@seams/wallet 0.6.2 → 0.7.3

package/THIRD_PARTY_NOTICES.md

@@ -5,7 +5,7 @@ distributed Seams Wallet SDK, server runtime, Wasm, strict Workers, and CLI.
 Dependency license expressions come from their package metadata. Packaged
 license and notice wording is reproduced below with normalized whitespace.
 
-Inventory: 522 dependency records (110 npm, 412 Cargo).
+Inventory: 518 dependency records (110 npm, 408 Cargo).
 
 ## Dependency inventory
 
@@ -26,7 +26,6 @@ Inventory: 522 dependency records (110 npm, 412 Cargo).
 | cargo | base64 | 0.23.1 | MIT OR Apache-2.0 | Marshall Pierce <marshall@mpierce.org> |
 | cargo | base64ct | 1.8.0 | Apache-2.0 OR MIT | RustCrypto Developers |
 | cargo | base64ct | 1.8.3 | Apache-2.0 OR MIT | RustCrypto Developers |
-| cargo | bincode | 1.3.3 | MIT | David Tolnay <dtolnay@gmail.com>; Francesco Mazzoli <f@mazzo.li>; Ty Overby <ty@pre-alpha.com>; Zoey Riordan <zoey@dos.cafe> |
 | cargo | bitflags | 2.13.0 | MIT OR Apache-2.0 | The Rust Project Developers |
 | cargo | bitflags | 2.13.1 | MIT OR Apache-2.0 | The Rust Project Developers |
 | cargo | block-buffer | 0.10.4 | MIT OR Apache-2.0 | RustCrypto Developers |
@@ -157,7 +156,6 @@ Inventory: 522 dependency records (110 npm, 412 Cargo).
 | cargo | hashbrown | 0.17.1 | MIT OR Apache-2.0 |  |
 | cargo | hashlink | 0.9.1 | MIT OR Apache-2.0 | kyren <kerriganw@gmail.com> |
 | cargo | heapless | 0.7.17 | MIT OR Apache-2.0 | Emil Fresk <emil.fresk@gmail.com>; Jorge Aparicio <jorge@japaric.io>; Per Lindgren <per.lindgren@ltu.se> |
-| cargo | hex-literal | 0.4.1 | MIT OR Apache-2.0 | RustCrypto Developers |
 | cargo | hex | 0.4.3 | MIT OR Apache-2.0 | KokaKiwi <kokakiwi@kokakiwi.net> |
 | cargo | hkdf | 0.12.4 | MIT OR Apache-2.0 | RustCrypto Developers |
 | cargo | hkdf | 0.13.0 | MIT OR Apache-2.0 | RustCrypto Developers |
@@ -251,8 +249,6 @@ Inventory: 522 dependency records (110 npm, 412 Cargo).
 | cargo | rand_core | 0.9.5 | MIT OR Apache-2.0 | The Rand Project Developers; The Rust Project Developers |
 | cargo | rfc6979 | 0.4.0 | Apache-2.0 OR MIT | RustCrypto Developers |
 | cargo | ring | 0.17.14 | Apache-2.0 AND ISC |  |
-| cargo | rmp-serde | 1.3.1 | MIT | Evgeny Safronov <division494@gmail.com> |
-| cargo | rmp | 0.8.15 | MIT | Evgeny Safronov <division494@gmail.com>; Kornel <kornel@geekhood.net> |
 | cargo | rusqlite | 0.32.1 | MIT | The rusqlite developers |
 | cargo | rustc_version | 0.4.1 | MIT OR Apache-2.0 |  |
 | cargo | rustls-native-certs | 0.8.4 | Apache-2.0 OR ISC OR MIT |  |
@@ -9739,37 +9735,6 @@ Applies to:
     DEALINGS IN THE SOFTWARE.
 
 
-### 90d7e062634054e6
-
-Packaged as: LICENSE.md
-
-Applies to:
-
-- cargo:bincode@1.3.3
-
-    The MIT License (MIT)
-
-    Copyright (c) 2014 Ty Overby
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to deal
-    in the Software without restriction, including without limitation the rights
-    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-    copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all
-    copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    SOFTWARE.
-
-
 ### 9117d922e6671255
 
 Packaged as: LICENSE-MIT
@@ -10033,38 +9998,6 @@ Applies to:
     THE SOFTWARE.
 
