@seams/wallet 0.6.1 → 0.7.1

package/dist/esm/react/core/indexedDB/seamsWalletDB/ecdsaClientPresignatures.js

@@ -0,0 +1,235 @@
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { requireRecord } from "../../../shared-ts/src/utils/validation.js";
+import "../../signingEngine/workerManager/ecdsaPresignLifecycle.js";
+import { sha256Bytes } from "../../../shared-ts/src/utils/digests.js";
+import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
+import { parseEcdsaCiphertextB64u, parseEcdsaCiphertextDigest, parseEcdsaIv12B64u, parseEcdsaMaterialSealingKeyId } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
+import { canonicalRouterAbMpcMaterialActivationRefBytes, routerAbMpcMaterialActivationRefToWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { SEAMS_WALLET_INDEXES } from "../schemaNames.js";
+import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRoleLocalPersistedMaterialRef } from "../../signingEngine/session/keyMaterialBrands.js";
+import { ecdsaClientPresignPoolKey, parseEcdsaClientPresignPoolIdentity } from "../../signingEngine/workerManager/ecdsaPresignPoolIdentity.js";
+import { PRESIGNATURE_STORE, additionalData, requireExactKeys } from "./ecdsaCapabilityManifestRecords.js";
+//#region src/core/indexedDB/seamsWalletDB/ecdsaClientPresignatures.ts
+const CLIENT_PRESIGNATURE_AAD_DOMAIN = "seams/ecdsa-client-presignature/v1";
+const MAX_EXPIRED_CLIENT_PRESIGNATURE_DELETIONS_PER_TRANSACTION = 32;
+const MAX_DURABLE_CLIENT_PRESIGNATURE_FUTURE_SKEW_MS = 5 * 6e4;
+function activeMaterialMatchesPresignature(material, poolIdentity, materialRef) {
+	const scope = material.binding.routerAbEcdsaDerivationNormalSigning.scope;
+	const materialActivation = routerAbMpcMaterialActivationRefToWire(material.binding.materialActivation);
+	return scope.wallet_id === poolIdentity.walletId && base64UrlEncode(routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1(scope)) === poolIdentity.signingScopeB64u && base64UrlEncode(canonicalRouterAbMpcMaterialActivationRefBytes(materialActivation)) === poolIdentity.materialActivationB64u && scope.signing_worker.key_epoch === poolIdentity.keyEpoch && scope.activation_epoch === poolIdentity.activationEpoch && materialActivation.activation_id === poolIdentity.materialActivationId && materialActivation.capability === poolIdentity.capability && materialActivation.key_binding === poolIdentity.keyBinding && materialActivation.material_owner === poolIdentity.walletId && material.binding.durableMaterialRef === materialRef.durableMaterialRef && material.binding.bindingDigest === materialRef.bindingDigest && mpcMaterialActivationRefsEqual(material.binding.materialActivation, materialRef.materialActivation);
+}
+function materialRefMatchesPoolIdentity(materialRef, poolIdentity) {
+	return materialRef.materialActivation.activationId === poolIdentity.materialActivationId && materialRef.materialActivation.capability === poolIdentity.capability && materialRef.materialActivation.keyBinding === poolIdentity.keyBinding && materialRef.materialActivation.materialOwner === poolIdentity.walletId;
+}
+function parseDurableClientPresignatureRecordId(value) {
+	if (typeof value !== "string" || !/^ecdsa-client-presignature-[A-Za-z0-9_-]+$/.test(value)) throw new Error("ECDSA durable presignature record id is invalid");
+	return value;
+}
+function parsePresignatureTimestamp(value, label) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} is invalid`);
+	return value;
+}
+function rawRecordId(value) {
+	if (!value || typeof value !== "object" || !("record_id" in value)) return null;
+	const recordId = value.record_id;
+	return typeof recordId === "string" ? recordId : null;
+}
+function supportsStrictIndexedDbDurability() {
+	return typeof IDBTransaction !== "undefined" && "durability" in IDBTransaction.prototype;
+}
+async function deleteCursorRows(cursor, limit = Number.POSITIVE_INFINITY) {
+	let deletedCount = 0;
+	while (cursor && deletedCount < limit) {
+		await cursor.delete();
+		deletedCount += 1;
+		cursor = await cursor.continue();
+	}
+	return deletedCount;
+}
+async function deleteExpiredClientPresignatureRows(context, walletId, nowMs) {
+	return await deleteCursorRows(await context.store(PRESIGNATURE_STORE).index(SEAMS_WALLET_INDEXES.walletExpiresAt).openCursor(IDBKeyRange.bound([walletId, 0], [walletId, nowMs])), MAX_EXPIRED_CLIENT_PRESIGNATURE_DELETIONS_PER_TRANSACTION);
+}
+async function readAvailableClientPresignatureRows(context, poolIdentity, nowMs) {
+	await deleteExpiredClientPresignatureRows(context, poolIdentity.walletId, nowMs);
+	const store = context.store(PRESIGNATURE_STORE);
+	const rows = await store.index(SEAMS_WALLET_INDEXES.poolIdentityKey).getAll(ecdsaClientPresignPoolKey(poolIdentity));
+	const available = [];
+	for (const raw of rows) try {
+		const row = parseSealedAvailableClientPresignatureRow(raw);
+		if (row.expires_at_ms <= nowMs) await store.delete(row.record_id);
+		else available.push(row);
+	} catch {
+		const malformedRecordId = rawRecordId(raw);
+		if (malformedRecordId) await store.delete(malformedRecordId);
+	}
+	return available;
+}
+function presignatureAadProjection(metadata) {
+	return {
