@seams/wallet 0.7.3 → 0.8.0

package/dist/esm/core/indexedDB/seamsWalletDB/signingSessionSeals.js

@@ -74,25 +74,6 @@ async function collectRawSealedRecordEntriesByThresholdSessionIdFromStore(store,
 	return await collectAllRawSealedRecordEntriesFromStore(store).catch(() => []);
 }
 var SigningSessionSealsRepository = class {
-	async getRawSealedRecordEntry(primaryKey) {
-		const db = await getSigningSessionSealsDb();
-		if (!db) return null;
-		const tx = db.transaction(SIGNING_SESSION_SEALS_STORE_NAME, "readonly");
-		const value = await requestToPromise(tx.objectStore(SIGNING_SESSION_SEALS_STORE_NAME).get(primaryKey));
-		await transactionDone(tx).catch(() => void 0);
-		return value === void 0 ? null : {
-			primaryKey,
-			value
-		};
-	}
-	async collectRawSealedRecordEntriesByEnrollmentId(enrollmentId) {
-		const db = await getSigningSessionSealsDb();
-		if (!db) return [];
-		const tx = db.transaction(SIGNING_SESSION_SEALS_STORE_NAME, "readonly");
-		const entries = await collectIndexedRawSealedRecordEntries(tx.objectStore(SIGNING_SESSION_SEALS_STORE_NAME).index(SEAMS_WALLET_INDEXES.enrollmentId), enrollmentId);
-		await transactionDone(tx).catch(() => void 0);
-		return entries;
-	}
 	async collectAllRawSealedRecordEntries() {
 		const db = await getSigningSessionSealsDb();
 		if (!db) return [];
@@ -109,14 +90,6 @@ var SigningSessionSealsRepository = class {
 		await transactionDone(tx).catch(() => void 0);
 		return entries;
 	}
-	async putSealedRecord(row) {
-		const db = await getSigningSessionSealsDb();
-		if (!db) return false;
-		const tx = db.transaction(SIGNING_SESSION_SEALS_STORE_NAME, "readwrite");
-		tx.objectStore(SIGNING_SESSION_SEALS_STORE_NAME).put(row);
-		await transactionDone(tx);
-		return true;
-	}
 	async replaceSealedRecord(args) {
 		const db = await getSigningSessionSealsDb();
 		if (!db) return;
@@ -189,14 +162,6 @@ var SigningSessionSealsRepository = class {
 			return null;
 		}
 	}
-	async clearAll() {
-		const db = await getSigningSessionSealsDb();
-		if (!db) return;
-		const tx = db.transaction([SIGNING_SESSION_SEALS_STORE_NAME, SIGNING_SESSION_RESTORE_LEASES_STORE_NAME], "readwrite");
-		tx.objectStore(SIGNING_SESSION_SEALS_STORE_NAME).clear();
-		tx.objectStore(SIGNING_SESSION_RESTORE_LEASES_STORE_NAME).clear();
-		await transactionDone(tx).catch(() => void 0);
-	}
 };
 const signingSessionSealsRepository = new SigningSessionSealsRepository();
 //#endregion

package/dist/esm/core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js

@@ -2,21 +2,21 @@ import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/dom
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u, parseIsoTimestamp } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { parseEcdsaCapabilityManifestId, parseEcdsaCapabilityManifestRevision, parseEvmFamilyEcdsaSignerId } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
-import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { buildVerifiedEcdsaPublicFacts, toEvmFamilyEcdsaKeyHandle, toParticipantId } from "../../signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
 import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { parseEcdsaKeyHandle, parseEcdsaRelayerKeyId } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRoleLocalBindingDigest, parseEcdsaRoleLocalDurableMaterialRef, parseEcdsaThresholdKeyId } from "../../signingEngine/session/keyMaterialBrands.js";
 import { parseWalletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseEcdsaCapabilityManifestId, parseEcdsaCapabilityManifestRevision, parseEvmFamilyEcdsaSignerId } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
 import { parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { seamsWalletDB } from "../singletons.js";
-import { SeamsWalletRepositories } from "./repositories.js";
 import { buildEcdsaRoleLocalPublicFacts } from "../../signingEngine/session/persistence/ecdsaRoleLocalRecords.js";
 import { buildEcdsaActivationBinding, buildEcdsaCapabilityScope, buildEcdsaManifestIdentity, buildEcdsaRoleLocalMaterialBinding, buildPreparedEvmFamilySigner } from "../../signingEngine/session/material/ecdsaCapabilityManifest.js";
+import { seamsWalletDB } from "../singletons.js";
 import { ecdsaRegisteredPublicFactsMatch, ecdsaRoleLocalMaterialBindingsMatch, ecdsaRoleLocalPublicFactsMatch } from "./ecdsaCapabilityManifestRecords.js";
 import { IndexedDbEcdsaCapabilityManifestStore, importCommittedActivation, prepareImportedWalletCustodyEcdsaContinuity } from "./ecdsaCapabilityManifestStore.js";
+import { SeamsWalletRepositories } from "./repositories.js";
 //#region src/core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.ts
 function buildWalletCustodyEcdsaContinuityImportInput(input) {
 	const authority = parseWalletAuthAuthorityRef(input.authority);

