08_STORAGE_PERSIST_SUCCEEDED,

package/dist/esm/react/SeamsWeb/operations/registration/registrationEd25519Yao.js

@@ -1,14 +1,15 @@
 import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseThresholdEd25519SessionId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseNearEd25519SigningKeyId } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseNearEd25519SigningKeyId } from "../../../shared-ts/src/utils/registrationIds.js";
 import { emailOtpAuthContextProviderUserId } from "../../../core/signingEngine/session/identity/laneIdentity.js";
 import { buildRouterAbEd25519SigningWalletSession } from "../../../core/signingEngine/session/routerAbSigningWalletSession.js";
 import { toAccountId } from "../../../core/types/accountIds.js";
 import { buildEmailOtpRouterAbEd25519WalletSessionState } from "../../../core/signingEngine/session/warmCapabilities/routerAbEd25519WalletSessionState.js";
+import { ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { RouterAbEd25519YaoHttpActivationTransportV1 } from "../../../core/signingEngine/threshold/ed25519/yaoClient.js";
-import { assertNever } from "./registrationTiming.js";
+import { buildPasskeyEd25519RestoreMetadata } from "../../../core/signingEngine/session/passkey/ed25519YaoSealedSession.js";
+import { assertNever, recordNearRegistrationSessionTiming } from "./registrationTiming.js";
 import { sameRuntimePolicyScope } from "./registrationStrictEcdsa.js";
 //#region src/SeamsWeb/operations/registration/registrationEd25519Yao.ts
 function passkeyWalletAuthAuthorityFromCredential(args) {
@@ -129,7 +130,37 @@ async function admitDeferredNearRegistration(work, transportConfig) {
 	if (!receipt.ok) throw new Error(receipt.message);
 	return receipt.value;
 }
+function buildRegistrationPasskeyEd25519SessionHydration(args) {
+	const ed25519 = registrationEstablishedEd25519Session(args.session);
+	return {
+		thresholdSessionId: String(ed25519.thresholdSessionId),
+		prfFirstB64u: args.prfFirstB64u,
+		expiresAtMs: args.session.expiresAtMs,
+		remainingUses: args.session.remainingUses,
+		diagnostics: { recordDuration: recordNearRegistrationSessionTiming.bind(void 0, args.ceremonyId) },
+		...args.preparedServerSeal ? { preparedServerSeal: args.preparedServerSeal } : {},
+		transport: {
+			curve: "ed25519",
+			authMethod: "passkey",
+			walletId: args.walletId,
+			relayerUrl: args.relayerUrl,
+			walletSessionToken: args.session.operationCredential.token,
+			ed25519Restore: buildPasskeyEd25519RestoreMetadata({
+				rpId: args.restore.rpId,
+				nearAccountId: args.restore.nearAccountId,
+				nearEd25519SigningKeyId: args.restore.nearEd25519SigningKeyId,
+				relayerKeyId: args.restore.relayerKeyId,
+				participantIds: args.restore.participantIds,
+				runtimePolicyScope: ed25519.runtimePolicyScope,
+				signerSlot: args.restore.signerSlot,
+				routerAbNormalSigning: ed25519.routerAbNormalSigning,
+				credentialIdB64u: args.restore.credentialIdB64u,
+				materialActivation: args.restore.materialActivation
+			})
+		}
+	};
+}
 //#endregion
-export { admitDeferredNearRegistration, buildRegistrationEmailOtpEd25519SessionState, passkeyWalletAuthAuthorityFromCredential, registrationEd25519MaterialFacts, registrationEstablishedEd25519Session, requireEd25519YaoRegistrationPublicResultMatches, requireEmailOtpEd25519YaoRegistrationPublicResultMatches, requireEmailOtpRegistrationEnrollmentMaterial, requirePasskeyRegistrationIntent };
+export { admitDeferredNearRegistration, buildRegistrationEmailOtpEd25519SessionState, buildRegistrationPasskeyEd25519SessionHydration, passkeyWalletAuthAuthorityFromCredential, registrationEd25519MaterialFacts, requireEd25519YaoRegistrationPublicResultMatches, requireEmailOtpEd25519YaoRegistrationPublicResultMatches, requireEmailOtpRegistrationEnrollmentMaterial, requirePasskeyRegistrationIntent };
 
 //# sourceMappingURL=registrationEd25519Yao.js.map

package/dist/esm/react/SeamsWeb/operations/registration/registrationSignerSet.js

@@ -1,6 +1,6 @@
 import { parseNamedNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { THRESHOLD_ED25519_2P_PARTICIPANT_IDS } from "../../../shared-ts/src/threshold/participants.js";
-import { implicitNearAccountProvisioning, sponsoredNamedNearAccountProvisioning } from "../../../shared-ts/src/utils/registrationIntent.js";
+import { implicitNearAccountProvisioning, sponsoredNamedNearAccountProvisioning } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { listThresholdEcdsaProvisionTargets } from "../session/thresholdEcdsaProvisioning.js";
 import { THRESHOLD_SECP256K1_ECDSA_2P_PARTICIPANT_IDS_V1 } from "../../../shared-ts/src/threshold/secp256k1.js";
 //#region src/SeamsWeb/operations/registration/registrationSignerSet.ts

package/dist/esm/react/SeamsWeb/operations/registration/registrationStrictEcdsa.js

@@ -1,12 +1,13 @@
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
-import { requireEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
-import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { parseCorrelationId, parseDigestB64u, parseIsoTimestamp } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { thresholdEcdsaChainTargetKey } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
+import { requireEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
+import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import "../../../shared-ts/src/signing-lanes/index.js";
+import { thresholdEcdsaChainTargetKey } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { toParticipantId } from "../../../core/signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
-import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRelayerKeyId, parseEcdsaRoleLocalBindingDigest, parseEcdsaThresholdKeyId } from "../../../core/signingEngine/session/keyMaterialBrands.js";
+import { parseEcdsaRelayerKeyId } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
+import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRoleLocalBindingDigest, parseEcdsaThresholdKeyId } from "../../../core/signingEngine/session/keyMaterialBrands.js";
 import { isRegistrationBenchmarkDiagnosticsEnabled } from "../../../core/signingEngine/walletCustody/ceremonyDriver.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { activateWalletAddSignerEcdsa, parseWalletRegistrationEcdsaDerivationRespond, respondWalletAddSignerEcdsa } from "../../../core/rpcClients/relayer/walletRegistration.js";