@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/core/rpcClients/relayer/walletRecoveryPrepare.js

@@ -1,20 +1,22 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { requireArray } from "../../../shared-ts/src/utils/validation.js";
+import { wireLiteral, wireObject, wireResult } from "../../../shared-ts/src/utils/wireSchema.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseUnixMs } from "../../../shared-ts/src/passkey-custody/primitives.js";
 import { buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
 import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../shared-ts/src/utils/signingSessionSeal.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { parseEcdsaServerGeneration } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
 import { requireEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
-import { ecdsaClientRootPublicKey33B64uFromString, parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion, parseSdkEcdsaDerivationThresholdKeyId } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import "../../../shared-ts/src/signing-lanes/index.js";
-import { parseRecoveryCodeReservationId } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
 import { parseRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { parseRecoveryCodeReservationId } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
+import { ecdsaClientRootPublicKey33B64uFromString, parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion, parseSdkEcdsaDerivationThresholdKeyId } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import { parseEcdsaServerGeneration } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
 import { parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { parseWalletRecoveryEcdsaPossessionChallengeV1 } from "../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.js";
+import { thresholdEcdsaChainTargetKey } from "../../../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
 import { parseWalletRecoveryEnvelopeEntry } from "../../../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js";
 import "../../../shared-ts/src/wallet-recovery/index.js";
 import { parseWalletRecoveryTargetV1 } from "../../../shared-ts/src/wallet-recovery/walletRecoveryTarget.js";
@@ -124,7 +126,7 @@ async function parseWalletRecoveryPrepareResponse(args) {
 	const body = decodeJsonObjectOrNull(await response.json().catch(() => ({})));
 	if (response.status === 200 && body && readJsonField(body, "ok") === true) try {
 		const preparedResponse = decodeExactJsonObject(body, args.target.kind === "passkey" ? WALLET_RECOVERY_PREPARE_PASSKEY_RESPONSE_FIELDS : WALLET_RECOVERY_PREPARE_COMMON_RESPONSE_FIELDS, "walletRecoveryPrepare");
-		const wrap = parsePreparedRecoveryWrap(readJsonField(preparedResponse, "wrap"));
+		const wrap = preparedRecoveryWrap()(readJsonField(preparedResponse, "wrap"), "walletRecoveryPrepare.wrap");
 		const entries = parsePreparedRecoveryEntries(readJsonField(preparedResponse, "entries"));
 		const walletIdResult = parseWalletId(readJsonField(preparedResponse, "walletId"));
 		if (!walletIdResult.ok) throw new Error("walletRecoveryPrepare.walletId is invalid");
@@ -157,7 +159,7 @@ async function parseWalletRecoveryPrepareResponse(args) {
 		};
 		switch (target.kind) {
 			case "passkey": {
-				const registration = parseWalletRecoveryRegistrationOptions(readJsonField(preparedResponse, "registration"), String(walletId), target.rpId);
+				const registration = walletRecoveryRegistrationOptions(String(walletId), target.rpId)(readJsonField(preparedResponse, "registration"), "registration");
 				if (registration.walletAuthMethodId !== targetWalletAuthMethodId.value) throw new Error("wallet recovery registration changed the target auth method");
 				return {
 					...common,
@@ -181,115 +183,69 @@ async function parseWalletRecoveryPrepareResponse(args) {
 	if (response.status === 401 || response.status === 400) return { kind: "refused" };
 	return { kind: "transport_uncertain" };
