@seams/wallet 0.7.1 → 0.7.3

package/dist/esm/react/SeamsWeb/SeamsWeb.js

@@ -42,11 +42,12 @@ import { parseWalletIframeExactSessionIdentity } from "./walletIframe/shared/exa
 import { resolveBrowserWorkerWarmupPolicy } from "./assembly/browserWorkerWarmupPolicy.js";
 import { configureBrowserIndexedDB } from "./assembly/configureBrowserIndexedDB.js";
 import { createBrowserHostPlatformRuntime, createBrowserSigningRuntime } from "./assembly/createBrowserSigningRuntime.js";
+import { scheduleRestoredSessionPresignaturePrefills } from "./walletIframe/host/restoredSessionPresignaturePrefill.js";
 import { createBrowserSigningStores } from "./assembly/createBrowserSigningStores.js";
 import { initializeBrowserSigningRuntime } from "./assembly/initializeBrowserSigningRuntime.js";
 import { assertWalletRuntimePostconditions } from "../core/signingEngine/session/postconditions/runtimePostconditions.js";
 import { resolveExactLinkedEmailOtpAuthority, resolveLinkedDeviceEmailOtpAuthoritySelection, unlockLinkedDeviceEmailOtpWallet } from "./operations/auth/login.js";
-import { getWalletSessionDomain } from "./operations/auth/walletAuth.js";
+import { getWalletSessionDomain, prefillRouterAbEcdsaDerivationPresignaturePoolDomain } from "./operations/auth/walletAuth.js";
 import { LINKED_DEVICE_SESSION_HTTP_BASE_PATH_V1 } from "./operations/devices/deviceLinkingHttpTransport.js";
 import { createWalletIframeLinkedDeviceManagementPortV1 } from "./publicApi/devices.js";
 import { resolveConfiguredChainTarget } from "./publicApi/chainTargets.js";
@@ -620,6 +621,14 @@ var SeamsWeb = class {
 	async getWalletIframeExactSessionState() {
 		return await this.walletIframe.getExactSessionState();
 	}
+	/** @internal One wallet-host restore owns all configured-chain prefills. */
+	async prefillRestoredWalletSession(state) {
+		await scheduleRestoredSessionPresignaturePrefills({
+			state,
+			chainTargets: this.configuredChainTargets(),
+			prefill: prefillRouterAbEcdsaDerivationPresignaturePoolDomain.bind(null, this.getWalletAuthDeps())
+		});
+	}
 	async openHostedAuthMenu(request, anchorElement) {
 		return await this.walletIframe.openHostedAuthMenu(request, anchorElement);
 	}

package/dist/esm/react/SeamsWeb/operations/auth/login.js

@@ -61,6 +61,7 @@ import { passkeyCredentialIdB64uFromAuthentication, passkeyPrfFirstB64uFromCrede
 import { scheduleEcdsaSessionPresignaturePrefill } from "./scheduleEcdsaSessionPresignaturePrefill.js";
 import { resolveManagedRuntimeScopeBootstrap } from "../../../core/config/managedRuntimeScope.js";
 import { exactPasskeyWalletAuthAuthorityRefForCredential, exactPasskeyWalletAuthMethodForCredential } from "../authMethods/passkey/exactPasskeyAuthority.js";
+import { scheduleLinkedDevicePresignaturePrefill } from "./scheduleLinkedDevicePresignaturePrefill.js";
 import { createRouterAbNormalSigningPolicy } from "../session/thresholdWarmSessionBootstrap.js";
 import { assertWalletRuntimePostconditions } from "../../../core/signingEngine/session/postconditions/runtimePostconditions.js";
 import { buildConfiguredTargetKeyCompletion, collectConfiguredTargetThresholdEcdsaWarmKeys, configuredTargetThresholdEcdsaWarmKey, mergeCanonicalThresholdEcdsaWarmSessionContexts, parseActiveEcdsaSignerRecordForUnlock, planUnlockEcdsaWarmup, requireCompleteConfiguredTargetKeyContext } from "../../../core/signingEngine/session/passkey/unlockEcdsaWarmupPlanner.js";
@@ -1324,12 +1325,21 @@ async function activateLinkedDeviceSignerRuntimesAfterLink(args) {
 			...providerIdentity ? { providerIdentity } : {}
 		});
 		const ecdsaMaterial = linkedDeviceEcdsaMaterial(openedMaterials);
-		if (ecdsaMaterial) await activateLinkedDeviceEcdsaHolderRuntime({
-			context: args.context,
-			selection,
-			factorAuthority,
-			material: ecdsaMaterial
-		});
+		if (ecdsaMaterial) {
+			const { runtime } = await activateLinkedDeviceEcdsaHolderRuntime({
+				context: args.context,
+				selection,
+				factorAuthority,
+				material: ecdsaMaterial
+			});
+			scheduleLinkedDevicePresignaturePrefill({
+				runtime,
+				operationCredential: args.operationCredential,
+				expiresAtMs: args.walletSession.expiresAtMs,
+				relayerUrl,
+				workerCtx: args.context.signingEngine.getSignerWorkerContext()
+			});
+		}
 		const ed25519Material = linkedDeviceEd25519Material(openedMaterials);
 		if (ed25519Material) {
 			const session = await linkedDeviceEd25519SessionAfterLink({

package/dist/esm/react/SeamsWeb/operations/auth/scheduleLinkedDevicePresignaturePrefill.js