package/dist/esm/core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js

@@ -1,7 +1,7 @@
 import { parseMpcMaterialActivationRef, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
+import { activeWalletSessionV1RecordsEqual, parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { SEAMS_WALLET_INDEXES, SEAMS_WALLET_STORES } from "../schemaNames.js";
 import { seamsWalletDB } from "../singletons.js";
 //#region src/core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.ts
@@ -253,23 +253,6 @@ function parseExactWalletSessionRecord(value) {
 	}
 	return null;
 }
-function buildActiveWalletSessionV1(input) {
-	const record = parseExactWalletSessionRecord({
-		kind: "active_wallet_session_v1",
-		walletId: input.walletId,
-		authorityId: input.authorityId,
-		authMethodId: input.authMethodId,
-		authorizationId: input.authorizationId,
-		quotaId: input.quotaId,
-		authorityDigestB64u: input.authorityDigestB64u,
-		authorityRevocationEpoch: input.authorityRevocationEpoch,
-		capabilitySubjects: input.capabilitySubjects,
-		issuedAtMs: input.issuedAtMs,
-		expiresAtMs: input.expiresAtMs
-	});
-	if (!record || record.kind !== "active_wallet_session_v1") throw new Error("Active Wallet Session v1 is invalid");
-	return record;
-}
 function retireWalletSessionV1(args) {
 	if (!isNonNegativeSafeInteger(args.retiredAtMs)) throw new Error("Retired Wallet Session v1 time is invalid");
 	const record = parseExactWalletSessionRecord({
@@ -438,6 +421,41 @@ var WalletSessionAuthorizationRepository = class {
 		});
 		return parsed;
 	}
+	async refreshExactWithOperationCredential(input) {
+		const expected = parseExactWalletSessionRecord(input.expected);
+		const incoming = parseExactWalletSessionRecord(input.record);
+		if (!expected || expected.kind !== "active_wallet_session_v1" || !incoming || incoming.kind !== "active_wallet_session_v1") throw new Error("Active Wallet Session refresh is invalid");
+		for (const field of EXACT_ACTIVE_FIELDS) {
+			if (field === "kind" || field === "capabilitySubjects") continue;
+			if (expected[field] !== incoming[field]) throw new Error("Wallet Session refresh changed its exact identity");
+		}
+		const operationCredential = parseWalletSessionOperationCredentialV1(input.operationCredential);
+		const incomingRow = toStoredExactWalletSessionAuthorizationRowV6(incoming, operationCredential);
+		const tx = (await this.manager.getDB()).transaction(STORE, "readwrite");
+		const store = tx.objectStore(STORE);
+		try {
+			const raw = await store.get(operationCredential.walletSessionId);
+			if (raw === void 0) {
+				await tx.done;
+				return "superseded";
+			}
+			const current = parseStoredExactWalletSessionAuthorizationRowV6(raw);
+			if (!current) throw new Error("Stored Wallet Session authorization v6 is corrupt");
+			if (!activeWalletSessionV1RecordsEqual(current.record, expected) || current.operationCredential.token !== operationCredential.token) {
+				await tx.done;
+				return "superseded";
+			}
+			await store.put(incomingRow);
+			await tx.done;
+			return "updated";
+		} catch (error) {
+			try {
+				tx.abort();
+			} catch {}
+			await settleAbortedTransaction(tx);
+			throw error;
+		}
+	}
 	async readExact(walletSessionId) {
 		const tx = (await this.manager.getDB()).transaction(STORE, "readwrite");
 		const store = tx.objectStore(STORE);
@@ -581,6 +599,6 @@ var WalletSessionAuthorizationRepository = class {
 };
 const walletSessionAuthorizations = new WalletSessionAuthorizationRepository();
 //#endregion
-export { WALLET_SESSION_AUTHORIZATION_RECORD_VERSION_V6, WalletSessionAuthorizationRepository, WalletSessionAuthorizationUpgradeRequiredError, buildActiveWalletSessionV1, parseStoredExactWalletSessionAuthorizationRowV6, readExactActiveWalletSessionForScopeInTransaction, replaceExactActiveWalletSessionAuthorizationInTransaction, retireWalletSessionV1, toStoredExactWalletSessionAuthorizationRowV6, walletSessionAuthorizations };
+export { WALLET_SESSION_AUTHORIZATION_RECORD_VERSION_V6, WalletSessionAuthorizationRepository, WalletSessionAuthorizationUpgradeRequiredError, parseStoredExactWalletSessionAuthorizationRowV6, readExactActiveWalletSessionForScopeInTransaction, replaceExactActiveWalletSessionAuthorizationInTransaction, retireWalletSessionV1, toStoredExactWalletSessionAuthorizationRowV6, walletSessionAuthorizations };
 