 }
-function parseWalletRecoveryRegistrationOptions(raw, expectedWalletId, expectedRpId) {
-	const registration = decodeExactJsonObject(raw, [
-		"kind",
-		"challengeId",
-		"challengeB64u",
-		"replacementId",
-		"walletAuthMethodId",
-		"rpId",
-		"user",
-		"pubKeyCredParams",
-		"authenticatorSelection",
-		"timeoutMs",
-		"attestation",
-		"extensions",
-		"excludeCredentials"
-	], "walletRecoveryPrepare.registration");
-	if (readJsonField(registration, "kind") !== "webauthn_recovery_registration_v1") throw new Error("walletRecoveryPrepare.registration kind is invalid");
-	const challengeId = requireResponseString(readJsonField(registration, "challengeId"), "registration.challengeId");
-	const challengeB64u = requireCanonicalBytesB64u(readJsonField(registration, "challengeB64u"), 32, "registration.challengeB64u");
-	const replacementId = requireResponseString(readJsonField(registration, "replacementId"), "registration.replacementId");
-	const walletAuthMethodId = parseWalletAuthMethodId(readJsonField(registration, "walletAuthMethodId"));
-	if (!walletAuthMethodId.ok) throw new Error("walletRecoveryPrepare.registration.walletAuthMethodId is invalid");
-	const rpIdResult = parseWebAuthnRpId(readJsonField(registration, "rpId"));
-	if (!rpIdResult.ok) throw new Error("walletRecoveryPrepare.registration.rpId is invalid");
-	if (rpIdResult.value !== expectedRpId) throw new Error("walletRecoveryPrepare.registration changed the relying party");
-	const user = decodeExactJsonObject(readJsonField(registration, "user"), [
-		"idB64u",
-		"name",
-		"displayName"
-	], "walletRecoveryPrepare.registration.user");
+function walletRecoveryRegistrationOptions(expectedWalletId, expectedRpId) {
 	const expectedUserIdB64u = base64UrlEncode(new TextEncoder().encode(expectedWalletId));
-	const idB64u = requireCanonicalNonEmptyB64u(readJsonField(user, "idB64u"), "registration.user.idB64u");
-	if (idB64u !== expectedUserIdB64u) throw new Error("walletRecoveryPrepare.registration user is bound to another wallet");
-	const name = requireResponseString(readJsonField(user, "name"), "registration.user.name");
-	const displayName = requireResponseString(readJsonField(user, "displayName"), "registration.user.displayName");
-	if (name !== expectedWalletId || displayName !== expectedWalletId) throw new Error("walletRecoveryPrepare.registration user labels changed the wallet identity");
-	const pubKeyCredParams = parseRecoveryPublicKeyParameters(readJsonField(registration, "pubKeyCredParams"));
-	const authenticatorSelection = parseRecoveryAuthenticatorSelection(readJsonField(registration, "authenticatorSelection"));
-	const timeoutMs = Number(readJsonField(registration, "timeoutMs"));
-	if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new Error("walletRecoveryPrepare.registration.timeoutMs is invalid");
-	if (readJsonField(registration, "attestation") !== "none") throw new Error("walletRecoveryPrepare.registration.attestation is invalid");
-	const extensions = parseRecoveryPrfExtensions(readJsonField(registration, "extensions"));
-	const excludeCredentials = parseRecoveryExcludeCredentials(readJsonField(registration, "excludeCredentials"));
-	return {
-		kind: "webauthn_recovery_registration_v1",
-		challengeId,
-		challengeB64u,
-		replacementId,
-		walletAuthMethodId: walletAuthMethodId.value,
-		rpId: rpIdResult.value,
-		user: {
-			idB64u,
-			name,
-			displayName
+	const credentialDescriptor = wireObject({
+		type: wireLiteral("public-key"),
+		id: (raw, label) => {
+			const id = wireResult(parseWebAuthnCredentialIdB64u)(raw, label);
+			requireCanonicalNonEmptyB64u(id, label);
+			return id;
+		}
+	});
+	return wireObject({
+		kind: wireLiteral("webauthn_recovery_registration_v1"),
+		challengeId: requireResponseString,
+		challengeB64u: (raw, label) => requireCanonicalBytesB64u(raw, 32, label),
+		replacementId: requireResponseString,
+		walletAuthMethodId: wireResult(parseWalletAuthMethodId),