 
-### 979d35e1d1572891
-
-Packaged as: LICENSE
-
-Applies to:
-
-- cargo:rmp-serde@1.3.1
-- cargo:rmp@0.8.15
-
-    MIT License
-
-    Copyright (c) 2017 Evgeny Safronov
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to deal
-    in the Software without restriction, including without limitation the rights
-    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-    copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in all
-    copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    SOFTWARE.
-
-
 ### 98181e7249d0c017
 
 Packaged as: LICENSE-MIT
@@ -11372,7 +11305,6 @@ Applies to:
 - cargo:ghash@0.5.1
 - cargo:hash2curve@0.14.0
 - cargo:hash2curve@0.14.0-rc.12
-- cargo:hex-literal@0.4.1
 - cargo:hkdf@0.12.4
 - cargo:hkdf@0.13.0
 - cargo:hmac@0.12.1
@@ -15147,42 +15079,6 @@ Applies to:
     DEALINGS IN THE SOFTWARE.
 
 
-### fbe7b9b51878efdf
-
-Packaged as: LICENSE-MIT
-
-Applies to:
-
-- cargo:hex-literal@0.4.1
-
-    Copyright (c) 2018 Artyom Pavlov
-    Copyright (c) 2018 The RustCrypto Project Developers
-
-    Permission is hereby granted, free of charge, to any
-    person obtaining a copy of this software and associated
-    documentation files (the "Software"), to deal in the
-    Software without restriction, including without
-    limitation the rights to use, copy, modify, merge,
-    publish, distribute, sublicense, and/or sell copies of
-    the Software, and to permit persons to whom the Software
-    is furnished to do so, subject to the following
-    conditions:
-
-    The above copyright notice and this permission notice
-    shall be included in all copies or substantial portions
-    of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
-    ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
-    TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
-    PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
-    SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-    CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-    OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
-    IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
-    DEALINGS IN THE SOFTWARE.
-
-
 ### fd80a26fbb3f644a
 
 Packaged as: LICENSE-MIT.md

package/dist/.build-inputs.sha256

@@ -1 +1 @@
-0d1577c2c1b97c7654920198df26f4d567031af57e0d5e0fb0262a294a65493a
+3cc408d97f9589145a26282262beee98f19671404d60cfe9373dbe147ef10de6