+		domain: CLIENT_PRESIGNATURE_AAD_DOMAIN,
+		version: 1,
+		pool_identity: metadata.poolIdentity,
+		durable_material_ref: metadata.durableMaterialRef,
+		presignature_id: metadata.presignatureId,
+		group_public_key33_b64u: metadata.groupPublicKey33B64u,
+		big_r33_b64u: metadata.bigR33B64u,
+		created_at_ms: metadata.createdAtMs,
+		expires_at_ms: metadata.expiresAtMs,
+		sealing_key_id: metadata.sealingKeyId
+	};
+}
+function parseSealedAvailableClientPresignatureRow(value) {
+	const record = requireRecord(value, "ECDSA durable presignature row");
+	requireExactKeys(record, "ECDSA durable presignature row", [
+		"kind",
+		"record_id",
+		"pool_identity",
+		"pool_identity_key",
+		"wallet_id",
+		"material_activation_id",
+		"durable_material_ref",
+		"presignature_id",
+		"group_public_key33_b64u",
+		"big_r33_b64u",
+		"created_at_ms",
+		"expires_at_ms",
+		"sealed"
+	]);
+	if (record.kind !== "sealed_available_client_presignature_v1") throw new Error("ECDSA durable presignature row kind is invalid");
+	const poolIdentityRecord = requireRecord(record.pool_identity, "ECDSA durable presignature pool identity");
+	requireExactKeys(poolIdentityRecord, "ECDSA durable presignature pool identity", [
+		"activationEpoch",
+		"capability",
+		"keyBinding",
+		"keyEpoch",
+		"materialActivationB64u",
+		"materialActivationId",
+		"pairRole",
+		"protocolId",
+		"relayerUrl",
+		"signingScopeB64u",
+		"walletId"
+	]);
+	const poolIdentity = parseEcdsaClientPresignPoolIdentity(poolIdentityRecord);
+	const recordId = parseDurableClientPresignatureRecordId(record.record_id);
+	const poolIdentityKeyValue = String(record.pool_identity_key ?? "");
+	if (poolIdentityKeyValue !== ecdsaClientPresignPoolKey(poolIdentity)) throw new Error("ECDSA durable presignature pool identity index is inconsistent");
+	const walletId = String(record.wallet_id ?? "").trim();
+	const materialActivationId = String(record.material_activation_id ?? "").trim();
+	if (!walletId || walletId !== poolIdentity.walletId) throw new Error("ECDSA durable presignature wallet binding is inconsistent");
+	if (!materialActivationId || materialActivationId !== poolIdentity.materialActivationId) throw new Error("ECDSA durable presignature activation binding is inconsistent");
+	const durableMaterialRef = parseEcdsaRoleLocalPersistedMaterialRef(record.durable_material_ref);
+	if (!materialRefMatchesPoolIdentity(durableMaterialRef, poolIdentity)) throw new Error("ECDSA durable presignature material binding is inconsistent");
+	const presignatureId = String(record.presignature_id ?? "").trim();
+	if (!presignatureId) throw new Error("ECDSA durable presignature id is invalid");
+	const groupPublicKey33B64u = parseEcdsaClientVerifyingPublicKey33B64u(record.group_public_key33_b64u);
+	const bigR33B64u = parseEcdsaClientVerifyingPublicKey33B64u(record.big_r33_b64u);
+	const createdAtMs = parsePresignatureTimestamp(record.created_at_ms, "created_at_ms");
+	const expiresAtMs = parsePresignatureTimestamp(record.expires_at_ms, "expires_at_ms");
+	if (createdAtMs > Date.now() + 3e5) throw new Error("ECDSA durable presignature creation timestamp is in the future");
+	if (expiresAtMs <= createdAtMs) throw new Error("ECDSA durable presignature expiry must follow creation");
+	if (expiresAtMs - createdAtMs > 7776e6) throw new Error("ECDSA durable presignature lifetime exceeds the maximum");
+	const sealed = requireRecord(record.sealed, "ECDSA durable presignature sealed payload");
+	requireExactKeys(sealed, "ECDSA durable presignature sealed payload", [
+		"kind",
+		"sealing_key_id",
+		"iv12_b64u",
+		"ciphertext_b64u",
+		"ciphertext_digest_b64u"
+	]);
+	if (sealed.kind !== "ecdsa_activation_aes_gcm_v1") throw new Error("ECDSA durable presignature sealing kind is invalid");
+	return {
+		kind: "sealed_available_client_presignature_v1",
+		record_id: recordId,
+		pool_identity: poolIdentity,
+		pool_identity_key: poolIdentityKeyValue,
+		wallet_id: walletId,
+		material_activation_id: materialActivationId,
+		durable_material_ref: durableMaterialRef,
+		presignature_id: presignatureId,
+		group_public_key33_b64u: groupPublicKey33B64u,
+		big_r33_b64u: bigR33B64u,
+		created_at_ms: createdAtMs,
+		expires_at_ms: expiresAtMs,
+		sealed: {
+			kind: "ecdsa_activation_aes_gcm_v1",
+			sealing_key_id: parseEcdsaMaterialSealingKeyId(sealed.sealing_key_id),
+			iv12_b64u: parseEcdsaIv12B64u(sealed.iv12_b64u),
+			ciphertext_b64u: parseEcdsaCiphertextB64u(sealed.ciphertext_b64u),
+			ciphertext_digest_b64u: parseEcdsaCiphertextDigest(sealed.ciphertext_digest_b64u)
+		}
+	};
+}
+function metadataFromPresignatureRow(row) {
+	return {
+		kind: "sealed_available_client_presignature_v1",
+		recordId: row.record_id,
+		poolIdentity: row.pool_identity,
+		durableMaterialRef: row.durable_material_ref,
+		presignatureId: row.presignature_id,
+		groupPublicKey33B64u: row.group_public_key33_b64u,
+		bigR33B64u: row.big_r33_b64u,
+		createdAtMs: row.created_at_ms,
+		expiresAtMs: row.expires_at_ms,
+		sealingKeyId: row.sealed.sealing_key_id
+	};
+}
+async function encryptPresignatureBytes(input) {
+	const iv12 = crypto.getRandomValues(new Uint8Array(12));