 //# sourceMappingURL=walletSessionAuthorizationStore.js.map

package/dist/esm/core/indexedDB/unifiedIndexedDBManager.js

@@ -1,9 +1,9 @@
 import { normalizeTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
 import { SIGNER_KINDS } from "../../shared-ts/src/utils/signerDomain.js";
-import { normalizeLastUserScope } from "./normalization.js";
 import { seamsWalletDB } from "./singletons.js";
+import { normalizeLastUserScope } from "./normalization.js";
 import { SeamsWalletRepositories } from "./seamsWalletDB/repositories.js";
+import { RegistrationSetupRepository } from "./seamsWalletDB/registrationSetup.js";
 //#region src/core/indexedDB/unifiedIndexedDBManager.ts
 const DEFAULT_STALE_PENDING_SIGNER_MS = 1440 * 6e4;
 const KEY_MATERIAL_SIGNER_KINDS = new Set(Object.values(SIGNER_KINDS));
@@ -14,6 +14,7 @@ var UnifiedIndexedDBManager = class {
 		this.lastUserScope = null;
 		this.seamsWalletDB = deps?.seamsWalletDB || seamsWalletDB;
 		this.seamsWalletRepositories = new SeamsWalletRepositories(this.seamsWalletDB);
+		this.registrationSetupRepository = new RegistrationSetupRepository(this.seamsWalletDB);
 	}
 	async initialize() {
 		if (this._initialized) return;
@@ -292,7 +293,13 @@ var UnifiedIndexedDBManager = class {
 		return this.seamsWalletRepositories.persistWalletRegistrationFinalize(input);
 	}
 	async publishPendingWalletRegistrationCommit(input) {
-		return this.seamsWalletRepositories.publishPendingWalletRegistrationCommit(input);
+		const result = await this.seamsWalletRepositories.publishPendingWalletRegistrationCommit(input);
+		try {
+			await this.registrationSetupRepository.complete(input.pending);
+		} catch (error) {
+			console.warn("Wallet registration committed; setup journal cleanup remains pending", error);
+		}
+		return result;
 	}
 	async publishPendingWalletRegistrationCommitAndRetain(input) {
 		return this.seamsWalletRepositories.publishPendingWalletRegistrationCommitAndRetain(input);

package/dist/esm/core/indexedDB/walletCustodyEd25519MaterialRecord.js

@@ -1,5 +1,5 @@
-import { base58Encode } from "../../shared-ts/src/utils/base58.js";
 import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
+import { base58Encode } from "../../shared-ts/src/utils/base58.js";
 import { buildEnvelopeAAD } from "./keyMaterialEnvelope.js";
 //#region src/core/indexedDB/walletCustodyEd25519MaterialRecord.ts
 const WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND = "wallet_custody_ed25519_active_client_v1";