+		rpId: wireResult(parseWebAuthnRpId),
+		user: wireObject({
+			idB64u: requireCanonicalNonEmptyB64u,
+			name: requireResponseString,
+			displayName: requireResponseString
+		}, (user, label) => {
+			if (user.idB64u !== expectedUserIdB64u || user.name !== expectedWalletId || user.displayName !== expectedWalletId) throw new Error(`${label} is bound to another wallet`);
+		}),
+		pubKeyCredParams: (raw, label) => {
+			if (!Array.isArray(raw) || raw.length !== 2) throw new Error(`${label} is invalid`);
+			return [publicKeyCredentialParameter(-7)(raw[0], `${label}[0]`), publicKeyCredentialParameter(-257)(raw[1], `${label}[1]`)];
 		},
-		pubKeyCredParams,
-		authenticatorSelection,
-		timeoutMs,
-		attestation: "none",
-		extensions,
-		excludeCredentials
-	};
-}
-function parseRecoveryPrfExtensions(raw) {
-	const evaluation = decodeExactJsonObject(readJsonField(decodeExactJsonObject(readJsonField(decodeExactJsonObject(raw, ["prf"], "walletRecoveryPrepare.registration.extensions"), "prf"), ["eval"], "walletRecoveryPrepare.registration.extensions.prf"), "eval"), ["firstB64u", "secondB64u"], "walletRecoveryPrepare.registration.extensions.prf.eval");
-	const firstB64u = requireCanonicalBytesB64u(readJsonField(evaluation, "firstB64u"), PASSKEY_PRF_FIRST_SALT_V1.length, "registration.extensions.prf.eval.firstB64u");
-	const secondB64u = requireCanonicalBytesB64u(readJsonField(evaluation, "secondB64u"), PASSKEY_PRF_SECOND_SALT_V1.length, "registration.extensions.prf.eval.secondB64u");
-	if (firstB64u !== base64UrlEncode(PASSKEY_PRF_FIRST_SALT_V1) || secondB64u !== base64UrlEncode(PASSKEY_PRF_SECOND_SALT_V1)) throw new Error("walletRecoveryPrepare.registration PRF salts are unsupported");
-	return { prf: { eval: {
-		firstB64u,
-		secondB64u
-	} } };
+		authenticatorSelection: wireObject({
+			residentKey: wireLiteral("required"),
+			userVerification: wireLiteral("preferred")
+		}),
+		timeoutMs: (raw, label) => {
+			const timeoutMs = Number(raw);
+			if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new Error(`${label} is invalid`);
+			return timeoutMs;
+		},
+		attestation: wireLiteral("none"),
+		extensions: wireObject({ prf: wireObject({ eval: wireObject({
+			firstB64u: prfSalt(PASSKEY_PRF_FIRST_SALT_V1),
+			secondB64u: prfSalt(PASSKEY_PRF_SECOND_SALT_V1)
+		}) }) }),
+		excludeCredentials: (raw, label) => requireArray(raw, label).map((entry, index) => credentialDescriptor(entry, `${label}[${index}]`))
+	}, (registration, label) => {
+		if (registration.rpId !== expectedRpId) throw new Error(`${label} changed the relying party`);
+	});
 }
-function parseRecoveryPublicKeyParameters(raw) {
-	if (!Array.isArray(raw) || raw.length !== 2) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams is invalid");
-	const first = decodeExactJsonObject(raw[0], ["type", "alg"], "walletRecoveryPrepare.registration.pubKeyCredParams[0]");
-	const second = decodeExactJsonObject(raw[1], ["type", "alg"], "walletRecoveryPrepare.registration.pubKeyCredParams[1]");
-	if (readJsonField(first, "type") !== "public-key" || readJsonField(first, "alg") !== -7) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams[0] is invalid");
-	if (readJsonField(second, "type") !== "public-key" || readJsonField(second, "alg") !== -257) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams[1] is invalid");
-	return [{
-		type: "public-key",
-		alg: -7
-	}, {
-		type: "public-key",
-		alg: -257
-	}];
+function publicKeyCredentialParameter(alg) {
+	return wireObject({
+		type: wireLiteral("public-key"),
+		alg: (raw, label) => {
+			if (raw !== alg) throw new Error(`${label} is invalid`);
+			return alg;
+		}
+	});
 }
-function parseRecoveryAuthenticatorSelection(raw) {
-	const selection = decodeExactJsonObject(raw, ["residentKey", "userVerification"], "walletRecoveryPrepare.registration.authenticatorSelection");