package/dist/esm/SeamsWeb/SeamsWeb.js

@@ -1,29 +1,30 @@
 import { parseMpcMaterialActivationRef, parseWalletAuthMethodId } from "../shared-ts/src/utils/domainIds.js";
-import { sha256HexUtf8 } from "../shared-ts/src/utils/digests.js";
-import { createServerAllocatedWalletId } from "../shared-ts/src/utils/registrationIntent.js";
 import { isObject } from "../shared-ts/src/utils/validation.js";
-import { isEmailOtpWalletAuthAuthority, parseWalletAuthAuthorityRef } from "../shared-ts/src/utils/walletAuthAuthority.js";
-import { parseLinkedDeviceApprovalResultV1 } from "../shared-ts/src/device-linking/parsers.js";
+import { sha256HexUtf8 } from "../shared-ts/src/utils/digests.js";
 import { WalletSessionStatusReadScope } from "../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { RegistrationEventPhase, UnlockEventPhase, createRegistrationFlowEvent, createUnlockFlowEvent } from "../core/types/sdkSentEvents.js";
 import { readNearProvisioningState } from "../core/signingEngine/flows/registration/nearProvisioningRegistry.js";
+import { createServerAllocatedWalletId } from "../shared-ts/src/utils/registrationIds.js";
 import { nearAccountBindingFromRaw } from "../shared-ts/src/utils/walletCapabilityBindings.js";
 import { resolvePrimaryNearRpcUrl } from "../core/config/chains.js";
 import { configuredThresholdEcdsaChainTargets, nearAccountRefFromAccountId, thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetsEqual, toWalletId, walletSessionRefFromSession } from "../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { parseExactEcdsaSigningLaneIdentity, parseExactEd25519ExportMaterialIdentity } from "../core/signingEngine/session/identity/exactSigningLaneIdentity.js";
 import { isRegistrationBenchmarkDiagnosticsEnabled } from "../core/signingEngine/walletCustody/ceremonyDriver.js";
+import { isEmailOtpWalletAuthAuthority, parseWalletAuthAuthorityRef } from "../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseLinkedDeviceApprovalResultV1 } from "../shared-ts/src/device-linking/parsers.js";
 import "../shared-ts/src/device-linking/index.js";
 import { isUserCancellationError, toError } from "../shared-ts/src/utils/errors.js";
 import { cloneAuthenticatorOptions } from "../shared-ts/src/utils/authenticatorOptions.js";
 import { walletSessionAuthorizations } from "../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
 import { IndexedDBManager } from "../core/indexedDB/index.js";
 import { IndexedDbEcdsaCapabilityManifestStore } from "../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
+import { resolveLinkedEcdsaHolderRuntimeV1 } from "../core/signingEngine/session/material/linkedEcdsaHolderRuntime.js";
 import { MinimalNearClient } from "../core/rpcClients/near/NearClient.js";
 import { resolveAppearanceTheme, resolveThemePalette } from "../core/config/configHelpers.js";
 import { buildConfigsFromEnv } from "../core/config/defaultConfigs.js";
 import { activateEmailOtpWalletAfterUnlock, persistVerifiedEmailOtpAuthorityAfterUnlock, walletAuthAuthorityRefForVerifiedEmailOtpUnlock } from "./operations/authMethods/emailOtp/walletActivation.js";
 import { __isWalletIframeHostMode } from "../core/browser/walletIframe/host-mode.js";
-import { readUnlockedWalletEd25519ExportRootCapabilityV1, walletCustodyCeremonyTransportFromWorkerContextV1 } from "../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
+import { readUnlockedEd25519ExportRootLinkingCapabilityV1, walletCustodyCeremonyTransportFromWorkerContextV1 } from "../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
 import { resolveAmbiguousEcdsaActivationForSelectedAuthMethod } from "./assembly/browserSigningSurfaceAssembly.js";
 import { BrowserSigningSurface } from "./signingSurface/BrowserSigningSurface.js";
 import { WALLET_IFRAME_TRANSPORT_TIMING_LABEL } from "./operations/registration/registrationTiming.js";
@@ -41,19 +42,20 @@ import { parseWalletIframeExactSessionIdentity } from "./walletIframe/shared/exa
 import { resolveBrowserWorkerWarmupPolicy } from "./assembly/browserWorkerWarmupPolicy.js";
 import { configureBrowserIndexedDB } from "./assembly/configureBrowserIndexedDB.js";
 import { createBrowserHostPlatformRuntime, createBrowserSigningRuntime } from "./assembly/createBrowserSigningRuntime.js";
+import { scheduleRestoredSessionPresignaturePrefills } from "./walletIframe/host/restoredSessionPresignaturePrefill.js";
 import { createBrowserSigningStores } from "./assembly/createBrowserSigningStores.js";
 import { initializeBrowserSigningRuntime } from "./assembly/initializeBrowserSigningRuntime.js";
 import { assertWalletRuntimePostconditions } from "../core/signingEngine/session/postconditions/runtimePostconditions.js";
 import { resolveExactLinkedEmailOtpAuthority, resolveLinkedDeviceEmailOtpAuthoritySelection, unlockLinkedDeviceEmailOtpWallet } from "./operations/auth/login.js";
-import { getWalletSessionDomain } from "./operations/auth/walletAuth.js";
+import { getWalletSessionDomain, prefillRouterAbEcdsaDerivationPresignaturePoolDomain } from "./operations/auth/walletAuth.js";
 import { LINKED_DEVICE_SESSION_HTTP_BASE_PATH_V1 } from "./operations/devices/deviceLinkingHttpTransport.js";
 import { createWalletIframeLinkedDeviceManagementPortV1 } from "./publicApi/devices.js";
 import { resolveConfiguredChainTarget } from "./publicApi/chainTargets.js";
 import { buildNearWalletRegistrationSignerSetSelection, resolvePasskeyRegistrationAccountProvisioning } from "./operations/registration/registrationSignerSet.js";
 import { requireTempoFeeTokenPreferenceSigningRequest } from "../core/signingEngine/chains/tempo/feeToken.js";
 import { createPublicApi } from "./publicApi/createPublicApi.js";
-import { createWalletHostCompositionV1 } from "./operations/devices/walletHostComposition.js";
 import { createWalletHostOwnerAuthoritiesV1 } from "./operations/devices/walletHostOwnerAuthority.js";
+import { createWalletHostCompositionV1 } from "./operations/devices/walletHostComposition.js";
 import { createDeviceLinkingEcdsaSourceContributionMetadataReaderV1, createDeviceLinkingEd25519SourceContributionPortV1, createDeviceLinkingSourceContributionPortV1 } from "../core/signingEngine/workerManager/deviceLinkingSourceContribution.js";
 import { beginGoogleEmailOtpWalletAuth } from "./operations/authMethods/emailOtp/googleEmailOtpWalletAuthFlow.js";
 import { acknowledgeWalletRecoveryBackup, readWalletRecoveryCodeStatus, requestWalletCustodyEmailOtpChallenge } from "../core/rpcClients/relayer/walletRecoveryRotate.js";