package/dist/esm/core/platform/browser/createBrowserPlatformRuntime.js

@@ -5,11 +5,10 @@ import { getPrfFirstB64uFromCredential } from "../../signingEngine/webauthnAuth/
 import { getSignerWorkerOperationCoreCode, getSignerWorkerOperationErrorCode } from "../../signingEngine/workerManager/workerTypes.js";
 import { parseEcdsaRoleLocalBindingDigest, parseEcdsaRoleLocalDurableMaterialRef, parseEcdsaRoleLocalMaterialHandle } from "../../signingEngine/session/keyMaterialBrands.js";
 import { closeRouterAbEcdsaRegistrationCeremonyWasm, createRouterAbEcdsaRegistrationCeremonyWasm, finalizeEcdsaClientBootstrapCommandWasm, finalizeRouterAbEcdsaRegistrationActivationWasm, persistInitialCanonicalEcdsaActivationWasm, prepareEcdsaClientBootstrapCommandWasm, storeEcdsaRoleLocalSigningMaterialWasm, verifyRouterAbEcdsaRegistrationClientProofsWasm } from "../../signingEngine/threshold/crypto/ecdsaDerivationClientWasm.js";
+import { ecdsaRoleLocalReadyRecordMatchesInput, ecdsaRoleLocalReadyRecordStorageKey, parseEcdsaRoleLocalReadyRecord, serializeEcdsaRoleLocalReadyRecord } from "../../signingEngine/session/persistence/ecdsaRoleLocalRecords.js";
 import { errorMessage } from "../../../shared-ts/src/utils/errors.js";
+import { serializeAuthenticationCredentialWithPRF, serializeRegistrationCredentialWithPRF } from "../../signingEngine/webauthnAuth/credentials/helpers.js";
 import { IndexedDBManager } from "../../indexedDB/index.js";
-import { isSerializedRegistrationCredential, serializeAuthenticationCredentialWithPRF, serializeRegistrationCredentialWithPRF } from "../../signingEngine/webauthnAuth/credentials/helpers.js";
-import { WindowParentDomainWebAuthnClient, requestParentDomainWebAuthn } from "../../signingEngine/webauthnAuth/fallbacks/safari-fallbacks.js";
-import { ecdsaRoleLocalReadyRecordMatchesInput, ecdsaRoleLocalReadyRecordStorageKey, parseEcdsaRoleLocalReadyRecord, serializeEcdsaRoleLocalReadyRecord } from "../../signingEngine/session/persistence/ecdsaRoleLocalRecords.js";
 import { parseGeneratedFinalizeEcdsaClientBootstrapOutput, parseGeneratedPrepareEcdsaClientBootstrapOutput, toGeneratedFinalizeEcdsaClientBootstrapCommand, toGeneratedPrepareEcdsaClientBootstrapCommand } from "../signerCoreCommandAdapters.js";
 //#region src/core/platform/browser/createBrowserPlatformRuntime.ts
 function unavailable(message) {
@@ -98,7 +97,6 @@ function mapFinalizeEcdsaCommandError(error) {
 function createBrowserDurableRecordStore(indexedDB) {
 	return {
 		kind: "durable_record_store",
-		indexedDB,
 		async loadEcdsaRoleLocalReadyRecord(input) {
 			const storageKey = ecdsaRoleLocalReadyRecordStorageKey(input);
 			try {
@@ -240,24 +238,9 @@ function requiredPrfSerializationFailure(error) {
 function isPublicKeyCredential(value) {
 	return Boolean(value && typeof value === "object" && "rawId" in value && "response" in value && typeof value.getClientExtensionResults === "function");
 }
-function isCrossOriginIframe() {
-	if (typeof window === "undefined" || window.top === window) return false;
-	try {
-		return window.top?.location.origin !== window.location.origin;
-	} catch {
-		return true;
-	}
-}
 async function runBrowserCredentialOperation(kind, publicKey, credentials) {
-	if (!isCrossOriginIframe()) return kind === "create" ? credentials.create({ publicKey }) : credentials.get({ publicKey });
-	const result = await requestParentDomainWebAuthn(kind, publicKey, new WindowParentDomainWebAuthnClient(), publicKey.timeout ?? 6e4);
-	if (result.ok) return result.credential;
-	throw new DOMException(result.error || "Passkey verification was cancelled", "NotAllowedError");
-}
-function isSerializedAuthenticationCredential(value) {
-	if (!value || typeof value !== "object") return false;
-	const response = value.response;
-	return Boolean(response && typeof response === "object" && typeof response.authenticatorData === "string");
+	if (kind === "create") return credentials.create({ publicKey });
+	return credentials.get({ publicKey });
 }
 function createBrowserAuthenticatorPort(credentials) {
 	return {
@@ -273,14 +256,14 @@ function createBrowserAuthenticatorPort(credentials) {
 					case "create_passkey": {
 						const registrationOptions = operation.registrationOptions;
 						const credential = await runBrowserCredentialOperation("create", browserPasskeyCreationOptions(registrationOptions), credentials);
-						if (!isPublicKeyCredential(credential) && !isSerializedRegistrationCredential(credential)) return {
+						if (!isPublicKeyCredential(credential)) return {
 							ok: false,
 							code: "invalid_credential",
 							message: "Passkey creation returned an invalid credential"
 						};
 						let serialized;
 						try {
-							serialized = isSerializedRegistrationCredential(credential) ? credential : serializeRegistrationCredentialWithPRF({ credential });
+							serialized = serializeRegistrationCredentialWithPRF({ credential });
 						} catch (error) {
 							if (operation.requirePrfFirst) {
 								const prfFailure = requiredPrfSerializationFailure(error);
@@ -331,14 +314,14 @@ function createBrowserAuthenticatorPort(credentials) {
 							userVerification: "preferred",
 							extensions: prfExtensionInput()
 						}, credentials);
-						if (!isPublicKeyCredential(credential) && !isSerializedAuthenticationCredential(credential)) return {
+						if (!isPublicKeyCredential(credential)) return {
 							ok: false,
 							code: "invalid_credential",
 							message: "Passkey assertion returned an invalid credential"
 						};
 						let serialized;
 						try {
-							serialized = isSerializedAuthenticationCredential(credential) ? credential : serializeAuthenticationCredentialWithPRF({ credential });
+							serialized = serializeAuthenticationCredentialWithPRF({ credential });
 						} catch (error) {
 							if (operation.requirePrfFirst) {
 								const prfFailure = requiredPrfSerializationFailure(error);

