@seams/wallet 0.6.2 → 0.7.3

package/dist/esm/react/SeamsWeb/operations/registration/pendingEcdsaRegistrationRecoveryValidation.js

@@ -27,10 +27,10 @@ function samePendingEcdsaProjection(pending, response, walletKey) {
 	const projection = requireEcdsaProjection(response);
 	return response.walletId === pending.walletId && response.custodyKeyManifestDigestB64u === pending.localMaterial.custodyCommit.keyManifestDigestB64u && response.walletCustody?.status === "committed" && session.walletId === pending.walletId && session.walletSession.walletId === pending.walletId && session.walletSession.authMethodId === pending.walletAuthMethodId && session.tokens.kind === "evm_family_ecdsa" && projection.ecdsa.keyHandle === walletKey.keyHandle && projection.ecdsa.thresholdSessionId === response.ecdsa.bootstrap.thresholdSessionId && session.expiresAtMs === response.ecdsa.bootstrap.expiresAtMs && session.remainingUses === response.ecdsa.bootstrap.remainingUses;
 }
-function samePendingEcdsaClientActivationFacts(activation, expected) {
+function samePendingEcdsaClientActivationFacts(activation, walletKey, expected) {
 	const identity = activation.ecdsa_activation.public_identity;
 	return sameRouterAbEcdsaVerifiedClientActivationFactsV1({
-		registrationRequestDigestB64u: base64UrlEncode(Uint8Array.from(activation.activation_request_digest.bytes)),
+		registrationRequestDigestB64u: walletKey.publicCapability.registration_request_digest_b64u,
 		proofTranscriptDigestB64u: base64UrlEncode(Uint8Array.from(activation.transcript_digest.bytes)),
 		contextBinding32B64u: identity.context_binding_b64u,
 		derivationClientSharePublicKey33B64u: identity.derivation_client_share_public_key33_b64u,
@@ -107,7 +107,7 @@ function assertActivationFacts(pending, response, walletKey) {
 	const receipt = activation.ecdsa_activation;
 	const identity = receipt.public_identity;
 	const client = pending.localMaterial.ecdsa.clientActivation;
-	if (activation.activation_correlation_id !== pending.localMaterial.ecdsa.activationJournalId || !samePendingEcdsaClientActivationFacts(activation, client) || !samePendingEcdsaBootstrapPublicIdentity(response.ecdsa.bootstrap.publicIdentity, walletKey) || receipt.context.application_binding_digest_b64u !== response.ecdsa.bootstrap.applicationBindingDigestB64u || !samePendingEcdsaActivationPublicIdentity(identity, walletKey)) throw new Error("pending ECDSA activation facts mismatch");
+	if (activation.activation_correlation_id !== pending.localMaterial.ecdsa.activationJournalId || base64UrlEncode(Uint8Array.from(activation.activation_request_digest.bytes)) !== pending.localMaterial.ecdsa.activationRequestDigestB64u || !samePendingEcdsaClientActivationFacts(activation, walletKey, client) || !samePendingEcdsaBootstrapPublicIdentity(response.ecdsa.bootstrap.publicIdentity, walletKey) || receipt.context.application_binding_digest_b64u !== response.ecdsa.bootstrap.applicationBindingDigestB64u || !samePendingEcdsaActivationPublicIdentity(identity, walletKey)) throw new Error("pending ECDSA activation facts mismatch");
 	if (!samePendingEcdsaBootstrapKeyIdentity(response.ecdsa.bootstrap, walletKey)) throw new Error("pending ECDSA bootstrap changed committed key identity");
 }
 function assertProjectionEcdsaFacts(response) {

package/dist/esm/react/SeamsWeb/operations/registration/pendingRegistrationRecovery.js

@@ -1,9 +1,9 @@
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
-import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { parseEmailOtpWalletAuthAuthority } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { toAccountId } from "../../../core/types/accountIds.js";
+import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { parseEd25519YaoRecoveryCapabilityV1 } from "../../../core/signingEngine/session/passkey/ed25519YaoRecoveryCapability.js";
 import { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND } from "../../../core/indexedDB/walletCustodyEd25519MaterialRecord.js";
 import { assertPendingWalletRegistrationIdentity } from "../../../core/indexedDB/pendingWalletRegistrationCommit.js";
@@ -18,19 +18,13 @@ import { unlockPendingEcdsaRegistration } from "./pendingEcdsaRegistrationRecove
 //#region src/SeamsWeb/operations/registration/pendingRegistrationRecovery.ts