@@ -404,21 +406,31 @@ function createWalletHostOwnerApprovalUpdatesV1(args) {
 	};
 }
 function createWalletHostEcdsaSourceContributionMetadataReaderV1(args) {
-	return createDeviceLinkingEcdsaSourceContributionMetadataReaderV1({ readActiveEcdsaCapabilityManifestV1: async ({ materialActivation }) => {
-		const authentication = args.signingEngine.readWalletAuthenticationState();
-		if (authentication.kind !== "authenticated") throw new Error("ECDSA source metadata requires an authenticated wallet");
-		let lookup = await ecdsaCapabilityManifestStore.lookupByMaterialActivation({
-			walletId: authentication.walletId,
-			materialActivation
-		});
-		if (lookup.kind === "ambiguous_authority") lookup = await resolveAmbiguousEcdsaActivationForSelectedAuthMethod({
-			walletId: authentication.walletId,
-			materialActivation,
-			authorities: lookup.authorities
-		});
-		if (lookup.kind !== "active") throw new Error(`ECDSA source metadata manifest is ${lookup.kind}`);
-		return lookup.manifest;
-	} });
+	return createDeviceLinkingEcdsaSourceContributionMetadataReaderV1({
+		readActiveEcdsaCapabilityManifestV1: async ({ materialActivation }) => {
+			const authentication = args.signingEngine.readWalletAuthenticationState();
+			if (authentication.kind !== "authenticated") throw new Error("ECDSA source metadata requires an authenticated wallet");
+			let lookup = await ecdsaCapabilityManifestStore.lookupByMaterialActivation({
+				walletId: authentication.walletId,
+				materialActivation
+			});
+			if (lookup.kind === "ambiguous_authority") lookup = await resolveAmbiguousEcdsaActivationForSelectedAuthMethod({
+				walletId: authentication.walletId,
+				materialActivation,
+				authorities: lookup.authorities
+			});
+			if (lookup.kind !== "active") throw new Error(`ECDSA source metadata manifest is ${lookup.kind}`);
+			return lookup.manifest;
+		},
+		readLinkedEcdsaHolderV1: ({ materialActivation }) => {
+			const authentication = args.signingEngine.readWalletAuthenticationState();
+			if (authentication.kind !== "authenticated") return null;
+			return resolveLinkedEcdsaHolderRuntimeV1({
+				walletId: authentication.walletId,
+				materialActivation
+			});
+		}
+	});
 }
 function createWalletHostDeviceDomainConstructionV1(args) {
 	const relayerUrl = String(args.configs.network.relayer?.url || "").trim();
@@ -429,7 +441,7 @@ function createWalletHostDeviceDomainConstructionV1(args) {
 		walletSessions: walletSessionAuthorizations,
 		resolveSelectedWalletAuthority: IndexedDBManager.resolveSelectedWalletAuthority.bind(IndexedDBManager),
 		readWalletAuthenticationState: args.signingEngine.readWalletAuthenticationState.bind(args.signingEngine),
-		readUnlockedEd25519ExportRootCapabilityV1: readUnlockedWalletEd25519ExportRootCapabilityV1
+		readUnlockedEd25519ExportRootCapabilityV1: readUnlockedEd25519ExportRootLinkingCapabilityV1
 	});
 	return {
 		platform,
@@ -609,6 +621,14 @@ var SeamsWeb = class {
 	async getWalletIframeExactSessionState() {
 		return await this.walletIframe.getExactSessionState();
 	}
+	/** @internal One wallet-host restore owns all configured-chain prefills. */
+	async prefillRestoredWalletSession(state) {
+		await scheduleRestoredSessionPresignaturePrefills({
+			state,
+			chainTargets: this.configuredChainTargets(),
+			prefill: prefillRouterAbEcdsaDerivationPresignaturePoolDomain.bind(null, this.getWalletAuthDeps())
+		});
+	}
 	async openHostedAuthMenu(request, anchorElement) {
 		return await this.walletIframe.openHostedAuthMenu(request, anchorElement);
 	}
@@ -957,76 +977,6 @@ var SeamsWeb = class {
 			error: { message: input.error.message }
 		});
 	}
-	emitEmailOtpRegistrationWorkerProgress(onEvent, args) {
-		const base = {
-			flowId: args.flowId,
-			walletId: args.walletId,
-			authMethod: "email_otp",
-			...args.challengeId ? { requestId: args.challengeId } : {}
-		};
-		switch (args.progress.code) {
-			case "otp.verify.succeeded":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_04_OTP_VERIFY_SUCCEEDED,
-					status: "succeeded",
-					interaction: {
-						kind: "otp_input",
-						overlay: "hide"
-					}
-				});
-				return RegistrationEventPhase.STEP_04_OTP_VERIFY_SUCCEEDED;
-			case "signer.email_otp.enroll.started":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_STARTED,
-					status: "running"
-				});
-				return RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_STARTED;
-			case "signer.email_otp.enroll.succeeded":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_SUCCEEDED,
-					status: "succeeded"
-				});
-				return RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_SUCCEEDED;
-			case "signer.ecdsa.bootstrap.started":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED,
-					status: "running",
-					data: { chainTarget: args.chainTarget }
-				});
-				return RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED;
-			case "signer.ecdsa.bootstrap.prepared":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED,
-					status: "running",
-					message: "Coordinating EVM signing session",
-					data: { chainTarget: args.chainTarget }
-				});
-				return RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED;
-			case "signer.ecdsa.bootstrap.responded":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED,
-					status: "running",
-					message: "Finalizing EVM signing session",
-					data: { chainTarget: args.chainTarget }
-				});
-				return RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED;
-			case "signer.ecdsa.bootstrap.succeeded":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_SUCCEEDED,
-					status: "succeeded",
-					data: { chainTarget: args.chainTarget }
-				});
-				return RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_SUCCEEDED;
-			default: return null;
-		}
-	}
 	emitEmailOtpUnlockWorkerProgress(onEvent, args) {
 		const chainLabel = args.chainTarget.kind === "tempo" ? "Tempo" : "EVM";
 		const base = {
@@ -1663,7 +1613,6 @@ var SeamsWeb = class {
 				this.emitEmailOtpUnlockEvent(args.onEvent, input);
 			};
 			let timingStartedAtMs = nowMs();
-			String(args.relayUrl || this.configs.network.relayer.url).trim();
 			const emailHashHex = await this.emailOtpEmailHashHex(args.emailOtpAuthorityEmail || "");
 			recordEmailOtpUnlockTiming(unlockTiming.timings, "emailHashLookupMs", timingStartedAtMs);
 			timingStartedAtMs = nowMs();