package/dist/esm/core/rpcClients/near/rpcCalls.js

@@ -16,6 +16,44 @@ import { parseWalletSessionAlreadyCommittedResponseV1, parseWalletUnlockAlreadyC
 import "../../../shared-ts/src/authorization/index.js";
 import { parseEd25519YaoRecoveryCapabilityV1 } from "../../signingEngine/session/passkey/ed25519YaoRecoveryCapability.js";
 //#region src/core/rpcClients/near/rpcCalls.ts
+function sleep(ms) {
+	return new Promise((res) => setTimeout(res, ms));
+}
+/**
+* Best-effort on-chain account existence check.
+*
+* Used to short-circuit UX flows (e.g. registration) before prompting the user.
+* Returns `false` on unknown/non-deterministic failures so that downstream flows
+* can rely on the Router API/contract for final enforcement.
+*/
+async function checkNearAccountExistsBestEffort(nearClient, nearAccountId, opts) {
+	const isNotFound = (m) => /does not exist|UNKNOWN_ACCOUNT|unknown\s+account/i.test(m);
+	const isRetryable = (m) => /server error|internal|temporar|timeout|too many requests|429|empty response|rpc request failed|failed to fetch/i.test(m);
+	const attempts = Math.max(1, Math.floor(opts?.attempts ?? 2));
+	const baseDelayMs = Math.max(50, Math.floor(opts?.delayMs ?? 150));
+	for (let i = 1; i <= attempts; i++) try {
+		await nearClient.viewAccount(nearAccountId);
+		return true;
+	} catch (err) {
+		const msg = errorMessage(err);
+		const details = err && typeof err === "object" && "details" in err ? err.details : void 0;
+		let detailsBlob = "";
+		if (details) try {
+			detailsBlob = typeof details === "string" ? details : JSON.stringify(details);
+		} catch {
+			detailsBlob = "";
+		}
+		const combined = `${msg}\n${detailsBlob}`.trim();
+		if (isNotFound(combined)) return false;
+		if (isRetryable(combined) && i < attempts) {
+			await sleep(baseDelayMs * Math.pow(2, i - 1));
+			continue;
+		}
+		console.warn(`[rpcCalls] Account existence check failed for '${nearAccountId}'; continuing:`, err);
+		return false;
+	}
+	return false;
+}
 function parsePasskeyWalletCustodyUnlockV1(raw) {
 	if (!isObject(raw) || raw.kind !== "wallet_custody_passkey_login_v1") throw new Error("Passkey wallet unlock returned invalid custody data");
 	if (!isObject(raw.ed25519)) throw new Error("Passkey wallet unlock omitted Ed25519 custody continuity");
@@ -333,6 +371,6 @@ async function verifyPasskeyWalletUnlock(relayServerUrl, input, statusReads) {
 	}
 }
 //#endregion
-export { verifyPasskeyWalletUnlock };
+export { checkNearAccountExistsBestEffort, verifyPasskeyWalletUnlock };
 