@@ -0,0 +1,64 @@
+import { MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS } from "../../../core/signingEngine/workerManager/ecdsaPresignLifecycle.js";
+import { routerAbMpcMaterialActivationRefToWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { deriveEvmFamilyEcdsaKeyHandle } from "../../../core/signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
+import { parseEcdsaKeyHandle } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
+import { resolveLinkedEcdsaHolderRuntimeV1 } from "../../../core/signingEngine/session/material/linkedEcdsaHolderRuntime.js";
+import { emitSigningSessionFlowTrace } from "../../../core/signingEngine/session/operationState/trace.js";
+import { buildRouterAbEcdsaDerivationSigningMaterialRef } from "../../../core/signingEngine/routerAb/ecdsaDerivation/signingMaterialRef.js";
+import { scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill } from "../../../core/signingEngine/routerAb/ecdsaDerivation/presignaturePool.js";
+import { createLinkedHolderClientSigningMaterialSource } from "../../../core/signingEngine/flows/signEvmFamily/signers/ecdsaDerivationClientSigningMaterialSource.js";
+//#region src/SeamsWeb/operations/auth/scheduleLinkedDevicePresignaturePrefill.ts
+async function scheduleLinkedDevicePresignaturePrefill(args) {
+	try {
+		const scope = args.runtime.activationReceipt.normalSigning.scope;
+		const material = buildRouterAbEcdsaDerivationSigningMaterialRef({ routerAbState: args.runtime.activationReceipt.normalSigning });
+		const keyHandle = await deriveEvmFamilyEcdsaKeyHandle({
+			ecdsaThresholdKeyId: scope.ecdsa_threshold_key_id,
+			signingRootId: scope.signing_root_id,
+			signingRootVersion: scope.signing_root_version
+		});
+		if (resolveLinkedEcdsaHolderRuntimeV1(args.runtime) !== args.runtime) return;
+		const result = scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill({
+			relayerUrl: args.relayerUrl,
+			keyHandle: parseEcdsaKeyHandle(keyHandle),
+			ecdsaThresholdKeyId: material.ecdsaThresholdKeyId,
+			clientVerifyingShareB64u: material.clientVerifier33B64u,
+			clientSigningMaterial: createLinkedHolderClientSigningMaterialSource(args.runtime.holderHandleId),
+			thresholdEcdsaPublicKeyB64u: material.thresholdVerifier33B64u,
+			relayerVerifyingShareB64u: material.serverVerifier33B64u,
+			credential: {
+				kind: "wallet_session_opaque",
+				walletSessionToken: args.operationCredential.token
+			},
+			authorization: {
+				kind: "reusable_wallet_session",
+				wallet_session_id: args.operationCredential.walletSessionId
+			},
+			materialActivation: routerAbMpcMaterialActivationRefToWire(args.runtime.materialActivation),
+			routerAbEcdsaDerivationPoolFill: {
+				kind: "router_ab_ecdsa_derivation_signing_worker_pool",
+				scope,
+				ceremonyExpiresAtMs: args.expiresAtMs,
+				materialExpiresAtMs: Date.now() + MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS
+			},
+			workerCtx: args.workerCtx
+		});
+		emitSigningSessionFlowTrace("evm-family", {
+			event: "ecdsa_linked_device_prefill",
+			scheduled: result.scheduled,
+			reason: result.reason,
+			depth: result.depth,
+			targetDepth: result.targetDepth
+		});
+	} catch {
+		emitSigningSessionFlowTrace("evm-family", {
+			event: "ecdsa_linked_device_prefill",
+			scheduled: false,
+			reason: "unexpected_error"
+		});
+	}
+}
+//#endregion
+export { scheduleLinkedDevicePresignaturePrefill };
+
+//# sourceMappingURL=scheduleLinkedDevicePresignaturePrefill.js.map

package/dist/esm/react/SeamsWeb/operations/auth/walletAuth.js

@@ -1,7 +1,6 @@
 import { toError } from "../../../shared-ts/src/utils/errors.js";
 import { SIGNER_AUTH_METHODS } from "../../../shared-ts/src/utils/signerDomain.js";
 import { toWalletId } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
-import { WalletSessionStatusReadScope } from "../../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { IndexedDBManager } from "../../../core/indexedDB/index.js";
 import { resolveWalletUnlockSubjectSet } from "./walletUnlockSubject.js";
 import { getRecentUnlocks, getWalletSession, lock, logout, unlockResolvedWalletSubjectSet } from "./login.js";
@@ -122,7 +121,7 @@ async function getRecentUnlocksDomain(deps) {
 	}
 	return await getRecentUnlocks(deps.getContext());
 }
-async function prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps, args) {
+async function prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps, args, statusReads) {
 	if (deps.walletIframe.shouldUseWalletIframe()) return await (await deps.walletIframe.requireRouter(args.walletSession.walletId)).prefillRouterAbEcdsaDerivationPresignaturePool({
 		walletSession: args.walletSession,
 		options: {
@@ -135,7 +134,7 @@ async function prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps, args)
 		walletId,
 		chainTarget: args.chainTarget,
 		...typeof args.waitForPoolReady === "boolean" ? { waitForPoolReady: args.waitForPoolReady } : {}
-	}, new WalletSessionStatusReadScope());
+	}, statusReads);
 }
 //#endregion
 export { getRecentUnlocksDomain, getWalletSessionDomain, hasPasskeyCredentialDomain, lockDomain, logoutDomain, prefillRouterAbEcdsaDerivationPresignaturePoolDomain, unlockDomain };