package/dist/esm/SeamsWeb/assembly/browserSigningSurfaceAssembly.js

@@ -1,12 +1,13 @@
 import { mpcMaterialActivationRefsEqual } from "../../shared-ts/src/utils/domainIds.js";
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../shared-ts/src/utils/walletAuthAuthority.js";
 import { WalletSessionStatusReadScope } from "../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { WALLET_AUTH_METHODS } from "../../shared-ts/src/utils/signerDomain.js";
 import { configuredThresholdEcdsaChainTargets, thresholdEcdsaChainTargetKey, toWalletId } from "../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { readEmailOtpProviderSubjectForWalletV1 } from "../../core/signingEngine/threshold/ed25519/yaoPublicCapabilityReferences.js";
+import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../shared-ts/src/utils/walletAuthAuthority.js";
 import { walletSessionAuthorizations } from "../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
 import { IndexedDBManager } from "../../core/indexedDB/index.js";
 import { IndexedDbEcdsaCapabilityManifestStore } from "../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
+import { emitSigningSessionFlowTrace } from "../../core/signingEngine/session/operationState/trace.js";
 import { withThresholdEd25519CommitQueue } from "../../core/signingEngine/threshold/ed25519/commitQueue.js";
 import { buildActiveNearEd25519WalletSessionAuthorization } from "../../core/signingEngine/session/material/nearEd25519YaoSigningPreparation.js";
 import { listExactSealedSessionsForWallet } from "../../core/signingEngine/session/persistence/sealedSessionStore.js";
@@ -51,7 +52,7 @@ async function noWalletPasskeyAuthenticator() {
 	return null;
 }
 /**
-* R103C: the active wallet auth-method store is the one source that resolves
+* The active wallet auth-method store is the one source that resolves
 * an authority reference to its full authority. Sealed-session restores and
 * loose authenticator lists are history and hints; matching against them let
 * a stale or sibling credential answer for the active authority.
@@ -226,14 +227,22 @@ async function readBrowserExactNearEd25519WalletSessionAuthorization(relayerUrlI
 	const authorizationNowMs = Date.now();
 	if (status.authorization.expiresAtMs <= authorizationNowMs) return { kind: "expired" };
 	if (status.walletSessionId !== exactRead.operationCredential.walletSessionId || status.quotaId !== exactRead.record.quotaId || status.expiresAtMs !== status.authorization.expiresAtMs || !walletSessionImmutableIdentityMatches(status.authorization, exactRead.record) || !walletSessionMatchesSelectedAuthority(status.authorization, currentSelected)) return { kind: "corrupt" };
+	let replaced;
 	try {
-		await walletSessionAuthorizations.replaceExactActive({
+		replaced = await IndexedDBManager.replaceExactActiveWalletSessionFromStatus({
 			active: status.authorization,
 			operationCredential: exactRead.operationCredential
 		});
 	} catch {
 		return { kind: "persistence_unavailable" };
 	}
+	if (replaced.kind === "superseded") {
+		emitSigningSessionFlowTrace("near", {
+			event: "wallet_session_status_superseded",
+			walletSessionId: exactRead.operationCredential.walletSessionId
+		});
+		return { kind: "unavailable" };
+	}
 	let selectedFactorAuthority;
 	try {
 		selectedFactorAuthority = await resolveBrowserSelectedFactorAuthority(currentSelected);
@@ -420,8 +429,9 @@ async function resolveBrowserEcdsaPreprocessingCapability(args, input, statusRea
 		kind: "inactive",
 		reason: "Exact Wallet Session authorization is expired"
 	};
+	let replaced;
 	try {
-		await walletSessionAuthorizations.replaceExactActive({
+		replaced = await IndexedDBManager.replaceExactActiveWalletSessionFromStatus({
 			active: status.authorization,
 			operationCredential: exactAuthorization.operationCredential
 		});
@@ -431,6 +441,16 @@ async function resolveBrowserEcdsaPreprocessingCapability(args, input, statusRea
 			reason: "Exact Wallet Session promotion reconciliation could not be persisted"
 		};
 	}
+	if (replaced.kind === "superseded") {
+		emitSigningSessionFlowTrace("evm-family", {
+			event: "wallet_session_status_superseded",
+			walletSessionId: exactAuthorization.operationCredential.walletSessionId
+		});
+		return {
+			kind: "inactive",
+			reason: "Exact Wallet Session status was superseded by a newer wallet authority"
+		};
+	}
 	const authorizationResolution = await buildBrowserEcdsaPreprocessingCapability({
 		context: args,
 		walletId,
@@ -511,7 +531,7 @@ async function resolveAmbiguousEcdsaActivationForSelectedAuthMethod(input) {
 		authority: chosen
 	});
 }
-async function resolveBrowserCanonicalEcdsaSigningCapability(args, input) {
+async function resolveBrowserCanonicalEcdsaSigningCapability(_args, input) {
 	const walletId = toWalletId(input.walletId);
 	const subjects = await ecdsaCapabilityManifestStore.listActiveWalletCapabilitySubjects(walletId);
 	if (subjects.kind !== "resolved") throw new Error(`ECDSA capability subjects are ${subjects.kind}`);