 //# sourceMappingURL=rpcCalls.js.map

package/dist/esm/core/rpcClients/relayer/passkeyCustodyEnvelope.js

@@ -36,11 +36,9 @@ async function fetchPasskeyCustodyEnvelope(args) {
 	}
 	const bodyUnknown = await response.json().catch(() => void 0);
 	if (response.status === 200 && responseDeclaresSuccess(bodyUnknown)) try {
-		const body = decodePasskeyCustodyEnvelopeResponse(bodyUnknown);
 		return {
 			kind: "active",
-			envelope: body.envelope,
-			storeVersion: body.storeVersion
+			envelope: decodePasskeyCustodyEnvelopeResponse(bodyUnknown).envelope
 		};
 	} catch {
 		return {
@@ -63,7 +61,6 @@ async function fetchPasskeyCustodyEnvelope(args) {
 		case 401:
 		case 403: return {
 			kind: "credential_rejected",
-			code: code || "credential_rejected",
 			message: message || "this credential does not open the wallet"
 		};
 		case 500:
@@ -77,7 +74,6 @@ async function fetchPasskeyCustodyEnvelope(args) {
 			};
 		default: return {
 			kind: "request_rejected",
-			code: code || "invalid_request",
 			message: message || `custody envelope request rejected (HTTP ${response.status})`
 		};
 	}
@@ -106,22 +102,16 @@ async function upgradeWalletCustodyEnvelopeOwnership(args) {
 		if (body.kind === "already_owned") return body;
 		const envelopeRevision = Number(body.envelopeRevision);
 		if (!Number.isSafeInteger(envelopeRevision) || envelopeRevision <= 0) throw new Error("invalid envelope revision");
-		return {
-			kind: "upgraded",
-			envelopeRevision
-		};
+		return { kind: "upgraded" };
 	} catch {
 		return {
 			kind: "rejected",
-			code: "invalid_response",
 			message: "custody envelope upgrade returned an invalid response"
 		};
 	}
-	const failure = decodeFailureResponse(bodyUnknown, "custody envelope upgrade response");
 	return {
 		kind: "rejected",
-		code: failure.code || "upgrade_rejected",
-		message: failure.message || `custody envelope upgrade rejected (HTTP ${response.status})`
+		message: decodeFailureResponse(bodyUnknown, "custody envelope upgrade response").message || `custody envelope upgrade rejected (HTTP ${response.status})`
 	};
 }
 function decodePasskeyCustodyEnvelopeResponse(value) {

package/dist/esm/core/rpcClients/relayer/thresholdEcdsa.js

@@ -56,7 +56,6 @@ const NON_EXPORT_BOOTSTRAP_RESPONSE_FIELDS = [
 	"publicIdentity",
 	"clientShareRetryCounter",
 	"relayerShareRetryCounter",
-	"publicTranscriptDigest32B64u",
 	"keyHandle",
 	"signingRootId",
 	"signingRootVersion",
@@ -116,7 +115,6 @@ function parseThresholdEcdsaDerivationRoleLocalBootstrapValue(value) {
 		publicIdentity,
 		clientShareRetryCounter,
 		relayerShareRetryCounter,
-		publicTranscriptDigest32B64u: requireNonEmptyString(readJsonField(record, "publicTranscriptDigest32B64u", "value.publicTranscriptDigest32B64u"), "publicTranscriptDigest32B64u"),
 		keyHandle,
 		signingRootId,
 		signingRootVersion,

package/dist/esm/core/rpcClients/relayer/walletRecoveryPrepare.js

@@ -6,15 +6,14 @@ import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/b
 import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseUnixMs } from "../../../shared-ts/src/passkey-custody/primitives.js";
 import { buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
 import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../shared-ts/src/utils/signingSessionSeal.js";
-import "../../../shared-ts/src/utils/encoders.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { parseEcdsaServerGeneration } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
 import { requireEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
-import { ecdsaClientRootPublicKey33B64uFromString, parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion, parseSdkEcdsaDerivationThresholdKeyId } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import "../../../shared-ts/src/signing-lanes/index.js";
-import { parseRecoveryCodeReservationId } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
 import { parseRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { parseRecoveryCodeReservationId } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
+import { ecdsaClientRootPublicKey33B64uFromString, parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion, parseSdkEcdsaDerivationThresholdKeyId } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import { parseEcdsaServerGeneration } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
 import { parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { parseWalletRecoveryEcdsaPossessionChallengeV1 } from "../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.js";
 import { thresholdEcdsaChainTargetKey } from "../../../shared-ts/src/utils/thresholdEcdsaChainTarget.js";