package/dist/esm/react/SeamsWeb/operations/auth/walletUnlockEcdsaSubject.js

@@ -1,7 +1,7 @@
 import { IndexedDbEcdsaCapabilityManifestStore } from "../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
 //#region src/SeamsWeb/operations/auth/walletUnlockEcdsaSubject.ts
 const ecdsaCapabilityManifestStore = new IndexedDbEcdsaCapabilityManifestStore();
-async function listEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
+async function resolveEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
 	const resolved = await ecdsaCapabilityManifestStore.listActiveWalletCapabilitySubjects(walletId);
 	if (resolved.kind === "persistence_unavailable") return {
 		kind: "failed",
@@ -24,9 +24,6 @@ async function listEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
 		subjects
 	};
 }
-async function resolveEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
-	return await listEvmFamilyEcdsaWalletUnlockSubjects(walletId);
-}
 async function resolveEcdsaActivationJournalSelectors(walletId) {
 	return await ecdsaCapabilityManifestStore.listWalletActivationJournalSelectors(walletId);
 }

package/dist/esm/react/SeamsWeb/operations/devices/deviceLinkingHttpTransport.js

@@ -9,6 +9,7 @@ import { parseLinkSessionProjectionV1, parseLinkSessionTransportEventV1, parseLi
 import { parseActivateInstalledAuthorityResultV1, parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1 } from "../../../shared-ts/src/device-linking/authorityActivation.js";
 import { LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, computeLinkedDevicePublicKeyDigestV1 } from "../../../shared-ts/src/device-linking/requestProof.js";
 import "../../../shared-ts/src/device-linking/index.js";
+import { hasExactKeys } from "../../../shared-ts/src/utils/exactKeys.js";
 //#region src/SeamsWeb/operations/devices/deviceLinkingHttpTransport.ts
 const LINKED_DEVICE_SESSION_HTTP_BASE_PATH_V1 = "/wallet/device-linking/v1/sessions";
 const LINKED_DEVICE_POLL_MAX_DELAY_MS = 4e3;
@@ -425,7 +426,7 @@ async function createPollingSubscriptionV1(input) {
 function parseSessionMutationEnvelopeV1(raw) {
 	const record = asPlainDeviceLinkingResponse(raw);
 	if (record === null) throw new Error("linked-device response must be an object");
-	if (!hasExactKeys(record, SESSION_MUTATION_RESPONSE_FIELDS)) throw new Error("linked-device response contains invalid fields");
+	if (!hasExactResponseKeys(record, SESSION_MUTATION_RESPONSE_FIELDS)) throw new Error("linked-device response contains invalid fields");
 	if (record.ok !== true) throw new Error("linked-device response outcome is invalid");
 	switch (record.outcome) {
 		case "applied": return {
@@ -444,7 +445,7 @@ function parseSessionMutationEnvelopeV1(raw) {
 function parseTargetCredentialRegistrationResponseV1(raw) {
 	const record = asPlainDeviceLinkingResponse(raw);
 	if (record === null) throw new Error("linked-device target credential response must be an object");
-	if (!hasExactKeys(record, TARGET_CREDENTIAL_RESPONSE_FIELDS)) throw new Error("linked-device target credential response contains invalid fields");
+	if (!hasExactResponseKeys(record, TARGET_CREDENTIAL_RESPONSE_FIELDS)) throw new Error("linked-device target credential response contains invalid fields");
 	if (record.ok !== true) throw new Error("linked-device target credential response outcome is invalid");
 	switch (record.outcome) {
 		case "applied": return parseTargetCredentialRegistrationResponseBranch(record, "applied");
@@ -462,20 +463,20 @@ function parseTargetCredentialRegistrationResponseBranch(record, outcome) {
 function parseHttpFailureMessageV1(response) {
 	const record = asPlainDeviceLinkingResponse(response.body);
 	if (record === null || record.ok !== false) return `linked-device request failed with HTTP ${response.status}`;
-	if (hasExactKeys(record, CODED_FAILURE_RESPONSE_FIELDS) && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
-	if (hasExactKeys(record, OUTCOME_FAILURE_RESPONSE_FIELDS) && typeof record.outcome === "string" && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
+	if (hasExactResponseKeys(record, CODED_FAILURE_RESPONSE_FIELDS) && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
+	if (hasExactResponseKeys(record, OUTCOME_FAILURE_RESPONSE_FIELDS) && typeof record.outcome === "string" && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
 	switch (record.outcome) {
 		case "conflict":
-			if (hasExactKeys(record, SESSION_CONFLICT_FAILURE_FIELDS)) return "linked-device request failed: conflict";
+			if (hasExactResponseKeys(record, SESSION_CONFLICT_FAILURE_FIELDS)) return "linked-device request failed: conflict";
 			break;
 		case "expired":
-			if (hasExactKeys(record, SESSION_EXPIRED_FAILURE_FIELDS)) return "linked-device request failed: expired";
+			if (hasExactResponseKeys(record, SESSION_EXPIRED_FAILURE_FIELDS)) return "linked-device request failed: expired";
 			break;
 		case "invalid_state":
-			if (hasExactKeys(record, SESSION_INVALID_STATE_FAILURE_FIELDS)) return "linked-device request failed: invalid_state";
+			if (hasExactResponseKeys(record, SESSION_INVALID_STATE_FAILURE_FIELDS)) return "linked-device request failed: invalid_state";
 			break;
 		case "integrity_error":
-			if (hasExactKeys(record, SESSION_INTEGRITY_FAILURE_FIELDS)) return "linked-device request failed: integrity_error";
+			if (hasExactResponseKeys(record, SESSION_INTEGRITY_FAILURE_FIELDS)) return "linked-device request failed: integrity_error";
 			break;
 		default: break;
 	}
@@ -493,11 +494,9 @@ function isPlainDeviceLinkingResponse(value) {
 		return false;
 	}
 }
-function hasExactKeys(record, expectedKeys) {
+function hasExactResponseKeys(record, expectedKeys) {
 	try {
-		const actualKeys = Object.keys(record).sort();
-		const expected = [...expectedKeys].sort();
-		return actualKeys.length === expected.length && actualKeys.every((key, index) => key === expected[index]);
+		return hasExactKeys(record, expectedKeys);
 	} catch {
 		return false;
 	}