 const defaultPendingRegistrationRecoveryPorts = {
 	listPendingWalletRegistrationCommits,
-	completeWalletRegistrationNearProvisioning: completePendingWalletRegistrationNearProvisioning,
+	completeWalletRegistrationNearProvisioning,
 	publishPendingWalletRegistrationCommit
 };
 async function listPendingWalletRegistrationCommits() {
 	await IndexedDBManager.initialize();
 	return await IndexedDBManager.listPendingWalletRegistrationCommits();
 }
-async function completePendingWalletRegistrationNearProvisioning(input) {
-	return await completeWalletRegistrationNearProvisioning(input);
-}
-async function activatePendingWalletRegistration(input) {
-	return await activateWalletRegistration(input);
-}
 async function publishPendingWalletRegistrationCommit(input) {
 	return await IndexedDBManager.publishPendingWalletRegistrationCommit(input);
 }
@@ -325,7 +319,7 @@ async function resumePendingNearRegistrations(args) {
 	return results;
 }
 const defaultPendingEcdsaRegistrationRecoveryPorts = {
-	activateWalletRegistration: activatePendingWalletRegistration,
+	activateWalletRegistration,
 	publishPendingWalletRegistrationCommit,
 	unlockPendingEcdsaRegistration
 };

package/dist/esm/react/SeamsWeb/operations/registration/registration.js

@@ -1,31 +1,32 @@
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import { deriveImplicitNearAccountIdFromEd25519PublicKey } from "../../../shared-ts/src/utils/near.js";
 import { getUserFriendlyErrorMessage } from "../../../shared-ts/src/utils/errors.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { isObject } from "../../../shared-ts/src/utils/validation.js";
 import { alphabetizeStringify, sha256BytesUtf8, sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { redactCredentialExtensionOutputs } from "../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
 import { parseThresholdEd25519SessionId, parseWalletAuthMethodId, parseWebAuthnCredentialIdB64u } from "../../../shared-ts/src/utils/domainIds.js";
-import { requireEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
-import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { parseCorrelationId, parseDigestB64u, parseIsoTimestamp } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseCanonicalEcdsaServerActivationRequest } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
-import { findRegistrationSignerPlanEvmFamilyEcdsaBranch, findRegistrationSignerPlanNearEd25519Branch, parseNearEd25519SigningKeyId, registrationSignerPlanFromSelection, walletIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { walletSessionPreservesCapabilities } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { buildEmailOtpWalletAuthAuthority, parseEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseRouterAbEcdsaVerifiedClientActivationFactsV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { thresholdEcdsaChainTargetFromChainFamily, toWalletId } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
+import { parseNearEd25519SigningKeyId, walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
+import { requireEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
+import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import "../../../shared-ts/src/signing-lanes/index.js";
+import { thresholdEcdsaChainTargetFromChainFamily, toWalletId } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { toParticipantId, toRpId } from "../../../core/signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
 import { nearEd25519SignerBindingFromBoundaryFields } from "../../../core/signingEngine/session/identity/exactSigningLaneIdentity.js";
 import { buildEmailOtpAuthContext, emailOtpAuthContextEmailHashHex, emailOtpAuthContextProvider, emailOtpAuthContextProviderUserId } from "../../../core/signingEngine/session/identity/laneIdentity.js";
 import { toAccountId } from "../../../core/types/accountIds.js";
-import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRelayerKeyId, parseEcdsaRoleLocalBindingDigest, parseEcdsaThresholdKeyId } from "../../../core/signingEngine/session/keyMaterialBrands.js";
-import { walletSessionPreservesCapabilities } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
+import { parseEcdsaRelayerKeyId } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