-	if (readJsonField(selection, "residentKey") !== "required" || readJsonField(selection, "userVerification") !== "preferred") throw new Error("walletRecoveryPrepare.registration.authenticatorSelection is invalid");
-	return {
-		residentKey: "required",
-		userVerification: "preferred"
+function prfSalt(salt) {
+	return (raw, label) => {
+		const value = requireCanonicalBytesB64u(raw, salt.length, label);
+		if (value !== base64UrlEncode(salt)) throw new Error(`${label} is unsupported`);
+		return value;
 	};
 }
-function parseRecoveryExcludeCredentials(raw) {
-	if (!Array.isArray(raw)) throw new Error("walletRecoveryPrepare.registration.excludeCredentials is invalid");
-	return raw.map((entry, index) => {
-		const descriptor = decodeExactJsonObject(entry, ["type", "id"], `walletRecoveryPrepare.registration.excludeCredentials[${index}]`);
-		if (readJsonField(descriptor, "type") !== "public-key") throw new Error("walletRecoveryPrepare.registration.excludeCredentials type is invalid");
-		const parsedId = parseWebAuthnCredentialIdB64u(readJsonField(descriptor, "id"));
-		if (!parsedId.ok) throw new Error("walletRecoveryPrepare.registration.excludeCredentials id is invalid");
-		requireCanonicalNonEmptyB64u(parsedId.value, "registration.excludeCredentials.id");
-		return {
-			type: "public-key",
-			id: parsedId.value
-		};
-	});
-}
 function recoveryTargetsMatch(left, right) {
 	if (left.kind !== right.kind) return false;
 	switch (left.kind) {
@@ -301,18 +257,12 @@ function recoveryTargetsMatch(left, right) {
 function assertNeverRecoveryTarget(value) {
 	throw new Error(`unsupported wallet recovery target: ${String(value)}`);
 }
-const PREPARED_WRAP_FIELDS = [
-	"nonceB64u",
-	"wrappedManifestKekB64u",
-	"aadHashB64u"
-];
-function parsePreparedRecoveryWrap(raw) {
-	const wrap = decodeExactJsonObject(raw, PREPARED_WRAP_FIELDS, "walletRecoveryPrepare.wrap");
-	return {
-		nonceB64u: parseEnvelopeNonceB64u(readJsonField(wrap, "nonceB64u"), "walletRecoveryPrepare.wrap.nonceB64u"),
-		wrappedManifestKekB64u: parseEnvelopeCiphertextB64u(readJsonField(wrap, "wrappedManifestKekB64u"), "walletRecoveryPrepare.wrap.wrappedManifestKekB64u"),
-		aadHashB64u: parseDigestField(readJsonField(wrap, "aadHashB64u"), "walletRecoveryPrepare.wrap.aadHashB64u")
-	};
+function preparedRecoveryWrap() {
+	return wireObject({
+		nonceB64u: parseEnvelopeNonceB64u,
+		wrappedManifestKekB64u: parseEnvelopeCiphertextB64u,
+		aadHashB64u: parseDigestField
+	});
 }
 function parsePreparedRecoveryEntries(raw) {
 	if (!Array.isArray(raw) || raw.length !== 1) throw new Error("walletRecoveryPrepare.entries must contain exactly one custody seed");
@@ -474,7 +424,7 @@ function parseWalletRecoveryPreparationEcdsaRecoveryBasis(raw, expectedWalletId)
 function parseWalletRecoveryEcdsaChainTargets(raw) {
 	if (!Array.isArray(raw) || raw.length === 0) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are invalid");
 	const targets = raw.map((value, index) => parseWalletRecoveryEcdsaChainTarget(value, index));
-	if (new Set(targets.map(walletRecoveryEcdsaChainTargetKey)).size !== targets.length) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are duplicated");
+	if (new Set(targets.map(thresholdEcdsaChainTargetKey)).size !== targets.length) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are duplicated");
 	const first = targets[0];
 	if (!first) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are invalid");
 	return [first, ...targets.slice(1)];
@@ -514,9 +464,6 @@ function parseWalletRecoveryEcdsaChainTarget(raw, index) {
 	};
 	throw new Error("walletRecoveryPrepare ECDSA recovery chain family is invalid");
 }
-function walletRecoveryEcdsaChainTargetKey(target) {
-	return target.kind === "evm" ? `evm:eip155:${target.chainId}` : `tempo:${target.chainId}`;
-}
 function parseWalletRecoveryEcdsaParticipantIds(raw) {
 	if (!Array.isArray(raw) || raw.length !== 2 || raw[0] !== 1 || raw[1] !== 2) throw new Error("walletRecoveryPrepare ECDSA recovery participant IDs are invalid");
 	return [1, 2];