package/dist/esm/react/SeamsWeb/operations/devices/deviceLinkingResume.js

@@ -3,6 +3,7 @@ import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitive
 import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { encodeWalletSignerActivationSetV1, parseWalletSignerActivationSetV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
 import { parseLocalAuthorityActivationFinalAckV1 } from "../../../shared-ts/src/device-linking/authorityActivation.js";
+import { hasExactKeys } from "../../../shared-ts/src/utils/exactKeys.js";
 //#region src/SeamsWeb/operations/devices/deviceLinkingResume.ts
 const LINKED_DEVICE_COMMITTED_RESUME_KIND_V1 = "linked_device_committed_resume_v1";
 const LINKED_DEVICE_PENDING_ACK_KIND_V1 = "linked_device_pending_ack_v1";
@@ -203,11 +204,6 @@ function isPlainDeviceLinkingResumeRecord(value) {
 		return false;
 	}
 }
-function hasExactKeys(record, expectedKeys) {
-	const actual = Object.keys(record).sort();
-	const expected = [...expectedKeys].sort();
-	return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
-}
 function sameSignerActivations(left, right) {
 	const leftBytes = encodeWalletSignerActivationSetV1(left);
 	const rightBytes = encodeWalletSignerActivationSetV1(right);

package/dist/esm/react/SeamsWeb/operations/devices/deviceLinkingWorkerChannels.js