package/dist/esm/core/rpcClients/relayer/walletRegistration.js

@@ -1,7 +1,7 @@
 import { parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildBearerAuthorizationHeader, buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { thresholdEcdsaChainTargetsEqual } from "../../signingEngine/interfaces/ecdsaChainTarget.js";
 import { normalizeThresholdRuntimePolicyScope } from "../../signingEngine/threshold/sessionPolicy.js";
@@ -17,9 +17,11 @@ import { parseWalletAuthorityV1 } from "../../../shared-ts/src/authorization/wal
 import { parseWebAuthnAuthenticatorDeviceInfo } from "../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeRegistrationIntentDigestB64u, parseAddAuthMethodIntentV1, parseAddSignerIntentV1, sameAddAuthMethodIntentV1, sameAddSignerIntentV1 } from "../../../shared-ts/src/utils/registrationIntent.js";
+import { registrationSetupRepository, registrationSetupScopeDigest } from "../../indexedDB/seamsWalletDB/registrationSetup.js";
 import { parseRegistrationEstablishedSessionResultV2 } from "../../../shared-ts/src/utils/registrationEstablishedSession.js";
 import { parseThresholdEcdsaKeyIdentityTargets } from "../../signingEngine/session/passkey/ecdsaKeyFactsInventory.js";
 import { parseThresholdEcdsaDerivationRoleLocalBootstrapValue } from "./thresholdEcdsa.js";
+import { WALLET_MANAGEMENT_PROTOCOL_HEADER } from "../../../shared-ts/src/utils/walletManagementProtocol.js";
 import { parseWalletAddSignerChainTarget, parseWalletAddSignerEcdsaWalletKey, parseWalletEd25519YaoSignerPublicResult, parseWalletRegistrationFinalizeAuthority, parseWalletRegistrationFinalizeAuthorityBranch, parseWalletRegistrationFinalizeDiagnostics, parseWalletRegistrationFinalizeResponse, requireResponseParticipantPair, requireResponseRpId, requireResponseSafeInteger, requireResponseString } from "./walletRegistrationTerminalResponse.js";
 //#region src/core/rpcClients/relayer/walletRegistration.ts
 /**
@@ -109,7 +111,10 @@ async function postJson(args) {
 	const maxAttempts = walletRegistrationPostMaxAttempts(args.path);
 	for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
 		const response = await fetch(`${normalizeRelayerBaseUrl(args.relayerUrl, { trim: false })}${args.path}`, buildRelayerJsonPostRequestInit({
-			headers: args.headers,
+			headers: {
+				...args.headers,
+				[WALLET_MANAGEMENT_PROTOCOL_HEADER]: "2"
+			},
 			body: args.body,
 			bodyJson: requestBody
 		}));
@@ -1166,6 +1171,7 @@ function normalizeWalletRegistrationSetupRequestForBinding(request) {
 	const signerSelection = registrationSignerSetSelectionFromPlan(signerPlan.value, { normalizeEcdsaChainTarget: normalizeWalletRegistrationSetupEcdsaChainTarget });
 	if (!signerSelection.ok) throw new Error(`Wallet registration setup request signerSelection is invalid: ${signerSelection.message}`);
 	return {
+		wallet: request.wallet ?? { kind: "server_allocated" },
 		authMethod,
 		signerSelection: signerSelection.value
 	};
@@ -1475,14 +1481,6 @@ function parseWalletEcdsaKeyFactsInventoryResponse(args) {
 		diagnostics: readWalletRegistrationResponseField(response, "diagnostics", responseName)
 	};
 }
-/**
-* `POST /wallets/register/setup` — the single admitted entry point replacing
-* the grant, intent, and start calls below.
-*
-* It is called *before* the WebAuthn create prompt, because its response
-* carries the challenge that create must sign. The server-side preparation
-* therefore overlaps the user's authenticator interaction.
-*/
 async function setupWalletRegistration(args) {
 	const publishableKey = String(args.auth?.publishableKey || "").trim();
 	const environmentId = String(args.auth?.environmentId || "").trim();
@@ -1491,7 +1489,13 @@ async function setupWalletRegistration(args) {
 		code: "invalid_body",
 		message: "registration setup requires a publishable key and environment id"
 	};
-	const normalizedRequest = normalizeWalletRegistrationSetupRequestForBinding(args.request);
+	const request = normalizeWalletRegistrationSetupRequestForBinding(args.request);
+	const scopeDigest = await registrationSetupScopeDigest({
+		relayerUrl: args.relayerUrl,
+		publishableKey,
+		environmentId
+	});
+	const attempt = await registrationSetupRepository.begin(scopeDigest, request);
 	const parsed = parseWalletRegistrationSetupResponseV2(await postJson({
 		relayerUrl: args.relayerUrl,
 		path: WALLET_REGISTRATION_SETUP_PATH,
@@ -1501,9 +1505,10 @@ async function setupWalletRegistration(args) {
 			[ROUTER_API_ENVIRONMENT_ID_HEADER]: environmentId
 		},
 		body: {
-			...args.request.wallet ? { wallet: args.request.wallet } : {},
-			signerSelection: normalizedRequest.signerSelection,
-			authMethod: normalizedRequest.authMethod
+			registrationOperationId: attempt.operationId,
+			wallet: request.wallet,
+			signerSelection: request.signerSelection,
+			authMethod: request.authMethod
 		},
 		...args.onServerTiming ? { onServerTiming: args.onServerTiming } : {}
 	}));
@@ -1511,8 +1516,9 @@ async function setupWalletRegistration(args) {
 	await assertWalletRegistrationSetupRequestBindings({
 		response: parsed,
 		...args.request.wallet ? { requestedWallet: args.request.wallet } : {},
-		request: normalizedRequest
+		request
 	});
+	await registrationSetupRepository.accept(attempt, parsed);
 	return parsed;
 }
 async function createWalletAddSignerIntent(args) {