+	const aad = additionalData(presignatureAadProjection(input.metadata));
+	try {
+		const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
+			name: "AES-GCM",
+			iv: iv12,
+			additionalData: aad
+		}, input.key, input.plaintext97));
+		try {
+			const ciphertextB64u = base64UrlEncode(ciphertext);
+			return {
+				iv12B64u: parseEcdsaIv12B64u(base64UrlEncode(iv12)),
+				ciphertextB64u: parseEcdsaCiphertextB64u(ciphertextB64u),
+				ciphertextDigestB64u: parseEcdsaCiphertextDigest(base64UrlEncode(await sha256Bytes(ciphertext)))
+			};
+		} finally {
+			ciphertext.fill(0);
+		}
+	} finally {
+		iv12.fill(0);
+		aad.fill(0);
+		input.plaintext97.fill(0);
+	}
+}
+async function decryptPresignatureBytes(input) {
+	const iv12 = base64UrlDecode(input.sealed.iv12_b64u);
+	const ciphertext = base64UrlDecode(input.sealed.ciphertext_b64u);
+	const aad = additionalData(presignatureAadProjection(input.metadata));
+	let plaintext = null;
+	try {
+		if (base64UrlEncode(await sha256Bytes(ciphertext)) !== input.sealed.ciphertext_digest_b64u) throw new Error("ECDSA durable presignature ciphertext digest mismatch");
+		plaintext = new Uint8Array(await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: iv12,
+			additionalData: aad
+		}, input.key, ciphertext));
+		if (plaintext.length !== 97) throw new Error("ECDSA durable presignature plaintext length is invalid");
+		return plaintext.slice();
+	} finally {
+		iv12.fill(0);
+		ciphertext.fill(0);
+		aad.fill(0);
+		plaintext?.fill(0);
+	}
+}
+async function retireClientPresignaturesForActivationInTransaction(context, walletId, materialActivationId) {
+	const store = context.store(PRESIGNATURE_STORE);
+	const rows = await store.index(SEAMS_WALLET_INDEXES.walletMaterialActivationId).getAll([walletId, materialActivationId]);
+	for (const raw of rows) {
+		const recordId = rawRecordId(raw);
+		if (recordId) await store.delete(recordId);
+	}
+}
+//#endregion
+export { MAX_DURABLE_CLIENT_PRESIGNATURE_FUTURE_SKEW_MS, activeMaterialMatchesPresignature, decryptPresignatureBytes, deleteCursorRows, encryptPresignatureBytes, materialRefMatchesPoolIdentity, metadataFromPresignatureRow, parseDurableClientPresignatureRecordId, parsePresignatureTimestamp, parseSealedAvailableClientPresignatureRow, rawRecordId, readAvailableClientPresignatureRows, retireClientPresignaturesForActivationInTransaction, supportsStrictIndexedDbDurability };
+
+//# sourceMappingURL=ecdsaClientPresignatures.js.map

package/dist/esm/react/core/indexedDB/seamsWalletDB/repositories.js

@@ -6,18 +6,19 @@ import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef, parseVer
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { sameDelegatedWalletAuthorityV1 } from "../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseEd25519PublicKeyB64u } from "../../../shared-ts/src/passkey-custody/primitives.js";
-import { encodeWalletSignerActivationSetV1, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1, isActiveRecoveredWalletAuthorityV1, parseWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
-import { parseWalletAuthMethodRecordV2, walletIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { parseLocalAuthorityInstallationReceiptV1 } from "../../../shared-ts/src/device-linking/parsers.js";
+import { walletSessionPreservesCapabilities } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, parseEmailOtpWalletAuthAuthority, parseWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { thresholdEcdsaChainTargetFromRequest } from "../../signingEngine/interfaces/ecdsaChainTarget.js";
 import { SIGNER_KINDS } from "../../../shared-ts/src/utils/signerDomain.js";
+import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
+import { thresholdEcdsaChainTargetFromRequest } from "../../signingEngine/interfaces/ecdsaChainTarget.js";
 import { toAccountId } from "../../types/accountIds.js";
 import { SEAMS_WALLET_INDEXES, SEAMS_WALLET_STORES } from "../schemaNames.js";
 import { parseEcdsaThresholdKeyId } from "../../signingEngine/session/keyMaterialBrands.js";
-import { walletSessionPreservesCapabilities } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
+import { parseWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parsePasskeyCustodyEnvelopeRecord, sameWalletCustodyEnvelopeOwnership } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
+import { encodeWalletSignerActivationSetV1, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1, isActiveRecoveredWalletAuthorityV1, isEcdsaExtensionOfEd25519WalletAuthority, parseWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
+import { parseLocalAuthorityInstallationReceiptV1 } from "../../../shared-ts/src/device-linking/authorityActivation.js";
 import "../../../shared-ts/src/device-linking/index.js";
 import { parseNearProvisioningState } from "../../types/sdkSentEvents.js";
 import { upsertEd25519YaoPublicCapabilityReferenceInTransaction } from "../../signingEngine/threshold/ed25519/yaoPublicCapabilityReferences.js";
@@ -2822,8 +2823,7 @@ var SeamsWalletRepositories = class {
 		return await this.resolveWalletAuthorityForSelection(walletId, null);
 	}
 	/**
-	* R109C: resolve the authority as a named method rather than as the selected
-	* one.