@@ -5,27 +5,10 @@ import { parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/
 import { parseLinkDevicePublicKeyB64u, parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1, parseLinkedDeviceEmailOtpVerificationGrantV1 } from "../../../shared-ts/src/device-linking/parsers.js";
 import { parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1, parseLinkedDeviceWalletSessionCredentialDeliveryV1 } from "../../../shared-ts/src/device-linking/walletSessionCredentialDelivery.js";
 import "../../../shared-ts/src/device-linking/index.js";
+import { hasExactKeys } from "../../../shared-ts/src/utils/exactKeys.js";
 import { resolveWorkerUrl } from "../../../core/walletRuntimePaths/workers.js";
 import { createDeviceLinkingOrdinaryMaterialWorkerPortV1 } from "../../../core/signingEngine/workerManager/deviceLinkingPorts.js";
 //#region src/SeamsWeb/operations/devices/deviceLinkingWorkerChannels.ts
-function isDeviceLinkingKeyHandleRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "handleId|kind";
-}
-function isDeviceLinkingKeyCreateResultRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "deliveryRecipientPublicKey65B64u|devicePublicKeyB64u|handleId|linkPublicKeyB64u";
-}
-function isDeviceLinkingEmailOtpFactorReleaseResultRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "factorSecret|kind|verificationGrant";
-}
-function isDeviceLinkingRequestSignatureResultRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "signatureB64u";
-}
-function isDeviceLinkingWorkerSuccessFrameRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "id|ok|result" && "ok" in value && value.ok === true;
-}
-function isDeviceLinkingWorkerFailureFrameRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "error|id|ok" && "ok" in value && value.ok === false;
-}
 function nonEmpty(value, label) {
 	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error(`${label} is required`);
 	return value;
@@ -51,7 +34,7 @@ function parseFixedB64u(value, length, label) {
 	return encoded;
 }
 function parseHandle(value) {
-	if (!isDeviceLinkingKeyHandleRecordV1(value)) throw new Error("device-linking key handle has invalid fields");
+	if (!hasExactKeys(value, ["kind", "handleId"])) throw new Error("device-linking key handle has invalid fields");
 	const record = value;
 	if (record.kind !== "device_linking_key_material_handle_v1") throw new Error("device-linking key handle kind is invalid");
 	return {
@@ -60,7 +43,12 @@ function parseHandle(value) {
 	};
 }
 function parseCreateResult(value) {
-	if (!isDeviceLinkingKeyCreateResultRecordV1(value)) throw new Error("device-linking key create response has invalid fields");
+	if (!hasExactKeys(value, [
+		"handleId",
+		"linkPublicKeyB64u",
+		"devicePublicKeyB64u",
+		"deliveryRecipientPublicKey65B64u"
+	])) throw new Error("device-linking key create response has invalid fields");
 	const record = value;
 	return {
 		handle: {
@@ -73,7 +61,11 @@ function parseCreateResult(value) {
 	};
 }
 function parseEmailOtpFactorReleaseResult(value) {
-	if (!isDeviceLinkingEmailOtpFactorReleaseResultRecordV1(value)) throw new Error("device-linking Email OTP factor release response has invalid fields");
+	if (!hasExactKeys(value, [
+		"kind",
+		"verificationGrant",
+		"factorSecret"
+	])) throw new Error("device-linking Email OTP factor release response has invalid fields");
 	const record = value;
 	if (record.kind !== "device_linking_email_otp_factor_release_result_v1") throw new Error("device-linking Email OTP factor release response kind is invalid");
 	if (!(record.factorSecret instanceof ArrayBuffer) || record.factorSecret.byteLength !== 32) throw new Error("device-linking Email OTP factor release secret is invalid");
@@ -87,11 +79,15 @@ function parseWalletSessionCredentialDeliveryResult(value) {
 	return parseWalletSessionOperationCredentialV1(value);
 }
 function parseSignatureResult(value) {
-	if (!isDeviceLinkingRequestSignatureResultRecordV1(value)) throw new Error("device-linking request signature response has invalid fields");
+	if (!hasExactKeys(value, ["signatureB64u"])) throw new Error("device-linking request signature response has invalid fields");
 	return { signatureB64u: parseFixedB64u(value.signatureB64u, 64, "signatureB64u") };
 }
 function parseResponseFrame(value) {
-	if (isDeviceLinkingWorkerSuccessFrameRecordV1(value)) {
+	if (hasExactKeys(value, [
+		"id",
+		"ok",
+		"result"
+	]) && value.ok === true) {
 		const id = value.id;
 		if (typeof id !== "string" || id.trim() !== id || id.length === 0) return null;
 		return {
@@ -100,7 +96,11 @@ function parseResponseFrame(value) {
 			result: value.result
 		};
 	}
-	if (isDeviceLinkingWorkerFailureFrameRecordV1(value)) {
+	if (hasExactKeys(value, [
+		"id",
+		"ok",
+		"error"
+	]) && value.ok === false) {
 		const id = value.id;
 		if (typeof id !== "string" || id.trim() !== id || id.length === 0) return null;
 		if (typeof value.error !== "string" || !value.error.trim()) return null;

package/dist/esm/react/SeamsWeb/operations/recovery/walletRecoveryDurablePayload.js

@@ -81,9 +81,6 @@ function durableBase64Url(value, label, byteLength) {
 	if (byteLength !== void 0 && bytes.byteLength !== byteLength) throw new Error(label + " must decode to " + byteLength + " bytes");
 	return normalized;
 }
-function durableCompressedPublicKey(value, label) {
-	return parseSecp256k1CompressedPublicKeyB64u(value, label);
-}
 function durableSafeInteger(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(label + " must be a non-negative safe integer");
 	return value;
@@ -154,10 +151,10 @@ function parseWalletRecoveryDurableEcdsaPublicFacts(raw) {
 	if (!/^0x[0-9a-f]{40}$/.test(ethereumAddress)) throw new Error("recovery durable ECDSA ethereumAddress is invalid");
 	return {
 		contextBinding32B64u: parseDigestField(record.contextBinding32B64u, "recovery durable ECDSA context binding"),
-		derivationClientSharePublicKey33B64u: durableCompressedPublicKey(record.derivationClientSharePublicKey33B64u, "recovery durable ECDSA client share"),
-		clientVerifyingShare33B64u: durableCompressedPublicKey(record.clientVerifyingShare33B64u, "recovery durable ECDSA client verifying share"),
-		relayerPublicKey33B64u: durableCompressedPublicKey(record.relayerPublicKey33B64u, "recovery durable ECDSA relayer public key"),
-		groupPublicKey33B64u: durableCompressedPublicKey(record.groupPublicKey33B64u, "recovery durable ECDSA group public key"),
+		derivationClientSharePublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.derivationClientSharePublicKey33B64u, "recovery durable ECDSA client share"),
+		clientVerifyingShare33B64u: parseSecp256k1CompressedPublicKeyB64u(record.clientVerifyingShare33B64u, "recovery durable ECDSA client verifying share"),
+		relayerPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.relayerPublicKey33B64u, "recovery durable ECDSA relayer public key"),
+		groupPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.groupPublicKey33B64u, "recovery durable ECDSA group public key"),
 		ethereumAddress,
 		clientShareRetryCounter: durableSafeInteger(record.clientShareRetryCounter, "recovery durable ECDSA client-share retry counter"),
 		relayerShareRetryCounter: durableSafeInteger(record.relayerShareRetryCounter, "recovery durable ECDSA relayer-share retry counter")

package/dist/esm/react/SeamsWeb/operations/registration/pendingRegistrationRecovery.js