+import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRoleLocalBindingDigest, parseEcdsaThresholdKeyId } from "../../../core/signingEngine/session/keyMaterialBrands.js";
 import { buildEmailOtpEnvelopeFactor, buildPasskeyEnvelopeFactor } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import { walletCustodyCommitPayloadWithRecoveryBackupAcknowledgement } from "../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
+import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { RegistrationEventPhase, createRegistrationFlowEvent } from "../../../core/types/sdkSentEvents.js";
 import { WalletSessionStatusReadScope } from "../../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { publishNearProvisioningState, runSingleFlightNearProvisioning } from "../../../core/signingEngine/flows/registration/nearProvisioningRegistry.js";
@@ -35,27 +36,28 @@ import { createRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/route
 import { RouterAbEd25519YaoClientV1 } from "../../../core/signingEngine/threshold/ed25519/yaoClient.js";
 import { buildRecoveredCustodyEnvelopeRecord } from "../../../core/signingEngine/walletCustody/recoveryReplacementEnvelope.js";
 import { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND } from "../../../core/indexedDB/walletCustodyEd25519MaterialRecord.js";
+import { findRegistrationSignerPlanEvmFamilyEcdsaBranch, findRegistrationSignerPlanNearEd25519Branch, registrationSignerPlanFromSelection } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { planPendingNearRegistration, preparePendingNearRegistration } from "../../../core/indexedDB/pendingWalletRegistrationCommit.js";
 import { walletSessionAuthorizations } from "../../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
 import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { nearEd25519YaoMaterialActivationFromMetadata } from "../../../core/signingEngine/session/material/nearEd25519YaoMaterialActivation.js";
 import { activateWalletRegistration, completeWalletRegistrationNearProvisioning, createWalletAddSignerIntent, finalizeWalletAddSigner, isEmailOtpWalletRegistrationFinalizeResponse, parseWalletRegistrationEcdsaDerivationRespond, respondWalletRegistration, setupWalletRegistration, startWalletAddSigner } from "../../../core/rpcClients/relayer/walletRegistration.js";
 import { persistPasskeyEd25519YaoSignerMaterialV1 } from "../../../core/signingEngine/session/passkey/ed25519YaoLocalMaterial.js";
-import { buildPasskeyEd25519RestoreMetadata } from "../../../core/signingEngine/session/passkey/ed25519YaoSealedSession.js";
 import { prepareWalletEcdsaRegistrationPublication, prepareWalletEd25519RegistrationPublication, prepareWalletEmailOtpEd25519RegistrationPublication } from "../../../core/signingEngine/flows/registration/accountLifecycle.js";
 import { computeAddSignerIntentDigest } from "../../../utils/intentDigest.js";
 import { establishUnlockedWalletEd25519ExportRootCapabilityV1, walletCustodyCeremonyTransportFromWorkerContextV1 } from "../../../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
 import { rememberPasskeyCustodySessionEnvelope } from "../../../core/signingEngine/session/passkey/passkeyCustodySessionCache.js";
 import { listConfiguredThresholdEcdsaPublicationTargets } from "../session/thresholdEcdsaProvisioning.js";
 import { openWalletCustodyEd25519ActiveClientV1, walletCustodyCacheEnvelopeFromRecordV1 } from "../../../core/signingEngine/walletCustody/openCustodyCache.js";
-import { RegistrationTimingRecorder, assertNever, createFailedRegistrationTimingSummary, createSucceededRegistrationTimingSummary, emitNearRegistrationTiming, emitRegistrationTimingSpan, emitRegistrationTimingSummary, recordNearRegistrationSessionTiming, recordRegistrationServerTimingBuckets, recordStrictEcdsaServerTimingBuckets, registrationTimingSignerSetFromPlan, roundDurationMs, zeroEmailOtpYaoPrewarmDiagnostics } from "./registrationTiming.js";
+import { RegistrationTimingRecorder, assertNever, createFailedRegistrationTimingSummary, createSucceededRegistrationTimingSummary, emitNearRegistrationTiming, emitRegistrationTimingSpan, emitRegistrationTimingSummary, recordRegistrationServerTimingBuckets, recordStrictEcdsaServerTimingBuckets, registrationTimingSignerSetFromPlan, roundDurationMs, zeroEmailOtpYaoPrewarmDiagnostics } from "./registrationTiming.js";