+	* Resolve the authority as a named method rather than as the selected one.
 	*
 	* Unlocking a sibling is how an added method comes into use - invariant 9
 	* makes lock and unlock the route - and the unlock moves the selection to it.
@@ -3055,6 +3055,55 @@ var SeamsWalletRepositories = class {
 			}));
 		});
 	}
+	/**
+	* Adopts the authority the Gateway returned after this wallet added an ECDSA
+	* signer: the local authority extended with exactly the activation this
+	* device made, nothing else changed. The Gateway promoted the wallet's live
+	* Wallet Sessions to it; the next exact status read carries that promotion
+	* into the local session, which keeps its operation credential.
+	*/
+	async adoptAddedEcdsaSignerAuthority(input) {
+		const parsed = parseWalletAuthorityV1(input.authority);
+		if (!parsed.ok || parsed.value.state !== "active" || !await walletAuthorityDigestsMatchV1(parsed.value)) throw new Error("Added ECDSA signer authority is invalid");
+		const next = parsed.value;
+		const nextEcdsa = next.signerActivations.ecdsa;
+		if (!nextEcdsa || !mpcMaterialActivationRefsEqual(nextEcdsa.materialActivation, input.materialActivation)) throw new Error("Added ECDSA signer authority does not carry the activated signer");
+		await this.manager.runTransaction([SEAMS_WALLET_STORES.walletAuthorities], "readwrite", async (ctx) => {
+			const store = ctx.store(SEAMS_WALLET_STORES.walletAuthorities);
+			const current = parseWalletAuthorityStorageRow(await store.get(next.authorityId));
+			if (!current || current.record.state !== "active") throw new Error("Added ECDSA signer has no active local authority to extend");
+			if (current.record.authorityDigestB64u === next.authorityDigestB64u) return;
+			if (!isEcdsaExtensionOfEd25519WalletAuthority(current.record, next)) throw new Error("Added ECDSA signer authority is not an extension of the local authority");
+			await store.put(walletAuthorityStorageRow(next));
+		});
+	}
+	/**
+	* Replaces the exact active Wallet Session with the one a status read
+	* returned, only while it still binds the wallet's stored authority and its
+	* unlocked selection. The status crosses the network, and a publication
+	* can commit meanwhile: deferred NEAR provisioning extends the authority
+	* and rebinds the session in one transaction. Writing the older status
+	* after it would bind the session to an authority digest no longer stored,
+	* and every exact-session check would refuse it until another status read.