@@ -18,19 +18,13 @@ import { unlockPendingEcdsaRegistration } from "./pendingEcdsaRegistrationRecove
 //#region src/SeamsWeb/operations/registration/pendingRegistrationRecovery.ts
 const defaultPendingRegistrationRecoveryPorts = {
 	listPendingWalletRegistrationCommits,
-	completeWalletRegistrationNearProvisioning: completePendingWalletRegistrationNearProvisioning,
+	completeWalletRegistrationNearProvisioning,
 	publishPendingWalletRegistrationCommit
 };
 async function listPendingWalletRegistrationCommits() {
 	await IndexedDBManager.initialize();
 	return await IndexedDBManager.listPendingWalletRegistrationCommits();
 }
-async function completePendingWalletRegistrationNearProvisioning(input) {
-	return await completeWalletRegistrationNearProvisioning(input);
-}
-async function activatePendingWalletRegistration(input) {
-	return await activateWalletRegistration(input);
-}
 async function publishPendingWalletRegistrationCommit(input) {
 	return await IndexedDBManager.publishPendingWalletRegistrationCommit(input);
 }
@@ -325,7 +319,7 @@ async function resumePendingNearRegistrations(args) {
 	return results;
 }
 const defaultPendingEcdsaRegistrationRecoveryPorts = {
-	activateWalletRegistration: activatePendingWalletRegistration,
+	activateWalletRegistration,
 	publishPendingWalletRegistrationCommit,
 	unlockPendingEcdsaRegistration
 };

package/dist/esm/react/SeamsWeb/operations/tempo/executeEvmFamilyTransaction.js

@@ -369,7 +369,10 @@ async function executeEvmFamilyTransactionLifecycle(args) {
 			}
 		});
 		const rawTxHex = assertRawTxHexOrThrow(signedResult.rawTxHex);
-		args.lifecycle.onBroadcastStarted?.(signedResult);
+		args.lifecycle.onBroadcastStarted({
+			walletSession: args.input.walletSession,
+			signedResult
+		});
 		txHash = normalizeTxHashOrThrow(await client.request({
 			method: "eth_sendRawTransaction",
 			params: [rawTxHex]

package/dist/esm/react/SeamsWeb/publicApi/auth.js

@@ -1,3 +1,4 @@
+import { WalletSessionStatusReadScope } from "../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { getRecentUnlocksDomain, getWalletSessionDomain, hasPasskeyCredentialDomain, lockDomain, logoutDomain, prefillRouterAbEcdsaDerivationPresignaturePoolDomain, unlockDomain } from "../operations/auth/walletAuth.js";
 //#region src/SeamsWeb/publicApi/auth.ts
 function createAuthCapability(deps) {
@@ -8,7 +9,7 @@ function createAuthCapability(deps) {
 		getWalletSession: async (walletId) => await getWalletSessionDomain(deps.getWalletAuthDeps(), walletId),
 		getRecentUnlocks: async () => await getRecentUnlocksDomain(deps.getWalletAuthDeps()),
 		hasPasskeyCredential: async (walletId) => await hasPasskeyCredentialDomain(deps.getWalletAuthDeps(), walletId),
-		prefillRouterAbEcdsaDerivationPresignaturePool: async (args) => await prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps.getWalletAuthDeps(), args),
+		prefillRouterAbEcdsaDerivationPresignaturePool: async (args) => await prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps.getWalletAuthDeps(), args, new WalletSessionStatusReadScope()),
 		requestEmailOtpChallenge: deps.domain.requestEmailOtpChallenge,
 		requestEmailOtpSigningSessionChallenge: deps.domain.requestEmailOtpSigningSessionChallenge,
 		refreshEmailOtpSigningSession: deps.domain.refreshEmailOtpSigningSession,

package/dist/esm/react/SeamsWeb/publicApi/tempo.js

@@ -63,6 +63,11 @@ function createTempoSignerCapability(deps, transactionDispatch = { kind: "ordina
 		...args,
 		chainTarget: resolveTempoChainTarget(deps.configs.network.chains, args.chainTarget)
 	}));
+	const onBroadcastStarted = (args) => {
+		const walletIframe = deps.getWalletIframe();
+		if (!walletIframe.shouldUseWalletIframe()) return;
+		walletIframe.requireRouter(toWalletId(args.walletSession.walletId)).then((router) => router.notifyTransactionBroadcastStarted(args.signedResult)).catch(() => {});
+	};
 	const reportBroadcastAccepted = async (args) => {
 		const walletIframe = deps.getWalletIframe();
 		const walletId = toWalletId(args.walletSession.walletId);
@@ -178,6 +183,7 @@ function createTempoSignerCapability(deps, transactionDispatch = { kind: "ordina
 		}
 	};
 	const lifecycle = {
+		onBroadcastStarted,
 		signEvmFamily,
 		reportBroadcastAccepted,
 		reportBroadcastRejected,