package/dist/esm/core/rpcClients/relayer/walletRegistration.js

@@ -1,7 +1,7 @@
 import { parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildBearerAuthorizationHeader, buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { thresholdEcdsaChainTargetsEqual } from "../../signingEngine/interfaces/ecdsaChainTarget.js";
 import { normalizeThresholdRuntimePolicyScope } from "../../signingEngine/threshold/sessionPolicy.js";
@@ -17,9 +17,11 @@ import { parseWalletAuthorityV1 } from "../../../shared-ts/src/authorization/wal
 import { parseWebAuthnAuthenticatorDeviceInfo } from "../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeRegistrationIntentDigestB64u, parseAddAuthMethodIntentV1, parseAddSignerIntentV1, sameAddAuthMethodIntentV1, sameAddSignerIntentV1 } from "../../../shared-ts/src/utils/registrationIntent.js";
+import { registrationSetupRepository, registrationSetupScopeDigest } from "../../indexedDB/seamsWalletDB/registrationSetup.js";
 import { parseRegistrationEstablishedSessionResultV2 } from "../../../shared-ts/src/utils/registrationEstablishedSession.js";
 import { parseThresholdEcdsaKeyIdentityTargets } from "../../signingEngine/session/passkey/ecdsaKeyFactsInventory.js";
 import { parseThresholdEcdsaDerivationRoleLocalBootstrapValue } from "./thresholdEcdsa.js";
+import { WALLET_MANAGEMENT_PROTOCOL_HEADER } from "../../../shared-ts/src/utils/walletManagementProtocol.js";
 import { parseWalletAddSignerChainTarget, parseWalletAddSignerEcdsaWalletKey, parseWalletEd25519YaoSignerPublicResult, parseWalletRegistrationFinalizeAuthority, parseWalletRegistrationFinalizeAuthorityBranch, parseWalletRegistrationFinalizeDiagnostics, parseWalletRegistrationFinalizeResponse, requireResponseParticipantPair, requireResponseRpId, requireResponseSafeInteger, requireResponseString } from "./walletRegistrationTerminalResponse.js";
 //#region src/core/rpcClients/relayer/walletRegistration.ts
 /**
@@ -109,7 +111,10 @@ async function postJson(args) {
 	const maxAttempts = walletRegistrationPostMaxAttempts(args.path);
 	for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
 		const response = await fetch(`${normalizeRelayerBaseUrl(args.relayerUrl, { trim: false })}${args.path}`, buildRelayerJsonPostRequestInit({
-			headers: args.headers,
+			headers: {
+				...args.headers,
+				[WALLET_MANAGEMENT_PROTOCOL_HEADER]: "2"
+			},
 			body: args.body,
 			bodyJson: requestBody
 		}));
@@ -1166,6 +1171,7 @@ function normalizeWalletRegistrationSetupRequestForBinding(request) {
 	const signerSelection = registrationSignerSetSelectionFromPlan(signerPlan.value, { normalizeEcdsaChainTarget: normalizeWalletRegistrationSetupEcdsaChainTarget });
 	if (!signerSelection.ok) throw new Error(`Wallet registration setup request signerSelection is invalid: ${signerSelection.message}`);
 	return {
+		wallet: request.wallet ?? { kind: "server_allocated" },
 		authMethod,
 		signerSelection: signerSelection.value
 	};
@@ -1475,14 +1481,6 @@ function parseWalletEcdsaKeyFactsInventoryResponse(args) {
 		diagnostics: readWalletRegistrationResponseField(response, "diagnostics", responseName)
 	};
 }
-/**
-* `POST /wallets/register/setup` — the single admitted entry point replacing
-* the grant, intent, and start calls below.
-*
-* It is called *before* the WebAuthn create prompt, because its response
-* carries the challenge that create must sign. The server-side preparation
-* therefore overlaps the user's authenticator interaction.
-*/
 async function setupWalletRegistration(args) {
 	const publishableKey = String(args.auth?.publishableKey || "").trim();
 	const environmentId = String(args.auth?.environmentId || "").trim();
@@ -1491,7 +1489,13 @@ async function setupWalletRegistration(args) {
 		code: "invalid_body",
 		message: "registration setup requires a publishable key and environment id"
 	};
-	const normalizedRequest = normalizeWalletRegistrationSetupRequestForBinding(args.request);
+	const request = normalizeWalletRegistrationSetupRequestForBinding(args.request);
+	const scopeDigest = await registrationSetupScopeDigest({
+		relayerUrl: args.relayerUrl,
+		publishableKey,
+		environmentId
+	});
+	const attempt = await registrationSetupRepository.begin(scopeDigest, request);
 	const parsed = parseWalletRegistrationSetupResponseV2(await postJson({
 		relayerUrl: args.relayerUrl,
 		path: WALLET_REGISTRATION_SETUP_PATH,
@@ -1501,9 +1505,10 @@ async function setupWalletRegistration(args) {
 			[ROUTER_API_ENVIRONMENT_ID_HEADER]: environmentId
 		},
 		body: {
-			...args.request.wallet ? { wallet: args.request.wallet } : {},
-			signerSelection: normalizedRequest.signerSelection,
-			authMethod: normalizedRequest.authMethod
+			registrationOperationId: attempt.operationId,
+			wallet: request.wallet,
+			signerSelection: request.signerSelection,
+			authMethod: request.authMethod
 		},
 		...args.onServerTiming ? { onServerTiming: args.onServerTiming } : {}
 	}));
@@ -1511,8 +1516,9 @@ async function setupWalletRegistration(args) {
 	await assertWalletRegistrationSetupRequestBindings({
 		response: parsed,
 		...args.request.wallet ? { requestedWallet: args.request.wallet } : {},
-		request: normalizedRequest
+		request
 	});
+	await registrationSetupRepository.accept(attempt, parsed);
 	return parsed;
 }
 async function createWalletAddSignerIntent(args) {