+	*/
+	async replaceExactActiveWalletSessionFromStatus(input) {
+		return await this.manager.runTransaction([
+			SEAMS_WALLET_STORES.walletAuthorities,
+			SEAMS_WALLET_STORES.walletSessionAuthorizations,
+			SEAMS_WALLET_STORES.walletSelections
+		], "readwrite", this.replaceExactActiveWalletSessionFromStatusInTransaction.bind(this, input));
+	}
+	async replaceExactActiveWalletSessionFromStatusInTransaction(input, ctx) {
+		const authority = parseWalletAuthorityStorageRow(await ctx.store(SEAMS_WALLET_STORES.walletAuthorities).get(input.active.authorityId));
+		const selection = parseWalletSelectionStorageRow(await ctx.store(SEAMS_WALLET_STORES.walletSelections).get(input.active.walletId));
+		if (!authority || authority.record.state !== "active" || authority.record.walletId !== input.active.walletId || authority.record.authorityDigestB64u !== input.active.authorityDigestB64u || authority.record.revocationEpoch !== input.active.authorityRevocationEpoch || !selection || selection.record.lockState !== "unlocked" || selection.record.walletAuthMethodId !== input.active.authMethodId) return { kind: "superseded" };
+		await replaceExactActiveWalletSessionAuthorizationInTransaction({
+			ctx,
+			active: input.active,
+			operationCredential: input.operationCredential
+		});
+		return { kind: "replaced" };
+	}
 	async reconcilePendingNearRegistrationAuthority(input) {
 		const authority = await this.getWalletAuthority(input.walletSession.authorityId);
 		if (!authority || authority.state !== "active" || !isActiveEcdsaWalletAuthorityV1(authority)) return;

package/dist/esm/react/core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js

@@ -0,0 +1,198 @@
+import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
+import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
+import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
+import { parseDigestB64u, parseIsoTimestamp } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseEcdsaCapabilityManifestId, parseEcdsaCapabilityManifestRevision, parseEvmFamilyEcdsaSignerId } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { parseWalletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import { buildVerifiedEcdsaPublicFacts, toEvmFamilyEcdsaKeyHandle, toParticipantId } from "../../signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
+import { seamsWalletDB } from "../singletons.js";
+import { parseEcdsaKeyHandle, parseEcdsaRelayerKeyId } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
+import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRoleLocalBindingDigest, parseEcdsaRoleLocalDurableMaterialRef, parseEcdsaThresholdKeyId } from "../../signingEngine/session/keyMaterialBrands.js";
+import { SeamsWalletRepositories } from "./repositories.js";
+import { buildEcdsaRoleLocalPublicFacts } from "../../signingEngine/session/persistence/ecdsaRoleLocalRecords.js";
+import { buildEcdsaActivationBinding, buildEcdsaCapabilityScope, buildEcdsaManifestIdentity, buildEcdsaRoleLocalMaterialBinding, buildPreparedEvmFamilySigner } from "../../signingEngine/session/material/ecdsaCapabilityManifest.js";
+import { ecdsaRegisteredPublicFactsMatch, ecdsaRoleLocalMaterialBindingsMatch, ecdsaRoleLocalPublicFactsMatch } from "./ecdsaCapabilityManifestRecords.js";
+import { IndexedDbEcdsaCapabilityManifestStore, importCommittedActivation, prepareImportedWalletCustodyEcdsaContinuity } from "./ecdsaCapabilityManifestStore.js";
+//#region src/core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.ts
+function buildWalletCustodyEcdsaContinuityImportInput(input) {
+	const authority = parseWalletAuthAuthorityRef(input.authority);
+	if (!authority || String(authority.walletId) !== String(input.walletId)) throw new Error("ECDSA custody import authority is invalid");
+	const publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(input.publicCapability);
+	const receipt = parseRouterAbEcdsaRegistrationActivationReceiptV1(input.activationReceipt);
+	const materialActivation = routerAbMpcMaterialActivationRefFromWire(receipt.ecdsa_activation.material_activation);
+	if (!mpcMaterialActivationRefsEqual(materialActivation, routerAbMpcMaterialActivationRefFromWire(publicCapability.material_activation))) throw new Error("ECDSA custody continuity changed the material activation");
+	const participantIds = [toParticipantId(input.participantIds[0]), toParticipantId(input.participantIds[1])];
+	const roleLocalBinding = buildEcdsaRoleLocalMaterialBinding({
+		keyHandle: parseEcdsaKeyHandle(input.keyHandle),
+		ecdsaThresholdKeyId: parseEcdsaThresholdKeyId(input.ecdsaThresholdKeyId),
+		clientVerifyingPublicKey33B64u: parseEcdsaClientVerifyingPublicKey33B64u(input.publicFacts.derivationClientSharePublicKey33B64u),
+		participantIds,
+		relayerKeyId: parseEcdsaRelayerKeyId(input.relayerKeyId)
+	});
+	const signer = buildPreparedEvmFamilySigner({
+		capability: materialActivation.capability,
+		signerId: parseEvmFamilyEcdsaSignerId(secureRandomId("ecdsa-signer", 32, "ECDSA custody signer identities")),