package/dist/esm/react/SeamsWeb/signingSurface/BrowserSigningSurface.js

@@ -54,10 +54,11 @@ import { fullWalletLoginRequired, invalidWalletSigningMaterial, isWalletSigningS
 import { buildBlockedMpcCapabilityHydrationPlan, buildRehydrateMaterialActivationHydrationPlan, buildUseLiveRuntimeHydrationPlan } from "../../core/signingEngine/session/material/mpcCapabilityHydration.js";
 import { nearEd25519YaoMaterialActivationFromMetadata, nearEd25519YaoRuntimeRef, resolveNearEd25519YaoCapabilityHydrationV1 } from "../../core/signingEngine/session/material/nearEd25519YaoMaterialActivation.js";
 import { buildThresholdEd25519WebAuthnPrfSecretSource } from "../../core/signingEngine/threshold/ed25519/walletSession.js";
-import { resolveThresholdEd25519CommitQueueKey, withThresholdEd25519CommitQueue } from "../../core/signingEngine/threshold/ed25519/commitQueue.js";
+import { clearThresholdCommitQueue, resolveThresholdCommitQueueKey } from "../../core/signingEngine/threshold/commitQueueShared.js";
+import { withThresholdEd25519CommitQueue } from "../../core/signingEngine/threshold/ed25519/commitQueue.js";
+import { ed25519DurableMaterialLocator } from "../../core/signingEngine/session/sealedRecovery/materialActivationKey.js";
 import { isConcreteAvailableSigningLane } from "../../core/signingEngine/session/availability/availableSigningLanes.js";
 import { signNear } from "../../core/signingEngine/flows/signNear/signNear.js";
-import { ed25519DurableMaterialLocator } from "../../core/signingEngine/session/sealedRecovery/materialActivationKey.js";
 import { resolvePasskeyEd25519YaoExportContextV1 } from "../../core/signingEngine/session/passkey/ed25519YaoWarmRecovery.js";
 import { ed25519YaoLocalMaterialIdentityFromWalletSession, hydratePasskeyEd25519YaoLocalMaterialV1, preparePasskeyEd25519YaoLocalMaterialRehydrationV1, readPasskeyEd25519YaoLocalMaterialLocatorV1 } from "../../core/signingEngine/session/passkey/ed25519YaoLocalMaterial.js";
 import { buildPasskeyEd25519RestoreMetadata, persistPasskeyEd25519YaoSessionForRefresh } from "../../core/signingEngine/session/passkey/ed25519YaoSealedSession.js";
@@ -69,7 +70,7 @@ import { persistVerifiedEmailOtpAuthorityAfterUnlock, walletAuthAuthorityRefForV
 import { isRetryableSealedRefreshCapabilityFetchError } from "../../core/signingEngine/session/warmCapabilities/sealedRefreshParity.js";
 import { buildExactEcdsaPasskeyOwnerLaneScope, buildExactLinkedEmailOtpOwnerLaneScope, buildExactPasskeyOwnerLaneScope, resolveExactOwnerLaneScope, resolveExactWalletAuthAuthority } from "../../core/signingEngine/session/identity/ownerLaneScope.js";
 import { buildFreshEmailOtpRoutePlan } from "../../core/signingEngine/session/emailOtp/routePlan.js";
-import { clearThresholdEcdsaSigningQueue, withThresholdEcdsaSigningQueue } from "../../core/signingEngine/threshold/ecdsa/signingQueue.js";
+import { withThresholdEcdsaSigningQueue } from "../../core/signingEngine/threshold/ecdsa/signingQueue.js";
 import { reconcileTempoNonceLane, reportTempoBroadcastAccepted, reportTempoBroadcastRejected, reportTempoDroppedOrReplaced, reportTempoFinalized, signEvmFamily } from "../../core/signingEngine/flows/signEvmFamily/signEvmFamily.js";
 import { UserConfirmationType } from "../../core/signingEngine/stepUpConfirmation/userConfirmationType.js";
 import { exportKeypairWithUI, resolveExactKeyExportLane } from "../../core/signingEngine/flows/recovery/public.js";
@@ -1844,18 +1845,15 @@ var BrowserSigningSurface = class {
 		const rehydrationKey = nearEd25519CapabilityRehydrationKey(subject);
 		const existingRehydration = this.nearEd25519CapabilityRehydrationBySubject.get(rehydrationKey);
 		if (existingRehydration) {
-			const reboundSubject = await existingRehydration;
-			const rehydrated = await this.resolveActiveNearEd25519YaoSigningLane(reboundSubject);
+			const rebound = await existingRehydration;
+			const rehydrated = await this.resolveActiveNearEd25519YaoSigningLane(rebound.subject);
 			if (rehydrated) return rehydrated;
 			throw new Error("[SigningEngine][near] joined rehydration did not publish an active lane");
 		}
 		const rehydration = this.rehydrateNearEd25519YaoCapabilityForSigning(subject);
 		this.nearEd25519CapabilityRehydrationBySubject.set(rehydrationKey, rehydration);
 		try {
-			const reboundSubject = await rehydration;
-			const rehydrated = await this.resolveActiveNearEd25519YaoSigningLane(reboundSubject);
-			if (rehydrated) return rehydrated;
-			throw new Error("[SigningEngine][near] local material rehydration did not publish a lane");
+			return (await rehydration).material;
 		} finally {
 			if (this.nearEd25519CapabilityRehydrationBySubject.get(rehydrationKey) === rehydration) this.nearEd25519CapabilityRehydrationBySubject.delete(rehydrationKey);
 		}
@@ -3181,7 +3179,14 @@ var BrowserSigningSurface = class {
 				passkeyPrfFirstB64u: warmSessionClaim.prfFirstB64u
 			} : { kind: "unavailable" }
 		});
-		if (liveHydration.kind === "live") return subject;
+		if (liveHydration.kind === "live") {
+			const material = await this.resolveActiveNearEd25519YaoSigningLane(subject);
+			if (!material) throw new Error("[SigningEngine][near] local material rehydration did not publish a lane");
+			return {
+				subject,
+				material
+			};
+		}
 		if (liveHydration.kind === "rehydrated") {
 			if (!warmSessionClaim.ok) {
 				liveHydration.activeClient.dispose();
@@ -3214,8 +3219,12 @@ var BrowserSigningSurface = class {
 					subject,
 					walletSessionState
 				});
-				if (!await this.resolveActiveNearEd25519YaoSigningLane(reboundSubject)) throw new Error("[SigningEngine][near] local material rehydration did not publish an active lane");
-				return reboundSubject;
+				const published = await this.resolveActiveNearEd25519YaoSigningLane(reboundSubject);
+				if (!published) throw new Error("[SigningEngine][near] local material rehydration did not publish an active lane");
+				return {
+					subject: reboundSubject,
+					material: published
+				};
 			} catch (error) {
 				liveHydration.activeClient.dispose();
 				throw error;
@@ -3362,7 +3371,7 @@ var BrowserSigningSurface = class {
 	async withExactEd25519MaterialOwner(args) {
 		return await withThresholdEd25519CommitQueue({
 			queueByKey: this.thresholdEd25519CommitQueueByKey,
-			queueKey: resolveThresholdEd25519CommitQueueKey({ materialActivation: args.materialActivation }),
+			queueKey: resolveThresholdCommitQueueKey({ materialActivation: args.materialActivation }),
 			nearAccountId: args.nearAccountId,
 			enabled: true,
 			task: args.task
@@ -3661,7 +3670,7 @@ var BrowserSigningSurface = class {
 		if (args.credentialExpectation.kind === "expect_exact_operation_credential" && (args.credentialExpectation.operationCredential.walletSessionId !== exactAuthorization.operationCredential.walletSessionId || args.credentialExpectation.operationCredential.token !== exactAuthorization.operationCredential.token)) throw new Error("[SigningEngine][near] expected Email OTP operation credential changed");
 		return await withThresholdEd25519CommitQueue({
 			queueByKey: this.thresholdEd25519CommitQueueByKey,
-			queueKey: resolveThresholdEd25519CommitQueueKey({ materialActivation: args.metadata.materialActivation }),
+			queueKey: resolveThresholdCommitQueueKey({ materialActivation: args.metadata.materialActivation }),
 			nearAccountId: toAccountId(args.bootstrap.session.nearAccountId),
 			enabled: args.commitQueue === "acquire",
 			task: async () => {
@@ -3881,7 +3890,7 @@ var BrowserSigningSurface = class {
 		this.ed25519YaoPageLifecycleOwner.dispose();
 	}
 	clearThresholdEcdsaSigningQueue() {
-		clearThresholdEcdsaSigningQueue(this.thresholdEcdsaSigningQueueByKey);
+		clearThresholdCommitQueue(this.thresholdEcdsaSigningQueueByKey);
 	}
 	async clearLinkedEcdsaHolderMaterials() {
 		await clearLinkedDeviceEcdsaHolderMaterialsWasm({ workerCtx: this.signerWorkerManager.getContext() });