 import { joinCustodyWireFromEnvelopeRecord } from "../../../core/signingEngine/walletCustody/joinCustodyWire.js";
 import { buildStrictRegistrationClientBootstrap, closeStrictEcdsaRegistrationCeremony, finalizeStrictEcdsaFamilyLocalActivation, measureStrictEcdsaCeremonyStep, registrationRouteHeaders, requireIssuedRegistrationEstablishedSession, runStrictEcdsaFamilyCeremony } from "./registrationStrictEcdsa.js";
-import { admitDeferredNearRegistration, buildRegistrationEmailOtpEd25519SessionState, passkeyWalletAuthAuthorityFromCredential, registrationEd25519MaterialFacts, registrationEstablishedEd25519Session, requireEd25519YaoRegistrationPublicResultMatches, requireEmailOtpEd25519YaoRegistrationPublicResultMatches, requireEmailOtpRegistrationEnrollmentMaterial, requirePasskeyRegistrationIntent } from "./registrationEd25519Yao.js";
+import { admitDeferredNearRegistration, buildRegistrationEmailOtpEd25519SessionState, buildRegistrationPasskeyEd25519SessionHydration, passkeyWalletAuthAuthorityFromCredential, registrationEd25519MaterialFacts, requireEd25519YaoRegistrationPublicResultMatches, requireEmailOtpEd25519YaoRegistrationPublicResultMatches, requireEmailOtpRegistrationEnrollmentMaterial, requirePasskeyRegistrationIntent } from "./registrationEd25519Yao.js";
 import { requirePasskeyPrfFirstB64u } from "../authMethods/passkey/ecdsaBootstrap.js";
 import { registrationProjectionFromPending, restorePendingNearRegistrationMaterial } from "./pendingRegistrationRecovery.js";
 import { scheduleEcdsaSessionPresignaturePrefill } from "../auth/scheduleEcdsaSessionPresignaturePrefill.js";
 import { resolveManagedRuntimeScopeBootstrap } from "../../../core/config/managedRuntimeScope.js";
+import { exactPasskeyWalletAuthAuthorityRefForCredential } from "../authMethods/passkey/exactPasskeyAuthority.js";
 import { collectPasskeyRegistrationAuthority } from "../authMethods/passkey/registrationAuthority.js";
 import { showWalletRecoveryCodeBackupUi } from "../recovery/walletRecoveryCodeBackup.js";
 import { pendingWalletRecoveryCodeBackupRepository } from "../../../core/indexedDB/seamsWalletDB/pendingWalletRecoveryCodeBackup.js";
@@ -573,8 +575,8 @@ function ethereumAddressFromAddress20B64u(value) {
 	return `0x${Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
 }
 /**
-* Refactor 94C. Calls `/wallets/register/setup`, which replaces the bootstrap
-* grant, the registration intent, and registration start.
+* Calls `/wallets/register/setup`, which replaces the bootstrap grant, the
+* registration intent, and registration start.
 *
 * Runs before the authenticator prompt, because its response carries the
 * challenge that prompt must sign — so the Router's ECDSA preparation overlaps
@@ -1697,43 +1699,31 @@ async function commitDeferredEd25519Registration(args) {
 			outcome: "success"
 		});
 		await requireCurrentNearRegistrationSession(args.sessionAuthority);
-		if (args.authMaterial.kind === "passkey" && registrationSession.remainingUses > 0) {
-			const registrationEd25519Session = registrationEstablishedEd25519Session(registrationSession);
-			hydration = hydrateDeferredNearRegistrationSession({
-				signingEngine: args.context.signingEngine,
+		if (args.authMaterial.kind === "passkey" && registrationSession.remainingUses > 0) hydration = hydrateDeferredNearRegistrationSession({
+			signingEngine: args.context.signingEngine,
+			ceremonyId: args.registrationCeremonyId,
+			input: buildRegistrationPasskeyEd25519SessionHydration({
+				session: registrationSession,
 				ceremonyId: args.registrationCeremonyId,
-				input: {
-					thresholdSessionId: String(registrationEd25519Session.thresholdSessionId),
-					diagnostics: { recordDuration: recordNearRegistrationSessionTiming.bind(void 0, args.registrationCeremonyId) },
-					prfFirstB64u: args.authMaterial.prfFirstB64u,
-					expiresAtMs: registrationSession.expiresAtMs,
-					remainingUses: registrationSession.remainingUses,
-					...preparedSessionSeal && finalized.sessionSeal ? { preparedServerSeal: {
-						preparationId: preparedSessionSeal.preparationId,
-						...finalized.sessionSeal
-					} } : {},
-					transport: {
-						curve: "ed25519",