+		authority,
+		scope: buildEcdsaCapabilityScope({ targetMemberships: input.chainTargets }),
+		materialOwner: materialActivation.materialOwner,
+		signingRootId: parseSdkEcdsaDerivationSigningRootId(input.signingRootId),
+		signingRootVersion: parseSdkEcdsaDerivationSigningRootVersion(input.signingRootVersion)
+	});
+	const activationBinding = buildEcdsaActivationBinding({
+		targetManifest: buildEcdsaManifestIdentity({
+			manifestId: parseEcdsaCapabilityManifestId(secureRandomId("ecdsa-manifest", 32, "ECDSA custody manifest identities")),
+			manifestRevision: parseEcdsaCapabilityManifestRevision(1)
+		}),
+		signer,
+		roleLocalBinding,
+		bindingDigest: parseEcdsaRoleLocalBindingDigest(input.publicFacts.contextBinding32B64u),
+		durableMaterialRef: parseEcdsaRoleLocalDurableMaterialRef(secureRandomId("ecdsa-role-local-material", 32, "ECDSA custody material identities"))
+	});
+	const ethereumAddress = input.publicFacts.ethereumAddress;
+	const registeredPublicFacts = buildVerifiedEcdsaPublicFacts({
+		keyHandle: toEvmFamilyEcdsaKeyHandle(input.keyHandle),
+		publicKeyB64u: input.publicFacts.groupPublicKey33B64u,
+		participantIds,
+		thresholdOwnerAddress: ethereumAddress
+	});
+	const roleLocalPublicFacts = buildEcdsaRoleLocalPublicFacts({
+		walletId: authority.walletId,
+		chainTarget: input.chainTargets[0],
+		keyHandle: roleLocalBinding.keyHandle,
+		ecdsaThresholdKeyId: roleLocalBinding.ecdsaThresholdKeyId,
+		signingRootId: signer.signingRootId,
+		signingRootVersion: signer.signingRootVersion,
+		applicationBindingDigestB64u: publicCapability.context.application_binding_digest_b64u,
+		clientParticipantId: participantIds[0],
+		relayerParticipantId: participantIds[1],
+		participantIds,
+		contextBinding32B64u: input.publicFacts.contextBinding32B64u,
+		derivationClientSharePublicKey33B64u: input.publicFacts.derivationClientSharePublicKey33B64u,
+		relayerPublicKey33B64u: input.publicFacts.relayerPublicKey33B64u,
+		groupPublicKey33B64u: input.publicFacts.groupPublicKey33B64u,
+		ethereumAddress,
+		publicCapability
+	});
+	const normalSigning = {
+		kind: "router_ab_ecdsa_derivation_normal_signing_v1",
+		scope: {
+			wallet_id: String(authority.walletId),
+			ecdsa_threshold_key_id: String(roleLocalBinding.ecdsaThresholdKeyId),
+			signing_root_id: String(signer.signingRootId),
+			signing_root_version: String(signer.signingRootVersion),
+			context: receipt.ecdsa_activation.context,
+			public_identity: receipt.ecdsa_activation.public_identity,
+			material_activation: receipt.ecdsa_activation.material_activation,
+			signing_worker: receipt.ecdsa_activation.signing_worker,
+			activation_epoch: receipt.ecdsa_activation.activation_epoch
+		}
+	};
+	return {
+		activationBinding,
+		serverCommit: {
+			correlationId: receipt.activation_correlation_id,
+			activationRequestDigest: parseDigestB64u(base64UrlEncode(Uint8Array.from(receipt.activation_request_digest.bytes))),
+			serverGeneration: receipt.server_generation,
+			protocolReceipt: receipt
+		},
+		readyStateBlobB64u: input.readyStateBlobB64u,
+		registeredPublicFacts,
+		roleLocalPublicFacts,
+		routerAbEcdsaDerivationNormalSigning: normalSigning,
+		runtimePolicyScope: normalizeRuntimePolicyScope(input.runtimePolicyScope),
+		committedAt: parseIsoTimestamp(new Date(receipt.ecdsa_activation.activated_at_ms).toISOString())
+	};
+}
+async function prepareWalletCustodyEcdsaContinuity(input) {
+	return prepareImportedWalletCustodyEcdsaContinuity(buildWalletCustodyEcdsaContinuityImportInput(input));
+}
+async function importWalletCustodyEcdsaContinuity(input) {
+	return await importCommittedActivation(input.store, buildWalletCustodyEcdsaContinuityImportInput(input), (prepared) => input.store.persistPreparedWalletCustodyEcdsaContinuity(prepared));
+}
+async function assertSharedWalletAuthorityMembership(input) {
+	const repositories = new SeamsWalletRepositories(seamsWalletDB);
+	for (const walletAuthMethodId of input.walletAuthMethodIds) {
+		const authMethod = await repositories.getWalletAuthMethodV2(String(walletAuthMethodId));
+		if (!authMethod || authMethod.status !== "active" || authMethod.walletId !== input.walletId || authMethod.walletAuthorityId !== input.walletAuthorityId) throw new Error(`ECDSA custody continuity method ${String(walletAuthMethodId)} is not an active member of the wallet authority`);
+	}
+}
+/**
+* Give an added auth method its own encrypted access projection over the
+* activation the wallet already has. The activation is not re-created and the
+* source credential's authority is not widened; only a second method-bound
+* record over the same material appears.
+*
+* The membership check is the whole safety argument. Copying access to a method
+* on another wallet authority would hand that credential custody it was never
+* granted, so both methods are read back and required to be active members of
+* the exact same authority before anything is opened.