package/dist/esm/react/SeamsWeb/walletIframe/host/restoredSessionPresignaturePrefill.js

@@ -0,0 +1,29 @@
+import { walletSessionRefFromSession } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
+import { WalletSessionStatusReadScope } from "../../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
+//#region src/SeamsWeb/walletIframe/host/restoredSessionPresignaturePrefill.ts
+async function scheduleRestoredSessionPresignaturePrefills(args) {
+	switch (args.state.kind) {
+		case "active_session": break;
+		case "wallet_unlocked_without_signing_session":
+			if (args.state.reason !== "exhausted") return;
+			break;
+		case "wallet_locked":
+		case "wallet_authenticated_identity_unresolvable":
+		case "expired_session": return;
+		default:
+			args.state;
+			return;
+	}
+	const walletSession = walletSessionRefFromSession({ walletId: args.state.walletId });
+	const statusReads = new WalletSessionStatusReadScope();
+	const prefills = [];
+	for (const chainTarget of args.chainTargets) prefills.push(args.prefill({
+		walletSession,
+		chainTarget
+	}, statusReads));
+	await Promise.all(prefills);
+}
+//#endregion
+export { scheduleRestoredSessionPresignaturePrefills };
+
+//# sourceMappingURL=restoredSessionPresignaturePrefill.js.map