-						authMethod: "passkey",
-						walletId: String(args.walletId),
-						relayerUrl: args.relayerUrl,
-						walletSessionToken: registrationSession.operationCredential.token,
-						ed25519Restore: buildPasskeyEd25519RestoreMetadata({
-							rpId: args.authMaterial.rpId,
-							nearAccountId: String(nearAccountId),
-							nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
-							relayerKeyId: finalized.ed25519.relayerKeyId,
-							participantIds: [...finalized.ed25519.participantIds],
-							runtimePolicyScope: registrationEd25519Session.runtimePolicyScope,
-							signerSlot: finalized.ed25519.signerSlot,
-							routerAbNormalSigning: registrationEd25519Session.routerAbNormalSigning,
-							credentialIdB64u: args.authMaterial.credentialIdB64u,
-							materialActivation
-						})
-					}
+				walletId: String(args.walletId),
+				relayerUrl: args.relayerUrl,
+				prfFirstB64u: args.authMaterial.prfFirstB64u,
+				preparedServerSeal: preparedSessionSeal && finalized.sessionSeal ? {
+					preparationId: preparedSessionSeal.preparationId,
+					...finalized.sessionSeal
+				} : null,
+				restore: {
+					rpId: args.authMaterial.rpId,
+					nearAccountId: String(nearAccountId),
+					nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
+					relayerKeyId: finalized.ed25519.relayerKeyId,
+					participantIds: finalized.ed25519.participantIds,
+					signerSlot: finalized.ed25519.signerSlot,
+					credentialIdB64u: args.authMaterial.credentialIdB64u,
+					materialActivation
 				}
-			});
-		}
+			})
+		});
 		const sessionStartedAt = performance.now();
 		await args.context.signingEngine.activateAuthenticatedWalletState({
 			walletId: args.walletId,
@@ -2869,6 +2859,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			recorder: registrationTiming,
 			passkeyExecution: args.passkeyExecution
 		});
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.setup");
 		const intent = requirePasskeyRegistrationIntent(setup.intent);
 		const eventAccountId = registrationEventAccountId(String(intent.walletId));
 		emitRegistrationEvent(options.onEvent, eventAccountId, {
@@ -2894,6 +2885,8 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			passkeyExecution: args.passkeyExecution
 		});
 		postTouchIdCompletedAt = performance.now();
+		registrationTiming.capturePasskeyAuthDiagnostics(passkeyAuthority.diagnostics);
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.authentication");
 		emitRegistrationEvent(options.onEvent, eventAccountId, {
 			authMethod: "passkey",
 			phase: RegistrationEventPhase.STEP_04_PASSKEY_CREATE_SUCCEEDED,
@@ -2912,6 +2905,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			kind: "passkey",
 			webauthnRegistration: passkeyAuthority.webauthnRegistration
 		});
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.respond");
 		if (responded.kind !== "near_ed25519") throw new Error("Ed25519-only registration respond returned a different signer branch");
 		const parsedCredentialId = parseWebAuthnCredentialIdB64u(String(passkeyAuthority.credential.rawId || passkeyAuthority.credential.id || "").trim());
 		if (!parsedCredentialId.ok) throw new Error(`passkey credential id ${parsedCredentialId.error.message}`);
@@ -2948,6 +2942,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 		} finally {
 			zeroizeArrayBuffer(walletCustodyFactorSecret);
 		}
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.custody");
 		await confirmWalletRecoveryCodesBackedUp(context, String(intent.walletId), options.recoveryCodeBackup, established.recoveryCodes);
 		const walletCustodyCommit = walletCustodyCommitPayloadWithRecoveryBackupAcknowledgement(established.commitPayload);
 		if (!established.localMaterial) throw new Error("Passkey registration produced no sealed local custody material");
@@ -2975,6 +2970,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 				}
 			}
 		});
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.backup_and_checkpoint");
 		const activated = await activateWalletRegistration({
 			relayerUrl,
 			registrationCeremonyId: setup.registrationCeremonyId,
@@ -2983,6 +2979,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			headers: registrationRouteHeaders(traceContext),
 			idempotencyKey: finalizeIdempotencyKey