+*/
+async function copyWalletCustodyEcdsaContinuityToAuthMethod(input) {
+	if (input.targetAuthority.walletId !== input.walletId || input.targetAuthority.walletAuthMethodId === input.sourceWalletAuthMethodId) throw new Error("ECDSA custody continuity target is invalid");
+	await assertSharedWalletAuthorityMembership({
+		walletId: input.walletId,
+		walletAuthorityId: input.walletAuthorityId,
+		walletAuthMethodIds: [input.sourceWalletAuthMethodId, input.targetAuthority.walletAuthMethodId]
+	});
+	const store = new IndexedDbEcdsaCapabilityManifestStore();
+	const listed = await store.listActiveWalletCapabilitySubjects(input.walletId);
+	if (listed.kind !== "resolved") throw new Error(`ECDSA custody continuity inventory is ${listed.kind}`);
+	if (listed.subjects.length === 0) return;
+	const sources = listed.subjects.filter((subject) => subject.authority.walletAuthMethodId === input.sourceWalletAuthMethodId);
+	if (sources.length === 0) throw new Error(`ECDSA custody continuity found no active capability for source method ${String(input.sourceWalletAuthMethodId)} among [${listed.subjects.map((subject) => String(subject.authority.walletAuthMethodId)).join(", ")}]`);
+	for (const source of sources) {
+		const sourceLookup = await store.lookup(source);
+		if (sourceLookup.kind !== "active") throw new Error(`ECDSA custody continuity source is ${sourceLookup.kind}`);
+		const targetSelector = {
+			capability: source.capability,
+			authority: input.targetAuthority
+		};
+		const targetLookup = await store.lookup(targetSelector);
+		if (targetLookup.kind === "active") {
+			const targetMaterial = targetLookup.manifest.durableMaterial;
+			const sourceMaterial = sourceLookup.manifest.durableMaterial;
+			if (targetMaterial.activationDigest !== sourceMaterial.activationDigest || targetMaterial.bindingDigest !== sourceMaterial.bindingDigest || targetMaterial.roleLocalBinding.ecdsaThresholdKeyId !== sourceMaterial.roleLocalBinding.ecdsaThresholdKeyId || !ecdsaRoleLocalMaterialBindingsMatch(targetMaterial.roleLocalBinding, sourceMaterial.roleLocalBinding) || !ecdsaRoleLocalPublicFactsMatch(targetMaterial.roleLocalPublicFacts, sourceMaterial.roleLocalPublicFacts) || !ecdsaRegisteredPublicFactsMatch(targetLookup.manifest.signer.registeredPublicFacts, sourceLookup.manifest.signer.registeredPublicFacts)) throw new Error("ECDSA custody continuity target conflicts with source material");
+			continue;
+		}
+		if (targetLookup.kind !== "missing") throw new Error(`ECDSA custody continuity target is ${targetLookup.kind}`);
+		const opened = await store.openActiveMaterialLookup(sourceLookup);
+		if (opened.kind !== "active") throw new Error(`ECDSA custody continuity material is ${opened.kind}`);
+		const manifest = opened.manifest;
+		const publicFacts = manifest.durableMaterial.roleLocalPublicFacts;
+		const imported = await importWalletCustodyEcdsaContinuity({
+			store,
+			authority: input.targetAuthority,
+			chainTargets: manifest.signer.scope.targetMemberships,
+			walletId: String(input.walletId),
+			keyHandle: publicFacts.keyHandle,
+			ecdsaThresholdKeyId: String(publicFacts.ecdsaThresholdKeyId),
+			signingRootId: String(publicFacts.signingRootId),
+			signingRootVersion: String(publicFacts.signingRootVersion),
+			relayerKeyId: String(manifest.durableMaterial.roleLocalBinding.relayerKeyId),
+			participantIds: publicFacts.participantIds,
+			publicCapability: publicFacts.publicCapability,
+			activationReceipt: manifest.activation.serverActivation.serverActivationReceipt.protocolReceipt,
+			runtimePolicyScope: manifest.durableMaterial.runtimePolicyScope,
+			readyStateBlobB64u: opened.readyStateBlobB64u,
+			publicFacts: {
+				contextBinding32B64u: publicFacts.contextBinding32B64u,
+				derivationClientSharePublicKey33B64u: publicFacts.derivationClientSharePublicKey33B64u,
+				clientVerifyingShare33B64u: publicFacts.publicCapability.public_identity.derivation_client_share_public_key33_b64u,
+				relayerPublicKey33B64u: publicFacts.relayerPublicKey33B64u,
+				groupPublicKey33B64u: publicFacts.groupPublicKey33B64u,
+				ethereumAddress: publicFacts.ethereumAddress,
+				clientShareRetryCounter: publicFacts.publicCapability.public_identity.client_share_retry_counter,
+				relayerShareRetryCounter: publicFacts.publicCapability.public_identity.server_share_retry_counter
+			}
+		});
+		if (imported.kind !== "committed") throw new Error(`ECDSA custody continuity import is ${imported.kind}`);
+	}
+}
+//#endregion
+export { copyWalletCustodyEcdsaContinuityToAuthMethod, importWalletCustodyEcdsaContinuity, prepareWalletCustodyEcdsaContinuity };
+
+//# sourceMappingURL=walletCustodyEcdsaContinuity.js.map

package/dist/esm/react/core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js

@@ -1,7 +1,7 @@
 import { parseMpcMaterialActivationRef, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/parsers.js";
+import { parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { SEAMS_WALLET_INDEXES, SEAMS_WALLET_STORES } from "../schemaNames.js";
 import { seamsWalletDB } from "../singletons.js";
 //#region src/core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.ts

package/dist/esm/react/core/indexedDB/unifiedIndexedDBManager.js

@@ -297,6 +297,12 @@ var UnifiedIndexedDBManager = class {
 	async publishPendingWalletRegistrationCommitAndRetain(input) {
 		return this.seamsWalletRepositories.publishPendingWalletRegistrationCommitAndRetain(input);
 	}
+	async adoptAddedEcdsaSignerAuthority(input) {