package/dist/esm/core/rpcClients/relayer/walletRegistrationTerminalResponse.js

@@ -1,8 +1,8 @@
 import { parseThresholdEd25519SessionId, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { requireRouterAbEd25519NormalSigningState } from "../../../shared-ts/src/utils/signingSessionSeal.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { parseNearEd25519SigningKeyId, walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey } from "../../signingEngine/interfaces/ecdsaChainTarget.js";
 import { normalizeThresholdRuntimePolicyScope } from "../../signingEngine/threshold/sessionPolicy.js";
@@ -639,7 +639,6 @@ function parseWalletRegistrationFinalizeResponse(args) {
 			if (response.ecdsa !== void 0) throw new Error(`${responseName} response mixed signer branches`);
 			const near = parseWalletRegistrationFinalizeNearResult({
 				response,
-				walletId,
 				authority
 			});
 			if (authorityBranch.kind === "passkey") return {

package/dist/esm/core/signingEngine/assembly/createManagers.js

@@ -12,7 +12,7 @@ import { getWorkerTransport } from "../workerManager/workerTransport.js";
 import { UserPreferencesManager } from "../session/userPreferences.js";
 //#region src/core/signingEngine/assembly/createManagers.ts
 function createManagerAssembly(args) {
-	const touchIdPrompt = new TouchIdPrompt(args.seamsWebConfigs.wallet.iframe?.rpIdOverride, true);
+	const touchIdPrompt = new TouchIdPrompt(args.seamsWebConfigs.wallet.iframe?.rpIdOverride);
 	const userPreferencesManager = new UserPreferencesManager({ store: args.stores.userPreferencesStore });
 	const chains = args.seamsWebConfigs.network.chains;
 	const nonceCoordinator = createNonceCoordinator({

package/dist/esm/core/signingEngine/assembly/ports/recovery.js

@@ -26,7 +26,7 @@ function createRecoveryPublicDeps(args) {
 			}, {
 				...completeConfiguredEcdsaTargets(availableLanesArgs),
 				requiredEcdsaCapability: "export_keys"
-			}, new WalletSessionStatusReadScope()),
+			}, new WalletSessionStatusReadScope(), "all"),
 			readOwnerScopedAvailableSigningLanesForTargets: async (availableLanesArgs) => await readOwnerScopedAvailableSigningLanes({
 				activeWalletAuthorityEcdsaRuntimeReadPorts: browserExactWalletSessionReadPorts,
 				ed25519YaoPublicCapabilityLanes: args.ed25519YaoPublicCapabilityLanes,

package/dist/esm/core/signingEngine/assembly/ports/shared.js

@@ -1,6 +1,6 @@
 import { resolvePrimaryNearRpcUrl } from "../../../config/chains.js";
 import { loadSecp256k1EngineCtor, loadSignEvmFamilyWithUiConfirmForTempo, loadSignEvmWithUiConfirm, loadWebAuthnP256EngineCtor } from "../../flows/signEvmFamily/signerLoader.js";
-import { prewarmSignerWorkers, warmCriticalResources } from "../warmup.js";
+import { warmCriticalResources } from "../warmup.js";
 //#region src/core/signingEngine/assembly/ports/shared.ts
 function resolveNearRpcUrl(args) {
 	return resolvePrimaryNearRpcUrl(args.seamsWebConfigs.network.chains);
@@ -30,7 +30,6 @@ function createManagerConveniencePortsFactory(args) {
 	const { createArgs, getWorkerResourceWarmupDeps } = args;
 	return () => ({
 		signTempo: createArgs.signTempo,
-		prewarmSignerWorkers: () => prewarmSignerWorkers(getWorkerResourceWarmupDeps()),
 		warmCriticalResources: (accountContext) => warmCriticalResources(getWorkerResourceWarmupDeps(), accountContext)
 	});
 }