 		});
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.activate");
 		if (activated.kind !== "near_ed25519" || activated.nearProvisioning?.status !== "near_pending") throw new Error("Ed25519-only activate did not return a wallet pending NEAR provisioning");
 		const nearProvisioningIdempotencyKey = await deriveNearProvisioningIdempotencyKey({
 			registrationCeremonyId: setup.registrationCeremonyId,
@@ -3018,6 +3015,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			operation: "registration_activate"
 		});
 		const clientPublicKey = `ed25519:${base58Encode(established.metadata.registeredPublicKey)}`;
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.provision_checkpoint");
 		const finalized = await completeWalletRegistrationNearProvisioning({
 			relayerUrl,
 			registrationCeremonyId: setup.registrationCeremonyId,
@@ -3028,6 +3026,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			auth: { kind: "passkey" },
 			walletCustodyCommit
 		});
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.finalize");
 		if (!finalized.ok || finalized.kind !== "near_ed25519") throw new Error("Deferred NEAR provisioning returned a different signer branch");
 		if (established.commitPayload && finalized.walletCustody?.status !== "committed") {
 			const status = finalized.walletCustody?.status ?? "not_reported";
@@ -3116,6 +3115,31 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			registration
 		})).signerActivations[1];
 		if (!storedNearActivation || storedNearActivation.signerSlot !== finalized.ed25519.signerSlot) throw new Error("Ed25519 Yao registration persisted a different signer slot");
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.publication");
+		const hydration = await hydrateDeferredNearRegistrationSession({
+			signingEngine: context.signingEngine,
+			ceremonyId: setup.registrationCeremonyId,
+			input: buildRegistrationPasskeyEd25519SessionHydration({
+				session: registrationSession,
+				ceremonyId: setup.registrationCeremonyId,
+				walletId: String(finalized.walletId),
+				relayerUrl,
+				prfFirstB64u: passkeyAuthority.prfFirstB64u,
+				preparedServerSeal: null,
+				restore: {
+					rpId: finalizedPasskey.rpId,
+					nearAccountId: String(nearAccountId),
+					nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
+					relayerKeyId: finalized.ed25519.relayerKeyId,
+					participantIds: finalized.ed25519.participantIds,
+					signerSlot: finalized.ed25519.signerSlot,
+					credentialIdB64u: finalizedPasskey.credentialIdB64u,
+					materialActivation: nearEd25519YaoMaterialActivationFromMetadata(metadata)
+				}
+			})
+		});
+		if (hydration.kind === "failed") throw hydration.error;
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.session_hydration");
 		await activatePasskeyRegistrationEd25519Material({
 			signingEngine: context.signingEngine,
 			sessionAuthority: {
@@ -3132,6 +3156,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			passkeyPrfFirstB64u: passkeyAuthority.prfFirstB64u,
 			relayerUrl
 		});
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.material_activation");
 		await establishPasskeyRegistrationEd25519ExportRootCapability({
 			signingEngine: context.signingEngine,
 			commit: established.commitPayload,
@@ -3141,6 +3166,7 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 			walletSessionId: String(registrationSession.walletSessionId),
 			expiresAtMs: registrationSession.expiresAtMs
 		});
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.export_capability");
 		await context.signingEngine.activateAuthenticatedWalletState({
 			walletId: finalized.walletId,
 			nearAccountId,
@@ -3169,6 +3195,12 @@ async function registerPasskeyEd25519YaoWalletOnly(args) {
 				traceContext
 			});
 		}
+		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.wallet_ready");
+		emitRegistrationTimingSummary(createSucceededRegistrationTimingSummary({
+			recorder: registrationTiming,
+			authMethod: "passkey",
+			signerSet: registrationTimingSignerSetFromPlan(args.signerPlan)
+		}));
 		const result = {
 			success: true,
 			kind: "wallet_registered",
@@ -3540,11 +3572,11 @@ async function addPasskeyEd25519YaoWalletSigner(input) {
 }
 async function addPasskeyEcdsaWalletSigner(input) {