+		await this.seamsWalletRepositories.adoptAddedEcdsaSignerAuthority(input);
+	}
+	async replaceExactActiveWalletSessionFromStatus(input) {
+		return await this.seamsWalletRepositories.replaceExactActiveWalletSessionFromStatus(input);
+	}
 	async reconcilePendingNearRegistrationAuthority(input) {
 		await this.seamsWalletRepositories.reconcilePendingNearRegistrationAuthority(input);
 	}

package/dist/esm/react/core/indexedDB/walletCustodyEd25519MaterialRecord.js

@@ -1,5 +1,5 @@
-import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
 import { base58Encode } from "../../shared-ts/src/utils/base58.js";
+import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
 import { buildEnvelopeAAD } from "./keyMaterialEnvelope.js";
 //#region src/core/indexedDB/walletCustodyEd25519MaterialRecord.ts
 const WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND = "wallet_custody_ed25519_active_client_v1";

package/dist/esm/react/core/platform/browser/createBrowserPlatformRuntime.js

@@ -1,5 +1,5 @@
-import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { errorMessage } from "../../../shared-ts/src/utils/errors.js";
+import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../shared-ts/src/utils/signingSessionSeal.js";
 import { getPrfFirstB64uFromCredential } from "../../signingEngine/webauthnAuth/credentials/credentialExtensions.js";
 import { toRpId } from "../../signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
@@ -35,22 +35,6 @@ function signerCryptoCommandFailure(code, message) {
 		message
 	};
 }
-function requiredString(value, field) {
-	if (typeof value !== "string") throw new Error(`ECDSA client bootstrap state is missing ${field}`);
-	const normalized = value.trim();
-	if (!normalized) throw new Error(`ECDSA client bootstrap state is missing ${field}`);
-	return normalized;
-}
-function requiredNonNegativeInteger(value, field) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(`${field} must be a non-negative safe integer`);
-	return value;
-}
-function requireBase64UrlBytes(value, field, byteLength) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error(`${field} is required`);
-	if (base64UrlDecode(normalized).length !== byteLength) throw new Error(`${field} must decode to ${byteLength} bytes`);
-	return normalized;
-}
 function decodeBase64UrlArrayBuffer(value) {
 	const decoded = base64UrlDecode(value);
 	const out = new ArrayBuffer(decoded.byteLength);
@@ -86,17 +70,6 @@ function browserPasskeyCreationOptions(options) {
 		} } }
 	};
 }
-function parsePublicKey33B64u(value, field) {
-	return requireBase64UrlBytes(value, field, 33);
-}
-function parseRelayerEcdsaDerivationPublicKey33B64u(value) {
-	return parsePublicKey33B64u(value, "ECDSA relayer DERIVATION public key");
-}
-function parseEthereumAddress(value) {
-	const normalized = String(value || "").trim();
-	if (!/^0x[0-9a-fA-F]{40}$/.test(normalized)) throw new Error("ECDSA relayer public identity has invalid ethereumAddress");
-	return normalized;
-}
 function isNativeBindingFailureMessage(message) {
 	return /wasm (initialization|initialize|instantiation)|webassembly|module_or_path|failed to (load|compile|instantiate) wasm|derivation client wasm initialization failed/i.test(message);
 }
@@ -122,17 +95,6 @@ function mapFinalizeEcdsaCommandError(error) {
 	if (/relayer|public identity|group public key|ethereum address|threshold public key/i.test(message)) return signerCryptoCommandFailure("public_identity_mismatch", message);
 	return signerCryptoCommandFailure("invalid_pending_state", message);
 }
-function parseRelayerPublicIdentity(input) {
-	if (input === null || typeof input !== "object" || Array.isArray(input)) throw new Error("ECDSA relayer public identity must be an object");
-	if (Object.keys(input).sort().join(",") !== "ethereumAddress,groupPublicKey33B64u,relayerKeyId,relayerPublicKey33B64u,relayerShareRetryCounter") throw new Error("ECDSA relayer public identity fields are invalid");
-	return {
-		relayerKeyId: requiredString(Reflect.get(input, "relayerKeyId"), "relayerKeyId"),
-		relayerPublicKey33B64u: parseRelayerEcdsaDerivationPublicKey33B64u(requiredString(Reflect.get(input, "relayerPublicKey33B64u"), "relayerPublicKey33B64u")),
-		groupPublicKey33B64u: parsePublicKey33B64u(requiredString(Reflect.get(input, "groupPublicKey33B64u"), "groupPublicKey33B64u"), "groupPublicKey33B64u"),
-		ethereumAddress: parseEthereumAddress(Reflect.get(input, "ethereumAddress")),
-		relayerShareRetryCounter: requiredNonNegativeInteger(Reflect.get(input, "relayerShareRetryCounter"), "relayerShareRetryCounter")
-	};
-}
 function createBrowserDurableRecordStore(indexedDB) {
 	return {
 		kind: "durable_record_store",
@@ -479,11 +441,6 @@ function createBrowserSignerCryptoPort(workerCtx) {
 		},
 		async finalizeEcdsaClientBootstrap(input) {
 			if (input.pendingStateBlob.kind !== "ecdsa_role_local_pending_state_blob_v1" || input.pendingStateBlob.curve !== "secp256k1" || input.pendingStateBlob.encoding !== "base64url" || input.pendingStateBlob.producer !== "signer_core") return signerCryptoCommandFailure("invalid_pending_state", "ECDSA client bootstrap pending blob envelope is invalid");
-			try {
-				parseRelayerPublicIdentity(input.relayerPublicIdentity);
-			} catch (error) {
-				return signerCryptoCommandFailure("invalid_relayer_public_identity", errorMessage(error));
-			}
 			if (!workerCtx) return signerCryptoInvocationFailure("unavailable", "ECDSA client bootstrap worker context is unavailable");
 			try {
 				return {