package/dist/esm/core/signingEngine/assembly/warmup.js

@@ -26,10 +26,6 @@ async function resolveWarmupSignerSlot(accountId, store) {
 		return null;
 	}
 }
-function prewarmSignerWorkers(deps) {
-	if (!shouldPrewarmWorkers(deps)) return;
-	deps.prewarmWorkers().catch(() => {});
-}
 async function warmCriticalResources(deps, accountContext = { kind: "none" }) {
 	const accountBinding = accountContext.kind === "near_account_bound" ? accountContext.account : null;
 	const accountId = accountBinding ? toAccountId(accountBinding.nearAccountId) : null;
@@ -63,6 +59,6 @@ async function warmCriticalResources(deps, accountContext = { kind: "none" }) {
 	};
 }
 //#endregion
-export { prewarmSignerWorkers, warmCriticalResources };
+export { warmCriticalResources };
 
 //# sourceMappingURL=warmup.js.map

package/dist/esm/core/signingEngine/chains/evm/display/functionSelectors.js

@@ -38,9 +38,6 @@ const KNOWN_CONTRACT_FUNCTION_SIGNATURES = Object.freeze({
 		"0xcfae3217": "greet()"
 	})
 });
-function normalizeSelector(selector) {
-	return normalizeHexSelector(selector);
-}
 function normalizeContractAddress(contractAddress) {
 	const normalized = String(contractAddress || "").trim().toLowerCase();
 	if (!EVM_ADDRESS_RE.test(normalized)) return void 0;
@@ -50,7 +47,7 @@ function selectorFromHexData(data) {
 	return deriveSelectorFromHexData(data);
 }
 function resolveFunctionSignature(selector, contractAddress) {
-	const normalized = normalizeSelector(selector);
+	const normalized = normalizeHexSelector(selector);
 	if (!normalized) return void 0;
 	const normalizedContractAddress = normalizeContractAddress(contractAddress);
 	if (normalizedContractAddress) {
@@ -66,7 +63,7 @@ function resolveFunctionDisplayName(selector, contractAddress) {
 		const normalizedName = (idx > 0 ? signature.slice(0, idx) : signature).trim();
 		if (normalizedName) return `${normalizedName}()`;
 	}
-	const normalizedSelector = normalizeSelector(selector);
+	const normalizedSelector = normalizeHexSelector(selector);
 	if (normalizedSelector) return `function ${normalizedSelector}`;
 }
 //#endregion