package/dist/esm/SeamsWeb/assembly/createBrowserSigningStores.js

@@ -1,6 +1,6 @@
 import { IndexedDbEd25519YaoPublicCapabilityReferenceStore } from "../../core/signingEngine/threshold/ed25519/yaoPublicCapabilityReferences.js";
 import { createIndexedDBNonceLaneCoordinationStore } from "../../core/indexedDB/nonceLaneCoordinationStore.js";
-import { acquireSigningSessionRestoreLease, deleteDurableSealedSessionRecord, listEcdsaSealedSessionsForWallet, listExactSealedSessionsForWallet, readExactSealedSession, releaseSigningSessionRestoreLease, updateExactSealedSessionPolicy, writeExactSealedSession } from "../../core/signingEngine/session/persistence/sealedSessionStore.js";
+import { acquireSigningSessionRestoreLease, listEcdsaSealedSessionsForWallet, listExactSealedSessionsForWallet, readExactSealedSession, releaseSigningSessionRestoreLease, updateExactSealedSessionPolicy, writeExactSealedSession } from "../../core/signingEngine/session/persistence/sealedSessionStore.js";
 //#region src/SeamsWeb/assembly/createBrowserSigningStores.ts
 function createBrowserSigningStores(indexedDB) {
 	return {
@@ -28,7 +28,6 @@ function createBrowserSigningStores(indexedDB) {
 			listEcdsaSealedSessionsForWallet,
 			acquireSigningSessionRestoreLease,
 			releaseSigningSessionRestoreLease,
-			deleteDurableSealedSessionRecord,
 			updateExactSealedSessionPolicy
 		},
 		ed25519YaoPublicCapabilityReferences: new IndexedDbEd25519YaoPublicCapabilityReferenceStore(indexedDB)