 	if (input.started.authorizationKind !== "webauthn_assertion") throw new Error("Wallet custody ECDSA add-signer requires WebAuthn authorization");
-	const authority = await walletAuthAuthorityRef({ authority: passkeyWalletAuthAuthorityFromCredential({
+	const authority = await exactPasskeyWalletAuthAuthorityRefForCredential({
 		walletId: input.walletId,
 		rpId: input.rpId,
-		credential: input.credential
-	}) });
+		credentialIdB64u: input.credentialIdB64u
+	});
 	const factorSecret = Uint8Array.from(base64UrlDecode(input.passkeyPrfFirstB64u)).buffer;
 	let pendingLocalFinalization;
 	try {
@@ -3562,7 +3594,7 @@ async function addPasskeyEcdsaWalletSigner(input) {
 	} finally {
 		zeroizeArrayBuffer(factorSecret);
 	}
-	const finalized = await finalizeWalletAddSigner({
+	const finalizeRequest = {
 		relayerUrl: input.relayerUrl,
 		walletId: input.walletId,
 		addSignerCeremonyId: input.started.addSignerCeremonyId,
@@ -3570,7 +3602,14 @@ async function addPasskeyEcdsaWalletSigner(input) {
 		kind: "evm_family_ecdsa",
 		ecdsa: { expectedKeyHandles: [pendingLocalFinalization.bootstrap.keyHandle] },
 		custodyKeySet: pendingLocalFinalization.custodyKeySet
-	});
+	};
+	let finalized;
+	try {
+		finalized = await finalizeWalletAddSigner(finalizeRequest);
+	} catch (error) {
+		if (!(error instanceof TypeError)) throw error;
+		finalized = await finalizeWalletAddSigner(finalizeRequest);
+	}
 	if (finalized.kind !== "evm_family_ecdsa" || finalized.walletId !== input.walletId || finalized.rpId !== input.rpId) throw new Error("Wallet add-signer finalize returned a different ECDSA identity");
 	const walletKeys = finalized.ecdsa.walletKeys;
 	const primaryKey = walletKeys[0];
@@ -3593,6 +3632,10 @@ async function addPasskeyEcdsaWalletSigner(input) {
 		walletId: input.walletId,
 		walletKeys: localEcdsaWalletKeys
 	});
+	await IndexedDBManager.adoptAddedEcdsaSignerAuthority({
+		authority: finalized.authority,
+		materialActivation: session.materialActivation
+	});
 	emitAddSignerEventSafely(input.onEvent, input.eventAccountId, {
 		authMethod: "passkey",
 		phase: RegistrationEventPhase.STEP_08_STORAGE_PERSIST_SUCCEEDED,

package/dist/esm/react/SeamsWeb/operations/registration/registrationEd25519Yao.js

@@ -1,14 +1,15 @@
 import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseThresholdEd25519SessionId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseNearEd25519SigningKeyId } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseNearEd25519SigningKeyId } from "../../../shared-ts/src/utils/registrationIds.js";
 import { emailOtpAuthContextProviderUserId } from "../../../core/signingEngine/session/identity/laneIdentity.js";
 import { buildRouterAbEd25519SigningWalletSession } from "../../../core/signingEngine/session/routerAbSigningWalletSession.js";
 import { toAccountId } from "../../../core/types/accountIds.js";
 import { buildEmailOtpRouterAbEd25519WalletSessionState } from "../../../core/signingEngine/session/warmCapabilities/routerAbEd25519WalletSessionState.js";
+import { ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { RouterAbEd25519YaoHttpActivationTransportV1 } from "../../../core/signingEngine/threshold/ed25519/yaoClient.js";
-import { assertNever } from "./registrationTiming.js";
+import { buildPasskeyEd25519RestoreMetadata } from "../../../core/signingEngine/session/passkey/ed25519YaoSealedSession.js";
+import { assertNever, recordNearRegistrationSessionTiming } from "./registrationTiming.js";
 import { sameRuntimePolicyScope } from "./registrationStrictEcdsa.js";
 //#region src/SeamsWeb/operations/registration/registrationEd25519Yao.ts
 function passkeyWalletAuthAuthorityFromCredential(args) {
@@ -129,7 +130,37 @@ async function admitDeferredNearRegistration(work, transportConfig) {
 	if (!receipt.ok) throw new Error(receipt.message);
 	return receipt.value;
 }
+function buildRegistrationPasskeyEd25519SessionHydration(args) {
+	const ed25519 = registrationEstablishedEd25519Session(args.session);
+	return {
+		thresholdSessionId: String(ed25519.thresholdSessionId),
+		prfFirstB64u: args.prfFirstB64u,
+		expiresAtMs: args.session.expiresAtMs,
+		remainingUses: args.session.remainingUses,
+		diagnostics: { recordDuration: recordNearRegistrationSessionTiming.bind(void 0, args.ceremonyId) },