package/dist/esm/core/signingEngine/chains/near/nearSignerWasm.js

@@ -1,5 +1,5 @@
 import { executeWorkerOperation } from "../../workerManager/executeWorkerOperation.js";
-import { NearSignerWorkerCustomRequestType, WorkerRequestType, WorkerResponseType } from "../../../types/signer-worker.js";
+import { NearSignerWorkerCustomRequestType } from "../../../types/signer-worker.js";
 //#region src/core/signingEngine/chains/near/nearSignerWasm.ts
 const NEAR_SIGNER_WORKER_TIMEOUT_MS = 2e4;
 async function computeThresholdEd25519Nep413SigningDigestWasm(args) {
@@ -133,38 +133,7 @@ function requireThresholdEd25519DecodeSignedNearTxBorshResult(value) {
 	if (!parsed?.signedTransaction?.transaction || !parsed.signedTransaction.signature || !parsed.signedTransaction.borshBytes || !parsed.transactionHash) throw new Error("near signer worker returned invalid Ed25519 signed tx decode result");
 	return parsed;
 }
-async function deriveThresholdEd25519ClientVerifyingShareWasm(args) {
-	const sessionId = String(args.sessionId || "").trim();
-	const nearAccountId = String(args.nearAccountId || "").trim();
-	const prfFirstB64u = String(args.prfFirstB64u || "").trim();
-	const wrapKeySalt = String(args.wrapKeySalt || "").trim();
-	if (!sessionId) throw new Error("Missing sessionId");
-	if (!nearAccountId) throw new Error("Missing nearAccountId");
-	if (!prfFirstB64u || !wrapKeySalt) throw new Error("Missing PRF.first or wrapKeySalt for share derivation");
-	const response = await executeWorkerOperation({
-		ctx: args.workerCtx,
-		kind: "nearSigner",
-		request: {
-			type: WorkerRequestType.DeriveThresholdEd25519ClientVerifyingShare,
-			timeoutMs: NEAR_SIGNER_WORKER_TIMEOUT_MS,
-			payload: {
-				sessionId,
-				nearAccountId,
-				prfFirstB64u,
-				wrapKeySalt
-			}
-		}
-	});
-	if (response.type !== WorkerResponseType.DeriveThresholdEd25519ClientVerifyingShareSuccess) throw new Error("DeriveThresholdEd25519ClientVerifyingShare failed");
-	const wasmResult = response.payload;
-	const clientVerifyingShareB64u = String(wasmResult?.clientVerifyingShareB64u || "").trim();
-	if (!clientVerifyingShareB64u) throw new Error("Missing clientVerifyingShareB64u in worker response");
-	return {
-		nearAccountId,
-		clientVerifyingShareB64u
-	};
-}
 //#endregion
-export { buildThresholdEd25519DelegateSigningPayloadWasm, buildThresholdEd25519NearTxUnsignedBorshWasm, computeThresholdEd25519DelegateSigningDigestWasm, computeThresholdEd25519Nep413SigningDigestWasm, decodeThresholdEd25519SignedNearTxBorshWasm, deriveThresholdEd25519ClientVerifyingShareWasm, finalizeThresholdEd25519DelegateFromSignatureWasm, finalizeThresholdEd25519NearTxFromSignatureWasm };
+export { buildThresholdEd25519DelegateSigningPayloadWasm, buildThresholdEd25519NearTxUnsignedBorshWasm, computeThresholdEd25519DelegateSigningDigestWasm, computeThresholdEd25519Nep413SigningDigestWasm, decodeThresholdEd25519SignedNearTxBorshWasm, finalizeThresholdEd25519DelegateFromSignatureWasm, finalizeThresholdEd25519NearTxFromSignatureWasm };
 
 //# sourceMappingURL=nearSignerWasm.js.map

package/dist/esm/core/signingEngine/flows/recovery/ecdsaDerivationExport.js

@@ -2,7 +2,6 @@ import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import "../../../../shared-ts/src/utils/encoders.js";
 import { SigningSessionIds } from "../../session/operationState/types.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { closeRouterAbEcdsaPostRegistrationCeremonyWasm, createEcdsaHolderOrdinaryExportRequestWasm, createRouterAbEcdsaPostRegistrationCeremonyWasm, finalizeEcdsaHolderOrdinaryExportWasm, finalizeRouterAbEcdsaExplicitExportWasm } from "../../threshold/crypto/ecdsaDerivationClientWasm.js";

package/dist/esm/core/signingEngine/flows/recovery/ecdsaExportFlow.js

@@ -7,7 +7,7 @@ import { thresholdEcdsaChainTargetKey, walletSessionRefFromSession } from "../..
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { sameRouterAbEcdsaDerivationNormalSigningStateV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
-import { resolveThresholdEcdsaSigningQueueKey } from "../../threshold/ecdsa/signingQueue.js";
+import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
 import { issueEcdsaOperationStepUpAuthorization, prepareEcdsaOperationStepUp } from "../../threshold/ecdsa/operationStepUp.js";
 import { resolveActiveWalletAuthorityEcdsaRuntimeV1 } from "../../session/material/activeWalletAuthorityEcdsaRuntime.js";
 import { ecdsaExportBoundaryChain, resolveEcdsaExportMaterialForLane, resolveFreshEmailOtpEcdsaExportMaterialForLane } from "./ecdsaExportMaterial.js";
@@ -107,7 +107,7 @@ async function prepareAndShowEcdsaExportArtifact(deps, args) {
 		});
 		const materialActivation = args.exportLane.laneIdentity.signer.materialActivation;
 		const artifact = await deps.withThresholdEcdsaSigningQueue({
-			queueKey: resolveThresholdEcdsaSigningQueueKey({ materialActivation }),
+			queueKey: resolveThresholdCommitQueueKey({ materialActivation }),
 			walletId: args.exportLane.key.walletId,
 			enabled: true,
 			task: async () => {