package/dist/esm/SeamsWeb/operations/auth/login.js

@@ -1,24 +1,20 @@
 import { mpcMaterialActivationRefsEqual, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { joinNormalizedUrl } from "../../../shared-ts/src/utils/normalize.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import { deriveImplicitNearAccountIdFromEd25519PublicKey } from "../../../shared-ts/src/utils/near.js";
-import { nearEd25519SigningKeyIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { joinNormalizedUrl } from "../../../shared-ts/src/utils/normalize.js";
 import { isObject } from "../../../shared-ts/src/utils/validation.js";
-import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { buildPasskeyWalletAuthAuthority, parseEmailOtpWalletAuthAuthority, parseWalletAuthAuthorityRef, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbServerIdentityV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/parsers.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { WalletSessionStatusReadScope } from "../../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { parseRouterAbEd25519NormalSigningState } from "../../../shared-ts/src/utils/signingSessionSeal.js";
 import { toAccountId } from "../../../core/types/accountIds.js";
 import { SIGNER_AUTH_METHODS } from "../../../shared-ts/src/utils/signerDomain.js";
 import { UnlockEventPhase, createUnlockFlowEvent } from "../../../core/types/sdkSentEvents.js";
+import { nearEd25519SigningKeyIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { buildEmailOtpWalletAuthMethodBinding, buildPasskeyAuthScope, buildPasskeyWalletAuthMethodBinding, buildWalletIdentity, parseRpId } from "../../../shared-ts/src/utils/walletCapabilityBindings.js";
 import { thresholdEcdsaChainTargetKey } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
+import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { buildBaseEvmFamilyEcdsaKeyIdentity, buildEvmFamilyEcdsaSessionLanePolicy, deriveEvmFamilySigningKeySlotId, evmFamilyEcdsaWalletKeyToIdentity, resolveThresholdSigningRootBindingFromRuntimePolicyScope, toEvmFamilyEcdsaKeyHandle, toRpId } from "../../../core/signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
 import { exactEd25519SigningLaneIdentity, nearEd25519SignerBindingFromBoundaryFields } from "../../../core/signingEngine/session/identity/exactSigningLaneIdentity.js";
 import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
@@ -26,8 +22,12 @@ import { DEFAULT_UNLOCK_REMAINING_USES, resolveWalletUnlockSessionUsesFromReques
 import { parseSignerSlot } from "../../../shared-ts/src/utils/signerSlot.js";
 import { IndexedDbEd25519YaoPublicCapabilityReferenceStore, publishEd25519YaoPublicCapabilityReferenceAndLane } from "../../../core/signingEngine/threshold/ed25519/yaoPublicCapabilityReferences.js";
 import { isWalletCustodySeedBinding } from "../../../shared-ts/src/passkey-custody/custodySecretBinding.js";
+import { sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { ROUTER_AB_ED25519_YAO_ACTIVE_CLIENT_KIND_V1, RouterAbEd25519YaoClientV1 } from "../../../core/signingEngine/threshold/ed25519/yaoClient.js";
+import { buildPasskeyWalletAuthAuthority, parseEmailOtpWalletAuthAuthority, parseWalletAuthAuthorityRef, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { destroyLinkedDeviceEcdsaHolderMaterialWasm, reconcileCanonicalEcdsaActivationWasm, storeLinkedDeviceEcdsaHolderMaterialWasm } from "../../../core/signingEngine/threshold/crypto/ecdsaDerivationClientWasm.js";
+import { sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbServerIdentityV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND } from "../../../core/indexedDB/walletCustodyEd25519MaterialRecord.js";
 import "../../../shared-ts/src/device-linking/index.js";
 import { openWalletAuthorityLinkedSignerMaterialV1 } from "../../../core/indexedDB/linkedAuthoritySignerMaterial.js";
@@ -60,6 +60,8 @@ import { verifyPasskeyWalletUnlock } from "../../../core/rpcClients/near/rpcCall
 import { passkeyCredentialIdB64uFromAuthentication, passkeyPrfFirstB64uFromCredential } from "../authMethods/passkey/ecdsaBootstrap.js";
 import { scheduleEcdsaSessionPresignaturePrefill } from "./scheduleEcdsaSessionPresignaturePrefill.js";
 import { resolveManagedRuntimeScopeBootstrap } from "../../../core/config/managedRuntimeScope.js";
+import { exactPasskeyWalletAuthAuthorityRefForCredential, exactPasskeyWalletAuthMethodForCredential } from "../authMethods/passkey/exactPasskeyAuthority.js";
+import { scheduleLinkedDevicePresignaturePrefill } from "./scheduleLinkedDevicePresignaturePrefill.js";
 import { createRouterAbNormalSigningPolicy } from "../session/thresholdWarmSessionBootstrap.js";
 import { assertWalletRuntimePostconditions } from "../../../core/signingEngine/session/postconditions/runtimePostconditions.js";
 import { buildConfiguredTargetKeyCompletion, collectConfiguredTargetThresholdEcdsaWarmKeys, configuredTargetThresholdEcdsaWarmKey, mergeCanonicalThresholdEcdsaWarmSessionContexts, parseActiveEcdsaSignerRecordForUnlock, planUnlockEcdsaWarmup, requireCompleteConfiguredTargetKeyContext } from "../../../core/signingEngine/session/passkey/unlockEcdsaWarmupPlanner.js";