+		...args.preparedServerSeal ? { preparedServerSeal: args.preparedServerSeal } : {},
+		transport: {
+			curve: "ed25519",
+			authMethod: "passkey",
+			walletId: args.walletId,
+			relayerUrl: args.relayerUrl,
+			walletSessionToken: args.session.operationCredential.token,
+			ed25519Restore: buildPasskeyEd25519RestoreMetadata({
+				rpId: args.restore.rpId,
+				nearAccountId: args.restore.nearAccountId,
+				nearEd25519SigningKeyId: args.restore.nearEd25519SigningKeyId,
+				relayerKeyId: args.restore.relayerKeyId,
+				participantIds: args.restore.participantIds,
+				runtimePolicyScope: ed25519.runtimePolicyScope,
+				signerSlot: args.restore.signerSlot,
+				routerAbNormalSigning: ed25519.routerAbNormalSigning,
+				credentialIdB64u: args.restore.credentialIdB64u,
+				materialActivation: args.restore.materialActivation
+			})
+		}
+	};
+}
 //#endregion
-export { admitDeferredNearRegistration, buildRegistrationEmailOtpEd25519SessionState, passkeyWalletAuthAuthorityFromCredential, registrationEd25519MaterialFacts, registrationEstablishedEd25519Session, requireEd25519YaoRegistrationPublicResultMatches, requireEmailOtpEd25519YaoRegistrationPublicResultMatches, requireEmailOtpRegistrationEnrollmentMaterial, requirePasskeyRegistrationIntent };
+export { admitDeferredNearRegistration, buildRegistrationEmailOtpEd25519SessionState, buildRegistrationPasskeyEd25519SessionHydration, passkeyWalletAuthAuthorityFromCredential, registrationEd25519MaterialFacts, requireEd25519YaoRegistrationPublicResultMatches, requireEmailOtpEd25519YaoRegistrationPublicResultMatches, requireEmailOtpRegistrationEnrollmentMaterial, requirePasskeyRegistrationIntent };
 
 //# sourceMappingURL=registrationEd25519Yao.js.map

package/dist/esm/react/SeamsWeb/operations/registration/registrationSignerSet.js

@@ -1,6 +1,6 @@
 import { parseNamedNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { THRESHOLD_ED25519_2P_PARTICIPANT_IDS } from "../../../shared-ts/src/threshold/participants.js";
-import { implicitNearAccountProvisioning, sponsoredNamedNearAccountProvisioning } from "../../../shared-ts/src/utils/registrationIntent.js";
+import { implicitNearAccountProvisioning, sponsoredNamedNearAccountProvisioning } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { listThresholdEcdsaProvisionTargets } from "../session/thresholdEcdsaProvisioning.js";
 import { THRESHOLD_SECP256K1_ECDSA_2P_PARTICIPANT_IDS_V1 } from "../../../shared-ts/src/threshold/secp256k1.js";
 //#region src/SeamsWeb/operations/registration/registrationSignerSet.ts

package/dist/esm/react/SeamsWeb/operations/registration/registrationStrictEcdsa.js

@@ -1,12 +1,13 @@
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
-import { requireEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
-import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { parseCorrelationId, parseDigestB64u, parseIsoTimestamp } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { thresholdEcdsaChainTargetKey } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
+import { requireEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
+import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import "../../../shared-ts/src/signing-lanes/index.js";
+import { thresholdEcdsaChainTargetKey } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
 import { toParticipantId } from "../../../core/signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
-import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRelayerKeyId, parseEcdsaRoleLocalBindingDigest, parseEcdsaThresholdKeyId } from "../../../core/signingEngine/session/keyMaterialBrands.js";
+import { parseEcdsaRelayerKeyId } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
+import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRoleLocalBindingDigest, parseEcdsaThresholdKeyId } from "../../../core/signingEngine/session/keyMaterialBrands.js";
 import { isRegistrationBenchmarkDiagnosticsEnabled } from "../../../core/signingEngine/walletCustody/ceremonyDriver.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { activateWalletAddSignerEcdsa, parseWalletRegistrationEcdsaDerivationRespond, respondWalletAddSignerEcdsa } from "../../../core/rpcClients/relayer/walletRegistration.js";