package/dist/esm/core/rpcClients/relayer/walletRegistrationTerminalResponse.js

@@ -1,8 +1,8 @@
 import { parseThresholdEd25519SessionId, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { requireRouterAbEd25519NormalSigningState } from "../../../shared-ts/src/utils/signingSessionSeal.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { parseNearEd25519SigningKeyId, walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey } from "../../signingEngine/interfaces/ecdsaChainTarget.js";
 import { normalizeThresholdRuntimePolicyScope } from "../../signingEngine/threshold/sessionPolicy.js";
@@ -639,7 +639,6 @@ function parseWalletRegistrationFinalizeResponse(args) {
 			if (response.ecdsa !== void 0) throw new Error(`${responseName} response mixed signer branches`);
 			const near = parseWalletRegistrationFinalizeNearResult({
 				response,
-				walletId,
 				authority
 			});
 			if (authorityBranch.kind === "passkey") return {

package/dist/esm/core/signingEngine/assembly/createManagers.js

@@ -12,7 +12,7 @@ import { getWorkerTransport } from "../workerManager/workerTransport.js";
 import { UserPreferencesManager } from "../session/userPreferences.js";
 //#region src/core/signingEngine/assembly/createManagers.ts
 function createManagerAssembly(args) {
-	const touchIdPrompt = new TouchIdPrompt(args.seamsWebConfigs.wallet.iframe?.rpIdOverride, true);
+	const touchIdPrompt = new TouchIdPrompt(args.seamsWebConfigs.wallet.iframe?.rpIdOverride);
 	const userPreferencesManager = new UserPreferencesManager({ store: args.stores.userPreferencesStore });
 	const chains = args.seamsWebConfigs.network.chains;
 	const nonceCoordinator = createNonceCoordinator({

package/dist/esm/core/signingEngine/assembly/ports/shared.js

@@ -1,6 +1,6 @@
 import { resolvePrimaryNearRpcUrl } from "../../../config/chains.js";
 import { loadSecp256k1EngineCtor, loadSignEvmFamilyWithUiConfirmForTempo, loadSignEvmWithUiConfirm, loadWebAuthnP256EngineCtor } from "../../flows/signEvmFamily/signerLoader.js";
-import { prewarmSignerWorkers, warmCriticalResources } from "../warmup.js";
+import { warmCriticalResources } from "../warmup.js";
 //#region src/core/signingEngine/assembly/ports/shared.ts
 function resolveNearRpcUrl(args) {
 	return resolvePrimaryNearRpcUrl(args.seamsWebConfigs.network.chains);
@@ -30,7 +30,6 @@ function createManagerConveniencePortsFactory(args) {
 	const { createArgs, getWorkerResourceWarmupDeps } = args;
 	return () => ({
 		signTempo: createArgs.signTempo,
-		prewarmSignerWorkers: () => prewarmSignerWorkers(getWorkerResourceWarmupDeps()),
 		warmCriticalResources: (accountContext) => warmCriticalResources(getWorkerResourceWarmupDeps(), accountContext)
 	});
 }

package/dist/esm/core/signingEngine/assembly/warmup.js

@@ -26,10 +26,6 @@ async function resolveWarmupSignerSlot(accountId, store) {
 		return null;
 	}
 }
-function prewarmSignerWorkers(deps) {
-	if (!shouldPrewarmWorkers(deps)) return;
-	deps.prewarmWorkers().catch(() => {});
-}
 async function warmCriticalResources(deps, accountContext = { kind: "none" }) {
 	const accountBinding = accountContext.kind === "near_account_bound" ? accountContext.account : null;
 	const accountId = accountBinding ? toAccountId(accountBinding.nearAccountId) : null;
@@ -63,6 +59,6 @@ async function warmCriticalResources(deps, accountContext = { kind: "none" }) {
 	};
 }
 //#endregion
-export { prewarmSignerWorkers, warmCriticalResources };
+export { warmCriticalResources };
 
 //# sourceMappingURL=warmup.js.map