@@ -276,27 +278,6 @@ function walletAuthMethodBindingFromRecord(record) {
 		default: return null;
 	}
 }
-async function exactPasskeyWalletAuthMethodForCredential(args) {
-	const matches = (await IndexedDBManager.listWalletAuthMethodsV2ForWallet(String(args.walletId))).filter((record) => record.kind === "passkey" && record.status === "active" && record.walletId === args.walletId && String(record.rpId) === args.rpId && String(record.credentialIdB64u) === args.credentialIdB64u);
-	const [record] = matches;
-	if (matches.length !== 1 || !record) throw new Error("[login] passkey authority requires one exact active V2 auth method");
-	return record;
-}
-async function exactPasskeyWalletAuthAuthorityRefForCredential(args) {
-	const record = await exactPasskeyWalletAuthMethodForCredential(args);
-	return await walletAuthAuthorityRef({ authority: {
-		walletId: record.walletId,
-		factor: {
-			kind: "passkey",
-			credentialIdB64u: record.credentialIdB64u
-		},
-		verifier: {
-			kind: "webauthn",
-			rpId: record.rpId
-		},
-		bindingId: record.walletAuthMethodId
-	} });
-}
 function walletAuthAuthorityForSelectedPasskeyMethod(record) {
 	return {
 		walletId: record.walletId,
@@ -1344,12 +1325,21 @@ async function activateLinkedDeviceSignerRuntimesAfterLink(args) {
 			...providerIdentity ? { providerIdentity } : {}
 		});
 		const ecdsaMaterial = linkedDeviceEcdsaMaterial(openedMaterials);
-		if (ecdsaMaterial) await activateLinkedDeviceEcdsaHolderRuntime({
-			context: args.context,
-			selection,
-			factorAuthority,
-			material: ecdsaMaterial
-		});
+		if (ecdsaMaterial) {
+			const { runtime } = await activateLinkedDeviceEcdsaHolderRuntime({
+				context: args.context,
+				selection,
+				factorAuthority,
+				material: ecdsaMaterial
+			});
+			scheduleLinkedDevicePresignaturePrefill({
+				runtime,
+				operationCredential: args.operationCredential,
+				expiresAtMs: args.walletSession.expiresAtMs,
+				relayerUrl,
+				workerCtx: args.context.signingEngine.getSignerWorkerContext()
+			});
+		}
 		const ed25519Material = linkedDeviceEd25519Material(openedMaterials);
 		if (ed25519Material) {
 			const session = await linkedDeviceEd25519SessionAfterLink({
@@ -1377,7 +1367,7 @@ async function activateLinkedDeviceSignerRuntimesAfterLink(args) {
 				walletSessionId: String(args.operationCredential.walletSessionId),
 				expiresAtMs: args.walletSession.expiresAtMs
 			});
-			else if (isWalletCustodySeedBinding(selection.exportRoot.envelope.binding)) await establishUnlockedWalletEd25519ExportRootCapabilityV1(walletCustodyCeremonyTransportFromWorkerContextV1(args.context.signingEngine.getSignerWorkerContext()), {
+			else if (isWalletCustodySeedBinding(selection.exportRoot.envelope.binding) || selection.exportRoot.envelope.binding.kind === "ed25519_yao_client_root_v1") await establishUnlockedWalletEd25519ExportRootCapabilityV1(walletCustodyCeremonyTransportFromWorkerContextV1(args.context.signingEngine.getSignerWorkerContext()), {
 				existingEnvelope: selection.exportRoot.envelope,
 				existingFactorSecret: args.factorSecret32,
 				walletId: String(selection.walletId),
@@ -1593,7 +1583,7 @@ function pendingNearRegistrationMatchesAuthority(selection, activation, pending)
 	return pending.operation === "near_provisioning" && pending.phase === "joined" && pending.signerPlanKind === "near_ed25519_and_evm_family_ecdsa" && pending.walletId === selection.walletId && pending.walletAuthMethodId === selection.authMethod.walletAuthMethodId && mpcMaterialActivationRefsEqual(pending.localMaterial.ed25519.metadata.materialActivation, activation);
 }
 /**
-* R109C: install the Ed25519 runtime an owner authority's unlock just built.
+* Install the Ed25519 runtime an owner authority's unlock just built.
 *
 * Everything is checked against the authority and method that were selected,
 * before the handle is used: a session naming a different method, or a
@@ -1826,7 +1816,7 @@ async function unlockLinkedDeviceEmailOtpWallet(args) {
 		factorSecret32?.fill(0);
 	}
 }
-async function unlockInternal(context, subjectSet, options, completion) {
+async function unlockInternal(context, subjectSet, options, _completion) {
 	const { onEvent, onError, afterCall } = options || {};
 	const { signingEngine } = context;
 	const walletUnlockSelection = resolveLoginWalletUnlockSelectionForSubjectSet({
@@ -1975,10 +1965,6 @@ async function unlockInternal(context, subjectSet, options, completion) {
 				identity: walletIdentity,
 				context: storedCanonicalEcdsaContext
 			});
-			buildConfiguredTargetKeyCompletion({
-				context: storedCanonicalEcdsaContext,
-				configuredTargets: warmupInput.selectedEcdsaTargets
-			});
 			const canFirstBootstrapThresholdEcdsa = Boolean(managedRuntimeScopeBootstrap);
 			const warmupPlan = resolveThresholdLoginWarmupPlan({
 				selection: warmupInput.selection,